last executing test programs: 8.68842539s ago: executing program 2 (id=3044): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) socket$isdn_base(0x22, 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000021c0), 0x5b, 0x40, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x5, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x20000400) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xd, 0x200cc, 0x6, 0x5}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240), 0x4b2, r5}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000700)={0x0, &(0x7f0000000540)=""/245, &(0x7f0000000640), &(0x7f0000001740), 0x2, r5}, 0x38) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'caif0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x20, r6, 0x1, 0x1000, 0x0, {0x2a}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40040}, 0x0) listen(r3, 0xe9c) r8 = socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000084010500ac1414aa000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe80000000000000000000000000000000000000000000000008000000000000000000007f000001000000000000000000000000000000003200000000000000e00000010000000000000000000000000000800003030000000000000000000000000000ff0100000000000000000000000000010000000033000000000000000a010101000000000000000000000000043500000000010000000000bf0a000000000000fe8000000000000000000000000000aa000004d533"], 0x23c}}, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r8, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000b40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r9, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000fcdbdf250e00000008000300", @ANYRES32=r11], 0x3c}, 0x1, 0x0, 0x0, 0x14}, 0x0) sendmsg$NL80211_CMD_SET_MPATH(r1, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r10, 0x8, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x851}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r12, {}, {0x0, 0xc}, {0xfff3}}}, 0x24}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x30}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x60}, 0x1, 0x0, 0x0, 0x24004040}, 0x0) 7.959025579s ago: executing program 2 (id=3049): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="120000000a000000040000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000019000000000000000066ba9f1b2f78bb056f4d170000000020b6b52b4600af9921c1eb6203926a6b8e61c757597adb5a1a5388969839f4b22f4312acd149b3e45a752a495793bb6275ea4f12ae3d309e407cf00dbfca864167c39717b041ae6a0bca8dc196637f718b04b97d5e17eb983b3cc4a063bddd726667beec68d2fb6f8bb06fa9977117cd00"/166], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)=r4}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r6, &(0x7f00000001c0), 0x0}, 0x20) ioctl$FS_IOC_MEASURE_VERITY(r6, 0xc0046686, &(0x7f00000001c0)={0x3, 0x4, "5f88d8e8"}) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r2, @ANYBLOB="05005b"], 0x24}}, 0x0) close(r3) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x8}, 0x50) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="0e00000004000000080000000100000000000000", @ANYRES32, @ANYBLOB="0000010001000000000000000000080000008ab5000000b100006691", @ANYBLOB="eb50da7dfb714da16377a526fd9e8ddc7209dd81aa1601286687e373f5673261ebf26ee3ce046e372721770be1b1ead17d2c2c65aa2044c8cc817b3501243cbe29d9b4f059fd1e0f6a16", @ANYBLOB="64ef54cbe7c4b2b5dbe03bfc3d7de193e78161f8ec0f7bde9b693cf84b319019918d9790ff52071c79e0eaf24b5f683bc57ec6ccd40009b4c7588dd29345a36b1644e3efb52d738329cf429e90323bcba6f2abccae165442668e97ce0af41ddc1e3bfd4ba87d2413fc2d5fd55da14524db46049c569371f2a5e0bb549d50ba84f2bf353482fc0a878330bc7d05364b8ecbc16ef68f7e151785e9a0ac8b268f763c641fb61e80839dc905808b6321dc89bf1ecaab92d85817f2b661c20db2dca080cca05998a092e6d9384b0a", @ANYBLOB='\x00'/28], 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r10, @ANYRESOCT=r10], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x12, 0x4, &(0x7f0000000c80)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x31}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, @cgroup_sock_addr=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r11, r8, 0x25, 0x2, @void}, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r12 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r12, &(0x7f00000031c0)={&(0x7f00000006c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000c40)}, {&(0x7f0000000280)="5c6817db84aafc4ba93b3b7b773c1f5c014e2a4405abce2e2192542afa9748dcd0a777e403000000290d970e2f9a1d422ca71d4207e563f192538f527923b0f362103e5bbeda2dca0d9d2b5e5238329691753f1860286f1aaa0786be123a788ba8d0e1205af7751df76effba5cb644966e7b7566d2960bab4c5ba6da8e730af484c4850e243e0e95803437dfd6b95b5d3ffbb5d9fb8bc5b2358837f79985f063bfb4e982bdbd79b6aff84a010d1a97960158de81236aa66640e348b98794dd9ca277d910243cf4d9c6d38979981faac0930900000000000000420903fbc1", 0xde}, {&(0x7f0000000480)="9eb8a2c0e241fb0402ac8d04ecbc724648d79b443d283855fdba1e1dc6283591a8a07eb1436788b6b641ed5ea90be62fc7499c9b017d2e73973395411b7efb244a226ba0ae7657c57101711c5aa138abd03dec1e0899824e678aced03a92fec128f69d27d84ee2ff2e4ad7a3db73f4f12d0728bada715bf5abce312346bb7d7345e8df1fc10fa733c98030cb193341700961aa2ccb9f0f029190a1d34386c73e7017cf0fe0275d2d6f9531b12f12e29b903f", 0xb2}, {&(0x7f0000000740)="4f0461e980a3df614c952ba937542c3956c268ef9da7fc364c6d5c543c3bd84159a349884fb4df8936363169ce8541c090bb5871df329e56747592fa4d29a09dcb4c416503ec1113680af76cba6417576ac2c0d3570f91a9c661f10e9bdab3c038f68844db4a19a8a613d78adb0405e27a1dea217288306169ac437c2401514510725ff144e75b83b8c67735520151c1018c3542bdfa2cae78aeb5d328f7d134706eb4d03bf4018be0f581f55e82cc1e851b8585d48a881144bfd5e96b52b62e62abe7ace71093fe8779d41feea0eb401dc005f2e3fe47320e7f945fb04e06c713f062ca47794f9c0b7fa88ccfacc4a51a4e816e0cb832c42d9f60561d5086ff512190d1129892fd541a0fbc9a41d70cd0d4501fed5545cd04b7800814bcbf492339bbfe784baba895beda447447a447e088a8d7cb795b3543a8cd8d8efb830dabc88b5b6466cd1d903833fca0e1049480810da129e746e2c9726a846ce85003a6bb9949e5dd140ab97a001c91323d5cb6648d4f61d40d4951ae36a1a404ba3452ae9a969c16a0918b4afe0b7b6afe4d59d8abfed8e7b38ce7c6c4daf306d0136c353c109f0a63c26df5f8866e763dc2fcd93b7c9b7143823cd8272533aa2eb47f873da2e1aeba66332990f5033c712108f71bc055f29317d8dd9b227b524d61381ed55fdb83ee0849699dae2e0bb675bf07392f4b0303f2498c892988420f1e144e73eb89146ccde129625478ae391d7ed1d6f5fc03c603c699250ff4801890eda63df41b0b9d619b2dad24798faf47863f79ee52ee40e8550c52c28a795377d934e9b3cb2f9f0ae973055288f5ebbb6a193e5cf89d3dfff60d4e545abda64b1c55d315931540117b96e72a5cea284c4a9d99d165d19e12176acd226a9ec38d6889c913b8c98b3a1666ec9b378655838df06b8318691cded6314ce3bcdd3d1ac172c3ecd2f82879771034f5f1ebb3d6ee5b10c77f269954680acc2495c586cf6bc33b2c8b374cf64275cfb06a0ef5485c269b152cbdd6c0489307000000c5a28372a45f3c79f3e45ce94ffb14bf3aa8e5f0e54d942e8440c94bf5d2f0eb05e32337b6ee0087f8047e2a820b1fe6c4db3d9969f9705d9ef5df25e8373de300f04ce07cbda2e41459024d13fa2ee32103d00b6642e6fe0ae493a9ad418329deb60f9930dc", 0x344}], 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000002900000004"], 0x18}, 0x8080) sendmsg$kcm(r12, &(0x7f0000000440)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)="5300138e06d44d863d4eedd1", 0xc}], 0x1, 0x0, 0x0, 0x900}, 0x0) syz_emit_ethernet(0x22, &(0x7f0000000300)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @multicast, @val={@void, {0x8100, 0x0, 0x1, 0x4}}, {@can={0xc, {{0x3}, 0x8, 0x3, 0x0, 0x0, "fa2b25fc66189827"}}}}, 0x0) 7.728299935s ago: executing program 2 (id=3051): socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) r8 = socket$unix(0x1, 0x5, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmmsg$sock(r1, &(0x7f000000bb40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4000011) 6.313890022s ago: executing program 2 (id=3062): socket$inet6(0xa, 0x3, 0x7) r0 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r0, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x80000000, 0xffffff00, 0x400002}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000800) 6.242221028s ago: executing program 2 (id=3064): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}, 0xf5ff}], 0xf00, 0x0, 0x0) shutdown(r2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x1d, 0x72, &(0x7f0000000040)="976d9023d56482cd284a63da539706d7009be646625bd75b025352ebe5", &(0x7f0000000180)=""/114, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x8000}, 0x50) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448cb, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair(0x5, 0x5, 0x7, &(0x7f0000000480)={0xffffffffffffffff}) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)={0x58, 0x2, 0x3, 0x801, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x33}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x10}, @NFQA_CFG_CMD={0x8, 0x1, {0x2, 0x0, 0x3}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xbaec, 0x3}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x14}, @NFQA_CFG_FLAGS={0x8}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x20}, @NFQA_CFG_CMD={0x8, 0x1, {0x3, 0x0, 0x1f}}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x0) bind$bt_hci(r3, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) r5 = socket$packet(0x11, 0x3, 0x300) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)={0x24, r6, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0xfffffffd}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x80}]}, 0x24}, 0x1, 0x0, 0x0, 0xc4}, 0x0) getsockopt$packet_int(r5, 0x107, 0xb, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) write(r3, &(0x7f0000000040)="05000000010000", 0x7) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, 0x0) 5.000259701s ago: executing program 2 (id=3067): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0xfffffffffffffebd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r1}, 0x10) (async, rerun: 32) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) shutdown(r2, 0x1) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000700)={0x0, 0x81, 0x10}, &(0x7f0000000040)=0xc) (async, rerun: 32) r3 = socket$alg(0x26, 0x5, 0x0) (rerun: 32) bind$alg(r3, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) (async, rerun: 32) r4 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) setsockopt$packet_int(r4, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r4, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x50, 0x10, 0x0, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x11}, {0x4, 0x1b}}]}]}, 0x50}}, 0x0) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b80)=@bpf_ext={0x1c, 0x23, &(0x7f0000000900)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @tail_call, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x40}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x28, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000ac0)={0x8, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x2107c, 0xffffffffffffffff, 0x3, &(0x7f0000000b00)=[r5], &(0x7f0000000b40)=[{0x0, 0x4, 0x9, 0x7}, {0x3, 0x3, 0xc, 0xc}, {0x4, 0x3, 0x6, 0x1}], 0x10, 0x400}, 0x94) bpf$PROG_BIND_MAP(0x1c, &(0x7f0000000140)={r7, 0xffffffffffffffff, 0x24}, 0xc) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="0800d90700000000000000bd5656", 0xe) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) unshare(0x62040200) (async, rerun: 32) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) (rerun: 32) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) (async) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) (async, rerun: 64) setsockopt$ALG_SET_KEY(r11, 0x117, 0x1, 0x0, 0x0) (async, rerun: 64) r12 = accept4(r11, 0x0, 0x0, 0x80800) sendmmsg$alg(r12, &(0x7f0000000240)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000008c0)="0928ffffff", 0x5}, {&(0x7f00000002c0)="ebe3a0e9", 0x4}], 0x2, 0x0, 0x0, 0x800}], 0x1, 0x40800) (async) sendmsg$NL80211_CMD_CONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0500008000264b51f6bfa95341c0feb89a24ea0501000000000000", @ANYRES32=r10, @ANYBLOB="0a00340002020202020200000a00060008021100000000000800350000000000080026006c090000"], 0x44}}, 0x0) 1.98433494s ago: executing program 4 (id=3126): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c0000003100010000000000000000000a0000000400000014000280bf74a7dffdd8f8331ba40dfa929744a6933331c6a1e6f8b1bde75192991b31ace4531e222f25ff68bb153e56263c5a60b8bca3b37066bfafee846358ac015ed8a264c9ad24a8f8f8e8412d62a8e19c547f5a4092e4544737ffceb149de29a04d703d5038b11ad8e1233018104626"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f00000001c0)={0x28, 0x0, 0x2710, @hyper}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x200, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0xa, 0xffe0}, {0xc, 0x4}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x34}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008814}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x10, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x1f4, 0xd50, 0x6558, &(0x7f0000000000)="ff", 0x0, 0x6, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x69) 1.87212812s ago: executing program 4 (id=3129): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={0x0, 0x1a8}, 0x1, 0x0, 0x0, 0x4}, 0x80) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @remote, 0x9}, 0x1c, 0x0, 0x0, 0x0, 0x590}}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000006c0)="b2c5c79f07ab3d9614d5c058db4a274ad23734c22aeb5fa860b7ba11a89526f3e0c83d84e43f97065e049df95e", 0x2d}], 0x1}}], 0x2, 0x8008801) 1.839068262s ago: executing program 4 (id=3131): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x48, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x20}}, {0x14, 0x4, @private0}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0) (async) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) (async) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000000), &(0x7f0000000100)=0x4) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 1.732335782s ago: executing program 4 (id=3132): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r2, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'\x00', 0x202}) ioctl$TUNSETPERSIST(r3, 0x400454cb, 0x1) (async) ioctl$TUNSETPERSIST(r3, 0x400454cb, 0x1) close(0x4) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) (async) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x2a}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x8000) (async) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x2a}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x8000) 1.625147108s ago: executing program 1 (id=3133): unshare(0x2c020400) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000040000000160a01010000000000000000010000000900010073797a30000000000900020073797a300000000014000380080002400000000008000140000000002c000000180a05000000000000000000010000000900010073797a30000000000c00054000000000000000011400000002"], 0xc8}}, 0x4000450) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socket$netlink(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="11072abd7000ffdbdf250500000008000300", @ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0x2c00c000}, 0x40000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) (async) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(r6, &(0x7f0000000000)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @link_local}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x50}, [@ldst={0x3, 0x2, 0x3, 0x1c10a1, 0x0, 0x42}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) sendto$inet6(r6, &(0x7f0000000280), 0x0, 0x800, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000000200)={0x1c, 0xa, 0x1, 0x7, 0x0, [@mcast2, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0, @loopback]}, 0x58) (async, rerun: 32) ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0xd0009412, &(0x7f0000000ac0)={0x0, 0x101000000000}) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x16, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000d0000000000000000001000850000007b00000095000000000000001a6a403bd698458e7c0a9ccfa6981457324ba715492e421ea0852ab7800bc5786c0959c0dda8dc8310923f60ac51d006d73768a12c963050cccdedee17a7ff5170efcb42309a14c4154165c5174d98f8c2d36fdc69837e4ad041bd0f413e91b4f089f9a9457109fc9959f5feb142f1d289f7ed2dd698e4fbacbd5d7c05405489a2275e1c3de2"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) bind$alg(r9, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'vmac64(anubis-generic)\x00'}, 0x58) ioctl$PPPIOCNEWUNIT(r9, 0xc004743e, &(0x7f0000000100)=0x4) (async) ioctl$PPPIOCSMAXCID(r9, 0x40047451, &(0x7f0000000200)=0x3) ioctl$PPPIOCSFLAGS1(r9, 0x40047459, 0x0) (async, rerun: 64) pwritev(r9, &(0x7f0000000080)=[{&(0x7f0000000240)="00214717a70700000000030640710a069d317ebbaaa6721d5874f72cf86d73d32f462e5947e4ad380feb56a29357215d78fc44", 0x33}], 0x1, 0x7, 0x0) (async, rerun: 64) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002300)={&(0x7f00000022c0)={0x40, 0x1, 0x4, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x1}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x2fdb}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x3}, @NFULA_CFG_MODE={0xa, 0x2, {0xfff, 0x1}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000) (async) ioctl$sock_rose_SIOCRSCLRRT(r0, 0x89e4) 1.503348422s ago: executing program 3 (id=3134): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000180)={r3, 0xfff}, 0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000080)={r3, @in={{0x2, 0x4e24, @multicast1}}, 0x1, 0x4, 0x4, 0x8, 0x8, 0x4, 0xd}, 0x9c) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x339) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001000010025bd7000fddbdf2500000000", @ANYRES32=r5, @ANYBLOB="ff0000000000000024001280110001006272696467655f736c617665000000000c000580080022"], 0x44}, 0x1, 0x0, 0x0, 0x80c5}, 0x40040c4) 1.416451659s ago: executing program 1 (id=3135): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) (async) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x1402, 0x300, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r2}, @RDMA_NLDEV_NET_NS_FD={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4c010}, 0x4008000) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(r1, &(0x7f00000008c0)={&(0x7f0000000200)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000240)="3fd1ed581c89fd73cf1be11855fb9d6ce64bb90bb2470e8224ba56c073e1dac1fd9a42ec5ac5643bf7a70203510cced9c5b526030357ca2f835a37c7cd8ffb8f06df3be17cf755f2684da7986025b6895de4ec762570273d020b4fdf82f7189c7db78e7cb7c0026e78b90b0ad038b8b3f94d4ca130c4bf62f6a71c08aaf24026543cdc2a012bf3d8f8c45ab6cdbf9f10a4b929d9812d881a734bdf61a910ec", 0x9f}, {&(0x7f0000000300)="b70b6e41cef188b18e7ecf8c961c276ea6cc73e2efaf1ad03f32a94c30cd868397fda314e2066036794fbc3b6a8858495515066619ff9a447808ebb17233bbcf68b29b3904e2fea4cb079d6f934a94bb8f4e8ed370fd74262a50d0f13ca2919a5c2be02b2d77c26f578a78046136e2b5b63995346b7513ed193fccd8ef4cca5fb1b3e810f701c476425d8a9104c60b1ae6c6e570330a581744d750eca416141dd3c7", 0xa2}, {&(0x7f00000003c0)="5f15e991ffb48e568dd5ed54ae1ca4a1d58523f761d8d41570c18b00723ced5359d16bf9378a22cc1df6ba57984fa1b82868433cc8f0245fc748a70f7c1b305dbbe5ec721e7d39f2c1e9e9da7f4b0b8cd5ede533cfba7d93eec06be114b4326d321e9f80e51d7fe219d6b6ced84f321ca53ca9c34fd1def36736b694126cce5f6e6ae1", 0x83}, {&(0x7f0000000480)="d87a0f37932f1962b624c25ee16eeab075b2add6b0b82d4baf359d05e77ee2bc39f1dc258af33697446698d21298b17c6d521915000c33684557f9bbbce54f0a5c49c8d573c676c2af29133dd82228a579fa97f0e8756eed4bb33cb5f7225cac9f2a5e15f9c779f7150c8130369c8131cc765b05c0ba77db8903ac702c8c3c701c412fcd1d5f1720c4", 0x89}, {&(0x7f0000000540)="b7bed6209d2d965ec34671371a1870f0663c4c5c7541fbbc7a96b3b94b6f7714272b6c1965e3c9b838a6b25db4ddb0d06a478dd4befe247c6eaa13d3e560e1151db43fad79c8f9a025ca5676a1fdf523947d93f47106f1d3ade20785dc6f703e6e7f03dd351b60d06533869852a1955f47b393888992edb48257c5d72b30551687e9da8cc9fecf4c13bd3044558f1c86b8983ba94f855666008a3a5bd3c9a8e8e54927f2a85e767edc9662786635ee4a6191673e128a7987bbcc801658f572c9faee8f9b3b29cf4c6c71698aa5b58a4ab727df631001", 0xd6}, {&(0x7f0000000640)="fe7cd5074a4d802eff0e0d1ed2e62e7eab63b3fcf80a26fb3d39f1c5170a16940f494b4c8678d29a7d5c2eadbed3ca2a4940424d3be3a22d4136db81d3104b14fddca5a38f", 0x45}, {&(0x7f00000006c0)="a508254cc10c5b6d2e7f", 0xa}, {&(0x7f0000000700)="34ee5785b5fe1d2befe39efe8c2290be35c71442977a78d512424f3593c1564575caa71c68cd04069ee6f5d3e7fb187683191af556680ae1c87cd31f1ef4d83640dc37a50926a952121b27fd83", 0x4d}, {&(0x7f0000000780)="0ad99b10a3b8e750da94c4fe73f535e6164288a566147f8be8b82693093bd12b7c02b98752b93d3d46c147153f6cc905e84869ca66a7d5c1352d4cb4e595950b71970db062463279c02f1cce384e75c76053fa947867164a60637b86d320ae67146cb8a1d75415bdd8039a73492b0aa45035ff11bc48fffaf870", 0x7a}], 0x9}, 0x0) (async) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000001740)={0x38, 0xd, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1000}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5}]}, 0x38}}, 0x0) 1.415024638s ago: executing program 3 (id=3136): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) r2 = socket$xdp(0x2c, 0x3, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000003000000000000000000090061100800e11a42000000ed7b0ae0ff000000009500000000"], &(0x7f0000000580)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x8}, 0x94) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x8, &(0x7f0000003140), &(0x7f0000000040)=0x30) (async) socket$key(0xf, 0x3, 0x2) (async) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmmsg$sock(r1, &(0x7f000000bb40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4000011) 1.332007279s ago: executing program 4 (id=3137): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'geneve1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0xd27, 0x30bd29, 0x40000002, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x7}, {0x7}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x9, 0x2, 0x5}, {0x4, 0x0, 0x1}}}]}]}]}}]}, 0x64}}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x77, 0x4) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x7fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='cdg\x00', 0x3) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000d00)={{}, &(0x7f0000000a40), &(0x7f0000000cc0)}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000000000000000000000000000850000003d"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x4, 0x8, 0xb}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map=r6, r5, 0x7}, 0x10) close(r6) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000140)='memory.numa_stat\x00', 0x275a, 0x0) read$alg(r8, &(0x7f0000000040)=""/136, 0x88) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r9, &(0x7f0000000200), 0x806000) writev(r9, 0x0, 0x0) write$tun(r9, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000012c0), 0x4) r10 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x2, 0x0, 0x80, 0x0, 0x7, 0x3, 0xc2, 0x4, 0x20, 0x8, [0x2, 0x0, 0x0, 0xc, 0x5, 0x0, 0x0, 0x2]}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001380)={{}, &(0x7f0000001300), &(0x7f0000001340)='%-5lx \x00'}, 0x20) 1.331294485s ago: executing program 0 (id=3138): socket$inet(0x2, 0x2, 0x1) (async) r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f00000004c0)="1ed8b7f9d457", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f000001000000000020000000000000000000000008"], 0x40}, 0x20000000) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000600), &(0x7f0000001380)=@udp=r2}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x5452, &(0x7f0000000380)={'gre0\x00', 0x0}) recvmsg(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000440)=""/103, 0x67}], 0x1}, 0x0) (async) recvmsg(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000440)=""/103, 0x67}], 0x1}, 0x0) sendmmsg$unix(r2, &(0x7f0000001040)=[{{&(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x170bd27, 0x0, {0xa, 0x0, 0x80, 0x1, 0x0, 0x0, 0xfd, 0xb, 0x2100}, [@RTA_IP_PROTO={0x5, 0x1b, 0x6}]}, 0x24}}, 0x200048d4) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000040)={0x1, 0xe4, "f52e55b9d33822a222fa0a2ca8ac467b420abf01d51306be9b2286ea8e3fa77ea87d73587cd359e9d79421b350281d7af9462d1ec7cc1d3d1dcae9cf32438f64638a742ec4461da0084c095b587962291b82e9d08f8a30f496e2725e858ad9306c03fd1750e10d5c1bee76dfbf63138ef02920b4272d89636aa02b3b594e466fa0c217e7234875055da4d314d95f1c18842b16158c44f2022ed734e6a90f2b303689c5c97fa2806ea37291662ee90a303173a6318dd774ddc1b546fbbd999a5ab018ccab2746560ea251b6ee9658c34e0fe72084ace4fd3a2e0e1f219c3e669d38796413"}) (async) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000040)={0x1, 