last executing test programs: 20.042801015s ago: executing program 3 (id=8441): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x2000, 0xab00, 0x0, 0x7, {{0x5, 0x4, 0x0, 0x13, 0x14, 0x20, 0x0, 0x2b, 0x2f, 0x0, @empty=0x2f, @multicast1}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="2daa000000000000711012000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="2daa000000000000711012000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) 19.913314781s ago: executing program 3 (id=8442): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x60) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)=0x0) connect$nfc_llcp(r2, &(0x7f00000002c0)={0x27, r3, 0xffffffffffffffff, 0x3, 0x0, 0x97, "b84735426d403e0999f4f52662c50ea7f2809e50527281e05eeb932ca4ec2daf6da8e89aef93e1e656c8ac865235e89896c53fcdad791a975a29d5bb184f1a", 0x4}, 0x60) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000000)={0x40, r4, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x1, 0x3c}, @val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'pim6reg0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0x403, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800, 0x55007}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}, @IFLA_IPVLAN_MODE={0x6}, @IFLA_IPVLAN_FLAGS={0x6, 0x2, 0x6}, @IFLA_IPVLAN_FLAGS={0x6}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) 19.834993155s ago: executing program 3 (id=8445): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002"], 0x7c}}, 0x0) r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000440)={0x0, 0x0, 0x3, 0x1}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001040)=ANY=[@ANYBLOB="12000000020000000400000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r2}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r1}, 0x20) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000000080)={r2, &(0x7f0000000040)}, 0x20) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001840)={0x0, 0x4, 0x80000001, 0x1}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000060a0b040000000000000000020000000900020073797a32000000006c000480680001800b00010074617267657400005800028040000300cd4b6abe42030763d02899c7e9ee2bcc9b6a37b458a8056dd9a87f963d140d7a9d3ac869f3a860917523679abf4579f9cd65080000000000000000000a000100484d41524b00000008000240000000000900010073797a30"], 0xc0}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000001c40)={0x0, 0x7, {0x80000000, @struct={0x800, 0x1}, r3, 0x0, 0x3, 0x6, 0x35, 0xffffffffffffffff, 0x428, @usage=0x7, 0x3, 0x6a, [0x7, 0x1, 0x8, 0x7ff, 0x7, 0x10]}, {0x5, @struct={0xfffeffff, 0x6}, 0x0, 0x6, 0x0, 0xdf4, 0x96, 0x5, 0x25, @struct={0x1, 0x1}, 0x9, 0xfffffffe, [0x3, 0x18, 0x2, 0x200, 0x7fffffff, 0xa]}, {0x7, @usage=0x1dd58437, r3, 0x4, 0x1, 0x80000001, 0x4, 0x8, 0x84, @struct={0x3, 0x7}, 0x84d, 0x5, [0xfffffffffffffff8, 0x16, 0x3, 0x7, 0xa01, 0x1c00000000]}, {0x5, 0x3}}) getsockopt$ax25_int(r0, 0x101, 0x3, &(0x7f0000000000), &(0x7f00000000c0)=0x4) r5 = socket$inet6(0xa, 0x80001, 0x0) syz_emit_ethernet(0x2b, &(0x7f00000003c0)={@local, @dev, @void, {@arp={0x806, @generic={0x6, 0x6004, 0x6, 0x4, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 'EzVL', @multicast, "5c917b8e44"}}}}, 0x0) ioctl(r5, 0x8100, &(0x7f0000000100)="28af204d001c3d3346eb2042cf71f1b089d76a6beb04cec6acfe90946e1904d144c4891a3c1d5ae0748a3e21f1f89a9fb597d5d2ec106f12a79f17e246f85c272652afb473a00b5a8b8fc9a47114e68ed2ba8eabc46b801c40236e8480a9d59563887331577a056962ede695b81d545f084f639e0d70c9fd2a9781aaf68095f56e70e744baea4618096aa71c0d6ae015ac947b9aeab6617b82dbd179162a9ec878770f7d5b935d1844eabe5d93b85e3605d3a964ea30703c4dd3b174b6f5dbb0d7") setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x2a, &(0x7f0000fca000)={0x5, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x0, @empty, 0x8}}}, 0x108) syz_emit_ethernet(0x42, &(0x7f0000000040)={@broadcast, @broadcast, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0xa, @broadcast, @ipv4={'\x00', '\xff\xff', @empty}, @empty, @empty}}}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000040)=ANY=[], 0x190) 19.669166685s ago: executing program 3 (id=8447): r0 = socket(0x10, 0x80002, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYRES8=r0, @ANYRES32=0x0, @ANYBLOB="00000000000100001c0016801800018014000a00ff03acb172310000000008e7ffffffff08001b"], 0x44}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140012"], 0x48}}, 0x400400c0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 19.617768429s ago: executing program 1 (id=8448): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = gettid() r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r3 = gettid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}}}, &(0x7f0000000180)=0xe8) r5 = openat$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.max.depth\x00', 0x2, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000780)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000740)={&(0x7f0000000200)={0x524, 0x16, 0x100, 0x70bd26, 0x25dfdbff, {0x14}, [@typed={0x8, 0xa8, 0x0, 0x0, @u32=0x4}, @nested={0xa6, 0x109, 0x0, 0x1, [@nested={0x4, 0x52}, @nested={0x4, 0xd1}, @nested={0x4, 0x12b}, @generic="d3ce6ebc0c148a15c376397513d3c66a9f17afdd695ac1f89ae955b3de404921dd69e751bbb05ce777028ee2591c2623c9302d79adf53493fe9eeb782926a3bad7046f50d58be083554f77a6c69bfd002f1465f3c1a6742e9451", @typed={0x3b, 0x75, 0x0, 0x0, @binary="e7f4bb63533335c7b68498bd31b65689826be6a3cf28d2ab031f115661428119356e88198a3744fc4da43bc8c52481d900169408f92d2b"}]}, @nested={0x100, 0x12d, 0x0, 0x1, [@nested={0x4, 0x2e}, @generic="dadef513a727402671277f071bc2d5770174941d40fa594038626426d26d62761d2ada6211ae67b0b783bf6df024ab974bde98b71eff8182ca0523c17374d235e98ddb68ba5013d1faade5141b32c1a38fa335dbf982d9fcb03391b327add0ed8ebd01fe41c88e263df76289ba4f73f75421b7474ce97eee22eaed81a4c7df6afa7e1f06b315bee7c71b59018e0c1a4b090e5e04e2796741097c6c9ee66ac530dec3786aa7ed0ee9f74901223f8fc376919f64bbe839a791a59ecea0b1bf703c69bec5a2da0a0d41e40f02a64e3103fb1599850aade0e11fbea1d3f2e622305219396c515d6ca062e352023e0733869eb037d1260302c62d"]}, @nested={0x154, 0x7f, 0x0, 0x1, [@typed={0x8, 0x144, 0x0, 0x0, @pid=r1}, @typed={0x8, 0x1e, 0x0, 0x0, @fd=r2}, @nested={0x4, 0xe9}, @typed={0x14, 0x22, 0x0, 0x0, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}}, @nested={0x4, 0x11c}, @generic="71323d63109a1de2f85602c069140903d4305beba001055d0a234ea4922f68df96cb919d775de75a90ea0cd9cf9498564c4a66ed1a77ca6a186c8f2bb842f28072acd464488da1e1c469", @generic="4dfddf6389b1a0df79f11f6b44201f93338127bdd8e33a6c973772980e9e0cdfcf872bccf1ecdb0085ea5a968d64366f3647998ee32260677f2d2df8d29a34b34b9808df65836c7538ac3c8eb139ad22355dc648126b18a18d81026c6cbe67144998d4618e81c2358fa75ff51d99daeb885f56314c1ebb18853680c3b487061e043289a822aaa672e660d04cfc3f4672aa0b59d3eac0160e3f130912980a964ff373a2d31c71bad3b4e8753f75a1e8e1b5443104c86aab48fe723e7a0e17dc9ddf262fb8d3a85a8eebfc2f905f07ba442982", @typed={0x8, 0x49, 0x0, 0x0, @pid=r3}]}, @nested={0x126, 0x72, 0x0, 0x1, [@typed={0x14, 0x14e, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x36}}, @typed={0x8, 0x14a, 0x0, 0x0, @uid=r4}, @nested={0x4, 0x11a}, @typed={0x8, 0x3e, 0x0, 0x0, @fd=r5}, @nested={0x4, 0xe6}, @nested={0x4, 0x7f}, @nested={0x4, 0xf4}, @generic="7616efe606658a975cba9a5440d63d577bbe7a4578619f38f585d694ec64166a58214339bd2ec15add440c64d21229ba40e4c0e8fc3407b4dadff52a3ef7416d8b542c2e789331f00ad26784f5e3f2a12eadaf4c54723db41a039da4eb801686052d5a1e6c853c7f55cea1e1048622a4ec779f987f0a63550ba589318f493b3ce292e18354335ebf4ff96bfa1c225ef1429df69ca634e1584a8fcf089b912de440ba", @generic="6ba6aafd3f2b8439ad14f938a939abe98bc12108c7f5ca61578dc572725f4bf1803aba3aa0e72ed59430c4fbc08f1d609fd5576db4c9a239632886b1a65c47dad8b75c8ec5c0af3e02af8fdf"]}, @generic="bc8efdf95fd99655d511cd1793e669f3bb6b0edac769ab878e72fe42bcd7f2408a1c461530e1a50dac8ec35808299bc106b823b2cf668798cab5f129229f419a3793", @nested={0xa0, 0x72, 0x0, 0x1, [@typed={0x9a, 0x12d, 0x0, 0x0, @binary="fd5e56b723298dbdfa566680b1315ca18ebedd298d03e098732e5639518360587386358b37b70241162baf65b69eedde44cd944ff7d07383402172941fae9cc999df8a2f5534b49fc6ed3173376eab70be0a40a786cffa6411e02956bdcd4a17b26dcbc367e94c3af4c63495fa6ebce340675822baa2612bb1328c5ac0ea51550771377a634eb3b4f1fb650d004192d2909bb879a474"}]}]}, 0x524}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)=@ipv4_getroute={0x1c, 0x1a, 0x300, 0x70bd27, 0x25dfdbff, {0x2, 0x0, 0x10, 0x7, 0xfd, 0x3, 0xc9, 0x2, 0x2200}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0xd0) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r2, 0x8002f515, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000940)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'wpan1\x00', 0x0}) r10 = gettid() r11 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r6, &(0x7f0000000a80)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x70, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_PID={0x8, 0x1c, r10}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r11}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x70}, 0x1, 0x0, 0x0, 0xc0}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r6) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000b00), &(0x7f0000000b40)=0xc) ioctl$INCFS_IOC_FILL_BLOCKS(r2, 0x80106720, &(0x7f0000001080)={0x7, &(0x7f0000000f80)=[{0x3, 0xab, &(0x7f0000000b80)="2418db34f435365634ede0eaf161be8e08e941a79d3736a936375df34d4088c6f1366c969cf8fe4cb054ba2c5163c4aab11fc66cfe27d9d2a024bab7109b344b9f35d6628d029b5ddf80bb137a1b74aafe108669d4442382cd246b1cbf712964246ba52c2c37fd9cc2c1e0c5b58e4a4c2bb14900bc64b533868d82227e6fe9199a5f8dcf82f45d1ab69a6ea5cb0e4db01f68c5d682d1f1818ec30a6093069eb0e46e8dc3afe012155669de", 0x1}, {0x6, 0x10, &(0x7f0000000c40)="5504f6d376aec8da9a0a5d0c8c33df0c", 0x1}, {0xa2, 0xbb, &(0x7f0000000c80)="550d2178972c0113d7ef52093ab3e824073f5cb5701175bab69941b58d0c724a8ab36ddd8965cc90b45754da24711746a80e22ca258ac6ce659938db8939505850afa86b3bda87dc2d996d78a442c0d30e322119290930ba931b2550c9dd071b4bee1024c2b51d15432b6ddd6257895526a7cc13c61ae5fbcf2eab58571fcc48fe3e32b3cd7cf85f803848d947f22764f0fe7b8b0efe288868d28183c174d866ec0ff9d08907d23fab6cbdcb1dd5c126410c3035ffe920d8a997c2", 0x0, 0x1}, {0x5, 0xf1, &(0x7f0000000d40)="ffba9b6a8ed58ade6ab1a175d61f6c7b33676460ab0411e434286ccb55cb7410e62b030eb6d7d54c7d6705d9b55738d2b3e2f69f61af7ee8fb46a6a4b884f0b75c4480615e3a6d9f596fcfcff168f982bb881cd5de93ca59762d3a220909d0aac24dbcc5f1165470adfb04b561a6e40eeaee902a184931e12fbc2ef99d997dc87a5a0e5be74a8f9b97c1acc74e84d2da96847ce2a70861ee7f1877639d013a842cdb1c03e19c91581f8ce416a3c8395c06a2d1978edf891387b60527d87404b97053f68f55767e359b25000d04be50b6a4de753ff1731545b8a7dd71c3d2398899ee81e84eab0711cab0e1253b1edfe143", 0x1, 0x1}, {0x5170399d, 0x1c, &(0x7f0000000e40)="aa50fd8fe80a37ad0cd6817a962ce7d2672b984bbe2f6730c0234a1e", 0x0, 0x1}, {0x6, 0x66, &(0x7f0000000e80)="d39eb5adf86bd08e6fbb233213276576a1978965c791e33e41f35cd9ad4369695e451ff360747490d77e4961add75e8f6ab6fcfa091524e5daae7b240e98b8d2ab45cdabc85125f6619fb363893822743f99a7cef378ca757f39af694394f381a8d071646a16"}, {0x6, 0x65, &(0x7f0000000f00)="06ae48bea3ef29ec1e549a7c39b9e88f4e6c50fe36a8f2b0a757208d362b13e9dd36edabddad41ccf53e0d3c94f98c47e8a62527a0d7ff87ea3158be2f4821361300a5365ee2b10d2b56ee5fd963cc8903999918358c66fe3a7f4a4cbea677e27597c5d2d4", 0x1}]}) r12 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001100), r6) sendmsg$NL802154_CMD_GET_INTERFACE(r6, &(0x7f00000011c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x20, r12, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}}, 0x24008000) splice(r5, &(0x7f0000001200)=0xc2, r11, &(0x7f0000001240), 0x400000000, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000001280)=""/221, &(0x7f0000001380)=0xdd) sendmsg$NL802154_CMD_DEL_SEC_DEV(r6, &(0x7f0000001500)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000014c0)={&(0x7f0000001400)={0x88, r12, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0002}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0102}}}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x88}, 0x1, 0x0, 0x0, 0x20008090}, 0x40050) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001980)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001900), &(0x7f0000001940)='%-010d \x00'}, 0x20) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000019c0)={&(0x7f0000001540)="676f844147312f962c97fbb8b47e57128cb18757d813e138a6cd9f8d988b31e3effde0b14837355b5bfa8191d53ea63e5e2ca709bb3adeabb73a10ebaaebc99a442975bfd0ff9c047cb15cc49676cbcbffb24abbcef6a98e51ccd1503bd1e71bd6f9fb0e6bb2e82856ebd6fa797580e1efc07b1131768732911479c264a3a8e215d42385b41a7592276197cb4a60e801127d01791b3bafaa88fbcaa6ac7618587b636250ed478b0b7e0155ccaebd461b73fbcaff300f2783fcc56dc16a4851518af287ac7290414f48459c4f5019e24600c6bbd9519353f6433262ebee9916", &(0x7f0000001640)=""/145, &(0x7f0000001700)="631225cffebc20e9d72f551fceb30fea4ad8e221de598009a851e30326a0f11273731e3660ce24135bc5647e23faf35ff30eee3be8a44ea4857b9003fbc1ba4ed4740df1d40cea97eae69afdd08763e8468b30e37cb9b95d1818690f78884c17e343f8aed2808ac5b7b482708d05d660f67010cd213e75a5086bf3ed8ef97a5ec5a81a543121f317bf7cc40827cdbeb3ef8f99493be9b6114e1db08eef67910a017e461e6f26acb853a205ad0b53fd2a57f7738c62bfeb22d5c6f37dd9d32dad2a53cc1395a2a90d1f7ca0ef1fb8d7e1658a49f4cba0a4d86bc9355e1f25923da5fe4cd2d10bbcd0d0236c8c805834d206", &(0x7f0000001800)="62e8a517c4f534349004c09b503ea17f1de89af60a80801aa7965069d5413c7a13c2470f471ae2fee8ecc39137e7bb9ed61d4be4fb59e09e2694969949852c55877669bc0d9de5a875fff7808461b2f291bf0f6c671097f517877c3e4360bc43e2b1570b23b6d72ffe837911b7919d5bd4cc3815747ab860045bfad1b0a9b36859ca7b7406971cf1f4ce4c08908d9da7c8daf3f3fc1af7a474e6d28e40fd4fe7f3beb97f49a36cc1e9d915f6e84aeb93caccbff5b78c7cdc35f823cce8ad35802f5bd19881ede62f22cb24fcc75c7424e8265662eea1c6a5c795a12356b9a599e4e5dd7af43b539aea2d2489c98ee134cbc51919", 0xb391, r13, 0x4}, 0x38) sendmsg$NET_DM_CMD_STOP(r6, &(0x7f0000001ac0)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a40)={0x14, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) r14 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001d00)={&(0x7f0000001bc0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x5c, 0x5c, 0x6, [@ptr={0x4, 0x0, 0x0, 0x2, 0x5}, @ptr={0x4}, @const={0xa, 0x0, 0x0, 0xa, 0x1}, @struct={0x3, 0x2, 0x0, 0x4, 0x1, 0xf28b, [{0x6, 0x0, 0x7}, {0x7, 0x3, 0x7}]}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x9, 0x2}]}]}, {0x0, [0x5f, 0x2e, 0x0, 0x61]}}, &(0x7f0000001c40)=""/139, 0x7a, 0x8b, 0x0, 0x10, 0x10000}, 0x28) r15 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001e00)=@o_path={&(0x7f0000001dc0)='./file0\x00', 0x0, 0x8, r5}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001ec0)={0x18, 0xc, &(0x7f0000001b00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x1d}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffd8}}]}, &(0x7f0000001b80)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x13, '\x00', 0x0, 0x0, r14, 0x8, &(0x7f0000001d40)={0x2, 0x2}, 0x8, 0x10, &(0x7f0000001d80)={0x3, 0x10, 0x800, 0x41}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000001e40)=[r13, r13, r13, r13, r15, r13, r13], &(0x7f0000001e80)=[{0x4, 0x3, 0xf, 0x9}, {0x5, 0x1, 0x9, 0xb}], 0x10, 0x1}, 0x94) 19.485264378s ago: executing program 1 (id=8450): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xffffffffffffff46, &(0x7f0000000080)={&(0x7f0000000140)={0x20, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL]}, 0x20}, 0x1, 0x0, 0x0, 0x801}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004002000080020"], 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x8}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'hsr0\x00'}, @IFLA_TXQLEN={0x8, 0xd, 0x1}]}, 0x3c}}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) splice(r5, 0x0, r4, 0x0, 0x406f413, 0x0) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000002000000000000000008500000061000000850000007d00000095"], &(0x7f0000000200)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r6, 0x27, 0x14, 0x0, &(0x7f0000000140)="f80204000000000000007f530800d31e0edf4dd3", 0x0, 0x405, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001e00010000000000000000000710"], 0x1c}}, 0x0) readv(r1, &(0x7f0000001840)=[{&(0x7f0000000200)=""/24, 0x18}], 0x1) sendmsg$NFT_MSG_GETSET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000a0a0500000000000000000000200001"], 0x14}, 0x1, 0x0, 0x0, 0x4004881}, 0x40000) 18.176113976s ago: executing program 3 (id=8452): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r1, 0x101, 0x70bd27, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dddbfb, "", [@nested={0x104, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac05}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x41}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 18.067909973s ago: executing program 3 (id=8455): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f00000001c0)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @dev}, 0x10) listen(r0, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r4], 0x1c}}, 0x0) write$nci(r1, &(0x7f0000001800)=ANY=[@ANYBLOB="7240082b0102020681055a03997713fa06070202267a"], 0x16) close(0x4) 18.017115167s ago: executing program 1 (id=8456): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) (async) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000180), 0x4) setsockopt$MRT_FLUSH(r1, 0x0, 0xd1, &(0x7f0000000040), 0x4) (async) setsockopt$MRT_FLUSH(r1, 0x0, 0xd1, &(0x7f0000000040), 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) socket(0x2a, 0x2, 0x0) (async) r3 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newtfilter={0x50, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x1c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0xfffffff8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}]}}]}, 0x50}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) bind$netlink(r2, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=@delnexthop={0x20, 0x69, 0xb, 0x0, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'sit0\x00', &(0x7f0000001000)={'syztnl2\x00', 0x0, 0x0, 0xa000, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x0, 0x4, 0x0, @empty, @rand_addr=0x3}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'sit0\x00', &(0x7f0000001000)={'syztnl2\x00', 0x0, 0x0, 0xa000, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x0, 0x4, 0x0, @empty, @rand_addr=0x3}}}}) 17.848746557s ago: executing program 1 (id=8460): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e2, &(0x7f0000000300)) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) 17.72838567s ago: executing program 1 (id=8462): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0x58) (async) r1 = socket(0x2d, 0x2, 0x0) setsockopt$netrom_NETROM_T1(r1, 0x11d, 0x1, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x280842, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x6, 0x0, 0x0) 17.628470858s ago: executing program 1 (id=8464): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x8b21, &(0x7f0000000040)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x19, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x1d}, {@in6=@private1, 0xfe, 0x32}, @in6=@empty, {0x3, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x7fffffff, 0x543}, {0x4, 0x7fffffffffffffff}, {0x2}, 0x70bd2c, 0x3500, 0xa, 0x1, 0x0, 0x50}, [@encap={0x1c, 0x16, {0x7, 0x4e24, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) clock_gettime(0x0, &(0x7f0000003340)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003240)=[{{&(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000240)=""/190, 0xbe}, {&(0x7f0000000300)=""/143, 0x8f}, {&(0x7f00000003c0)=""/136, 0x88}], 0x3, &(0x7f00000004c0)=""/80, 0x50}, 0xfffffffc}, {{&(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000600)=[{&(0x7f00000005c0)=""/41, 0x29}], 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000640)=""/1, 0x1}, {&(0x7f0000000680)=""/228, 0xe4}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/255, 0xff}, {&(0x7f0000001880)=""/216, 0xd8}, {&(0x7f0000001980)=""/128, 0x80}, {&(0x7f0000001a00)=""/24, 0x18}, {&(0x7f0000001a40)=""/116, 0x74}, {&(0x7f0000001ac0)=""/130, 0x82}], 0x9, &(0x7f0000001c40)=""/255, 0xff}, 0x6}, {{&(0x7f0000001d40)=@nl=@proc, 0x80, &(0x7f00000030c0)=[{&(0x7f0000001dc0)=""/171, 0xab}, {&(0x7f0000001e80)=""/4096, 0x1000}, {&(0x7f0000002e80)=""/233, 0xe9}, {&(0x7f0000002f80)=""/164, 0xa4}, {&(0x7f0000003040)=""/109, 0x6d}], 0x5, &(0x7f0000003140)=""/222, 0xde}, 0x2}], 0x4, 0x100, &(0x7f0000003380)={r2, r3+60000000}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {0x7a}, [{0x78, 0x1, [@m_police={0x74, 0x1, 0x0, 0x0, {{0xb}, {0x48, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c}, @TCA_POLICE_RESULT={0x8, 0x5, 0x20000000}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x8c}}, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x2, &(0x7f0000000100)=@netrom={'nr', 0x0}, 0x59) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r7, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2, 0x3}, @TCA_FQ_QUANTUM={0xffffffffffffff0f}]}}]}, 0x48}}, 0x0) r11 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) write$cgroup_subtree(r11, &(0x7f0000000080)=ANY=[@ANYBLOB="2d626c6b696f202b696f202b696f202d626c6b696f202b6e6574202b6370757324e9b1a8f6dc30ed636c732002000000000000002b68756765746c6220"], 0x3d) ppoll(&(0x7f00000033c0)=[{r5, 0x702}], 0x1, &(0x7f0000003400), &(0x7f0000003440)={[0xe4]}, 0x8) getpeername$inet(r4, &(0x7f0000003480)={0x2, 0x0, @multicast2}, &(0x7f00000034c0)=0x10) 16.95401609s ago: executing program 2 (id=8477): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000001000050400"/20, @ANYRES32=r2, @ANYBLOB="ebffffffffffffff280012800b00010065727370616e0000180002800400120005001600010000000800150000000076"], 0x48}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000000000000691165000000000085100000020000008500"/48], &(0x7f0000000040)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', r2, @fallback=0x17, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x20}, 0x94) 16.924371675s ago: executing program 2 (id=8480): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000001e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x120, 0x18, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_FLOWTABLE_HOOK={0xf4, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve1\x00'}, {0x14, 0x1, 'veth0_to_team\x00'}, {0x14, 0x1, 'pim6reg0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK_DEVS={0x4}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syzkaller0\x00'}, {0x14, 0x1, 'dvmrp1\x00'}, {0x14, 0x1, 'ipvlan1\x00'}, {0x14, 0x1, 'hsr0\x00'}, {0x14, 0x1, 'batadv_slave_1\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x40}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bridge_slave_0\x00'}, {0x14, 0x1, 'macsec0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x102}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}]}], {0x14}}, 0x148}}, 0x0) 16.800382355s ago: executing program 2 (id=8484): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x12, 0xc, 0x8, 0x3}, 0x48) r5 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r4, &(0x7f00000000c0), &(0x7f0000000000)=@udp6=r5}, 0x20) recvmmsg(r5, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/8, 0x8}], 0x1}}], 0x2, 0x10001, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001300)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x10}, {}, {0x6, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0xffffffff, 0x1, 0x0, 0x400, 0x3, 0x5, 0x5, 0xb762, 0x6, 0x7, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x800, 0xfffffffe, 0x6, 0x401, 0x9, 0xb89, 0xffffe4f5, 0x7, 0x4, 0xffff, 0x7, 0x0, 0x2, 0x101, 0x1, 0xfffffffc, 0x4, 0x1, 0x1, 0x9, 0xc, 0xfff, 0x2, 0x2, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x5, 0x9, 0x44, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x80000001, 0x7, 0x8, 0xfffffa72, 0xcd, 0xffffff7d, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x0, 0x9, 0xf, 0x7, 0xc28, 0x9, 0x8, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x5, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0x60000000, 0x1, 0x1, 0x1, 0x7, 0x7fffffff, 0x7, 0xe, 0x8000, 0x1, 0x45c, 0x80, 0x3, 0x7fffffff, 0xff, 0xa0, 0xa7, 0xf, 0x2, 0xfffffffd, 0x3, 0x1000, 0xfe, 0x401, 0xf8a, 0x80000000, 0xffff, 0x6, 0x5, 0x4, 0x2, 0x80000000, 0x1966f9ab, 0x5, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa89, 0x40, 0x2, 0xfffffffe, 0x7, 0x101, 0x2d5421e8, 0x7, 0x10000, 0xffffffff, 0xed, 0x32, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x7, 0xffffffff, 0x1, 0x0, 0x0, 0xfffffffe, 0x5, 0x8, 0x3, 0x4, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x5, 0x5, 0x4d15, 0x1ff, 0xfffff060, 0x3, 0x469, 0x3, 0x0, 0x200, 0x5, 0x7, 0x1, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x57, 0x6, 0x4, 0x400, 0xa000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0xfff, 0x1ff, 0x8000, 0x3, 0x8, 0x3, 0x9, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x3e, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0x0, 0x9, 0x0, 0x4, 0x10, 0x143, 0x5, 0x2, 0x7b, 0x6, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x4, 