last executing test programs: 3.47969516s ago: executing program 4 (id=4035): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) recvmsg(r0, &(0x7f0000001600)={&(0x7f0000000200)=@in6, 0x80, &(0x7f0000001580)=[{&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001640)=""/71, 0x47}, {&(0x7f0000001300)=""/159, 0x9f}, {&(0x7f00000013c0)=""/200, 0xc8}, {&(0x7f00000014c0)=""/50, 0x32}, {&(0x7f0000001500)=""/97, 0x61}], 0x6}, 0x102) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x6}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x1}, @TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000003f0009000000000000000000040000000400fc00080008"], 0x20}}, 0x4004080) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) sendmmsg(r6, &(0x7f0000008b40)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000001540)="f2", 0x1}, {0x0}], 0x2}}], 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000016c0)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="9380000068820000140012800c0001006d6163767461700004000280080005001f0cbd61209f382993c4fbcfd66f6b07e72deef94c5cfccf024b8e32843524e932d8585792d70d0a3b376db72bd24f102104aea9b8f413eb8c6fcc2df6df107fe7a016117657e75a082df58e36f2a753e76294d827f5dfcb0f0e18f9c7e44393a7dcec2a1e95b28a60dad100000000000000000000007130b6ff4c9c9f879d738b19c72aa725feb90c0166fad274121353bd9a66820fc1aef2bcac74a4005a8141b5c47d0bee27f644c8706f6d7944c38d600feab6cf7bffaff1dd96977881a447cdb7bbca3dc57013404c2b798c8ec81e8ccaa9dcfa8c0f2c40449512b345faf836c9af9d8fac5843180755a62224ccb4914d01c7940681f4a3612ae18e8c4afc962797cef7096f2e14de", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x26008884}, 0x4054) 2.359628455s ago: executing program 3 (id=4037): mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000140)={r0, &(0x7f0000000040)='\\}\\,\x00', 0x0, &(0x7f0000000080)={@align=0x80, {0x2, 0x8000, 0x81, 0xc52}}, 0x2, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x1}) 2.32443695s ago: executing program 3 (id=4038): socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000680)=@filter={'filter\x00', 0x42, 0x4, 0x2c8, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x230, 0x230, 0x230, 0xffffffff, 0x4, 0x0, {[{{@ip={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0x0, 'syz_tun\x00', 'pim6reg0\x00', {}, {}, 0x6, 0x1, 0x9}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@multicast2, @remote, 0x0, 0x0, 'ipvlan0\x00', 'tunl0\x00'}, 0x0, 0xa0, 0x100, 0x0, {0x60010000}, [@common=@ah={{0x30}, {[0x1]}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x1, 0x6, 0x4, 0x3, 0x2], 0x2, 0x1}, {0xffffffffffffffff, [0x5, 0x6, 0x6, 0x6, 0x4, 0x1], 0x2, 0x3}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket(0x2, 0x80805, 0x0) (async) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) (async) sendmsg$inet6(r1, &(0x7f0000000340)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x44}, 0x5}, 0x1c, 0x0, 0x0, &(0x7f00000006c0)=[@hoplimit={{0x14, 0x29, 0x34, 0x7fff}}], 0x18}, 0xc4) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b000000000000000000000000800000000008"], 0x50) (async, rerun: 64) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 64) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000600)={0xfdf9, 0x8, 0x1f}, 0x8) (async) sendto$inet6(r3, &(0x7f0000000040)='\x00', 0x1, 0x2004c044, &(0x7f0000000180)={0xa, 0x0, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1}, 0x1c) (async) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x40000140, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x7, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r4}, 0xc) (async) socket$inet_sctp(0x2, 0x1, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071127f000000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x20000}, 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x0, 0x4}, 0x94) r5 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f0000000080)=0x2) connect$vsock_stream(r5, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) (async, rerun: 32) shutdown(r5, 0x2) (rerun: 32) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2.234605807s ago: executing program 3 (id=4039): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)={0x28, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x43}, @void, @val={0xc, 0x99, {0x8, 0xfffff801}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000300)=@ethtool_drvinfo={0x3, "ec0f94df139179fed3faff3af613f0787022d14b64ab74e996699a8ec06ed4a6", "6c0fae93b198ad6a9d6023de0d216e81ead2cd8e209691e23224b64c01241b44", "47ba22bac56189e28398c1553557db88681539e80c4c3c965338d9f570fce542", "cced961adca433189a395209dfda4e9a23ac0f1344e180e513ddb1e71f4909c6", "db02a1d5a71410c8e56240bee8c203b3db25ba48d7d28fea586cc597a4aac89f", "d2f5c256a0c14fc7fcecf5d0", 0x8000, 0x4, 0x5, 0x4, 0x6}}) (async) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfffd, 0x2}, 0x7) (async, rerun: 64) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) (rerun: 64) 1.76708567s ago: executing program 1 (id=4040): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000080)={0x3, 0x4, 0x2}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a3000000000580000001c0a01000000000000000000010000000900010073797a3000000000090002"], 0xfc}}, 0x0) 1.713775785s ago: executing program 1 (id=4041): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x5, 0x40, 0x6, 0x8}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r0}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x3, r1}, 0x38) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b80)=@mangle={'mangle\x00', 0x2, 0x6, 0x578, 0x0, 0x3d8, 0xd0, 0x3d8, 0x3d8, 0x4a8, 0x4a8, 0x4a8, 0x4a8, 0x4a8, 0x6, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @remote}, [0x0, 0xff, 0xff000000, 0xff000000], [0x0, 0xffffff00, 0xffffff00, 0xffffffff], 'gretap0\x00', 'batadv0\x00', {}, {0xff}, 0x11, 0x5, 0x1, 0x18}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000010000000}}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0xfc, 0x6}}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0xb4}, @initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, [0xffffff00], [0xffffff00], 'ip6gre0\x00', 'bond_slave_0\x00', {}, {0xff}}, 0x0, 0xf0, 0x138, 0x48000000, {}, [@common=@dst={{0x48}, {0xff, 0x4, 0x0, [0x1, 0x7a, 0xfffd, 0x3f4, 0x0, 0x3, 0x5, 0x0, 0x8, 0x30, 0xe5, 0x4, 0x1, 0x6, 0x0, 0x7], 0x6}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 'ip6gre0\x00', {0x4}}}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0xd}, [0x0, 0xffff00, 0xffffffff], [0xffffff00, 0xffffff00, 0xffffff00, 0xff000000], 'nr0\x00', 'vxcan1\x00', {}, {}, 0x62, 0x5, 0x3, 0x20}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@remote, @ipv6=@mcast1, 0x6, 0x27, 0xd}}}, {{@ipv6={@loopback, @private0, [0xff000000, 0xffffff, 0x0, 0xffffff00], [0xffffff00, 0xffffff00, 0xff, 0xff000000], 'pim6reg1\x00', 'ip6erspan0\x00', {}, {}, 0x6c, 0x80, 0x5, 0x61}, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d8) sendmmsg$inet(r2, &(0x7f00000034c0)=[{{&(0x7f0000000040)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, &(0x7f0000003380)=[{&(0x7f0000000140)="e381c47b3e7925fecace5946857b60f477844d3b5178da2fea28189aa21430aa297a7f02bc213ffe7ab1f81515af", 0x2e}, {&(0x7f0000000200)="60aff8c14d66068b3c8cf1bed4c7ff2c0f92c9c52463d7826cf9f7c3e50d5988d727e07a34b1535c4c4ea2e9579fcf1c98", 0x31}, {&(0x7f0000000240)="69b67125a1ec4e3b03f1b851b230b1217d6a08209e560f325e3dc64e24592e", 0x1f}, {&(0x7f0000001180)="5228c232030d5ff2cfb27920efbdba1e7194ba4e2131f32c6188443b3473f8a9a560a9c83efb8740b849c2d4b70bd5c5798ce56c6a7970173fc85f14d1d609435892d283ce47aeb8c49ea266b18cb975972b17a4c82a9300eca52dda4a20c099e7a60b4a684b78f4d5c30cee2bc95b86a69f1adf4e4a84d98d798816c08a74303a08684e7179c434f136dd72b84a1282e2ecc0a1803f288cbc60123b854fd9d3687a15951fd8df4fefff665ba64d6a895c9a5ebe0b2aae193938a709c4f8d21b0e86c774f2a5f9f291ff33aedd8820affb1e81eebcf28b522aa51d29f3c0c7647387e0c593f1cc157337b8ec0f9d7c738c5b2d4aee5149c3b66c71925412b20509a13db334541f8651e833e8f79597e50c13ee6f61efe153218d5bad8311d5c1626052316174bfc35d10b5fcb7ce596a2c9c35b23f1b7abcc92ac2efa4b9ff15b471c680727a657b174314a766961fd54b18ef5b4138310653c3f255a92718cea6b1e39cdb454c4876b8e6fee2a58dcf1f0f8aff87a454ab6d3897b036e256de235388e29d353f553e285579d7db60bebc91a7326fbf3011553f6706707ae72e3891f8dd993b378a358cea72d3e9e6f12aadc67b5b73482ba8937a6f34cc8f08aa406165c81fbe744ab452175d9d374ff85f9052712a0e28d613c3afed56ad1e79ca78c77338537fc9aef2587a6b9bf74f9ca07b67a721773eeeb7bba831dc7bee3d5443609e5512f5171b6954a278b990462e2f72081c1fb3617bfdad1bf96f68780de63247fc3bdbf9b43b27b8c2291eafaff41bb9138edff556e91c2085cb8fcd8983ee430c330e7b5b74112123083553c8d5b2d1b82cc93c9d42cc21c672fd0d4bf369a12a00b9cde4e2126345896260ff05cdce72aed1baf41b71db4f3230c9d7c8fb0fe50df5300d4fbb0ba7cf6b08bff35b0e4c7f1d9e3d274fe11fb8518f1475791e77f5b0f7a519922aef7e595036c0082d3c2330626635939482cd9835f72ec7d4681eeeb582a6398f5235a8c420b0af4cf94ceed2ca12a2d1ce725861ae02cb365e005eb3867cf9ffd9900b3a6bf8079bc410e0dbea77a8543f03716432bf5347f71176a5495d0813ba39164dfc5f6e0fb78f4a9c21e06127be873f57bb20d56bfbae1ee60f5885cecbf48ee966cad8be9926e0f922a7fcee1c36b0ff7442e6e7cf87c698e2658799941126bd1877d53807c3a07f0daf87c3262daa7306fc2ad2580a14fc2494d86406d286eb7cace34bf44c8d147a68f3e725a8eab59261798c91d0bf86b7abe9cb457bcf657b17e376cbae38b720b108ba215c413189316dc18964c33245a4be6fb66ad141ea56aeaa24cbb8a24c4f41abf896303dec11065576b2dc166149da2064a2dd22357ed21b7fd5578665b8898f6e768831a6bee5efa13875434ba2ee03908b03ff931dc1fc48b340c6baf7f7e02e1122031805343f26fa9cca4ebd618e4569b138df8d339c729fa5f1147e2a981c647a78b2c47f2c8302439db47e7e9976b6e7d0aa2d4ae493d2c1e295fcae33ed44be06b1da022b3e63d5d3519d1397e56bd3507adcea075e0d757d538b976414834f7b0179162a4afcdabce96152007db773d8a2780546f20b6b8ff9d2b0d1d36e4b93d1aff3df86cf454250a120b510435799aaae1a8d1b71c61570d3cc6e96d54958e96a5aefa9da29932c31d32cc356af0a063b0226ed53a0607512c584e1b3771d3553f7d8abdd989d855fb387355bf73043b9df7903476dd131d2242952946bb4ea308db829740564d620c4315ed97e482402cc326ebfd6b26b9b830dbce21a18750d3b39f2f8aae6df4c21e75f886258c420337162565c0300e152e45cdd9fa866a6629bbb605527984e0e7dcdc4289a286211797971d40daf56504c0bcf1895d37663a9e5f186485e8ffc87c4f87f2affb976c73c1e3fbf4bfaf1539b57d00510cd23e118d5b3bfdb5c9e519d2bd04cda6f88cdb99499fb9c4b881087bc0f2ff878e301f410f27be87fa07bc66258b15daa6d8d0666c968ea4c903decc142cbdb9095e914e109a87bf86c6180bd9262d0bea261b3495a3643b3f5fa596dc9b506310e5b30014fc5f54e76cc56689ff4c9189fec2538f212057846d82f20108991bd467149c3ce247d1a9d6aa521f9e7cccda65966622c2516dfdbe58da00b077a92c3569631f21b57290a3a778d24056f23b76005ab9bf73620f8197d90c64e69cb76a9243f6dbd4cda02b6863900d42739c2e17012e7badf21dd7df356f5cf590d51b2b1eeb520b09e5ae0d80fceacb29473ab5c26b7403f556f2b99e6fc973034f89dc1d8e98e7dac8937bd4c8faf93436a9581bdc7c83e06f4bab618a382105a9c0ccffc314d7a1ae4fec76e8cb95c435c77d4b6f3877796b28ec08569098c60d6abf0dc391a06fde376a8bf12bda7c697f4f78a5f5d33125c81e4cf3893dbe6e9ec5e8d05439895b372b1cd456c2e0c7800669b914997a5204a3ba2fb71a4bdf825bc6b7a42b4262e571b87b9bb38ac4a61e210d83ef84989343fef79e25127bd50338ff65957e90b9f3c3caa12437db9b0a93792672d1dadeceeefaa595867fc633e9d482056e9a82e7474c00908484579f091109e907103554af2eeea05b5f1ec567676bddba4523c57729f1ad1253fc07288a020bb33ab16c3f22844b9edce65a4070c978d603dcfb3fb3ec1b863a55bf31edbe96fcf90e5155df5f656f5df25f6d6e45f164c83c27fdeb3cce521d3157ea40ae1a4ca67f0cddf035f30bfec42685afe5216741e77873faf68c2032712ca2f9c8415f7517ece78c5238acba7b0caaa4a3abad263faacb41b130364b4a280f789a28e20a53b2fc0fc3ee4110e6c11581679c93821e6ac9354591c114afe8c85d4648e44631a195e52954bce965f43ecb8533764aa0af2d2514aa1f488709a8dc6390d4ce3650c05f2b14352d8e9b1f9fc87b5a4e904548ee37472f753229b30af4e989dc1d74e85fe52c64eba8f3cbfb68db92edba97644d9bab8ac0e574f839b8d9cb78adfdc627a19ad947cd6f264a4f84ac66e22a3e7f79768714ed3113fff42b8857aba5f794aa88d2e0cc99a61db27c37286161e15311c3019d74f38dd91c480f3ca771974ad0cda36d4850334c4ba7ffeaa3f009c8bb6f4a36b4968209b3ea7869fb85d83d7df9dbaa0e8eab3bd19319e2f0ecb5e285867f561296e92738841af8d191250372c6d9f70849fb24403bd731f6da9bc7a59814189e22305e08e107cc6e16c169ce0b9f2bd3adac5a0da6272bb0bda2b1bfa5be3c28de9a249ec6693e68fd92a652d308ae0e7fea0d15ecfc0bf9532517120bdbb533e854343942dd6ee25a650ff87316a1d0f8d16726474c7f4dd5e074036fe11b09c9f15feaed743631b98f0272be176fc42e745dcf276a756c61c8674be966644260d84cbd215f7b35c114e4050fe65d48c715a60552c60b3ef2f1f8252f1d2a8fd5babff6c98c7c7d1090dff37d121062dc6af9b6c69d32f21e9b88f7f321af7460da4557fee2b146e3128e044a4c3090f5174b8289ee55553b49c45904343159406c69c2de9c184446bc0547f4e461b570052f289d5c4710cf8c51d1c4e41b5ef28aa94e9cd2464ed4cad1caa186e83f13c2257f7032ff34d201c7f5fe4e004886a764ab5d2b3f189849f4fa6c603938d3833dd03bfca8d9244f53d6891e42d61de8742607f75fcee552f905632cb2864969bbc0ccd4ebd9bb8faa91b997c69a994617b01a9d7e10d3cb19d8c049470f38858693513824d55ede93ac81f6ae697d0ad7fe93f5a0d62cc0f37b8106e4ff61f0a0c8176fffc08eaf5c2b348518770bc21a8f9f2ed3802752e7149a0ab61e5bc1239b89a74703e15e3c7b8e3e07955b0613c3723f3b20c8463d23c13aef0e9aab19c9f465c4eb85529c049b5f2971b4f50b770ae199fb5ccfe44d2bf500db0f5e2ee5f9f70d8a35a9ddd8499259653359117737c9f3b8b81a6d1f75322c6b823ec6414e77863658ad864114e84b8ec12d860fe7da2e750d1f8fc1c1985c9ef3b27907b5401c2bce7acf8b69c272c0120abbc1eb24ce49fe37b21ab080268cc13238bffd49fe2a6aad0891298bbae4b69772acd88942f29b155db630e57b6446f343cde7364e3bb3958acf96fc7225a95d145cfc8f911277f53176a530051e537a10c4eaafeef40b43e2ff57363acd439639f39586524a358ea7df41e656115862f851cc0e7cb970ab664705a504701fabbc010fbfe8f082e3c0ea92ee023609a8d54b3de7abacf92f82168a257d4fe6d7683b297f9b95f069679beae8a7e0875afa6e3d16109cfd54f5036a5674d685bf54f87276741e1b05ad5afa69f525c03d0fd8046acc02544102503114b69d35d786c533ffce6958d6b1d08d558940961cb00ffe3d3f69bed17883f5f2f19cfb6d7557a3dd8462e7d3c2c46fdb77f2c54123591e22458dc64009870ecbdf19077a80c5824388c2f53c77ba2811cadeb6dc06e2dfc7ce2504531b4c04313df21bbb9ea0e9265ee675b89ff72fc03555b8e72d50499568c551cbdbca84f8161306c7a028cc4a6ec456f449462c19bc84370f66f6c871500dc9e02061770870ef67702302ef4a1f50748a7426905cb43d05964f0d49349537cf269052e131578f30e1a76930eecdc86decab132d6f24ef4087af8f9b19301a455c949c21035fa3a2a1da898d109647efd4699f1e1074d0a7a95adeafb97a556c47712b88f1ff403be3f072174f9b84588164d38b102341484fa17b2af8db43bbf4db4d3fa6c73e35a183cae188389c29932ea478f6cdf0fb2a437f5ea167ba0cc5ac1c56b930bb4be6b85b1311eb0d98336f8ec93b276147ddbbcf4d1889d1707b8d8c9263908c0c3cebfecd0e3ccb448414dce450d031a494b353e0f5421d614533f9b99290575074a9087507df56fd13e69c4abb74e7554f77ad62ba74d9716f8572d1e6fe732ba9bc3f800b73eb2317a65146e27cb7e2bb3e0a492d85d2f60f4a1b1312725d9a19e33b8cda570d3d009d4592e65faaf951b682191fe2c91c40ebf249683c78757a8b3505ed5365a8ed3be6727714b816aaf3a68809ca16e3462b7f342290847c53ba5a9e88ba0d393d3214099b3808f9012f3e69b2fc84b3eaa7ff0908601a28a07adaeac69edbbd1390c625d7975e99300fc0d1021525e12ea688fafddd53b04012b5e5c2cf72cfaa1096764bef00e85bbeccc5ef243f4e9a9390937fc85d48cea2efcf0b81e2b8225c0ad22ba43698bc3cda3c0c67fbacbd181adfd5eddb9f29ec6721755839e1240993d53185659883cdc73aca85a5a6f6aae55829d48c51d60509e0fb7d6a05e919ad849cc5a55f229c9c074e30783e3e63aa9284e48873715c17209813fb8b85f679db58683b34b77a2cd0e59fa8c918cb223da8f96672a97a72dc77e449bd6597081c05ec7387ec7143b655fb2d55c94ea2eef3667c2839add2f0a76a4e91576cbbcbf86f961abb60f39f33b08923d9901355511a68fa907a601d278b5a615efdd55e2de7a0a1c83015e41ad0d43851bfb1c9857b49f063b99ce1774a050a5acdb4a96fce850d0b2eb27f50182bca30c59998759c2ae4d8ddd61c51637cc0b36e2eb0c6b100acfa49cde8aa5f3dd7936f8bb1a969e9e82c771e527498919ecb5191019dc6e8f5d2993b08893f64ff9d30605d15ecd14c50dee0d925c81dd9167574108f9b1c6a0da552226adcede59375bc111518c1e23b21699a4419750c531b47fb62b6991d26d54d1c62b57540cf7fa00c7bafc8bfedcfff24a04c9cccbfa", 0x1000}, {&(0x7f0000003280)="2804ea5fa46dd2d414165a942d878ff0a89082d342bf15f3a412e44fc2a95955bbb49275633f700767a504deb728fde4e45f9b00df6eddde630ed89c11f22f9b50c13baa122838fffe097ab5d51473d9aa66d2b2d0d3603378079b164383238ee3d91e4f41a41a6bb8e2d5b25ca01e749f44ae8c765cd4b295d5168fc44df34c07e952c1417478908d6275778a2672720d0e9b127c5248477861c51685995534907f319e7ed582077aa79c035445c8eeef1772918988f0dc80bff0f0023a6bc4c16c52d0b2d94dffd5516b87ca718e3e8ecd3eb0cfd745da44d851", 0xdb}], 0x5, &(0x7f0000003400)=[@ip_retopts={{0x88, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x44, 0x60, 0x3, 0x5, [{@rand_addr=0x64010100, 0x3}, {@broadcast}, {@local, 0x2}, {@remote, 0x5}, {@multicast2, 0x6c4}, {@broadcast, 0xd}, {@multicast1, 0x2}, {@multicast1, 0x7}]}, @ra={0x94, 0x4}, @timestamp={0x44, 0x14, 0x32, 0x0, 0x0, [0x80000000, 0x2, 0x6, 0xcc3]}, @lsrr={0x83, 0x1b, 0xbc, [@rand_addr=0x64010102, @multicast2, @broadcast, @remote, @multicast2, @rand_addr=0x64010101]}]}}}], 0x88}}], 0x1, 0x4000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3b071, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x18, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="184ccb9596dae50c750000b68266a3ffff95000000000000f1463400bbe6e111a231ade830866d384decf6a8ca4c48df9fdcc5d63fe7257db07df15f3d63fd4a9cc2c48670bae0ad139f6336a25ca269b67efa4f999ce34dae61ebce"], &(0x7f0000000180)='GPL\x00', 0x4, 0x1029, &(0x7f0000002240)=""/4137, 0x41100, 0x1d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'pimreg0\x00'}) socket$inet6_udp(0xa, 0x2, 0x0) 1.601270985s ago: executing program 3 (id=4043): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000000c0)=0x3, 0x4) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="ad21000000000000140003006e657464657673696d30000000000000080004000e04000034001680300001802c000c8014"], 0x70}, 0x1, 0x0, 0x0, 0x4048000}, 0x800) 1.600170614s ago: executing program 4 (id=4044): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r3, r2}, 0xc) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000340)="480000001400190d09034beafd0d36020a841a000000230f00000000a2bc5603ca00000f7f89004e00200000000101ff00c00e03000200000000000000000300005839c900910000", 0x48}], 0x1) write$tun(r0, &(0x7f0000000040)={@val={0x2000}, @void, @eth={@broadcast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x5, 0x29, 0x0, @initdev={0xac, 0x1e, 0xfc, 0x0}, @multicast1}, {0x300, 0x7000, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x0, 0xce1300d54c3818a3, @val=0xe0000001}}}}}}}}, 0x36) 1.598124466s ago: executing program 2 (id=4045): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r1, 0x10c, 0x1, &(0x7f0000001ec0)=0x8001, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1b, 0x4, 0x808, 0x8, 0x804, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffc}, 0x50) (async, rerun: 64) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c0000002e00090027bd700000000000040000000400120004001d"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) (async, rerun: 64) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) r3 = socket$inet(0x2, 0x2, 0x1) (async) r4 = socket(0xa, 0x5, 0x0) listen(r4, 0x100) (async) sendmsg$inet_sctp(r4, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="30000000000000008400000001000000090047d72a09"], 0x30, 0xc8c4}, 0x0) (async, rerun: 32) sendmsg$inet(r3, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000280)="08001efbb07d5a6e", 0x8}], 0x1, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @remote}}}], 0x20}, 0x20080880) (async, rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x50}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x85, 0x0, 0x0, 0x17}}]}, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) (async) setsockopt$IP_VS_SO_SET_TIMEOUT(r3, 0x0, 0x48a, &(0x7f00000002c0)={0x2, 0xf, 0x8}, 0xc) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xe, 0x0, &(0x7f0000000300)="0101000071a78326c799dbe888a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x58, r2, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_LNS_MODE={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x84}, 0x800) 1.367309891s ago: executing program 2 (id=4046): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@empty, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x2, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x6, 0x177bfb99}, 0x4, 0x0, 0x1, 0x0, 0x0, 0x2}, [@tmpl={0x44, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffdffc, 0x3c}, 0xa, @in=@empty, 0x3503, 0x4, 0x3, 0x0, 0x401, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendto$inet6(r0, &(0x7f00000000c0)="b8", 0x1, 0x2000c851, &(0x7f0000000180)={0xa, 0x4e26, 0x3, @loopback, 0xffffffff}, 0x1c) socket$kcm(0xa, 0x3, 0x87) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010027bd7000fedbdf250b0000000c00058008000100"], 0x20}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000000) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x8000000000000009, 0x8, 0xe1, 0xdd41, 0x10000000004, 0x3c, 0xfffffffffffffffe, 0x3}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000003c0)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000014c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r6, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000001500)={0x20, r7, 0x381, 0x70bd29, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0xca49bb32449717af}, 0x100d0) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd1200e1fd0000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.31638992s ago: executing program 4 (id=4048): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) setsockopt(r0, 0x2, 