0xe4, "f52e55b9d33822a222fa0a2ca8ac467b420abf01d51306be9b2286ea8e3fa77ea87d73587cd359e9d79421b350281d7af9462d1ec7cc1d3d1dcae9cf32438f64638a742ec4461da0084c095b587962291b82e9d08f8a30f496e2725e858ad9306c03fd1750e10d5c1bee76dfbf63138ef02920b4272d89636aa02b3b594e466fa0c217e7234875055da4d314d95f1c18842b16158c44f2022ed734e6a90f2b303689c5c97fa2806ea37291662ee90a303173a6318dd774ddc1b546fbbd999a5ab018ccab2746560ea251b6ee9658c34e0fe72084ace4fd3a2e0e1f219c3e669d38796413"}) 1.245791955s ago: executing program 0 (id=3139): r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x20, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000140), &(0x7f00000001c0)}, 0x20) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000240)=r4, 0x4) r5 = openat$cgroup_type(r1, &(0x7f0000000040), 0x2, 0x0) sendfile(r0, r5, 0x0, 0x9) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=@newlink={0x5c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003, 0x10000}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_REMOTE={0x14, 0x7, @mcast1}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e20}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x0) close(r6) 1.17637112s ago: executing program 1 (id=3140): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[], 0x48}}, 0x1) 1.060093384s ago: executing program 1 (id=3141): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xad4b}, 0x1c) getsockname$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000100)=0x1c) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x4) r2 = socket$isdn(0x22, 0x3, 0x4) getsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f00000001c0), &(0x7f0000000280)=0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x20, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000140)=@gcm_128={{0x303}, "342a4f49e872f79d", "4b8b4e0802ff03fbe3c7a6f875981e00", "85372e3c", "090000e6ff00"}, 0x28) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000300)=""/203, 0xcb}], 0x1) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x7ffd, 0xe) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000080)=0x49e1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) 1.046050105s ago: executing program 1 (id=3142): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000000)="10", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x7, 0xe, 0x9, 0x0, 0x1, 0x8, 0xa7, 0x4, 0x5, 0xf1, 0xb, 0x7, 0x0, 0x7}, 0xe) poll(&(0x7f0000000080)=[{r0, 0x46a8}], 0x1, 0x400) shutdown(r0, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c000b8004"], 0x44}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, 0x0, 0x0) socket(0x2b, 0x1, 0xfffffffc) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x5c, 0x2, 0x6, 0x101, 0x0, 0x0, {0xa}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xffffffff}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}}, 0x80) r4 = socket$nl_rdma(0x10, 0x3, 0x14) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c1300001900100026bd7000ffdbdf250266e70b0002000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmmsg(0xffffffffffffffff, &(0x7f0000001140)=[{{&(0x7f0000000300)=@isdn={0x22, 0xe, 0x7, 0x0, 0x9}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000380)="51dc89dc5d45f84c68ae398182e06aff559c88fc9ff06259fab8f489a8fc77ebd9c83f0ad693a2772924652dd160d37331532084a5d285bf70b26748e6e5b1dc51050b8f198b36439866918272e0fd949ad7628e662fdd32bc3630565e24e1253a2c", 0x62}, {&(0x7f0000000400)="d4a2998150ef0af977277bd0dd7bb3c466b10850e21c803eac46716b69ff01ef7eaf9315eb3922fd4f72c2abf842a1de6135c0f8da917f3b372984e4966813b7f2cfe08a405ce2d8f414b9e9489307d6c1d0ff9c731862a9d357", 0x5a}, {&(0x7f00000001c0)="c0fdbbef1476ab9dbf84916581b7f9f5eae742ef7c6cddfb95b4b116ea", 0x1d}, {&(0x7f0000000480)="2d0230", 0x3}, {&(0x7f0000000600)="f8dfddfffeb8562894b7f9284ef4977a4a39b491b89afb88c849b17eba53581f6d8acf4ea8397439c790122df8cc2ced4d1d1cef91c303faffec2c91a910ba528e891bf6017232006daf7d40ad692d05b6e56e33fa2b81de654978aa852f803393cb64bec259ae9ad0d870ac321007f762be03bafdf1cd03b5870bacc5b8b7e6bca2a39ec58c1a31d0a42979beaccfa7e386e73cb8d1a52b398d2e50bf163a8d9a1a", 0xa2}, {&(0x7f0000000500)="ebb7941b73b20ec37a7f350cd944884d37fc6adb9b975f9939f2f3bde299ab3f96a2e7e3ed76dec3cc324ecb54c3269302b6f9f39b74c0092f46eb5a9f12c8495ebcd970857375642d8334a0c3e3cb64a87a97541188e4cd070600210c788f8aa682d120aa78c6cbbc4aac9e", 0x6c}, {&(0x7f0000000780)="61b90afba126a299782d0b185d79d41bd545b9263a4f615dd8de5885d44c9e12fbf72cd5b77476d0ad8e484115e995311ecd1a6caa13d46809ef2dcec39101927796145f2f72fe0908d3d7ee41e36ded10d7cb2856f2698b78b41baf10cdc67a1072bcff777c", 0x66}, {&(0x7f0000000800)}, {&(0x7f0000000840)="a69c3f869b68f0239f3d83aa9d2711b28934ccc803f35e7b0543d67c994252a12ca3f79aa300b88bdd15de335b4f30c6c4deb28f11ef5d9792af0e8a7051e0af123e967bb9a395204bded5c4110e3303841dbbe95aa7bf85cf1e80d0b36665b49ebb5ebd9eba7e87d66f4fb826ba38", 0x6f}], 0x9}}, {{&(0x7f0000000980)=@in={0x2, 0x4e23, @local}, 0x80, &(0x7f0000000e00)=[{&(0x7f00000011c0)="991fd9e6e12a0357792a81ef9cff5c9d92b3a21ad76b259017b2664502c81e5ab28cb4c7b42b676888bd30b89a9cd4edfbfc825a7573f343352e795b492da88b76dc7dee2db5c544fb4d1d4cec55042293d12f777cae26cba15bb9bf2afa263cab9d474708af466fd81504f55b9226ada191004acdbfa917289a4cfe9f4e2227f57526880b5f9371087023ded0d3883adf1c6eb384ab839089aaae991d18aa8dc28cd1499e63f010cbcf2dba577a9f3ba42ace3b36f3cb2b828384e6c74808879ad6f2c524de1dd555bf6462db82", 0xce}, {&(0x7f0000000ac0)="9c74e9bf892d70025b409b7749436d16f8946c86a64aa7578b9b7cc9f5f0a628bc817575d98f2af998", 0x29}, {&(0x7f0000000b00)="0d493a86f7168e44e6b71404bf0fcf6048d34dca0fe5bdc415819bf67d4add7449dc0000000000000002c027f7df8dae45da6433da9f0803a440d928b099518500f35ecc4b6a9b0f55de6781fcebe96829b1228f85116e668f37f637a9a23488479e3f26dcab07254bb771b14ad020f5c8055f36d8f2140337538528c1e5aa1c33b53b", 0x83}, {&(0x7f0000000bc0)="ba54c861cfb9c2137a09b8ac9cfc114a6c42319ae3d26548023755a8d5d8f11765df5a62f7075a583ce25e2e9423f3aa9f630a0d03e434d81de8253d313c36a2655095223d298b8b58beb58aebf588e6c9904c350f3ee038187d8b929258a3ace6a5bf00aa25cf4d6bf8e7efe0ac9c93fc5ca946882b0128c38d7b7e2473f0bf74d4f1ded300753281cf2439ec31209a1746cfc3cdf3381a5eff260cb26487087b99c5b79ba980ed9bbd235c0b09df1bd6ae368d0396eb095bd33b7aa3bbdcb9730aef6b2ed6af1be7629f8823886ec04a039845d5def01cf1e13902ff67efb4b6add24a95d21a65c60b6a40cfaee6790d44", 0xf2}, {&(0x7f0000000cc0)="eab9cb2a890304cebf6903dc19314158ae18587b5e14f42c3cd962682d470c96fd331d5ca7b14422787a00782207769630f0b235573c783ca60769941305250353c11a8237099ada326a3ab34fa97ae619e92a33b00fd3dec33d816f24f9ac4bd8768a2ba6e0dd80601c11f22924be3e8062bf09ec06c572aec756319229508a54d4696a84a374b26d7ee5325f4dba125759bc7f3d2db6234f41", 0x9a}, {&(0x7f0000000d80)="9f1c6156855bf9cad7acd4c323e6bff663a4198d579af6e1c4b8354ed870c805c735baf7e91b65e4009072049e4ca17df9dee48f3168d250c3e2a35f3c522e4d9a1a64c6152c9ef5abda0e1a9efd0430bbad4a94eec07d3ab5eaf9f6f32ce1db986e40121cf7da0f", 0x68}], 0x6, &(0x7f0000000e80)=[{0x48, 0x10f, 0x3, "5903210e03f82d8bb46d78288620c02f144365c63ea54ecb5e73d794d7448c35dcbf9030f9e2619e56ab7f48522d08e23b82564d047d9b"}, {0x98, 0x104, 0x3, "ff2c543c4f155b58048c1f9a6285faaa6a3be14f2be6b6f7d53885c9660decf093e3527cd991ab895324c40891a3c965f75f94db9d64c62c358bf42158e5ad114cc9b23797a6171d493d6d509e463076a4a57b5ff35af1a67c8b8bdd46ede2dd1aaf54c2a15caaed770c2c73e3fac6701881735610d8fbbf158705715b8a4455144c"}, {0xf8, 0x0, 0x11, "b7f5f64ecfe756931fb126202b6d1bdaf897fcc32f980c2fb5b644d3f388a082af4dbfa446674e80ff6fc6a6933417c1ffb8b5fd6be2e7844cb8adc7dd6d6fb89b932c3e9cb1bfd5e6ffbf5de4565cd0db1777e3edeac6140e15610b1d69b635a927bef9923061d21654047dcade25486da846ed961cb36415ea24734db2283354a60c033122fbb918377135ce78487bde76097f300e8b04491f241d441cc79a2b4898452875f4539123ab5b9a5a398156febd33d7d081a5ce5a403bb1f87419ff304955638c6a02e1cb6cf3b7546a88706326b4795a2231db61cb7538d6b5bc770e83fa8cd4"}, {0x58, 0x10b, 0x200008, "b9cf5c1e46e605d72f2d523fd890c62ff4aed9b7c0864ebbf3cafaf506d5d963a237322305f33797c01519c63d8dc4a036f261d36f035b301675ada8780c16f81da52e845d7c"}, {0x18, 0x88, 0x8, "dd"}, {0x48, 0x108, 0x2, "a6a6c2fca0206ee4f0213f11fb27144c5977481d72fd7a0d23befc05651213451db967fea4f5276174e38c2654fff8309cec0bf04240"}], 0x290}}], 0x2, 0x48881) getsockname$packet(r5, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00000e8d00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r8}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000300)={0x3c, r10, 0x9, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048814}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="400000001000370400000000fcdbdf2500000000", @ANYRES32=r6, @ANYBLOB="890c04000000000020001280080001006774700014000280050005"], 0x40}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @empty, @rand_addr=0x3}}}], 0x20}}], 0x1, 0x4040880) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) socket$inet_tcp(0x2, 0x1, 0x0) 585.216654ms ago: executing program 4 (id=3143): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) r3 = openat$cgroup_ro(r2, &(0x7f0000000200)='blkio.bfq.io_merged\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)={0x64, r4, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x48, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "793bb0bb537be833"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="b4f42dfb21b445eef1df2342c81fc614"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="f12fc4e75cdfbf09ac587f1868dc372b75026eee166c2bae258616dda2cfec94"}]}]}, 0x64}}, 0x4000080) sendmsg$NL80211_CMD_LEAVE_MESH(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x14, r4, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {@void, @void}}}, 0x14}}, 0x80) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)={0xb4, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x70, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0}}, @IPSET_ATTR_MAXELEM={0x8}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6c}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x8}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x6}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x8}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0xb4}}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r8, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) connect$can_j1939(r2, &(0x7f00000001c0)={0x1d, r9, 0x3, {0x1, 0xff, 0x4}, 0x1}, 0x18) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x74, r8, {0xb, 0xffeb}, {0xfff1, 0xfff2}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40455d00000900020073797a31000000000900010073797a30000000000800054000000021100011800c150100636f756e14c5fe549652ddf7fdd96d51384974657200400100000c0a01010000000000000000070000000900020073797a31000000000900010073797a300000000014010380100100800900034000000002030106"], 0x1d4}, 0x1, 0x0, 0x0, 0x8000}, 0x840) 459.644975ms ago: executing program 0 (id=3144): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYRES64=r0, @ANYRESDEC=r0, @ANYRES64=r1, @ANYRES8=r0, @ANYRES64, @ANYRES8=r1], 0x54}}, 0x0) accept4(0xffffffffffffffff, &(0x7f00000003c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, &(0x7f0000000440)=0x80, 0x80000) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1a, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="262e5c04bb225f52eae2612db1eb55d73faef5fa2819b8d5120af534a167ec74a176d110655d7d4e0fe63c8a40190aa55251c301f95907cd43f9ee68a9e87eca6906fe367d947c31eef51fb9ff9adfbab2330ec12d2f4d1601380896dffa6ecb38ad4f828c49e02963ae59e3a2100df7bb4f51a06727eb"], &(0x7f0000000280)='GPL\x00', 0x100, 0x0, 0x0, 0x40f00, 0x14, '\x00', 0x0, @fallback=0xf3617376568ea760, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800020d4}, 0x94) r2 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$6lowpan_control(r2, &(0x7f0000000500)='connect aa:aa:aa:aa:aa:11 0', 0x1b) write$6lowpan_control(r1, &(0x7f0000000540)='connect aa:aa:aa:aa:aa:11 2', 0x11) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) r4 = socket(0x10, 0x803, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x52f02, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000000, 0x12, r7, 0x0) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000180)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYRES64=r7], &(0x7f0000000000)='syzkaller\x00', 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r10}, 0x10) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) sendmsg$nl_route_sched(r6, 0x0, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) write$6lowpan_control(r3, &(0x7f00000006c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b) 409.183517ms ago: executing program 3 (id=3145): r0 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) listen(r1, 0x7d) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_int(r2, 0x1, 0xb, &(0x7f0000000040)=0x5, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000080)=r0, 0x4) r3 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x800) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r3, 0x28, 0x6, &(0x7f0000000100), 0x10) setsockopt$sock_void(r2, 0x1, 0x24, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x400000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'macvlan0\x00', 0x10}) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = accept$ax25(0xffffffffffffffff, &(0x7f00000001c0)={{0x3, @bcast}, [@rose, @default, @null, @netrom, @remote, @bcast, @null]}, &(0x7f0000000240)=0x48) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r5, 0x8982, &(0x7f0000000280)={0x6, 'veth1_macvtap\x00', {0x1}, 0x7af6}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NET_DM_CMD_STOP(r6, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r7, 0x300, 0x70bd29, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000400)={0x0, 0x80000000}, &(0x7f0000000440)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000540)={r9, 0x84, &(0x7f0000000480)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x25}}, @in6={0xa, 0x4e22, 0x4b8, @private2={0xfc, 0x2, '\x00', 0x1}, 0xffff17e5}, @in={0x2, 0x4e21, @loopback}, @in6={0xa, 0x4e24, 0x3, @private0, 0x8}, @in6={0xa, 0x4e22, 0x5e997358, @local, 0x2}, @in={0x2, 0x4e24, @multicast2}]}, &(0x7f0000000580)=0x10) socket$caif_stream(0x25, 0x1, 0x4) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_STOPDAEMON(r10, 0x0, 0x48c, &(0x7f00000005c0)={0x2, 'veth0\x00', 0x4}, 0x18) r11 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r11, 0x400448c8, &(0x7f0000000700)={r1, r1, 0x40, 0xf3, &(0x7f0000000600)="e2c818c71fa3c93b47c7387c57c1c320f65a2dd53005e6c329a4b5d1165d78d58ad72cf1fbd8d87155008a5ce04ef08c98b62668451fc9d8010d926e60fa5d9c351b9825075d555428dbabbb9b82de889f75b6fd1bea1f22cc3383391f84fc8a8373a283fa545b5aaa669c768ed3df72ca893f2d815bb6afd937fcb00cd92745f72113835b91d191ee8c561c1562532478b6da1707ebac3312b07a8b44b85b71e5d46a4c2c797254d44f7a3f68b83165936191321c5bdf7b49b216e1575d0d9ab42375711403bf6ad5825c8f626e206a1883689473de02dd7148ee5a67c0c102dd1bf5a2c08356ec957f3c1426a37d05b66659", 0x1, 0x3, 0x2, 0x5, 0x7fff, 0x3, 0x3, 'syz1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r12, &(0x7f0000000940)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000800)={0xd8, 0x1403, 0x8, 0x70bd2a, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'wg0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_macvtap\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_bridge\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'dummy0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team0\x00'}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x1850}, 0x8080) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f00000009c0), 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)=@getchain={0x34, 0x66, 0x200, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xffe0}, {0xd, 0xfff3}, {0x7, 0xfff1}}, [{0x8, 0xb, 0x4}, {0x8, 0xb, 0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x8800}, 0x8080) 312.464822ms ago: executing program 3 (id=3146): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r1, 0xe4}, 0x18) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'dummy0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCB={0x5}, @IFLA_MACSEC_REPLAY_PROTECT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x4c}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x110e22fff6) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNGETVNETLE(r5, 0x4010744d, &(0x7f0000000180)) socket$inet6_sctp(0xa, 0x5, 0x84) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r1, 0xe4}, 0x18) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'dummy0\x00'}) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCB={0x5}, @IFLA_MACSEC_REPLAY_PROTECT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x4c}}, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) close(r5) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x110e22fff6) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) ioctl$TUNGETVNETLE(r5, 0x4010744d, &(0x7f0000000180)) (async) 303.530651ms ago: executing program 0 (id=3147): r0 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r0, 0x6b, 0x3, &(0x7f0000000000)=0x7, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x58, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) connect(r2, &(0x7f0000000100)=@ll={0x11, 0x3, r3, 0x1, 0x7, 0x6, @random="7f6aad85c777"}, 0x80) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000180)={'veth1_virt_wifi\x00', {0x2, 0x4e20, @remote}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0xb8, 0x0, 0x20, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x55f300}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x180}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffff7fff}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x401}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0xb8}, 0x1, 0x0, 0x0, 0x44}, 0x48000) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r1) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r5, 0x200, 0x70bd29, 0x25dfdbff, {}, ["", ""]}, 0x1c}}, 0x4) ioctl$SIOCX25GCAUSEDIAG(r2, 0x89e6, &(0x7f0000000480)={0x7, 0x9}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r4) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x5c, r6, 0x20, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x14}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x77}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x6b}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x69}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x2}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x25}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40010}, 0x48800) r7 = socket$netlink(0x10, 0x3, 0x4) r8 = syz_genetlink_get_family_id$team(&(0x7f0000000680), r1) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000780)={'syztnl1\x00', &(0x7f0000000700)={'syztnl0\x00', r3, 0x4, 0x8, 0x3, 0xffff, 0x45, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x80, 0x0, 0x65f575c, 0x6}}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000007c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000800)={'vxcan1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000840)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000000dc0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000d80)={&(0x7f0000000880)={0x4f8, r8, 0x300, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0x130, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r9}}}]}}, {{0x8, 0x1, r3}, {0x194, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r10}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0x3, 0x2, 0x30, 0xfffffffd}, {0x800, 0x7, 0xff, 0x8}, {0x4, 0x0, 0x1, 0x9e}, {0xcab0, 0x10, 0x0, 0x32}, {0x8, 0x40, 0x3, 0x8000}, {0xffff, 0x5, 0xbf, 0x3}, {0x2, 0x0, 0x5, 0x7ffd}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x40}}}]}}, {{0x8, 0x1, r3}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9e}}}]}}, {{0x8, 0x1, r11}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffe01}}, {0x8, 0x6, r12}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r13}, {0x140, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}]}, 0x4f8}, 0x1, 0x0, 0x0, 0x4}, 0x8000000) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_LIST(r14, &(0x7f0000001000)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000e80)={0x128, r15, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x10c, 0xc, 0x0, 0x1, [{0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4dba}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x24bf1aab}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x8bb8d5b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5829}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x41db}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2dc6c230}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa792}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5f6788f8}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb3de}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xecb7}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa2c6}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x10ff}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x832d}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x35f18839}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x54b7}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x69e3}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbb96}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd1b79fb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1ad8e43d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7282eb8f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2e1fa1dc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x43b30b6f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x17f0}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2798}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x566f55f1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x370e3cad}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x88e7cfb}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7c15714e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x24993ea}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r2, &(0x7f0000001040)={0x2000}) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000010c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r4, &(0x7f0000001180)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x24, r6, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r16}, @void}}, [@NL80211_ATTR_TDLS_ACTION={0x5, 0x88, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000001) getsockopt$SO_J1939_PROMISC(r0, 0x6b, 0x2, &(0x7f00000011c0), &(0x7f0000001200)=0x4) setsockopt$netrom_NETROM_T1(0xffffffffffffffff, 0x103, 0x1, &(0x7f0000001300)=0x5, 0x4) 136.110672ms ago: executing program 0 (id=3148): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000060000850000007700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYRESOCT=r1], 0x7c}}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001d40)={@fallback, 0xffffffffffffffff, 0x15}, 0x20) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a48000000060a0b040000000000000000020000001c0004801800018008000100647570000c00028008000140000000ff0900010073797a30000000000900020073797a32"], 0x70}}, 0x0) 130.615555ms ago: executing program 3 (id=3149): r0 = socket(0x18, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="020a000307000000000000000000000005001a00ac1e0001000000000000000000000000e000000100000000000000000000000000000d9f"], 0x38}}, 0x40000) bind$packet(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@newlinkprop={0xac, 0x6c, 0x800, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x1, 0x60}, [@IFLA_EXT_MASK={0x8, 0x1d, 0xb}, @IFLA_BROADCAST={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x6}, @IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GTP_RESTART_COUNT={0x5, 0x6, 0x3}, @IFLA_GTP_LOCAL6={0x14, 0x8, @local}, @IFLA_GTP_LOCAL={0x8, 0x7, @local}]}}}, @IFLA_LINKMODE={0x5}, @IFLA_WEIGHT={0x8, 0xf, 0x4}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x4}, @IFLA_PHYS_PORT_ID={0xf, 0x22, "73702bc878093b92e066b6"}, @IFLA_ALT_IFNAME={0x14, 0x35, 'batadv0\x00'}]}, 0xac}, 0x1, 0x0, 0x0, 0x20004801}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSETELEM={0x1844, 0xe, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x139c, 0x3, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @connlimit={{0xe}, @void}}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x82}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xfffffffffffffffe}]}, {0x1350, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x12bc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xb2, 