0x1, 0x6, 0x200, 0x2]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$packet(0x11, 0x3, 0x300) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffff7, 0x7fffefff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r10, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r12, {0x3}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x80, '\x00', 0x8, 0x461b, 0xa, 0xfffffff9}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x480d8}, 0x4000000) socket$unix(0x1, 0x1, 0x0) 16.436953631s ago: executing program 0 (id=8490): r0 = socket(0x2b, 0x2, 0x2) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='blkio.bfq.sectors\x00', 0x0, 0x0) (rerun: 32) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r1, 0x110, 0x5, &(0x7f0000000200)=[0x2, 0x4], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r3, &(0x7f0000000080)="0ab390107f", &(0x7f0000000000)=""/10, 0x2}, 0x20) (async, rerun: 32) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000001000000000", @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB='\x00\x00\x00@\x00'/28], 0x50) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x10, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r4, @ANYRES32=r4, @ANYBLOB="0000000000000000b705070008fb190085000000a00000009500000000000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000000cc0)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) (async) connect$l2tp6(r5, &(0x7f00000001c0)={0xa, 0x0, 0xafb, @mcast1, 0x2, 0x1}, 0x20) r6 = socket$kcm(0x2, 0x5, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) (async, rerun: 32) socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 32) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$rds(0x15, 0x5, 0x0) (async) setsockopt$inet6_int(r7, 0x29, 0x43, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0x3, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3fc, 0x40000000, 0x7, 0x80000000000, 0x0, 0x20, 0x80000000, 0x104}, 0x0, 0x0) (async) setsockopt$sock_attach_bpf(r6, 0x1, 0x7, &(0x7f0000000440), 0x4) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c0000001000010000003a080000000000000000", @ANYRES32=r9, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028014001000fc02000000000000000000000000000106000f"], 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7050000000000ff89107d0000000000750500002000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9808837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8abef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb186ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) (async, rerun: 32) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x45) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="d700000001000000bf"], 0x0, 0x7}, 0x94) 16.416733701s ago: executing program 0 (id=8492): r0 = socket(0xa, 0x5, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x26}}, 0x6}]}, &(0x7f0000000100)=0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r3, 0x8b2c, &(0x7f0000000040)) ppoll(&(0x7f00000001c0)=[{r2, 0x8038}], 0x1, &(0x7f00000003c0), 0x0, 0x0) r4 = socket$kcm(0x11, 0x2, 0x0) r5 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000015"], 0x34}, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) recvmsg$can_bcm(r8, &(0x7f0000000380)={&(0x7f0000000200)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @empty}}}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000280)=""/104, 0x68}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f00000014c0)=""/138, 0x8a}, {&(0x7f0000001580)=""/137, 0x89}], 0x4, &(0x7f0000001640)=""/199, 0xc7}, 0x10000) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}, {0x7}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, [0x8, 0x6, 0x3c, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}]}}]}, 0x8c}}, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000500)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000580)="02042700ea0e0000000000001eafbcf706e105000000000000001104ee1606d4b8bf4a828bda305775c43824cee8440000", 0x31}, {&(0x7f00000023c0)="29386c9ba0", 0x5}, {&(0x7f0000000080)="088d85d1f4b8220aee82e7932b326f8a3164ae439862807a1589836c736d2341f7", 0x21}, {&(0x7f0000000140)="df3b46263300"/19, 0x52}, {&(0x7f00000005c0)="b72abab9439ca41f5cf14d6435575ba774ee5f5c23ff2f5176f5773d08a15668ec280cfe4ea416cf769dbf978a8191bbe006e0da50029176c0f24e3ff4d3e895a2afbf52cef2fe1ca31edd842b126ec4be67e6e3624b9ddf806fc146c645ec1d37fe7e3b025c156d5d520104b53f7fb2af436201cfd5dca170edea5a190e4786bfaac544b60f514d7ef420526c467f14790dcfa5ab915d7dbcdf2765bbcad014c991f8b829c79f53586de79f0b987ad796f9de4a6e53136a07a39ab1f5a2ce30aded70a9b72d1beff7e8b6405fd6331e5635ee71e809be2d58f412dcd7b2e856d692dbfed19045ff13244acce351b6e450395568063569c71ea80a04f83fbe6ad1d0862fb97f816576c4844da65d751ee1fdc522ae1158670de297cdb2117bc0adc1486e016a6bcc922a162fce6a9ecc8c42b0c44c566004eda037864e5f339bbb0998cdaf2b8e49ae003659bc033668f7c8e550197ed95c420461254ba1883dbd9403672d579cee85c37f103ee9a350a768286017158784baeb063c8c684b91b022b0db2238b679092a1f6909f0cd9228500e088f5cc7bac4c0dc56e80fedac93554aec79715ce02e8bf3fcbd70382f619bfe3dcf06890d8542022ee58bdfb075d319c9fc8474cadc8de5c3dd3f682d3f68324d0af7a727064053ad84c94643eef190783c616467628f84620044c084b80e3e57bfcdf293c9c36b4474a52398b35e49e2ad4a4ac090bffc5cd27d3c69b4ae5f841d5b0766ccd36d25eb58d8f01621a05744b79ede39019ab9d7a1946353d8f3b7f833ce1a102a8c97a9e3f32138ffafd305448f2518ccdb7eef594a890eaeaff3f876f742fec22669a97085ed93b18228ecbe9e354e8f69967ca749fd2b1cf026665ca912e3fc0188b294519078b46676052de4fe22798290bd1e232c9791fc01ddb4ae776b5769143df2867042e8a3ddfa8e786bd8a244076956d4ab137939ad381650dd4fefd2b942a98d6f2edfd7019ae473e7608647b86d643e8ff3d7d4e89ed826e4b8c6e8fed224c528d805ade85c5b45261b2692c0f403dec050bd973b0999df214689f4402dd1598a16b0c7671e5e204a00b06376ddee7cb99292a8b835c0b451642b71f2ffa1aeea56255817b2384bfe4f8213ccfc1f762f250592896102e5f6d34cdd726bc0f86af52fd7c4483d32e23e5af770e960c7445b8e67b6086f0cadcd22d0d4bdadc31b5a94dd687379dc6e078210ccc71f8e67eb58d330394425ab17e55d1ca8f868f6bf738af291d2293c3dfa2ccff25061ded22878b3cc6532d19e5a00d1f0f1b9de35305fac2c6cfd5d77a2b02618735b7d392738bd5cd3eabb7039c790a9f193913f16e06605d405d6a0cf0011a2e5f935d8563fef1722692dd266c3d320b9f5eeb2a4b2f72155522f0ed72ff1efa0b6ee78e70d3d45241609e7f87d7bcfe1af71159baa11ad667a0ead3986b2b06500ba2615ee966ea86ca68d02de4802bd9ef18dac5ba53ca98b90df49ef4e3268ceee538973620e5a60513ea330989642626420b67dceebc569478657aedeb62c45b079348796923ad1fba5a99e6b150cf97ba2a570150053309c6dca7fa352fa1678c9b919fbc47ae0a84175a7fc25a00fa5888cb017e8d8225fadb29e34bd3c5bbccfb22a83255fec3967c991d5b3e6719ade82fb7ef85c8a4b9e7ad8ef2a3a7bc78de424572224affb1f9e0c5a969e61ee2ebb4f247bfa09384bdad04438f2efbfae303d47c3afe7e8d3a157b2a6f37572ea3ecc441dfb208ba755f781f144e58d80aea590abcfccbe8678ec6de47511f9d61cc408cbbe90eeab2cffe6d1a48dc3eb4e48e228fd43cafd7ff2c85c3ed52e99fe16887be28fcd2cd4ba4cac414c92c96294fa7d628e4356c748c173f790a7f30071d0bd53817c78d163249c7402b222b8f28668cae7afd17b97dbaf10b75b61409ca6f5b285d1ab09207c5a91c68b0d4b5da6d6b5a495c8debd7f4400e56d9e22d1cc330f782f2b5441a31b9ccf35aa1a151219cdcff5ab8b240af5b5a751eca67773c057412a935e3a7a367b2bcd28463904ee040a586d6f4f969cee56d55b6b4d97d1fe93b67e2f6bd47925054c4702ec8969a1a6211ea8f6783ca0e8ae333922ce19eceb24e2ff714a0208d2489a62f299aa50cdbfe5a826e872ab231bbddf5bd2fca92d4460379e05e13ff34a200fd921dcb67a002873bda8d86536cddaccb54eb72dd4e399fe9195ad5574ad85d9ed2eaae4106234f0a8db05a230ff377b59b54fd0919d1b86b938622ae6098f003db7f4d45d6874f54c33064ce6184dccc99fece2d994e9572d4840b0cbdd704fd70b4f625912d48a512339f883533768f09a4f614583dfb72defe713ee38f61184df279461b7d35becd8e67d01f0ec27e901d88215554d5a69db373a662085733d09ad9153e7d432c94f872ff7cd72995b3a581ea17722ed13a191b366208f75661112b1a7d42c252c907488ca8dd8f819d4618b0053d4bcddb3b5975cb8615ebc472e052552ee74d5253174a2b0cb96e1eaf6349b6c39be975123ee72b0ffe1367df7aba54de26c9135a3422d21067034551be5efc5daf8b8f59bc725e4fd171378fd9f16a785f1b0378823c85eec521e0b2aca70b7b72b719a20eb2fb0addc0b05851c8e181607f49dad7323bc255309097584c2099574db1ed7940fd16796aef19d30acd714dc1f898716df64db87d852eddf2f86e78fd7fd64868b4cb6cc626efcdea49c4a2779a0e777bbe23968e14233a810d9883680894de93023a8deae51ccbf32e6d1e53618ebee95c761221a33bc3263fff0f5ae23e14dba0418cf3f31effcb36956e06c57a17620044260419a208ae1d2296ec9472d44be74a8ed0a33a23181acdef8c7d2695ce9485ed8d17d9f6f30b9b128ee0ba15c42cbf6059bcfef008c09db8855343f79c3ce1c4d79077c8a62237d4e400a5aa88e7424f2f99df6c2070d6ed071f4968376581e20e52d64e9c4f8a6f73bb33f5b6b62c1deecc85bf789565fde14e4454306ed8f09af08afb360ee4fb40dd5dca0be43ccff75e5c0ef85ea7c521cb4840d61e99e1ce4661e721446d5a571cddffbc3643ec9b58237fd416376906bdca09485c2c80f82b23e8e7bbf22035fdbcacd804ae3771fd616901184ced46987d533017eef717e9b34a5531c3efe2d77c9b6cb0617382d69951545378a4118e71c64a1f16d096a8f933580922083d0536b90ae1715c63f682e8241b42e1646b0c52e34aa9c91efe2b6b787ce0747d4ff0dd07d6ebc9ce27e0ef35705eb7b78763a9829b464523ff3ed9078aff6ee29e6e7a59a5243825e8bb9235f8e49a9dfb5932536666c3dc75b29f715dbca4c84268cf23cd7b6da6814328a3cb26d7b1d6c28e20b36f9a2c9e2fcf663c314f72f37d2b8f405cfc686a6b35400435be0eab01709c2c4b3005491cbb0b560e33547b77ba9f25f01b194e20534199a3786ddfaf0a75aafb65cd4df4da7b5f98fe72a8bc7d045339fd41508cecca791c717a10d4fed8aa69eec80955bd899a6f8aaf3411be40568149e631ccbe17c68f85e87b58da81ba78def8b1a48c49b2dc7613f7d6ea8b158bed077666d37d1caba9a23b7cb2772e780f70872113e5bcaebaf9f9499f651dc894be3bba1e99d58b33d60c0eda397df91d7cf9fb072f247fa9a9f59c4f59c4284a3832ff0a1f9ce8f6346cb5c08a9dcb2851c7f169af688fc13f00cf9519ade547671698caaa3f4d4921fee83753b9ab0875707836343eddb5b87bec86aae023c9571b8e389ff3f4c692b6fb19686105249ce033116777d919ceb4559a67ee6b6ad9d4b53d2be24315429de3bf201107fe7dff9cbc92dbf9173391d555b0a1b8ea3252fd7d7fd15d8a3cc70cecdbdd43c4edcc4bb2fbbf646d5ec7dad0d3156a513d14184e0c316f8155e774f7dcea485f904828edf28510d692b66b1500c5a704371c2188a2812bd323de012f36a79674082b5f5e9f7f4ce1a75ed854b71555e9fcd1f0322c22a9e543674c79a74404e08e61860f505dc56e1b52977b9a9af18be4064b5f6aa7c891382bbbe65e70a4cee33176570341a525fb6b25c0b20bfa3f2ee4a01584f259f43c3b63a2dfc376f435827211379ab3ca8912cbe01e4f837920666fbda682f6954d1c156f21e12547b885f485c38f62e765013144be8ca92b1d4872790a5c02671517f6a8f0ceb247e08c64268ad8970b57bb6d077c9b8ebe7fb1183087c9a3baee06100609204be588621253b9b120c08db9f28c2d38c9bc3f59018bb7216d73186048770d1e556faa49df23a40a64b40cdda2041dccf5619db09b7a7795fd7eb631c0e0bffc3b64422bf6acd84b7fae8bd05b057260a4d7c4851829c7bbf0b6f27c5db0ff10f42df3528f79dc9bbd591965259cd0389deb124b1fadc5dfd3ade9742d29261379ea3d98929512371dec991f0636fbda5dac355a04e363beeb4751781d9cef3a0b6ac6500895d223ad43ed75cac8b0a868253fffa10bf6c2de99c687fd056e075cf0632b6d8ed2263ca08ad95b6f335a3b6d8ab7801422ac8597441ac1bbe289b50af31eb221d19a2d3177d4ad1056d616295e89471e65d811b8fa4fe2c0c12793f43ef7e75c7f657f6c26ca9cbae63ce99301069ab257ae77c38778d35afd326d569c626a68f3904b2c376dfaa05568892f346f86fb05e71fb751e09cd22525cb63512a7d2e4670bd31109b87818278e66dc73fa9667e35c5bc6588cd36d2b62592a4103803d93c194f8edd5d20c6597231321b909bbb3c1d13408e5cf27728883e333b391222e6b6665454892dfedd17a1066f1145163e1a31ba9a3e3cee925e55d794b89462a0a092a639ccd4a24514083cb68224c87c18f0bb39ff721cc598e686b5fef169bc30f9ec6df397905f8340f6ae7ad826aac774cc46bfb9dfe8192e9ef10e8355d7c2810269eb73c7ecb8d3ffa33437142b8e596cdb778cd3cdda5bbbd09a8ea919929adbc63ff1004490c45a9ea59def65fabc884c39beac1b74a218f59c5e31ba85dcc4b8bd81d7a66d8aaf0edb64b505f760442e16fb7f07a069aba88601c3ace27762cef8196da3d44b14796b04e7fa3bab37209190a1de6e6ecfd99353279ef643766814fa7fac7254eba59bff3546bf21afc7445a4f1bc92c7b013f34962ff029e0f2926acf6c8a25fecea5b0b810656c981535492a2a4159dcfd0bf98085dc9612159fa0ad837a22eaffce80405367931ef3eacbf5a663175acc306eb075c52265d0c6dfaabab0ab31a653c4c13d5a1a6e099729ab1a39b0d999338d0f44875083d27dbb943d845e78a3e47242412f24092006daadc3477f33f839065ac17f7bdf37a438353be31a4b5cec8", 0xed5}], 0x5}, 0x40000) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x34, 0x0, &(0x7f0000000040)=0x1) 16.253764364s ago: executing program 4 (id=8495): bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, 0x0, 0x0}, 0x94) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x38, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback=0x7f000015}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_ORIG={0x1c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}]}]}, 0x94}}, 0x0) 16.191637032s ago: executing program 4 (id=8496): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000811248000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x90) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x800, 0x0, 0x1, 0x1, 0xc, 0x10}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x20, r2, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40810}, 0x810) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) 15.905230928s ago: executing program 2 (id=8497): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000200)={0x3, 0x1, 0x207, 0x0, 0x0, 0x1, 0x7, 0x8000}, 0x20) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x3a) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c000000100039040000000000000000000000005cf495052b841fb45f9ff6aff5edc01f7e3420e513d9eb390f8cf05f51a035e9181d3f8ad5df8cde0482093d4bd9d8c27d66154bcbdfefdd2ba9b9d13edbac246950c8a86ef80789f2753d25246f3127dcec89f7a58848856b8a2076e4cb83a10ed3356743288385bbef4270684319b588e0fd074bdc53d9ce4e0462b702b5b30f59b5ea1baffd071fd09b287c9d8297bb4d", @ANYRES32=0x0, @ANYBLOB="00000000000000000a0002000180c20000010000"], 0x2c}}, 0x50) 15.753143648s ago: executing program 2 (id=8498): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000040)=0x4c80, 0x4) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r2, &(0x7f0000000c40)={&(0x7f00000003c0)=@sco, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000440)=""/196, 0xc4}, {&(0x7f0000000680)=""/204, 0xcc}, {&(0x7f0000000540)=""/163, 0xa3}, {&(0x7f0000000780)=""/113, 0x71}, {&(0x7f0000000800)=""/242, 0xf2}, {&(0x7f0000000900)=""/172, 0xac}, {&(0x7f00000009c0)=""/180, 0xb4}, {&(0x7f0000000240)=""/4, 0x4}], 0x8, &(0x7f0000000b00)=""/217, 0xd9}, 0x2040) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={0xffffffffffffffff, 0x4}, 0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x8000, 0x10, 0x6, 0xba2, {{0x36, 0x4, 0x3, 0x3b, 0xd8, 0x68, 0x0, 0xd, 0x2f, 0x0, @multicast2, @empty, {[@ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x34, 0x4a, 0x3, 0x6, [{@remote, 0x9}, {@remote}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, {@multicast1, 0x1}, {@dev={0xac, 0x14, 0x14, 0x1c}, 0x9}, {@multicast1, 0x5d}]}, @timestamp_addr={0x44, 0x3c, 0x2c, 0x1, 0x6, [{@empty, 0x3}, {@empty, 0x8}, {@local, 0x2}, {@loopback, 0x72c7183c}, {@loopback, 0x6}, {@local, 0x4}, {@multicast2, 0xec09}]}, @end, @timestamp_prespec={0x44, 0x14, 0x78, 0x3, 0x1, [{@private=0xa010101, 0xfffffff9}, {@private=0xa010100, 0x29}]}, @generic={0x83, 0x3, "b3"}, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0xc, 0x79, 0x1, 0x5, [{@multicast1, 0xac8}]}, @ssrr={0x89, 0x1b, 0xae, [@remote, @multicast1, @loopback, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @local]}, @lsrr={0x83, 0xb, 0xbd, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty]}]}}}}}) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0), 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x2, 0x2, 0x7, 0x4000, r3, 0xb, '\x00', r4, r5, 0x2, 0x3, 0x5, 0xe}, 0x50) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000380)={0x1, 0x81}, 0x8) sendmmsg$unix(r1, &(0x7f00000029c0)=[{{&(0x7f0000000600)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000000c00)=[@cred={{0x1c, 0x1, 0x51}}], 0x20, 0x20000010}}], 0x1, 0x3400c0c4) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt-generic)\x00'}, 0xffffffffffffffea) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x27}, 0x62) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r6, 0x118, 0x1, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001bc0)=ANY=[@ANYBLOB="5c0000000206010100000000000000000000000005000100070000000900020073797a32000000000500050000000000050004000000000014000780080008400000009008000640000000030d0003006c6973743a736574"], 0x5c}}, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x1, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) 15.752573878s ago: executing program 2 (id=8499): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0xa, 0x3, 0x87) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x800000000, 0x100000000, 0xff, 0xfffeffffffffffff, 0x4, 0xb, 0x2880040000000009, 0x1}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=ANY=[@ANYBLOB="18eaff962c000000550001070000000000000000", @ANYRES32=0x0], 0x18}}, 0x0) unshare(0x2c060000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x29, 0x4a, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x24004040) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x2713, 0x0, &(0x7f0000000280)) openat$cgroup_ro(r6, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) r8 = socket(0x2a, 0x2, 0x0) getsockopt$MRT(r8, 0x0, 0xcf, 0x0, &(0x7f0000000940)) socket$netlink(0x10, 0x3, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @remote, @empty}, &(0x7f00000000c0)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', r9, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) 15.535362357s ago: executing program 0 (id=8500): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) (async, rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (rerun: 64) write$cgroup_int(r2, &(0x7f0000000200), 0x12) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)={0x6, 0x4, 0x1a00}, 0x980) connect$can_bcm(r1, &(0x7f00000004c0), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="05000000010400"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000040f5"], 0x48}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="3800000055002f03000000000000000007000000", @ANYRES32, @ANYBLOB="090001"], 0x38}}, 0x0) 15.468557226s ago: executing program 0 (id=8501): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) (async) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x1}}}}]}, 0x44}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r2) sendmsg$nl_route_sched(r2, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000680)=@newtaction={0x180, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x16c, 0x1, [@m_connmark={0x50, 0x2, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0xd, 0x5, 0x0, 0x3}, 0x8}}]}, {0x4}, {0xc}, {0xc}}}, @m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0xd4, 0x3, 0x0, 0x0, {{0x9}, {0x58, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0x0, 0x3, {0x2, 0xea3, 0x7}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1d28}}, @TCA_GACT_PARMS={0x18, 0x2, {0xb66, 0xb3, 0x10000000, 0x34e, 0xffff}}, @TCA_GACT_PARMS={0x18, 0x2, {0x7ff, 0xd8, 0x0, 0x9, 0x100000e0}}]}, {0x52, 0x6, "a06b1d1931f3579c6d7c5159238a286074602c3726c701f3c0d5382de62a6e8c4fb714fcd674c66cd306a4f78d3d05530609c9b04b7483bd084d70df8e77e6fbd503917aa0a6c737cef0ed021b60"}, {0xc}, {0x1, 0x8, {0x2, 0x2}}}}]}]}, 0x180}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x150, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xffff, 0xffe0}, {}, {0x1, 0x6}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x120, 0x2, [@TCA_CGROUP_EMATCHES={0x11c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_LIST={0x110, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x1, 0x3, 0x8}, {0xffffffff, 0x5, 0x0, 0xd}}}, @TCF_EM_IPSET={0x10, 0x1, 0x0, 0x0, {{0x68, 0x8, 0xc5d}, {0x3, 0x6}}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x46c, 0x1, 0x8001}, {0x4, 0x7, 0x0, 0x2, 0x7, 0x2, 0x1}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x4, 0x7, 0x101}, {{0x2, 0x1}, {0x1, 0x1, 0x0, 0x1}}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x8, 0x3, 0x401}, {0x2, 0x20, 0x3, 0x3}}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x3, 0x1, 0x5fa}, {0x8001, 0x7, 0x4, 0x0, 0x3, 0x1}}}, @TCF_EM_IPT={0x24, 0x1, 0x0, 0x0, {{0xfffa, 0x9, 0xf1b0}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x7}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x7}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x4}]}}, @TCF_EM_META={0x5c, 0x2, 0x0, 0x0, {{0x8, 0x4, 0x14}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x8001, 0x6}, {0x2, 0xf8}}}, @TCA_EM_META_HDR={0xc, 0x1, {{0x4000, 0x6, 0x2}, {0x1, 0x5}}}, @TCA_EM_META_LVALUE={0xf, 0x2, [@TCF_META_TYPE_INT=0x9, @TCF_META_TYPE_VAR="6050d098", @TCF_META_TYPE_VAR="b2ad2c"]}, @TCA_EM_META_LVALUE={0x16, 0x2, [@TCF_META_TYPE_INT, @TCF_META_TYPE_INT=0xa, @TCF_META_TYPE_VAR="1d26", @TCF_META_TYPE_INT=0x3, @TCF_META_TYPE_INT=0xa, @TCF_META_TYPE_VAR]}, @TCA_EM_META_LVALUE={0xf, 0x2, [@TCF_META_TYPE_INT=0xa, @TCF_META_TYPE_INT=0x2, @TCF_META_TYPE_VAR="016a15"]}]}}]}]}]}}]}, 0x150}, 0x1, 0x0, 0x0, 0x40000}, 0x1) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@deltaction={0x24, 0x32, 0x533, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}]}, 0x24}}, 0x0) socket$igmp(0x2, 0x3, 0x2) (async) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r6, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5"}, 0x3c) setsockopt$MRT_DEL_MFC_PROXY(r6, 0x0, 0xd3, &(0x7f00000000c0)={@multicast2, @multicast1, 0x0, "c6c0e6ec8755b5dc4e305886d95f086707764f8d0e5a0358ea21274f844a69e9", 0x0, 0x200}, 0x3c) (async) setsockopt$MRT_DEL_MFC_PROXY(r6, 0x0, 0xd3, &(0x7f00000000c0)={@multicast2, @multicast1, 0x0, "c6c0e6ec8755b5dc4e305886d95f086707764f8d0e5a0358ea21274f844a69e9", 0x0, 0x200}, 0x3c) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000000)) (async) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000000)) socket$inet6_udp(0xa, 0x2, 0x0) 15.341086487s ago: executing program 0 (id=8502): syz_init_net_socket$ax25(0x3, 0x5, 0xcc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0xfffffffc, @private2, 0x80001}, 0x1c) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18030000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='netlink_extack\x00', r1}, 0x10) r2 = socket(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f0000000a0000000d0085a168d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000480)={@in6={{0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9}}, 0x0, 0x0, 0xb, 0x0, "9ecf3315567f14d56a87d134cc409e2a652dbbf6c50480937c6fa85af81bc6fc54b71f03985ac33e31d612d976a6efcda8853b8a4430503621f06679995d916cb4361795dd7dbae51d07384b7c2e6949"}, 0xd8) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)={0x30, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@nested={0x8, 0x15, 0x0, 0x1, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) syz_emit_ethernet(0x33a, &(0x7f0000000580)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}, @void, {@ipv4={0x800, @gre={{0x17, 0x4, 0x0, 0x7, 0x32c, 0x65, 0x0, 0x4, 0x2f, 0x0, @rand_addr=0x64010101, @local, {[@end, @cipso={0x86, 0x43, 0x2, [{0x0, 0xe, "dfe461a5429ad26e11aa6f40"}, {0x1, 0x4, "a80b"}, {0x1, 0x8, "95b9b7dd37b5"}, {0x5, 0xd, "41ba3221845356f8d1420c"}, {0x1, 0x6, "2ca47ba9"}, {0x0, 0x10, "8e2bf421095463b64beced8450b1"}]}, @end, @noop]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0xb6, 0x1, [0x6, 0x7f], "660f0a8c6f7116a98e554c966e8e1c8ee3aace10016991e3e4b2cce3d235b56a48c83f95d49ef4ac6cd52b2113d5cc6b321ade61ce61424ed8fb2bf1e795c4298c86e7994e49525fc6c88d736b58734f2802fae2dc01006fb9e154c5ff619e6a7cc7c94d688579949ba9cdaae5552bb14e22948a34756f7374c5bb8bbc93631285aebfbeeed858cfbbeaaae70cdeb5f8a2fe5a22a3ea200ea847a9aabb470e988e5cc4d03af995f307942ba8584c8d20bca99d6a3e79"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x800, [0xd], "a48cdf57b19b8a630409d2037159f2c147c54b826de35476fe64711d40a6cf774095f85564ebf8ff01666b"}, {0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x8, 0xfffd], "63ca75f4c10fc7a5ecfb95b9c84a8538c66a086f3b274eb23eead72efe7c0b006d266b3efe23ba0f2f59c8bf10b6f01ba2651cee6a4ce5bccd543c74af108222aa86655c5fd9a928f48500ab9c7ea87c5e71a9c0e63ba3c17d65efcb39e77278f0773e7940a1d7e23e21e844eaf7712222640f520dbbf4d0ac098c872d4187cfc601b43d1d7bfaf9a3554e264a8e41b641dac5399fd6941a4bb78c440c787c091fbf295f4297a0c684dc3d029edea6bcb82d3592f98c73bcc13aee497a12a1206bbd4441baa5537256e9b66480d5f04f54aa5ce19a6821d028263fad8b9202a5c4a9d02567643138b591866c97952ce5278d39"}, {0x8, 0x88be, 0x4, {{0x2, 0x1, 0x10, 0x3, 0x1, 0x2, 0x2, 0x1}, 0x1, {0x8}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0xff, 0x1, 0x1, 0x1, 0x1, 0x3}, 0x2, {0xffffab3e, 0x1, 0x1, 0x9, 0x0, 0x0, 0x1, 0x0, 0x1}}}, {0x8, 0x6558, 0x1, "a94ca9a0560d53967596fff286b5d6f8c9fb971ab8d369b284a91425ab2dab3308a312a2244f29b6f484372962a32e574153b394b707143b4997c8be3141b94166edf480d1e44278ace4d55558c899c36a1867e4a4c6611a9d92601fc7e489ddb16f2c1b94fe14d7bd51e706d71f23626d473a63e1e99d47593bd4dee62336ec04d308b5a198dd723a2e495b668e4d7729812578f2c8f31ae9f3f3aa1ff0134885c6119af2d14637961f011be758"}}}}}}, 0x0) 15.322822495s ago: executing program 0 (id=8503): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x3, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xa1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x3c}, 0x1, 