last executing test programs: 3.373712991s ago: executing program 2 (id=2795): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x15}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}]}, &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x26, &(0x7f0000000100)=""/38, 0x41100, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x8, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x3, 0x10, 0x6, 0xf1}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000240)=[0x1, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0x1, 0x1, 0xffffffffffffffff], &(0x7f0000000280)=[{0x0, 0x1, 0xd, 0xb}, {0x5, 0x3, 0x4, 0x9}, {0x0, 0x2, 0x8, 0x1}, {0x4, 0x3, 0xb, 0x8}, {0x3, 0x4, 0xd, 0x8}, {0x1, 0x3, 0xd, 0x5}], 0x10, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='mmc_request_done\x00', r0, 0x0, 0x40}, 0x18) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x18, 0x2e, 0x1, 0x8f0bd26, 0x25dfdbfc, {0x4}, [@nested={0x4, 0x12}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) 3.173216773s ago: executing program 2 (id=2798): mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)={0x284, 0x1, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_TABLE_USERDATA={0xf1, 0x6, "46417551ae5d5d3da1c8c515875c70aee53466600c892567ca8ace3da9d4edbcbf67a2303492089824610cc49ff3a36a841572893911ee7f6f5cf6297e168986ed2f5f323088311818ce9e60bad5edd4303e3ca3deb887dcca2d84265b47482ee0bde6d856d02b9eceed768942d7499365eae885df0d92d37a29cbe6f2b7f0d39939d40fb0acdbb88a6d614ae573a51b866108e53a15f223cb181d45dbdc10c3bed655510d0c48e2fec7d15813497b86ee63e1e746dbc60bc2244b58ee09606cb8d370d8a78c0fc0993d20a4ce9df02427d5ad70dc67849f9df387dbb4d02cd1573eac422b4a04ef6731f0b72f"}, @NFTA_TABLE_USERDATA={0x37, 0x6, "d46854b9ffcc18e4873fb8706c2abb024014e8be8a002b8afc6c7a46cfe91f5d47fd782bb3f511fc1882fe9b5a16037abc53ce"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_USERDATA={0xb9, 0x6, "9a4871f124cb10c4e089f902669c2cc242cf201bb1b5e2237be4169f865c8af971389b884de81240a42b031c7f1c51c5120cddc10178ca66cd874039b0ef1ad31c04fe484fe2b36c5fb8c2e3b9f689c8bf790f2ee1a38a97d8d3c9c4e240d6d678bcd3aaa7e91c0fb07a22989a8ef29da3b8d72cf3e73a3c607935e3722a05fe279dfa287d9957612ef5ff640a6d294df59af0e3f4284001c6eaa404798bb3b846d0221440ca913616235d95c8abcb79d6b94d1dc1"}, @NFTA_TABLE_USERDATA={0x57, 0x6, "4904c19fad7aefbc89d4e56af8449be5a771c320863d81c415027ab1e3c249a1696486476f40dff85b96c23fe63a7a15603df1daaf2e4269b248ac4c30cbf0d863c99e35136b3858b20bc620f0bb1a1a3dd1ae"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x7}]}, 0x284}, 0x1, 0x0, 0x0, 0x40}, 0x20000050) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x3, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x27, 0xcc0, 0x7, &(0x7f00000003c0)="52e1119c000000002bf0543786dd", 0x0, 0x20007, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0xab) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r3, &(0x7f00000003c0)={0x0, 0xfffffffffffffd90, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r4, 0x701, 0x74bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000001100), r3) mmap(&(0x7f000086a000/0x2000)=nil, 0x2000, 0x4, 0xf5cfd0ed62d9e836, 0xffffffffffffffff, 0x2000) 