0x1, "8cbca2b884350160f54dcab11f550bcafaf489e504c36e7d984b508715a91cfe8e1de0b96cd4e6a2cd71d86a911f0e83addf8c4bb1f2d1ea9751771d997213f16c5dbfc458fedba1b084979437042f94268f9fd93c908a51aa652a896f1840fb8c6e981a3f096c9cbb4378828c9aa9ae34f34651bce921dc12fba7ec3b8dc2a8f77f43b4ec3d8233b0219a432a578d98d112e56791a3b55097f936c2c4427d22fb81b95c5562dbef8955c2c327d9"}, @NFTA_DATA_VALUE={0xdd, 0x1, "65c870a3c3aadd3d8c1ae56c6e13a9b70334d44b06ef96e6a0edd1ee0979f9686e81d92fbcfc8a88f0412e6f25994798d4926671a63c8e3164c41ffa4fe882296637e4201e3d1fe9e5073b195b71e3394bbba046de575f71e575ae91154562f0c855121e50e3cb566260485250fd0138f24f75b89fb8c3138c849d3aac3e0f467a800794bbe999e3ab4f9c8e476e7137ed0b23660c42ce57d7c5db4e38e9a04bc878094e6e2827450810e9378955ffac1012d004a301915ab63583b3ba4b6f59dd4612c0bab76a37229b62057404f9efe41fdf52f5ff153054"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x9c, 0x1, "99fbfde592229ed6f2fa2c8e760e9f20c3a560dafb02531fb5e3c587b2634b839ea0dd00620b925fdc92ff65b457aa699049570a94da3df6c629d06ff6191bf40315716ae26dfe4535d8a00c1940f5a5229798fe4f38cc928bbacac9eb9449f3dda741f581c313af9544d1e9e60bc2f59b89110de509bbc7a07cdfa44c003288875ab049afcb002f268377ed015aebe48586aa4c2fae8dbb"}, @NFTA_DATA_VALUE={0x6a, 0x1, "149fbe80f1caff8c8a1b6dca8fe18b19e749e35f62d461c4343d7874680adba12580cad9fe9c39d9469a13dbe42b123b046f7e90684ff388a704d33411d19b05dc2dc4e9e0329221fc57301e10e5014fabe2b50a77a46c1dafa3671ed1a4d719af5adb7b392c"}, @NFTA_DATA_VALUE={0x1004, 0x1, "0964ef9e07cf23eba5620f1c91b717ee869b26914da88d5f60a3527e8fedc96318b8cd031f34a57bb3d9a74f471f2184897ea96843e7ecc4fa78a4d80494835ffae2545eaabfaa54ad6ba1a43141c358d322c6759558801220edc11260a53375f68685c4fa1263806aecd3be4f2d9402b2e5939d0ff7cae69001a4cbaaa8998f86599db46fb462b617add437bc415e96a81134992e7d4af62ce6da601352db03515e6772cc4c83df9e2ee9e9729156862501c5c465a3ea293eba33d2a9a9ec0a8aae6ccc697b92e829e267903ca6e3662be12c4a2d54e5372f211307152ba10de14fe1e1805d3559a4c9cc76cc4bf3bf657f56383db6051c16b972c4f4757eb657ba4423e128632aea625330f053a4c5aa5f649bae1a9f278ea6f46ad3c73acba8d10b806f94bb4d1a170e89a12b50cfd81cb2bde83f14f771b3eed7a37584679cded505681d7094174d835b36907758afbfad93f744baa7393f8e407b243befe64a31669659fde1ec1cf014321589f8fca8ead04899b24180cdf8651d2bc09467673c3d07a04121f024dbe1c271d26afe7d72b9a972cad420f91bd27cf11afea3c2512a3f5114e3f57b1fa6f29e0ca5cc3cf3b166aaf3c5d41ff2fc9808d628700c0c88ba002cfc3623c3ef9a4a26cbaed6ae9f54f1d54332d8ae68bf622a5b532d3b172fb2da8f845fcfa0c21e2c17f12ab6f5803edd2623a4555691391683a0f1983e82211668f0777da6016deae6c1325c69a3ab0162c6233b9acb042e88f0bd9a680b2daa0877822f9b6ea6fc4c9d43d7e7ad337d9b80ac380ae0d24960b4d96c5d9f9d498b9cded09e7a0b93560b74f8845f4398aac00336c515c4b280bd9e5db4631b2f5f0a485c20f79312c18b0ddb7e0e23b95d853e9b7f01fc79a1b1caac0a05ed15651a271c40853eb04a1310d08025f4643b9a95fce07645d0cc4c53db1c7853c7773fc29d4c144049ee206938e783c06335d1b78e7f4c2614032c5201eec3c92a5eb2a8dd412a2d0a890d03a91c7f85e7bdfddaef6d9834d9ad244c8b1d54b6a7ecf106106aaa1ef9d26c88c66a957aa907765ebfe2f29d217e76599c8341041e7c550d8dc8e8e8c03c8465b6fee16d4a5422244a2750ed7774942efec6e536942a452eb37841af6a59691c08c7bdf165da298a8944c70fb3dd9b7e245745e28d22644c230556d491afdf0b12aa14a5ba5f440ea2c414f9c1eb105097d9adc36d820c14332618ba895cdf213a0ccf0243bd06feb22fe7315ebb93968d4b13ca71d37593c83daa52cb52be6388944919e5861809ffc0b50aa64c29e816389d96887c891df03271ee9e7f8cfae7d26032fb00b7ce0219714f30303951cfce4180a14f52c1cbc095d61e10ab16224987760baa2caa0dfb6deac172f14a41b1bcc1a6d7e1d8bcb1de6a9ed82a970534901e8ac8e50cd88d5bc41c9c95beb205bba95d9e829505b281ff43edba690a022d35c9f39b470925d0bf10304891ed70ff0e698178e514e47276b9264a43ce53b7ba7ac603f39773da6b0abe86a534377a9781e93af92b4c62f426a5075274a5962309b1c7baa2b43f6c5732a1784995cb2b0daad6c2b4a432fee0821e6dba3b85ae2634a648afff2a4642791a798a45397a0aba40359a21d5e47efcfe6a7d3b7f9166f17fad9ea90ff4b2802c2ac1273292a58264e9a87acb4960b2c0216d757c3640497fbfe205f6236e5c1ee9af4aed9092054913eefaac8310bb3d14d0def2fade268eee41cdbc0e77cfdb582027379cdc26d248ea933a1d35d483c1cb66a520fd406cddb833f7af37eb2c05b47d885795ca8a8358edcda4b33d06cda635c61fdf2e55111452d895026f3fbb58cdcc57937b9b79893453db481d34f2ad6df5e6cc665c6753ac194b23de73d66122095ea76bcc135d4191d43d77464d10c9b1239ff748f9dc1de983729cfea4d5b5a9b49f5fbe54838b9cffa9dc9857772b03167f30cf21ea0592a97275b01d339f711ad96b635ac0f0ae95a0ac96224147379e553445c979613089c11a7a23c2c31d0cb4cb3da3b3f47da1a4928b3ed5d6cdecf1ea9007adbc748c34710258fb1a39eab84d5db3e6fbc0807f4e7d58f57e4d314d9803fc42d62c0b3fa351cb60e4a963cd53ba562bec1f8860363363ec69411d23f52fd209a09de06a5fbd99f968fd2d9d875d5c102921962fc3e514d815b083584c988d9cca3cfdd4ec8fd69ce7b6676e32f021d2aa28f6a6ae856204df44d802bf26a975f61f144d396875a3692f9cbdad3f19193216b7244d75780af14094278c77a5a0b806ae70d236f953cb730fc1228d4dab5e1d2c712c0608a702eb73a73ba6c87a534aac30f16d85c8763a6c97f815e3055c7b4bd0bdb87e70ea5aece0dc5eface9b5bb9542752ca5abcdfb8878f2e7015db55562ec96ceec858e627be7b85e057f261d4d4450bd5d4a001da97c8ac45abdfba540f53debc9381c95f1e5f960cb2114202fa99c8079e2ff857eb8ecd9d1d18baaa073e0ecf06df750f554d0158ff3be1d2088d60f48b1efbe69f87ded84cd4e9fe922b802b0f769e3d761c474062074c90f24dac945ec6a54388a1608787484e4cb812015fb48ee1948efc2032ee8eb8a0c58206a68a3c7c20fed408103caf1354e9d0fb33dc488a2cdd2a8bf84c10e24ea251532af69349d65fb110d0926e5db9ec77a0dc2f19ea523d1733a2a084f4209cb1e75ed674597fee43b42ffccd2e93ca64e41af3bd5d06d3f360698f1fa89f2a43931aa07a490157adf0bc3b606f98309a7462940bdf7eb0d0880b8eff5fc7f32d6d41a4720d86867cd0086cf4f20ab06c9c8201d7b6810a66e9964a3d892dc9bf70115b049ba2ca82b957fc61a6e2af91bc0a4fd5cd4d8c315747ff4da27cc48261d09224eb29da93f0b44d7cdd856594cb35cb580bedd02f8f8c94c0611e6f95837c464860578bd4d02d3c2287ccde70a5a212abf7f2db8c9da35db3548df009dd61445ef2aee849524b1f0e1719d6f9e6f30fcb599f152ea612b1da907db3a66af59cd97627b33b879b216da7111187652b3fa716a123f83fac9ace6b32a57b4d3dc4e68159842e38054cc97a9bce2214ec3e1a4c5c3f15ec29251be27bcd33da8784235a1bb4130d799ba6d6cceda0bc9e0ce10f708ecf529175420ee06b6794c82d071aa1a03e1e3469ab2cd1f3fa3515438fe5b4c12d454b5cb7a122fc1ef265f93c444e79204aeff2c6895aeb823ee0fcb5f17b7e297c88f3571afa09015b16c62f8e55dcbaa16d2254a4d04530702a28794ca9a5607447a7af51b1cb7069a0d6cd33a2b67d753a6b4f1570714e5116fd0fa87fb722e0833e7e258266a67844d10a03e380a929babc185d5ccbffd8e440b96d48fbeaa2528700e11fa637ed72110bb2f927f306f3e79ad823a934d27a6b3a17ec44fb7beaa36efd9a5fbe1bc3f2e4ea9f42837fc7f5e81b2445a6db02cca57b1056a5602794056a401dd4c89e29ba3a4a30482629d93970cb4cc866b6d00e4f37453f0b598a7df4791d40cab33255b86e229e9fe5ffd2fbfa580c43c4e1185958b9d4e0beb85dccc882db580b899d0ed4f8755c41198a4a6b87e038e52356431842da8ad90e9b65b39e7f9ddf5b45b748296fe6b8e862f04b957e63ef22a6ad3e2565c5306d821b97fdb371159d35ffd2267569e03c99ba021d68f36b788d4e3e09a014bf78f57ddf30e25fad1b98b173017179dde4e560d41322b1c7199f589014d8f029085e9422de2dcf6b082ce347dbec9fefce648646b3726db9ca1df98329b6809ab448b947b82cb018c3cb92a2c01428b70d2a3bdc0a05602e6fe9d7c52be027dd7a4a750c2e22081f60be546359a9f17f35ab1f413904c8d76a835a5078d75ad70369b72372b7bd029046360372cddb2dc7318f0600836c095a48f7dc67614b3ab46b05a176a54908aa6372de86f1d92d8833f89aeb96c89626d5f94ee9e49f825dfb06189e6268bd087d71f72b4f532680e56752545a1ea9c16ab645177b005bfaf7435cb22a4791f73d484e7c449a2fdc99530f9133c8b5a482eac0ff6bc1c598ddbcb6200fcdeca7bddbc85f538f0785015068626ec35c620c14309c7df96c35ffe06ad56f3877f6a7f5354ab646137dac2fda524e58f8e454d689a84f34469e201651b61d134386febfaf019ef1ebeacab92a950a42ad276b4a49c5a198673633ada1838249323973cc576e559be3f5d8a6410b060748d8cd06504efbfb787f17cbc5782776d9e31d7c82447ecb4171db8d60574531283da7337afeeeb87e9cc5ccefc41c475eee44e83a60e6284022cf8f4a4851a815ad2673c884e7186e32f274166fb335f15161202a960f0d78bccdc753e1051939cb58b4b73737a8dea4755e85931f0d50fe79d9d8e4b761002ef6f29c69f6ef29a9519501225d02528ca862d6ebea3f5252b356e2365cadda50e349449759f5f043ead51ea3e92d9ea2ebb5eee8ff4e1ea21a543d9f8336e1cf264b76e9385f5a1da4e61b9b10e6b39599442d8dc464f52de327fcff113070e0592233b9aa888bd0d53dc84f155d69e167a9ea0df5b75d45d9de4bba3e7f7d4c9607c0c4344a62d29103e1305f7ea3418afa846eda721074bc15e23cedebcadd055d7e38e5e140f7dca0a538c4197f8a2a23458c075df4f4d04af48f27a6c5a9d7a1d6f4254bb648c50a141a87c4a38a98dcbd6d507008d40289cd7275664e195133ae1a378b9f74acb29902f0e611e273f13a0a9e08a97f015c278512647010337b5f0800286899f55540392ff1156c33976841b3fe998c1c2f1cf2fc8b8a8685424d6db38165274c013fc7d6de0bd656fbe7a70016fe6db5e2016df610ad830a3e094907a80f89585f6cb9a0de31d91383fea030ca569766f3635f353fc24de9a9d6605679087718a42768c0d7c94d9c0f424386973048ac9e9d1cdf1de36a31d00b58d0521a6a5a097bc9b4abb47c2d01dd30fdab410ac8c74e977772fc5071644dd3c6d356654b45be3170338aeaf357149c4b29673fb68ba2442ab0034a4355b94fcfb585603e190f96278edcf8567924583d58842a151d7969b66ab97c31d9e8c4749949d6db52d7c96dede665e517acd690116ebdf12ef618cd3158ed70d4497f3cc74550b37c5a163d910035dc223f7b4f5f16ac8230b627627013e5fc7ddfb9eac8acbf00e5b4040b6abd7dfa9bb201a2a5d3c74877974ed54f9ad99eaadcedc039e256226d193816d4b423e190d1285657a788623044231aa10d27ccafecf4905974a72d6715c16287cc6ab0c094c0a0a8ccbccdfbdb83169a27ac96e1a79b3876da1a1ecb4187497dc0ce2020b80aa6eef434bf98a8fe00967adac7a3eb168f58c9e5f0e4625e7d2a0895949ef21137bb003a8c4744cf62e113e30c2710be25d7fa3d7d7fdbb8a293926af32d62ae072dfb5e3f89d44e15a4db7300173d58a2a02a162df64dd8e859ac4477b547c337840e05ecbd8fc5b538cbecc3635092b7d1084b5e9767bb314dbb8310b56151dd31bc159ba80b82bc033ad8d6b21764c606a7dcb6964a3deb06fbacc1baeb302af39dae49cd57296b5a840fb1a8b6e98c42197f79e1798835e6320ecad8b57bf569b9e4b24af22b9c86e4e89e4198d251bef19ddea36a73152f0d40bf34f19ff329e690d74a5a124ced0e52adfe2d484206d019be0dc2b16221717ea87e88a7b136e490fc1f383897f701ca0d2969bfb3b6774c942b5149dd316f8e5dc5441be0e6f02fd95444979e4078f23e6bff488b403319dfb3af04a72b2eb0f34f6a9655"}]}, @NFTA_SET_ELEM_KEY={0x60, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x5c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x30, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @byteorder={{0xe}, @void}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x494, 0x3, 0x0, 0x1, [{0x388, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_KEY={0x1c, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @hash={{0x9}, @void}}, @NFTA_SET_ELEM_DATA={0x44, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_EXPR={0x1c, 0x7, 0x0, 0x1, @meta={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xb}]}}}, @NFTA_SET_ELEM_USERDATA={0x79, 0x6, 0x1, 0x0, "1f6bab29b2d22b9ff157fc0114ba37c69fcfd8c5929beaa30d30703e721da1e53895541ee4f30a2d21f55556ed11b9531e74a4e9ab60f5d793ceca9cd740da0cef537a3ebc9ad6bfca97c876a08f7a51e10c232fe653952573b65c8d3fb2b87d25fea08a2d3b790c5d02c1d18403f853d8eb0cfda9"}, @NFTA_SET_ELEM_DATA={0x1b8, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x90386afd3a8530ff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x69, 0x1, "68f10162942dbd5827e01a6da5c170bb0ed66c99e7114d80441a429cdaf2c06d5eab5638dc396062474eb3bde39941e9823f5a97848d0201aff07cd6bd83fea3f01bd7794c6846b8a9bbe361fffdb0a72a5094217d10bd167f51eaea7b935d38a8db6c8e03"}, @NFTA_DATA_VALUE={0x73, 0x1, "7a2df5572a8bd88bf21df9f481dbf0ca5792a0db3eda420b53cd047292be6adb0343ce31c4612490df8c20a1825acd12ac5528c31c5e7da797602b75eaae5d746c99b4fa7fff539fa0b53088c78d7e7700cf20963e5109197b5c550c5a804209998c997d51554b92cc0b806a417930"}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_USERDATA={0x9f, 0x6, 0x1, 0x0, "27b0088373da01116a6e6d97e2207705b063243067fabf83b6fa6384f61cba419a0ecb182273bec1d1ab4482ddc93f4b6ac4f12b4ba1959206c2f7e4f791f98bd55ad4b9fcfec462611634f155d54fb169f4f81bebd1cf5649c0a4235841a7cf94e0906f834b453b452baa66c1e39fe1d1c85e265c3db37eb54ffba748432f2d9529a59a0c44d254dc7572ecaf4f88d6eff38662b1b603cf16fbcc"}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x8000000000000000}]}, {0xec, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_EXPIRATION={0xc}, @NFTA_SET_ELEM_USERDATA={0xd0, 0x6, 0x1, 0x0, "ee71054fb2e13c988fae4a0337b869660249cc70b458e21fe30f30362d333f77f244ecc21d45decf55f508252660da65cabc520c85dd85fe860f6386c5948677d9579e1cf728a671177e861be84f01b3c40f17bad50af0fceca0a3a70955061115bfa9a84cb0c5abd155b7b040adf23f8ed41040f1a50d36463caef5396e3518c24e10b0098693685625a150b8d9a64300962ab70d9bcefbfe453ed51a6af406ceeadc592f7aac819cdd83ba89f58351c429b16cce8595ddb03868c3928f5da785e124ff2dce562e9c63ed00"}]}, {0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x691bc4b9}]}]}]}, @NFT_MSG_NEWTABLE={0xe0, 0x0, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_TABLE_USERDATA={0x3a, 0x6, "7c80c4c191aba25a309521ab7cdfba2c683b477d428b04200b72cd77a2ad74d9e507f42f700d36d6407951572c302dc66b72bebf01c1"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x7c, 0x6, "c6d006a99262f63118ed1a8867f1d7836f5dd7184bed4b2420a2e91b1a618b47b6f3b85a3008574794fb2868142eb7ae6b7b8de5c46e4285ea72ad905c8d09249d76a78eaa38d86d5c9f61b4214f7819f8464300b28c1482bf8deaa60f263cfe81eca0228c9494973b257174bd4497719cf4a7ae0d4e0532"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}], {0x14, 0x10}}, 0x196c}}, 0x0) 112.008231ms ago: executing program 1 (id=3150): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000210000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) getpid() (async) getpid() r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000008c00)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="50558c", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a80)="fb24ba96", 0xc3fd}, {0x0, 0x11}], 0x2}}], 0x2, 0x20004810) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000780), 0x8) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0300000004000000040000000a2b", @ANYRES32=0x1, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000030000000100"/28], 0x50) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0300000004000000040000000a2b", @ANYRES32=0x1, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000030000000100"/28], 0x50) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) close(0x3) (async) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec850000007500000004"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00'}) socket$netlink(0x10, 0x3, 0x400000000000004) socket(0x1e, 0x4, 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000017000000540006803c0004"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000cc0)={0x1cc, r6, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x6c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x800000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x598}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffffd}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe99}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}]}]}, @TIPC_NLA_BEARER={0x18, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}]}, @TIPC_NLA_MEDIA={0x60, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}]}, @TIPC_NLA_LINK={0x40, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb5b5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x346b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}]}, @TIPC_NLA_MEDIA={0x94, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x37d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x40090}, 0x0) recvmsg$unix(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) connect$phonet_pipe(r4, &(0x7f0000000280)={0x23, 0x8, 0x3, 0x6}, 0x10) 98.672137ms ago: executing program 0 (id=3151): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(r0) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="55274e8ca414e8b5033b9bdf1fca69d7b30000007cb18e92a3c57a079920162f63fe9bf7ff83271333436f4eb7"], 0x14}, 0x1, 0x0, 0x0, 0x4004084}, 0x20000810) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000400)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x8000000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x34, 0x2, {{0x1, 0x2, 0x40, 0x7, 0xe9, 0xcc36}, [@TCA_NETEM_JITTER64={0xc, 0xb, 0x8}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0xff}]}}}]}, 0x64}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 3 (id=3152): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000005c0)={0x64, r5, 0x1, 0x0, 0x0, {0x49}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}]}, 0x64}}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x80000, {0x0, 0x0, 0x0, r8, {}, {0xffe6, 0xb}, {0xc, 0x1}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8}}]}, 0x40}, 0x1, 0x0, 0x0, 0x140480a4}, 0x4008000) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) kernel console output (not intermixed with test programs): ntered promiscuous mode [ 175.498054][T12510] syzkaller0: entered allmulticast mode [ 175.515767][T12513] tap0: tun_chr_ioctl cmd 2147767521 [ 175.553067][T12512] netlink: 'syz.0.1866': attribute type 20 has an invalid length. [ 175.874801][T12535] ip6gretap1: entered promiscuous mode [ 175.911256][T12537] netlink: 'syz.4.1875': attribute type 4 has an invalid length. [ 175.974396][T12542] __nla_validate_parse: 12 callbacks suppressed [ 175.974418][T12542] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1877'. [ 176.067433][T12551] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1877'. [ 176.100460][T12553] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1878'. [ 176.118274][T12555] netlink: 'syz.3.1880': attribute type 10 has an invalid length. [ 176.135742][T12551] hsr_slave_1 (unregistering): left promiscuous mode [ 176.146595][T12544] sctp: [Deprecated]: syz.1.1879 (pid 12544) Use of struct sctp_assoc_value in delayed_ack socket option. [ 176.146595][T12544] Use struct sctp_sack_info instead [ 176.177298][T12555] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 176.198679][T12544] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1879'. [ 176.322202][T12544] 8021q: adding VLAN 0 to HW filter on device bond1 [ 176.433663][T12569] 8021q: adding VLAN 0 to HW filter on device bond1 [ 176.447767][T12569] bond1: (slave vxcan1): The slave device specified does not support setting the MAC address [ 176.472143][T12569] bond1: (slave vxcan1): Error -95 calling set_mac_address [ 176.472886][T12579] sock: sock_timestamping_bind_phc: sock not bind to device [ 176.519972][T12577] tipc: Enabling of bearer rejected, already enabled [ 176.609127][T12582] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1885'. [ 176.622789][T12582] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1885'. [ 176.632256][T12582] netlink: 'syz.3.1885': attribute type 14 has an invalid length. [ 176.640754][T12582] netlink: 'syz.3.1885': attribute type 13 has an invalid length. [ 176.963916][T12613] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1891'. [ 177.031609][T12615] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 177.040069][T12615] batadv1: entered promiscuous mode [ 177.048032][T12615] batadv1: entered allmulticast mode [ 177.053928][T12615] team0: Failed to send options change via netlink (err -105) [ 177.075386][T12615] team0: Port device batadv1 added [ 177.147074][T12621] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1893'. [ 177.171783][T12626] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1896'. [ 177.181199][T12626] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1896'. [ 177.191838][T12626] netlink: 'syz.3.1896': attribute type 18 has an invalid length. [ 177.525445][ T8230] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 177.534851][ T8230] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 178.313853][T12680] netlink: 'syz.4.1907': attribute type 10 has an invalid length. [ 178.382058][T12684] lo speed is unknown, defaulting to 1000 [ 178.409817][T12684] lo speed is unknown, defaulting to 1000 [ 178.455413][T12684] lo speed is unknown, defaulting to 1000 [ 178.468245][T12684] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 178.491500][T12684] lo speed is unknown, defaulting to 1000 [ 178.498273][T12684] lo speed is unknown, defaulting to 1000 [ 178.506150][T12684] lo speed is unknown, defaulting to 1000 [ 178.513077][T12684] lo speed is unknown, defaulting to 1000 [ 178.519981][T12684] lo speed is unknown, defaulting to 1000 [ 178.649929][T12700] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 178.752800][T12707] ip6gre1: entered allmulticast mode [ 178.794078][T12704] syzkaller1: entered promiscuous mode [ 178.802174][T12704] syzkaller1: entered allmulticast mode [ 178.882230][T12716] lo speed is unknown, defaulting to 1000 [ 178.920599][T12716] sit0: left promiscuous mode [ 178.928870][T12716] veth0_to_team: left promiscuous mode [ 178.934491][T12716] veth0_to_team: left allmulticast mode [ 178.941896][T12716] net_ratelimit: 19 callbacks suppressed [ 178.941918][T12716] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 178.969285][T12718] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 179.588254][T12736] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.622567][T12738] sctp: [Deprecated]: syz.0.1929 (pid 12738) Use of int in max_burst socket option. [ 179.622567][T12738] Use struct sctp_assoc_value instead [ 179.643860][T12738] syzkaller0: entered promiscuous mode [ 179.650173][T12738] syzkaller0: entered allmulticast mode [ 179.764241][T12741] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.777569][T12741] tipc: Failed to remove unknown binding: 66,1,1/0:3463857320/3463857322 [ 180.121157][T12770] validate_nla: 4 callbacks suppressed [ 180.121176][T12770] netlink: 'syz.1.1940': attribute type 2 has an invalid length. [ 180.159295][T12770] k›*·]‘: entered promiscuous mode [ 180.229485][T12776] netlink: 'syz.2.1942': attribute type 10 has an invalid length. [ 180.311615][T12781] netlink: 'syz.4.1941': attribute type 13 has an invalid length. [ 180.322619][T12780] syzkaller0: entered promiscuous mode [ 180.330747][T12780] syzkaller0: entered allmulticast mode [ 180.417266][T12781] netlink: 'syz.4.1941': attribute type 17 has an invalid length. [ 180.596655][T12740] tipc: Failed to remove unknown binding: 66,1,1/0:3463857320/3463857322 [ 180.608546][T12740] tipc: Failed to remove unknown binding: 66,1,1/0:3463857320/3463857322 [ 181.057787][T12781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 181.099083][T12781] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 181.137909][T12782] lo speed is unknown, defaulting to 1000 [ 181.143973][T12795] sysfs: cannot create duplicate filename '/class/ieee80211/žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»–_à›xDä±pj8¼•TTí!' [ 181.160243][T12795] CPU: 1 UID: 0 PID: 12795 Comm: syz.1.1946 Not tainted syzkaller #0 PREEMPT(full) [ 181.160273][T12795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 181.160286][T12795] Call Trace: [ 181.160293][T12795] [ 181.160301][T12795] dump_stack_lvl+0x189/0x250 [ 181.160329][T12795] ? __pfx_dump_stack_lvl+0x10/0x10 [ 181.160350][T12795] ? __pfx__printk+0x10/0x10 [ 181.160371][T12795] ? kernfs_root+0x1c/0x230 [ 181.160401][T12795] ? kernfs_path_from_node+0x2f/0x290 [ 181.160420][T12795] ? kernfs_path_from_node+0x250/0x290 [ 181.160438][T12795] ? kernfs_path_from_node+0x2f/0x290 [ 181.160459][T12795] sysfs_warn_dup+0x8e/0xa0 [ 181.160478][T12795] sysfs_do_create_link_sd+0xc0/0x110 [ 181.160498][T12795] device_add_class_symlinks+0x1cf/0x240 [ 181.160519][T12795] device_add+0x475/0xb50 [ 181.160538][T12795] wiphy_register+0x1ba6/0x28d0 [ 181.160572][T12795] ? __pfx_wiphy_register+0x10/0x10 [ 181.160595][T12795] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 181.160619][T12795] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 181.160641][T12795] ieee80211_register_hw+0x3425/0x4080 [ 181.160668][T12795] ? ieee80211_register_hw+0x14c1/0x4080 [ 181.160693][T12795] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 181.160715][T12795] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 181.160742][T12795] ? __hrtimer_setup+0x187/0x210 [ 181.160759][T12795] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 181.160785][T12795] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 181.160822][T12795] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 181.160843][T12795] ? trace_kmalloc+0x1f/0xd0 [ 181.160864][T12795] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 181.160888][T12795] ? kstrndup+0xbf/0x160 [ 181.160911][T12795] hwsim_new_radio_nl+0xea4/0x1b10 [ 181.160934][T12795] ? __pfx___nla_validate_parse+0x10/0x10 [ 181.160989][T12795] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 181.161018][T12795] ? __nla_parse+0x40/0x60 [ 181.161042][T12795] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 181.161068][T12795] genl_family_rcv_msg_doit+0x212/0x300 [ 181.161093][T12795] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 