0x2}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071103100000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0af8fe00000000720390ff00000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="680000000714010025bd7000ffdbdf25080001000100000008000100000000000900020073797a32000000000900020073797a300000000005004200050000000800010001000000090002007379b6bf000000000900020073797a3000000000080001"], 0x68}}, 0x0) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0xffea, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000070000100000000000000000007000000", @ANYRES32=r8, @ANYBLOB="0c00018008000100000001000c0002"], 0x30}}, 0x0) setsockopt$packet_int(r4, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) ioctl$SIOCX25GSUBSCRIP(r2, 0x89e0, &(0x7f00000002c0)={'netpci0\x00', 0x1ff, 0x7b37}) bind$packet(r2, &(0x7f0000000140)={0x11, 0xe, r8, 0x1, 0x6, 0x6, @random="14a026312568"}, 0x14) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r11 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r11, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sed\x00', 0x1, 0x4, 0x72}, 0x2c) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000034c0)=ANY=[@ANYBLOB="240000003f0007010300000000000000027c0000100003800c0008"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) setsockopt$IP_VS_SO_SET_ADDDEST(r11, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x4, 0x0}, 0x4e21, 0x3, 'lc\x00', 0x1e, 0x81, 0x37}, {@rand_addr=0x64010105, 0x4e23, 0x0, 0xc3, 0x3, 0x12d5c}}, 0x44) syz_genetlink_get_family_id$smc(&(0x7f0000000240), r12) sendmsg$ETHTOOL_MSG_FEATURES_SET(r9, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="df4800000000000000000c000000180003801000038003fe018005000200000000000400010018000180140002007369743000"/62], 0x44}}, 0x0) 15.302096261s ago: executing program 4 (id=8504): bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5}, 0x38) 15.217341701s ago: executing program 4 (id=8505): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, 0x0, 0x0) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000b40)={'dummy0\x00'}) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x1, 0x4, 0x201, 0x0, 0x0, {0x7}}, 0x14}}, 0x2000004) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="8500000089000000620a00ff000000007500000000000000950000000000000018100000", @ANYBLOB="00000000000000000504000000a48774000000f73b858730deef", @ANYRES32, @ANYRES64=0x0, @ANYRES16=r0], &(0x7f0000000140)='GPL\x00', 0x2, 0xfffffd85, &(0x7f0000000180)=""/134, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5}, 0x94) 15.217007213s ago: executing program 4 (id=8506): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="0100f785c9d83e17a85ad8800069703665727370616e4fe1ae95863fcb1fee0000002800028005000b00050000000600023a25ce4a8b"], 0x5c}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000021bf0000000000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000db090000a1000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x6}, 0x94) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xb7, '\x00', 0x0, r2, 0x5, 0x5, 0x4}, 0x50) 15.17839966s ago: executing program 4 (id=8507): r0 = socket$rxrpc(0x21, 0x2, 0x2) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f0000000000)={0x0, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r3 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r4 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd4, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x40000c0}, 0x8000) (async) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd4, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x40000c0}, 0x8000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40000d1) (async) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40000d1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x89400000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x98, r6, 0x100, 0x70bd2c, 0x25dfdbff, {{}, {@void, @val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_4ADDR={0x5}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "11c54bb90586afea3c06ea545cbef29e52678a637d9dfa4d"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}], @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'ipvlan0\x00'}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0_to_bond\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x98}, 0x1, 0x0, 0x0, 0x81}, 0x850) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, r6, 0x10, 0x70bd27, 0x25dfdbff, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x5}, 0x50) (async) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x5}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000780)={r8, 0x58, &(0x7f0000000700)}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000007c0), &(0x7f0000000800)=0xc) getsockopt(r1, 0xb9, 0x9, &(0x7f0000000840)=""/235, &(0x7f0000000940)=0xeb) socketpair(0x2c, 0x6, 0x0, &(0x7f00000009c0)) (async) socketpair(0x2c, 0x6, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f0000000980), r10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000a00)={'wlan0\x00'}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000a40), &(0x7f0000000a80)=0x4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b80)={{r11}, &(0x7f0000000b00), &(0x7f0000000b40)=r12}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b80)={{r11}, &(0x7f0000000b00), &(0x7f0000000b40)=r12}, 0x20) sendmsg$NL80211_CMD_VENDOR(r12, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x60, r6, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x7f, 0x72}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x7fffffff}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xcea2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NL80211_CMD_VENDOR(r12, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x60, r6, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x7f, 0x72}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x7fffffff}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xcea2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0) setsockopt$XDP_TX_RING(r11, 0x11b, 0x3, &(0x7f0000000d00)=0x14, 0x4) getsockname$packet(r9, &(0x7f0000000d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000d80)=0x14) (async) getsockname$packet(r9, &(0x7f0000000d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000d80)=0x14) socket$nl_rdma(0x10, 0x3, 0x14) syz_genetlink_get_family_id$nl80211(&(0x7f0000000dc0), r12) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r13, &(0x7f0000000ec0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x1c, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc000) 2.135879892s ago: executing program 32 (id=8464): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x8b21, &(0x7f0000000040)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x19, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x1d}, {@in6=@private1, 0xfe, 0x32}, @in6=@empty, {0x3, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x7fffffff, 0x543}, {0x4, 0x7fffffffffffffff}, {0x2}, 0x70bd2c, 0x3500, 0xa, 0x1, 0x0, 0x50}, [@encap={0x1c, 0x16, {0x7, 0x4e24, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) clock_gettime(0x0, &(0x7f0000003340)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003240)=[{{&(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000240)=""/190, 0xbe}, {&(0x7f0000000300)=""/143, 0x8f}, {&(0x7f00000003c0)=""/136, 0x88}], 0x3, &(0x7f00000004c0)=""/80, 0x50}, 0xfffffffc}, {{&(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000600)=[{&(0x7f00000005c0)=""/41, 0x29}], 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000640)=""/1, 0x1}, {&(0x7f0000000680)=""/228, 0xe4}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/255, 0xff}, {&(0x7f0000001880)=""/216, 0xd8}, {&(0x7f0000001980)=""/128, 0x80}, {&(0x7f0000001a00)=""/24, 0x18}, {&(0x7f0000001a40)=""/116, 0x74}, {&(0x7f0000001ac0)=""/130, 0x82}], 0x9, &(0x7f0000001c40)=""/255, 0xff}, 0x6}, {{&(0x7f0000001d40)=@nl=@proc, 0x80, &(0x7f00000030c0)=[{&(0x7f0000001dc0)=""/171, 0xab}, {&(0x7f0000001e80)=""/4096, 0x1000}, {&(0x7f0000002e80)=""/233, 0xe9}, {&(0x7f0000002f80)=""/164, 0xa4}, {&(0x7f0000003040)=""/109, 0x6d}], 0x5, &(0x7f0000003140)=""/222, 0xde}, 0x2}], 0x4, 0x100, &(0x7f0000003380)={r2, r3+60000000}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {0x7a}, [{0x78, 0x1, [@m_police={0x74, 0x1, 0x0, 0x0, {{0xb}, {0x48, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c}, @TCA_POLICE_RESULT={0x8, 0x5, 0x20000000}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x8c}}, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x2, &(0x7f0000000100)=@netrom={'nr', 0x0}, 0x59) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r7, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2, 0x3}, @TCA_FQ_QUANTUM={0xffffffffffffff0f}]}}]}, 0x48}}, 0x0) r11 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) write$cgroup_subtree(r11, &(0x7f0000000080)=ANY=[@ANYBLOB="2d626c6b696f202b696f202b696f202d626c6b696f202b6e6574202b6370757324e9b1a8f6dc30ed636c732002000000000000002b68756765746c6220"], 0x3d) ppoll(&(0x7f00000033c0)=[{r5, 0x702}], 0x1, &(0x7f0000003400), &(0x7f0000003440)={[0xe4]}, 0x8) getpeername$inet(r4, &(0x7f0000003480)={0x2, 0x0, @multicast2}, &(0x7f00000034c0)=0x10) 2.114165527s ago: executing program 33 (id=8455): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f00000001c0)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @dev}, 0x10) listen(r0, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r4], 0x1c}}, 0x0) write$nci(r1, &(0x7f0000001800)=ANY=[@ANYBLOB="7240082b0102020681055a03997713fa06070202267a"], 0x16) close(0x4) 86.79407ms ago: executing program 34 (id=8503): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x3, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xa1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x3c}, 0x1, 0x2}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071103100000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0af8fe00000000720390ff00000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="680000000714010025bd7000ffdbdf25080001000100000008000100000000000900020073797a32000000000900020073797a300000000005004200050000000800010001000000090002007379b6bf000000000900020073797a3000000000080001"], 0x68}}, 0x0) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0xffea, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000070000100000000000000000007000000", @ANYRES32=r8, @ANYBLOB="0c00018008000100000001000c0002"], 0x30}}, 0x0) setsockopt$packet_int(r4, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) ioctl$SIOCX25GSUBSCRIP(r2, 0x89e0, &(0x7f00000002c0)={'netpci0\x00', 0x1ff, 0x7b37}) bind$packet(r2, &(0x7f0000000140)={0x11, 0xe, r8, 0x1, 0x6, 0x6, @random="14a026312568"}, 0x14) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r11 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r11, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sed\x00', 0x1, 0x4, 0x72}, 0x2c) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000034c0)=ANY=[@ANYBLOB="240000003f0007010300000000000000027c0000100003800c0008"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) setsockopt$IP_VS_SO_SET_ADDDEST(r11, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x4, 0x0}, 0x4e21, 0x3, 'lc\x00', 0x1e, 0x81, 0x37}, {@rand_addr=0x64010105, 0x4e23, 0x0, 0xc3, 0x3, 0x12d5c}}, 0x44) syz_genetlink_get_family_id$smc(&(0x7f0000000240), r12) sendmsg$ETHTOOL_MSG_FEATURES_SET(r9, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="df4800000000000000000c000000180003801000038003fe018005000200000000000400010018000180140002007369743000"/62], 0x44}}, 0x0) 57.388622ms ago: executing program 35 (id=8499): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0xa, 0x3, 0x87) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x800000000, 0x100000000, 0xff, 0xfffeffffffffffff, 0x4, 0xb, 0x2880040000000009, 0x1}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=ANY=[@ANYBLOB="18eaff962c000000550001070000000000000000", @ANYRES32=0x0], 0x18}}, 0x0) unshare(0x2c060000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x29, 0x4a, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x24004040) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x2713, 0x0, &(0x7f0000000280)) openat$cgroup_ro(r6, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) r8 = socket(0x2a, 0x2, 0x0) getsockopt$MRT(r8, 0x0, 0xcf, 0x0, &(0x7f0000000940)) socket$netlink(0x10, 0x3, 0x10) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @remote, @empty}, &(0x7f00000000c0)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', r9, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) 0s ago: executing program 36 (id=8507): r0 = socket$rxrpc(0x21, 0x2, 0x2) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f0000000000)={0x0, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r3 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r4 = gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd4, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x40000c0}, 0x8000) (async) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd4, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x40000c0}, 0x8000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40000d1) (async) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r6, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40000d1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x89400000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x98, r6, 0x100, 0x70bd2c, 0x25dfdbff, {{}, {@void, @val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_4ADDR={0x5}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "11c54bb90586afea3c06ea545cbef29e52678a637d9dfa4d"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}], @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'ipvlan0\x00'}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0_to_bond\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x98}, 0x1, 0x0, 0x0, 0x81}, 0x850) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, r6, 0x10, 0x70bd27, 0x25dfdbff, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x5}, 0x50) (async) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x5}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000780)={r8, 0x58, &(0x7f0000000700)}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000007c0), &(0x7f0000000800)=0xc) getsockopt(r1, 0xb9, 0x9, &(0x7f0000000840)=""/235, &(0x7f0000000940)=0xeb) socketpair(0x2c, 0x6, 0x0, &(0x7f00000009c0)) (async) socketpair(0x2c, 0x6, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f0000000980), r10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000a00)={'wlan0\x00'}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000a40), &(0x7f0000000a80)=0x4) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b80)={{r11}, &(0x7f0000000b00), &(0x7f0000000b40)=r12}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b80)={{r11}, &(0x7f0000000b00), &(0x7f0000000b40)=r12}, 0x20) sendmsg$NL80211_CMD_VENDOR(r12, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x60, r6, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x7f, 0x72}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x7fffffff}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xcea2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NL80211_CMD_VENDOR(r12, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x60, r6, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@void, @void, @val={0xc, 0x99, {0x7f, 0x72}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x7fffffff}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xcea2}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0) setsockopt$XDP_TX_RING(r11, 0x11b, 0x3, &(0x7f0000000d00)=0x14, 0x4) getsockname$packet(r9, &(0x7f0000000d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000d80)=0x14) (async) getsockname$packet(r9, &(0x7f0000000d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000d80)=0x14) socket$nl_rdma(0x10, 0x3, 0x14) syz_genetlink_get_family_id$nl80211(&(0x7f0000000dc0), r12) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r13, &(0x7f0000000ec0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x1c, 0x0, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc000) kernel console output (not intermixed with test programs): going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 637.066140][T26915] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 637.082644][T18221] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.108445][T18221] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.126994][T26915] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 637.148047][T26915] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 637.149036][T27035] netlink: 256 bytes leftover after parsing attributes in process `syz.4.6167'. [ 637.198286][T26915] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 637.236195][T18221] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.297788][T18221] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.423838][T26915] hsr_slave_0: entered promiscuous mode [ 637.437607][T26915] hsr_slave_1: entered promiscuous mode [ 637.444977][T26915] debugfs: 'hsr0' already exists in 'hsr' [ 637.452584][T26915] Cannot create hsr debugfs directory [ 637.492734][T27053] openvswitch: netlink: Missing valid actions attribute. [ 637.501207][T27053] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 637.571602][T27053] netlink: 'syz.0.6171': attribute type 1 has an invalid length. [ 637.579866][T27053] netlink: 'syz.0.6171': attribute type 2 has an invalid length. [ 637.627149][T18221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.635836][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.748215][T27065] netlink: 'syz.3.6175': attribute type 11 has an invalid length. [ 637.826128][T27072] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6177'. [ 637.852223][T27072] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6177'. [ 637.861659][T27072] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6177'. [ 637.886129][T27074] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6178'. [ 637.927366][T27076] sctp: [Deprecated]: syz.3.6179 (pid 27076) Use of struct sctp_assoc_value in delayed_ack socket option. [ 637.927366][T27076] Use struct sctp_sack_info instead [ 637.998276][T26915] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 638.010857][T26915] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.022710][T26915] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 638.047806][T27085] syzkaller0: entered promiscuous mode [ 638.054189][T27085] syzkaller0: entered allmulticast mode [ 638.158689][T26915] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 638.180694][T26915] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.199643][T26915] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 638.200481][ T5842] Bluetooth: hci4: command tx timeout [ 638.412939][T26915] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 638.457337][T26915] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.525635][T26915] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 638.695573][T27127] FAULT_INJECTION: forcing a failure. [ 638.695573][T27127] name failslab, interval 1, probability 0, space 0, times 0 [ 638.708775][T27127] CPU: 1 UID: 0 PID: 27127 Comm: syz.3.6190 Not tainted syzkaller #0 PREEMPT(full) [ 638.708812][T27127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 638.708830][T27127] Call Trace: [ 638.708843][T27127] [ 638.708851][T27127] dump_stack_lvl+0x189/0x250 [ 638.708875][T27127] ? __pfx____ratelimit+0x10/0x10 [ 638.708897][T27127] ? __pfx_dump_stack_lvl+0x10/0x10 [ 638.708916][T27127] ? __pfx__printk+0x10/0x10 [ 638.708945][T27127] ? __pfx___might_resched+0x10/0x10 [ 638.708963][T27127] ? fs_reclaim_acquire+0x7d/0x100 [ 638.708992][T27127] should_fail_ex+0x414/0x560 [ 638.709016][T27127] should_failslab+0xa8/0x100 [ 638.709044][T27127] __kmalloc_noprof+0xcb/0x800 [ 638.709066][T27127] ? ethnl_default_set_doit+0x13a/0x8f0 [ 638.709093][T27127] ethnl_default_set_doit+0x13a/0x8f0 [ 638.709112][T27127] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 638.709133][T27127] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 638.709157][T27127] genl_family_rcv_msg_doit+0x215/0x300 [ 638.709187][T27127] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 638.709222][T27127] ? bpf_lsm_capable+0x9/0x20 [ 638.709240][T27127] ? security_capable+0x7e/0x2e0 [ 638.709277][T27127] genl_rcv_msg+0x60e/0x790 [ 638.709306][T27127] ? __pfx_genl_rcv_msg+0x10/0x10 [ 638.709327][T27127] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 638.709368][T27127] netlink_rcv_skb+0x208/0x470 [ 638.709387][T27127] ? __pfx_genl_rcv_msg+0x10/0x10 [ 638.709410][T27127] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 638.709445][T27127] ? down_read+0x274/0x2e0 [ 638.709467][T27127] ? genl_rcv+0xd/0x40 [ 638.709490][T27127] genl_rcv+0x28/0x40 [ 638.709509][T27127] netlink_unicast+0x82f/0x9e0 [ 638.709544][T27127] ? __pfx_netlink_unicast+0x10/0x10 [ 638.709571][T27127] ? netlink_sendmsg+0x642/0xb30 [ 638.709586][T27127] ? skb_put+0x11b/0x210 [ 638.709615][T27127] netlink_sendmsg+0x805/0xb30 [ 638.709662][T27127] ? __pfx_netlink_sendmsg+0x10/0x10 [ 638.709683][T27127] ? aa_sock_msg_perm+0xf1/0x1b0 [ 638.709703][T27127] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 638.709726][T27127] ? __pfx_netlink_sendmsg+0x10/0x10 [ 638.709744][T27127] __sock_sendmsg+0x21c/0x270 [ 638.709768][T27127] ____sys_sendmsg+0x505/0x820 [ 638.709800][T27127] ? __pfx_____sys_sendmsg+0x10/0x10 [ 638.709836][T27127] ? import_iovec+0x74/0xa0 [ 638.709863][T27127] ___sys_sendmsg+0x21f/0x2a0 [ 638.709892][T27127] ? __pfx____sys_sendmsg+0x10/0x10 [ 638.709925][T27127] ? rcu_read_lock_any_held+0xb3/0x120 [ 638.709973][T27127] ? __fget_files+0x2a/0x420 [ 638.709989][T27127] ? __fget_files+0x3a0/0x420 [ 638.710014][T27127] __x64_sys_sendmsg+0x19b/0x260 [ 638.710043][T27127] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 638.710079][T27127] ? __pfx_ksys_write+0x10/0x10 [ 638.710105][T27127] ? do_syscall_64+0xbe/0xf80 [ 638.710131][T27127] do_syscall_64+0xfa/0xf80 [ 638.710154][T27127] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.710171][T27127] ? clear_bhb_loop+0x60/0xb0 [ 638.710193][T27127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.710209][T27127] RIP: 0033:0x7f1d5778f749 [ 638.710225][T27127] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 638.710240][T27127] RSP: 002b:00007f1d58667038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 638.710265][T27127] RAX: ffffffffffffffda RBX: 00007f1d579e5fa0 RCX: 00007f1d5778f749 [ 638.710278][T27127] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 000000000000000e [ 638.710289][T27127] RBP: 00007f1d58667090 R08: 0000000000000000 R09: 0000000000000000 [ 638.710299][T27127] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 638.710309][T27127] R13: 00007f1d579e6038 R14: 00007f1d579e5fa0 R15: 00007ffed4de7d98 [ 638.710340][T27127] [ 639.110858][T27123] bridge0: entered allmulticast mode [ 639.190075][T26915] bond0: (slave netdevsim0): Releasing backup interface [ 639.196275][T27132] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6192'. [ 639.211643][T26915] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.222147][T26915] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.233653][T26915] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 639.332362][T27137] 8021q: VLANs not supported on gre0 [ 639.489377][T27147] IPVS: Scheduler module ip_vs_sip not found [ 639.501942][T27150] €Â: renamed from dummy0 (while UP) [ 639.552620][T26915] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 639.569208][T26915] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 639.637440][T26915] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 639.667526][T26915] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 639.929487][T27179] FAULT_INJECTION: forcing a failure. [ 639.929487][T27179] name failslab, interval 1, probability 0, space 0, times 0 [ 639.950207][T26915] 8021q: adding VLAN 0 to HW filter on device bond0 [ 639.962822][T27179] CPU: 1 UID: 0 PID: 27179 Comm: syz.3.6202 Not tainted syzkaller #0 PREEMPT(full) [ 639.962849][T27179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 639.962862][T27179] Call Trace: [ 639.962870][T27179] [ 639.962879][T27179] dump_stack_lvl+0x189/0x250 [ 639.962907][T27179] ? __pfx____ratelimit+0x10/0x10 [ 639.962933][T27179] ? __pfx_dump_stack_lvl+0x10/0x10 [ 639.962956][T27179] ? __pfx__printk+0x10/0x10 [ 639.962990][T27179] ? __pfx___might_resched+0x10/0x10 [ 639.963012][T27179] ? fs_reclaim_acquire+0x7d/0x100 [ 639.963046][T27179] should_fail_ex+0x414/0x560 [ 639.963076][T27179] should_failslab+0xa8/0x100 [ 639.963116][T27179] __kmalloc_noprof+0xcb/0x800 [ 639.963141][T27179] ? ethnl_default_set_doit+0x13a/0x8f0 [ 639.963173][T27179] ethnl_default_set_doit+0x13a/0x8f0 [ 639.963196][T27179] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 639.963223][T27179] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 639.963259][T27179] genl_family_rcv_msg_doit+0x215/0x300 [ 639.963294][T27179] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 639.963336][T27179] ? bpf_lsm_capable+0x9/0x20 [ 639.963357][T27179] ? security_capable+0x7e/0x2e0 [ 639.963395][T27179] genl_rcv_msg+0x60e/0x790 [ 639.963428][T27179] ? __pfx_genl_rcv_msg+0x10/0x10 [ 639.963453][T27179] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 639.963494][T27179] netlink_rcv_skb+0x208/0x470 [ 639.963516][T27179] ? __pfx_genl_rcv_msg+0x10/0x10 [ 639.963543][T27179] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 639.963584][T27179] ? down_read+0x274/0x2e0 [ 639.963611][T27179] ? genl_rcv+0xd/0x40 [ 639.963638][T27179] genl_rcv+0x28/0x40 [ 639.963661][T27179] netlink_unicast+0x82f/0x9e0 [ 639.963701][T27179] ? __pfx_netlink_unicast+0x10/0x10 [ 639.963733][T27179] ? netlink_sendmsg+0x642/0xb30 [ 639.963752][T27179] ? skb_put+0x11b/0x210 [ 639.963786][T27179] netlink_sendmsg+0x805/0xb30 [ 639.963818][T27179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 639.963842][T27179] ? aa_sock_msg_perm+0xf1/0x1b0 [ 639.963865][T27179] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 639.963892][T27179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 639.963914][T27179] __sock_sendmsg+0x21c/0x270 [ 639.963943][T27179] ____sys_sendmsg+0x505/0x820 [ 639.963980][T27179] ? __pfx_____sys_sendmsg+0x10/0x10 [ 639.964022][T27179] ? import_iovec+0x74/0xa0 [ 639.964055][T27179] ___sys_sendmsg+0x21f/0x2a0 [ 639.964090][T27179] ? __pfx____sys_sendmsg+0x10/0x10 [ 639.964135][T27179] ? rcu_read_lock_any_held+0xb3/0x120 [ 639.964192][T27179] ? __fget_files+0x2a/0x420 [ 639.964210][T27179] ? __fget_files+0x3a0/0x420 [ 639.964240][T27179] __x64_sys_sendmsg+0x19b/0x260 [ 639.964275][T27179] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 639.964318][T27179] ? __pfx_ksys_write+0x10/0x10 [ 639.964348][T27179] ? do_syscall_64+0xbe/0xf80 [ 639.964380][T27179] do_syscall_64+0xfa/0xf80 [ 639.964407][T27179] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.964428][T27179] ? clear_bhb_loop+0x60/0xb0 [ 639.964453][T27179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.964473][T27179] RIP: 0033:0x7f1d5778f749 [ 639.964492][T27179] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 639.964510][T27179] RSP: 002b:00007f1d58667038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 639.964532][T27179] RAX: ffffffffffffffda RBX: 00007f1d579e5fa0 RCX: 00007f1d5778f749 [ 639.964547][T27179] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 000000000000000e [ 639.964560][T27179] RBP: 00007f1d58667090 R08: 0000000000000000 R09: 0000000000000000 [ 639.964572][T27179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 639.964585][T27179] R13: 00007f1d579e6038 R14: 00007f1d579e5fa0 R15: 00007ffed4de7d98 [ 639.964620][T27179] [ 640.358387][T26915] 8021q: adding VLAN 0 to HW filter on device team0 [ 640.401241][T26915] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 640.412021][T26915] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 640.483420][T18222] bridge0: port 1(bridge_slave_0) entered blocking state [ 640.490620][T18222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 640.500247][T18222] bridge0: port 2(bridge_slave_1) entered blocking state [ 640.507331][ T5842] Bluetooth: hci4: command tx timeout [ 640.507397][T18222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 640.667922][T27190] netlink: 'syz.0.6206': attribute type 9 has an invalid length. [ 640.712707][T27190] netlink: 'syz.0.6206': attribute type 6 has an invalid length. [ 641.016897][T26915] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 641.046948][T27218] netlink: 'syz.4.6210': attribute type 1 has an invalid length. [ 641.054729][T27218] __nla_validate_parse: 5 callbacks suppressed [ 641.054743][T27218] netlink: 228 bytes leftover after parsing attributes in process `syz.4.6210'. [ 641.093859][T27218] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6210'. [ 641.139544][T26915] veth0_vlan: entered promiscuous mode [ 641.175099][T26915] veth1_vlan: entered promiscuous mode [ 641.238921][T26915] veth0_macvtap: entered promiscuous mode [ 641.253760][T26915] veth1_macvtap: entered promiscuous mode [ 641.316844][T26915] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 641.341114][T26915] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 641.360474][T18222] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 641.384687][T18222] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 641.431441][T18222] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 641.497397][T18222] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 641.565258][T18222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 641.573616][T18222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 641.633859][T18221] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 641.645695][T18221] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 641.982597][T27261] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6224'. [ 642.344851][T27270] netlink: 'syz.4.6227': attribute type 2 has an invalid length. [ 642.587165][ T5842] Bluetooth: hci4: command tx timeout [ 642.746661][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.754964][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.766020][T18221] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 642.774007][T27292] dvmrp6: entered allmulticast mode [ 643.114623][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 643.141849][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.220804][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 643.230948][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 643.238798][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 643.258743][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 643.282448][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 643.472237][T27281] dvmrp6: left allmulticast mode [ 643.571648][T27315] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6238'. [ 643.634435][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 643.684944][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.729223][T27329] netlink: 'syz.1.6242': attribute type 30 has an invalid length. [ 643.738031][T27328] RDS: rds_bind could not find a transport for ::ffff:172.30.0.3, load rds_tcp or rds_rdma? [ 643.764014][T27320] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6240'. [ 643.832022][T27320] : entered promiscuous mode [ 643.884110][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 643.899014][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.919595][T27336] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6244'. [ 644.017383][T27336] bridge_slave_1 (unregistering): left allmulticast mode [ 644.029627][T27336] bridge_slave_1 (unregistering): left promiscuous mode [ 644.037381][T27336] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.119033][ T12] batman_adv: batadv0: Removing interface: netdevsim0 [ 644.131854][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 644.143510][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 644.242664][T27344] netlink: 'syz.4.6249': attribute type 3 has an invalid length. [ 644.331607][T18221] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 644.370131][T18221] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 644.460376][T18221] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 644.545081][T27355] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 644.545081][T27363] netlink: 'syz.4.6256': attribute type 2 has an invalid length. [ 644.572953][T18221] netdevsim netdevsim3 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 645.105056][T27396] netlink: 'syz.4.6263': attribute type 1 has an invalid length. [ 645.131053][T27394] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6263'. [ 645.237342][T27404] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6265'. [ 645.270402][ T12] team0: Port device geneve0 removed [ 645.316443][ T5839] Bluetooth: hci1: command tx timeout [ 645.656891][ T12] team0: Port device bridge8 removed [ 645.765983][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 645.783095][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 645.794033][ T12] bond0 (unregistering): Released all slaves [ 645.812048][ T12] bond1 (unregistering): Released all slaves [ 645.901634][ T12] bond2 (unregistering): (slave veth5): Releasing backup interface [ 645.911765][ T12] bond2 (unregistering): Released all slaves [ 646.001966][ T12] bond3 (unregistering): Released all slaves [ 646.014903][ T12] bond4 (unregistering): Released all slaves [ 646.028429][ T12] bond5 (unregistering): Released all slaves [ 646.041316][ T12] bond6 (unregistering): Released all slaves [ 646.079332][T27306] chnl_net:caif_netlink_parms(): no params data found [ 646.275907][T27418] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 646.369982][T27306] bridge0: port 1(bridge_slave_0) entered blocking state [ 646.387715][T27306] bridge0: port 1(bridge_slave_0) entered disabled state [ 646.394889][T27306] bridge_slave_0: entered allmulticast mode [ 646.417396][T27306] bridge_slave_0: entered promiscuous mode [ 646.426163][T27306] bridge0: port 2(bridge_slave_1) entered blocking state [ 646.433798][T27431] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6275'. [ 646.434053][T27306] bridge0: port 2(bridge_slave_1) entered disabled state [ 646.454042][T27306] bridge_slave_1: entered allmulticast mode [ 646.461793][T27306] bridge_slave_1: entered promiscuous mode [ 646.474748][T27435] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6273'. [ 646.649495][T27306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 646.670987][T27306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 646.766731][T27306] team0: Port device team_slave_0 added [ 646.779132][T27306] team0: Port device team_slave_1 added [ 646.820817][T27453] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6281'. [ 646.830521][T27449] netlink: 240 bytes leftover after parsing attributes in process `syz.4.6279'. [ 646.878870][T27306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 646.899087][T27306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 646.941210][T27306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 646.972832][T27306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 646.979900][T27306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 647.013810][T27306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 647.106315][T27476] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6285'. [ 647.154415][T27476] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6285'. [ 647.181824][T27306] hsr_slave_0: entered promiscuous mode [ 647.189361][T27306] hsr_slave_1: entered promiscuous mode [ 647.195861][T27306] debugfs: 'hsr0' already exists in 'hsr' [ 647.201717][T27306] Cannot create hsr debugfs directory [ 647.208221][T27476] bridge_slave_1: left allmulticast mode [ 647.224369][T27476] bridge_slave_1: left promiscuous mode [ 647.237223][T27476] bridge0: port 2(bridge_slave_1) entered disabled state [ 647.257743][T27476] bridge_slave_0: left allmulticast mode [ 647.262292][T27483] netlink: 148 bytes leftover after parsing attributes in process `syz.0.6288'. [ 647.274713][T27476] bridge_slave_0: left promiscuous mode [ 647.281969][T27476] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.341995][T27483] vcan0: entered allmulticast mode [ 647.385405][ T5839] Bluetooth: hci1: command tx timeout [ 647.641821][T27306] netdevsim netdevsim3 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 647.675971][T27497] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 647.707762][ T12] : left promiscuous mode [ 647.761136][T27306] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 647.793735][ T12] : left promiscuous mode [ 647.818999][T27505] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6295'. [ 647.958121][T27306] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 647.975894][T27505] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6295'. [ 648.044925][ T12] tipc: Left network mode [ 648.098833][ T12] IPVS: stopping master sync thread 17748 ... [ 648.113124][T27510] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 648.141039][T27505] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6295'. [ 648.168296][T27306] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 648.492921][T27525] netlink: 'syz.0.6302': attribute type 27 has an invalid length. [ 648.597822][T27306] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 648.663203][T27306] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 648.726617][T27531] netlink: 'syz.1.6305': attribute type 8 has an invalid length. [ 648.759704][T27306] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 648.773258][T27306] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 649.082045][T27555] netlink: 'syz.2.6311': attribute type 58 has an invalid length. [ 649.366936][ T12] hsr_slave_0: left promiscuous mode [ 649.376141][ T12] hsr_slave_1: left promiscuous mode [ 649.391601][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 649.401888][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 649.416907][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 649.435076][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 649.465686][ T5839] Bluetooth: hci1: command tx timeout [ 649.493973][ T12] team_slave_1: left promiscuous mode [ 649.508837][ T12] veth1_macvtap: left promiscuous mode [ 649.514483][ T12] veth0_macvtap: left promiscuous mode [ 649.521118][ T12] veth1_vlan: left promiscuous mode [ 649.526901][ T12] veth0_vlan: left promiscuous mode [ 649.908336][ T12] team0 (unregistering): Port device team_slave_1 removed [ 650.119303][ T12] team0 (unregistering): Port device €Â removed [ 650.232270][T27573] veth0_macvtap: left promiscuous mode [ 650.325176][T27306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 650.455012][T27306] 8021q: adding VLAN 0 to HW filter on device team0 [ 650.519416][T18220] bridge0: port 1(bridge_slave_0) entered blocking state [ 650.526586][T18220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 650.578439][T18220] bridge0: port 2(bridge_slave_1) entered blocking state [ 650.585603][T18220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 650.722005][ T12] IPVS: stop unused estimator thread 0... [ 650.728087][T27306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 650.785217][T27613] netlink: 'syz.1.6329': attribute type 1 has an invalid length. [ 650.835026][T27613] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 650.970400][T27621] 8021q: adding VLAN 0 to HW filter on device bond6 [ 651.063332][T27306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 651.173770][T27636] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 651.194435][T27636] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 651.222848][T27636] gretap1: entered promiscuous mode [ 651.231995][T27636] gretap1: entered allmulticast mode [ 651.250701][T27642] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 651.261067][T27306] veth0_vlan: entered promiscuous mode [ 651.274362][T27306] veth1_vlan: entered promiscuous mode [ 651.337609][T27306] veth0_macvtap: entered promiscuous mode [ 651.349741][T27306] veth1_macvtap: entered promiscuous mode [ 651.378300][T27306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 651.391576][T27306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 651.415068][ T3469] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.427380][ T3469] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.442634][ T3469] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.454916][ T3469] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.545875][ T5839] Bluetooth: hci1: command tx timeout [ 651.594092][T27663] netlink: 'syz.4.6340': attribute type 17 has an invalid length. [ 651.602466][T27663] __nla_validate_parse: 11 callbacks suppressed [ 651.602481][T27663] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6340'. [ 651.618138][T27663] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6340'. [ 651.641854][T18219] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 651.681327][T18219] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 651.751482][T18219] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 651.768646][T18219] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 651.805909][T27671] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6341'. [ 652.116433][T27692] netlink: 'syz.3.6348': attribute type 83 has an invalid length. [ 652.118730][T27690] tipc: Started in network mode [ 652.167732][T27690] tipc: Node identity 5647008e236a, cluster identity 4711 [ 652.175028][T27690] tipc: Enabled bearer , priority 0 [ 652.207298][T27690] syzkaller0: mtu less than device minimum [ 652.257903][T27688] tipc: Disabling bearer [ 652.835067][ T5842] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 652.845784][ T5842] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 652.853562][ T5842] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 652.855959][T27724] netlink: 84 bytes leftover after parsing attributes in process `syz.3.6359'. [ 652.873714][ T5842] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 652.883525][ T5842] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 652.911647][T27726] netlink: 'syz.1.6358': attribute type 21 has an invalid length. [ 652.927945][T27726] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6358'. [ 653.225672][T27747] Unsupported ieee802154 address type: 0 [ 653.414610][T27764] netlink: 88 bytes leftover after parsing attributes in process `syz.1.6370'. [ 653.486327][T27764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6370'. [ 653.681707][T27774] netlink: 'syz.0.6372': attribute type 33 has an invalid length. [ 653.750839][T27779] netlink: 'syz.1.6374': attribute type 15 has an invalid length. [ 653.769703][T27774] bond0: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 653.782894][T27779] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6374'. [ 653.790955][T27784] Bluetooth: MGMT ver 1.23 [ 653.801120][T27774] bond0 (unregistering): Released all slaves [ 653.848271][T27780] syzkaller1: entered promiscuous mode [ 653.854081][T27780] syzkaller1: entered allmulticast mode [ 653.891431][T27720] chnl_net:caif_netlink_parms(): no params data found [ 653.956926][T27787] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6376'. [ 653.966474][T27780] tipc: Enabling of bearer rejected, media not registered [ 653.989366][T27791] x_tables: ip_tables: socket match: used from hooks POSTROUTING, but only valid from PREROUTING/INPUT [ 654.082038][T27787] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6376'. [ 654.231220][T27720] bridge0: port 1(bridge_slave_0) entered blocking state [ 654.249033][T27720] bridge0: port 1(bridge_slave_0) entered disabled state [ 654.273510][T27807] x_tables: duplicate entry at hook 3 [ 654.275911][T27720] bridge_slave_0: entered allmulticast mode [ 654.287103][T27720] bridge_slave_0: entered promiscuous mode [ 654.308804][T27720] bridge0: port 2(bridge_slave_1) entered blocking state [ 654.325738][T27720] bridge0: port 2(bridge_slave_1) entered disabled state [ 654.336237][T27720] bridge_slave_1: entered allmulticast mode [ 654.344103][T27720] bridge_slave_1: entered promiscuous mode [ 654.408151][T27720] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 654.431910][T27720] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 654.531205][T27720] team0: Port device team_slave_0 added [ 654.550388][T27720] team0: Port device team_slave_1 added [ 654.644574][T27720] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 654.667187][T27720] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 654.718192][T27720] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 654.732868][T27720] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 654.740128][T27720] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 654.768654][T27720] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 654.907866][ T5839] Bluetooth: hci2: command tx timeout [ 654.975004][T27843] netlink: 'syz.1.6397': attribute type 11 has an invalid length. [ 654.983121][T27843] netlink: 'syz.1.6397': attribute type 11 has an invalid length. [ 655.045084][T27720] hsr_slave_0: entered promiscuous mode [ 655.052972][T27720] hsr_slave_1: entered promiscuous mode [ 655.086563][T27720] debugfs: 'hsr0' already exists in 'hsr' [ 655.092309][T27720] Cannot create hsr debugfs directory [ 655.159513][T27849] syzkaller0: entered promiscuous mode [ 655.165024][T27849] syzkaller0: entered allmulticast mode [ 655.208706][T27849] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 655.433743][ T5949] IPVS: starting estimator thread 0... [ 655.482853][T27871] netlink: 'syz.2.6406': attribute type 11 has an invalid length. [ 655.518168][T27720] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 655.536580][T27869] IPVS: using max 32 ests per chain, 76800 per kthread [ 655.538829][T27720] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 655.634902][T27881] x_tables: duplicate entry at hook 3 [ 655.643692][T27720] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 655.654176][T27720] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 655.745038][T27720] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 655.756979][T27720] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 655.850839][T27720] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 655.871352][T27720] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.039134][T27905] netlink: 'syz.1.6417': attribute type 17 has an invalid length. [ 656.116338][T27911] netlink: 'syz.2.6420': attribute type 7 has an invalid length. [ 656.124195][T27911] netlink: 'syz.2.6420': attribute type 8 has an invalid length. [ 656.133385][T27909] bond1: Invalid ad_actor_system MAC address. [ 656.140140][T27909] bond1: option ad_actor_system: invalid value (1) [ 656.149024][T27909] bond1 (unregistering): Released all slaves [ 656.177621][T27720] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 656.190792][T27720] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 656.232384][T27720] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 656.259649][T27720] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 656.310746][T27923] openvswitch: netlink: Flow key attr not present in new flow. [ 656.420386][T27720] 8021q: adding VLAN 0 to HW filter on device bond0 [ 656.452047][T27720] 8021q: adding VLAN 0 to HW filter on device team0 [ 656.478501][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 656.485692][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 656.524219][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 656.531374][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 656.896423][T27720] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 656.989038][ T5839] Bluetooth: hci2: command tx timeout [ 657.037184][T27962] __nla_validate_parse: 15 callbacks suppressed [ 657.037201][T27962] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6432'. [ 657.328022][T27983] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6439'. [ 657.503716][T27983] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6439'. [ 657.553392][T27983] bridge0: port 2(bridge_slave_1) entered disabled state [ 657.641197][T27720] veth0_vlan: entered promiscuous mode [ 657.656951][T28006] netlink: 'syz.2.6441': attribute type 1 has an invalid length. [ 657.678890][T27720] veth1_vlan: entered promiscuous mode [ 657.686645][T28006] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6441'. [ 657.703590][T28006] netlink: 512 bytes leftover after parsing attributes in process `syz.2.6441'. [ 657.762257][T27720] veth0_macvtap: entered promiscuous mode [ 657.816610][T27720] veth1_macvtap: entered promiscuous mode [ 657.859309][T27720] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 657.891488][T27720] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 657.928985][T18221] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.949760][T28021] netlink: 'syz.1.6446': attribute type 17 has an invalid length. [ 657.961939][T18221] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.965202][T28021] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6446'. [ 657.980478][T28021] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6446'. [ 657.986865][T18221] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.024238][T28031] netlink: 'syz.0.6449': attribute type 1 has an invalid length. [ 658.044347][T28027] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6448'. [ 658.054025][T18221] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.213987][ T164] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.250570][T28037] netlink: 'syz.2.6450': attribute type 44 has an invalid length. [ 658.259971][ T164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.287881][T28039] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 