0x1622, &(0x7f0000000400)="805ae6732597c0a2ec6cf2cbca82960ff299e030f8be9b0b2bf8d0c25eba46f9e5b88643649255575d08fd6cea70ad4468ead2fcc18aa14a9a25c581d64e17bf12cee4318fde1a2710c135171c7193196095b5407b96ff9acb479e1dd365677fa4ccc2b8a7e81006c92af94d51efd9c587a652cfcf758535cadc3dd8c445544f133397b2f952620a3cf8e60803811c7dacab5eb559a9ca0143abd69b9bf3f7dd8c8fa26ba443439e43ff1418bf23ac1474c58616cb1ed4dc430e669c12f6ca097020ce7dd3aaf803b66fbafb8e56df4003a52c9f77ea0622902f0e2eb34a9d8524a24d740b9d", 0xe6) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=ANY=[@ANYBLOB="7300000007bd093125266e5011a96dd5100085f69dc9917315f2fe540000000000", @ANYRESOCT=r2, @ANYBLOB="01000000000000001c0012000c00be0100626f6e64000000000c000200080074fd6e"], 0x3c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40018}, 0x24000050) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x2a, &(0x7f0000009b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002e2fafb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) socket$inet_icmp(0x2, 0x2, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="10002cbd7000fbdbdf254f00000008000300", @ANYRES32=r5, @ANYBLOB="0c009900ffff61a7097d37b0ed7d7a800c000300357f56029cca633a080004000600000008000400010000000c000300350b3b5606d9f52c"], 0x54}, 0x1, 0x0, 0x0, 0x44}, 0x48000) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000a00)=@filter={'filter\x00', 0xe, 0x0, 0xc0, [0xffffffffffffffff, 0x2000000000c0, 0x2000000000f0, 0x200000000120, 0x101, 0x5], 0x0, 0x0, &(0x7f0000000900)=ANY=[@ANYRES8=r0, @ANYRESDEC=r0]}, 0x8d) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r7 = socket(0x1, 0x803, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000500), r1) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000600)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="00042bbd7000fedbdf250600000008001800e0000001e5ff0d000100000006000e0004001e000600010007000000060002000100000005002200010000000500140002000000060002000000000095dd4c9a81427947ba5ffc0a7e33184d4446134004667b85fd45b2c23b4ecff62a32865b6666cf59ac0daa7ebfd503909689b70dacadaefb86e085c97f5db14a7806617922c52aaadc1226892c6a02ae38ae7d924c7b048783574af14de722b54967b4356e4b4dca8508f955f4260763667dcd57cc41fbaf6587305b3c2788ced8c5d5a3c7dd01d54d"], 0x54}, 0x1, 0x0, 0x0, 0xde20e8857599f9d2}, 0x4000040) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r9, 0x20000084, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) r10 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r9, 0x84, 0x17, &(0x7f0000000580)=ANY=[@ANYRES8=r0, @ANYBLOB="51852c32b5994644195b62c61be6f8b5d5d7fc569f0d12d88a8e38fd1feccde8b4d13d357eb616b821772e92f2"], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r9, 0x84, 0x23, &(0x7f0000000040)={r11, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r7, 0x84, 0x13, &(0x7f0000000040)={r11, 0xfffffeff}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r7, 0x84, 0x1e, &(0x7f0000000300)=0x1, 0x4) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="340000001400100025bd7000fbdbdf250a0020fd", @ANYRES32=0x0, @ANYBLOB="140001002001000000160000000000000000000800080000010000"], 0x34}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) 1.154368575s ago: executing program 2 (id=4049): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$cgroup_procs(r1, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='-4'], 0xc) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCDELRT(r4, 0x891a, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000600)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x168, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7482}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x100}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x444}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24, 0x2}}]}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x5c}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x13}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffff5}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x5}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x200}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@private=0xa010100}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@private=0xa010100}]}]}, 0x168}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="997405007000fbdbdf25150000004c0001"], 0x60}, 0x1, 0x0, 0x0, 0x24000884}, 0x2400c000) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000100)={@val={0x0, 0x10}, @void, @eth={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @val={@val={0x88a8, 0x0, 0x0, 0x4}, {0x8100, 0x4, 0x1, 0xfff}}, {@generic={0x894f}}}}, 0x1a) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r7 = socket(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000200)={0x6, 0x8002, 0x71a6, 0x4, 0x0}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp_SCTP_CONTEXT(r7, 0x84, 0x11, &(0x7f0000000340)={r8, 0x5}, &(0x7f0000000380)=0x8) r9 = socket$netlink(0x10, 0x3, 0xb) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r10) sendmsg$DEVLINK_CMD_RATE_SET(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000000000000002a0000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r9, 0x10e, 0x1, &(0x7f0000000080)=0x84, 0x4) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.047135234s ago: executing program 4 (id=4050): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000400000711247000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000000540)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000140)="01", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e23, @loopback}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000480)='Or', 0x2}], 0x1}}], 0x2, 0xc000) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000003c0)={r4, 0x0, 0x20}, 0xc) syz_emit_ethernet(0x7c, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd60381f3400462ffffc000000000000000000000000000000ff020000000000000000000000000001042081000000892f0080000008f1000086dd88a888be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000"], 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000080)={r4}, &(0x7f00000000c0)=0x8) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x80000001}) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000005c0)=@nat={'nat\x00', 0x1b, 0x5, 0x770, 0x348, 0x5b0, 0xffffffff, 0x348, 0x5b0, 0x6a0, 0x6a0, 0xffffffff, 0x6a0, 0x6a0, 0x5, &(0x7f0000000280), {[{{@uncond, 0x0, 0x320, 0x348, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0xe, 0x0, [{0xffff, 0x5, 0x1, 0x9}, {0x7ff, 0x80, 0x9, 0xbf2}, {0x83, 0x2, 0x40, 0x7}, {0x7, 0x5, 0x7, 0x2}, {0x6, 0x81, 0x2, 0x4}, {0xd053, 0x5, 0x3, 0x2a9}, {0x0, 0x6, 0x3, 0x90f}, {0x5d, 0x4d, 0x4, 0x5}, {0x6, 0x7, 0xff}, {0xffff, 0xf5, 0x6, 0x5}, {0x2, 0x0, 0x4, 0x7}, {0x8000, 0x2, 0x9, 0x4}, {0x8, 0xdb, 0x38, 0x5}, {0xff, 0x4, 0x0, 0x3}, {0x0, 0x13, 0x2, 0x237}, {0xdf, 0x2, 0x3, 0x7}, {0x10, 0x8, 0x3, 0x80000000}, {0x0, 0x0, 0x9, 0x7}, {0x7aa7, 0x7, 0x8, 0x172ef0f5}, {0x2, 0x2, 0x1, 0x7}, {0x3, 0x4, 0x4, 0x8}, {0x6, 0x7, 0xc6, 0x12c0}, {0x9, 0x4, 0x5, 0x8}, {0xff6c, 0x53, 0x1, 0xffffbdea}, {0xff, 0xc2, 0x5, 0x7}, {0x0, 0xbd, 0xa7, 0x6fe6}, {0x1, 0x6, 0xa, 0xffff}, {0x3, 0x78, 0x2, 0x8}, {0x5, 0x71, 0x45, 0x4}, {0x0, 0x6c, 0x9}, {0x3, 0x4, 0xd0, 0x7}, {0x10, 0xe, 0x8, 0x3}, {0x7f, 0x3, 0x7f, 0x2}, {0xa9f, 0x3, 0x7, 0x910}, {0x8, 0x4, 0x7, 0x3}, {0x1fd, 0x1, 0x6, 0x3}, {0x5, 0xfd, 0x10, 0x6}, {0x2, 0x90, 0x6, 0x5}, {0x8, 0x7, 0x2, 0x7ff}, {0x3, 0x8, 0x9, 0x543daab3}, {0x4, 0x2, 0x0, 0x80000001}, {0xff01, 0x7f, 0xd, 0x7f}, {0x10, 0x0, 0x3, 0x30a97c9a}, {0x6, 0xcc, 0x4, 0x4}, {0x401, 0x8, 0x4, 0xddfc}, {0x401, 0x9, 0x2, 0x8}, {0xe, 0x4, 0x2, 0x8}, {0x7fff, 0x9, 0x5, 0x1}, {0x6, 0x6, 0x3, 0x40}, {0x4ca, 0x81, 0x4}, {0x2a5d, 0x1, 0xf1, 0xcc5}, {0x8, 0x7, 0x9, 0xf1}, {0x0, 0xb7, 0x5}, {0x0, 0x5, 0x5, 0x5}, {0x1d7, 0x7, 0x5, 0x7}, {0x81, 0x6, 0x80, 0x6}, {0x3ff, 0x8, 0x3, 0xe}, {0x4, 0x8f, 0xf9, 0x100}, {0x3, 0x6, 0x2, 0x5}, {0x0, 0x0, 0xf8, 0x5}, {0x7f, 0x9, 0x1, 0xd}, {0x7, 0x9, 0x2, 0xffffff81}, {0x0, 0x1, 0x2, 0x986b}, {0x5, 0xfa, 0x40, 0x1}], {0x47}}}, @common=@unspec=@helper={{0x48}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x7d2}}}, {{@uncond, 0x0, 0x108, 0x150, 0x0, {}, [@common=@srh={{0x30}, {0x3a, 0x4, 0xf, 0x8, 0x2, 0x0, 0x96770072844ef066}}, @common=@srh={{0x30}, {0x3b, 0x8, 0x0, 0x2, 0xbe6, 0x0, 0x2142}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x1a, @ipv4=@remote, @ipv4=@local, @icmp_id=0x65, @icmp_id=0x64}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@icmp6={{0x28}, {0xb, "70cc"}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x14, @ipv6=@empty, @ipv6=@mcast2, @icmp_id=0x67, @port=0x4e20}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x14, @ipv4=@dev={0xac, 0x14, 0x14, 0x2e}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @port=0x4e24, @gre_key=0xe9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7d0) 933.021527ms ago: executing program 4 (id=4052): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) (async) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000940)={@local, @empty, @void, {@ipv4={0x8902, @igmp={{0x5, 0x4, 0x1, 0x19, 0x1c, 0x68, 0x0, 0xf, 0x2, 0x0, @private=0xa010101, @local}, {0x13, 0x1c, 0x0, @empty}}}}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000440009c176454eeff107f533a1d6b8eff9863300000000000040000003000000"], 0x14}}, 0x24004044) (async) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000440009c176454eeff107f533a1d6b8eff9863300000000000040000003000000"], 0x14}}, 0x24004044) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0xf, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x43}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20, 0x40000000}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000080)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="7a0af8ff75257075bfa100000000000007010000f9ffffffb702000005000000bf130000000000008500000071000000b7000000000000009500000000000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b257183fa3bcd48666d1ddd73f3047d248df061222193165274bc7f2382f6cda4bfdd45be583823c0f09601f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce7243d1aebd00000000000000005839c77edf2d34b12cd48a0c20fb7dd843267e0331759f4ec6b5b0af58e604f4942eb613eff289026d5045ef76d7d864409eb2dcc718a09f4886afc26abba34635d0e8b54bc76be40d435aa8b5202db761014b1b999a12df6bee431a666100"/296], &(0x7f0000000100)='GPL\x00'}, 0x48) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="7a0af8ff75257075bfa100000000000007010000f9ffffffb702000005000000bf130000000000008500000071000000b7000000000000009500000000000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b257183fa3bcd48666d1ddd73f3047d248df061222193165274bc7f2382f6cda4bfdd45be583823c0f09601f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce7243d1aebd00000000000000005839c77edf2d34b12cd48a0c20fb7dd843267e0331759f4ec6b5b0af58e604f4942eb613eff289026d5045ef76d7d864409eb2dcc718a09f4886afc26abba34635d0e8b54bc76be40d435aa8b5202db761014b1b999a12df6bee431a666100"/296], &(0x7f0000000100)='GPL\x00'}, 0x48) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f00000003c0)=r3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x2000000000000021, 0x2, 0x2) (async) socket(0x2000000000000021, 0x2, 0x2) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) (async) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) (async) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) (async) socket$inet6(0xa, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x7a, 0x0, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140)=0xffffffffffffffff, 0x4) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140)=0xffffffffffffffff, 0x4) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r8) connect$unix(r8, &(0x7f0000000940)=@file={0x0, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r8) 798.495567ms ago: executing program 2 (id=4053): socket(0x10, 0x80002, 0x0) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) (async) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) r2 = socket$pppoe(0x18, 0x1, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100ffffffff000000003900000008000300", @ANYRES32=r5, @ANYBLOB="18005a801400018005000a"], 0x34}}, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x2, @random="12d03715a316", 'batadv0\x00'}}, 0x1e) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$team(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001740)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010027bd7000ffdbdf250100000008000100", @ANYRES32=r9, @ANYBLOB="400002803c00010024000100656e61626c656400000000000000000000000000000000000000000000000000050003000600000004008400080003"], 0x5c}, 0x1, 0x400000000000000, 0x0, 0x98}, 0x40810) (async) recvmmsg$unix(r6, &(0x7f0000002cc0)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}, {{&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000000100)=[{&(0x7f0000001980)=""/4096, 0x1000}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000002980)=""/225, 0xfeda}], 0x3, &(0x7f0000002a80)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x110}}, {{&(0x7f0000000380), 0x6e, &(0x7f0000000300)=[{&(0x7f0000002bc0)=""/245, 0xf5}], 0x1, &(0x7f0000000440)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x28}}], 0x3, 0x400122a0, 0x0) (async) sendmmsg(r6, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async) sendmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) sendmmsg(r2, &(0x7f0000001840)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000100)="72e020b1fdd540597a6b57278572c838b170c67cf7f04d5372ea3c8840b0d1fd017b87e240bf41a8c6050e94fdbebd1cc9b051b54b5b805bcc6f757d0fdb5b0ccb9c8de46f025c5299c0fa6301a081da7d97ed5f6ffcd42432f8f35bfdd53de80083ffbf1c66e9699e14fc1db7114707ed4146ab5493439f951b4925c7a226686c3c3a17bf1bebcc2a431ad45cbbdd5c230256ba8eae215f7500ccb1466db52ba3e9e8812f5412a6b6c3e317af89e543882479f1fbd4e5ec78dee75b121de56af00caa1c11faa427d0464b4153809262666d204a0e82c0994c82d78e0e10683a19c8e2fa8149279dcd21d75bb7d0476e554b067d6028a22a5b122b76bbcf05dbaef0985446f8569b6fb79b81034f25c8a2fb63a8f995b641ada13d1fc127969222fc85830a9810757021edc714f8c63fda9da4ab8e0e0773975e324a8b1475ef057a20cab0a39861043be23797cba8121719c1183019ee839de7cf85051569e81cb5ae9a6b1b2c7f239479ab6aee63fd925b816508deda84c6f1faeb5cc4d78d48cac3d69bafdf145c0779cf729caa491a7e7adaac95d36a21d8e852e02c4c8ba5aea871cad09a8c4bbe4db29a252a1f98bd3841fda2c062b8fc15480923339b1b20a1d80a75b8be9462be21cc900587de13652c4f1010b99b87057097a58f29261421c9f3b7a04c2f713db7a2cdea94b091acccb0ce28d8fafec94397cf91c6421f0510c4e587f265782fe7aa082d6f8f6642a99b80c62007882bb6b17cc0c0352a83f2c2670db41a9590e1f7542e78e4eacf5c060ddf0eabdc764b5aec61ede77575143392c175fb4f6da2ee9b39af474e9522a5ca400cfa0b8fcabe8e171af238cabfed707269eef50f55f7cd4e1a58e232a68bb86e9e695f1cba5c3beb6578193ec1244a87a18ad485f8a919e0a03e9a800e321c0aac83d28589aacea976e5a762e9dd08e86c2a1b3be9f26106ca22930e176e9ff4cd853f1a4a88d70d2aa2987d55a7e60b5f76b51acd5a512b20dd62ccf66b4e154edadd8785c3f2f971c4192a25483adc3bfdb65c622c7402b32b7ccfb0781517164cfc23832558f98e7e9813db21c374df9bde1578cc7d121aebbb1101e4aad200d04cd441058f721d7c398254a33fa7966653ca7e3743de272e5574927483015937f2249ef25f8e4841c6e550a52dabac3083382d1ba25ab639edf2d53cd6bd1d8727c52971f476e79fdfa3db1bfc66afc4968d931ae456ba1556e1c354a3b2200a2b14d07c8d5f7017de663d3f9b2ddebf572730b2237bc6021cc4ccd02bbd1fffbc1f110c1f09e61b5e6431b2ca7d0fe765091c5453e0c08fa6bf9303cb8b8554faa141ff5c492280d12d79329a1f1761ffea8438ebd4a08523fd8633826bd25071a0779131df73eba03867a54b62715653adfa226e3b13ef3ef3d6bb1ba5fe13e5083c8e79ffa862d4ee9a8012a263d59aaebda84f77924bb6da107ee2252ddbb1261f9b00182e3a8d941b769d6967628e6da0d20a175130e266d265b3f9421e6cc46123c76c053c4f1e684915cf30cb74aac76cdcf43fdaed93951fce06a5aaf9c6cffcac689dd53efeb7bbc4c82295b70f70319e63064ee2883e5be11c6e38ef4c3e0fdba48be49948a32b6257cdb59b0d0c25ab06435be63a6c4a1ea9d9bb35a2811d1310633b7830f85f92a1b96e6d5f0dad45ce5035b0800afbf2d7781a7730c7aa6c6dd2f95966ad0476347a7a644f980e4d77a205b277b932a13989777eb946c024504db9c3e521d0ba23f6a7d669499171d11d0e6caf6b83b0f8e643dbdc58c8cbe420bb5228d0dfa388cf1a4fcffb9e9443223b70eb5c3974df27a2efe43694b679192ac90b81f78a419ce2f67f8071c720f590068300698bec4345ea143192cc7cdb6b5b07af0c42eef6f87acef0d6257a98810cff967e612b1c2deef8cf1f666a73d7edc9b45893ada183c071934c0fc65459e640e3618dc4996f6af814ffa4bce040d1372c7e037882c1036d8482ee03d2e1592cbd272cbc8ebfda39ff6cb4f3470a4037e09af5cad95cf463bd2478ca49502e4d6dce1caf29e13396d001242d6e30d88c9c0662a29c0ea80a4bab00268329da1dbb51b6963fa68f34cc266dbe8f806cf0b6546080f8e09eaf", 0x5eb}], 0x1}}], 0x1, 0x4000) (async, rerun: 32) r11 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (rerun: 32) ioctl$IOCTL_GET_NCIDEV_IDX(r11, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r1, &(0x7f0000000880)={0x27, r12, 0x0, 0x6, 0x0, 0x2, "d92984bd1ca44c226af5160e961711a077609475b78411e879918d20000000f2170e65e3f50327080e000000000000001900", 0x3c}, 0x60) (async) readv(r1, &(0x7f0000000600)=[{&(0x7f00000001c0)=""/109, 0x6d}], 0x1) (async) close(r11) socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, 0x0, 0x0, 0x4c014, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=0x1, @ANYRES32=r0, @ANYBLOB='.\x00\x00'], 0x20) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[], 0x20) 761.640136ms ago: executing program 2 (id=4055): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000)={r1, r2}, 0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r2, r3, 0x25, 0x8, @void}, 0x10) openat$cgroup(r0, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup/syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f00000001c0)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) write$tun(r5, &(0x7f0000000800)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a44, 0x1700) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xe, 0x12, r6, 0x952de000) 696.037143ms ago: executing program 0 (id=4056): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000280)="96fa2c0bff2099297e1c1ea6d53ff4c2f69b32d385f14857ae25047e39555bbacdb216aa20b99d21a3aa2f698ad7b1417791e55e5775e86006548ec677400377670a3422aa5184ed400cf452f14ef81d20a792091e037ed82c9ee401f0f428bd4951eab88952d0", 0x67) (async) tee(r0, r2, 0xfffffffffffffffd, 0x0) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040), &(0x7f00000000c0)=0x4) close(r0) close(r1) 611.129449ms ago: executing program 1 (id=4057): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000064270ba3ceacc89bc2efb1810000000000000004008500000050000000180100002020642500002000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b00000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 610.77768ms ago: executing program 0 (id=4058): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000000)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xe0, r3, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@NL80211_ATTR_REG_RULES={0xcc, 0x22, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x5}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x2}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x9}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xd}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xa}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xffffffff}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x13e}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xffffa857}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xfff}]}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x1}, 0x44051) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000)=0x6, 0x4) socket$nl_route(0x10, 0x3, 0x0) 604.93361ms ago: executing program 3 (id=4059): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f00000004c0)={{r0, &(0x7f00000003c0)='\x00F\t\xecT\x95\xea\x87~\x04\x00\x97\x1e \x84\x8c\x02fB,\xe1\xe7\xb3\xf7\xe3\'\xc7\xaex}\xa3\xbd@', 0x521100, &(0x7f0000000040)={@align=0xffffffffffffffff, {0xfff9, 0xc, 0x2000400, 0x40000000010}}, 0x22ca, &(0x7f0000000240)={@_ha_fsid}, &(0x7f00000000c0)=0x4ffffffd}, 0x2, &(0x7f0000000380)=[{0x2, 0x5, &(0x7f0000000100)='\'.:-:}[[,],\x00', &(0x7f0000000140)="42537731fffb0c47fd1c2225a76491cc7ac5c984131b6ab5fba60ae53a0e88a67fe88928075767a3fda58cc0754694483178ac5e490a37bd29a82f2abaea522d75407661b17d824f02ccb044c40ca8ff624d08d3eb889b07d37b4fa8716015e74362cc1c291268b0ee284494db892c875c288feaa3cd", 0x76, 0x12}, {0x3, 0x2, &(0x7f0000000400)='\x00\x00\x00', &(0x7f0000000280)="ddcc3d2f5c80259459ed8a401dd1bd810330bc3770801c5d81b200e2baf38a3b87994bd53232a94a466f58b738a37f0c8b8fb17bd9579ca26fc986bf6f0ace7197bc12ed07d71c0cba6fdd9162b9acc82c0191479a1f1c5bce665177bb13a39c3ea25aeca657b5c5a8d28f5c4e8cd1f4fcdc09697608f06d8bd70de3fa39a5e04a95ed502b8d0d227f830d8db6d6bfb9b3048c5680b20cb4ffb5b2a72a9c2798a3f6172b6745340cd690596dfe5bf6633a77b72ed2f45403c964c8366a4a428d8723c2502b53159e399ca68d9378028bfaa0123d9cd2fc9dec52389ce6855b22c38ed5e855fbf32fb6b51fa517a902c0cdf7b98607e58a9d65446a75a30998", 0xff, 0x8}]}) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r3, &(0x7f00000008c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000001740)=[{&(0x7f0000000380)='\f', 0x1}], 0x1}}], 0x1, 0x80040) r4 = socket(0x11, 0x3, 0x0) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f0000000000)=@req3={0x10000, 0x1, 0x100, 0x100, 0x100, 0x0, 0x4}, 0x1c) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f00000001c0)={r5, 0x6}, 0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r5, 0x10000, 