181.161120][T12795] ? bpf_lsm_capable+0x9/0x20 [ 181.161143][T12795] ? security_capable+0x7e/0x2e0 [ 181.161171][T12795] genl_rcv_msg+0x60e/0x790 [ 181.161193][T12795] ? __pfx_genl_rcv_msg+0x10/0x10 [ 181.161211][T12795] ? __kasan_slab_alloc+0x6c/0x80 [ 181.161233][T12795] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 181.161256][T12795] ? __netlink_lookup+0xbd/0x810 [ 181.161271][T12795] ? rcu_is_watching+0x15/0xb0 [ 181.161293][T12795] netlink_rcv_skb+0x208/0x470 [ 181.161318][T12795] ? __pfx_genl_rcv_msg+0x10/0x10 [ 181.161338][T12795] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 181.161368][T12795] ? lock_release+0x4b/0x3e0 [ 181.161399][T12795] ? down_read+0x1ad/0x2e0 [ 181.161418][T12795] genl_rcv+0x28/0x40 [ 181.161437][T12795] netlink_unicast+0x82f/0x9e0 [ 181.161465][T12795] ? __pfx_netlink_unicast+0x10/0x10 [ 181.161488][T12795] ? netlink_sendmsg+0x642/0xb30 [ 181.161504][T12795] ? skb_put+0x11b/0x210 [ 181.161523][T12795] netlink_sendmsg+0x805/0xb30 [ 181.161544][T12795] ? __pfx_netlink_sendmsg+0x10/0x10 [ 181.161562][T12795] ? aa_sock_msg_perm+0xf1/0x1d0 [ 181.161579][T12795] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 181.161598][T12795] ? __pfx_netlink_sendmsg+0x10/0x10 [ 181.161615][T12795] __sock_sendmsg+0x219/0x270 [ 181.161639][T12795] ____sys_sendmsg+0x505/0x830 [ 181.161660][T12795] ? __pfx_____sys_sendmsg+0x10/0x10 [ 181.161683][T12795] ? import_iovec+0x74/0xa0 [ 181.161704][T12795] ___sys_sendmsg+0x21f/0x2a0 [ 181.161723][T12795] ? __pfx____sys_sendmsg+0x10/0x10 [ 181.161745][T12795] ? futex_wake+0x4b2/0x560 [ 181.161781][T12795] ? __fget_files+0x2a/0x420 [ 181.161796][T12795] ? __fget_files+0x3a0/0x420 [ 181.161817][T12795] __x64_sys_sendmsg+0x19b/0x260 [ 181.161837][T12795] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 181.161867][T12795] ? rcu_is_watching+0x15/0xb0 [ 181.161886][T12795] ? rcu_is_watching+0x15/0xb0 [ 181.161905][T12795] do_syscall_64+0xfa/0x3b0 [ 181.161923][T12795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.161942][T12795] ? clear_bhb_loop+0x60/0xb0 [ 181.161962][T12795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.161979][T12795] RIP: 0033:0x7f3107f8ebe9 [ 181.161997][T12795] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 181.162014][T12795] RSP: 002b:00007f3108e0d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 181.162035][T12795] RAX: ffffffffffffffda RBX: 00007f31081b5fa0 RCX: 00007f3107f8ebe9 [ 181.162049][T12795] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000006 [ 181.162062][T12795] RBP: 00007f3108011e19 R08: 0000000000000000 R09: 0000000000000000 [ 181.162074][T12795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 181.162086][T12795] R13: 00007f31081b6038 R14: 00007f31081b5fa0 R15: 00007ffed76fce58 [ 181.162108][T12795] [ 181.756139][ T848] IPVS: starting estimator thread 0... [ 181.763857][T12807] __nla_validate_parse: 11 callbacks suppressed [ 181.763888][T12807] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1949'. [ 181.784124][T12807] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1949'. [ 181.889825][T12804] IPVS: using max 45 ests per chain, 108000 per kthread [ 181.999997][T12824] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1953'. [ 182.111591][T12830] veth0_to_bridge: entered promiscuous mode [ 182.118497][T12830] veth0_to_bridge: left promiscuous mode [ 182.390047][T12841] tipc: Enabling of bearer rejected, already enabled [ 182.410823][T12841] tipc: Resetting bearer [ 182.470554][T12851] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1957'. [ 182.610655][T12860] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1960'. [ 182.650226][T12860] IPVS: Unknown mcast interface: batadv0 [ 182.709716][T12867] team0: Mode "" not found [ 182.777591][T12873] gretap0: mtu less than device minimum [ 182.868807][T12878] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1965'. [ 182.899158][T12878] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 182.923095][T12883] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1967'. [ 182.935885][T12880] pimreg: entered allmulticast mode [ 182.955264][T12883] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1967'. [ 183.319098][T12911] netlink: 'syz.2.1973': attribute type 1 has an invalid length. [ 183.353296][T12905] gretap1: entered allmulticast mode [ 183.363015][T12905] bond4: (slave gretap1): making interface the new active one [ 183.372940][T12905] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 183.425692][T12914] netlink: 'syz.2.1974': attribute type 1 has an invalid length. [ 183.461399][T12914] 8021q: adding VLAN 0 to HW filter on device bond5 [ 183.490289][T12914] vlan2: entered allmulticast mode [ 183.505602][T12914] batadv0: entered allmulticast mode [ 183.526965][T12914] bond5: (slave vlan2): Opening slave failed [ 183.610175][T12917] lo speed is unknown, defaulting to 1000 [ 183.873988][T12945] netlink: 'syz.2.1981': attribute type 8 has an invalid length. [ 184.003283][T12956] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 184.012451][T12957] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1985'. [ 184.041844][T12957] IPVS: Unknown mcast interface: batadv0 [ 184.093550][T12967] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1987'. [ 184.151578][T12971] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 184.159149][T12971] IPv6: NLM_F_CREATE should be set when creating new route [ 184.166608][T12971] IPv6: NLM_F_CREATE should be set when creating new route [ 184.174542][T12971] IPv6: NLM_F_CREATE should be set when creating new route [ 184.183512][T12971] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 184.308357][T12979] tipc: Enabled bearer , priority 0 [ 184.320010][T12979] syzkaller0: entered promiscuous mode [ 184.326069][T12979] syzkaller0: entered allmulticast mode [ 184.341470][T12979] tipc: Resetting bearer [ 184.373477][T12985] team_slave_0: left promiscuous mode [ 184.383871][T12985] team0: Port device team_slave_0 removed [ 184.390942][T12985] team_slave_1: left promiscuous mode [ 184.401514][T12985] team0: Port device team_slave_1 removed [ 184.408451][T12985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 184.421204][T12985] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 184.433328][T12985] batman_adv: batadv0: Removing interface: virt_wifi0 [ 184.441992][T12985] bond0: (slave veth7): Releasing active interface [ 184.453486][T12985] batadv1: left promiscuous mode [ 184.461503][T12985] team0: Port device batadv1 removed [ 184.470445][T12985] bond4: (slave gretap1): Releasing active interface [ 184.482141][T12979] tipc: Resetting bearer [ 184.517228][T12979] tipc: Disabling bearer [ 184.561522][T12984] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 184.906904][T13012] sctp: [Deprecated]: syz.1.1999 (pid 13012) Use of struct sctp_assoc_value in delayed_ack socket option. [ 184.906904][T13012] Use struct sctp_sack_info instead [ 184.937095][ T8226] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.945927][ T8226] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.954497][ T8226] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.969695][ T8226] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.999445][T13018] sctp: [Deprecated]: syz.1.1999 (pid 13018) Use of struct sctp_assoc_value in delayed_ack socket option. [ 184.999445][T13018] Use struct sctp_sack_info instead [ 185.033839][T13012] syzkaller1: entered promiscuous mode [ 185.063183][T13012] syzkaller1: entered allmulticast mode [ 185.159278][T13012] syzkaller1: left promiscuous mode [ 185.181006][T13012] syzkaller1: left allmulticast mode [ 185.209154][T13033] netlink: 'syz.3.2006': attribute type 1 has an invalid length. [ 185.256710][T13033] netlink: 'syz.3.2006': attribute type 2 has an invalid length. [ 185.376879][T13036] lo speed is unknown, defaulting to 1000 [ 185.482322][T13050] IPVS: Unknown mcast interface: batadv0 [ 185.519542][T13037] lo speed is unknown, defaulting to 1000 [ 185.562054][T13053] tipc: Started in network mode [ 185.576274][T13053] tipc: Node identity ba9cd89e94c9, cluster identity 4711 [ 185.604056][T13053] tipc: Enabled bearer , priority 0 [ 185.621232][T13055] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 185.658518][T13061] syzkaller0: entered promiscuous mode [ 185.664036][T13061] syzkaller0: entered allmulticast mode [ 185.710567][T13053] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 185.744356][T13053] tipc: Resetting bearer [ 185.815208][T13052] tipc: Resetting bearer [ 185.836161][T13052] tipc: Disabling bearer [ 185.862187][T13071] lo speed is unknown, defaulting to 1000 [ 185.998691][T13077] netlink: 'syz.3.2016': attribute type 3 has an invalid length. [ 186.921092][T13087] tipc: Enabled bearer , priority 0 [ 186.943417][T13097] __nla_validate_parse: 6 callbacks suppressed [ 186.943434][T13097] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2020'. [ 186.977574][T13087] tipc: Resetting bearer [ 186.980247][T13097] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2020'. [ 186.995998][T13087] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2021'. [ 187.004398][T13102] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2023'. [ 187.014823][T13087] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2021'. [ 187.019436][T13097] netlink: 'syz.2.2020': attribute type 18 has an invalid length. [ 187.024516][T13087] netlink: 'syz.3.2021': attribute type 6 has an invalid length. [ 187.049869][T13087] netlink: 'syz.3.2021': attribute type 5 has an invalid length. [ 187.070417][T13087] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2021'. [ 187.084225][T13109] sysfs: cannot create duplicate filename '/class/ieee80211/žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»–_à›xDä±pj8¼•TTí!' [ 187.118606][T13109] CPU: 0 UID: 0 PID: 13109 Comm: syz.1.2025 Not tainted syzkaller #0 PREEMPT(full) [ 187.118635][T13109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 187.118647][T13109] Call Trace: [ 187.118654][T13109] [ 187.118662][T13109] dump_stack_lvl+0x189/0x250 [ 187.118690][T13109] ? __pfx_dump_stack_lvl+0x10/0x10 [ 187.118711][T13109] ? __pfx__printk+0x10/0x10 [ 187.118732][T13109] ? kernfs_root+0x1c/0x230 [ 187.118753][T13109] ? kernfs_path_from_node+0x2f/0x290 [ 187.118779][T13109] ? kernfs_path_from_node+0x250/0x290 [ 187.118798][T13109] ? kernfs_path_from_node+0x2f/0x290 [ 187.118819][T13109] sysfs_warn_dup+0x8e/0xa0 [ 187.118838][T13109] sysfs_do_create_link_sd+0xc0/0x110 [ 187.118857][T13109] device_add_class_symlinks+0x1cf/0x240 [ 187.118879][T13109] device_add+0x475/0xb50 [ 187.118897][T13109] wiphy_register+0x1ba6/0x28d0 [ 187.118931][T13109] ? __pfx_wiphy_register+0x10/0x10 [ 187.118954][T13109] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 187.118977][T13109] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 187.118998][T13109] ieee80211_register_hw+0x3425/0x4080 [ 187.119029][T13109] ? ieee80211_register_hw+0x14c1/0x4080 [ 187.119053][T13109] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 187.119074][T13109] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 187.119101][T13109] ? __hrtimer_setup+0x187/0x210 [ 187.119118][T13109] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 187.119144][T13109] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 187.119179][T13109] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 187.119200][T13109] ? trace_kmalloc+0x1f/0xd0 [ 187.119220][T13109] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 187.119244][T13109] ? kstrndup+0xbf/0x160 [ 187.119265][T13109] hwsim_new_radio_nl+0xea4/0x1b10 [ 187.119289][T13109] ? __pfx___nla_validate_parse+0x10/0x10 [ 187.119320][T13109] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 187.119347][T13109] ? __nla_parse+0x40/0x60 [ 187.119370][T13109] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 187.119393][T13109] genl_family_rcv_msg_doit+0x212/0x300 [ 187.119415][T13109] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 187.119440][T13109] ? bpf_lsm_capable+0x9/0x20 [ 187.119462][T13109] ? security_capable+0x7e/0x2e0 [ 187.119488][T13109] genl_rcv_msg+0x60e/0x790 [ 187.119509][T13109] ? __pfx_genl_rcv_msg+0x10/0x10 [ 187.119526][T13109] ? __kasan_slab_alloc+0x6c/0x80 [ 187.119545][T13109] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 187.119563][T13109] ? __netlink_lookup+0xbd/0x810 [ 187.119577][T13109] ? rcu_is_watching+0x15/0xb0 [ 187.119595][T13109] netlink_rcv_skb+0x208/0x470 [ 187.119616][T13109] ? __pfx_genl_rcv_msg+0x10/0x10 [ 187.119633][T13109] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 187.119658][T13109] ? lock_release+0x4b/0x3e0 [ 187.119680][T13109] ? down_read+0x1ad/0x2e0 [ 187.119696][T13109] genl_rcv+0x28/0x40 [ 187.119711][T13109] netlink_unicast+0x82f/0x9e0 [ 187.119734][T13109] ? __pfx_netlink_unicast+0x10/0x10 [ 187.119754][T13109] ? netlink_sendmsg+0x642/0xb30 [ 187.119767][T13109] ? skb_put+0x11b/0x210 [ 187.119791][T13109] netlink_sendmsg+0x805/0xb30 [ 187.119809][T13109] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.119824][T13109] ? futex_unqueue+0x22/0x240 [ 187.119841][T13109] ? aa_sock_msg_perm+0xf1/0x1d0 [ 187.119857][T13109] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 187.119874][T13109] ? __pfx_netlink_sendmsg+0x10/0x10 [ 187.119890][T13109] __sock_sendmsg+0x219/0x270 [ 187.119914][T13109] ____sys_sendmsg+0x505/0x830 [ 187.119934][T13109] ? __pfx_____sys_sendmsg+0x10/0x10 [ 187.119953][T13109] ? import_iovec+0x74/0xa0 [ 187.119973][T13109] ___sys_sendmsg+0x21f/0x2a0 [ 187.119997][T13109] ? __pfx____sys_sendmsg+0x10/0x10 [ 187.120018][T13109] ? futex_wait+0x285/0x360 [ 187.120054][T13109] ? __fget_files+0x2a/0x420 [ 187.120069][T13109] ? __fget_files+0x3a0/0x420 [ 187.120090][T13109] __x64_sys_sendmsg+0x19b/0x260 [ 187.120108][T13109] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 187.120130][T13109] ? rcu_is_watching+0x15/0xb0 [ 187.120147][T13109] ? rcu_is_watching+0x15/0xb0 [ 187.120161][T13109] do_syscall_64+0xfa/0x3b0 [ 187.120177][T13109] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.120195][T13109] ? clear_bhb_loop+0x60/0xb0 [ 187.120214][T13109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.120231][T13109] RIP: 0033:0x7f3107f8ebe9 [ 187.120249][T13109] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 187.120266][T13109] RSP: 002b:00007f3108dec038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 187.120286][T13109] RAX: ffffffffffffffda RBX: 00007f31081b6090 RCX: 00007f3107f8ebe9 [ 187.120300][T13109] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000008 [ 187.120312][T13109] RBP: 00007f3108011e19 R08: 0000000000000000 R09: 0000000000000000 [ 187.120324][T13109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 187.120334][T13109] R13: 00007f31081b6128 R14: 00007f31081b6090 R15: 00007ffed76fce58 [ 187.120354][T13109] [ 187.629069][T13086] tipc: Disabling bearer [ 187.715917][T13123] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2029'. [ 187.748988][T13124] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2026'. [ 187.894370][T13142] lo speed is unknown, defaulting to 1000 [ 188.046713][T13157] netlink: 'syz.3.2038': attribute type 1 has an invalid length. [ 188.130138][T13162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2038'. [ 188.166190][T13162] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2038'. [ 188.912376][T13197] netlink: 'syz.3.2044': attribute type 6 has an invalid length. [ 189.156814][T13207] sctp: [Deprecated]: syz.3.2050 (pid 13207) Use of int in max_burst socket option deprecated. [ 189.156814][T13207] Use struct sctp_assoc_value instead [ 189.158914][T13205] netlink: zone id is out of range [ 189.194608][T13205] netlink: zone id is out of range [ 189.201568][T13205] netlink: zone id is out of range [ 189.207437][T13205] netlink: zone id is out of range [ 189.213813][T13205] netlink: zone id is out of range [ 189.230936][T13205] netlink: zone id is out of range [ 189.238869][T13205] netlink: zone id is out of range [ 189.263408][T13205] netlink: zone id is out of range [ 189.363096][T13220] netlink: 'syz.3.2056': attribute type 3 has an invalid length. [ 189.388841][T13217] netlink: 'syz.2.2055': attribute type 30 has an invalid length. [ 189.798984][T13230] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 189.807385][T13230] net_ratelimit: 16 callbacks suppressed [ 189.807406][T13230] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 189.836793][T13234] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 189.847636][T13234] bond0 (unregistering): Released all slaves [ 189.861493][T13230] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.895072][T13237] ip6tnl2: entered promiscuous mode [ 189.900399][T13237] ip6tnl2: entered allmulticast mode [ 189.936185][T13230] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.963362][T13230] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.020456][T13230] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.093721][T13259] ip6gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 190.114137][ T8229] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.123605][ T30] audit: type=1107 audit(1756313055.925:3): pid=13258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 190.164913][ T8230] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.181140][ T8230] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.189910][ T8230] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.268210][T13261] lo speed is unknown, defaulting to 1000 [ 190.684635][T13281] tipc: Enabling of bearer rejected, failed to enable media [ 190.933993][T13302] tipc: Enabled bearer , priority 0 [ 190.970841][T13302] D: renamed from syzkaller0 [ 190.978660][T13302] tipc: Disabling bearer [ 191.087653][T13311] pim6reg: left allmulticast mode [ 191.248604][T13319] ipvlan3: entered promiscuous mode [ 192.030935][T13351] team0: Caught tx_queue_len zero misconfig [ 192.053486][T13353] validate_nla: 5 callbacks suppressed [ 192.053504][T13353] netlink: 'syz.1.2096': attribute type 1 has an invalid length. [ 192.077403][T13353] __nla_validate_parse: 19 callbacks suppressed [ 192.077667][T13353] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2096'. [ 192.245177][T13356] block nbd1: server does not support multiple connections per device. [ 192.259804][T13356] block nbd1: shutting down sockets [ 193.118161][T13369] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2102'. [ 193.807830][T13401] lo speed is unknown, defaulting to 1000 [ 193.978689][T13408] tipc: Enabled bearer , priority 0 [ 193.986365][T13408] syzkaller0: entered promiscuous mode [ 193.992044][T13408] syzkaller0: entered allmulticast mode [ 194.115482][T13415] tipc: Resetting bearer [ 194.182607][T13407] tipc: Resetting bearer [ 194.230526][T13407] tipc: Disabling bearer [ 194.247594][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.392004][T13427] netlink: 'syz.0.2121': attribute type 1 has an invalid length. [ 194.416053][T13427] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2121'. [ 194.437719][T13431] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2123'. [ 194.453585][T13431] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 194.714623][T13453] tipc: Enabled bearer , priority 0 [ 194.726901][T13453] syzkaller0: entered promiscuous mode [ 194.732482][T13453] syzkaller0: entered allmulticast mode [ 194.748495][T13458] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2131'. [ 194.771283][T13453] tipc: Resetting bearer [ 194.789770][T13452] tipc: Resetting bearer [ 194.802363][T13452] tipc: Disabling bearer [ 194.937526][T13471] siw: device registration error -23 [ 195.081810][T13497] netlink: 'syz.3.2140': attribute type 9 has an invalid length. [ 195.121688][T13501] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2143'. [ 195.130941][T13501] netlink: 'syz.2.2143': attribute type 2 has an invalid length. [ 195.140790][T13501] netlink: 'syz.2.2143': attribute type 10 has an invalid length. [ 195.149118][T13501] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2143'. [ 195.160639][T13501] !: entered promiscuous mode [ 195.167019][T13501] !: entered allmulticast mode [ 195.167592][T13500] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2139'. [ 195.172577][T13501] A link change request failed with some changes committed already. Interface 0! may have been left with an inconsistent configuration, please check. [ 195.249049][T13507] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2144'. [ 195.278289][T13507] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2144'. [ 195.578036][T13524] lo speed is unknown, defaulting to 1000 [ 195.620131][T13533] tipc: Enabled bearer , priority 14 [ 195.633010][T13533] tipc: Enabling of bearer rejected, failed to enable media [ 195.788797][T13559] tipc: Enabled bearer , priority 0 [ 195.797774][T13559] syzkaller0: entered promiscuous mode [ 195.803386][T13559] syzkaller0: entered allmulticast mode [ 195.819492][T13558] tipc: Resetting bearer [ 195.830960][T13558] tipc: Disabling bearer [ 195.909996][T13568] vlan2: entered promiscuous mode [ 195.915726][T13568] erspan0: entered promiscuous mode [ 196.164185][T13595] team0: left allmulticast mode [ 196.170301][T13595] team0: left promiscuous mode [ 196.175451][T13595] bridge0: port 1(team0) entered disabled state [ 196.184587][T13595] bond0: (slave bond3): Releasing backup interface [ 196.219769][T13594] A link change request failed with some changes committed already. Interface bond2 may have been left with an inconsistent configuration, please check. [ 196.556718][T13614] netlink: get zone limit has 8 unknown bytes [ 196.745069][ T7242] tipc: Node number set to 54294215 [ 196.766923][T13623] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 196.788549][T13623] mac80211_hwsim hwsim4 wlan0: Caught tx_queue_len zero misconfig [ 196.837788][T13623] batadv_slave_0: entered promiscuous mode [ 196.922560][T13627] netlink: 'syz.3.2178': attribute type 1 has an invalid length. [ 196.941234][T13627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.956722][T13627] bond0: (slave geneve2): making interface the new active one [ 196.965771][T13627] bond0: (slave geneve2): Enslaving as an active interface with an up link [ 196.974500][ T1159] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.983384][ T1159] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.994391][ T1159] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.004608][ T1159] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 197.106464][T13639] tipc: Enabled bearer , priority 0 [ 197.114449][T13639] syzkaller0: entered promiscuous mode [ 197.120766][T13639] syzkaller0: entered allmulticast mode [ 197.131110][T13641] netlink: 'syz.3.2183': attribute type 4 has an invalid length. [ 197.145418][T13639] __nla_validate_parse: 8 callbacks suppressed [ 197.145437][T13639] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2182'. [ 197.162490][T13638] tipc: Resetting bearer [ 197.170782][T13638] tipc: Disabling bearer [ 197.564490][T13665] team0: Mode changed to "loadbalance" [ 197.573191][T13665] syzkaller0: entered promiscuous mode [ 197.579741][T13665] syzkaller0: entered allmulticast mode [ 197.593859][T13670] team0: Unable to change to the same mode the team is in [ 197.624130][T13668] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2189'. [ 197.671160][T13674] lo speed is unknown, defaulting to 1000 [ 197.679132][T13677] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 197.730458][T13677] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 197.799280][T13677] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 197.889526][T13677] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 198.022907][T13693] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2199'. [ 198.032475][T13693] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2199'. [ 198.041787][T13693] netlink: 31 bytes leftover after parsing attributes in process `syz.3.2199'. [ 198.051188][T13693] netlink: 'syz.3.2199': attribute type 3 has an invalid length. [ 198.059659][T13693] netlink: 'syz.3.2199': attribute type 2 has an invalid length. [ 198.068805][T13693] netlink: 31 bytes leftover after parsing attributes in process `syz.3.2199'. [ 198.069857][ T8227] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.078370][T13693] netlink: 'syz.3.2199': attribute type 2 has an invalid length. [ 