658.294744][T28037] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 658.311628][T28041] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6450'. [ 658.331824][T28041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6450'. [ 658.369264][T28046] netlink: 'syz.3.6452': attribute type 6 has an invalid length. [ 658.447506][T28050] openvswitch: netlink: Flow key attr not present in new flow. [ 658.514414][T28046] 8021q: adding VLAN 0 to HW filter on device bond1 [ 658.535520][ T2211] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.543351][ T2211] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.597328][T28051] bond1: (slave veth3): Enslaving as an active interface with a down link [ 658.637177][T28055] bond1: (slave veth0_to_bond): making interface the new active one [ 658.658071][T28055] veth0_to_bond: entered promiscuous mode [ 658.664276][T28055] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 658.703782][T28046] bond1: entered promiscuous mode [ 658.709584][T28046] bond1: entered allmulticast mode [ 658.714809][T28046] veth0_to_bond: entered allmulticast mode [ 658.784763][T28068] validate_nla: 2 callbacks suppressed [ 658.784781][T28068] netlink: 'syz.3.6461': attribute type 39 has an invalid length. [ 658.910170][T28073] netlink: 'syz.2.6462': attribute type 1 has an invalid length. [ 658.964875][T28077] netlink: 'syz.0.6463': attribute type 1 has an invalid length. [ 658.983185][T28073] 8021q: adding VLAN 0 to HW filter on device bond1 [ 659.076216][ T5839] Bluetooth: hci2: command tx timeout [ 659.129181][T28084] 8021q: adding VLAN 0 to HW filter on device bond4 [ 659.157050][T28084] bond3: (slave bond4): making interface the new active one [ 659.179600][T28099] xt_CT: You must specify a L4 protocol and not use inversions on it [ 659.180175][T28100] xt_CT: You must specify a L4 protocol and not use inversions on it [ 659.204412][T28084] bond3: (slave bond4): Enslaving as an active interface with an up link [ 659.279996][T28104] gtp0: entered promiscuous mode [ 659.296963][T28104] gtp0: entered allmulticast mode [ 659.394570][T28111] netlink: 'syz.2.6473': attribute type 12 has an invalid length. [ 659.417961][T28115] batman_adv: batadv0: Adding interface: dummy0 [ 659.424579][T28115] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 659.461363][T28115] batman_adv: batadv0: Interface activated: dummy0 [ 659.705932][ T13] wlan0: Trigger new scan to find an IBSS to join [ 659.796860][T28141] syz_tun: entered allmulticast mode [ 660.021965][T28159] ip6t_srh: unknown srh match flags 4000 [ 660.518857][T28186] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 660.556899][T28183] bridge3: port 1(veth3) entered blocking state [ 660.563377][T28183] bridge3: port 1(veth3) entered disabled state [ 660.570189][T28183] veth3: entered allmulticast mode [ 660.577621][T28183] veth3: entered promiscuous mode [ 660.611358][T28188] bridge3: port 2(veth0_to_bond) entered blocking state [ 660.618710][T28188] bridge3: port 2(veth0_to_bond) entered disabled state [ 660.626323][T28188] veth0_to_bond: entered allmulticast mode [ 660.633564][T28188] veth0_to_bond: entered promiscuous mode [ 660.855751][T28206] netlink: 'syz.1.6502': attribute type 1 has an invalid length. [ 660.919474][T28213] pim6reg: entered allmulticast mode [ 660.943584][T28206] bond6: (slave gretap2): making interface the new active one [ 660.957685][T28206] bond6: (slave gretap2): Enslaving as an active interface with an up link [ 660.967237][T28213] pim6reg: left allmulticast mode [ 661.051194][T28218] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 661.159273][ T5839] Bluetooth: hci2: command tx timeout [ 661.179974][T28232] bond2: option all_slaves_active: invalid value (222) [ 661.193440][T28232] bond2 (unregistering): Released all slaves [ 661.549892][T28251] team0 (unregistering): Port device team_slave_0 removed [ 661.599351][T28251] team0 (unregistering): Port device team_slave_1 removed [ 661.622078][T28253] netlink: 'syz.3.6514': attribute type 3 has an invalid length. [ 661.653241][T28256] syzkaller0: entered promiscuous mode [ 661.662331][T28256] syzkaller0: entered allmulticast mode [ 661.808222][T28266] can: request_module (can-proto-5) failed. [ 661.895434][T28270] xt_TCPMSS: Only works on TCP SYN packets [ 662.004537][T18221] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 662.059780][T28280] __nla_validate_parse: 24 callbacks suppressed [ 662.059796][T28280] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6520'. [ 662.090158][T18221] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 662.091688][T28280] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6520'. [ 662.103192][T18221] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 662.118238][T18221] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 662.247423][T28300] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6525'. [ 662.261322][T28301] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6523'. [ 662.278934][T28301] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6523'. [ 662.452591][T28312] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6530'. [ 662.471513][T28313] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6529'. [ 662.684714][T28329] dvmrp0: entered allmulticast mode [ 662.697167][T28329] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6534'. [ 662.757271][ T13] wlan0: Trigger new scan to find an IBSS to join [ 662.786030][T28334] netlink: 'syz.1.6537': attribute type 1 has an invalid length. [ 662.874418][T28334] 8021q: adding VLAN 0 to HW filter on device bond7 [ 663.010124][T28341] bond7: (slave veth5): Enslaving as an active interface with a down link [ 663.100563][T28356] openvswitch: netlink: EtherType 50a is less than min 600 [ 663.234393][T28361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6545'. [ 663.280863][T28368] netlink: 'syz.3.6548': attribute type 1 has an invalid length. [ 663.390147][T28376] netlink: 96 bytes leftover after parsing attributes in process `syz.0.6550'. [ 663.576288][T28385] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 663.706277][T28396] netlink: 'syz.4.6557': attribute type 5 has an invalid length. [ 663.906115][T28411] netlink: 'syz.4.6562': attribute type 2 has an invalid length. [ 664.032478][T28419] netlink: zone id is out of range [ 664.044331][T28419] netlink: del zone limit has 4 unknown bytes [ 664.392440][T28437] syzkaller1: entered promiscuous mode [ 664.419391][T28437] syzkaller1: entered allmulticast mode [ 664.773924][T17315] IPVS: starting estimator thread 0... [ 664.875420][T28458] IPVS: using max 30 ests per chain, 72000 per kthread [ 664.889755][T28460] netlink: 'syz.4.6577': attribute type 1 has an invalid length. [ 664.908111][T28460] netlink: 'syz.4.6577': attribute type 1 has an invalid length. [ 665.369412][T28481] : entered promiscuous mode [ 665.604312][T28503] xt_CT: You must specify a L4 protocol and not use inversions on it [ 665.702131][T28507] sch_fq: defrate 0 ignored. [ 665.715688][T18217] wlan0: Trigger new scan to find an IBSS to join [ 665.735228][T28509] IPv6: sit1: Disabled Multicast RS [ 665.754442][T28509] sit1: entered allmulticast mode [ 665.832457][T28519] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 666.548779][T28568] tipc: Enabled bearer , priority 0 [ 666.571653][T28570] syzkaller0: entered promiscuous mode [ 666.620024][T28570] syzkaller0: entered allmulticast mode [ 666.651126][T28567] tipc: Resetting bearer [ 666.659984][ T12] wlan0: Creating new IBSS network, BSSID 4a:6a:9f:80:4e:df [ 666.684914][T28567] tipc: Disabling bearer [ 666.763262][T28584] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 667.003397][T28599] openvswitch: netlink: IP tunnel TTL not specified. [ 667.024242][T28599] netlink: 'syz.4.6618': attribute type 1 has an invalid length. [ 667.050560][T28599] netlink: 'syz.4.6618': attribute type 2 has an invalid length. [ 667.129473][T28610] __nla_validate_parse: 21 callbacks suppressed [ 667.129492][T28610] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6622'. [ 667.188315][T28615] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6623'. [ 667.198470][T28610] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6622'. [ 667.298164][T28617] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6624'. [ 667.324761][T28621] sock: sock_set_timeout: `syz.3.6625' (pid 28621) tries to set negative timeout [ 667.346269][T28622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6626'. [ 667.429414][T28626] xt_connbytes: Forcing CT accounting to be enabled [ 667.711766][T28653] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6635'. [ 667.811952][T28653] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6635'. [ 667.934585][T28665] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6639'. [ 668.025631][ T5839] Bluetooth: hci2: command tx timeout [ 668.063831][T28671] bond2: Unable to set peer notification delay as MII monitoring is disabled [ 668.108731][T28671] bond2 (unregistering): Released all slaves [ 668.128594][T28679] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6643'. [ 668.176762][T28678] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6643'. [ 668.322810][T28693] sctp: [Deprecated]: syz.0.6648 (pid 28693) Use of int in maxseg socket option. [ 668.322810][T28693] Use struct sctp_assoc_value instead [ 668.401734][T28693] openvswitch: netlink: Flow key attr not present in new flow. [ 668.933624][T28742] SET target dimension over the limit! [ 668.964682][T28745] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 669.040265][T28745] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 669.144526][T28756] netlink: 'syz.3.6667': attribute type 10 has an invalid length. [ 669.274127][T28762] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 669.406109][T28772] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 669.534094][T28783] netlink: 'syz.2.6673': attribute type 16 has an invalid length. [ 669.547065][T28787] : renamed from ipvlan0 [ 669.578952][T28783] netlink: 'syz.2.6673': attribute type 17 has an invalid length. [ 669.639805][T28783] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 670.234057][T28832] netlink: 'syz.4.6683': attribute type 1 has an invalid length. [ 670.306651][T28832] bond1: entered promiscuous mode [ 670.337203][T28832] 8021q: adding VLAN 0 to HW filter on device bond1 [ 670.461263][T28844] syzkaller1: entered promiscuous mode [ 670.511106][T28844] syzkaller1: entered allmulticast mode [ 670.630635][T28826] bond1: (slave bridge2): making interface the new active one [ 670.640030][T28826] bridge2: entered promiscuous mode [ 670.646338][T28826] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 670.779151][T28863] tipc: Enabled bearer , priority 0 [ 670.787435][T28863] bridge0: entered promiscuous mode [ 670.825492][T28863] bridge0: entered allmulticast mode [ 670.869197][T28862] tipc: Disabling bearer [ 671.160185][T28895] Cannot find del_set index 49151 as target [ 671.451562][T28922] netlink: 'syz.1.6704': attribute type 2 has an invalid length. [ 671.474263][T28922] netlink: 'syz.1.6704': attribute type 2 has an invalid length. [ 671.673997][T28936] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 671.698570][T28938] netlink: 'syz.3.6710': attribute type 12 has an invalid length. [ 671.707548][T28938] netlink: 'syz.3.6710': attribute type 29 has an invalid length. [ 671.980531][T28958] syzkaller1: entered promiscuous mode [ 671.988042][T28958] syzkaller1: entered allmulticast mode [ 672.294278][T28979] pimreg: entered allmulticast mode [ 672.383786][T28983] __nla_validate_parse: 20 callbacks suppressed [ 672.383803][T28983] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6722'. [ 672.416552][T28983] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6722'. [ 672.427375][T28983] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6722'. [ 672.524502][T28998] netlink: 'syz.0.6726': attribute type 2 has an invalid length. [ 672.866325][T29023] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 672.930034][T29029] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6739'. [ 672.939593][T29029] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6739'. [ 672.949072][T29029] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6739'. [ 672.958529][T29029] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6739'. [ 673.058103][T29033] netlink: 'syz.0.6742': attribute type 1 has an invalid length. [ 673.068288][T29035] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6740'. [ 673.088370][T29035] openvswitch: netlink: Flow key attr not present in new flow. [ 673.100632][T29034] bond5 (unregistering): Released all slaves [ 673.198917][T29041] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6743'. [ 673.368102][T29050] bond2: peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 673.381797][T29050] bond2: entered promiscuous mode [ 673.387539][T29050] bond2: entered allmulticast mode [ 673.393316][T29050] 8021q: adding VLAN 0 to HW filter on device bond2 [ 673.817761][T29090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6759'. [ 674.433956][T29142] validate_nla: 1 callbacks suppressed [ 674.433973][T29142] netlink: 'syz.1.6774': attribute type 2 has an invalid length. [ 674.498681][T16500] IPVS: starting estimator thread 0... [ 674.511240][T29146] netlink: zone id is out of range [ 674.549799][T29146] netlink: zone id is out of range [ 674.554938][T29146] netlink: zone id is out of range [ 674.568980][T29146] netlink: zone id is out of range [ 674.577353][T29154] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 674.580471][T29146] netlink: zone id is out of range [ 674.591877][T29149] nbd: couldn't find a device at index 0 [ 674.605478][T29147] IPVS: using max 30 ests per chain, 72000 per kthread [ 674.619407][T29146] netlink: get zone limit has 4 unknown bytes [ 674.681487][T29164] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 674.693104][T29165] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 674.728691][T29160] bond2: option xmit_hash_policy: invalid value (64) [ 674.740402][T29160] bond2 (unregistering): Released all slaves [ 674.966882][T29175] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 674.987059][T29178] netlink: 'syz.4.6784': attribute type 1 has an invalid length. [ 675.110085][T29178] bond2: (slave geneve2): making interface the new active one [ 675.139125][T29178] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 675.149498][ T3867] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 675.158946][ T3867] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 675.177897][ T3867] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 675.195784][ T3867] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 675.300601][T29203] netlink: 'syz.4.6792': attribute type 4 has an invalid length. [ 675.424806][T29213] sctp: [Deprecated]: syz.0.6795 (pid 29213) Use of struct sctp_assoc_value in delayed_ack socket option. [ 675.424806][T29213] Use struct sctp_sack_info instead [ 675.465463][T29206] nbd8: detected capacity change from 0 to 127 [ 675.482713][ T5839] block nbd8: Receive control failed (result -32) [ 675.768585][T29242] openvswitch: netlink: Key 11 has unexpected len 4 expected 2 [ 675.805661][T29244] openvswitch: netlink: Key 11 has unexpected len 4 expected 2 [ 676.308622][T29278] bond8: Unable to set down delay as MII monitoring is disabled [ 676.318547][T29278] bond8 (unregistering): Released all slaves [ 676.688582][T29313] ipt_ECN: cannot use operation on non-tcp rule [ 676.879893][T29322] netlink: 'syz.1.6828': attribute type 3 has an invalid length. [ 677.071082][T29333] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 677.409004][T29346] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 677.454522][T29344] __nla_validate_parse: 17 callbacks suppressed [ 677.454540][T29344] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6836'. [ 677.491746][T29351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6840'. [ 677.507039][T29352] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6836'. [ 677.524598][T29344] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.532509][T29344] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.555934][T29352] bridge0: port 2(bridge_slave_1) entered blocking state [ 677.563125][T29352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 677.570626][T29352] bridge0: port 1(bridge_slave_0) entered blocking state [ 677.577790][T29352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 677.588283][T29352] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6836'. [ 677.608730][T29352] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.615978][T29352] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.694190][T29357] ipvlan2: entered promiscuous mode [ 677.826602][T29372] netlink: 27 bytes leftover after parsing attributes in process `syz.4.6846'. [ 677.843376][T29376] netlink: 'syz.1.6847': attribute type 1 has an invalid length. [ 677.852523][T29376] netlink: 'syz.1.6847': attribute type 2 has an invalid length. [ 678.038045][T29388] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6850'. [ 678.071235][T29392] netlink: 'syz.2.6854': attribute type 1 has an invalid length. [ 678.321319][T29409] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6858'. [ 678.364399][T29417] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6860'. [ 678.415103][T29424] Bluetooth: MGMT ver 1.23 [ 678.429033][T29417] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6860'. [ 678.459542][T29414] netlink: 'syz.4.6859': attribute type 12 has an invalid length. [ 678.718953][T29441] netlink: 'syz.3.6867': attribute type 11 has an invalid length. [ 678.843517][T29457] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6870'. [ 678.935939][T29461] x_tables: duplicate underflow at hook 1 [ 679.979671][T29551] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 680.431167][ T5839] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 680.519965][ T5839] Bluetooth: hci2: command 0x0401 tx timeout [ 680.818897][T29598] net_ratelimit: 7 callbacks suppressed [ 680.818917][T29598] sock: sock_set_timeout: `syz.1.6913' (pid 29598) tries to set negative timeout [ 681.022679][T29615] nbd: couldn't find a device at index 0 [ 681.053360][T29616] netlink: 'syz.2.6918': attribute type 16 has an invalid length. [ 681.066957][T29617] nbd: couldn't find a device at index 0 [ 681.109595][T29616] netlink: 'syz.2.6918': attribute type 17 has an invalid length. [ 681.341890][T29616] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 681.704651][T29655] IPVS: set_ctl: invalid protocol: 50 172.20.20.187:20000 [ 682.118611][T29686] vlan2: entered promiscuous mode [ 682.124325][T29686] geneve1: entered promiscuous mode [ 682.130088][T29686] vlan2: entered allmulticast mode [ 682.135735][T29686] geneve1: entered allmulticast mode [ 682.406711][T29704] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 682.651395][T29721] __nla_validate_parse: 16 callbacks suppressed [ 682.651414][T29721] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6949'. [ 682.771791][T29729] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 682.807113][T29729] bond3: (slave vcan1): Error -95 calling set_mac_address [ 682.951215][T29737] syzkaller0: entered promiscuous mode [ 682.956888][T29737] syzkaller0: entered allmulticast mode [ 683.222051][T29756] ipt_REJECT: TCP_RESET invalid for non-tcp [ 683.236436][ T5842] Bluetooth: hci2: command 0x0401 tx timeout [ 683.289298][T29756] tipc: Started in network mode [ 683.304010][T29764] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6962'. [ 683.304730][T29756] tipc: Node identity e621e06a8448, cluster identity 4711 [ 683.313990][T29764] netlink: 'syz.4.6962': attribute type 5 has an invalid length. [ 683.314009][T29764] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6962'. [ 683.340341][T29756] tipc: Enabled bearer , priority 0 [ 683.373046][T29764] geneve3: entered promiscuous mode [ 683.378755][T29764] geneve3: entered allmulticast mode [ 683.390309][T29765] syzkaller0: entered promiscuous mode [ 683.396691][T29765] syzkaller0: entered allmulticast mode [ 683.408735][ T3469] netdevsim netdevsim4 netdevsim0: set [1, 2] type 2 family 0 port 256 - 0 [ 683.418907][ T3469] netdevsim netdevsim4 netdevsim1: set [1, 2] type 2 family 0 port 256 - 0 [ 683.446326][T29756] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 683.481052][ T3469] netdevsim netdevsim4 netdevsim2: set [1, 2] type 2 family 0 port 256 - 0 [ 683.516018][ T3469] netdevsim netdevsim4 netdevsim3: set [1, 2] type 2 family 0 port 256 - 0 [ 683.529010][T29756] tipc: Resetting bearer [ 683.549118][T29771] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6964'. [ 683.572774][T29755] tipc: Resetting bearer [ 683.605015][T29755] tipc: Disabling bearer [ 683.617028][T29776] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6966'. [ 683.626288][T29776] tipc: Invalid UDP bearer configuration [ 683.626331][T29776] tipc: Enabling of bearer rejected, failed to enable media [ 683.726611][T29779] 8021q: adding VLAN 0 to HW filter on device bond4 [ 683.760216][T29779] bond_slave_0: entered promiscuous mode [ 683.766105][T29779] bond_slave_1: entered promiscuous mode [ 683.777260][T29779] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 683.791923][T29779] bond4: (slave macvlan3): Enslaving as a backup interface with an up link [ 683.832530][T29795] netlink: 'syz.4.6969': attribute type 15 has an invalid length. [ 684.002997][T29803] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6975'. [ 684.005088][T29801] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 684.026466][T29801] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6974'. [ 684.037967][T29803] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 684.066009][T29805] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6976'. [ 684.070873][T29803] netlink: 184 bytes leftover after parsing attributes in process `syz.4.6975'. [ 684.129645][T29808] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6977'. [ 684.242777][T29815] IPVS: set_ctl: invalid protocol: 44 224.0.0.2:20002 [ 684.877465][T29869] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 684.980773][T29881] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 685.253906][T29895] netlink: 'syz.1.7005': attribute type 30 has an invalid length. [ 685.527360][T29912] Bluetooth: MGMT ver 1.23 [ 685.537981][T29912] Bluetooth: hci1: too big key_count value 32778 [ 686.821335][T30015] netlink: 'syz.3.7036': attribute type 1 has an invalid length. [ 686.834049][T30015] netlink: 'syz.3.7036': attribute type 4 has an invalid length. [ 686.884574][T30016] openvswitch: netlink: nsh attr 12336 is out of range max 3 [ 686.951457][T30025] sctp: [Deprecated]: syz.3.7040 (pid 30025) Use of struct sctp_assoc_value in delayed_ack socket option. [ 686.951457][T30025] Use struct sctp_sack_info instead [ 687.290827][T30050] No such timeout policy "syz1" [ 687.663828][T30068] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 687.747946][T30073] bond0: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 687.780666][T30076] __nla_validate_parse: 18 callbacks suppressed [ 687.780683][T30076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7055'. [ 687.854409][T30085] netlink: 'syz.3.7058': attribute type 13 has an invalid length. [ 687.871218][T30085] veth0_macvtap: left promiscuous mode [ 687.887383][T30085] macvtap0: entered allmulticast mode [ 687.903445][T30085] macvtap0: refused to change device tx_queue_len [ 687.949025][T30088] pim6reg: entered allmulticast mode [ 688.114588][T30101] syzkaller1: entered promiscuous mode [ 688.132173][T30101] syzkaller1: entered allmulticast mode [ 688.269632][T30107] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7064'. [ 688.297897][T30110] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 688.424581][T30115] bridge0: port 1(bridge_slave_0) entered disabled state [ 688.426823][T30119] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7068'. [ 688.528797][T30124] netlink: 'syz.4.7069': attribute type 29 has an invalid length. [ 688.542611][T30124] netlink: 'syz.4.7069': attribute type 29 has an invalid length. [ 688.561045][T30124] netlink: 'syz.4.7069': attribute type 29 has an invalid length. [ 688.572091][T30124] netlink: 'syz.4.7069': attribute type 29 has an invalid length. [ 688.603568][T30124] netlink: 'syz.4.7069': attribute type 29 has an invalid length. [ 688.613879][T30124] netlink: 'syz.4.7069': attribute type 29 has an invalid length. [ 688.733353][T30135] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7073'. [ 688.742906][T30135] netlink: 15 bytes leftover after parsing attributes in process `syz.3.7073'. [ 688.796153][T30135] netlink: 15 bytes leftover after parsing attributes in process `syz.3.7073'. [ 688.819265][T30135] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7073'. [ 688.887509][T30144] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7075'. [ 