0x5}, &(0x7f0000000480)=0xc) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x60, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_PEERS={0x38, 0x8, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x3}, @WGPEER_A_ALLOWEDIPS={0x4}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4094}, 0x20000010) socket$packet(0x11, 0x2, 0x300) 601.13141ms ago: executing program 2 (id=4060): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r2, &(0x7f0000000080)={&(0x7f00000000c0)={0xa, 0xa, 0x4, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="14"], 0x18}, 0x922bac8576b92dde) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r4, 0x6, 0x21, &(0x7f0000000280)="dc8daf8d760c0b8caa98fa19c6a35a18883775d272c579ff33a6effc0c49320f", 0x20) getsockopt$inet_tcp_buf(r4, 0x6, 0x21, 0x0, &(0x7f0000000580)) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x3}, {0xfff3}}}, 0x24}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd29, 0xfffffffc, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x448db}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r7) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000a80)={'syzkaller0\x00', @broadcast}) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x20, 0x70bd27, 0xfffffff8, {0x0, 0x0, 0x0, r9, {0xfff3, 0xd}, {0x2}, {0x8, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000810}, 0x40004) recvmmsg(r10, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)=""/62, 0x3e}, {&(0x7f0000000700)=""/197, 0xc5}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000000940)=""/53, 0x35}, {&(0x7f0000000840)=""/255, 0xff}], 0x5}, 0x5d}], 0x1, 0x10022, 0x0) 508.883916ms ago: executing program 1 (id=4061): r0 = socket(0x400000000010, 0x3, 0x0) syz_emit_ethernet(0x6a, &(0x7f00000000c0)={@broadcast, @dev, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x5c, 0x68, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x8100, 0x2, 0x0, [0xb09a], "7f49"}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {}, {0x8, 0x22eb, 0x1, {{}, 0x2, {0x0, 0xfffd}}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge_slave_1\x00', 0x0}) r2 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(r4, &(0x7f0000000080)={0x11, 0x800, r5, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, r3, 0x1, 0x1, 0x6, @multicast}, 0x14) syz_emit_ethernet(0xfdef, &(0x7f0000000140)=ANY=[@ANYBLOB="5b1a033f2511aaaaaaaaaabb08"], 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0xffffffffffffffa1, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, 0x7, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4000}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}}, 0x240000d2) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0x9, 0x9}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x6, 0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x44840) 462.079802ms ago: executing program 4 (id=4062): r0 = socket(0x28, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x50, 0x2, 0x2, 0x801, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x34, 0x10, 0x401, 0x3, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x190, 0xf1f80502f07a58b}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40010}, 0x240080c1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x20000021) r4 = socket(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmmsg(r4, &(0x7f0000000000), 0x400000000000235, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@bridge_newvlan={0x24, 0x70, 0x1, 0x70bd2a, 0x25dfdbfb, {0x7, 0x0, 0x0, r3}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x21, 0x1}}}]}, 0x24}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0xffffffff, 0x1}]}]}}, &(0x7f0000000500)=""/16, 0x46, 0x10, 0x1}, 0x1f) listen(r0, 0x0) r5 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r5, &(0x7f0000000080), 0x10) sendmmsg$alg(r5, &(0x7f0000004ec0)=[{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)='\b', 0x1}], 0x1, 0x0, 0x0, 0x4000004}], 0x1, 0x20) setsockopt$sock_linger(r5, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r5, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24008014) r6 = accept4$unix(r0, 0x0, 0x0, 0x0) recvmsg(r6, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000300)=""/73, 0x49}], 0x1}, 0x10000) recvfrom$unix(r6, &(0x7f0000000140)=""/263, 0x107, 0x0, 0x0, 0x0) 403.331926ms ago: executing program 3 (id=4063): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407}}}}}}, 0x0) readv(r1, &(0x7f00000005c0)=[{&(0x7f0000000180)=""/53, 0xf7a}], 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @broadcast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$unix(0x1, 0x5, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x7, 0x5, 0x5, 0xffffffff, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x2, 0xf}, {0xa, 0xb}, {0xffe0, 0x3}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x200c840) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000004c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="20002bbd7000ffdbdf252100000008000300b659b8a270a3cbf7ceace0a8a602b00eb95d9cadd013774148ae7a8fc4a2324ee33f99c80ca31f45e7781416df211d02260a98fb5e610dcbd8c48bcd0bededf68ad146e511fc7c9954946e7726f7e6987da06aa390b2af2b44b7fd61f16e6260efb4e5ffa038a654101a89dce1b98dc8c17326dad0be50609b27c89b312d0d48eaeffe6e744bd465e7c0fbc3af732724b470855031387543486a07727e580cf4c48771800cc478a4c7b51e7f1b992fce8f6627c087c45ab5a1a8716ce6a8c96156ae8227afb4f756", @ANYRES32=r10, @ANYBLOB="0800dc00000000000800dc0002000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000050}, 0x4004004) 402.831637ms ago: executing program 0 (id=4064): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400), 0x4) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000004c0)={0x4a, 0x0}, 0x8) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x1}, 0x50) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r4, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x20b7ee}) getsockopt$bt_BT_SNDMTU(r4, 0x112, 0xc, &(0x7f0000000100)=0xfffc, &(0x7f0000000180)=0x2) writev(r4, &(0x7f0000000080)=[{0x0}], 0x1) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1}, 0x50) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000600)={0x0, 0x7, 0x8}, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=@base={0x21, 0x0, 0xa, 0x0, 0x40025, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1005, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x0, 0x0, &(0x7f0000000300)='syzkaller\x00', 0xeb0, 0xaa, &(0x7f0000000340)=""/170, 0x41100, 0x10, '\x00', 0x0, @fallback=0x2dfa3a8da4b76485, r1, 0x8, &(0x7f0000000440)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000480)={0x0, 0x10, 0x0, 0x200}, 0x10, r2, 0xffffffffffffffff, 0x7, &(0x7f00000007c0)=[r3, r4, r5, r6, r7, r8, r9], &(0x7f0000000800)=[{0x1, 0x4, 0x4, 0x7}, {0x5, 0x2, 0x8, 0x5}, {0x4, 0x5, 0xf, 0x3}, {0x2, 0x1, 0x7, 0xc}, {0x0, 0x5, 0xb, 0xb}, {0x4, 0x3, 0x1, 0x3}, {0x4, 0x1, 0x1, 0x5}], 0x10, 0x401}, 0x94) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x8572, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x50) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xa7a0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x50) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x2}, 0x50) r13 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000680)=@generic={&(0x7f0000000640)='./file0\x00', 0x0, 0x8}, 0x18) r14 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)={0x1b, 0x0, 0x0, 0x4, 0x0, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2}, 0x50) r15 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb1, 0x7f}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r15}, @generic={0xc3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2}, @exit]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000001}, 0x94) r16 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="08000000040000000400000006"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0x8, &(0x7f0000000240)=ANY=[@ANYRES8=r14, @ANYRES32=r16, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, @sched_cls, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1b, 0x13, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0xffffffc0}, [@call={0x85, 0x0, 0x0, 0x6a}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}}]}, &(0x7f0000000180)='syzkaller\x00', 0x8, 0xe2, &(0x7f0000000380)=""/226, 0x41000, 0x4, '\x00', 0x0, @fallback=0x22, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000480)={0x2, 0xc, 0x2c2, 0x9}, 0x10, r2, 0xffffffffffffffff, 0x4, &(0x7f0000000740)=[r10, r11, r12, r13, 0x1, r14, 0xffffffffffffffff, r15, r16], &(0x7f0000000780)=[{0x3, 0x3, 0xa, 0x6}, {0x3, 0x5, 0xb}, {0x5, 0x1, 0x4f}, {0x1, 0x2, 0x4, 0xa}], 0x10, 0xeb600000}, 0x94) r17 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r17, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r17, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) 347.536587ms ago: executing program 0 (id=4065): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xf, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}, {0x85, 0x0, 0x0, 0x2d}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r1}, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="08000000040000000400000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x14, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000300)="0000ffffffffa000f2710263d2ac", 0x0, 0xe505, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xd}, 0x2e) 336.541762ms ago: executing program 1 (id=4066): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r2, 0x84, 0x1, &(0x7f0000001280)=""/4093, &(0x7f00000000c0)=0xffd) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a0300fef0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000009000000b70000000000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2000000}, 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)=@o_path={&(0x7f0000000080)='./file0\x00', 0x0, 0x18, r0}, 0x18) 193.806193ms ago: executing program 0 (id=4067): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x20, 0x29, 0x1}, 0x20}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="d800000018007b18e00212ba0d8105040a0a9100fe0f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6fd4007100a007a290457f0189b316277ce06bbace8017cbec4c2fe5a7cef4090000001fb791643a5ee4b01602b2a10800ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5", 0xd2}, {&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x2, 0x0, 0x0, 0x2663}, 0x20008000) r2 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300)=0x8df, 0x4) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010001fff2bbd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000098100300280012800900010076657468b339b3930b0fa8381400010000000000", @ANYRES32=0x0, @ANYBLOB="8200030022000000"], 0x48}}, 0x24008000) 96.371518ms ago: executing program 0 (id=4068): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @private=0xa010101}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f00000001c0)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000180)={r3, 0x80000001}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000080)={r4}, 0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={r4, 0x40}, 0x8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ppoll(&(0x7f00000000c0)=[{r0, 0x6}, {r2, 0x1010}, {r2, 0x81fa}, {0xffffffffffffffff, 0x8000}, {r2, 0x4}, {r5, 0x8025}, {r2, 0x22}], 0x7, &(0x7f0000000100), &(0x7f0000000140)={[0x85]}, 0x8) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000080)=0x9, 0x4) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYBLOB="06"], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB="00000119ad"], 0x9) 0s ago: executing program 1 (id=4069): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) accept$inet6(r1, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast1}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum64={0x4, 0x0, 0x0, 0x13, 0x1, 0x2}]}, {0x0, [0x0, 0x0, 0x30, 0x2e, 0x1e]}}, 0x0, 0x2b, 0x0, 0x1, 0x3}, 0x28) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x4}, 0x10) write(r2, &(0x7f0000000240)="240000001a007f0214f9f4070009040803000000000000050000000008000f40fe00000e", 0x24) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xe, 0x4, 0x4, 0x8}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x20008020) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8, 0x40010, r1, 0x0) kernel console output (not intermixed with test programs): d started: state = BACKUP, mcast_ifn = ipvlan1, syncid = 0, id = 0 [ 439.613692][ T7644] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 439.631079][ T7644] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.757794][ T7644] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 439.790576][ T7644] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.924491][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.934081][T16758] __nla_validate_parse: 2 callbacks suppressed [ 439.934097][T16758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3017'. [ 439.957282][T16760] bridge_slave_1: left allmulticast mode [ 439.971117][T16760] bridge_slave_1: left promiscuous mode [ 439.988795][T16760] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.008647][T11076] IPVS: starting estimator thread 0... [ 440.049864][T16757] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3017'. [ 440.105169][T16766] IPVS: using max 55 ests per chain, 132000 per kthread [ 440.340131][T16779] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3020'. [ 440.366225][T16779] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3020'. [ 440.383890][T16784] netlink: 'syz.3.3021': attribute type 1 has an invalid length. [ 440.428261][T16784] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3021'. [ 440.439631][T16780] sctp: [Deprecated]: syz.0.3019 (pid 16780) Use of int in max_burst socket option. [ 440.439631][T16780] Use struct sctp_assoc_value instead [ 440.691290][T16759] lo speed is unknown, defaulting to 1000 [ 440.714233][T16796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3024'. [ 440.738759][T16796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3024'. [ 440.762773][T16796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3024'. [ 440.879197][T16806] bridge_slave_0: left allmulticast mode [ 440.900302][T16806] bridge_slave_0: left promiscuous mode [ 440.912586][T16806] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.925981][T16806] bridge_slave_1: left allmulticast mode [ 440.941922][T16806] bridge_slave_1: left promiscuous mode [ 440.952300][T16806] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.976539][T16806] bond0: (slave bond_slave_0): Releasing backup interface [ 440.990062][T16806] bond0: (slave bond_slave_1): Releasing backup interface [ 441.002936][T16806] team0: Port device team_slave_0 removed [ 441.011922][T16806] team0: Port device team_slave_1 removed [ 441.013694][T16814] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3029'. [ 441.019176][T16806] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 441.072524][T16809] ip6gre2: entered allmulticast mode [ 441.081351][T16809] team0: Port device ip6gre2 added [ 441.251195][T16818] netlink: 'syz.1.3031': attribute type 3 has an invalid length. [ 441.280518][T16818] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 441.329817][T16830] netlink: 'syz.2.3032': attribute type 1 has an invalid length. [ 441.494131][T16823] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3034'. [ 441.712007][T16839] 8021q: adding VLAN 0 to HW filter on device bond19 [ 441.815179][ T7644] bond19: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 441.845188][T16840] bond19: (slave ip6gretap2): Enslaving as an active interface with an up link [ 441.945649][ T58] bond19: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 442.275541][T16852] syzkaller0: entered promiscuous mode [ 442.287211][T16852] syzkaller0: entered allmulticast mode [ 442.767452][T16850] lo speed is unknown, defaulting to 1000 [ 442.955562][ T5635] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 442.968333][ T5635] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 442.979134][ T5635] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 442.994794][ T5635] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 443.002941][ T5635] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 443.280135][T16892] IPv6: NLM_F_CREATE should be specified when creating new route [ 443.292985][T16892] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 443.300300][T16892] IPv6: NLM_F_CREATE should be set when creating new route [ 443.307757][T16892] IPv6: NLM_F_CREATE should be set when creating new route [ 443.315026][T16892] IPv6: NLM_F_CREATE should be set when creating new route [ 443.703024][T16907] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 444.062014][T16922] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 444.097384][T16922] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 444.120917][T16922] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 444.234144][T16881] lo speed is unknown, defaulting to 1000 [ 444.240055][ T5758] IPVS: starting estimator thread 0... [ 444.325181][T16934] IPVS: using max 31 ests per chain, 74400 per kthread [ 444.959952][T16964] netlink: 'syz.4.3069': attribute type 1 has an invalid length. [ 445.041057][ T5636] Bluetooth: hci1: command tx timeout [ 445.228256][T16964] 8021q: adding VLAN 0 to HW filter on device bond1 [ 445.384873][T16969] bond1: (slave veth3): Enslaving as an active interface with a down link [ 445.484288][T16972] bond1: (slave dummy0): making interface the new active one [ 445.508290][T16972] dummy0: entered promiscuous mode [ 445.528937][T16972] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 446.164913][T17005] erspan0: entered promiscuous mode [ 446.196497][T17005] erspan0: entered allmulticast mode [ 446.212275][T16881] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.265241][T16881] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.272933][T16881] bridge_slave_0: entered allmulticast mode [ 446.281495][T16881] bridge_slave_0: entered promiscuous mode [ 446.296889][T16881] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.309846][T16881] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.322762][T16881] bridge_slave_1: entered allmulticast mode [ 446.331569][T16881] bridge_slave_1: entered promiscuous mode [ 446.383286][T16881] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 446.401520][T16881] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 446.494054][T16881] team0: Port device team_slave_0 added [ 446.504892][T16881] team0: Port device team_slave_1 added [ 446.696922][T16881] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 446.728876][T16881] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.791231][T16881] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 446.816734][T17019] netlink: 'syz.3.3080': attribute type 3 has an invalid length. [ 446.837450][T16881] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 446.852829][T16881] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.942793][T16881] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 446.955646][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 447.115835][ T5636] Bluetooth: hci1: command tx timeout [ 447.118723][T16881] hsr_slave_0: entered promiscuous mode [ 447.146735][T16881] hsr_slave_1: entered promiscuous mode [ 447.163461][T16881] debugfs: 'hsr0' already exists in 'hsr' [ 447.174208][T16881] Cannot create hsr debugfs directory [ 447.683086][T16881] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 447.725610][T16881] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 447.926222][T16881] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 447.927150][T17069] __nla_validate_parse: 6 callbacks suppressed [ 447.927167][T17069] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3095'. [ 447.969865][T16881] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 448.090054][T16881] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 448.123111][T16881] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 448.259994][T16881] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 448.278751][T16881] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 448.374884][T17101] netlink: 'syz.2.3103': attribute type 1 has an invalid length. [ 448.428861][T17101] 8021q: adding VLAN 0 to HW filter on device bond5 [ 448.616887][T17108] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 448.631511][T17110] netlink: 'syz.3.3107': attribute type 49 has an invalid length. [ 448.631973][T17112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3108'. [ 448.665435][T17112] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3108'. [ 448.702066][T17110] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3107'. [ 448.756435][T16881] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 448.770990][T16881] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 448.779915][T16881] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 448.828314][T16881] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 448.892691][T16881] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 448.913451][T16881] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 448.933223][T17126] netlink: 'syz.4.3112': attribute type 1 has an invalid length. [ 448.945102][T16881] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 