198.117357][ T8227] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.146717][ T8227] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.187880][ T8227] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.457843][T13709] lo speed is unknown, defaulting to 1000 [ 198.480517][T13711] netlink: 64991 bytes leftover after parsing attributes in process `syz.2.2204'. [ 198.583791][T13717] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2206'. [ 198.608244][T13717] bridge_slave_0: entered allmulticast mode [ 198.676884][T13717] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2206'. [ 199.135686][T13743] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2214'. [ 199.159724][T13743] bridge5: entered promiscuous mode [ 199.167743][T13743] bridge5: entered allmulticast mode [ 199.245638][T13754] tun0: tun_chr_ioctl cmd 2148045848 [ 199.374457][T13764] bond2: (slave ip6gretap2): making interface the new active one [ 199.386016][T13764] bond2: (slave ip6gretap2): Enslaving as an active interface with an up link [ 199.421822][T13775] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 199.465740][T13780] tipc: Enabled bearer , priority 0 [ 199.485091][T13780] syzkaller0: entered promiscuous mode [ 199.490605][T13780] syzkaller0: entered allmulticast mode [ 199.517591][T13775] 8021q: VLANs not supported on ip_vti0 [ 199.546119][T13775] netlink: 'syz.2.2220': attribute type 30 has an invalid length. [ 199.562066][T13775] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 199.589231][T13775] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 199.599759][T13779] tipc: Resetting bearer [ 199.607568][T13779] tipc: Disabling bearer [ 199.641270][T13788] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 199.665375][ T8223] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.677621][ T8223] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.706566][ T8223] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.726386][ T8223] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.814433][T13799] team0: No ports can be present during mode change [ 199.831542][T13800] netlink: 'syz.1.2230': attribute type 7 has an invalid length. [ 200.737837][T13821] netlink: 'syz.0.2234': attribute type 10 has an invalid length. [ 200.812452][T13830] tipc: Enabling of bearer rejected, already enabled [ 200.823129][T13831] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 200.843354][ T8227] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.870676][ T8227] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.881451][ T8227] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.894526][ T8227] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 200.930944][T13836] (unnamed net_device) (uninitialized): option ad_select: invalid value (34) [ 200.974247][ T1159] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.006381][ T1159] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.026874][ T1159] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.041968][ T1159] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.738399][T13885] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 201.745744][T13885] IPv6: NLM_F_CREATE should be set when creating new route [ 201.753007][T13885] IPv6: NLM_F_CREATE should be set when creating new route [ 201.760449][T13885] IPv6: NLM_F_CREATE should be set when creating new route [ 201.890953][T13879] !: left promiscuous mode [ 201.896828][T13879] !: left allmulticast mode [ 201.908971][T13879] veth0_to_team: left promiscuous mode [ 201.914743][T13879] veth0_to_team: left allmulticast mode [ 201.920680][T13879] batadv_slave_1: left promiscuous mode [ 201.931343][T13879] 0·: left allmulticast mode [ 201.937467][T13879] hsr_slave_0: left allmulticast mode [ 201.943176][T13879] hsr_slave_1: left allmulticast mode [ 201.960500][T13879] ipvlan2: left promiscuous mode [ 201.972042][T13879] mac80211_hwsim hwsim12 wlan1: left promiscuous mode [ 201.979658][T13879] macvtap0: left promiscuous mode [ 201.988250][T13879] ip6gre1: left allmulticast mode [ 201.995487][T13879] gretap1: left allmulticast mode [ 202.007358][T13879] bridge5: left promiscuous mode [ 202.012366][T13879] bridge5: left allmulticast mode [ 202.173885][T13894] netlink: 'syz.4.2256': attribute type 1 has an invalid length. [ 202.190238][T13894] __nla_validate_parse: 16 callbacks suppressed [ 202.190256][T13894] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2256'. [ 202.215203][T13894] tipc: Enabling of bearer rejected, already enabled [ 202.300170][T13903] netlink: 'syz.2.2258': attribute type 13 has an invalid length. [ 202.322584][T13903] netlink: 'syz.2.2258': attribute type 17 has an invalid length. [ 202.392924][T13903] 8021q: adding VLAN 0 to HW filter on device team0 [ 202.418898][T13909] netlink: 'syz.0.2261': attribute type 10 has an invalid length. [ 202.429539][T13909] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2261'. [ 202.439960][T13903] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 202.457374][T13914] netlink: 'syz.3.2260': attribute type 3 has an invalid length. [ 202.483572][T13909] veth0_vlan: entered allmulticast mode [ 202.519115][T13918] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2263'. [ 202.526293][T13909] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 202.657807][T13915] lo speed is unknown, defaulting to 1000 [ 202.688285][T13922] dvmrp8: entered allmulticast mode [ 202.727938][T13926] tipc: Enabling of bearer rejected, already enabled [ 202.808553][T13931] lo speed is unknown, defaulting to 1000 [ 202.819228][T13926] netlink: 1041 bytes leftover after parsing attributes in process `syz.4.2267'. [ 202.877409][T13936] netlink: 'syz.0.2265': attribute type 23 has an invalid length. [ 202.914537][T13922] lo speed is unknown, defaulting to 1000 [ 203.140876][T13921] dvmrp8: left allmulticast mode [ 203.167257][T13949] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2270'. [ 203.552283][T13974] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2273'. [ 203.812496][T13983] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2281'. [ 203.923970][T13989] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2285'. [ 203.942833][T13989] bond0: entered promiscuous mode [ 203.950215][T13989] bond0: left promiscuous mode [ 204.021263][T13992] tipc: Enabling of bearer rejected, failed to enable media [ 204.063523][T13996] netlink: 'syz.4.2286': attribute type 1 has an invalid length. [ 204.111159][T13996] netlink: 'syz.4.2286': attribute type 10 has an invalid length. [ 204.132230][T13996] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2286'. [ 204.291723][T14013] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2290'. [ 204.503571][T14026] bond0: (slave rose0): Error: Device can not be enslaved while up [ 204.530235][T14029] lo speed is unknown, defaulting to 1000 [ 204.803869][T14046] lo speed is unknown, defaulting to 1000 [ 205.615961][T14106] team0: Port device sit1 added [ 205.637711][T14106] tipc: Enabling of bearer rejected, already enabled [ 205.744370][T14114] lo speed is unknown, defaulting to 1000 [ 205.902614][T14138] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 205.996871][ T8227] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x9 [ 206.984046][T14195] netlink: 'syz.4.2337': attribute type 2 has an invalid length. [ 207.142024][T14206] batman_adv: batadv0: Adding interface: ip6gretap3 [ 207.169836][T14206] batman_adv: batadv0: The MTU of interface ip6gretap3 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 207.216594][T14206] batman_adv: batadv0: Interface activated: ip6gretap3 [ 207.491462][T14216] netlink: 'syz.0.2343': attribute type 5 has an invalid length. [ 207.585845][T14223] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 207.826207][T14233] lo speed is unknown, defaulting to 1000 [ 207.959460][T14246] netlink: 'syz.1.2353': attribute type 4 has an invalid length. [ 208.017729][T14248] tipc: Enabled bearer , priority 0 [ 208.025797][T14248] syzkaller0: entered promiscuous mode [ 208.031675][T14248] syzkaller0: entered allmulticast mode [ 208.039940][T14248] __nla_validate_parse: 12 callbacks suppressed [ 208.039956][T14248] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2355'. [ 208.060875][T14247] tipc: Resetting bearer [ 208.080130][T14247] tipc: Disabling bearer [ 208.094313][T14250] tipc: Enabled bearer , priority 0 [ 208.102643][T14252] netlink: 248 bytes leftover after parsing attributes in process `syz.2.2356'. [ 208.103315][T14250] syzkaller0: entered promiscuous mode [ 208.121362][T14250] syzkaller0: entered allmulticast mode [ 208.167170][T14250] tipc: Resetting bearer [ 208.187712][T14249] tipc: Resetting bearer [ 208.204659][T14249] tipc: Disabling bearer [ 208.289449][T14270] delete_channel: no stack [ 208.502968][T14285] bond2: (slave ip6gretap2): Releasing active interface [ 208.587048][T14290] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2363'. [ 208.616270][T14290] netlink: 'syz.0.2363': attribute type 10 has an invalid length. [ 208.632098][T14294] netlink: 108 bytes leftover after parsing attributes in process `syz.4.2367'. [ 208.711393][ T8227] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20001 - 0 [ 208.722047][ T8227] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20001 - 0 [ 208.733727][ T8227] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20001 - 0 [ 208.758751][ T8227] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20001 - 0 [ 208.862873][T14311] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 208.900825][T14314] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2376'. [ 208.917552][T14314] ip6gretap0: entered promiscuous mode [ 208.931114][T14314] macvtap1: entered promiscuous mode [ 208.937532][T14314] macvtap1: entered allmulticast mode [ 208.943026][T14314] ip6gretap0: entered allmulticast mode [ 209.092140][T14324] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2379'. [ 209.117379][T14332] syz_tun: entered allmulticast mode [ 209.128570][T14330] netlink: 'syz.2.2380': attribute type 3 has an invalid length. [ 209.145511][T14330] netlink: 666 bytes leftover after parsing attributes in process `syz.2.2380'. [ 209.181792][T14331] syz_tun: left allmulticast mode [ 209.240805][T14342] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2384'. [ 209.512519][T14363] netlink: 'syz.1.2389': attribute type 1 has an invalid length. [ 209.532776][T14363] bond8: entered promiscuous mode [ 209.538602][T14363] 8021q: adding VLAN 0 to HW filter on device bond8 [ 209.549840][T14364] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2391'. [ 209.566870][T14371] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2390'. [ 209.576886][T14363] 8021q: adding VLAN 0 to HW filter on device bond8 [ 209.584165][T14363] bond8: (slave wireguard0): The slave device specified does not support setting the MAC address [ 209.608007][T14363] bond8: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 209.622013][T14363] bond8: (slave wireguard0): making interface the new active one [ 209.639190][T14363] wireguard0: entered promiscuous mode [ 209.647489][T14363] bond8: (slave wireguard0): Enslaving as an active interface with an up link [ 209.660159][T14383] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 209.667493][T14383] IPv6: NLM_F_CREATE should be set when creating new route [ 209.674833][T14383] IPv6: NLM_F_CREATE should be set when creating new route [ 209.676309][T14371] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 209.682785][T14383] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 209.824755][T14395] netlink: 'syz.0.2397': attribute type 3 has an invalid length. [ 209.836700][T14395] netlink: 'syz.0.2397': attribute type 3 has an invalid length. [ 209.852299][T14394] bond6: (slave gretap1): Releasing active interface [ 209.885584][T14394] bond8: (slave wireguard0): Releasing backup interface [ 209.900536][T14394] wireguard0: left promiscuous mode [ 209.957519][T14404] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 209.983683][T14394] netlink: 'syz.1.2395': attribute type 10 has an invalid length. [ 210.115858][T14417] pimreg: entered allmulticast mode [ 210.124230][T14417] pimreg: left allmulticast mode [ 210.154079][T14425] netlink: 'syz.4.2405': attribute type 3 has an invalid length. [ 210.435303][T14442] nbd1: detected capacity change from 0 to 127 [ 210.449359][ T5873] block nbd1: Receive control failed (result -104) [ 210.455499][ T5866] block nbd1: Receive control failed (result -32) [ 210.738359][T14467] (unnamed net_device) (uninitialized): option broadcast_neighbor: invalid value (5) [ 210.840497][T14476] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 210.948201][T14486] syzkaller1: entered promiscuous mode [ 210.956919][T14486] syzkaller1: entered allmulticast mode [ 211.228152][T14507] sctp: [Deprecated]: syz.2.2430 (pid 14507) Use of struct sctp_assoc_value in delayed_ack socket option. [ 211.228152][T14507] Use struct sctp_sack_info instead [ 211.639203][T14536] lo speed is unknown, defaulting to 1000 [ 211.731182][T14536] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 211.818746][T14550] syz_tun: entered allmulticast mode [ 211.831099][T14550] dvmrp8: entered allmulticast mode [ 211.870229][T14550] lo speed is unknown, defaulting to 1000 [ 211.987242][T14548] syz_tun: left allmulticast mode [ 211.998473][T14548] dvmrp8: left allmulticast mode [ 212.033213][T14556] lo speed is unknown, defaulting to 1000 [ 212.216673][T14570] lo speed is unknown, defaulting to 1000 [ 212.252946][T14577] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.268085][ T7232] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 212.308190][T14577] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.339712][T14586] netlink: 'syz.2.2452': attribute type 1 has an invalid length. [ 212.406651][ T7232] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 212.417624][T14577] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.472532][T14577] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.524744][T14607] tipc: Enabled bearer , priority 0 [ 212.534579][T14607] syzkaller0: entered promiscuous mode [ 212.540491][T14607] syzkaller0: entered allmulticast mode [ 212.553593][T14607] tipc: Resetting bearer [ 212.567025][T14606] tipc: Resetting bearer [ 212.575597][T14606] tipc: Disabling bearer [ 212.589856][ T6973] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.607703][ T8224] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.622590][ T8224] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.637337][ T8224] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 212.650543][T14583] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.717998][T14583] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.780085][T14583] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.802440][T14618] tipc: Enabled bearer , priority 0 [ 212.812631][T14618] syzkaller0: entered promiscuous mode [ 212.833032][T14618] syzkaller0: entered allmulticast mode [ 212.847869][T14583] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.870760][ T8224] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 212.893943][T14617] tipc: Resetting bearer [ 212.915204][T14617] tipc: Disabling bearer [ 212.943577][T14625] IPVS: set_ctl: invalid protocol: 22 100.1.1.2:20002 [ 213.154444][T14634] netlink: 'syz.4.2466': attribute type 1 has an invalid length. [ 213.166088][T14634] __nla_validate_parse: 20 callbacks suppressed [ 213.166107][T14634] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2466'. [ 213.192037][T14634] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2466'. [ 213.256540][T14634] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2466'. [ 213.430936][T14657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2469'. [ 213.663007][T14662] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2470'. [ 213.674161][T14662] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2470'. [ 213.786259][T14665] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2471'. [ 213.925713][ T6973] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 213.933865][ T6973] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 214.290398][T14681] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2473'. [ 214.312716][T14680] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2476'. [ 214.322100][T14680] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2476'. [ 214.545149][ T43] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 214.604526][ T6973] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.622596][ T6973] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.634589][ T6973] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.680758][ T8224] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.728835][T14710] tipc: Enabled bearer , priority 0 [ 214.742845][T14709] tipc: Disabling bearer [ 214.768138][T14713] ieee802154 phy0 wpan0: encryption failed: -22 [ 215.190519][T14748] netlink: 'syz.0.2493': attribute type 1 has an invalid length. [ 215.223818][T14748] bond3: (slave gretap2): making interface the new active one [ 215.232351][T14748] bond3: (slave gretap2): Enslaving as an active interface with an up link [ 215.518372][T14766] lo speed is unknown, defaulting to 1000 [ 215.607261][T14779] lo speed is unknown, defaulting to 1000 [ 216.239647][T14828] netlink: 'syz.0.2520': attribute type 4 has an invalid length. [ 216.464001][T14851] netlink: 'syz.3.2529': attribute type 2 has an invalid length. [ 216.510429][T14851] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 216.701372][T14873] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition [ 216.739910][T14873] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0) [ 216.906089][T14894] batadv_slave_1: entered promiscuous mode [ 217.207238][T14917] tipc: Enabled bearer , priority 0 [ 217.225901][T14917] syzkaller0: entered promiscuous mode [ 217.233228][T14917] syzkaller0: entered allmulticast mode [ 217.334398][T14924] vlan2: entered allmulticast mode [ 217.339739][T14924] erspan0: entered allmulticast mode [ 217.503162][T14934] bridge10: entered allmulticast mode [ 217.845039][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 218.099787][T14916] tipc: Resetting bearer [ 218.118025][T14916] tipc: Disabling bearer [ 218.194045][T14990] __nla_validate_parse: 17 callbacks suppressed [ 218.194063][T14990] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2565'. [ 218.215961][T14990] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2565'. [ 218.227940][T14988] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2563'. [ 218.245357][T14990] batadv0: entered promiscuous mode [ 218.255947][T14990] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 218.274822][T14988] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2563'. [ 218.447658][T15003] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2568'. [ 218.467773][T15003] netlink: 'syz.4.2568': attribute type 5 has an invalid length. [ 218.479390][T15003] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2568'. [ 218.530681][T15003] geneve4: entered promiscuous mode [ 218.539543][T15003] geneve4: entered allmulticast mode [ 218.546533][ T8227] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 218.580431][ T8227] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 218.642962][ T8227] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 218.744269][T15004] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2569'. [ 218.746150][T15021] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2574'. [ 218.754183][ T8227] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 218.771927][T15004] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2569'. [ 218.781873][T15010] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2569'. [ 218.871584][T15004] pimreg: left allmulticast mode [ 219.042546][T15038] lo speed is unknown, defaulting to 1000 [ 219.064726][T15043] lo speed is unknown, defaulting to 1000 [ 219.318479][T15067] tipc: Enabled bearer , priority 0 [ 219.325897][T15067] syzkaller0: entered promiscuous mode [ 219.331367][T15067] syzkaller0: entered allmulticast mode [ 219.352892][T15067] tipc: Resetting bearer [ 219.360989][T15065] tipc: Resetting bearer [ 219.370728][T15065] tipc: Disabling bearer [ 219.423113][T15069] tipc: Enabling of bearer rejected, already enabled [ 219.758962][T15092] tap0: tun_chr_ioctl cmd 1074025675 [ 219.765705][T15092] tap0: persist disabled [ 219.767801][T15093] netlink: 'syz.4.2594': attribute type 13 has an invalid length. [ 219.781643][T15093] netlink: 'syz.4.2594': attribute type 17 has an invalid length. [ 219.820605][T15093] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 219.898642][T15089] lo speed is unknown, defaulting to 1000 [ 220.470048][T15109] tipc: Enabled bearer , priority 0 [ 220.524301][T15106] tipc: Disabling bearer [ 220.638511][T15114] lo speed is unknown, defaulting to 1000 [ 220.688226][T15112] lo speed is unknown, defaulting to 1000 [ 221.059791][T15138] lo speed is unknown, defaulting to 1000 [ 221.092603][T15143] tipc: Enabling of bearer rejected, already enabled [ 222.149644][T15212] netlink: 'syz.3.2624': attribute type 7 has an invalid length. [ 222.167061][T15205] 8021q: adding VLAN 0 to HW filter on device bond4 [ 222.613466][T15240] netlink: 'syz.1.2633': attribute type 16 has an invalid length. [ 222.622691][T15239] netlink: 'syz.0.2632': attribute type 1 has an invalid length. [ 222.629348][T15240] netlink: 'syz.1.2633': attribute type 17 has an invalid length. [ 222.648522][ T8224] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.668432][ T8224] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.698413][ T8224] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.727730][ T8224] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.137093][T15273] netlink: 'syz.1.2639': attribute type 13 has an invalid length. [ 223.145752][T15273] netlink: 'syz.1.2639': attribute type 17 has an invalid length. [ 223.200693][T15273] 8021q: adding VLAN 0 to HW filter on device à [ 223.209371][T15273] 8021q: adding VLAN 0 to HW filter on device team0 [ 223.220983][T15273] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 223.238465][T14650] lo speed is unknown, defaulting to 1000 [ 223.247273][T14650] syz2: Port: 1 Link ACTIVE [ 223.264046][T15274] lo speed is unknown, defaulting to 1000 [ 223.571555][T15280] openvswitch: netlink: VXLAN extension 2 out of range max 1 [ 223.845409][T15293] __nla_validate_parse: 17 callbacks suppressed [ 223.845426][T15293] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2645'. [ 223.912643][T15298] IPVS: set_ctl: invalid protocol: 47 10.1.1.2:20004 [ 223.953490][T15302] netlink: 'syz.2.2648': attribute type 7 has an invalid length. [ 223.972577][T15304] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2649'. [ 223.996005][T15304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2649'. [ 224.280758][T15311] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2651'. [ 224.750362][T15346] netlink: 'syz.4.2663': attribute type 10 has an invalid length. [ 224.859855][T15351] netlink: 'syz.4.2664': attribute type 10 has an invalid length. [ 224.874394][T15351] netlink: 'syz.4.2664': attribute type 10 has an invalid length. [ 224.989161][T15364] netlink: 'syz.3.2667': attribute type 12 has an invalid length. [ 225.106380][T15368] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2669'. [ 225.261140][T15382] netlink: 'syz.4.2675': attribute type 7 has an invalid length. [ 225.272822][T15382] IPVS: Unknown mcast interface: batadv0 [ 225.370498][T15396] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2677'. [ 225.388280][T15396] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2677'. [ 225.404878][T15396] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2677'. [ 225.414204][T15396] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2677'. [ 225.471741][T15401] tipc: Enabled bearer , priority 0 [ 225.486519][T15401] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 225.493843][T15401] IPv6: NLM_F_CREATE should be set when creating new route [ 225.503963][T15401] tipc: Resetting bearer [ 225.506156][T15404] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2680'. [ 225.523245][T15405] netlink: 'syz.1.2679': attribute type 13 has an invalid length. [ 225.531346][T15405] netlink: 'syz.1.2679': attribute type 17 has