689.776692][T30191] netlink: 120 bytes leftover after parsing attributes in process `syz.3.7092'. [ 689.929484][T30200] netlink: 'syz.3.7095': attribute type 8 has an invalid length. [ 690.019947][T30197] ip6gre2: entered promiscuous mode [ 690.441082][T30216] netlink: 76 bytes leftover after parsing attributes in process `syz.2.7100'. [ 690.451976][T30217] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 690.564197][T30221] x_tables: unsorted entry at hook 1 [ 690.803733][T30231] syzkaller0: entered promiscuous mode [ 690.841535][T30231] syzkaller0: entered allmulticast mode [ 691.880356][T30293] x_tables: duplicate underflow at hook 1 [ 691.892235][T30291] tipc: Enabled bearer , priority 0 [ 691.913812][T30291] syzkaller0: entered promiscuous mode [ 691.936622][T30291] syzkaller0: entered allmulticast mode [ 691.957296][T30291] tipc: Resetting bearer [ 691.994552][T30291] tipc: Disabling bearer [ 692.074784][T30302] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 692.791544][T30354] __nla_validate_parse: 13 callbacks suppressed [ 692.791563][T30354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7143'. [ 692.814685][T30354] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 692.871148][T30354] team1: entered promiscuous mode [ 692.915678][T30354] team1: entered allmulticast mode [ 693.323574][ T3508] tipc: Subscription rejected, illegal request [ 693.431699][T30406] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 693.501625][T30411] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 693.533121][T30409] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 693.668531][T30420] tipc: Started in network mode [ 693.673526][T30420] tipc: Node identity 12f92b343503, cluster identity 4711 [ 693.688430][T30420] tipc: Enabled bearer , priority 0 [ 693.696746][T30422] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 693.717726][T30420] syzkaller0: entered promiscuous mode [ 693.723216][T30420] syzkaller0: entered allmulticast mode [ 693.739097][T30422] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7167'. [ 693.768890][T30420] tipc: Resetting bearer [ 693.775176][T30424] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7168'. [ 693.789471][T30427] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7167'. [ 693.904801][T30435] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7171'. [ 693.935705][T30435] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7171'. [ 693.945053][T30435] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7171'. [ 693.955221][T30435] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7171'. [ 693.964890][T30435] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7171'. [ 693.980356][T30439] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 694.031349][T30435] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7171'. [ 694.097028][T30417] tipc: Resetting bearer [ 694.166288][T30417] tipc: Disabling bearer [ 694.283919][T30454] x_tables: duplicate underflow at hook 3 [ 694.313865][T30447] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 694.410455][T30460] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 694.630377][T30474] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 694.647017][T30474] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 694.651236][T30482] netlink: 'syz.3.7187': attribute type 1 has an invalid length. [ 694.654866][T30474] gretap2: entered promiscuous mode [ 694.670227][T30474] gretap2: entered allmulticast mode [ 694.840913][T30490] netlink: 'syz.4.7190': attribute type 1 has an invalid length. [ 694.977598][T30501] xt_l2tp: v2 doesn't support IP mode [ 695.513182][T30539] netlink: 'syz.4.7205': attribute type 13 has an invalid length. [ 695.733202][T30550] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 695.744284][T30550] syzkaller0: entered promiscuous mode [ 695.752862][T30550] syzkaller0: entered allmulticast mode [ 695.924758][T30561] bridge0: port 2(bridge_slave_1) entered disabled state [ 695.932456][T30561] bridge0: port 1(bridge_slave_0) entered disabled state [ 696.030208][T30561] bridge_slave_0: left allmulticast mode [ 696.037767][T30561] bridge_slave_0: left promiscuous mode [ 696.043642][T30561] bridge0: port 1(bridge_slave_0) entered disabled state [ 696.073682][T30561] bridge_slave_1: left allmulticast mode [ 696.080001][T30561] bridge_slave_1: left promiscuous mode [ 696.096976][T30561] bridge0: port 2(bridge_slave_1) entered disabled state [ 696.120427][T30561] veth0_to_bond: left allmulticast mode [ 696.138779][T30561] veth0_to_bond: left promiscuous mode [ 696.144469][T30561] bridge3: port 2(veth0_to_bond) entered disabled state [ 696.174701][T30561] bond0: (slave bond_slave_0): Releasing backup interface [ 696.230501][T30561] bond0: (slave bond_slave_1): Releasing backup interface [ 696.279618][T30561] team0: Port device team_slave_0 removed [ 696.295762][T30561] team0: Port device team_slave_1 removed [ 696.306332][T30561] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 696.318645][T30561] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 696.331000][T30561] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 696.349991][T30561] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 696.373647][T30561] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 696.405067][T30550] tipc: Enabled bearer , priority 0 [ 696.436330][T30581] syzkaller0: entered promiscuous mode [ 696.457126][T30581] syzkaller0: entered allmulticast mode [ 696.474688][ T5918] syz1: Port: 1 Link DOWN [ 696.484062][T30537] tipc: Resetting bearer [ 696.518279][T30537] tipc: Disabling bearer [ 696.724553][T30611] netlink: 'syz.4.7221': attribute type 1 has an invalid length. [ 696.938899][T30623] netlink: 'syz.1.7225': attribute type 1 has an invalid length. [ 696.977638][T30623] netlink: 'syz.1.7225': attribute type 2 has an invalid length. [ 697.003336][T30625] syzkaller0: entered promiscuous mode [ 697.009093][T30625] syzkaller0: entered allmulticast mode [ 697.741108][T30641] x_tables: unsorted underflow at hook 4 [ 697.798780][T30646] __nla_validate_parse: 62 callbacks suppressed [ 697.798798][T30646] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7232'. [ 697.857609][T30647] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7232'. [ 697.929027][T30649] netlink: 45 bytes leftover after parsing attributes in process `syz.4.7233'. [ 697.982153][T30646] hsr_slave_1 (unregistering): left promiscuous mode [ 698.187011][T30662] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7239'. [ 698.232320][T30662] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7239'. [ 698.353284][T30674] netlink: 10 bytes leftover after parsing attributes in process `syz.3.7243'. [ 698.430578][T30680] Unknown options in mask b7f2 [ 698.479304][T30685] x_tables: duplicate underflow at hook 1 [ 698.606291][T30693] netlink: 'syz.0.7250': attribute type 1 has an invalid length. [ 698.647590][T30698] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7252'. [ 699.148026][T30732] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 699.997995][T30791] netlink: 'syz.4.7273': attribute type 17 has an invalid length. [ 700.017384][T30791] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7273'. [ 700.053065][T30791] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7273'. [ 700.096080][T30791] gretap0: entered promiscuous mode [ 700.122928][T30791] gretap0: left promiscuous mode [ 700.384454][T30813] netlink: 1 bytes leftover after parsing attributes in process `syz.2.7280'. [ 700.818836][T30837] syzkaller0: create flow: hash 3671401906 index 1 [ 700.834815][ T36] syzkaller0: tun_net_xmit 76 [ 700.849281][ T36] syzkaller0: tun_net_xmit 48 [ 700.857476][T16499] syzkaller0: tun_net_xmit 76 [ 701.261564][T30837] syzkaller0: delete flow: hash 3671401906 index 1 [ 701.614705][T30864] netlink: 'syz.2.7291': attribute type 20 has an invalid length. [ 703.124371][T30883] vlan4: entered allmulticast mode [ 703.136325][T30886] netlink: 'syz.4.7299': attribute type 1 has an invalid length. [ 703.152698][T30886] netlink: 'syz.4.7299': attribute type 7 has an invalid length. [ 703.161871][T30889] __nla_validate_parse: 3 callbacks suppressed [ 703.161887][T30889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7298'. [ 703.177638][T30886] netlink: 'syz.4.7299': attribute type 8 has an invalid length. [ 703.191780][T30889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7298'. [ 703.193126][T30890] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7297'. [ 703.210665][T30886] netlink: 132 bytes leftover after parsing attributes in process `syz.4.7299'. [ 703.686350][T30926] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 703.785192][T30937] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7309'. [ 703.908636][T30943] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7314'. [ 703.919287][T30943] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7314'. [ 703.950965][T30943] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7314'. [ 703.967651][T30943] bridge0: entered promiscuous mode [ 703.973584][T30943] macsec2: entered promiscuous mode [ 703.979447][T30943] macsec2: entered allmulticast mode [ 703.986055][T30943] bridge0: port 5(macsec2) entered blocking state [ 703.992661][T30943] bridge0: port 5(macsec2) entered disabled state [ 704.002392][T30943] bridge0: left promiscuous mode [ 704.390694][T30966] netlink: 11 bytes leftover after parsing attributes in process `syz.0.7321'. [ 704.400567][T30966] netlink: 11 bytes leftover after parsing attributes in process `syz.0.7321'. [ 704.518495][T30972] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 704.564997][T30938] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 704.682723][T30978] netlink: 'syz.2.7326': attribute type 2 has an invalid length. [ 705.760461][ T3555] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.811301][ T3555] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.839693][ T3555] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.861232][ T3555] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.980046][ T3555] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.980248][T31021] lec:lec_atm_close: lec0: Shut down! [ 705.997119][ T3555] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 706.009723][ T3555] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 706.021049][ T3555] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 706.283607][T31080] tipc: Enabled bearer , priority 0 [ 706.302422][T31080] mac80211_hwsim hwsim57 syzkaller0: entered promiscuous mode [ 706.317799][T31080] mac80211_hwsim hwsim57 syzkaller0: entered allmulticast mode [ 706.382579][T31090] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 706.531904][T31107] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 706.909102][T31137] bond3: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 706.933171][T31137] bond3 (unregistering): Released all slaves [ 707.238662][T31158] netlink: 'syz.4.7373': attribute type 9 has an invalid length. [ 707.345590][T31164] tipc: Enabling of bearer rejected, failed to enable media [ 707.450231][ T5918] tipc: Node number set to 1965883534 [ 707.518088][T31170] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 707.612877][T31170] openvswitch: netlink: Flow key attr not present in new flow. [ 707.799159][T31187] tipc: Enabled bearer , priority 0 [ 707.835576][T31187] syzkaller0: entered promiscuous mode [ 707.843669][T31187] syzkaller0: entered allmulticast mode [ 708.050038][T31212] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 708.100835][T31187] tipc: Resetting bearer [ 708.180872][T31187] tipc: Resetting bearer [ 708.249966][T31187] tipc: Disabling bearer [ 708.356137][T31228] netlink: 'syz.4.7390': attribute type 4 has an invalid length. [ 708.364283][T31228] netlink: 'syz.4.7390': attribute type 1 has an invalid length. [ 708.410789][T31228] __nla_validate_parse: 11 callbacks suppressed [ 708.410805][T31228] netlink: 228 bytes leftover after parsing attributes in process `syz.4.7390'. [ 708.531661][T31234] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7394'. [ 708.581708][T31237] netlink: 'syz.4.7395': attribute type 1 has an invalid length. [ 708.594048][T31237] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7395'. [ 708.663056][T31242] netlink: 'syz.1.7397': attribute type 39 has an invalid length. [ 708.736307][T31247] bond0: Caught tx_queue_len zero misconfig [ 708.813290][T31250] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7401'. [ 708.829592][T31254] netlink: 'syz.3.7400': attribute type 2 has an invalid length. [ 708.836156][T31250] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7401'. [ 708.847959][T31250] bridge0: entered promiscuous mode [ 708.853192][T31250] bridge0: entered allmulticast mode [ 709.170566][T31275] 8021q: VLANs not supported on ipvlan1 [ 709.241562][T31275] netlink: 'syz.3.7407': attribute type 1 has an invalid length. [ 709.268067][T31275] netlink: 'syz.3.7407': attribute type 10 has an invalid length. [ 709.296723][T31275] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 709.307383][T31275] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 709.678041][T31312] netlink: 'syz.3.7417': attribute type 4 has an invalid length. [ 710.018005][T31333] netlink: 'syz.3.7422': attribute type 9 has an invalid length. [ 710.059779][T31335] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 710.088808][T31339] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7425'. [ 710.224269][T31352] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 710.284844][T31355] netlink: 'syz.1.7429': attribute type 11 has an invalid length. [ 710.453459][T31364] atomic_op ffff88802f303998 conn xmit_atomic 0000000000000000 [ 710.479289][T31368] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7433'. [ 710.600221][T31375] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7436'. [ 710.717922][T31384] syzkaller0: entered promiscuous mode [ 710.723436][T31384] syzkaller0: entered allmulticast mode [ 710.910433][T31389] 8021q: adding VLAN 0 to HW filter on device bond5 [ 710.991275][T31390] veth5: entered promiscuous mode [ 711.008845][T31390] bond5: (slave veth5): Enslaving as an active interface with an up link [ 711.058403][T31391] netlink: 84 bytes leftover after parsing attributes in process `syz.3.7440'. [ 711.069699][T31409] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7443'. [ 711.087986][T31409] bridge0: port 1(vlan1) entered blocking state [ 711.105591][T31409] bridge0: port 1(vlan1) entered disabled state [ 711.111965][T31409] vlan1: entered allmulticast mode [ 711.121793][T31409] bridge0: entered allmulticast mode [ 711.130942][T31409] vlan1: left allmulticast mode [ 711.135948][T31409] bridge0: left allmulticast mode [ 711.324090][T31428] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 711.427417][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.436000][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.462810][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.541405][T31440] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 711.589444][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.603180][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.642968][T31450] bond9: Unable to set peer notification delay as MII monitoring is disabled [ 711.675392][T31450] bond9 (unregistering): Released all slaves [ 711.733251][T31461] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 711.795335][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.803607][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.812267][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.847950][T31468] RDS: rds_bind could not find a transport for ::ffff:172.30.0.4, load rds_tcp or rds_rdma? [ 711.859533][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.878935][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.940813][T31451] bond6 (unregistering): Released all slaves [ 711.971117][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 711.979726][T31440] syzkaller0 speed is unknown, defaulting to 1000 [ 712.425847][T31505] syzkaller1: entered promiscuous mode [ 712.450963][T31505] syzkaller1: entered allmulticast mode [ 712.481298][T31507] lo: Caught tx_queue_len zero misconfig [ 712.492845][T31510] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 712.593276][T31512] validate_nla: 1 callbacks suppressed [ 712.593296][T31512] netlink: 'syz.3.7473': attribute type 6 has an invalid length. [ 712.833573][T31538] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 713.179015][T31559] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 713.448964][T31573] __nla_validate_parse: 10 callbacks suppressed [ 713.448982][T31573] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7490'. [ 713.488861][T31578] netlink: 'syz.0.7493': attribute type 9 has an invalid length. [ 713.498225][T31579] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7492'. [ 713.518197][T31579] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 713.974473][T31612] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7501'. [ 714.189090][T31620] syzkaller1: entered promiscuous mode [ 714.215530][T31620] syzkaller1: entered allmulticast mode [ 714.239398][T31625] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7506'. [ 714.678685][T31663] netlink: 'syz.0.7523': attribute type 1 has an invalid length. [ 714.696565][T31665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 714.715612][T31663] netlink: 'syz.0.7523': attribute type 2 has an invalid length. [ 714.796649][T31674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7526'. [ 714.834965][T31674] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 714.854548][T31678] netlink: 260 bytes leftover after parsing attributes in process `syz.0.7528'. [ 714.906714][T31676] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7527'. [ 714.951211][T31676] tipc: Enabling of bearer rejected, failed to enable media [ 715.010438][T31683] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 715.135949][T31696] netlink: 'syz.1.7534': attribute type 4 has an invalid length. [ 715.154040][T31696] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7534'. [ 715.366264][T31709] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7539'. [ 715.502332][T31709] netlink: 'syz.1.7539': attribute type 13 has an invalid length. [ 715.640869][T31716] veth0: entered promiscuous mode [ 715.690885][T31723] veth0: left promiscuous mode [ 715.778581][T31727] netlink: 'syz.0.7543': attribute type 83 has an invalid length. [ 715.823659][T31725] netlink: 'syz.2.7544': attribute type 1 has an invalid length. [ 715.890158][T31725] bond5 (unregistering): Released all slaves [ 715.932207][T31737] netlink: 'syz.0.7546': attribute type 1 has an invalid length. [ 715.949260][T31735] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7548'. [ 716.039550][T31739] tipc: Enabled bearer , priority 0 [ 716.046973][T31739] syzkaller0: entered promiscuous mode [ 716.052885][T31739] syzkaller0: entered allmulticast mode [ 716.112006][T31739] tipc: Resetting bearer [ 716.143811][T31738] tipc: Resetting bearer [ 716.166236][T31738] tipc: Disabling bearer [ 716.606729][T31781] bridge0: port 1(batadv2) entered blocking state [ 716.620134][T31781] bridge0: port 1(batadv2) entered disabled state [ 716.629622][T31781] batadv2: entered allmulticast mode [ 716.638702][T31781] batadv2: entered promiscuous mode [ 717.105813][ T3867] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 717.115165][ T3867] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 717.413756][T31845] netlink: 'syz.1.7586': attribute type 142 has an invalid length. [ 717.794429][T31873] netlink: 'syz.1.7595': attribute type 13 has an invalid length. [ 717.902518][T31880] xt_hashlimit: size too large, truncated to 1048576 [ 717.942170][T31882] netlink: 'syz.2.7597': attribute type 29 has an invalid length. [ 717.964254][T31873] tipc: Enabling of bearer rejected, failed to enable media [ 718.113728][T31891] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 718.264809][T31903] netlink: 'syz.0.7604': attribute type 10 has an invalid length. [ 718.277237][T31903] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 718.289102][T31903] `: (slave netdevsim0): Enslaving as an active interface with an up link [ 718.305062][T31904] netlink: 'syz.2.7602': attribute type 9 has an invalid length. [ 718.329268][ T5918] IPVS: starting estimator thread 0... [ 718.339479][T31904] tipc: Enabling of bearer rejected, failed to enable media [ 718.347126][T31903] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 718.429329][T31909] IPVS: using max 31 ests per chain, 74400 per kthread [ 718.602347][T31925] netlink: 'syz.4.7609': attribute type 1 has an invalid length. [ 718.636809][T31928] __nla_validate_parse: 15 callbacks suppressed [ 718.636825][T31928] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7608'. [ 718.671054][T31927] netlink: 7 bytes leftover after parsing attributes in process `syz.3.7610'. [ 718.788191][T31936] mac80211_hwsim hwsim62 wlan1: entered allmulticast mode [ 718.850161][T31938] syzkaller0: entered promiscuous mode [ 718.866176][T31938] syzkaller0: entered allmulticast mode [ 718.886645][T31938] netlink: 288 bytes leftover after parsing attributes in process `syz.0.7614'. [ 719.009263][T31945] blkio.reset_stats is deprecated [ 719.121389][T31956] Unsupported ieee802154 address type: 0 [ 719.186292][T31960] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7623'. [ 719.220318][T31962] dvmrp0: left allmulticast mode [ 719.225522][T31962] syz_tun: left allmulticast mode [ 719.236823][T31960] netlink: 'syz.3.7623': attribute type 21 has an invalid length. [ 719.277071][T31967] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7625'. [ 719.443631][T31979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7627'. [ 719.532182][T31986] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7630'. [ 719.544265][T31986] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7630'. [ 719.547809][T31984] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7629'. [ 719.638850][T31986] veth0: entered promiscuous mode [ 719.647879][T31993] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7632'. [ 720.015993][T31996] netlink: 'syz.1.7632': attribute type 1 has an invalid length. [ 720.128561][T32003] bond0: (slave bond_slave_0): Releasing backup interface [ 720.150804][T32003] bond_slave_0: left promiscuous mode [ 720.185176][T32003] bond0: (slave bond_slave_1): Releasing backup interface [ 720.193595][ T3867] batman_adv: batadv2: IGMP Querier appeared [ 720.199820][ T3867] batman_adv: batadv2: MLD Querier appeared [ 720.221613][T32003] bond_slave_1: left promiscuous mode [ 720.237700][T32011] ipt_ECN: cannot use operation on non-tcp rule [ 720.253891][T32003] team0: Port device team_slave_0 removed [ 720.290385][T32003] team0: Port device team_slave_1 removed [ 720.297230][T32003] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 720.304649][T32003] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 720.314114][T32003] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 720.380056][T18221] bond4: (slave macvlan3): speed changed to 0 on port 1 [ 720.455881][T32012] bond6: entered allmulticast mode [ 720.461318][T31982] veth0: left promiscuous mode [ 720.500420][T32015] ip6gretap1: entered allmulticast mode [ 720.519811][T32015] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 720.550948][T18221] bond4: (slave macvlan3): link status definitely down, disabling slave [ 720.744876][T32032] veth0: entered promiscuous mode [ 720.760407][T32031] veth0: left promiscuous mode [ 720.854269][T32038] netlink: 'syz.0.7647': attribute type 2 has an invalid length. [ 721.018196][T32047] tipc: Enabled bearer , priority 10 [ 721.168809][T32013] syzkaller0 speed is unknown, defaulting to 1000 [ 721.350371][T32057] netlink: 'syz.3.7654': attribute type 1 has an invalid length. [ 721.518168][T32057] bond7: (slave bridge4): making interface the new active one [ 721.530140][T32057] bond7: (slave bridge4): Enslaving as an active interface with an up link [ 721.981212][T32097] bridge: RTM_NEWNEIGH with invalid ether address [ 722.050404][T32102] sctp: [Deprecated]: syz.2.7664 (pid 32102) Use of struct sctp_assoc_value in delayed_ack socket option. [ 722.050404][T32102] Use struct sctp_sack_info instead [ 722.070650][T32101] sctp: [Deprecated]: syz.2.7664 (pid 32101) Use of struct sctp_assoc_value in delayed_ack socket option. [ 722.070650][T32101] Use struct sctp_sack_info instead [ 722.119860][T32102] netlink: 'syz.2.7664': attribute type 11 has an invalid length. [ 722.136338][ T5918] tipc: Node number set to 2886997007 [ 722.275060][T32111] netlink: 'syz.3.7671': attribute type 23 has an invalid length. [ 722.334263][T32114] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20000 [ 722.450668][T32123] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 