448.973020][T16881] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 449.091586][T17126] 8021q: adding VLAN 0 to HW filter on device bond2 [ 449.110046][T17143] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3114'. [ 449.120429][T17131] tipc: Enabling of bearer rejected, failed to enable media [ 449.134132][T17139] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.150779][T17139] bridge_slave_0 (unregistering): left allmulticast mode [ 449.171594][T17139] bridge_slave_0 (unregistering): left promiscuous mode [ 449.197623][ T5636] Bluetooth: hci1: command tx timeout [ 449.206265][T17139] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.408774][T17156] netem: change failed [ 449.427829][T17156] syzkaller0: entered promiscuous mode [ 449.440804][T17156] syzkaller0: entered allmulticast mode [ 449.513743][T16881] 8021q: adding VLAN 0 to HW filter on device bond0 [ 449.573285][T17169] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3121'. [ 449.583318][T16881] 8021q: adding VLAN 0 to HW filter on device team0 [ 449.622657][ T1179] bridge0: port 1(bridge_slave_0) entered blocking state [ 449.629862][ T1179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 449.653025][ T1179] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.660281][ T1179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 449.942340][T17185] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3126'. [ 449.989839][T17185] bond3: entered promiscuous mode [ 449.998595][T17185] 8021q: adding VLAN 0 to HW filter on device bond3 [ 450.057228][T17185] bridge1: entered promiscuous mode [ 450.064214][T17185] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 450.086055][T17185] netlink: 8048 bytes leftover after parsing attributes in process `syz.4.3126'. [ 450.119649][T17185] bond3 (unregistering): (slave bridge1): Releasing backup interface [ 450.147136][T17185] bridge1: left promiscuous mode [ 450.163322][T17185] bond3 (unregistering): Released all slaves [ 450.214363][T17205] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3131'. [ 450.409030][T17219] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3134'. [ 450.421929][T17219] netlink: 'syz.4.3134': attribute type 1 has an invalid length. [ 450.646565][T16881] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 450.728203][T16881] veth0_vlan: entered promiscuous mode [ 450.751854][T16881] veth1_vlan: entered promiscuous mode [ 450.813668][T16881] veth0_macvtap: entered promiscuous mode [ 450.829279][T16881] veth1_macvtap: entered promiscuous mode [ 450.866161][T16881] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 450.904263][T16881] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 450.952494][ T47] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.972698][ T47] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.990673][ T47] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.194575][ T47] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.275598][ T5636] Bluetooth: hci1: command tx timeout [ 451.564169][ T1179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.589021][ T1179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 451.704309][ T7642] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.724094][ T7642] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 452.204244][T17290] netlink: 'syz.1.3152': attribute type 5 has an invalid length. [ 452.233198][T17290] netlink: 'syz.1.3152': attribute type 6 has an invalid length. [ 452.282972][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 452.303945][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 452.318382][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 452.329158][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 452.337901][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 452.586293][T17305] netlink: 'syz.0.3154': attribute type 13 has an invalid length. [ 452.650721][T17305] netlink: 'syz.0.3154': attribute type 17 has an invalid length. [ 452.740423][T17303] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.857557][T17303] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 452.874912][T17303] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 453.117876][ T1179] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.129403][ T1179] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.156250][ T1179] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.167014][T17281] lo speed is unknown, defaulting to 1000 [ 453.219143][T17322] geneve2: entered promiscuous mode [ 453.253579][T17328] FAULT_INJECTION: forcing a failure. [ 453.253579][T17328] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.287284][T17328] CPU: 1 UID: 0 PID: 17328 Comm: syz.3.3158 Not tainted syzkaller #0 PREEMPT(full) [ 453.287310][T17328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 453.287326][T17328] Call Trace: [ 453.287337][T17328] [ 453.287345][T17328] dump_stack_lvl+0xe8/0x150 [ 453.287373][T17328] should_fail_ex+0x412/0x560 [ 453.287406][T17328] _copy_from_user+0x2d/0xb0 [ 453.287432][T17328] ____sys_sendmsg+0x308/0x9f0 [ 453.287460][T17328] ? __might_fault+0xaf/0x130 [ 453.287490][T17328] ? __pfx_____sys_sendmsg+0x10/0x10 [ 453.287524][T17328] ? import_iovec+0x73/0xa0 [ 453.287552][T17328] ___sys_sendmsg+0x2a5/0x360 [ 453.287576][T17328] ? __lock_acquire+0x6b5/0x2cf0 [ 453.287599][T17328] ? __pfx____sys_sendmsg+0x10/0x10 [ 453.287630][T17328] ? kstrtouint+0x6e/0xe0 [ 453.287675][T17328] ? __fget_files+0x2a/0x420 [ 453.287696][T17328] ? __fget_files+0x3a0/0x420 [ 453.287728][T17328] __sys_sendmmsg+0x27c/0x4e0 [ 453.287758][T17328] ? __pfx___sys_sendmmsg+0x10/0x10 [ 453.287782][T17328] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 453.287826][T17328] ? ksys_write+0x242/0x270 [ 453.287854][T17328] ? __pfx_ksys_write+0x10/0x10 [ 453.287885][T17328] __x64_sys_sendmmsg+0xa0/0xc0 [ 453.287912][T17328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.287931][T17328] do_syscall_64+0x15f/0xf80 [ 453.287947][T17328] ? trace_irq_disable+0x3b/0x140 [ 453.287981][T17328] ? clear_bhb_loop+0x40/0x90 [ 453.288001][T17328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.288020][T17328] RIP: 0033:0x7efef6d9cdd9 [ 453.288038][T17328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.288054][T17328] RSP: 002b:00007efef7b81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 453.288075][T17328] RAX: ffffffffffffffda RBX: 00007efef7015fa0 RCX: 00007efef6d9cdd9 [ 453.288088][T17328] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 453.288100][T17328] RBP: 00007efef7b81090 R08: 0000000000000000 R09: 0000000000000000 [ 453.288111][T17328] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000001 [ 453.288122][T17328] R13: 00007efef7016038 R14: 00007efef7015fa0 R15: 00007ffcbe706508 [ 453.288148][T17328] [ 453.525275][T17324] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 453.537441][T17324] bond1 (unregistering): Released all slaves [ 453.575565][ T1179] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.613545][T17334] __nla_validate_parse: 9 callbacks suppressed [ 453.613563][T17334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3159'. [ 453.686953][T17336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3159'. [ 453.858505][T17345] netlink: 332 bytes leftover after parsing attributes in process `syz.3.3163'. [ 453.863745][T17341] ip6gretap1: entered allmulticast mode [ 453.870240][T17345] netlink: 'syz.3.3163': attribute type 9 has an invalid length. [ 453.884474][T17345] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3163'. [ 453.895236][T17345] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3163'. [ 453.904372][T17344] netlink: 'syz.1.3162': attribute type 49 has an invalid length. [ 453.920586][T17341] netlink: 'syz.0.3161': attribute type 2 has an invalid length. [ 453.936708][T17341] tipc: Started in network mode [ 453.943998][T17341] tipc: Node identity 1340008, cluster identity 4711 [ 453.954782][T17341] tipc: Node number set to 20185096 [ 453.992024][T17347] netlink: 65027 bytes leftover after parsing attributes in process `syz.0.3161'. [ 454.117755][T17355] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3165'. [ 454.131944][T17356] netlink: 'syz.1.3165': attribute type 3 has an invalid length. [ 454.240537][T17291] lo speed is unknown, defaulting to 1000 [ 454.259727][T17364] xt_hashlimit: size too large, truncated to 1048576 [ 454.395233][ T5635] Bluetooth: hci2: command tx timeout [ 455.010338][T17375] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3170'. [ 455.242121][T17396] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3172'. [ 455.279751][T17396] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3172'. [ 455.579807][ T7642] tipc: Subscription rejected, illegal request [ 455.581889][T17291] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.593580][T17291] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.602219][T17291] bridge_slave_0: entered allmulticast mode [ 455.610245][T17291] bridge_slave_0: entered promiscuous mode [ 455.683279][T17291] bridge0: port 2(bridge_slave_1) entered blocking state [ 455.698689][T17291] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.709665][T17291] bridge_slave_1: entered allmulticast mode [ 455.718767][T17291] bridge_slave_1: entered promiscuous mode [ 455.817138][T17424] gtp0: entered promiscuous mode [ 455.829928][T17424] gtp0: entered allmulticast mode [ 455.858784][T17291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 455.891555][T17291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 455.977995][T17430] syz_tun: entered allmulticast mode [ 456.054173][T17430] syz_tun (unregistering): left allmulticast mode [ 456.138113][T17291] team0: Port device team_slave_0 added [ 456.167307][T17291] team0: Port device team_slave_1 added [ 456.189527][T17444] hsr_slave_0 (unregistering): left promiscuous mode [ 456.220972][T17449] netlink: 'syz.1.3186': attribute type 8 has an invalid length. [ 456.271472][T17291] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 456.282985][T17291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.326958][T17291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 456.416755][T17291] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 456.443053][T17291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.485275][ T5635] Bluetooth: hci2: command tx timeout [ 456.497763][T17291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 456.561327][T17291] hsr_slave_0: entered promiscuous mode [ 456.569063][T17291] hsr_slave_1: entered promiscuous mode [ 456.575704][T17291] debugfs: 'hsr0' already exists in 'hsr' [ 456.581491][T17291] Cannot create hsr debugfs directory [ 457.119477][T17483] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 457.164515][T17483] Bluetooth: MGMT ver 1.23 [ 457.326350][ T47] dummy0: left promiscuous mode [ 457.503354][T17504] bridge0: port 3(team0) entered disabled state [ 457.509951][T17504] bridge0: port 2(bridge_slave_1) entered disabled state [ 457.518774][T17504] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.633850][T17504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 457.649523][T17504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 457.834751][ T1179] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.869894][T17439] lo speed is unknown, defaulting to 1000 [ 457.876298][ T1179] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.896781][ T1179] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.929581][ T1179] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.946777][T17523] x_tables: duplicate underflow at hook 2 [ 458.040159][T17526] netlink: 'syz.1.3201': attribute type 5 has an invalid length. [ 458.558622][ T5635] Bluetooth: hci2: command tx timeout [ 458.768440][T17291] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 458.810977][T17291] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 458.843636][T17291] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 458.892717][T17291] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 458.916174][T17291] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 458.926058][T17550] sctp: [Deprecated]: syz.1.3206 (pid 17550) Use of int in max_burst socket option. [ 458.926058][T17550] Use struct sctp_assoc_value instead [ 458.947647][T17291] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 458.962397][T17291] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 459.037004][T17291] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 459.317638][T17291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 459.349694][T17291] 8021q: adding VLAN 0 to HW filter on device team0 [ 459.372588][ T7642] bridge0: port 1(bridge_slave_0) entered blocking state [ 459.379819][ T7642] bridge0: port 1(bridge_slave_0) entered forwarding state [ 459.401889][ T7642] bridge0: port 2(bridge_slave_1) entered blocking state [ 459.409091][ T7642] bridge0: port 2(bridge_slave_1) entered forwarding state [ 459.590357][T17585] x_tables: duplicate underflow at hook 3 [ 459.609054][T17581] __nla_validate_parse: 10 callbacks suppressed [ 459.609075][T17581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3213'. [ 459.628948][T17581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3213'. [ 459.648488][ T7642] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 459.658131][T17581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3213'. [ 459.667533][T17581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3213'. [ 459.684549][ T7642] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 459.703265][ T7642] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 459.717386][ T7642] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 459.820219][T17591] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3214'. [ 459.983364][T17600] x_tables: duplicate underflow at hook 1 [ 460.231383][T17291] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 460.393993][T17291] veth0_vlan: entered promiscuous mode [ 460.475753][T17623] netlink: 364 bytes leftover after parsing attributes in process `syz.0.3221'. [ 460.490547][T17291] veth1_vlan: entered promiscuous mode [ 460.596434][T17291] veth0_macvtap: entered promiscuous mode [ 460.624279][T17291] veth1_macvtap: entered promiscuous mode [ 460.635115][ T5635] Bluetooth: hci2: command tx timeout [ 460.671821][T17291] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 460.762019][T17291] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 460.811285][ T7642] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.841522][ T7642] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.862652][ T7642] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.009769][ T7642] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.041508][T17637] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3225'. [ 461.060054][T17638] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3226'. [ 461.157795][T17641] netlink: 'syz.1.3224': attribute type 1 has an invalid length. [ 461.178653][T17641] netlink: 13 bytes leftover after parsing attributes in process `syz.1.3224'. [ 461.407760][ T7654] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 461.431010][ T7654] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.492735][ T7642] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 461.513175][ T7642] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.550321][T17648] netlink: 'syz.0.3229': attribute type 21 has an invalid length. [ 461.850988][T17648] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3229'. [ 461.861339][T17648] netlink: 'syz.0.3229': attribute type 1 has an invalid length. [ 462.201415][T17677] FAULT_INJECTION: forcing a failure. [ 462.201415][T17677] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 462.221507][T17677] CPU: 0 UID: 0 PID: 17677 Comm: syz.4.3235 Not tainted syzkaller #0 PREEMPT(full) [ 462.221531][T17677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 462.221543][T17677] Call Trace: [ 462.221552][T17677] [ 462.221560][T17677] dump_stack_lvl+0xe8/0x150 [ 462.221593][T17677] should_fail_ex+0x412/0x560 [ 462.221623][T17677] prepare_alloc_pages+0x22a/0x650 [ 462.221660][T17677] __alloc_frozen_pages_noprof+0x12f/0x380 [ 462.221689][T17677] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 462.221718][T17677] ? __pfx_policy_nodemask+0x10/0x10 [ 462.221744][T17677] ? trace_kmalloc+0x2a/0xf0 [ 462.221768][T17677] ? __pfx__copy_from_iter+0x10/0x10 [ 462.221794][T17677] alloc_pages_mpol+0x235/0x490 [ 462.221826][T17677] alloc_pages_noprof+0xac/0x2a0 [ 462.221846][T17677] af_alg_sendmsg+0x1446/0x2650 [ 462.221884][T17677] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 462.221906][T17677] ? __pfx_aa_sk_perm+0x10/0x10 [ 462.221926][T17677] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 462.221957][T17677] ? aa_sock_msg_perm+0xf1/0x1b0 [ 462.221982][T17677] ? skcipher_sendmsg+0x26/0xf0 [ 462.222009][T17677] ____sys_sendmsg+0x972/0x9f0 [ 462.222035][T17677] ? __might_fault+0xaf/0x130 [ 462.222063][T17677] ? __pfx_____sys_sendmsg+0x10/0x10 [ 462.222098][T17677] ? import_iovec+0x73/0xa0 [ 462.222124][T17677] ___sys_sendmsg+0x2a5/0x360 [ 462.222149][T17677] ? __lock_acquire+0x6b5/0x2cf0 [ 462.222173][T17677] ? __pfx____sys_sendmsg+0x10/0x10 [ 462.222204][T17677] ? kstrtouint+0x6e/0xe0 [ 462.222250][T17677] ? __fget_files+0x2a/0x420 [ 462.222271][T17677] ? __fget_files+0x3a0/0x420 [ 462.222302][T17677] __sys_sendmmsg+0x27c/0x4e0 [ 462.222334][T17677] ? __pfx___sys_sendmmsg+0x10/0x10 [ 462.222358][T17677] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 462.222401][T17677] ? ksys_write+0x242/0x270 [ 462.222428][T17677] ? __pfx_ksys_write+0x10/0x10 [ 462.222455][T17677] __x64_sys_sendmmsg+0xa0/0xc0 [ 462.222481][T17677] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.222501][T17677] do_syscall_64+0x15f/0xf80 [ 462.222518][T17677] ? trace_irq_disable+0x3b/0x140 [ 462.222544][T17677] ? clear_bhb_loop+0x40/0x90 [ 462.222566][T17677] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.222585][T17677] RIP: 0033:0x7f1b9dd9cdd9 [ 462.222603][T17677] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 462.222619][T17677] RSP: 002b:00007f1b9eca2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 462.222648][T17677] RAX: ffffffffffffffda RBX: 00007f1b9e015fa0 RCX: 00007f1b9dd9cdd9 [ 462.222662][T17677] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 462.222674][T17677] RBP: 00007f1b9eca2090 R08: 0000000000000000 R09: 0000000000000000 [ 462.222685][T17677] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000001 [ 462.222697][T17677] R13: 00007f1b9e016038 R14: 00007f1b9e015fa0 R15: 00007fffaeb80ba8 [ 462.222727][T17677] [ 462.681999][ T5636] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 462.772068][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 462.780125][ T5636] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 462.789267][ T5636] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 462.797127][ T5636] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 463.029774][T17702] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 463.380122][T17712] netlink: 'syz.4.3241': attribute type 1 has an invalid length. [ 463.993624][T17700] lo speed is unknown, defaulting to 1000 [ 464.275013][T17738] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.301769][T17738] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.309228][T17738] bridge0: port 1(bridge_slave_0) entered forwarding state [ 464.480634][T17744] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 464.598153][T17730] lo speed is unknown, defaulting to 1000 [ 464.877959][ T5635] Bluetooth: hci3: command tx timeout [ 465.200686][T17686] lo speed is unknown, defaulting to 1000 [ 465.593346][T17745] lo speed is unknown, defaulting to 1000 [ 465.605238][T17745] lo speed is unknown, defaulting to 1000 [ 465.617846][T17745] lo speed is unknown, defaulting to 1000 [ 465.642367][T17745] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 465.695998][T17745] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 465.745144][T17745] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 465.846717][T17745] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 466.035115][T17745] lo speed is unknown, defaulting to 1000 [ 466.082142][T17745] lo speed is unknown, defaulting to 1000 [ 466.241285][T17745] lo speed is unknown, defaulting to 1000 [ 466.248123][T17686] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.276865][T17686] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.295264][T17686] bridge_slave_0: entered allmulticast mode [ 466.337815][T17686] bridge_slave_0: entered promiscuous mode [ 466.357017][T17745] lo speed is unknown, defaulting to 1000 [ 466.363788][T17686] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.378165][T17686] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.388856][T17686] bridge_slave_1: entered allmulticast mode [ 466.416459][T17686] bridge_slave_1: entered promiscuous mode [ 466.424698][T17745] lo speed is unknown, defaulting to 1000 [ 466.444737][T17745] lo speed is unknown, defaulting to 1000 [ 466.468200][T17686] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 466.477526][T17745] lo speed is unknown, defaulting to 1000 [ 466.487180][T17686] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 