an invalid length. [ 225.542473][T15397] tipc: Disabling bearer [ 225.582994][T15405] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 225.605083][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 225.623147][T15407] lo speed is unknown, defaulting to 1000 [ 225.678661][T15411] macsec1: entered promiscuous mode [ 225.685934][T15411] macsec1: entered allmulticast mode [ 225.709840][T15411] openvswitch: netlink: nsh attr 9217 is out of range max 3 [ 225.720388][T15411] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.773911][T15415] lo speed is unknown, defaulting to 1000 [ 225.834488][T15415] tipc: Started in network mode [ 225.840899][T15415] tipc: Node identity 5eab1f80aeb3, cluster identity 4711 [ 225.849592][T15415] tipc: Enabled bearer , priority 0 [ 225.858249][T15415] syzkaller0: entered promiscuous mode [ 225.864200][T15415] syzkaller0: entered allmulticast mode [ 225.877458][T15418] openvswitch: netlink: Duplicate or invalid key (type 0). [ 225.886119][T15418] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.991066][T15414] tipc: Resetting bearer [ 226.008386][T15414] tipc: Disabling bearer [ 226.164128][ T6973] tipc: Left network mode [ 226.183354][T15427] sctp: [Deprecated]: syz.4.2686 (pid 15427) Use of int in max_burst socket option. [ 226.183354][T15427] Use struct sctp_assoc_value instead [ 226.529374][T15445] IPVS: stopping backup sync thread 10694 ... [ 226.561328][T15448] IPVS: sync thread started: state = BACKUP, mcast_ifn = gre0, syncid = 10, id = 0 [ 226.616311][ T30] audit: type=1800 audit(1756313092.385:4): pid=15449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2691" name="x000000000000000500000000000000000000005" dev="tmpfs" ino=2780 res=0 errno=0 [ 226.650279][ T30] audit: type=1804 audit(1756313092.385:5): pid=15449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.2691" name="/newroot/538/x000000000000000500000000000000000000005" dev="tmpfs" ino=2780 res=1 errno=0 [ 226.994738][T15458] lo speed is unknown, defaulting to 1000 [ 227.223552][T15473] 8021q: adding VLAN 0 to HW filter on device bond10 [ 227.234415][T15473] bond9: (slave bond10): Enslaving as an active interface with an up link [ 227.246854][T15475] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 227.483660][T15485] bond9: (slave bond10): Releasing backup interface [ 227.540629][T15488] netlink: 'syz.0.2701': attribute type 5 has an invalid length. [ 227.906430][T15518] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 227.934555][T15518] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 227.962950][T15518] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 228.010616][T15530] netlink: 'syz.3.2712': attribute type 7 has an invalid length. [ 228.048865][T15518] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 228.071692][T15518] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 228.084484][T15518] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 228.173370][T15518] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 228.215314][T15518] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 228.228167][T15518] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 228.320590][T15518] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 228.342578][T15518] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 228.370637][T15518] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 228.532236][ T6973] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 228.549149][ T6973] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 228.557653][ T6973] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 20001 - 0 [ 228.566748][ T6973] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 228.576182][ T6973] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 228.584368][ T6973] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 20001 - 0 [ 228.599345][ T6973] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 228.612876][ T6973] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 228.621428][ T6973] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 20001 - 0 [ 228.649063][ T6973] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 228.670474][ T6973] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 228.678782][ T6973] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 20001 - 0 [ 228.691272][T15569] vlan0: entered promiscuous mode [ 228.698802][T15569] gretap0: entered promiscuous mode [ 228.742096][T15569] vlan0: entered promiscuous mode [ 228.797112][T15569] vlan0: entered promiscuous mode [ 228.821575][T15577] lo speed is unknown, defaulting to 1000 [ 228.886690][T15569] __nla_validate_parse: 24 callbacks suppressed [ 228.886709][T15569] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2725'. [ 228.898983][T15586] lo speed is unknown, defaulting to 1000 [ 228.964007][T15588] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2731'. [ 228.967944][T15569] vlan0: entered promiscuous mode [ 228.981635][T15592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2733'. [ 228.991760][T15592] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2733'. [ 229.032469][T15594] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2734'. [ 229.056632][T15569] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2725'. [ 229.088733][T15569] vlan0: entered promiscuous mode [ 229.159142][T15569] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2725'. [ 229.209883][T15569] vlan0: entered promiscuous mode [ 229.264134][T15609] 8021q: adding VLAN 0 to HW filter on device bond5 [ 229.271846][T15569] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2725'. [ 229.275368][T15607] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2739'. [ 229.291697][T15569] vlan0: entered promiscuous mode [ 229.356703][T15569] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2725'. [ 229.378145][T15569] vlan0: entered promiscuous mode [ 229.460821][T15569] vlan0: entered promiscuous mode [ 229.569669][T15624] macvtap1: entered promiscuous mode [ 229.575168][T15624] mac80211_hwsim hwsim12 wlan1: entered promiscuous mode [ 229.583699][T15624] mac80211_hwsim hwsim12 wlan1: left promiscuous mode [ 229.796816][T15632] tipc: Enabled bearer , priority 0 [ 229.812116][T15632] syzkaller0: entered promiscuous mode [ 229.828678][T15632] syzkaller0: entered allmulticast mode [ 229.848557][T15642] veth0_to_bridge: entered promiscuous mode [ 229.861675][T15632] tipc: Resetting bearer [ 229.871176][T15645] netlink: 'syz.1.2752': attribute type 12 has an invalid length. [ 229.884658][T15631] tipc: Resetting bearer [ 229.900093][T15631] tipc: Disabling bearer [ 230.530353][T15650] netlink: 'syz.0.2754': attribute type 101 has an invalid length. [ 230.548468][T15650] netlink: 'syz.0.2754': attribute type 7 has an invalid length. [ 230.562148][T15654] netlink: 'syz.1.2757': attribute type 1 has an invalid length. [ 230.611058][T15654] bond11: entered promiscuous mode [ 230.628079][T15654] 8021q: adding VLAN 0 to HW filter on device bond11 [ 230.682740][T15659] 8021q: adding VLAN 0 to HW filter on device bond11 [ 230.704465][T15659] bond11: (slave vxcan5): The slave device specified does not support setting the MAC address [ 230.714887][T15659] bond11: (slave vxcan5): Setting fail_over_mac to active for active-backup mode [ 230.728070][T15659] bond11: (slave vxcan5): making interface the new active one [ 230.737040][T15659] vxcan5: entered promiscuous mode [ 230.743343][T15659] bond11: (slave vxcan5): Enslaving as an active interface with an up link [ 230.752407][T15641] veth0_to_bridge: left promiscuous mode [ 230.800488][T15671] gre2: entered allmulticast mode [ 230.866970][T15676] netlink: 'syz.2.2761': attribute type 13 has an invalid length. [ 230.903848][T15676] netlink: 'syz.2.2761': attribute type 17 has an invalid length. [ 230.954023][T15676] 8021q: adding VLAN 0 to HW filter on device team0 [ 230.996850][T15676] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 231.069295][T15692] sctp: [Deprecated]: syz.1.2768 (pid 15692) Use of int in max_burst socket option deprecated. [ 231.069295][T15692] Use struct sctp_assoc_value instead [ 231.103292][T15681] lo speed is unknown, defaulting to 1000 [ 231.316176][T15698] netlink: 'syz.0.2770': attribute type 10 has an invalid length. [ 231.338982][T15698] dummy0: entered promiscuous mode [ 231.373073][T15712] ieee802154 phy0 wpan0: encryption failed: -22 [ 231.395223][T15698] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 231.684206][T15720] veth0_to_team: left promiscuous mode [ 231.691187][T15720] veth0_to_team: left allmulticast mode [ 231.712386][T15720] geneve2: left allmulticast mode [ 231.719868][T15720] veth2: left promiscuous mode [ 231.737538][T15720] tipc: Resetting bearer [ 231.743719][T15720] syzkaller0: left promiscuous mode [ 231.749362][T15720] syzkaller0: left allmulticast mode [ 231.756005][T15720] bridge5: left promiscuous mode [ 231.846706][T15720] ip6gretap0: left allmulticast mode [ 231.852495][T15720] macvtap1: left promiscuous mode [ 231.857999][T15720] macvtap1: left allmulticast mode [ 231.873998][T15720] bridge10: left allmulticast mode [ 231.889446][T15720] geneve4: left promiscuous mode [ 231.894518][T15720] geneve4: left allmulticast mode [ 231.914870][ T8224] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.926964][ T8224] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 256 - 0 [ 231.935477][ T8224] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 20001 - 0 [ 231.944150][ T8224] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.956253][ T8224] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 256 - 0 [ 231.964684][ T8224] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 20001 - 0 [ 231.977280][ T8224] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.985801][ T8224] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 256 - 0 [ 231.994030][ T8224] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 20001 - 0 [ 232.002510][ T8224] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 232.011227][ T8224] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 232.019808][ T8224] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 20001 - 0 [ 232.067512][T15732] lo speed is unknown, defaulting to 1000 [ 232.314442][T15741] lo speed is unknown, defaulting to 1000 [ 232.518062][T15754] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 233.377268][T15764] lo speed is unknown, defaulting to 1000 [ 233.565328][T15778] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 233.849021][ T5873] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 233.860198][ T5873] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 233.867827][ T5873] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 233.877800][ T5873] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 233.894130][ T5873] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 233.973946][T15803] __nla_validate_parse: 13 callbacks suppressed [ 233.973966][T15803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2799'. [ 234.020083][T15804] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2799'. [ 234.048682][T15797] lo speed is unknown, defaulting to 1000 [ 234.058003][T15806] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2798'. [ 234.121075][T15813] netlink: 92 bytes leftover after parsing attributes in process `syz.0.2800'. [ 234.154031][T15813] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2800'. [ 234.165570][T15813] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2800'. [ 234.273798][T15817] netlink: 'syz.1.2801': attribute type 1 has an invalid length. [ 234.296509][T15817] netlink: 'syz.1.2801': attribute type 1 has an invalid length. [ 234.305406][T15819] netlink: 'syz.0.2802': attribute type 13 has an invalid length. [ 234.481075][T15826] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2803'. [ 234.487914][T15827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2804'. [ 234.501307][T15819] bond0: left promiscuous mode [ 234.511413][T15819] dummy0: left promiscuous mode [ 234.562030][ T8224] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.573593][ T8224] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.607738][ T8224] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.627492][ T8224] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.640933][T15823] lo speed is unknown, defaulting to 1000 [ 234.649434][T15797] chnl_net:caif_netlink_parms(): no params data found [ 234.883747][T15797] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.901611][T15797] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.913013][T15797] bridge_slave_0: entered allmulticast mode [ 234.918290][T15857] netlink: 172 bytes leftover after parsing attributes in process `syz.2.2811'. [ 234.929365][T15797] bridge_slave_0: entered promiscuous mode [ 234.937020][T15797] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.944265][T15797] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.964577][T15797] bridge_slave_1: entered allmulticast mode [ 234.974612][T15797] bridge_slave_1: entered promiscuous mode [ 235.060248][T15797] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 235.100200][T15797] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 235.204855][T15797] team0: Port device team_slave_0 added [ 235.228326][T15859] lo speed is unknown, defaulting to 1000 [ 235.230180][T15873] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2814'. [ 235.270353][T15797] team0: Port device team_slave_1 added [ 235.282100][T15875] lo speed is unknown, defaulting to 1000 [ 235.511428][T15797] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.534993][T15797] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.585039][T15797] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.633836][T15797] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.650504][T15797] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.703488][T15797] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 235.772484][T15883] lo speed is unknown, defaulting to 1000 [ 235.938355][ T5873] Bluetooth: hci5: command tx timeout [ 235.957483][T15797] hsr_slave_0: entered promiscuous mode [ 235.965501][T15797] hsr_slave_1: entered promiscuous mode [ 236.118079][T15920] netlink: 'syz.0.2824': attribute type 4 has an invalid length. [ 236.131885][T15920] netlink: 'syz.0.2824': attribute type 12 has an invalid length. [ 236.228799][T15921] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 236.394055][T15932] netlink: 'syz.3.2827': attribute type 12 has an invalid length. [ 236.427352][T15932] netlink: 'syz.3.2827': attribute type 11 has an invalid length. [ 236.509251][ T30] audit: type=1800 audit(1756313102.305:6): pid=15929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2825" name="memory.events" dev="tmpfs" ino=2995 res=0 errno=0 [ 236.575958][T15940] netlink: 'syz.3.2827': attribute type 1 has an invalid length. [ 236.638494][T15937] lo speed is unknown, defaulting to 1000 [ 236.675684][T15932] 8021q: adding VLAN 0 to HW filter on device bond7 [ 236.684145][T15932] bond6: (slave bond7): making interface the new active one [ 236.695529][T15932] bond6: (slave bond7): Enslaving as an active interface with an up link [ 236.769221][T15933] bond6: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 236.784468][T15933] bond6: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 236.875200][T15797] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 236.904122][T15797] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 236.999932][T15949] lo speed is unknown, defaulting to 1000 [ 236.999950][T15797] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 237.020035][T15797] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 237.259097][T15797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 237.280693][T15797] 8021q: adding VLAN 0 to HW filter on device team0 [ 237.322470][ T8227] bridge0: port 1(bridge_slave_0) entered blocking state [ 237.329700][ T8227] bridge0: port 1(bridge_slave_0) entered forwarding state [ 237.398245][ T8227] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.405468][ T8227] bridge0: port 2(bridge_slave_1) entered forwarding state [ 237.959190][T15797] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 238.005216][ T5873] Bluetooth: hci5: command tx timeout [ 238.159641][T15998] netlink: 'syz.1.2840': attribute type 10 has an invalid length. [ 238.230180][T15998] team0: Device hsr_slave_0 failed to register rx_handler [ 238.391240][T15984] tipc: Enabled bearer , priority 0 [ 238.553893][T15984] syzkaller0: entered promiscuous mode [ 238.572862][T15984] syzkaller0: entered allmulticast mode [ 238.599322][T15984] tipc: Resetting bearer [ 238.681515][T15797] veth0_vlan: entered promiscuous mode [ 238.746936][T15797] veth1_vlan: entered promiscuous mode [ 238.764055][T15983] tipc: Resetting bearer [ 238.778140][T16022] IPVS: set_ctl: invalid protocol: 12 224.0.0.2:0 [ 239.007518][T15983] tipc: Disabling bearer [ 239.113394][T15797] veth0_macvtap: entered promiscuous mode [ 239.174815][T15797] veth1_macvtap: entered promiscuous mode [ 239.224304][T15797] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 239.267351][T15797] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 239.284635][ T8223] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.300959][ T8223] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.311079][ T8223] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.347359][ T8223] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.371131][T16035] netlink: 'syz.3.2848': attribute type 13 has an invalid length. [ 239.488626][T16035] mac80211_hwsim hwsim6 wlan1: left promiscuous mode [ 239.530730][T16044] Unsupported ieee802154 address type: 0 [ 239.615788][T16035] batman_adv: batadv0: Interface deactivated: ip6gretap3 [ 239.679969][ T1159] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.695696][ T1159] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.711537][T16047] netlink: 'syz.0.2853': attribute type 1 has an invalid length. [ 239.719754][ T1159] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.719797][ T1159] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.723559][ T8227] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.747634][ T8227] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 239.756528][T16047] __nla_validate_parse: 3 callbacks suppressed [ 239.756546][T16047] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2853'. [ 239.828576][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.863804][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 240.098692][ T5873] Bluetooth: hci5: command tx timeout [ 240.203726][T16090] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2862'. [ 240.243567][T16090] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2862'. [ 240.300783][T16098] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2864'. [ 240.312633][T16098] gretap0: entered promiscuous mode [ 240.344281][T16098] gretap0: entered allmulticast mode [ 240.458194][T16109] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2868'. [ 240.473022][T16109] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2868'. [ 240.482919][T16109] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2868'. [ 240.483651][T16111] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2869'. [ 240.506192][T16109] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2868'. [ 240.518733][T16109] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2868'. [ 240.584130][T16109] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.591678][T16109] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.830118][T16127] syzkaller1: entered promiscuous mode [ 240.839613][T16127] syzkaller1: entered allmulticast mode [ 240.965093][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 240.973322][ T94] block nbd1: Connection timed out, retrying (0/2 alive) [ 240.980739][ T94] block nbd1: Connection timed out, retrying (0/2 alive) [ 240.987901][ T94] block nbd1: Connection timed out, retrying (0/2 alive) [ 241.005453][ T94] block nbd1: Connection timed out, retrying (0/2 alive) [ 241.012591][ T94] block nbd1: Dead connection, failed to find a fallback [ 241.019706][ T94] block nbd1: shutting down sockets [ 241.024959][ T94] blk_print_req_error: 138 callbacks suppressed [ 241.024976][ T94] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.040631][ T94] buffer_io_error: 138 callbacks suppressed [ 241.040647][ T94] Buffer I/O error on dev nbd1, logical block 3, async page read [ 241.054460][ T94] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.063557][ T94] Buffer I/O error on dev nbd1, logical block 2, async page read [ 241.071666][ T94] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.080917][ T94] Buffer I/O error on dev nbd1, logical block 1, async page read [ 241.088734][ T94] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.098448][ T94] Buffer I/O error on dev nbd1, logical block 0, async page read [ 241.106816][ T5876] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.116091][ T5876] Buffer I/O error on dev nbd1, logical block 0, async page read [ 241.123957][ T5876] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.133375][ T5876] Buffer I/O error on dev nbd1, logical block 1, async page read [ 241.141469][ T5876] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.150555][ T5876] Buffer I/O error on dev nbd1, logical block 2, async page read [ 241.159090][ T5876] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.168479][ T5876] Buffer I/O error on dev nbd1, logical block 3, async page read [ 241.180271][ T5876] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.189695][ T5876] Buffer I/O error on dev nbd1, logical block 0, async page read [ 241.197649][ T5876] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 241.207112][ T5876] Buffer I/O error on dev nbd1, logical block 1, async page read [ 241.217371][ T5876] ldm_validate_partition_table(): Disk read failed. [ 241.225785][ T5876] Dev nbd1: unable to read RDB block 0 [ 241.233043][ T5876] nbd1: unable to read partition table [ 241.246237][ T5876] ldm_validate_partition_table(): Disk read failed. [ 241.254757][ T5876] Dev nbd1: unable to read RDB block 0 [ 241.262273][ T5876] nbd1: unable to read partition table [ 241.677507][T16156] team0: left allmulticast mode [ 241.708547][T16156] batadv1: left allmulticast mode [ 241.734117][T16156] bridge0: port 1(team0) entered disabled state [ 241.928714][T16185] netlink: 'syz.2.2891': attribute type 7 has an invalid length. [ 242.165397][ T5873] Bluetooth: hci5: command tx timeout [ 242.739727][T16239] tipc: Started in network mode [ 242.744644][T16239] tipc: Node identity 72a9e85010ce, cluster identity 4711 [ 242.752467][T16239] tipc: Enabled bearer , priority 0 [ 242.771059][T16237] syzkaller0: entered promiscuous mode [ 242.786492][T16237] syzkaller0: entered allmulticast mode [ 242.799034][T16242] netlink: 'syz.1.2911': attribute type 2 has an invalid length. [ 242.812322][T16243] tipc: Resetting bearer [ 242.827025][T16235] tipc: Resetting bearer [ 242.846384][T16235] tipc: Disabling bearer [ 243.111663][T16266] syzkaller1: entered promiscuous mode [ 243.121856][T16266] syzkaller1: entered allmulticast mode [ 243.630257][ T5866] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 243.639005][ T5866] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 243.647560][ T5866] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 243.650759][T16284] lo speed is unknown, defaulting to 1000 [ 243.655806][ T5866] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 243.668336][ T5866] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 243.737457][T16287] lo speed is unknown, defaulting to 1000 [ 243.780298][T16298] tipc: Enabled bearer , priority 0 [ 243.790318][T16300] syzkaller0: entered promiscuous mode [ 243.796093][T16300] syzkaller0: entered allmulticast mode [ 243.827025][T16301] tipc: Resetting bearer [ 243.841254][T16297] tipc: Resetting bearer [ 243.854127][T16297] tipc: Disabling bearer [ 244.069257][T16287] chnl_net:caif_netlink_parms(): no params data found [ 244.204306][T16287] bridge0: port 1(bridge_slave_0) entered blocking state [ 244.227551][T16287] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.234801][T16287] bridge_slave_0: entered allmulticast mode [ 244.242548][T16287] bridge_slave_0: entered promiscuous mode [ 