722.948906][T32162] bridge4: entered promiscuous mode [ 722.956215][T32162] bridge4: entered allmulticast mode [ 723.004708][T32167] openvswitch: netlink: Message has 6 unknown bytes. [ 723.026900][T32168] openvswitch: netlink: Message has 6 unknown bytes. [ 723.082940][T32175] º: renamed from veth1_vlan (while UP) [ 723.578621][T32207] validate_nla: 3 callbacks suppressed [ 723.578640][T32207] netlink: 'syz.3.7700': attribute type 83 has an invalid length. [ 723.606625][T32207] netlink: 'syz.3.7700': attribute type 7 has an invalid length. [ 723.849226][T32224] __nla_validate_parse: 16 callbacks suppressed [ 723.849245][T32224] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7706'. [ 723.870271][T32224] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7706'. [ 723.950190][T32231] team0: Device gtp0 is up. Set it down before adding it as a team port [ 724.213860][T32250] bridge5: the hash_elasticity option has been deprecated and is always 16 [ 724.299127][T32259] netlink: 'syz.0.7714': attribute type 63 has an invalid length. [ 724.401658][T32264] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7715'. [ 724.421276][T32265] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7715'. [ 724.747757][T32295] sctp: [Deprecated]: syz.2.7725 (pid 32295) Use of int in max_burst socket option. [ 724.747757][T32295] Use struct sctp_assoc_value instead [ 724.767473][T32295] sctp: [Deprecated]: syz.2.7725 (pid 32295) Use of struct sctp_assoc_value in delayed_ack socket option. [ 724.767473][T32295] Use struct sctp_sack_info instead [ 724.797829][T32283] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7721'. [ 724.841140][T32300] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.7726'. [ 725.069906][T32320] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 725.587601][T32345] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7737'. [ 725.653997][T32350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7737'. [ 725.929827][T32361] sctp: [Deprecated]: syz.0.7741 (pid 32361) Use of struct sctp_assoc_value in delayed_ack socket option. [ 725.929827][T32361] Use struct sctp_sack_info instead [ 726.187643][ T5842] Bluetooth: hci2: command 0x0401 tx timeout [ 726.921277][T32366] bond8: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 726.993332][T32369] netlink: 'syz.4.7744': attribute type 1 has an invalid length. [ 727.047686][T32366] bond8: (slave lo): Enslaving as a backup interface with an up link [ 727.086882][T32366] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 727.367097][T32386] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7748'. [ 727.647224][T32398] sctp: [Deprecated]: syz.3.7752 (pid 32398) Use of struct sctp_assoc_value in delayed_ack socket option. [ 727.647224][T32398] Use struct sctp_sack_info instead [ 727.906750][T32406] netlink: 1196 bytes leftover after parsing attributes in process `syz.3.7754'. [ 727.945697][T32410] netlink: 'syz.1.7755': attribute type 1 has an invalid length. [ 728.077980][T32410] bond9: entered promiscuous mode [ 728.083322][T32410] 8021q: adding VLAN 0 to HW filter on device bond9 [ 728.126887][T32416] netlink: 'syz.3.7757': attribute type 10 has an invalid length. [ 728.151861][T32416] team0: Port device dummy0 added [ 728.159722][T32416] netlink: 'syz.3.7757': attribute type 10 has an invalid length. [ 728.183825][T32419] bond9: (slave bridge7): making interface the new active one [ 728.205369][T32419] bridge7: entered promiscuous mode [ 728.213763][T32419] bridge7: left promiscuous mode [ 728.313393][T32416] team0: Port device dummy0 removed [ 728.327204][T32416] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 728.813592][T32449] 8021q: adding VLAN 0 to HW filter on device bond9 [ 729.153123][T32478] netlink: 'syz.0.7774': attribute type 5 has an invalid length. [ 729.180046][T32484] netlink: 'syz.0.7774': attribute type 5 has an invalid length. [ 729.193256][T32486] __nla_validate_parse: 3 callbacks suppressed [ 729.193273][T32486] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7777'. [ 729.338588][T32493] xt_hashlimit: overflow, try lower: 3/0 [ 729.477391][T32496] netlink: 'syz.3.7778': attribute type 10 has an invalid length. [ 729.497956][T32508] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7782'. [ 729.820814][T32530] netlink: 'syz.4.7789': attribute type 30 has an invalid length. [ 729.836187][T32531] netlink: 'syz.0.7790': attribute type 3 has an invalid length. [ 730.071906][T32545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7794'. [ 730.108776][T32548] bond4: option mode: unable to set because the bond device has slaves [ 730.129876][T32548] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7797'. [ 730.253430][T32562] netlink: 'syz.2.7801': attribute type 8 has an invalid length. [ 730.370921][T32569] netlink: 324 bytes leftover after parsing attributes in process `syz.4.7803'. [ 730.839436][T32591] syzkaller0: entered promiscuous mode [ 730.846594][T32591] syzkaller0: entered allmulticast mode [ 730.968804][T32596] syzkaller0: entered promiscuous mode [ 730.974316][T32596] syzkaller0: entered allmulticast mode [ 731.000108][T32600] siw: device registration error -23 [ 731.010889][T32596] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7811'. [ 731.175142][T32612] netlink: 'syz.4.7815': attribute type 8 has an invalid length. [ 731.183469][T32614] IPVS: set_ctl: invalid protocol: 108 172.20.20.170:20004 [ 731.238407][T32573] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 731.301900][T32616] dvmrp0: entered allmulticast mode [ 731.321078][T32616] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7817'. [ 731.339794][T32622] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7821'. [ 731.516226][T32642] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7823'. [ 731.690904][T32647] vlan2: entered promiscuous mode [ 731.696516][T32647] geneve1: entered promiscuous mode [ 731.701941][T32647] vlan2: entered allmulticast mode [ 731.709901][T32647] geneve1: entered allmulticast mode [ 731.774154][T32653] bond10: Removing last arp target with arp_interval on [ 731.822967][T32660] syzkaller1: entered promiscuous mode [ 731.837552][T32660] syzkaller1: entered allmulticast mode [ 731.847527][T32661] syzkaller0: entered promiscuous mode [ 731.858136][T32661] syzkaller0: entered allmulticast mode [ 731.874707][T32663] sctp: [Deprecated]: syz.3.7831 (pid 32663) Use of struct sctp_assoc_value in delayed_ack socket option. [ 731.874707][T32663] Use struct sctp_sack_info instead [ 732.072494][T32674] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 732.112000][T32674] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 732.156682][T32679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7835'. [ 732.349762][ T3867] nci: nci_rsp_packet: unknown rsp opcode 0x805 [ 733.856338][T32750] siw: device registration error -23 [ 733.864581][T32751] netlink: 'syz.2.7856': attribute type 5 has an invalid length. [ 733.946980][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805957c000: rx timeout, send abort [ 733.956922][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805957c000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 734.173114][T32757] bridge0: port 1(ipvlan2) entered blocking state [ 734.210517][T32757] bridge0: port 1(ipvlan2) entered disabled state [ 734.237818][T32757] ipvlan2: entered allmulticast mode [ 734.257421][T32757] bridge0: entered allmulticast mode [ 734.272815][T32757] ipvlan2: left allmulticast mode [ 734.278087][T32757] bridge0: left allmulticast mode [ 734.310817][T32758] netlink: 'syz.2.7859': attribute type 3 has an invalid length. [ 734.320453][T32758] __nla_validate_parse: 1 callbacks suppressed [ 734.320469][T32758] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7859'. [ 734.345176][T32766] syzkaller0: entered promiscuous mode [ 734.354053][T32766] syzkaller0: entered allmulticast mode [ 734.567363][ T313] syzkaller1: entered allmulticast mode [ 734.662321][ T330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7865'. [ 734.778375][ T339] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7871'. [ 734.845106][ T339] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7871'. [ 734.898435][ T345] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7873'. [ 734.918825][ T345] netlink: 80 bytes leftover after parsing attributes in process `syz.2.7873'. [ 734.969171][ C1] vcan0: j1939_tp_rxtimer: 0xffff88804c4e7400: rx timeout, send abort [ 734.977509][ C1] vcan0: j1939_tp_rxtimer: 0xffff88804c4e7800: rx timeout, send abort [ 734.986924][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88804c4e7400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 735.001289][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88804c4e7800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 735.132984][ T354] netlink: 256 bytes leftover after parsing attributes in process `syz.1.7877'. [ 735.152791][ T354] netlink: 'syz.1.7877': attribute type 1 has an invalid length. [ 735.160887][ T354] netlink: 'syz.1.7877': attribute type 4 has an invalid length. [ 735.169609][ T354] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.7877'. [ 735.189640][ T357] bond11 (unregistering): Released all slaves [ 735.530967][ T379] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 735.653285][ T390] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 735.677780][ T388] netlink: 100 bytes leftover after parsing attributes in process `syz.4.7885'. [ 735.731357][ T401] netlink: 156 bytes leftover after parsing attributes in process `syz.4.7885'. [ 735.935740][ T415] netdevsim netdevsim4 ÿÿÿÿÿÿ: renamed from netdevsim0 [ 736.256766][ T442] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 736.258372][ T440] syzkaller1: entered promiscuous mode [ 736.276276][ T440] syzkaller1: entered allmulticast mode [ 736.566998][ T475] lo: Caught tx_queue_len zero misconfig [ 736.911478][ T492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 737.117374][ T505] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 737.340748][ T521] macvtap0: mtu less than device minimum [ 737.714482][ T544] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 737.725905][ T544] team0: Device macvtap1 is already an upper device of the team interface [ 737.770020][ T554] netlink: 'syz.3.7939': attribute type 1 has an invalid length. [ 737.829745][ T554] xt_ecn: cannot match TCP bits for non-tcp packets [ 737.896900][ T561] netlink: 'syz.2.7941': attribute type 7 has an invalid length. [ 738.099014][ T575] bond10: Unable to set down delay as MII monitoring is disabled [ 738.127439][ T575] bond10 (unregistering): Released all slaves [ 738.165231][ T584] nbd: couldn't find a device at index 0 [ 738.173886][ T584] netlink: 'syz.2.7947': attribute type 4 has an invalid length. [ 738.312242][ T595] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 738.490876][ T607] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 738.499081][ T607] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 738.555850][ T609] syzkaller0: entered promiscuous mode [ 738.561525][ T609] syzkaller0: entered allmulticast mode [ 738.582975][ T609] x_tables: unsorted entry at hook 2 [ 738.638762][ T613] netlink: 'syz.2.7958': attribute type 11 has an invalid length. [ 738.941668][ T631] netlink: 'syz.1.7964': attribute type 1 has an invalid length. [ 738.975854][ T635] netlink: 'syz.3.7965': attribute type 1 has an invalid length. [ 739.274244][ T658] netlink: 'syz.4.7973': attribute type 1 has an invalid length. [ 739.298638][ T661] netlink: 'syz.3.7974': attribute type 39 has an invalid length. [ 739.471243][ T674] validate_nla: 1 callbacks suppressed [ 739.471263][ T674] netlink: 'syz.1.7977': attribute type 12 has an invalid length. [ 739.553569][ T674] bond10: option primary_reselect: invalid value (255) [ 739.621768][ T674] bond10 (unregistering): Released all slaves [ 741.648097][ T717] __nla_validate_parse: 16 callbacks suppressed [ 741.648115][ T717] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7989'. [ 741.678123][ T717] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7989'. [ 741.698441][ T717] vxcan2: entered allmulticast mode [ 742.043707][ T741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7995'. [ 742.047326][ T739] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7996'. [ 742.086722][ T744] vlan1: entered allmulticast mode [ 742.092037][ T744] erspan0: entered allmulticast mode [ 742.201859][ T752] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 742.213138][ T752] tipc: Enabled bearer , priority 2 [ 742.299752][ T755] tipc: Enabled bearer , priority 0 [ 742.389162][ T755] syzkaller0: entered promiscuous mode [ 742.397952][ T755] syzkaller0: entered allmulticast mode [ 742.406683][ T755] tipc: Resetting bearer [ 742.422659][ T754] tipc: Resetting bearer [ 743.819756][ T754] tipc: Disabling bearer [ 743.829936][ T774] IPVS: Error connecting to the multicast addr [ 743.859014][T17315] tipc: Node number set to 1651105898 [ 744.025379][ T5842] Bluetooth: hci3: command 0x0406 tx timeout [ 744.056821][ T789] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8009'. [ 744.149020][ T803] netlink: 72 bytes leftover after parsing attributes in process `syz.1.8015'. [ 744.185170][ T801] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8014'. [ 744.283732][ T809] netlink: 'syz.2.8018': attribute type 3 has an invalid length. [ 744.287579][ T808] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8016'. [ 744.292119][ T809] netlink: 'syz.2.8018': attribute type 1 has an invalid length. [ 744.315453][ T809] netlink: 224 bytes leftover after parsing attributes in process `syz.2.8018'. [ 744.443328][ T816] batadv_slave_0: Caught tx_queue_len zero misconfig [ 744.579958][ T824] xt_cluster: node mask cannot exceed total number of nodes [ 744.899241][ T848] netlink: 792 bytes leftover after parsing attributes in process `syz.3.8030'. [ 744.975935][ T850] IPVS: persistence engine module ip_vs_pe_À not found [ 744.992721][ T850] netlink: 'syz.1.8031': attribute type 5 has an invalid length. [ 745.001566][ T850] netlink: 'syz.1.8031': attribute type 6 has an invalid length. [ 745.010568][ T850] netlink: 'syz.1.8031': attribute type 2 has an invalid length. [ 745.572890][ T904] netlink: 'syz.2.8048': attribute type 15 has an invalid length. [ 745.635094][ T906] netlink: 'syz.3.8049': attribute type 1 has an invalid length. [ 745.668575][ T910] xt_TCPMSS: Only works on TCP SYN packets [ 745.680281][ T906] 8021q: adding VLAN 0 to HW filter on device bond12 [ 746.054623][ T934] syzkaller0: entered promiscuous mode [ 746.073438][ T934] syzkaller0: entered allmulticast mode [ 746.083542][ T934] tipc: Enabled bearer , priority 0 [ 746.092671][ T932] tipc: Resetting bearer [ 746.156986][ T932] tipc: Disabling bearer [ 746.443754][ T952] tipc: Enabled bearer , priority 0 [ 746.452879][ T950] syzkaller0: entered allmulticast mode [ 746.542678][ T952] tipc: Resetting bearer [ 746.609574][ T952] tipc: Disabling bearer [ 746.655563][ T971] __nla_validate_parse: 11 callbacks suppressed [ 746.655581][ T971] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8063'. [ 746.980164][ T997] netlink: 'syz.2.8072': attribute type 4 has an invalid length. [ 746.993168][ T998] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8074'. [ 747.013177][T28064] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 747.025019][T28064] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 747.035167][T28064] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 747.044724][T28064] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 747.077738][ T1003] netlink: 44 bytes leftover after parsing attributes in process `syz.4.8073'. [ 747.172051][ T1007] nbd: must specify a device to reconfigure [ 747.216828][ T1010] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8077'. [ 747.299102][ T1015] netlink: 156 bytes leftover after parsing attributes in process `syz.0.8079'. [ 747.299102][ T1014] netlink: 156 bytes leftover after parsing attributes in process `syz.0.8079'. [ 747.766643][ T1044] bridge8: entered allmulticast mode [ 748.018506][ T1075] netlink: 64 bytes leftover after parsing attributes in process `syz.0.8095'. [ 748.033640][ T1077] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8094'. [ 748.079551][ T1075] netlink: 64 bytes leftover after parsing attributes in process `syz.0.8095'. [ 748.096059][ T1084] syz_tun: entered allmulticast mode [ 748.113446][ T1084] netlink: 52 bytes leftover after parsing attributes in process `syz.4.8098'. [ 748.401161][ T1103] netlink: 'syz.4.8106': attribute type 23 has an invalid length. [ 748.776059][ T1131] vlan2: entered allmulticast mode [ 748.781467][ T1131] bridge_slave_0: entered allmulticast mode [ 748.867108][ T1138] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 749.038795][ T30] audit: type=1800 audit(1765474043.651:10): pid=1155 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8121" name="memory.events" dev="tmpfs" ino=2215 res=0 errno=0 [ 749.069046][ T1155] ip6t_srh: unknown srh invflags 4000 [ 749.113371][ T30] audit: type=1804 audit(1765474043.651:11): pid=1155 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.8121" name="/newroot/433/memory.events" dev="tmpfs" ino=2215 res=1 errno=0 [ 749.360445][ T1177] vlan3: entered allmulticast mode [ 749.375487][ T1177] hsr0: entered allmulticast mode [ 749.391119][ T1177] hsr_slave_0: entered allmulticast mode [ 749.424191][ T1177] hsr_slave_1: entered allmulticast mode [ 749.649950][ T1206] sit0: entered promiscuous mode [ 749.704915][ T1206] netlink: 'syz.2.8133': attribute type 1 has an invalid length. [ 749.850907][ T1219] Cannot find add_set index 65532 as target [ 749.966028][ T1191] syzkaller0 speed is unknown, defaulting to 1000 [ 750.182877][ T1225] netlink: 'syz.1.8138': attribute type 2 has an invalid length. [ 750.758263][ T1260] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 750.844518][ T1260] bond5 (unregistering): Released all slaves [ 750.904001][ T1262] ip6tnl0: Caught tx_queue_len zero misconfig [ 750.991364][ T1281] veth1_to_batadv: entered allmulticast mode [ 751.237718][ T1292] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 751.362740][ T1309] sctp: [Deprecated]: syz.0.8157 (pid 1309) Use of struct sctp_assoc_value in delayed_ack socket option. [ 751.362740][ T1309] Use struct sctp_sack_info instead [ 751.406816][ T1310] netlink: 'syz.3.8158': attribute type 4 has an invalid length. [ 751.428477][ T1310] netlink: 'syz.3.8158': attribute type 12 has an invalid length. [ 751.468279][ T1310] netlink: 'syz.3.8158': attribute type 29 has an invalid length. [ 751.493102][ T1310] netlink: 'syz.3.8158': attribute type 1 has an invalid length. [ 751.552556][ T1320] netlink: 'syz.2.8160': attribute type 1 has an invalid length. [ 751.607203][ T1320] 8021q: adding VLAN 0 to HW filter on device bond5 [ 751.689316][ T1323] bond5: (slave gretap3): making interface the new active one [ 751.697945][ T1323] bond5: (slave gretap3): Enslaving as an active interface with an up link [ 751.762486][ T1327] !€ÿ: renamed from bond_slave_0 [ 751.870688][ T1341] ipt_rpfilter: unknown options [ 751.987369][ T1347] xt_bpf: check failed: parse error [ 752.356320][ T1371] netlink: 'syz.1.8175': attribute type 2 has an invalid length. [ 752.371286][ T1369] __nla_validate_parse: 14 callbacks suppressed [ 752.371302][ T1369] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8176'. [ 752.397611][ T1373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8177'. [ 752.414387][ T1371] : entered promiscuous mode [ 752.476250][ T1373] netlink: 'syz.0.8177': attribute type 10 has an invalid length. [ 752.544583][ T1378] gtp2: entered promiscuous mode [ 752.549739][ T1378] gtp2: entered allmulticast mode [ 752.604612][ T1387] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8180'. [ 752.628351][ T1389] netlink: 60 bytes leftover after parsing attributes in process `syz.0.8181'. [ 752.785628][ T1402] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8186'. [ 752.950598][ T1412] netlink: 88 bytes leftover after parsing attributes in process `syz.2.8188'. [ 753.024492][ T1420] tunl0: entered promiscuous mode [ 753.031760][ T1418] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 753.034281][ T1420] tunl0: entered allmulticast mode [ 753.208434][ T1433] netlink: 112 bytes leftover after parsing attributes in process `syz.4.8196'. [ 753.212582][ T1428] bond0: (slave macvlan3): Error -98 calling set_mac_address [ 753.439568][ T1449] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8200'. [ 753.474164][ T1453] openvswitch: netlink: Missing key (keys=40, expected=100) [ 753.644652][ T1459] tipc: New replicast peer: 255.255.255.255 [ 753.651446][ T1459] tipc: Enabled bearer , priority 10 [ 753.714669][ T1466] netlink: 'syz.2.8207': attribute type 1 has an invalid length. [ 753.792304][ T1471] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8208'. [ 753.801377][ T1472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8208'. [ 753.938536][ T1478] tipc: Enabling of bearer rejected, failed to enable media [ 753.997087][ T1481] ip6gre3: entered promiscuous mode [ 754.124396][ T1493] netlink: 'syz.1.8216': attribute type 10 has an invalid length. [ 754.350600][ T1510] bridge_slave_0: mtu less than device minimum [ 754.787031][ T1546] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.864785][ T1547] bridge0: left promiscuous mode [ 754.896657][ T1547] bridge0: left allmulticast mode [ 754.936026][ T1547] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 755.404016][ T1598] x_tables: duplicate underflow at hook 2 [ 755.455904][ T1600] validate_nla: 7 callbacks suppressed [ 755.455920][ T1600] netlink: 'syz.4.8250': attribute type 1 has an invalid length. [ 755.546665][ T1608] bond4: (slave veth7): Enslaving as an active interface with a down link [ 755.590300][ T1600] 8021q: adding VLAN 0 to HW filter on device bond4 [ 755.651195][ T1615] wireguard0: entered promiscuous mode [ 755.679019][ T1615] wireguard0: entered allmulticast mode [ 755.701722][ T1615] team0: Device wireguard0 is of different type [ 755.892540][ T1629] batadv1: entered allmulticast mode [ 756.187711][ T1645] netlink: 'syz.3.8261': attribute type 10 has an invalid length. [ 756.294014][ T1649] netlink: 'syz.4.8263': attribute type 10 has an invalid length. [ 756.894433][ T1686] tipc: Enabling of bearer rejected, failed to enable media [ 757.107339][ T1701] x_tables: duplicate underflow at hook 1 [ 757.307350][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 757.416356][ T1719] __nla_validate_parse: 13 callbacks suppressed [ 757.416377][ T1719] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8290'. [ 757.447161][ T1721] ipt_rpfilter: unknown options [ 757.488303][ T1723] netlink: 'syz.4.8292': attribute type 1 has an invalid length. [ 757.499308][ T1723] netlink: 224 bytes leftover after parsing attributes in process `syz.4.8292'. [ 757.613749][ T1733] syzkaller0: entered promiscuous mode [ 757.620216][ T1733] syzkaller0: entered allmulticast mode [ 758.011482][ T1754] syzkaller1: entered promiscuous mode [ 758.018078][ T1754] syzkaller1: entered allmulticast mode [ 758.099476][ T1761] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 758.692767][ T1801] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8316'. [ 758.739494][ T1801] bond10 (unregistering): Released all slaves [ 758.792618][ T1803] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8317'. [ 759.049814][ T1831] netlink: 196 bytes leftover after parsing attributes in process `syz.4.8324'. [ 759.061882][ T1831] netlink: 'syz.4.8324': attribute type 1 has an invalid length. [ 759.163425][ T1837] xt_hashlimit: max too large, truncated to 1048576 [ 759.230594][ T1837] netlink: 'syz.1.8327': attribute type 1 has an invalid length. [ 759.244002][ T1837] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8327'. [ 759.329914][ T1849] tipc: Enabling of bearer rejected, failed to enable media [ 759.363243][ T1854] netlink: 88 bytes leftover after parsing attributes in process `syz.1.8331'. [ 759.374452][ T1854] netem: invalid attributes len -24 [ 759.380170][ T1854] netem: change failed [ 759.386651][ T5842] Bluetooth: hci4: command 0x0406 tx timeout [ 759.468348][ T1858] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8333'. [ 759.930678][ T1895] netlink: 284 bytes leftover after parsing attributes in process `syz.3.8342'. [ 759.959089][ T1898] netlink: 212 bytes leftover after parsing attributes in process `syz.4.8344'. [ 760.051397][ T1904] netlink: 'syz.3.8346': attribute type 1 has an invalid length. [ 760.096626][ T1904] 8021q: adding VLAN 0 to HW filter on device bond15 [ 760.130347][ T1904] bond15: (slave veth9): Enslaving as an active interface with a down link [ 760.150028][ T1910] syzkaller0: entered promiscuous mode [ 760.157455][ T1910] syzkaller0: entered allmulticast mode [ 760.198727][ T1904] bond15: (slave veth11): Enslaving as an active interface with a down link [ 760.224838][ T1911] netlink: 'syz.1.8345': attribute type 23 has an invalid length. [ 762.170404][ T2000] tunl0: left promiscuous mode [ 762.238782][ T2005] block nbd12: Unsupported socket: should be TCP or UNIX. [ 762.337985][ T2000] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 762.355128][ T2000] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 762.449668][ T2000] bond1: left promiscuous mode [ 762.457272][ T2000] gtp0: left promiscuous mode [ 762.469025][ T2000] bond2: left promiscuous mode [ 762.476816][ T2000] vlan2: left promiscuous mode [ 762.481733][ T2000] geneve1: left promiscuous mode [ 762.535127][T13448] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.560665][T13448] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.613167][T13448] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.638472][T13448] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.656522][T13448] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.679222][T13448] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.723119][ T2017] gtp3: entered promiscuous mode [ 762.761258][T13448] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.773461][T13448] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.881174][ T2026] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 762.891668][ T2026] netlink: 'syz.3.8386': attribute type 23 has an invalid length. [ 763.113609][ T2039] __nla_validate_parse: 12 callbacks suppressed [ 763.113638][ T2039] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8391'. [ 763.179202][ T2048] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8391'. [ 763.220799][ T2050] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 763.232007][ T2044] net veth1_virt_wifi .: renamed from virt_wifi0 [ 763.233151][ T2050] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 763.297580][ T2057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8396'. [ 763.307634][ T2057] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8396'. [ 763.424317][ T2061] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8397'. [ 763.478020][ T2061] bridge_slave_1 (unregistering): left allmulticast mode [ 763.485084][ T2061] bridge_slave_1 (unregistering): left promiscuous mode [ 763.523001][ T2061] bridge0: port 2(bridge_slave_1) entered disabled state [ 763.681737][ T2090] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8404'. [ 763.748768][ T2090] vxcan2: entered allmulticast mode [ 763.965807][ T2118] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8411'. [ 764.213188][ T2141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8417'. [ 764.418104][ T2156] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 764.428245][ T2156] macvlan0: entered promiscuous mode [ 764.454512][ T2156] netlink: 112 bytes leftover after parsing attributes in process `syz.2.8422'. [ 764.670792][ T2172] openvswitch: netlink: IPv4 tun info is not correct [ 764.762509][ T2173] netlink: 'syz.0.8427': attribute type 1 has an invalid length. [ 764.806145][ T2173] netlink: 232 bytes leftover after parsing attributes in process `syz.0.8427'. [ 764.926837][ T2179] syzkaller1: entered promiscuous mode [ 764.958792][ T2179] syzkaller1: entered allmulticast mode [ 765.151140][ T2186] netlink: 'syz.3.8432': attribute type 58 has an invalid length. [ 765.177063][ T2189] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 765.305379][ T736] Bluetooth: hci2: command 0x0401 tx timeout [ 765.311533][ T5839] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 765.492660][ T2207] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 765.877953][ T2234] tipc: Enabled bearer , priority 0 [ 765.970205][ T2234] syzkaller0: entered promiscuous mode [ 765.983913][ T2234] syzkaller0: entered allmulticast mode [ 765.991471][ T2234] tipc: Resetting bearer [ 766.003892][ T2231] tipc: Resetting bearer [ 766.096482][ T2246] netlink: 'syz.3.8447': attribute type 18 has an invalid length. [ 766.268951][ T2260] netlink: 'syz.1.8450': attribute type 32 has an invalid length. [ 767.500826][ T2231] tipc: Disabling bearer [ 767.535769][ T2260] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 767.571686][ T2278] netlink: 'syz.3.8452': attribute type 11 has an invalid length. [ 767.823024][ T2299] sctp: [Deprecated]: syz.4.8458 (pid 2299) Use of struct sctp_assoc_value in delayed_ack socket option. [ 767.823024][ T2299] Use struct sctp_sack_info instead [ 768.158738][ T2325] netlink: 'syz.1.8464': attribute type 22 has an invalid length. [ 768.213788][ T2331] delete_channel: no stack [ 768.688424][ T2358] netlink: 'syz.4.8475': attribute type 63 has an invalid length. [ 768.932846][ T2321] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 768.953111][ T2321] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 769.008674][ T2382] netlink: 'syz.2.8484': attribute type 2 has an invalid length. [ 769.017254][ T2321] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 769.023185][ T2321] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 769.038095][ T2382] netlink: 'syz.2.8484': attribute type 1 has an invalid length. [ 769.059978][ T2321] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 769.068612][ T2321] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 769.101391][ T2321] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 769.109749][ T2321] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 769.161795][ T2390] veth1_to_bond: entered promiscuous mode [ 769.473476][ T2424] vlan2: entered allmulticast mode [ 769.480651][ T2424] hsr0: entered allmulticast mode [ 769.486153][ T2424] hsr_slave_0: entered allmulticast mode [ 769.491823][ T2424] hsr_slave_1: entered allmulticast mode [ 769.871939][ T2428] __nla_validate_parse: 9 callbacks suppressed [ 769.871953][ T2428] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8497'. [ 770.001885][ T2436] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8499'. [ 770.260371][ T2444] netlink: 108 bytes leftover after parsing attributes in process `syz.0.8501'. [ 770.270487][ T2444] netlink: 108 bytes leftover after parsing attributes in process `syz.0.8501'. [ 770.280236][ T2444] netlink: 84 bytes leftover after parsing attributes in process `syz.0.8501'. [ 770.340490][ T2451] netlink: 'syz.0.8502': attribute type 5 has an invalid length. [ 770.353416][ T2451] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 770.500440][ T2460] netlink: 60 bytes leftover after parsing attributes in process `syz.4.8506'. [ 770.541078][ T2462] netlink: 'syz.0.8503': attribute type 8 has an invalid length. [ 770.550853][ T2462] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 912.825744][ T31] INFO: task kworker/0:4:5918 blocked for more than 143 seconds. [ 912.833526][ T31] Not tainted syzkaller #0 [ 912.838593][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 912.847551][ T31] task:kworker/0:4 state:D stack:23288 pid:5918 tgid:5918 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 912.859861][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 912.866623][ T31] Call Trace: [ 912.869900][ T31] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 912.872831][ T31] __schedule+0x14bc/0x5000 [ 912.878180][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 912.883427][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 912.890061][ T31] ? preempt_schedule+0xae/0xc0 [ 912.894952][ T31] ? preempt_schedule+0xae/0xc0 [ 912.899974][ T31] ? __pfx___schedule+0x10/0x10 [ 912.904866][ T31] ? schedule+0x91/0x360 [ 912.909594][ T31] schedule+0x165/0x360 [ 912.913817][ T31] schedule_preempt_disabled+0x13/0x30 [ 912.954910][ T31] __mutex_lock+0x7e6/0x1350 [ 912.968085][ T31] ? __mutex_lock+0x5bb/0x1350 [ 912.972916][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 912.982232][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 912.987919][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 912.993685][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 912.999882][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 913.008382][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 913.014130][ T31] process_scheduled_works+0xad1/0x1770 [ 913.019913][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 913.026102][ T31] worker_thread+0x8a0/0xda0 [ 913.030718][ T31] kthread+0x711/0x8a0 [ 913.034782][ T31] ? __pfx_worker_thread+0x10/0x10 [ 913.040597][ T31] ? __pfx_kthread+0x10/0x10 [ 913.045485][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 913.050707][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 913.056192][ T31] ? __pfx_kthread+0x10/0x10 [ 913.060792][ T31] ret_from_fork+0x599/0xb30 [ 913.065506][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 913.070632][ T31] ? __switch_to_asm+0x39/0x70 [ 913.075527][ T31] ? __switch_to_asm+0x33/0x70 [ 913.080315][ T31] ? __pfx_kthread+0x10/0x10 [ 913.084903][ T31] ret_from_fork_asm+0x1a/0x30 [ 913.089975][ T31] [ 913.093096][ T31] INFO: task syz.3.8455:2283 blocked for more than 143 seconds. [ 913.100821][ T31] Not tainted syzkaller #0 [ 913.105988][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 913.114692][ T31] task:syz.3.8455 state:D stack:25784 pid:2283 tgid:2283 ppid:27306 task_flags:0x400040 flags:0x00080002 [ 913.127315][ T31] Call Trace: [ 913.130611][ T31] [ 913.133562][ T31] __schedule+0x14bc/0x5000 [ 913.138163][ T31] ? __pfx___schedule+0x10/0x10 [ 913.143029][ T31] ? schedule+0x91/0x360 [ 913.147580][ T31] schedule+0x165/0x360 [ 913.151738][ T31] schedule_preempt_disabled+0x13/0x30 [ 913.157549][ T31] __mutex_lock+0x7e6/0x1350 [ 913.162164][ T31] ? __mutex_lock+0x5bb/0x1350 [ 913.167033][ T31] ? rfkill_unregister+0xc8/0x220 [ 913.172061][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 913.177133][ T31] ? __pfx_device_del+0x10/0x10 [ 913.181983][ T31] ? __cancel_work_sync+0x5c/0x110 [ 913.187413][ T31] rfkill_unregister+0xc8/0x220 [ 913.192278][ T31] nfc_unregister_device+0x96/0x2a0 [ 913.197512][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 913.203232][ T31] virtual_ncidev_close+0x56/0x90 [ 913.208345][ T31] __fput+0x44c/0xa70 [ 913.212340][ T31] task_work_run+0x1d4/0x260 [ 913.217184][ T31] ? __pfx_task_work_run+0x10/0x10 [ 913.222307][ T31] ? __se_sys_close_range+0x4ed/0x650 [ 913.227973][ T31] ? exit_to_user_mode_loop+0x55/0x4f0 [ 913.233439][ T31] exit_to_user_mode_loop+0xff/0x4f0 [ 913.238763][ T31] ? rcu_is_watching+0x15/0xb0 [ 913.243552][ T31] do_syscall_64+0x2e3/0xf80 [ 913.248607][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.254714][ T31] ? clear_bhb_loop+0x60/0xb0 [ 913.259448][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.265452][ T31] RIP: 0033:0x7eff38f8f749 [ 913.269878][ T31] RSP: 002b:00007ffe756676e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 913.278487][ T31] RAX: 0000000000000000 RBX: 00007eff391e7da0 RCX: 00007eff38f8f749 [ 913.286549][ T31] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 913.294513][ T31] RBP: 00007eff391e7da0 R08: 00000000000000e0 R09: 0000000b756679df [ 913.302563][ T31] R10: 00007eff391e7cb0 R11: 0000000000000246 R12: 00000000000bb9d5 [ 913.311080][ T31] R13: 00007eff391e6180 R14: ffffffffffffffff R15: 00007ffe75667800 [ 913.319107][ T31] [ 913.322155][ T31] INFO: task syz.1.8464:2321 blocked for more than 143 seconds. [ 913.330003][ T31] Not tainted syzkaller #0 [ 913.334954][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 913.343920][ T31] task:syz.1.8464 state:D stack:25272 pid:2321 tgid:2320 ppid:26539 task_flags:0x400140 flags:0x00080002 [ 913.356007][ T31] Call Trace: [ 913.359293][ T31] [ 913.362223][ T31] __schedule+0x14bc/0x5000 [ 913.368091][ T31] ? __pfx___schedule+0x10/0x10 [ 913.372988][ T31] ? schedule+0x91/0x360 [ 913.377352][ T31] schedule+0x165/0x360 [ 913.381517][ T31] schedule_preempt_disabled+0x13/0x30 [ 913.387345][ T31] __mutex_lock+0x7e6/0x1350 [ 913.391961][ T31] ? __mutex_lock+0x5bb/0x1350 [ 913.397009][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 913.402300][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 913.407368][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 913.412575][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 913.418576][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 913.424912][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 913.430874][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 913.436152][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 913.441885][ T31] rfkill_set_block+0x1d2/0x440 [ 913.446886][ T31] rfkill_fop_write+0x44b/0x570 [ 913.451794][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 913.458101][ T31] ? security_kernfs_init_security+0x270/0x290 [ 913.464280][ T31] ? rw_verify_area+0x255/0x4d0 [ 913.469645][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 913.475063][ T31] vfs_write+0x27e/0xb30 [ 913.479789][ T31] ? __pfx_vfs_write+0x10/0x10 [ 913.484591][ T31] ? __fget_files+0x2a/0x420 [ 913.489571][ T31] ? __fget_files+0x2a/0x420 [ 913.494178][ T31] ? __fget_files+0x3a0/0x420 [ 913.499051][ T31] ? __fget_files+0x2a/0x420 [ 913.503675][ T31] ksys_write+0x145/0x250 [ 913.508071][ T31] ? __pfx_ksys_write+0x10/0x10 [ 913.512949][ T31] ? do_syscall_64+0xbe/0xf80 [ 913.518024][ T31] do_syscall_64+0xfa/0xf80 [ 913.522645][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.528843][ T31] ? clear_bhb_loop+0x60/0xb0 [ 913.533635][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.539736][ T31] RIP: 0033:0x7fe981d8f749 [ 913.544158][ T31] RSP: 002b:00007fe982c4f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 913.553278][ T31] RAX: ffffffffffffffda RBX: 00007fe981fe5fa0 RCX: 00007fe981d8f749 [ 913.561838][ T31] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000006 [ 913.569845][ T31] RBP: 00007fe981e13f91 R08: 0000000000000000 R09: 0000000000000000 [ 913.578586][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 913.587361][ T31] R13: 00007fe981fe6038 R14: 00007fe981fe5fa0 R15: 00007ffef5865918 [ 913.595524][ T31] [ 913.598577][ T31] [ 913.598577][ T31] Showing all locks held in the system: [ 913.609141][ T31] 1 lock held by khungtaskd/31: [ 913.614003][ T31] #0: ffffffff8df41cc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 913.624031][ T31] 2 locks held by kworker/u8:11/3508: [ 913.629601][ T31] #0: ffff8880b893a7d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 913.640463][ T31] #1: ffff8880b8824448 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 913.649519][ T31] 2 locks held by getty/5594: [ 913.654200][ T31] #0: ffff8880303470a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 913.664005][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 913.674782][ T31] 3 locks held by kworker/0:4/5918: [ 913.680026][ T31] #0: ffff88801a055948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 913.691122][ T31] #1: ffffc900046afb80 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 913.707121][ T31] #2: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 913.718513][ T31] 2 locks held by syz.3.8455/2283: [ 913.723616][ T31] #0: ffff888041704100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 913.734169][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 913.744343][ T31] 2 locks held by syz.1.8464/2321: [ 913.749915][ T31] #0: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_write+0x191/0x570 [ 913.760728][ T31] #1: ffff888041704100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 913.770516][ T31] 3 locks held by syz.2.8499/2436: [ 913.775659][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 913.783841][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 913.793807][ T31] #2: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 913.803801][ T31] 2 locks held by syz.0.8503/2453: [ 913.808999][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 913.818081][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 913.827160][ T31] 2 locks held by syz.0.8503/2458: [ 913.832260][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 913.840492][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 913.850080][ T31] 2 locks held by syz.0.8503/2462: [ 913.855213][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 913.863462][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 913.873448][ T31] 2 locks held by syz.4.8507/2466: [ 913.879137][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 913.887441][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 913.896470][ T31] 2 locks held by syz.4.8507/2468: [ 913.901568][ T31] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 913.910436][ T31] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 913.919429][ T31] 2 locks held by syz-executor/2473: [ 913.924701][ T31] #0: ffff88805882e918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 913.934846][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 913.946177][ T31] 2 locks held by syz-executor/2474: [ 913.951478][ T31] #0: ffff888058829118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 913.961523][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 913.972079][ T31] 2 locks held by syz-executor/2478: [ 913.977643][ T31] #0: ffff88807e2c5118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 913.987757][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 913.998041][ T31] 2 locks held by syz-executor/2482: [ 914.003317][ T31] #0: ffff8880544c3918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.013764][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.023745][ T31] 2 locks held by syz-executor/2483: [ 914.029603][ T31] #0: ffff888054d4f918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.039940][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.049941][ T31] 2 locks held by syz-executor/2486: [ 914.055844][ T31] #0: ffff8880543c6118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.066182][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.076142][ T31] 2 locks held by syz-executor/2487: [ 914.081420][ T31] #0: ffff8880572f5118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.091926][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.102067][ T31] 2 locks held by syz-executor/2490: [ 914.107585][ T31] #0: ffff88802514b918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.118190][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.128477][ T31] 2 locks held by syz-executor/2491: [ 914.133780][ T31] #0: ffff8880559db918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.143836][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.154301][ T31] 2 locks held by syz-executor/2493: [ 914.159790][ T31] #0: ffff888046e90918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.169888][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.180183][ T31] 2 locks held by syz-executor/2499: [ 914.189917][ T31] #0: ffff88802efcb918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.199971][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.210421][ T31] 2 locks held by syz-executor/2500: [ 914.215933][ T31] #0: ffff88807ffbc118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.226172][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.236820][ T31] 2 locks held by syz-executor/2503: [ 914.242123][ T31] #0: ffff8880790b9918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.252437][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.262523][ T31] 2 locks held by syz-executor/2504: [ 914.268665][ T31] #0: ffff88807a2c5118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.278877][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.288877][ T31] 2 locks held by syz-executor/2506: [ 914.294159][ T31] #0: ffff88806a3a1918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 914.304560][ T31] #1: ffffffff8f5e15e8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 914.314814][ T31] [ 914.317200][ T31] ============================================= [ 914.317200][ T31] [ 914.326107][ T31] NMI backtrace for cpu 1 [ 914.326126][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 914.326140][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 914.326149][ T31] Call Trace: [ 914.326154][ T31] [ 914.326160][ T31] dump_stack_lvl+0x189/0x250 [ 914.326179][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 914.326193][ T31] ? __pfx__printk+0x10/0x10 [ 914.326219][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 914.326252][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 914.326268][ T31] ? __pfx__printk+0x10/0x10 [ 914.326289][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 914.326310][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 914.326326][ T31] watchdog+0xf3c/0xf80 [ 914.326347][ T31] ? watchdog+0x1e2/0xf80 [ 914.326367][ T31] kthread+0x711/0x8a0 [ 914.326386][ T31] ? __pfx_watchdog+0x10/0x10 [ 914.326402][ T31] ? __pfx_kthread+0x10/0x10 [ 914.326436][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 914.326451][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 914.326467][ T31] ? __pfx_kthread+0x10/0x10 [ 914.326483][ T31] ret_from_fork+0x599/0xb30 [ 914.326503][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 914.326529][ T31] ? __switch_to_asm+0x39/0x70 [ 914.326543][ T31] ? __switch_to_asm+0x33/0x70 [ 914.326557][ T31] ? __pfx_kthread+0x10/0x10 [ 914.326573][ T31] ret_from_fork_asm+0x1a/0x30 [ 914.326599][ T31] [ 914.326604][ T31] Sending NMI from CPU 1 to CPUs 0: [ 914.474370][ C0] NMI backtrace for cpu 0 [ 914.474386][ C0] CPU: 0 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 914.474403][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 914.474414][ C0] Workqueue: events_unbound toggle_allocation_gate [ 914.474440][ C0] RIP: 0010:load_new_mm_cr3+0x14f/0x1e0 [ 914.474462][ C0] Code: b7 c3 3d ff 07 00 00 73 4c f7 c3 00 08 00 00 75 50 ff c3 0f b7 c3 48 09 c1 48 b8 00 00 00 00 00 00 00 80 48 09 c8 0f 22 d8 5b <41> 5c 41 5e 41 5f c3 cc cc cc cc cc 90 0f 0b 90 eb af 90 0f 0b 90 [ 914.474476][ C0] RSP: 0018:ffffc90000bb74a0 EFLAGS: 00000046 [ 914.474488][ C0] RAX: 000000000dd3a000 RBX: dffffc0000000000 RCX: ffff88801a173d00 [ 914.474500][ C0] RDX: 0000000000000000 RSI: 000000000dd3a000 RDI: 000000001fffffff [ 914.474510][ C0] RBP: ffffc90000bb7590 R08: ffffffff8e05133f R09: 1ffffffff1c0a267 [ 914.474521][ C0] R10: dffffc0000000000 R11: fffffbfff1c0a268 R12: ffffffff8e050b38 [ 914.474533][ C0] R13: ffffffff8e050a80 R14: ffffffff8dd3a000 R15: 0000000000010000 [ 914.474544][ C0] FS: 0000000000000000(0000) GS:ffff8881260b1000(0000) knlGS:0000000000000000 [ 914.474556][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 914.474567][ C0] CR2: 00007ffd40909978 CR3: 000000000dd3a000 CR4: 00000000003526f0 [ 914.474580][ C0] Call Trace: [ 914.474587][ C0] [ 914.474594][ C0] switch_mm_irqs_off+0x539/0x7b0 [ 914.474617][ C0] ? __pfx_switch_mm_irqs_off+0x10/0x10 [ 914.474636][ C0] ? __pfx_switch_mm_irqs_off+0x10/0x10 [ 914.474654][ C0] ? do_raw_spin_lock+0x121/0x290 [ 914.474679][ C0] ? __pte_offset_map_lock+0x13e/0x210 [ 914.474700][ C0] unuse_temporary_mm+0x136/0x220 [ 914.474721][ C0] ? __pfx_unuse_temporary_mm+0x10/0x10 [ 914.474743][ C0] ? __page_table_check_ptes_set+0x277/0x2f0 [ 914.474765][ C0] ? kmem_cache_alloc_node_noprof+0x8b/0x710 [ 914.474783][ C0] __text_poke+0x70f/0x9f0 [ 914.474803][ C0] ? __pfx_text_poke_memcpy+0x10/0x10 [ 914.474820][ C0] ? perf_event_text_poke+0x13d/0x190 [ 914.474838][ C0] ? kmem_cache_alloc_node_noprof+0x8b/0x710 [ 914.474856][ C0] ? __pfx___text_poke+0x10/0x10 [ 914.474871][ C0] ? rcu_is_watching+0x15/0xb0 [ 914.474889][ C0] ? trace_contention_end+0x39/0x100 [ 914.474913][ C0] smp_text_poke_batch_finish+0x90a/0x1130 [ 914.474937][ C0] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 914.474958][ C0] ? arch_jump_label_transform_queue+0x97/0x110 [ 914.474985][ C0] arch_jump_label_transform_apply+0x1c/0x30 [ 914.475005][ C0] static_key_disable_cpuslocked+0xc5/0x1a0 [ 914.475024][ C0] static_key_disable+0x1a/0x20 [ 914.475040][ C0] toggle_allocation_gate+0x1a1/0x240 [ 914.475062][ C0] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 914.475083][ C0] ? __pfx_autoremove_wake_function+0x10/0x10 [ 914.475107][ C0] ? process_scheduled_works+0x9ef/0x1770 [ 914.475131][ C0] ? process_scheduled_works+0x9ef/0x1770 [ 914.475154][ C0] process_scheduled_works+0xad1/0x1770 [ 914.475199][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 914.475231][ C0] worker_thread+0x8a0/0xda0 [ 914.475258][ C0] kthread+0x711/0x8a0 [ 914.475278][ C0] ? __pfx_worker_thread+0x10/0x10 [ 914.475292][ C0] ? __pfx_kthread+0x10/0x10 [ 914.475311][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 914.475329][ C0] ? lockdep_hardirqs_on+0x98/0x140 [ 914.475348][ C0] ? __pfx_kthread+0x10/0x10 [ 914.475366][ C0] ret_from_fork+0x599/0xb30 [ 914.475389][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 914.475417][ C0] ? __switch_to_asm+0x39/0x70 [ 914.475435][ C0] ? __switch_to_asm+0x33/0x70 [ 914.475451][ C0] ? __pfx_kthread+0x10/0x10 [ 914.475469][ C0] ret_from_fork_asm+0x1a/0x30 [ 914.475496][ C0]