466.498955][T17745] lo speed is unknown, defaulting to 1000 [ 466.520467][T17745] lo speed is unknown, defaulting to 1000 [ 466.547910][T17745] lo speed is unknown, defaulting to 1000 [ 466.557118][T17686] team0: Port device team_slave_0 added [ 466.564711][T17745] lo speed is unknown, defaulting to 1000 [ 466.574656][T17686] team0: Port device team_slave_1 added [ 466.582277][T17745] lo speed is unknown, defaulting to 1000 [ 466.651217][T17686] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 466.663399][T17686] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 466.697624][T17686] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 466.720494][T17686] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 466.728244][T17686] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 466.754729][T17686] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 466.867588][T17686] hsr_slave_0: entered promiscuous mode [ 466.880939][T17686] hsr_slave_1: entered promiscuous mode [ 466.892928][T17686] debugfs: 'hsr0' already exists in 'hsr' [ 466.907402][T17686] Cannot create hsr debugfs directory [ 466.955551][ T5635] Bluetooth: hci3: command tx timeout [ 466.994680][T17775] __nla_validate_parse: 2 callbacks suppressed [ 466.994700][T17775] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3252'. [ 467.033835][T17775] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 467.339520][T17789] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3256'. [ 467.386454][T17789] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.394128][T17789] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.460824][T17793] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.478293][T17794] xt_TPROXY: Can be used only with -p tcp or -p udp [ 467.499223][T17789] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 467.511095][T17789] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 467.669623][ T1179] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.688602][ T1179] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.698184][ T1179] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.710238][ T1179] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.727017][ T1179] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.746195][ T1179] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.809344][ T1179] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.818514][ T1179] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.110052][T17814] bond1: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 468.124520][T17814] bond1 (unregistering): Released all slaves [ 468.413604][T17753] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 468.469070][T17686] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 468.514646][T17686] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 468.541913][T17686] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 468.573211][T17686] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 468.594940][T17686] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 468.629427][T17686] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 468.654045][T17686] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 468.665598][T17686] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 468.674420][T17839] syzkaller0: entered promiscuous mode [ 468.684466][T17839] syzkaller0: entered allmulticast mode [ 468.929381][T17686] 8021q: adding VLAN 0 to HW filter on device bond0 [ 468.994417][T17686] 8021q: adding VLAN 0 to HW filter on device team0 [ 469.010819][ T1179] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.018058][ T1179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 469.037789][ T5635] Bluetooth: hci3: command tx timeout [ 469.089374][ T7644] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.096616][ T7644] bridge0: port 2(bridge_slave_1) entered forwarding state [ 469.229955][T17686] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 469.364540][T17893] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 469.407155][T17893] netlink: 'syz.0.3267': attribute type 12 has an invalid length. [ 469.888761][T17925] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3272'. [ 469.947835][ T29] audit: type=1800 audit(1778424031.980:4): pid=17921 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3271" name="memory.events" dev="tmpfs" ino=449 res=0 errno=0 [ 470.020105][ T29] audit: type=1804 audit(1778424031.980:5): pid=17921 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.3271" name="/newroot/85/memory.events" dev="tmpfs" ino=449 res=1 errno=0 [ 470.188702][T17686] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 470.330901][T17686] veth0_vlan: entered promiscuous mode [ 470.388348][T17686] veth1_vlan: entered promiscuous mode [ 470.464553][T17957] FAULT_INJECTION: forcing a failure. [ 470.464553][T17957] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 470.502647][T17686] veth0_macvtap: entered promiscuous mode [ 470.502662][T17957] CPU: 1 UID: 0 PID: 17957 Comm: syz.0.3280 Not tainted syzkaller #0 PREEMPT(full) [ 470.502682][T17957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 470.502691][T17957] Call Trace: [ 470.502698][T17957] [ 470.502704][T17957] dump_stack_lvl+0xe8/0x150 [ 470.502732][T17957] should_fail_ex+0x412/0x560 [ 470.502759][T17957] prepare_alloc_pages+0x22a/0x650 [ 470.502793][T17957] __alloc_frozen_pages_noprof+0x12f/0x380 [ 470.502823][T17957] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 470.502852][T17957] ? __pfx_policy_nodemask+0x10/0x10 [ 470.502878][T17957] ? trace_kmalloc+0x2a/0xf0 [ 470.502909][T17957] ? __pfx__copy_from_iter+0x10/0x10 [ 470.502935][T17957] alloc_pages_mpol+0x235/0x490 [ 470.502965][T17957] alloc_pages_noprof+0xac/0x2a0 [ 470.502985][T17957] af_alg_sendmsg+0x1446/0x2650 [ 470.503027][T17957] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 470.503048][T17957] ? __pfx_aa_sk_perm+0x10/0x10 [ 470.503068][T17957] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 470.503098][T17957] ? aa_sock_msg_perm+0xf1/0x1b0 [ 470.503123][T17957] ? skcipher_sendmsg+0x26/0xf0 [ 470.503147][T17957] ____sys_sendmsg+0x972/0x9f0 [ 470.503173][T17957] ? __might_fault+0xaf/0x130 [ 470.503201][T17957] ? __pfx_____sys_sendmsg+0x10/0x10 [ 470.503235][T17957] ? import_iovec+0x73/0xa0 [ 470.503261][T17957] ___sys_sendmsg+0x2a5/0x360 [ 470.503285][T17957] ? __lock_acquire+0x6b5/0x2cf0 [ 470.503308][T17957] ? __pfx____sys_sendmsg+0x10/0x10 [ 470.503365][T17957] ? __fget_files+0x2a/0x420 [ 470.503386][T17957] ? __fget_files+0x3a0/0x420 [ 470.503415][T17957] __sys_sendmmsg+0x27c/0x4e0 [ 470.503446][T17957] ? __pfx___sys_sendmmsg+0x10/0x10 [ 470.503469][T17957] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 470.503517][T17957] ? rcu_is_watching+0x15/0xb0 [ 470.503545][T17957] __x64_sys_sendmmsg+0xa0/0xc0 [ 470.503570][T17957] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.503589][T17957] do_syscall_64+0x15f/0xf80 [ 470.503607][T17957] ? clear_bhb_loop+0x40/0x90 [ 470.503629][T17957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.503646][T17957] RIP: 0033:0x7fd0e759cdd9 [ 470.503663][T17957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.503679][T17957] RSP: 002b:00007fd0e83d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 470.503697][T17957] RAX: ffffffffffffffda RBX: 00007fd0e7815fa0 RCX: 00007fd0e759cdd9 [ 470.503709][T17957] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 470.503721][T17957] RBP: 00007fd0e83d2090 R08: 0000000000000000 R09: 0000000000000000 [ 470.503732][T17957] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 470.503743][T17957] R13: 00007fd0e7816038 R14: 00007fd0e7815fa0 R15: 00007ffec1e874d8 [ 470.503771][T17957] [ 470.796704][T17686] veth1_macvtap: entered promiscuous mode [ 470.846717][T17686] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 470.868274][T17686] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 470.886396][T17961] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3282'. [ 470.906365][ T7642] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.915772][ T7642] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.926161][ T7642] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 470.950172][ T7642] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.115633][ T5635] Bluetooth: hci3: command tx timeout [ 471.828824][T17855] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 471.961078][ T1179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.991021][ T1179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 472.049446][T17986] netlink: 'syz.2.3287': attribute type 21 has an invalid length. [ 472.065904][T17986] IPv6: NLM_F_CREATE should be specified when creating new route [ 472.158386][ T50] hid-generic 0005:4C4A:0A11.0001: item fetching failed at offset 0/1 [ 472.158471][ T7644] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 472.168054][ T50] hid-generic 0005:4C4A:0A11.0001: probe with driver hid-generic failed with error -22 [ 472.188068][ T7644] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 472.240686][T17984] 8021q: adding VLAN 0 to HW filter on device bond2 [ 472.249465][T17984] bond1: (slave bond2): Enslaving as an active interface with an up link [ 472.324794][T17994] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 472.358911][T17984] bond1: entered allmulticast mode [ 472.365052][T17984] bond2: entered allmulticast mode [ 472.371280][T17984] gretap1: entered allmulticast mode [ 472.653979][T18019] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3296'. [ 472.654011][T18025] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3296'. [ 472.673221][T18025] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3296'. [ 472.700526][T18019] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3296'. [ 472.780258][T18035] bond3: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 472.819401][T18035] bond3 (unregistering): Released all slaves [ 472.894278][T18045] xt_CT: You must specify a L4 protocol and not use inversions on it [ 472.940748][T18049] netlink: 'syz.2.3303': attribute type 11 has an invalid length. [ 473.139280][T18061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3308'. [ 473.163300][T18069] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3311'. [ 473.174072][T18067] openvswitch: netlink: IP tunnel dst address not specified [ 473.182999][T18067] netlink: 26 bytes leftover after parsing attributes in process `syz.4.3310'. [ 473.197923][ T5635] Bluetooth: hci3: command tx timeout [ 473.203134][T18063] bond2: entered promiscuous mode [ 473.221307][T18063] 8021q: adding VLAN 0 to HW filter on device bond2 [ 473.238677][T18070] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3308'. [ 473.267634][T18061] syzkaller0: entered promiscuous mode [ 473.287856][T18061] syzkaller0: entered allmulticast mode [ 473.329132][T18079] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3314'. [ 473.723524][T18105] nbd: nbd0 already in use [ 473.744168][T18105] nbd: nbd0 already in use [ 473.790790][T18105] nbd: nbd0 already in use [ 473.854629][T18105] nbd: nbd0 already in use [ 473.883243][T18116] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3323'. [ 473.931450][T18105] nbd: nbd0 already in use [ 473.981733][T18105] nbd: nbd0 already in use [ 473.997063][T18105] nbd: nbd0 already in use [ 474.030651][T18105] nbd: nbd0 already in use [ 474.038467][T18105] nbd: nbd0 already in use [ 474.150285][T18105] nbd: nbd0 already in use [ 474.162390][T18105] nbd: nbd0 already in use [ 474.190537][T18134] netlink: 'syz.4.3328': attribute type 4 has an invalid length. [ 474.199825][T18134] netlink: 'syz.4.3328': attribute type 8 has an invalid length. [ 474.222494][T18105] nbd: nbd0 already in use [ 474.277288][T18105] nbd: nbd0 already in use [ 474.292440][T18105] nbd: nbd0 already in use [ 474.322745][T18105] nbd: nbd0 already in use [ 474.350312][T18105] nbd: nbd0 already in use [ 474.362061][T18105] nbd: nbd0 already in use [ 474.377411][T18105] nbd: nbd0 already in use [ 474.396863][T18105] nbd: nbd0 already in use [ 474.406749][T18139] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 474.436013][T18139] syzkaller0: entered promiscuous mode [ 474.442682][T18105] nbd: nbd0 already in use [ 474.454900][T18105] nbd: nbd0 already in use [ 474.462578][T18139] syzkaller0: entered allmulticast mode [ 474.468493][T18105] nbd: nbd0 already in use [ 474.489701][T18105] nbd: nbd0 already in use [ 474.499461][T18105] nbd: nbd0 already in use [ 474.509450][T18105] nbd: nbd0 already in use [ 474.522857][T18105] nbd: nbd0 already in use [ 474.671333][T18153] netlink: 'syz.2.3336': attribute type 1 has an invalid length. [ 474.930350][T18171] netlink: 'syz.1.3344': attribute type 1 has an invalid length. [ 474.971637][T18172] bond3 (unregistering): Released all slaves [ 475.092420][T18186] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 475.119747][T18179] bond3: entered allmulticast mode [ 475.172139][T18187] bridge1: entered allmulticast mode [ 475.187290][T18187] bond3: (slave bridge1): Enslaving as a backup interface with an up link [ 475.271053][T18171] bridge2: entered allmulticast mode [ 475.292248][T18171] bond3: (slave bridge2): Enslaving as a backup interface with a down link [ 475.721013][T18229] netlink: 'syz.4.3356': attribute type 1 has an invalid length. [ 475.975352][T18238] 8021q: adding VLAN 0 to HW filter on device bond3 [ 475.982611][T18235] sch_tbf: burst 1023 is lower than device lo mtu (65550) ! [ 476.043901][T18239] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 476.085203][ T7642] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 476.257764][ T47] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 476.323526][T18263] netlink: 'syz.1.3366': attribute type 21 has an invalid length. [ 476.461678][T18278] netlink: 'syz.3.3369': attribute type 1 has an invalid length. [ 476.593036][T18290] siw: device registration error -23 [ 478.315617][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 478.580481][T18330] __nla_validate_parse: 17 callbacks suppressed [ 478.580500][T18330] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3386'. [ 479.236390][T18263] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 479.443427][T18355] netlink: 'syz.4.3394': attribute type 3 has an invalid length. [ 479.474689][T18355] openvswitch: netlink: ufid size 32 bytes exceeds the range (1, 16) [ 479.476836][T18356] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 479.484672][T18355] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 479.573640][T18363] netlink: 'syz.1.3397': attribute type 1 has an invalid length. [ 479.704183][T18366] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 479.730003][T18366] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 479.914409][T18375] bond4: (slave bridge3): Enslaving as an active interface with a down link [ 479.947152][T18366] macvlan2: entered promiscuous mode [ 479.953111][T18366] macvlan2: entered allmulticast mode [ 479.959845][T18366] bond4: entered promiscuous mode [ 479.980412][T18366] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 479.996535][T18384] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 480.014862][T18366] bond4: left promiscuous mode [ 480.060804][T18386] netlink: 756 bytes leftover after parsing attributes in process `syz.0.3399'. [ 480.118683][T18391] netlink: 'syz.2.3406': attribute type 4 has an invalid length. [ 480.136913][ T5751] lo speed is unknown, defaulting to 1000 [ 480.160811][T18367] ip6tnl2: entered allmulticast mode [ 480.363553][T18407] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3413'. [ 480.386950][T18407] dvmrp0: entered allmulticast mode [ 480.399224][T18406] dvmrp0: left allmulticast mode [ 480.490010][T18413] netlink: 'syz.0.3415': attribute type 10 has an invalid length. [ 480.513786][T18413] team0: Port device dummy0 added [ 480.583455][T18417] veth0: entered promiscuous mode [ 480.603313][T18417] bond0: entered promiscuous mode [ 480.629286][T18417] bond_slave_0: entered promiscuous mode [ 480.657626][T18417] bond_slave_1: entered promiscuous mode [ 480.835578][T18430] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 480.963713][T18412] bond0: left promiscuous mode [ 480.972118][T18412] bond_slave_0: left promiscuous mode [ 480.981342][T18412] bond_slave_1: left promiscuous mode [ 480.995782][T18412] veth0: left promiscuous mode [ 481.044646][T18443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3420'. [ 481.068700][T18444] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3422'. [ 481.187330][T18444] team0: Port device team_slave_0 removed [ 481.206579][T18461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3425'. [ 481.251737][T18457] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3422'. [ 481.282485][T18457] tipc: Enabling of bearer rejected, failed to enable media [ 481.347454][T18463] bond3: Removing last arp target with arp_interval on [ 481.568692][T18449] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.693488][T18491] tipc: Enabling of bearer rejected, failed to enable media [ 481.777626][T18449] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.006439][T18449] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.138650][T18449] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.190840][T18514] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3434'. [ 482.211598][T18511] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.219230][T18511] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.330737][T18511] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 482.345323][T18511] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 482.432987][T18511] bond2: left promiscuous mode [ 482.441134][ T5751] lo speed is unknown, defaulting to 1000 [ 482.452680][T18513] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3435'. [ 482.461973][ T5751] syz2: Port: 1 Link DOWN [ 482.477162][ T7654] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.501178][ T7654] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.533119][ T7654] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.562523][ T7654] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.596902][T18519] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3437'. [ 482.637896][ T7654] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.684455][ T47] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.730033][ T47] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.807166][ T47] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.094513][T18539] tipc: Enabling of bearer rejected, failed to enable media [ 483.183598][T18541] @0Ùÿÿ: renamed from bond_slave_1 [ 483.582657][T18522] lo speed is unknown, defaulting to 1000 [ 483.861984][T18565] syzkaller0: entered promiscuous mode [ 483.871092][T18565] syzkaller0: entered allmulticast mode [ 485.646353][T18522] lo speed is unknown, defaulting to 1000 [ 485.647489][T18550] lo speed is unknown, defaulting to 1000 [ 485.992991][T18589] netlink: 'syz.2.3455': attribute type 1 has an invalid length. [ 485.993359][T18587] __nla_validate_parse: 2 callbacks suppressed [ 485.993373][T18587] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3454'. [ 486.052385][T18589] bond4: entered promiscuous mode [ 486.057929][T18589] bond4: entered allmulticast mode [ 486.063643][T18589] 8021q: adding VLAN 0 to HW filter on device bond4 [ 486.093549][T18590] macvlan2: entered promiscuous mode [ 486.099173][T18590] macvlan2: entered allmulticast mode [ 486.106711][T18590] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 486.108586][T18589] xt_hl: Unknown Hop Limit match mode: 206 [ 486.131738][T18550] lo speed is unknown, defaulting to 1000 [ 486.715315][T18616] tipc: Enabling of bearer rejected, failed to enable media [ 486.961737][T18632] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3462'. [ 486.974308][T18632] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3462'. [ 487.332510][T18644] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3467'. [ 487.380701][T18646] xt_hashlimit: size too large, truncated to 1048576 [ 487.440493][T18649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3467'. [ 487.453640][T18650] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3468'. [ 487.492765][T18652] xt_bpf: check failed: parse error [ 487.544188][T18649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3467'. [ 487.575565][T18649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3467'. [ 487.608023][T18649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3467'. [ 487.948830][T18675] netlink: 'syz.1.3471': attribute type 49 has an invalid length. [ 487.967322][T18676] tipc: Enabled bearer , priority 0 [ 487.980946][T18676] tipc: Resetting bearer [ 488.286470][T18684] netlink: 'syz.4.3476': attribute type 1 has an invalid length. [ 488.295313][T18687] netlink: 'syz.4.3476': attribute type 1 has an invalid length. [ 488.303432][T18684] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 488.312907][T18687] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 488.482902][T18674] tipc: Disabling bearer [ 489.148506][T18729] netlink: 210640 bytes leftover after parsing attributes in process `syz.1.3480'. [ 489.332705][T18725] bond5: (slave bond_slave_1): Device