244.250477][T16287] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.257709][T16287] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.264992][T16287] bridge_slave_1: entered allmulticast mode [ 244.272058][T16287] bridge_slave_1: entered promiscuous mode [ 244.347606][T16287] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 244.359119][T16287] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 244.429466][T16287] team0: Port device team_slave_0 added [ 244.456061][T16287] team0: Port device team_slave_1 added [ 244.523756][T16287] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 244.533493][T16287] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 244.582966][T16287] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 244.637940][T16287] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 244.649123][T16287] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 244.682333][T16287] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 244.732941][T16351] lo speed is unknown, defaulting to 1000 [ 244.940300][T16287] hsr_slave_0: entered promiscuous mode [ 244.947556][T16287] hsr_slave_1: entered promiscuous mode [ 244.953663][T16287] debugfs: 'hsr0' already exists in 'hsr' [ 244.959772][T16287] Cannot create hsr debugfs directory [ 245.110246][T16382] __nla_validate_parse: 33 callbacks suppressed [ 245.110264][T16382] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2954'. [ 245.212218][T16394] netlink: 'syz.3.2958': attribute type 21 has an invalid length. [ 245.225435][T16394] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2958'. [ 245.331604][T16406] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2961'. [ 245.357895][T16409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2962'. [ 245.406672][T16409] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2962'. [ 245.444566][T16411] netlink: 19 bytes leftover after parsing attributes in process `syz.2.2963'. [ 245.497843][T16413] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.2964'. [ 245.679407][T16287] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 245.685097][ T5866] Bluetooth: hci0: command tx timeout [ 245.729038][T16287] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 245.768600][T16287] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 245.798345][T16287] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 245.861333][T16434] lo speed is unknown, defaulting to 1000 [ 245.906675][T16450] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.2973'. [ 246.009123][T16456] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2976'. [ 246.024149][T16454] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2975'. [ 246.046803][T16454] netlink: 'syz.2.2975': attribute type 1 has an invalid length. [ 246.073506][T16287] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.116909][T16287] 8021q: adding VLAN 0 to HW filter on device team0 [ 246.170446][ T8224] bridge0: port 1(bridge_slave_0) entered blocking state [ 246.177745][ T8224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 246.188407][ T8224] bridge0: port 2(bridge_slave_1) entered blocking state [ 246.195561][ T8224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 246.242226][T16459] lo speed is unknown, defaulting to 1000 [ 246.273937][T16473] lo speed is unknown, defaulting to 1000 [ 246.500094][T16485] openvswitch: netlink: Key type 221 is out of range max 32 [ 246.646219][T16495] Bluetooth: MGMT ver 1.23 [ 246.678597][T16498] IPVS: Error joining to the multicast group [ 246.699989][T16495] 8021q: VLANs not supported on sit0 [ 246.810505][T16287] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 246.897315][T16287] veth0_vlan: entered promiscuous mode [ 246.911541][T16287] veth1_vlan: entered promiscuous mode [ 246.937645][T16515] syzkaller1: entered promiscuous mode [ 246.944680][T16515] syzkaller1: entered allmulticast mode [ 246.999651][T16287] veth0_macvtap: entered promiscuous mode [ 247.020417][T16287] veth1_macvtap: entered promiscuous mode [ 247.087610][T16287] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 247.096367][T16519] lo speed is unknown, defaulting to 1000 [ 247.109798][T16287] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 247.178191][ T8224] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.210607][ T8224] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.239543][ T8224] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.258008][T16536] netlink: 'syz.3.2999': attribute type 12 has an invalid length. [ 247.276758][T16541] sctp: [Deprecated]: syz.1.3000 (pid 16541) Use of int in max_burst socket option deprecated. [ 247.276758][T16541] Use struct sctp_assoc_value instead [ 247.339479][ T8224] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.416924][T16552] netlink: 'syz.3.3002': attribute type 1 has an invalid length. [ 247.436160][T16534] sctp: [Deprecated]: syz.2.2998 (pid 16534) Use of int in max_burst socket option. [ 247.436160][T16534] Use struct sctp_assoc_value instead [ 247.482835][ T8223] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.525313][ T8223] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.652652][ T8223] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.709619][ T8223] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.769215][ T5866] Bluetooth: hci0: command tx timeout [ 247.818212][T16572] pim6reg: entered allmulticast mode [ 247.918930][T16579] netlink: 'syz.0.2924': attribute type 3 has an invalid length. [ 248.279359][T16593] netlink: 'syz.2.3012': attribute type 4 has an invalid length. [ 248.423353][T16607] netlink: 'syz.2.3017': attribute type 1 has an invalid length. [ 248.451612][T16607] netlink: 'syz.2.3017': attribute type 3 has an invalid length. [ 248.491943][ T5873] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 248.501826][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 248.512334][ T5873] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 248.526349][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 248.534214][ T5873] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 248.546325][T16604] lo speed is unknown, defaulting to 1000 [ 248.681098][T16612] lo speed is unknown, defaulting to 1000 [ 248.993742][ T8228] batman_adv: batadv0: Removing interface: ip6gretap3 [ 249.068338][ T8228] bond0 (unregistering): (slave geneve2): Releasing active interface [ 249.258149][ T8228] bond1 (unregistering): Released all slaves [ 249.271388][ T8228] bond2 (unregistering): Released all slaves [ 249.281913][ T8228] bond3 (unregistering): Released all slaves [ 249.294301][ T8228] bond4 (unregistering): Released all slaves [ 249.304521][ T8228] bond0 (unregistering): Released all slaves [ 249.320187][ T8228] bond5 (unregistering): Released all slaves [ 249.330915][ T8228] bond6 (unregistering): (slave bond7): Releasing backup interface [ 249.339708][ T8228] bond6 (unregistering): Released all slaves [ 249.349486][ T8228] bond7 (unregistering): Released all slaves [ 249.385194][T16640] tipc: Enabling of bearer rejected, failed to enable media [ 249.461112][ T8228] k›*·]‘: left promiscuous mode [ 249.503712][T16653] lo speed is unknown, defaulting to 1000 [ 249.561397][ T8228] tipc: Left network mode [ 249.570047][T16656] lo speed is unknown, defaulting to 1000 [ 249.614802][T16612] chnl_net:caif_netlink_parms(): no params data found [ 249.658152][ T8228] IPVS: stopping backup sync thread 6147 ... [ 249.746376][T16668] netlink: 'syz.4.3030': attribute type 7 has an invalid length. [ 249.845072][ T5873] Bluetooth: hci0: command tx timeout [ 249.890181][T16682] IPVS: sync thread started: state = BACKUP, mcast_ifn = batadv0, syncid = 4, id = 0 [ 249.976750][T16673] lo speed is unknown, defaulting to 1000 [ 249.986522][T16612] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.012534][T16612] bridge0: port 1(bridge_slave_0) entered disabled state [ 250.024061][T16612] bridge_slave_0: entered allmulticast mode [ 250.032847][T16612] bridge_slave_0: entered promiscuous mode [ 250.061982][T16612] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.069732][T16612] bridge0: port 2(bridge_slave_1) entered disabled state [ 250.077239][T16612] bridge_slave_1: entered allmulticast mode [ 250.084395][T16612] bridge_slave_1: entered promiscuous mode [ 250.161516][T16612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 250.181635][T16612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 250.199422][ T8228] hsr_slave_0: left promiscuous mode [ 250.206712][ T8228] hsr_slave_1: left promiscuous mode [ 250.224523][ T8228] batadv1 (unregistering): left promiscuous mode [ 250.232772][ T8228] team0 (unregistering): Port device batadv1 removed [ 250.645020][ T5873] Bluetooth: hci1: command tx timeout [ 250.678898][T16612] team0: Port device team_slave_0 added [ 250.702207][T16612] team0: Port device team_slave_1 added [ 250.752155][T16695] lo speed is unknown, defaulting to 1000 [ 250.908393][T16612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 250.947421][T16612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 250.979053][T16612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 250.994469][T16612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 251.015002][T16612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 251.059906][T16612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 251.157561][T16612] hsr_slave_0: entered promiscuous mode [ 251.164699][T16612] hsr_slave_1: entered promiscuous mode [ 251.171805][T16612] debugfs: 'hsr0' already exists in 'hsr' [ 251.178257][T16612] Cannot create hsr debugfs directory [ 251.183857][T16703] __nla_validate_parse: 17 callbacks suppressed [ 251.183874][T16703] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3035'. [ 251.241003][T16712] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3039'. [ 251.256563][ T8228] IPVS: stop unused estimator thread 0... [ 251.323731][T16713] bridge6: port 1(veth15) entered blocking state [ 251.330704][T16713] bridge6: port 1(veth15) entered disabled state [ 251.338411][T16713] veth15: entered allmulticast mode [ 251.344370][T16713] veth15: entered promiscuous mode [ 251.361797][T16711] bridge6: port 2(veth0_to_bond) entered blocking state [ 251.369980][T16711] bridge6: port 2(veth0_to_bond) entered disabled state [ 251.378992][T16711] veth0_to_bond: entered allmulticast mode [ 251.385966][T16711] veth0_to_bond: entered promiscuous mode [ 251.854779][T16728] syz_tun: entered allmulticast mode [ 251.931751][ T5873] Bluetooth: hci0: command tx timeout [ 251.971667][T16736] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3044'. [ 252.021618][T16736] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3044'. [ 252.073265][T16612] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 252.374803][T16746] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3047'. [ 252.389068][T16612] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 252.402569][T16612] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 252.437475][T16612] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 252.507109][T16749] IPVS: set_ctl: invalid protocol: 137 224.0.0.2:20001 [ 252.628886][T16612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 252.669975][T16612] 8021q: adding VLAN 0 to HW filter on device team0 [ 252.697819][ T8227] bridge0: port 1(bridge_slave_0) entered blocking state [ 252.705002][ T8227] bridge0: port 1(bridge_slave_0) entered forwarding state [ 252.725423][ T5873] Bluetooth: hci1: command tx timeout [ 252.737780][ T8228] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.744940][ T8228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.769372][T16762] team0: Port device sit3 added [ 252.807759][T16768] tipc: Enabled bearer , priority 0 [ 252.832613][T16768] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 252.862481][T16768] syzkaller0: entered promiscuous mode [ 252.870438][T16768] syzkaller0: entered allmulticast mode [ 252.949366][T16768] tipc: Resetting bearer [ 253.018375][T16780] FAULT_INJECTION: forcing a failure. [ 253.018375][T16780] name failslab, interval 1, probability 0, space 0, times 0 [ 253.051702][T16780] CPU: 0 UID: 0 PID: 16780 Comm: syz.1.3054 Not tainted syzkaller #0 PREEMPT(full) [ 253.051727][T16780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 253.051749][T16780] Call Trace: [ 253.051756][T16780] [ 253.051763][T16780] dump_stack_lvl+0x189/0x250 [ 253.051787][T16780] ? __pfx____ratelimit+0x10/0x10 [ 253.051810][T16780] ? __pfx_dump_stack_lvl+0x10/0x10 [ 253.051827][T16780] ? __pfx__printk+0x10/0x10 [ 253.051849][T16780] ? __pfx___might_resched+0x10/0x10 [ 253.051866][T16780] ? lock_acquire+0x5f/0x360 [ 253.051887][T16780] should_fail_ex+0x414/0x560 [ 253.051917][T16780] should_failslab+0xa8/0x100 [ 253.051940][T16780] __kmalloc_node_noprof+0xd1/0x4e0 [ 253.051959][T16780] ? rcu_is_watching+0x15/0xb0 [ 253.051975][T16780] ? qdisc_alloc+0x97/0xaa0 [ 253.051999][T16780] qdisc_alloc+0x97/0xaa0 [ 253.052026][T16780] qdisc_create+0x12c/0xea0 [ 253.052043][T16780] ? lock_release+0x4b/0x3e0 [ 253.052065][T16780] ? qdisc_lookup+0x36d/0x6d0 [ 253.052082][T16780] tc_modify_qdisc+0x1538/0x20e0 [ 253.052106][T16780] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 253.052135][T16780] ? lock_release+0x4b/0x3e0 [ 253.052154][T16780] ? bpf_lsm_capable+0x9/0x20 [ 253.052174][T16780] ? security_capable+0x7e/0x2e0 [ 253.052199][T16780] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 253.052219][T16780] rtnetlink_rcv_msg+0x779/0xb70 [ 253.052243][T16780] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 253.052265][T16780] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 253.052286][T16780] ? ref_tracker_free+0x63a/0x7d0 [ 253.052307][T16780] ? __asan_memcpy+0x40/0x70 [ 253.052323][T16780] ? __pfx_ref_tracker_free+0x10/0x10 [ 253.052346][T16780] netlink_rcv_skb+0x208/0x470 [ 253.052369][T16780] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 253.052392][T16780] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 253.052421][T16780] netlink_unicast+0x82f/0x9e0 [ 253.052444][T16780] ? __pfx_netlink_unicast+0x10/0x10 [ 253.052463][T16780] ? netlink_sendmsg+0x642/0xb30 [ 253.052476][T16780] ? skb_put+0x11b/0x210 [ 253.052493][T16780] netlink_sendmsg+0x805/0xb30 [ 253.052513][T16780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 253.052529][T16780] ? aa_sock_msg_perm+0xf1/0x1d0 [ 253.052544][T16780] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 253.052560][T16780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 253.052574][T16780] __sock_sendmsg+0x219/0x270 [ 253.052596][T16780] ____sys_sendmsg+0x505/0x830 [ 253.052615][T16780] ? __pfx_____sys_sendmsg+0x10/0x10 [ 253.052636][T16780] ? import_iovec+0x74/0xa0 [ 253.052656][T16780] ___sys_sendmsg+0x21f/0x2a0 [ 253.052675][T16780] ? __pfx____sys_sendmsg+0x10/0x10 [ 253.052708][T16780] ? __fget_files+0x2a/0x420 [ 253.052721][T16780] ? __fget_files+0x3a0/0x420 [ 253.052738][T16780] __x64_sys_sendmsg+0x19b/0x260 [ 253.052755][T16780] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 253.052775][T16780] ? __pfx_ksys_write+0x10/0x10 [ 253.052792][T16780] ? rcu_is_watching+0x15/0xb0 [ 253.052811][T16780] ? rcu_is_watching+0x15/0xb0 [ 253.052827][T16780] do_syscall_64+0xfa/0x3b0 [ 253.052844][T16780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.052858][T16780] ? clear_bhb_loop+0x60/0xb0 [ 253.052875][T16780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.052901][T16780] RIP: 0033:0x7f3107f8ebe9 [ 253.052917][T16780] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 253.052932][T16780] RSP: 002b:00007f3108e0d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 253.052950][T16780] RAX: ffffffffffffffda RBX: 00007f31081b5fa0 RCX: 00007f3107f8ebe9 [ 253.052963][T16780] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 253.052973][T16780] RBP: 00007f3108e0d090 R08: 0000000000000000 R09: 0000000000000000 [ 253.052985][T16780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.052996][T16780] R13: 00007f31081b6038 R14: 00007f31081b5fa0 R15: 00007ffed76fce58 [ 253.053015][T16780] [ 253.474708][T16783] pimreg: entered allmulticast mode [ 253.543073][T16612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 253.556713][T16786] lo speed is unknown, defaulting to 1000 [ 253.564373][T16788] netlink: 'syz.0.3057': attribute type 1 has an invalid length. [ 253.583500][T16612] veth0_vlan: entered promiscuous mode [ 253.597521][T16612] veth1_vlan: entered promiscuous mode [ 253.618315][T16612] veth0_macvtap: entered promiscuous mode [ 253.629319][T16612] veth1_macvtap: entered promiscuous mode [ 253.636540][T16788] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3057'. [ 253.645784][T16612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 253.648634][T16612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 253.691241][T16767] tipc: Resetting bearer [ 253.824191][T16767] tipc: Disabling bearer [ 253.982018][T16790] xfrm1: entered allmulticast mode [ 253.999626][ T1159] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.097474][ T1159] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.135674][ T1159] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.176324][ T1159] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.242719][T16808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3061'. [ 254.293410][T16808] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3061'. [ 254.312506][T16812] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3063'. [ 254.406332][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 254.418723][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 254.501951][T16814] Bluetooth: MGMT ver 1.23 [ 254.524678][T16821] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3065'. [ 254.553665][ T8230] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 254.562528][ T8230] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 254.750009][T16839] netlink: 'syz.3.3070': attribute type 3 has an invalid length. [ 254.778092][T16831] lo speed is unknown, defaulting to 1000 [ 254.805158][ T5866] Bluetooth: hci1: command tx timeout [ 254.821897][T16846] tipc: MTU too low for tipc bearer [ 254.956536][T16852] syzkaller0: entered promiscuous mode [ 254.962199][T16852] syzkaller0: entered allmulticast mode [ 255.454316][T16856] IPVS: set_ctl: invalid protocol: 2 172.20.20.52:20003 [ 255.499687][T16861] lo: entered allmulticast mode [ 255.549397][T16866] pim6reg: left allmulticast mode [ 255.587832][T16866] lo: left allmulticast mode [ 255.690119][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.722793][T16870] bond11: (slave vxcan5): Releasing backup interface [ 255.768611][T16870] vxcan5: left promiscuous mode [ 255.823348][T16870] team0: Port device sit3 removed [ 255.902731][T16883] sysfs: cannot create duplicate filename '/class/ieee80211/!å' [ 255.966908][T16883] CPU: 1 UID: 0 PID: 16883 Comm: syz.4.3085 Not tainted syzkaller #0 PREEMPT(full) [ 255.966934][T16883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 255.966944][T16883] Call Trace: [ 255.966950][T16883] [ 255.966958][T16883] dump_stack_lvl+0x189/0x250 [ 255.966984][T16883] ? __pfx_dump_stack_lvl+0x10/0x10 [ 255.967004][T16883] ? __pfx__printk+0x10/0x10 [ 255.967023][T16883] ? kernfs_root+0x1c/0x230 [ 255.967043][T16883] ? kernfs_path_from_node+0x2f/0x290 [ 255.967061][T16883] ? kernfs_path_from_node+0x250/0x290 [ 255.967078][T16883] ? kernfs_path_from_node+0x2f/0x290 [ 255.967098][T16883] sysfs_warn_dup+0x8e/0xa0 [ 255.967115][T16883] sysfs_do_create_link_sd+0xc0/0x110 [ 255.967134][T16883] device_add_class_symlinks+0x1cf/0x240 [ 255.967154][T16883] device_add+0x475/0xb50 [ 255.967172][T16883] wiphy_register+0x1ba6/0x28d0 [ 255.967204][T16883] ? __pfx_wiphy_register+0x10/0x10 [ 255.967226][T16883] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 255.967248][T16883] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 255.967268][T16883] ieee80211_register_hw+0x3425/0x4080 [ 255.967295][T16883] ? ieee80211_register_hw+0x14c1/0x4080 [ 255.967318][T16883] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 255.967339][T16883] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 255.967365][T16883] ? __hrtimer_setup+0x187/0x210 [ 255.967381][T16883] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 255.967406][T16883] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 255.967440][T16883] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 255.967460][T16883] ? trace_kmalloc+0x1f/0xd0 [ 255.967479][T16883] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 255.967501][T16883] ? kstrndup+0xbf/0x160 [ 255.967522][T16883] hwsim_new_radio_nl+0xea4/0x1b10 [ 255.967544][T16883] ? __pfx___nla_validate_parse+0x10/0x10 [ 255.967574][T16883] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 255.967600][T16883] ? __nla_parse+0x40/0x60 [ 255.967624][T16883] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 255.967648][T16883] genl_family_rcv_msg_doit+0x212/0x300 [ 255.967670][T16883] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 255.967703][T16883] ? bpf_lsm_capable+0x9/0x20 [ 255.967725][T16883] ? security_capable+0x7e/0x2e0 [ 255.967751][T16883] genl_rcv_msg+0x60e/0x790 [ 255.967772][T16883] ? __pfx_genl_rcv_msg+0x10/0x10 [ 255.967790][T16883] ? __kasan_slab_alloc+0x6c/0x80 [ 255.967810][T16883] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 255.967830][T16883] ? __netlink_lookup+0xbd/0x810 [ 255.967845][T16883] ? rcu_is_watching+0x15/0xb0 [ 255.967866][T16883] netlink_rcv_skb+0x208/0x470 [ 255.967890][T16883] ? __pfx_genl_rcv_msg+0x10/0x10 [ 255.967909][T16883] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 255.967938][T16883] ? lock_release+0x4b/0x3e0 [ 255.967962][T16883] ? down_read+0x1ad/0x2e0 [ 255.967979][T16883] genl_rcv+0x28/0x40 [ 255.967996][T16883] netlink_unicast+0x82f/0x9e0 [ 255.968021][T16883] ? __pfx_netlink_unicast+0x10/0x10 [ 255.968042][T16883] ? netlink_sendmsg+0x642/0xb30 [ 255.968056][T16883] ? skb_put+0x11b/0x210 [ 255.968073][T16883] netlink_sendmsg+0x805/0xb30 [ 255.968092][T16883] ? __pfx_netlink_sendmsg+0x10/0x10 [ 255.968109][T16883] ? aa_sock_msg_perm+0xf1/0x1d0 [ 255.968125][T16883] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 255.968142][T16883] ? __pfx_netlink_sendmsg+0x10/0x10 [ 255.968158][T16883] __sock_sendmsg+0x219/0x270 [ 255.968180][T16883] ____sys_sendmsg+0x505/0x830 [ 255.968201][T16883] ? __pfx_____sys_sendmsg+0x10/0x10 [ 255.968222][T16883] ? import_iovec+0x74/0xa0 [ 255.968242][T16883] ___sys_sendmsg+0x21f/0x2a0 [ 255.968261][T16883] ? __pfx____sys_sendmsg+0x10/0x10 [ 255.968294][T16883] ? __fget_files+0x2a/0x420 [ 255.968308][T16883] ? __fget_files+0x3a0/0x420 [ 255.968327][T16883] __x64_sys_sendmsg+0x19b/0x260 [ 255.968346][T16883] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 255.968374][T16883] do_syscall_64+0xfa/0x3b0 [ 255.968390][T16883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.968407][T16883] ? clear_bhb_loop+0x60/0xb0 [ 255.968425][T16883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.968442][T16883] RIP: 0033:0x7fa33c98ebe9 [ 255.968456][T16883] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 255.968472][T16883] RSP: 002b:00007fa33abf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 255.968491][T16883] RAX: ffffffffffffffda RBX: 00007fa33cbb5fa0 RCX: 00007fa33c98ebe9 [ 255.968504][T16883] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 255.968515][T16883] RBP: 00007fa33ca11e19 R08: 0000000000000000 R09: 0000000000000000 [ 255.968526][T16883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 255.968536][T16883] R13: 00007fa33cbb6038 R14: 00007fa33cbb5fa0 R15: 00007ffd8167bb38 [ 255.968556][T16883] [ 255.970283][T16870] netlink: 'syz.1.3076': attribute type 10 has an invalid length. [ 256.193217][ T5858] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 256.250400][T16898] netdevsim netdevsim4: Direct firmware load for  failed with error -2 [ 256.262878][ T5858] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 256.277662][T16894] tipc: Started in network mode [ 256.287768][ T5858] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 256.290271][T16894] tipc: Node identity 92cb6fc33315, cluster identity 4711 [ 256.302011][T16898] netdevsim netdevsim4: Falling back to sysfs fallback for:  [ 256.337738][T16894] tipc: Enabled bearer , priority 0 [ 256.393062][ T5858] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 