is not our slave [ 489.385271][T18725] bond5: option active_slave: invalid value (bond_slave_1) [ 489.451212][T18725] bond5 (unregistering): Released all slaves [ 489.594703][T18732] bond1: option min_links: invalid value (18446744073709551612) [ 489.626438][T18732] bond1: option min_links: allowed values 0 - 2147483647 [ 489.670974][T18732] bond1 (unregistering): Released all slaves [ 491.555995][T18808] __nla_validate_parse: 4 callbacks suppressed [ 491.556013][T18808] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3495'. [ 491.971921][T18816] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3498'. [ 492.023029][T18816] tipc: Enabling of bearer rejected, failed to enable media [ 492.135456][T18821] tls_set_device_offload_rx: netdev not found [ 492.209115][T18773] lo speed is unknown, defaulting to 1000 [ 492.313522][T18829] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3501'. [ 492.518765][T18834] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3502'. [ 492.615810][T18834] netlink: 'syz.1.3502': attribute type 11 has an invalid length. [ 493.042765][T18773] lo speed is unknown, defaulting to 1000 [ 493.070828][T18844] gre1: entered allmulticast mode [ 493.611166][T18854] veth3: entered allmulticast mode [ 493.698996][T18864] netlink: 41 bytes leftover after parsing attributes in process `syz.4.3510'. [ 493.745150][T18864] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3510'. [ 493.786885][T18864] netlink: 41 bytes leftover after parsing attributes in process `syz.4.3510'. [ 493.872884][T18872] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3512'. [ 493.890902][T18871] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3511'. [ 494.238773][T18882] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3516'. [ 494.710397][T18898] erspan0: left promiscuous mode [ 494.747371][T18898] erspan0: left allmulticast mode [ 494.849011][T18898] gre1: left allmulticast mode [ 495.020343][T18913] netlink: 'syz.2.3523': attribute type 16 has an invalid length. [ 495.028772][T18913] netlink: 'syz.2.3523': attribute type 17 has an invalid length. [ 495.039438][ T50] IPVS: starting estimator thread 0... [ 495.040388][T18910] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 495.096347][T18913] 8021q: adding VLAN 0 to HW filter on device bond0 [ 495.104925][T18913] 8021q: adding VLAN 0 to HW filter on device team0 [ 495.126483][T18913] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.135369][T18915] IPVS: using max 31 ests per chain, 74400 per kthread [ 495.197700][T18913] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 495.207629][T18913] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 495.218927][T18913] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 495.230285][T18913] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 495.247048][T18913] veth1_vlan: left promiscuous mode [ 495.253505][T18913] veth0_vlan: left promiscuous mode [ 495.259806][T18913] veth0_vlan: entered promiscuous mode [ 495.268872][T18913] veth1_vlan: entered promiscuous mode [ 495.280408][T18913] veth1_macvtap: left promiscuous mode [ 495.287719][T18913] veth0_macvtap: left promiscuous mode [ 495.294427][T18913] veth0_macvtap: entered promiscuous mode [ 495.302095][T18913] veth1_macvtap: entered promiscuous mode [ 495.315838][T18913] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 495.324225][T18913] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 495.333023][T18913] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 495.341623][T18913] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 495.352893][T18913] 8021q: adding VLAN 0 to HW filter on device bond1 [ 495.361027][T18913] 8021q: adding VLAN 0 to HW filter on device bond2 [ 495.372438][T18913] 8021q: adding VLAN 0 to HW filter on device bond3 [ 495.381707][T18913] bond4: left promiscuous mode [ 495.386669][T18913] bond4: left allmulticast mode [ 495.398252][ T50] lo speed is unknown, defaulting to 1000 [ 495.398969][ T7659] bridge0: port 1(bridge_slave_0) entered blocking state [ 495.411159][ T7659] bridge0: port 1(bridge_slave_0) entered forwarding state [ 495.416788][ T50] syz2: Port: 1 Link ACTIVE [ 495.424309][ T7659] bridge0: port 2(bridge_slave_1) entered blocking state [ 495.431524][ T7659] bridge0: port 2(bridge_slave_1) entered forwarding state [ 495.479244][ T1170] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.489098][ T1170] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.528353][ T1170] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.539754][ T1170] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.780934][T18944] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 495.793305][T11078] IPVS: starting estimator thread 0... [ 495.896122][T18949] IPVS: using max 28 ests per chain, 67200 per kthread [ 498.185385][T18936] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 498.607741][T18983] bond4: entered promiscuous mode [ 498.613012][T18983] bond4: entered allmulticast mode [ 498.619918][T18983] 8021q: adding VLAN 0 to HW filter on device bond4 [ 498.720463][T19006] FAULT_INJECTION: forcing a failure. [ 498.720463][T19006] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.740595][T19006] CPU: 0 UID: 0 PID: 19006 Comm: syz.1.3543 Not tainted syzkaller #0 PREEMPT(full) [ 498.740623][T19006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 498.740635][T19006] Call Trace: [ 498.740643][T19006] [ 498.740651][T19006] dump_stack_lvl+0xe8/0x150 [ 498.740677][T19006] should_fail_ex+0x412/0x560 [ 498.740707][T19006] _copy_from_iter+0x1d3/0x1670 [ 498.740731][T19006] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 498.740762][T19006] ? __pfx_policy_nodemask+0x10/0x10 [ 498.740789][T19006] ? trace_kmalloc+0x2a/0xf0 [ 498.740812][T19006] ? __pfx__copy_from_iter+0x10/0x10 [ 498.740837][T19006] ? alloc_pages_mpol+0x3c0/0x490 [ 498.740870][T19006] af_alg_sendmsg+0x1552/0x2650 [ 498.740914][T19006] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 498.740936][T19006] ? __pfx_aa_sk_perm+0x10/0x10 [ 498.740957][T19006] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 498.740988][T19006] ? aa_sock_msg_perm+0xf1/0x1b0 [ 498.741012][T19006] ? skcipher_sendmsg+0x26/0xf0 [ 498.741038][T19006] ____sys_sendmsg+0x972/0x9f0 [ 498.741066][T19006] ? __might_fault+0xaf/0x130 [ 498.741094][T19006] ? __pfx_____sys_sendmsg+0x10/0x10 [ 498.741128][T19006] ? import_iovec+0x73/0xa0 [ 498.741156][T19006] ___sys_sendmsg+0x2a5/0x360 [ 498.741180][T19006] ? __lock_acquire+0x6b5/0x2cf0 [ 498.741205][T19006] ? __pfx____sys_sendmsg+0x10/0x10 [ 498.741236][T19006] ? kstrtouint+0x6e/0xe0 [ 498.741282][T19006] ? __fget_files+0x2a/0x420 [ 498.741303][T19006] ? __fget_files+0x3a0/0x420 [ 498.741335][T19006] __sys_sendmmsg+0x27c/0x4e0 [ 498.741369][T19006] ? __pfx___sys_sendmmsg+0x10/0x10 [ 498.741394][T19006] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 498.741444][T19006] ? ksys_write+0x242/0x270 [ 498.741473][T19006] ? __pfx_ksys_write+0x10/0x10 [ 498.741504][T19006] __x64_sys_sendmmsg+0xa0/0xc0 [ 498.741531][T19006] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.741550][T19006] do_syscall_64+0x15f/0xf80 [ 498.741567][T19006] ? trace_irq_disable+0x3b/0x140 [ 498.741591][T19006] ? clear_bhb_loop+0x40/0x90 [ 498.741613][T19006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.741631][T19006] RIP: 0033:0x7fb41539cdd9 [ 498.741648][T19006] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.741664][T19006] RSP: 002b:00007fb416286028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 498.741684][T19006] RAX: ffffffffffffffda RBX: 00007fb415615fa0 RCX: 00007fb41539cdd9 [ 498.741698][T19006] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 498.741710][T19006] RBP: 00007fb416286090 R08: 0000000000000000 R09: 0000000000000000 [ 498.741722][T19006] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 498.741734][T19006] R13: 00007fb415616038 R14: 00007fb415615fa0 R15: 00007ffe3a26cb18 [ 498.741765][T19006] [ 499.080569][T19007] tipc: Enabled bearer , priority 0 [ 499.092004][T19007] tipc: Resetting bearer [ 499.118620][T19005] tipc: Disabling bearer [ 499.162189][T19018] __nla_validate_parse: 1 callbacks suppressed [ 499.162205][T19018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3548'. [ 499.178444][T19018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3548'. [ 499.189393][T19019] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 499.194640][T19018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3548'. [ 499.197418][T19019] IPv6: NLM_F_CREATE should be set when creating new route [ 499.208050][T19018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3548'. [ 499.213609][T19019] IPv6: NLM_F_CREATE should be set when creating new route [ 499.298761][T19022] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 499.361233][T19025] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3549'. [ 499.391509][T19022] syzkaller1: entered promiscuous mode [ 499.411320][T19022] syzkaller1: entered allmulticast mode [ 499.599261][T19040] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3552'. [ 499.630735][T19039] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3552'. [ 500.603669][T19070] bond5 (unregistering): Released all slaves [ 500.673821][T19083] tipc: Enabled bearer , priority 0 [ 500.691381][T19083] tipc: Resetting bearer [ 500.719677][T19079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3557'. [ 500.757869][T19082] tipc: Disabling bearer [ 501.005634][T19093] netlink: 'syz.2.3563': attribute type 2 has an invalid length. [ 501.302026][T19118] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3569'. [ 501.358280][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.509501][T19126] netlink: 'syz.4.3572': attribute type 11 has an invalid length. [ 501.531575][T19128] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3573'. [ 501.769659][T19140] sctp: [Deprecated]: syz.4.3576 (pid 19140) Use of int in maxseg socket option. [ 501.769659][T19140] Use struct sctp_assoc_value instead [ 501.869491][T19149] netlink: 'syz.1.3578': attribute type 11 has an invalid length. [ 502.028622][T19160] netlink: 'syz.1.3580': attribute type 1 has an invalid length. [ 502.091821][T19122] lo speed is unknown, defaulting to 1000 [ 502.159801][T19166] netlink: 'syz.2.3583': attribute type 29 has an invalid length. [ 502.379528][T19177] 8021q: adding VLAN 0 to HW filter on device bond0 [ 502.403681][T19177] 8021q: adding VLAN 0 to HW filter on device team0 [ 502.427721][T19177] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 502.498230][T19177] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 502.520093][T19177] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 502.548910][T19177] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 502.574677][T19177] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 502.616483][T19177] veth1_vlan: left promiscuous mode [ 502.626678][T19177] veth0_vlan: left promiscuous mode [ 502.641748][T19177] veth0_vlan: entered promiscuous mode [ 502.659855][T19177] veth1_vlan: entered promiscuous mode [ 502.668216][T19191] IPVS: set_ctl: invalid protocol: 2 172.20.20.187:0 [ 502.679481][T19177] veth1_macvtap: left promiscuous mode [ 502.696610][T19177] veth0_macvtap: left promiscuous mode [ 502.704257][T19177] veth0_macvtap: entered promiscuous mode [ 502.716381][T19177] veth1_macvtap: entered promiscuous mode [ 502.738726][T19177] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 502.747037][T19177] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 502.767650][T19177] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 502.777019][T19177] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 502.794427][T19177] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 502.804117][T19177] ip6gretap1: left allmulticast mode [ 502.812684][T19177] ip6tnl2: left allmulticast mode [ 502.822683][ T5738] team_slave_0: entered promiscuous mode [ 502.830062][ T5738] team_slave_1: entered promiscuous mode [ 502.854846][ T5738] dummy0: entered promiscuous mode [ 502.878586][ T7650] bridge0: port 2(bridge_slave_1) entered blocking state [ 502.885790][ T7650] bridge0: port 2(bridge_slave_1) entered forwarding state [ 502.953305][T19122] lo speed is unknown, defaulting to 1000 [ 502.963803][ T7659] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 502.973783][ T7659] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.060430][ T7659] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.074551][ T7659] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.223928][T19212] netlink: 'syz.4.3596': attribute type 10 has an invalid length. [ 503.310948][T19212] team0: left allmulticast mode [ 503.320113][T19212] team_slave_0: left allmulticast mode [ 503.344573][T19212] team_slave_1: left allmulticast mode [ 503.366675][T19212] team0: left promiscuous mode [ 503.377000][T19212] team_slave_0: left promiscuous mode [ 503.383086][T19212] team_slave_1: left promiscuous mode [ 503.389202][T19212] bridge0: port 3(team0) entered disabled state [ 503.400096][T19221] IPVS: set_ctl: invalid protocol: 108 0.0.0.0:20002 [ 503.406562][T19226] netlink: 'syz.2.3599': attribute type 1 has an invalid length. [ 503.426500][T19212] 8021q: adding VLAN 0 to HW filter on device team0 [ 503.439443][T19212] bond0: (slave team0): Enslaving as an active interface with an up link [ 503.450647][T19217] netlink: 'syz.4.3596': attribute type 4 has an invalid length. [ 503.533631][T19230] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 503.746788][T11078] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 504.004286][ T5635] block nbd0: Receive control failed (result -32) [ 504.213679][T19256] __nla_validate_parse: 19 callbacks suppressed [ 504.213698][T19256] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3605'. [ 504.288883][T19257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3605'. [ 504.338126][T11078] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 504.424508][ T7659] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 504.786900][T19297] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3612'. [ 504.921313][T19305] IPVS: set_ctl: invalid protocol: 9 127.0.0.1:20000 [ 505.267709][T19319] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.275371][T19319] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.367948][T19345] netlink: 'syz.3.3618': attribute type 1 has an invalid length. [ 505.388982][T19319] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.404773][T19319] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.628152][ T5738] lo speed is unknown, defaulting to 1000 [ 505.638052][ T5738] syz2: Port: 1 Link DOWN [ 505.654482][T19337] tap0: tun_chr_ioctl cmd 1074025680 [ 505.742710][ T7659] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.760724][ T7659] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.806909][ T7659] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.817445][ T7659] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 505.844690][ T7659] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 505.859290][ T7659] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 506.022573][T19376] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3628'. [ 506.043794][T19376] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3628'. [ 506.094008][T19380] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3630'. [ 506.256182][T19390] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3633'. [ 506.337656][T19390] netlink: 'syz.2.3633': attribute type 12 has an invalid length. [ 506.361173][T19401] netlink: 'syz.0.3634': attribute type 1 has an invalid length. [ 506.395388][ T5738] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 506.474513][T19401] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3634'. [ 506.534803][T19396] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3634'. [ 506.768759][T19421] netlink: 'syz.4.3643': attribute type 5 has an invalid length. [ 506.863094][T19426] netlink: 'syz.1.3644': attribute type 1 has an invalid length. [ 507.094913][T19441] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3647'. [ 507.112161][T19442] syz.2.3648: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 507.147781][T19442] CPU: 1 UID: 0 PID: 19442 Comm: syz.2.3648 Not tainted syzkaller #0 PREEMPT(full) [ 507.147807][T19442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 507.147819][T19442] Call Trace: [ 507.147827][T19442] [ 507.147835][T19442] dump_stack_lvl+0xe8/0x150 [ 507.147862][T19442] warn_alloc+0x249/0x340 [ 507.147889][T19442] ? stack_trace_save+0xa9/0x100 [ 507.147919][T19442] ? __pfx_warn_alloc+0x10/0x10 [ 507.147948][T19442] ? kasan_save_track+0x4f/0x80 [ 507.147970][T19442] ? kasan_save_track+0x3e/0x80 [ 507.147991][T19442] ? __kasan_kmalloc+0x93/0xb0 [ 507.148013][T19442] ? __kmalloc_cache_noprof+0x31c/0x660 [ 507.148036][T19442] ? xskq_create+0x56/0x170 [ 507.148059][T19442] ? xsk_setsockopt+0x54c/0x990 [ 507.148078][T19442] ? do_sock_setsockopt+0x17c/0x1b0 [ 507.148102][T19442] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 507.148125][T19442] ? do_syscall_64+0x15f/0xf80 [ 507.148146][T19442] __vmalloc_node_range_noprof+0x132/0x1750 [ 507.148201][T19442] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 507.148231][T19442] ? __kasan_kmalloc+0x93/0xb0 [ 507.148262][T19442] vmalloc_user_noprof+0xad/0xe0 [ 507.148285][T19442] ? xskq_create+0xbf/0x170 [ 507.148309][T19442] xskq_create+0xbf/0x170 [ 507.148336][T19442] xsk_init_queue+0x8a/0xe0 [ 507.148362][T19442] xsk_setsockopt+0x54c/0x990 [ 507.148387][T19442] ? __pfx_xsk_setsockopt+0x10/0x10 [ 507.148410][T19442] ? __pfx_aa_sk_perm+0x10/0x10 [ 507.148436][T19442] ? aa_sock_opt_perm+0xff/0x1a0 [ 507.148463][T19442] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 507.148487][T19442] ? __pfx_xsk_setsockopt+0x10/0x10 [ 507.148510][T19442] do_sock_setsockopt+0x17c/0x1b0 [ 507.148540][T19442] __x64_sys_setsockopt+0x13d/0x1b0 [ 507.148571][T19442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.148592][T19442] do_syscall_64+0x15f/0xf80 [ 507.148608][T19442] ? trace_irq_disable+0x3b/0x140 [ 507.148633][T19442] ? clear_bhb_loop+0x40/0x90 [ 507.148656][T19442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.148674][T19442] RIP: 0033:0x7fa2edf9cdd9 [ 507.148696][T19442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.148712][T19442] RSP: 002b:00007fa2eee00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 507.148731][T19442] RAX: ffffffffffffffda RBX: 00007fa2ee215fa0 RCX: 00007fa2edf9cdd9 [ 507.148745][T19442] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 507.148756][T19442] RBP: 00007fa2ee032d69 R08: 0000000000000004 R09: 0000000000000000 [ 507.148767][T19442] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 507.148779][T19442] R13: 00007fa2ee216038 R14: 00007fa2ee215fa0 R15: 00007fff1d102058 [ 507.148808][T19442] [ 507.148901][T19442] Mem-Info: [ 507.257224][T19448] dvmrp6: entered allmulticast mode [ 507.271531][T19442] active_anon:5870 inactive_anon:6 isolated_anon:0 [ 507.271531][T19442] active_file:2826 inactive_file:40985 isolated_file:0 [ 507.271531][T19442] unevictable:768 dirty:120 writeback:0 [ 507.271531][T19442] slab_reclaimable:12529 slab_unreclaimable:205905 [ 507.271531][T19442] mapped:29901 shmem:1296 pagetables:1324 [ 507.271531][T19442] sec_pagetables:0 bounce:0 [ 507.271531][T19442] kernel_misc_reclaimable:0 [ 507.271531][T19442] free:1203933 free_pcp:18897 free_cma:0 [ 507.323998][T19448] xt_connbytes: Forcing CT accounting to be enabled [ 507.406688][T19442] Node 0 active_anon:23480kB inactive_anon:24kB active_file:11304kB inactive_file:163736kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:99124kB dirty:476kB writeback:0kB shmem:3648kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16440kB pagetables:5136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 507.526612][T19442] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:20480kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 507.530276][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.560805][T19442] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:16kB free_cma:0kB [ 507.560867][T19442] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 507.560900][T19442] Node 0 DMA32 free:933484kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23480kB inactive_anon:24kB active_file:11304kB inactive_file:163736kB unevictable:1536kB writepending:476kB zspages:0kB present:3129332kB managed:2552540kB mlocked:0kB bounce:0kB free_pcp:37504kB local_pcp:22188kB free_cma:0kB [ 507.560951][T19442] lowmem_reserve[]: 0 0 0 0 0 [ 507.645192][T19442] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:668kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 507.685803][T19442] lowmem_reserve[]: 0 0 0 0 0 [ 507.690656][T19442] Node 1 Normal free:3866024kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:33200kB local_pcp:33200kB free_cma:0kB [ 507.749517][T19442] lowmem_reserve[]: 0 0 0 0 0 [ 507.759011][T19442] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 2*4096kB (UM) = 15344kB [ 507.774354][T19442] Node 0 DMA32: 7992*4kB (UM) 4218*8kB (UME) 1855*16kB (UME) 145*32kB (UME) 70*64kB (UM) 449*128kB (UME) 571*256kB (UME) 335*512kB (UME) 188*1024kB (UM) 83*2048kB (UM) 1*4096kB (U) = 846272kB [ 507.802186][T19442] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 507.814160][T19442] Node 1 Normal: 1*4kB (U) 5*8kB (UM) 7*16kB (UM) 6*32kB (UM) 10*64kB (UM) 4*128kB (UM) 4*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (U) 941*4096kB (UM) = 3866076kB [ 507.831491][T19442] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 507.845578][T19442] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 507.856121][T19442] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 507.885720][T19442] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 507.905245][T19442] 45103 total pagecache pages [ 507.915292][T19442] 0 pages in swap cache [ 507.938923][T19442] Free swap = 124996kB [ 507.944400][T19442] Total swap = 124996kB [ 507.954509][T19442] 2097051 pages RAM [ 507.966945][T19442] 0 pages HighMem/MovableOnly [ 507.982477][T19442] 427134 pages reserved [ 507.997720][T19442] 0 pages cma reserved [ 507.999725][T19477] netlink: 'syz.0.3657': attribute type 3 has an invalid length. [ 508.109826][T19488] tipc: Started in network mode [ 508.116271][T19488] tipc: Node identity 2e23a150b142, cluster identity 4711 [ 508.123643][T19488] tipc: Enabled bearer , priority 0 [ 508.131503][T19489] syzkaller0: entered promiscuous mode [ 508.147463][T19489] syzkaller0: entered allmulticast mode [ 508.212123][T19489] tipc: Resetting bearer [ 508.245331][T19489] tipc: Disabling bearer [ 508.458055][T19509] tipc: Started in network mode [ 508.464479][T19509] tipc: Node identity e206f64ec00a, cluster identity 4711 [ 508.472119][T19509] tipc: Enabled bearer , priority 0 [ 508.516519][T19509] syzkaller0: entered promiscuous mode [ 508.523785][T19509] syzkaller0: entered allmulticast mode [ 508.567168][T11077] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.577743][T19512] tipc: Resetting bearer [ 508.616064][T19512] tipc: Disabling bearer [ 508.767682][T19532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 508.850266][T19537] x_tables: duplicate underflow at hook 3 [ 509.223953][T19567] netlink: 'syz.0.3682': attribute type 39 has an invalid length. [ 509.241356][T19568] netlink: 'syz.0.3682': attribute type 39 has an invalid length. [ 509.257522][T19571] syzkaller0: entered promiscuous mode [ 509.263113][T19571] syzkaller0: entered allmulticast mode [ 509.608424][ T5832] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 509.616612][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 509.675634][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 509.763687][T19597] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 509.920290][T19572] __nla_validate_parse: 9 callbacks suppressed [ 509.920309][T19572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3681'. [ 510.118942][T19609] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3691'. [ 510.234516][T19560] lo speed is unknown, defaulting to 1000 [ 510.351182][T19627] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3697'. [ 510.371657][T19626] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3696'. [ 510.418413][T19626] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3696'. [ 510.432948][T19626] nbd: socks must be embedded in a SOCK_ITEM attr [ 510.625993][T19637] xt_hashlimit: size too large, truncated to 1048576 [ 510.639100][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.647267][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.656366][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.798047][T19560] lo speed is unknown, defaulting to 1000 [ 510.926214][T19649] netlink: 'syz.4.3705': attribute type 2 has an invalid length. [ 511.037049][T19650] syzkaller0: entered promiscuous mode [ 511.054464][T19650] 0: reclassify loop, rule prio 0, protocol 700 [ 511.060868][T19663] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3708'. [ 511.115597][T19661] 8021q: adding VLAN 0 to HW filter on device bond0 [ 511.130436][T19661] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 511.208528][T19661] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 511.242537][T19661] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 511.293752][T19661] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 511.320581][T19661] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 511.340350][T19661] veth1_vlan: left promiscuous mode [ 511.348287][T19661] veth0_vlan: left promiscuous mode [ 511.354160][T19661] veth0_vlan: entered promiscuous mode [ 511.365622][T19661] veth1_vlan: entered promiscuous mode [ 511.382921][T19661] veth1_macvtap: left promiscuous mode [ 511.675595][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.286027][T19661] veth0_macvtap: left promiscuous mode [ 513.655788][T19661] veth0_macvtap: entered promiscuous mode [ 513.755948][ T5723] net_ratelimit: 4 callbacks suppressed [ 513.755965][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.236384][T19661] veth1_macvtap: entered promiscuous mode [ 514.252220][T19661] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 514.317152][T19661] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 514.335095][T19675] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 514.344642][T19661] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 514.363789][T19661] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 514.397317][T19661] 8021q: adding VLAN 0 to HW filter on device bond1 [ 514.409148][T19661] 8021q: adding VLAN 0 to HW filter on device bond2 [ 514.421918][T19661] 8021q: adding VLAN 0 to HW filter on device bond3 [ 514.435800][ T7650] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.437977][T19661] bond4: left promiscuous mode [ 514.449213][T19661] bond4: left allmulticast mode [ 514.455224][ T7652] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.475347][ T7652] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.527937][ T7650] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.575809][ T58] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.597581][T19684] netlink: 'syz.4.3713': attribute type 62 has an invalid length. [ 514.606114][ T58] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.617872][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.625080][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 514.633093][T19685] openvswitch: netlink: nsh attr 1647 is out of range max 3 [ 514.643403][ T58] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.652778][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.659967][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 514.685124][ T1040] bond3: (slave ip6gretap1): link status up again after 0 ms [ 514.793918][ T1170] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.826310][ T1170] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.854175][ T1170] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.878289][ T1170] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.003311][T19705] netlink: 'syz.3.3716': attribute type 32 has an invalid length. [ 515.042723][T19697] 8021q: adding VLAN 0 to HW filter on device eth0 [ 515.110205][T19697] 8021q: adding VLAN 0 to HW filter on device eth1 [ 515.128932][T19697] 8021q: adding VLAN 0 to HW filter on device eth2 [ 515.141984][T19697] 8021q: adding VLAN 0 to HW filter on device eth3 [ 515.152809][T19697] 8021q: adding VLAN 0 to HW filter on device bond1 [ 515.165280][T19697] mac80211_hwsim hwsim33 wlan0: entered promiscuous mode [ 515.186943][T19697] 8021q: adding VLAN 0 to HW filter on device bond2 [ 515.194695][ T1170] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.204210][ T1170] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.292103][ T7652] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.312300][ T7652] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.384139][T19711] netlink: 'syz.1.3721': attribute type 28 has an invalid length. [ 515.428680][ T7652] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 515.460597][T19712] block nbd0: NBD_DISCONNECT [ 515.471549][T19712] block nbd0: Send disconnect failed -32 [ 515.532612][T19712] block nbd0: shutting down sockets [ 515.562006][T19717] pimreg: left allmulticast mode [ 515.672403][T19729] netlink: 'syz.1.3725': attribute type 1 has an invalid length. [ 515.720774][T19729] bond5: entered promiscuous mode [ 515.728579][T19729] 8021q: adding VLAN 0 to HW filter on device bond5 [ 515.771321][T19731] 8021q: adding VLAN 0 to HW filter on device bond5 [ 515.784668][T19731] bond5: (slave wireguard0): The slave device specified does not support setting the MAC address [ 515.806244][T19731] bond5: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 515.841821][T19731] bond5: (slave wireguard0): making interface the new active one [ 515.851337][T19731] wireguard0: entered promiscuous mode [ 515.862709][T19731] bond5: (slave wireguard0): Enslaving as an active interface with an up link [ 516.092044][T19741] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3726'. [ 516.130475][T19755] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3730'. [ 516.401096][T19762] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 516.415888][T19762] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 516.427282][T19762] hsr0: entered promiscuous mode [ 516.457697][T19765] netlink: 'syz.4.3733': attribute type 4 has an invalid length. [ 516.463231][T19726] lo speed is unknown, defaulting to 1000 [ 516.505256][T19766] netlink: 'syz.4.3733': attribute type 4 has an invalid length. [ 516.518533][ T50] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 516.554262][T19765] netlink: 'syz.4.3733': attribute type 4 has an invalid length. [ 516.829067][T19776] netlink: 'syz.0.3736': attribute type 21 has an invalid length. [ 516.830607][T19726] lo speed is unknown, defaulting to 1000 [ 516.838546][T19776] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3736'. [ 516.858826][T19777] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3737'. [ 516.905343][ T5832] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 516.952427][T19779] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 516.967215][T19779] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 517.144573][T19777] macvlan2: entered promiscuous mode [ 517.150393][T19777] macvlan2: entered allmulticast mode [ 517.157006][T19777] bond5: (slave macvlan2): Error -98 calling set_mac_address [ 517.174001][T19791] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3739'. [ 517.355398][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 517.696435][T19808] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3745'. [ 518.141568][T19840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3757'. [ 518.531057][T19852] syzkaller0: entered promiscuous mode [ 518.537733][T19852] syzkaller0: entered allmulticast mode [ 518.673598][T19845] lo speed is unknown, defaulting to 1000 [ 518.751551][T19868] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3765'. [ 518.795349][ T1170] net_ratelimit: 70 callbacks suppressed [ 518.795366][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 518.925750][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 518.961829][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.035751][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 519.130505][T19845] lo speed is unknown, defaulting to 1000 [ 519.141456][T19857] lo speed is unknown, defaulting to 1000 [ 519.146887][T19876] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.159608][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.270782][T19878] netlink: 'syz.3.3769': attribute type 10 has an invalid length. [ 519.311948][T19878] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3769'. [ 520.007266][ T5751] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 520.566181][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.040110][ T5751] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.304929][T19857] lo speed is unknown, defaulting to 1000 [ 521.313583][T19863] lo speed is unknown, defaulting to 1000 [ 521.319541][ T13] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 521.428609][T19897] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3776'. [ 521.570409][T19897] bond3: entered promiscuous mode [ 521.576759][T19897] 8021q: adding VLAN 0 to HW filter on device bond3 [ 521.627272][T19900] 8021q: adding VLAN 0 to HW filter on device bond3 [ 521.634838][T19900] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 521.648134][T19900] bond3: (slave ip6gre1): Error -95 calling set_mac_address [ 521.684821][T19863] lo speed is unknown, defaulting to 1000 [ 522.159133][T19927] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3784'. [ 522.607586][T19951] netlink: 'syz.3.3791': attribute type 4 has an invalid length. [ 522.652818][T19951] netlink: 'syz.3.3791': attribute type 4 has an invalid length. [ 522.850721][T19961] syzkaller1: entered promiscuous mode [ 522.856402][T19961] syzkaller1: entered allmulticast mode [ 522.928920][T19966] tipc: Started in network mode [ 522.933955][T19966] tipc: Node identity 7a2517dc51f3, cluster identity 4711 [ 522.942474][T19966] tipc: Enabled bearer , priority 0 [ 522.952491][T19966] syzkaller0: entered promiscuous mode [ 522.958680][T19966] syzkaller0: entered allmulticast mode [ 523.316965][T19982] batadv_slave_0: entered promiscuous mode [ 523.362762][T19981] batadv_slave_0: left promiscuous mode [ 523.536529][T19990] bridge1: entered allmulticast mode [ 523.543153][T19992] sctp: [Deprecated]: syz.0.3804 (pid 19992) Use of struct sctp_assoc_value in delayed_ack socket option. [ 523.543153][T19992] Use struct sctp_sack_info instead [ 523.578384][T19993] tipc: Enabled bearer , priority 0 [ 523.710254][T19993] syzkaller0: entered promiscuous mode [ 523.723218][T19993] syzkaller0: entered allmulticast mode [ 523.741093][T19993] tipc: Resetting bearer [ 523.766744][T19960] tipc: Resetting bearer [ 523.828921][T19960] tipc: Disabling bearer [ 523.885255][ T7652] net_ratelimit: 19 callbacks suppressed [ 523.885273][ T7652] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 523.910125][T20008] Bluetooth: MGMT ver 1.23 [ 523.961309][T20008] netlink: 'syz.3.3810': attribute type 4 has an invalid length. [ 523.973039][T20011] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3809'. [ 524.086889][ T13] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 524.101735][T20015] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3811'. [ 524.120028][T20018] FAULT_INJECTION: forcing a failure. [ 524.120028][T20018] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 524.154272][T20018] CPU: 0 UID: 0 PID: 20018 Comm: syz.3.3812 Not tainted syzkaller #0 PREEMPT(full) [ 524.154297][T20018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 524.154308][T20018] Call Trace: [ 524.154316][T20018] [ 524.154324][T20018] dump_stack_lvl+0xe8/0x150 [ 524.154351][T20018] should_fail_ex+0x412/0x560 [ 524.154379][T20018] prepare_alloc_pages+0x22a/0x650 [ 524.154413][T20018] __alloc_frozen_pages_noprof+0x12f/0x380 [ 524.154444][T20018] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 524.154474][T20018] ? __pfx_policy_nodemask+0x10/0x10 [ 524.154496][T20018] ? trace_kmalloc+0x2a/0xf0 [ 524.154516][T20018] ? __pfx__copy_from_iter+0x10/0x10 [ 524.154538][T20018] alloc_pages_mpol+0x235/0x490 [ 524.154563][T20018] alloc_pages_noprof+0xac/0x2a0 [ 524.154579][T20018] af_alg_sendmsg+0x1446/0x2650 [ 524.154621][T20018] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 524.154639][T20018] ? __pfx_aa_sk_perm+0x10/0x10 [ 524.154655][T20018] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 524.154681][T20018] ? aa_sock_msg_perm+0xf1/0x1b0 [ 524.154704][T20018] ? skcipher_sendmsg+0x26/0xf0 [ 524.154726][T20018] ____sys_sendmsg+0x972/0x9f0 [ 524.154748][T20018] ? __might_fault+0xaf/0x130 [ 524.154771][T20018] ? __pfx_____sys_sendmsg+0x10/0x10 [ 524.154799][T20018] ? import_iovec+0x73/0xa0 [ 524.154821][T20018] ___sys_sendmsg+0x2a5/0x360 [ 524.154841][T20018] ? __lock_acquire+0x6b5/0x2cf0 [ 524.154861][T20018] ? __pfx____sys_sendmsg+0x10/0x10 [ 524.154888][T20018] ? kstrtouint+0x6e/0xe0 [ 524.154925][T20018] ? __fget_files+0x2a/0x420 [ 524.154942][T20018] ? __fget_files+0x3a0/0x420 [ 524.154971][T20018] __sys_sendmmsg+0x27c/0x4e0 [ 524.155000][T20018] ? __pfx___sys_sendmmsg+0x10/0x10 [ 524.155023][T20018] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 524.155069][T20018] ? ksys_write+0x242/0x270 [ 524.155096][T20018] ? __pfx_ksys_write+0x10/0x10 [ 524.155128][T20018] __x64_sys_sendmmsg+0xa0/0xc0 [ 524.155152][T20018] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.155170][T20018] do_syscall_64+0x15f/0xf80 [ 524.155186][T20018] ? trace_irq_disable+0x3b/0x140 [ 524.155209][T20018] ? clear_bhb_loop+0x40/0x90 [ 524.155232][T20018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.155248][T20018] RIP: 0033:0x7f9c8899cdd9 [ 524.155266][T20018] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.155281][T20018] RSP: 002b:00007f9c8986a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 524.155299][T20018] RAX: ffffffffffffffda RBX: 00007f9c88c15fa0 RCX: 00007f9c8899cdd9 [ 524.155313][T20018] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 524.155324][T20018] RBP: 00007f9c8986a090 R08: 0000000000000000 R09: 0000000000000000 [ 524.155336][T20018] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 524.155347][T20018] R13: 00007f9c88c16038 R14: 00007f9c88c15fa0 R15: 00007ffe5d032fb8 [ 524.155376][T20018] [ 524.443769][ T7652] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 524.451648][ T5832] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.765251][T11076] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.894035][ T7652] tipc: Resetting bearer [ 524.943173][T19987] tipc: Resetting bearer [ 525.113811][T20038] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3818'. [ 525.838278][T11076] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.887889][T11076] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.958644][ T5832] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.425524][T19987] tipc: Disabling bearer [ 527.434122][ T50] tipc: Node number set to 4227989504 [ 527.455430][ T13] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 527.515366][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.698728][T20078] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3827'. [ 527.714481][T20077] xfrm0: entered allmulticast mode [ 527.741151][T20078] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3827'. [ 527.816321][T20087] netlink: 'syz.4.3829': attribute type 1 has an invalid length. [ 528.020797][T20087] 8021q: adding VLAN 0 to HW filter on device bond5 [ 528.111183][T20099] netlink: 'syz.0.3831': attribute type 1 has an invalid length. [ 528.196676][T20099] bond1: (slave bridge3): making interface the new active one [ 528.218414][T20099] bond1: (slave bridge3): Enslaving as an active interface with an up link [ 528.250079][T20104] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 528.386226][ T29] audit: type=1804 audit(1778424090.410:6): pid=20108 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3832" name="/newroot/214/memory.events" dev="tmpfs" ino=1109 res=1 errno=0 [ 528.439666][T20112] netlink: 212360 bytes leftover after parsing attributes in process `syz.0.3833'. [ 528.478512][ T29] audit: type=1800 audit(1778424090.440:7): pid=20108 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3832" name="memory.events" dev="tmpfs" ino=1109 res=0 errno=0 [ 528.650706][T20108] bond6: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 528.956951][ T5751] net_ratelimit: 9 callbacks suppressed [ 528.956969][ T5751] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.962041][T20135] smc: ib device syz0 ibport 2 erased user defined pnetid SYZ2 [ 529.411493][T20108] bond6 (unregistering): Released all slaves [ 529.450782][T20137] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3834'. [ 529.465103][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 529.597679][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 529.657931][T20155] netlink: 'syz.3.3840': attribute type 1 has an invalid length. [ 529.745148][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 529.781661][T20159] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 529.792923][T20159] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 529.809774][T20155] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3840'. [ 529.832789][T20163] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3844'. [ 529.855564][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 529.909754][T20159] ip6gretap2: entered promiscuous mode [ 529.920301][T20171] netlink: 364 bytes leftover after parsing attributes in process `syz.0.3847'. [ 529.929746][T20159] ip6gretap2: entered allmulticast mode [ 529.956494][T20159] bond4: (slave ip6gretap2): making interface the new active one [ 529.979331][T20159] bond4: (slave ip6gretap2): Enslaving as an active interface with an up link [ 529.997954][T11078] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.038174][T20176] bridge0: entered allmulticast mode [ 530.064588][T20176] pim6reg: entered allmulticast mode [ 530.082779][T20176] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.3848'. [ 530.096875][ T7659] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 