256.478833][T16901] __nla_validate_parse: 1 callbacks suppressed [ 256.478852][T16901] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3090'. [ 256.480717][ T5858] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 256.488098][T16889] tipc: Resetting bearer [ 256.559072][T16889] tipc: Disabling bearer [ 256.565198][ T5873] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 256.571473][ T5873] Bluetooth: hci0: command 0x0c1a tx timeout [ 256.580579][T16901] (unnamed net_device) (uninitialized): option broadcast_neighbor: invalid value (5) [ 256.617505][T16891] lo speed is unknown, defaulting to 1000 [ 256.770079][T16918] sctp: [Deprecated]: syz.0.3096 (pid 16918) Use of int in maxseg socket option. [ 256.770079][T16918] Use struct sctp_assoc_value instead [ 256.885141][ T5873] Bluetooth: hci1: command tx timeout [ 256.912909][T16926] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition [ 256.928992][T16926] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0) [ 257.003297][T16891] chnl_net:caif_netlink_parms(): no params data found [ 257.160275][T16942] netlink: 'syz.0.3105': attribute type 10 has an invalid length. [ 257.171499][T16951] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3104'. [ 257.230694][T16891] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.247734][T16951] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3104'. [ 257.270112][T16891] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.293231][T16891] bridge_slave_0: entered allmulticast mode [ 257.301481][T16951] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3104'. [ 257.308602][T16891] bridge_slave_0: entered promiscuous mode [ 257.342672][T16891] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.375368][T16891] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.382643][T16891] bridge_slave_1: entered allmulticast mode [ 257.383889][T16951] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3104'. [ 257.428551][T16891] bridge_slave_1: entered promiscuous mode [ 257.478665][T16972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 257.486533][T16972] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 257.487892][T16976] netlink: 'syz.0.3112': attribute type 2 has an invalid length. [ 257.503156][T16972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 257.510770][T16972] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 257.532982][T16891] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 257.540744][T16976] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3112'. [ 257.544950][T16891] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 257.564404][T16976] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3112'. [ 257.574102][T16976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3112'. [ 257.629723][T16891] team0: Port device team_slave_0 added [ 257.652464][T16891] team0: Port device team_slave_1 added [ 257.671220][T16980] team_slave_1: Caught tx_queue_len zero misconfig [ 257.729472][T16983] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.736779][T16983] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.823715][T16891] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 257.833631][T16891] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 257.865416][T16891] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 257.877340][T16891] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 257.884283][T16891] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 257.919038][T16891] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 257.943980][ T8227] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.953126][ T8227] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.980116][ T8227] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.991170][T16991] netlink: 'syz.3.3116': attribute type 29 has an invalid length. [ 258.017810][ T8227] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.059121][T16993] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 258.094026][T16891] hsr_slave_0: entered promiscuous mode [ 258.100914][T16891] hsr_slave_1: entered promiscuous mode [ 258.107062][T16891] debugfs: 'hsr0' already exists in 'hsr' [ 258.117987][T16999] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3120'. [ 258.122490][T16891] Cannot create hsr debugfs directory [ 258.147007][ T959] IPVS: starting estimator thread 0... [ 258.204366][T17005] syzkaller1: entered promiscuous mode [ 258.210138][T17005] syzkaller1: entered allmulticast mode [ 258.241498][T17010] tipc: Enabled bearer , priority 0 [ 258.251477][T17010] syzkaller0: entered allmulticast mode [ 258.257768][T17006] IPVS: using max 46 ests per chain, 110400 per kthread [ 258.269304][T17010] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3123'. [ 258.276130][T17011] netlink: 'syz.0.3122': attribute type 10 has an invalid length. [ 258.290999][T17010] tipc: Resetting bearer [ 258.303268][T17011] team0: Device dummy0 is up. Set it down before adding it as a team port [ 258.319145][T17009] tipc: Disabling bearer [ 258.344817][T17013] 8021q: adding VLAN 0 to HW filter on device bond1 [ 258.360718][T17014] bond_slave_0: entered promiscuous mode [ 258.366392][T17014] bond_slave_1: entered promiscuous mode [ 258.373414][T17014] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 258.381931][T17014] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 258.395781][T17013] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 258.490829][ T6973] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 258.518786][ T6973] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 258.544876][ T6973] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 258.554817][ T6973] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 258.565208][ T5873] Bluetooth: hci3: command tx timeout [ 258.632851][T17033] macsec0: entered promiscuous mode [ 258.640935][T17033] macsec0: entered allmulticast mode [ 258.650415][T17033] veth1_macvtap: entered allmulticast mode [ 258.657116][T17033] macsec0: left promiscuous mode [ 258.666414][T17033] macsec0: left allmulticast mode [ 258.672037][T17033] veth1_macvtap: left allmulticast mode [ 258.682204][T17021] tipc: Enabled bearer , priority 0 [ 258.703251][T17021] syzkaller0: entered promiscuous mode [ 258.708793][T17021] syzkaller0: entered allmulticast mode [ 258.728551][T17021] tipc: Resetting bearer [ 258.739774][T17020] tipc: Resetting bearer [ 258.747062][T17020] tipc: Disabling bearer [ 258.769562][T17035] bridge2: entered promiscuous mode [ 258.774867][T17035] macsec1: entered promiscuous mode [ 258.780652][T17035] macsec1: entered allmulticast mode [ 258.786089][T17035] bridge2: entered allmulticast mode [ 258.793093][T17035] bridge2: port 1(macsec1) entered blocking state [ 258.801991][T17035] bridge2: port 1(macsec1) entered disabled state [ 258.810871][T17035] bridge2: left allmulticast mode [ 258.816276][T17035] bridge2: left promiscuous mode [ 258.838462][T16891] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 258.866983][T17036] bridge2: entered promiscuous mode [ 258.872370][T17036] macsec1: entered promiscuous mode [ 258.878906][T17036] macsec1: entered allmulticast mode [ 258.884280][T17036] bridge2: entered allmulticast mode [ 258.892066][T17036] bridge2: port 1(macsec1) entered blocking state [ 258.899064][T17036] bridge2: port 1(macsec1) entered disabled state [ 258.907459][T17036] bridge2: left allmulticast mode [ 258.912560][T17036] bridge2: left promiscuous mode [ 258.927663][T16891] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 258.990063][T16891] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 259.000747][T16891] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 259.063622][ T8228] veth0_to_bond: left allmulticast mode [ 259.080758][ T8228] veth0_to_bond: left promiscuous mode [ 259.105065][ T8228] bridge6: port 2(veth0_to_bond) entered disabled state [ 259.126283][ T8228] veth15: left allmulticast mode [ 259.131257][ T8228] veth15: left promiscuous mode [ 259.253466][ T8228] bridge6: port 1(veth15) entered disabled state [ 259.546703][T17077] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 259.717863][T17081] siw: device registration error -23 [ 259.780585][ T8228] bond0 (unregistering): Released all slaves [ 259.791552][ T8228] bond1 (unregistering): Released all slaves [ 259.801278][ T8228] bond2 (unregistering): Released all slaves [ 259.812509][ T8228] bond3 (unregistering): Released all slaves [ 259.822332][ T8228] bond4 (unregistering): Released all slaves [ 259.834716][ T8228] bond5 (unregistering): Released all slaves [ 259.943179][ T8228] k›*·]‘: left promiscuous mode [ 259.998942][ T8228] þ: left promiscuous mode [ 260.047004][T16891] 8021q: adding VLAN 0 to HW filter on device bond0 [ 260.073437][T16891] 8021q: adding VLAN 0 to HW filter on device team0 [ 260.084775][ T8228] tipc: Disabling bearer [ 260.100059][ T8228] tipc: Left network mode [ 260.104720][ T8230] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.111838][ T8230] bridge0: port 1(bridge_slave_0) entered forwarding state [ 260.128108][ T8230] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.135295][ T8230] bridge0: port 2(bridge_slave_1) entered forwarding state [ 260.191618][ T8228] IPVS: stopping backup sync thread 6668 ... [ 260.474252][ T8228] hsr_slave_0: left promiscuous mode [ 260.481539][ T8228] hsr_slave_1: left promiscuous mode [ 260.514648][ T8228] pim6reg (unregistering): left allmulticast mode [ 260.644997][ T5858] Bluetooth: hci3: command tx timeout [ 260.804952][ C1] ================================================================== [ 260.813064][ C1] BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x471/0x4b0 [ 260.820968][ C1] Read of size 2 at addr ffff8880555db82a by task modprobe/17133 [ 260.828667][ C1] [ 260.830984][ C1] CPU: 1 UID: 0 PID: 17133 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) [ 260.831004][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 260.831014][ C1] Call Trace: [ 260.831020][ C1] [ 260.831027][ C1] dump_stack_lvl+0x189/0x250 [ 260.831050][ C1] ? rcu_is_watching+0x15/0xb0 [ 260.831067][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 260.831083][ C1] ? rcu_is_watching+0x15/0xb0 [ 260.831098][ C1] ? lock_release+0x4b/0x3e0 [ 260.831121][ C1] ? __virt_addr_valid+0x1c8/0x5c0 [ 260.831140][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 260.831160][ C1] print_report+0xca/0x240 [ 260.831175][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 260.831195][ C1] kasan_report+0x118/0x150 [ 260.831217][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 260.831240][ C1] rose_timer_expiry+0x471/0x4b0 [ 260.831262][ C1] call_timer_fn+0x17e/0x5f0 [ 260.831284][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 260.831303][ C1] ? call_timer_fn+0xbe/0x5f0 [ 260.831323][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 260.831348][ C1] ? rcu_is_watching+0x15/0xb0 [ 260.831362][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 260.831383][ C1] __run_timer_base+0x61a/0x860 [ 260.831402][ C1] ? ktime_get+0x3e/0x1f0 [ 260.831423][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 260.831441][ C1] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 260.831465][ C1] run_timer_softirq+0xb7/0x180 [ 260.831485][ C1] handle_softirqs+0x283/0x870 [ 260.831502][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 260.831525][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 260.831543][ C1] __irq_exit_rcu+0xca/0x1f0 [ 260.831558][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 260.831576][ C1] irq_exit_rcu+0x9/0x30 [ 260.831589][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 260.831611][ C1] [ 260.831617][ C1] [ 260.831622][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 260.831640][ C1] RIP: 0010:validate_mm+0x10b/0x4b0 [ 260.831656][ C1] Code: 48 85 c0 0f 84 e4 02 00 00 48 89 c3 48 8d 78 40 48 89 f8 48 c1 e8 03 42 80 3c 30 00 74 05 e8 ac 58 0f 00 45 89 ee 48 8b 43 40 <48> 89 44 24 18 4c 8b 64 24 68 4c 8b 6c 24 70 4c 8d 7b 08 4c 89 f8 [ 260.831670][ C1] RSP: 0018:ffffc9001be9f620 EFLAGS: 00000246 [ 260.831685][ C1] RAX: 0000000000000000 RBX: ffff88805d159a00 RCX: ffff888030a80000 [ 260.831697][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88805d159a40 [ 260.831707][ C1] RBP: ffffc9001be9f750 R08: ffff888030a80000 R09: 0000000000000004 [ 260.831719][ C1] R10: 0000000000000003 R11: 0000000000000000 R12: 00005558a58fb000 [ 260.831728][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 [ 260.831747][ C1] ? __pfx_validate_mm+0x10/0x10 [ 260.831764][ C1] ? __pfx_uprobe_mmap+0x10/0x10 [ 260.831780][ C1] ? vma_wants_writenotify+0xb3/0x2a0 [ 260.831799][ C1] ? vma_set_page_prot+0xc3/0x100 [ 260.831819][ C1] mmap_region+0x15a5/0x20c0 [ 260.831843][ C1] ? __pfx_mmap_region+0x10/0x10 [ 260.831859][ C1] ? unmapped_area_topdown+0x571/0x590 [ 260.831902][ C1] ? mm_get_unmapped_area_vmflags+0xb3/0xe0 [ 260.831927][ C1] ? bpf_lsm_mmap_addr+0x9/0x20 [ 260.831946][ C1] ? security_mmap_addr+0x71/0x270 [ 260.831965][ C1] ? shmem_mapping+0xd/0x50 [ 260.831981][ C1] ? memfd_check_seals_mmap+0xc5/0x200 [ 260.831999][ C1] do_mmap+0xc45/0x10d0 [ 260.832022][ C1] ? __pfx_do_mmap+0x10/0x10 [ 260.832038][ C1] ? down_write_killable+0x178/0x230 [ 260.832056][ C1] ? __pfx_down_write_killable+0x10/0x10 [ 260.832070][ C1] ? common_file_perm+0x1b5/0x230 [ 260.832097][ C1] vm_mmap_pgoff+0x2a6/0x4d0 [ 260.832114][ C1] ? rcu_is_watching+0x15/0xb0 [ 260.832130][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 260.832147][ C1] ? lock_release+0x4b/0x3e0 [ 260.832176][ C1] ? __fget_files+0x3a0/0x420 [ 260.832189][ C1] ? __fget_files+0x2a/0x420 [ 260.832203][ C1] ksys_mmap_pgoff+0x51f/0x760 [ 260.832224][ C1] do_syscall_64+0xfa/0x3b0 [ 260.832238][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.832253][ C1] ? clear_bhb_loop+0x60/0xb0 [ 260.832270][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.832285][ C1] RIP: 0033:0x7f49a0e36242 [ 260.832299][ C1] Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00 [ 260.832312][ C1] RSP: 002b:00007ffe4e1ef878 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 260.832327][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f49a0e36242 [ 260.832338][ C1] RDX: 0000000000000001 RSI: 0000000000006050 RDI: 0000000000000000 [ 260.832348][ C1] RBP: 0000000000000802 R08: 0000000000000000 R09: 0000000000000000 [ 260.832357][ C1] R10: 0000000000000802 R11: 0000000000000246 R12: 0000000000000000 [ 260.832366][ C1] R13: 00007f49a0e0b050 R14: 00007ffe4e1efcb0 R15: 00000fffc9c3df12 [ 260.832384][ C1] [ 260.832389][ C1] [ 261.303830][ C1] Allocated by task 6145: [ 261.308144][ C1] kasan_save_track+0x3e/0x80 [ 261.312811][ C1] __kasan_kmalloc+0x93/0xb0 [ 261.317391][ C1] __kmalloc_cache_noprof+0x230/0x3d0 [ 261.322750][ C1] rose_add_node+0x23a/0xde0 [ 261.327324][ C1] rose_rt_ioctl+0xa48/0xfb0 [ 261.331897][ C1] rose_ioctl+0x3ce/0x8b0 [ 261.336207][ C1] sock_do_ioctl+0xdc/0x300 [ 261.340695][ C1] sock_ioctl+0x576/0x790 [ 261.345009][ C1] __se_sys_ioctl+0xf9/0x170 [ 261.349584][ C1] do_syscall_64+0xfa/0x3b0 [ 261.354065][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.359940][ C1] [ 261.362244][ C1] Freed by task 16839: [ 261.366305][ C1] kasan_save_track+0x3e/0x80 [ 261.370968][ C1] kasan_save_free_info+0x46/0x50 [ 261.375975][ C1] __kasan_slab_free+0x5b/0x80 [ 261.380728][ C1] kfree+0x18e/0x440 [ 261.384607][ C1] rose_rt_device_down+0x473/0x4c0 [ 261.389704][ C1] rose_device_event+0x603/0x6a0 [ 261.394620][ C1] notifier_call_chain+0x1b3/0x3e0 [ 261.399712][ C1] __dev_notify_flags+0x18d/0x2e0 [ 261.404720][ C1] netif_change_flags+0xe8/0x1a0 [ 261.409639][ C1] dev_change_flags+0x130/0x260 [ 261.414469][ C1] dev_ioctl+0x7b4/0x1150 [ 261.418791][ C1] sock_do_ioctl+0x22c/0x300 [ 261.423365][ C1] sock_ioctl+0x576/0x790 [ 261.427677][ C1] __se_sys_ioctl+0xf9/0x170 [ 261.432250][ C1] do_syscall_64+0xfa/0x3b0 [ 261.436743][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.442616][ C1] [ 261.444920][ C1] The buggy address belongs to the object at ffff8880555db800 [ 261.444920][ C1] which belongs to the cache kmalloc-512 of size 512 [ 261.458949][ C1] The buggy address is located 42 bytes inside of [ 261.458949][ C1] freed 512-byte region [ffff8880555db800, ffff8880555dba00) [ 261.472644][ C1] [ 261.474951][ C1] The buggy address belongs to the physical page: [ 261.481361][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880555dbc00 pfn:0x555d8 [ 261.491413][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 261.499892][ C1] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 261.508389][ C1] page_type: f5(slab) [ 261.512353][ C1] raw: 00fff00000000240 ffff88801a441c80 ffffea0000bd6f10 ffffea00008f3c10 [ 261.520920][ C1] raw: ffff8880555dbc00 000000000010000f 00000000f5000000 0000000000000000 [ 261.529492][ C1] head: 00fff00000000240 ffff88801a441c80 ffffea0000bd6f10 ffffea00008f3c10 [ 261.538147][ C1] head: ffff8880555dbc00 000000000010000f 00000000f5000000 0000000000000000 [ 261.546799][ C1] head: 00fff00000000002 ffffea0001557601 00000000ffffffff 00000000ffffffff [ 261.555447][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 261.564094][ C1] page dumped because: kasan: bad access detected [ 261.570497][ C1] page_owner tracks the page as allocated [ 261.576191][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5948, tgid 5948 (kworker/u8:2), ts 59553169412, free_ts 14703827249 [ 261.597540][ C1] post_alloc_hook+0x240/0x2a0 [ 261.602300][ C1] get_page_from_freelist+0x21e4/0x22c0 [ 261.607824][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 261.613609][ C1] alloc_pages_mpol+0x232/0x4a0 [ 261.618446][ C1] allocate_slab+0x8a/0x370 [ 261.622945][ C1] ___slab_alloc+0xbeb/0x1410 [ 261.627610][ C1] __kmalloc_cache_noprof+0x296/0x3d0 [ 261.632974][ C1] alloc_bprm+0x7d/0x5c0 [ 261.637202][ C1] kernel_execve+0x9b/0x9f0 [ 261.641698][ C1] call_usermodehelper_exec_async+0x210/0x360 [ 261.647763][ C1] ret_from_fork+0x3f9/0x770 [ 261.652353][ C1] ret_from_fork_asm+0x1a/0x30 [ 261.657113][ C1] page last free pid 1 tgid 1 stack trace: [ 261.662904][ C1] __free_frozen_pages+0xbc4/0xd30 [ 261.668018][ C1] free_contig_range+0x1bd/0x4a0 [ 261.672941][ C1] destroy_args+0x64/0x4a0 [ 261.677346][ C1] debug_vm_pgtable+0x39f/0x3b0 [ 261.682180][ C1] do_one_initcall+0x233/0x820 [ 261.686933][ C1] do_initcall_level+0x104/0x190 [ 261.691856][ C1] do_initcalls+0x59/0xa0 [ 261.696165][ C1] kernel_init_freeable+0x334/0x4b0 [ 261.701351][ C1] kernel_init+0x1d/0x1d0 [ 261.705661][ C1] ret_from_fork+0x3f9/0x770 [ 261.710233][ C1] ret_from_fork_asm+0x1a/0x30 [ 261.714988][ C1] [ 261.717296][ C1] Memory state around the buggy address: [ 261.722905][ C1] ffff8880555db700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 261.730942][ C1] ffff8880555db780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 261.738982][ C1] >ffff8880555db800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 261.747020][ C1] ^ [ 261.752371][ C1] ffff8880555db880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 261.760409][ C1] ffff8880555db900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 261.768445][ C1] ================================================================== [ 261.776613][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 261.783811][ C1] CPU: 1 UID: 0 PID: 17133 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) [ 261.793001][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 261.803046][ C1] Call Trace: [ 261.806315][ C1] [ 261.809145][ C1] dump_stack_lvl+0x99/0x250 [ 261.813726][ C1] ? __asan_memcpy+0x40/0x70 [ 261.818307][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 261.823508][ C1] ? __pfx__printk+0x10/0x10 [ 261.828113][ C1] vpanic+0x281/0x750 [ 261.832088][ C1] ? __pfx_vpanic+0x10/0x10 [ 261.836580][ C1] ? rcu_is_watching+0x15/0xb0 [ 261.841342][ C1] panic+0xb9/0xc0 [ 261.845060][ C1] ? __pfx_panic+0x10/0x10 [ 261.849467][ C1] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 261.855354][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 261.861244][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 261.866346][ C1] check_panic_on_warn+0x89/0xb0 [ 261.871277][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 261.876374][ C1] end_report+0x78/0x160 [ 261.880606][ C1] kasan_report+0x129/0x150 [ 261.885101][ C1] ? rose_timer_expiry+0x471/0x4b0 [ 261.890228][ C1] rose_timer_expiry+0x471/0x4b0 [ 261.895162][ C1] call_timer_fn+0x17e/0x5f0 [ 261.899747][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 261.905198][ C1] ? call_timer_fn+0xbe/0x5f0 [ 261.909862][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 261.914968][ C1] ? rcu_is_watching+0x15/0xb0 [ 261.919727][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 261.925175][ C1] __run_timer_base+0x61a/0x860 [ 261.930018][ C1] ? ktime_get+0x3e/0x1f0 [ 261.934336][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 261.939694][ C1] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 261.945926][ C1] run_timer_softirq+0xb7/0x180 [ 261.950765][ C1] handle_softirqs+0x283/0x870 [ 261.955515][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 261.960277][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 261.965551][ C1] __irq_exit_rcu+0xca/0x1f0 [ 261.970126][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 261.975338][ C1] irq_exit_rcu+0x9/0x30 [ 261.979565][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 261.985193][ C1] [ 261.988109][ C1] [ 261.991021][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 261.996985][ C1] RIP: 0010:validate_mm+0x10b/0x4b0 [ 262.002167][ C1] Code: 48 85 c0 0f 84 e4 02 00 00 48 89 c3 48 8d 78 40 48 89 f8 48 c1 e8 03 42 80 3c 30 00 74 05 e8 ac 58 0f 00 45 89 ee 48 8b 43 40 <48> 89 44 24 18 4c 8b 64 24 68 4c 8b 6c 24 70 4c 8d 7b 08 4c 89 f8 [ 262.021765][ C1] RSP: 0018:ffffc9001be9f620 EFLAGS: 00000246 [ 262.027825][ C1] RAX: 0000000000000000 RBX: ffff88805d159a00 RCX: ffff888030a80000 [ 262.035784][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88805d159a40 [ 262.043741][ C1] RBP: ffffc9001be9f750 R08: ffff888030a80000 R09: 0000000000000004 [ 262.051701][ C1] R10: 0000000000000003 R11: 0000000000000000 R12: 00005558a58fb000 [ 262.059654][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 [ 262.067621][ C1] ? __pfx_validate_mm+0x10/0x10 [ 262.072550][ C1] ? __pfx_uprobe_mmap+0x10/0x10 [ 262.077470][ C1] ? vma_wants_writenotify+0xb3/0x2a0 [ 262.082828][ C1] ? vma_set_page_prot+0xc3/0x100 [ 262.087840][ C1] mmap_region+0x15a5/0x20c0 [ 262.092427][ C1] ? __pfx_mmap_region+0x10/0x10 [ 262.097360][ C1] ? unmapped_area_topdown+0x571/0x590 [ 262.102846][ C1] ? mm_get_unmapped_area_vmflags+0xb3/0xe0 [ 262.108740][ C1] ? bpf_lsm_mmap_addr+0x9/0x20 [ 262.113591][ C1] ? security_mmap_addr+0x71/0x270 [ 262.118696][ C1] ? shmem_mapping+0xd/0x50 [ 262.123191][ C1] ? memfd_check_seals_mmap+0xc5/0x200 [ 262.128639][ C1] do_mmap+0xc45/0x10d0 [ 262.132788][ C1] ? __pfx_do_mmap+0x10/0x10 [ 262.137361][ C1] ? down_write_killable+0x178/0x230 [ 262.142633][ C1] ? __pfx_down_write_killable+0x10/0x10 [ 262.148245][ C1] ? common_file_perm+0x1b5/0x230 [ 262.153275][ C1] vm_mmap_pgoff+0x2a6/0x4d0 [ 262.157856][ C1] ? rcu_is_watching+0x15/0xb0 [ 262.162605][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 262.167703][ C1] ? lock_release+0x4b/0x3e0 [ 262.172285][ C1] ? __fget_files+0x3a0/0x420 [ 262.176945][ C1] ? __fget_files+0x2a/0x420 [ 262.181521][ C1] ksys_mmap_pgoff+0x51f/0x760 [ 262.186285][ C1] do_syscall_64+0xfa/0x3b0 [ 262.190774][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.196827][ C1] ? clear_bhb_loop+0x60/0xb0 [ 262.201491][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.207368][ C1] RIP: 0033:0x7f49a0e36242 [ 262.211775][ C1] Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00 [ 262.231373][ C1] RSP: 002b:00007ffe4e1ef878 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 262.239778][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f49a0e36242 [ 262.247738][ C1] RDX: 0000000000000001 RSI: 0000000000006050 RDI: 0000000000000000 [ 262.255694][ C1] RBP: 0000000000000802 R08: 0000000000000000 R09: 0000000000000000 [ 262.263650][ C1] R10: 0000000000000802 R11: 0000000000000246 R12: 0000000000000000 [ 262.271605][ C1] R13: 00007f49a0e0b050 R14: 00007ffe4e1efcb0 R15: 00000fffc9c3df12 [ 262.279567][ C1] [ 262.282824][ C1] Kernel Offset: disabled [ 262.287129][ C1] Rebooting in 86400 seconds..