530.118517][T20185] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3850'. [ 530.218930][T20188] syzkaller0: entered promiscuous mode [ 530.247769][T20188] syzkaller0: entered allmulticast mode [ 530.274137][T20192] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 530.279168][T20197] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3856'. [ 530.311365][T20188] tipc: Enabled bearer , priority 0 [ 530.352755][T20187] tipc: Resetting bearer [ 530.414703][T20187] tipc: Disabling bearer [ 530.445233][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 530.552606][T20195] bond2: option xmit_hash_policy: invalid value (10) [ 530.565157][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.583997][ T5635] block nbd0: Receive control failed (result -107) [ 530.602609][T20195] bond2 (unregistering): Released all slaves [ 530.952899][T20240] netlink: 'syz.1.3865': attribute type 1 has an invalid length. [ 531.020522][T20246] xt_NFQUEUE: number of total queues is 0 [ 531.131023][T20240] bond6: entered promiscuous mode [ 531.153490][T20240] 8021q: adding VLAN 0 to HW filter on device bond6 [ 531.224356][T20244] bond6: (slave veth3): making interface the new active one [ 531.247155][T20244] veth3: entered promiscuous mode [ 531.264234][T20244] bond6: (slave veth3): Enslaving as an active interface with an up link [ 531.407585][T20258] nbd: socks must be embedded in a SOCK_ITEM attr [ 531.420061][T20229] lo speed is unknown, defaulting to 1000 [ 531.905971][T20229] lo speed is unknown, defaulting to 1000 [ 531.921559][T20280] Bluetooth: MGMT ver 1.23 [ 532.715187][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 533.718945][T20359] __nla_validate_parse: 7 callbacks suppressed [ 533.718963][T20359] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3898'. [ 533.959836][T20374] xt_hashlimit: size too large, truncated to 1048576 [ 533.967662][ T1166] net_ratelimit: 2076 callbacks suppressed [ 533.967680][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 534.155225][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 534.165899][ T5635] Bluetooth: hci5: command 0x0406 tx timeout [ 534.172467][T11078] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.285162][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 534.428017][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 534.462693][T20390] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3910'. [ 534.569143][ T58] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 534.699140][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 534.835168][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 535.036001][ T58] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 535.165474][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 535.267639][T20445] netlink: 'syz.3.3925': attribute type 1 has an invalid length. [ 535.283609][T20443] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3924'. [ 535.336758][T20445] 8021q: adding VLAN 0 to HW filter on device bond5 [ 535.404068][T20447] bond5: (slave geneve3): making interface the new active one [ 535.444872][T20447] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 536.222035][T20485] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3930'. [ 536.278413][T20461] bridge0: port 2(bridge_slave_1) entered disabled state [ 536.286170][T20461] bridge0: port 1(bridge_slave_0) entered disabled state [ 536.380855][T20461] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 536.394736][T20461] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 536.680089][ T47] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.702817][ T47] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.861130][ T47] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.891404][ T47] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.092472][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.111166][T20511] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3940'. [ 537.115218][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.146002][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.204594][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.247691][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.273364][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.334733][T20520] bond2: option packets_per_slave: invalid value (1048582) [ 537.347674][T20520] bond2: option packets_per_slave: allowed values 0 - 65535 [ 537.360071][T20520] bond2 (unregistering): Released all slaves [ 537.388144][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.433813][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.445577][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.476087][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.484262][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.493266][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.504392][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.515220][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.529283][T20526] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.3943'. [ 537.531664][T20524] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.3943'. [ 537.552187][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.560780][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.569167][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.577630][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.585914][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.594126][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.612359][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.620657][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.628964][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.637409][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.645782][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.660311][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.671536][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.680110][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.688605][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.696966][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.705468][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.714215][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.722443][T20509] tipc: Enabling of bearer rejected, media not registered [ 537.983087][T20542] bridge4: entered promiscuous mode [ 538.005226][T20542] bridge4: entered allmulticast mode [ 538.153981][T20549] netlink: 'syz.0.3950': attribute type 29 has an invalid length. [ 538.508760][T20561] syzkaller1: tun_chr_ioctl cmd 2147767520 [ 538.559754][T20551] lo speed is unknown, defaulting to 1000 [ 538.709918][T20571] netlink: 'syz.0.3957': attribute type 1 has an invalid length. [ 538.829701][T20572] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 538.841042][T20572] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 538.882579][T20579] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3959'. [ 538.917463][T20551] lo speed is unknown, defaulting to 1000 [ 539.010487][T20588] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3962'. [ 539.125763][T20590] netlink: 'syz.2.3961': attribute type 1 has an invalid length. [ 539.345771][T20604] tipc: Enabling of bearer rejected, failed to enable media [ 539.416270][ T7650] net_ratelimit: 20 callbacks suppressed [ 539.416287][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 539.535392][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 539.638276][T20586] lo speed is unknown, defaulting to 1000 [ 539.665799][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 539.754346][T20622] x_tables: duplicate underflow at hook 2 [ 539.775260][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 539.895174][ T58] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 540.015366][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 540.050232][T20588] lo speed is unknown, defaulting to 1000 [ 540.051628][T20586] lo speed is unknown, defaulting to 1000 [ 540.235313][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 540.329530][T20588] lo speed is unknown, defaulting to 1000 [ 540.876961][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 540.995120][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 541.118088][ T7642] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 541.181893][T20627] netlink: 'syz.2.3969': attribute type 1 has an invalid length. [ 541.190395][T20625] veth0_virt_wifi: entered allmulticast mode [ 541.203798][T20627] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 541.302843][T20635] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3968'. [ 542.325624][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 542.344401][T20608] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 542.423880][T20651] ipvlan2: entered promiscuous mode [ 542.433605][T20651] bridge0: port 3(ipvlan2) entered blocking state [ 542.452987][T20651] bridge0: port 3(ipvlan2) entered disabled state [ 542.461966][T20651] ipvlan2: entered allmulticast mode [ 542.471215][T20651] bridge0: entered allmulticast mode [ 542.495555][T20651] ipvlan2: left allmulticast mode [ 542.509573][T20651] bridge0: left allmulticast mode [ 542.514318][T20656] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3977'. [ 542.825428][T20679] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3982'. [ 543.107567][T20699] netlink: 'syz.0.3989': attribute type 1 has an invalid length. [ 543.124271][T20701] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3990'. [ 543.139383][T20699] 8021q: adding VLAN 0 to HW filter on device bond3 [ 543.164028][T20699] bond3: (slave geneve2): making interface the new active one [ 543.174821][T20699] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 543.375645][T20715] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3993'. [ 543.421590][T20719] syzkaller0: entered promiscuous mode [ 543.432403][T20719] syzkaller0: entered allmulticast mode [ 543.538856][T20724] sctp: [Deprecated]: syz.1.3995 (pid 20724) Use of struct sctp_assoc_value in delayed_ack socket option. [ 543.538856][T20724] Use struct sctp_sack_info instead [ 544.092834][T20758] netlink: 72 bytes leftover after parsing attributes in process `syz.4.4005'. [ 544.108677][T20758] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4005'. [ 544.118553][T20758] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4005'. [ 544.213898][T20770] netlink: 156 bytes leftover after parsing attributes in process `syz.0.4008'. [ 544.427599][T20781] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4010'. [ 544.466129][ T1170] net_ratelimit: 24 callbacks suppressed [ 544.466148][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 544.543679][T20785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4013'. [ 544.559781][T20785] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4013'. [ 544.605566][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 544.696600][T20794] xt_TPROXY: Can be used only with -p tcp or -p udp [ 544.746790][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 544.849586][T20800] netlink: 'syz.1.4017': attribute type 10 has an invalid length. [ 544.890214][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 544.894801][T20800] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4017'. [ 544.946767][T20778] lo speed is unknown, defaulting to 1000 [ 545.025952][ T58] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 545.041547][T20809] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4020'. [ 545.247352][ T47] bond3: (slave ip6gretap1): link status up again after 0 ms [ 545.275532][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 545.415536][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 545.461426][ T47] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 545.555273][ T47] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 545.634221][T20778] lo speed is unknown, defaulting to 1000 [ 545.825120][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 545.923533][T20851] netlink: 260 bytes leftover after parsing attributes in process `syz.1.4028'. [ 546.278736][T20839] lo speed is unknown, defaulting to 1000 [ 546.618624][T20839] lo speed is unknown, defaulting to 1000 [ 546.618655][T20838] lo speed is unknown, defaulting to 1000 [ 546.829735][T20838] lo speed is unknown, defaulting to 1000 [ 547.520773][ T58] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.554949][ T58] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.571552][ T47] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.600460][ T47] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 548.038012][T20874] netlink: 'syz.1.4033': attribute type 13 has an invalid length. [ 548.050027][T20874] netlink: 'syz.1.4033': attribute type 17 has an invalid length. [ 548.098399][T20874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 548.107853][T20874] 8021q: adding VLAN 0 to HW filter on device team0 [ 548.121069][T20874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 548.157947][T20874] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 548.168418][T20874] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 548.179009][T20874] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 548.192088][T20874] veth0_virt_wifi: left allmulticast mode [ 548.206822][T20874] veth1_vlan: left promiscuous mode [ 548.213112][T20874] veth0_vlan: left promiscuous mode [ 548.219329][T20874] veth0_vlan: entered promiscuous mode [ 548.227707][T20874] veth1_vlan: entered promiscuous mode [ 548.238488][T20874] veth1_macvtap: left promiscuous mode [ 548.245165][T20874] veth0_macvtap: left promiscuous mode [ 548.251571][T20874] veth0_macvtap: entered promiscuous mode [ 548.264228][T20874] veth1_macvtap: entered promiscuous mode [ 548.275731][T20874] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 548.287724][T20874] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 548.301917][T20874] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 548.313209][T20874] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 548.320539][T20818] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 548.339755][T20834] netlink: 'syz.0.4023': attribute type 1 has an invalid length. [ 548.358580][T20874] geneve2: left promiscuous mode [ 548.380363][T20874] gtp0: left promiscuous mode [ 548.395362][T20874] gtp0: left allmulticast mode [ 548.412716][T20874] bond1: left allmulticast mode [ 548.430956][T20874] bond2: left allmulticast mode [ 548.443763][T20874] gretap1: left allmulticast mode [ 548.458314][T20874] 8021q: adding VLAN 0 to HW filter on device bond1 [ 548.495757][T20874] 8021q: adding VLAN 0 to HW filter on device bond2 [ 548.515972][T20874] bond3: left allmulticast mode [ 548.520951][T20874] bridge1: left allmulticast mode [ 548.526276][T20874] bridge2: left allmulticast mode [ 548.532384][T20874] 8021q: adding VLAN 0 to HW filter on device bond3 [ 548.572892][T20874] 8021q: adding VLAN 0 to HW filter on device bond4 [ 549.485465][ T7650] net_ratelimit: 51 callbacks suppressed [ 549.485488][ T7650] bond3: (slave bridge1): link status up again after 0 ms [ 549.566610][ T1166] bond3: (slave bridge1): link status up again after 0 ms [ 549.605514][ T7650] bond3: (slave bridge1): link status up again after 0 ms [ 549.635642][ T1166] bond3: (slave bridge1): link status up again after 0 ms [ 549.649110][T20896] x_tables: ip_tables: ah match: only valid for protocol 51 [ 549.674017][ T1166] bond3: (slave bridge1): link status up again after 0 ms [ 549.725923][ T7650] bond3: (slave bridge1): link status up again after 0 ms [ 549.745165][ T1166] bond3: (slave bridge1): link status up again after 0 ms [ 549.765610][ T1166] bond3: (slave bridge1): link status up again after 0 ms [ 549.786464][ T1166] bond3: (slave bridge1): link status up again after 0 ms [ 549.805401][ T58] bond3: (slave bridge1): link status up again after 0 ms [ 550.013401][T20874] bond5: left promiscuous mode [ 550.018636][T20874] wireguard0: left promiscuous mode [ 550.024718][T20874] 8021q: adding VLAN 0 to HW filter on device bond5 [ 550.049274][T20874] bond6: left promiscuous mode [ 550.054060][T20874] veth3: left promiscuous mode [ 550.060475][T20874] 8021q: adding VLAN 0 to HW filter on device bond6 [ 550.074584][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.081804][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 550.092274][ T1170] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.099417][ T1170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 550.146591][T20906] __nla_validate_parse: 4 callbacks suppressed [ 550.146610][T20906] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4040'. [ 550.148681][ T7642] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.172310][ T7642] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.181985][ T7642] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.191321][ T7642] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.213042][ T7642] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.233636][ T7642] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.266472][ T7642] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.301455][ T7642] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.321587][T20909] SET target dimension over the limit! [ 550.396896][ T1170] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 550.842068][T20939] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4049'. [ 551.154772][T20952] tipc: Enabled bearer , priority 0 [ 551.183274][T20951] syzkaller0: entered promiscuous mode [ 551.198275][T20951] syzkaller0: entered allmulticast mode [ 551.227464][T20957] tipc: Resetting bearer [ 551.259354][T20950] tipc: Resetting bearer [ 551.279120][ T29] audit: type=1804 audit(1778424113.300:8): pid=20962 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.4055" name="/newroot/151/memory.events" dev="tmpfs" ino=790 res=1 errno=0 [ 551.321534][ T29] audit: type=1800 audit(1778424113.300:9): pid=20962 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4055" name="memory.events" dev="tmpfs" ino=790 res=0 errno=0 [ 551.353162][T20950] tipc: Disabling bearer [ 551.453607][T20973] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4060'. [ 551.542317][T20976] sch_fq: defrate 8 ignored. [ 551.608032][T20980] bond6: entered promiscuous mode [ 551.660682][T20973] syzkaller0: entered promiscuous mode [ 551.666602][T20973] syzkaller0: entered allmulticast mode [ 551.697919][T20986] tipc: Enabled bearer , priority 0 [ 551.706355][T20986] syzkaller0: entered promiscuous mode [ 551.711927][T20986] syzkaller0: entered allmulticast mode [ 551.723757][T20994] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4067'. [ 551.767719][T20986] tipc: Resetting bearer [ 551.944347][T21001] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4069'. [ 551.964086][T21001] bond0: entered promiscuous mode [ 551.970051][T21001] bond_slave_0: entered promiscuous mode [ 551.976430][T21001] bond_slave_1: entered promiscuous mode [ 551.985445][ T3390] unregister_netdevice: waiting for bond5 to become free. Usage count = 2 [ 551.997012][T21001] bridge4: port 1(bond0) entered blocking state [ 552.003413][T21001] bridge4: port 1(bond0) entered disabled state [ 552.010241][T21001] bond0: entered allmulticast mode [ 552.016472][T21001] bond_slave_0: entered allmulticast mode [ 552.022713][T21001] bond_slave_1: entered allmulticast mode [ 554.056649][T20978] tipc: Resetting bearer [ 554.072369][T20978] tipc: Disabling bearer [ 554.081357][ T5832] tipc: Node number set to 571274830 [ 554.476048][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 554.545217][ T1170] net_ratelimit: 68 callbacks suppressed [ 554.545236][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 554.566369][ T7642] bond3: (slave bridge1): failed to get link speed/duplex [ 554.635074][ T5635] Bluetooth: hci0: command 0x0406 tx timeout [ 554.665331][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 554.685517][ T7659] bond3: (slave bridge1): failed to get link speed/duplex [ 554.775286][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 554.795284][ T7642] bond3: (slave bridge1): failed to get link speed/duplex [ 554.886072][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 554.905174][ T7650] bond3: (slave bridge1): failed to get link speed/duplex [ 554.995207][ T7642] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 555.015303][ T1166] bond3: (slave bridge1): failed to get link speed/duplex [ 559.596271][ T58] net_ratelimit: 81 callbacks suppressed [ 559.596291][ T58] bond3: (slave bridge1): failed to get link speed/duplex [ 559.645564][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 559.715227][ T58] bond3: (slave bridge1): failed to get link speed/duplex [ 559.765160][ T1170] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 559.835308][ T1170] bond3: (slave bridge1): failed to get link speed/duplex [ 559.875171][ T1166] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 559.945177][ T1170] bond3: (slave bridge1): failed to get link speed/duplex [ 559.985323][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 560.055163][ T1170] bond3: (slave bridge1): failed to get link speed/duplex [ 560.095301][ T7650] bond3: (slave ip6gretap1): failed to get link speed/duplex