2.923334346s ago: executing program 2 (id=2801): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x24, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x48010}, 0x0) unshare(0x24020400) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000240)="94", 0x1) vmsplice(r3, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7c8926dc6acd0ae6c178054e95986faff9544de5fc4c30adf404da41181a77466ac5075905ea5f50134fdd517a957fe2ee59b61f9fe8d7aabe595ea23de2723e437af0423a56686a4c2d957be1a0ab922fbbd3cb1d8c6ab0d58440a327c8eb05d445b4ac5f20abe449e4084f8b996268d0564f67980d3ed3479e0edfe5cec7b4f89bface391c9c4c58ad123b91c33173c72326d1df18804a9ea20f9ece48f784d8ca2318e3d2b316666b5dfb7295c4915989d5bcb120e8fedaa97b93a137c256ce4", 0x20013644}, {&(0x7f0000013680)="c578381bf5113dad8319d9ea5294285ae9a90384ce23866477bef9de4399237d8b3522c9c194e71edaf3332a2f169682f9d8fa271683d4d441b710409e506333e0c3b64e52e8720734b6787f4a84f5bebb046649c6c697d978affd349031b2cd874c7a8961a586a9f2d62f945e7a5bf2f5f7a31684c0503704881d2578a2a98ac3ef4e4a4b0dcdb70db735d5c1652eed3848b2dd4131bb0eb7cfadfaf5", 0x9d}], 0x2, 0x0) tee(r1, r3, 0x2, 0x100000000000003) r4 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r4, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r4, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x0) syz_extract_tcp_res(&(0x7f00000000c0), 0x80, 0x1) syz_emit_ethernet(0x216, &(0x7f00000005c0)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "9928a2", 0x1e0, 0x11, 0xff, @private1, @private1={0xfc, 0x1, '\x00', 0x1}, {[@srh={0x3c, 0x2, 0x4, 0x1, 0x1, 0x10, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}]}, @routing={0x11, 0xa, 0x1, 0x9, 0x0, [@mcast1, @ipv4={'\x00', '\xff\xff', @remote}, @remote, @remote, @private0={0xfc, 0x0, '\x00', 0x1}]}, @routing={0x62, 0x8, 0x2, 0x0, 0x0, [@rand_addr=' \x01\x00', @remote, @empty, @empty]}, @dstopts={0x89, 0x12, '\x00', [@ra={0x5, 0x2, 0x82}, @ra, @calipso={0x7, 0x38, {0x2, 0xc, 0x2, 0x1ff, [0x10001, 0x2, 0x3, 0x7, 0xe2ab, 0x4]}}, @generic={0x53, 0x40, "92115f13bc1ee7d750233a8e2470582b2b72b02c4119c78a2802beb7e3cc17b807cc1bf4aef26bbb16dcef54b8da327e36e00a0655f1fca3ff66aa29b9eb1c89"}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x5}]}], {0x4e22, 0x4e22, 0x88, 0x0, @opaque="a5fa95014fedf2a9ebf0f1b233bbac58738e5ed2e454a6b9e27138b969071429861fdad789092b7b79e2668d205ae5162783164cf7afe1fc7157ffddfd05b5926861fee3e1664d9847ffa65c43f5db94c112430e6900206f828fe07e207151fd60bf48059a572581ae2f3914b7c20ded4ae24099862f531d2de4b451652cc118"}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) r6 = socket$kcm(0xa, 0x2, 0x73) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, &(0x7f0000001100)=@broute={'broute\x00', 0x20, 0x5, 0x146, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000011c0], 0x0, 0x0, &(0x7f00000011c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{0x5, 0xe, 0x890d, 'veth0_to_bond\x00', 'veth1_vlan\x00', 'pimreg1\x00', 'tunl0\x00', @multicast, [0xff, 0x0, 0x0, 0x0, 0x0, 0xff], @random="7d9ad184ac9d", [0x0, 0xff, 0x0, 0xff, 0xff], 0x6e, 0x6e, 0xb6, [], [], @common=@ERROR={'ERROR\x00', 0x20, {"5feb50bc72f9796637f17372fc066bd93f164f25de54e865c664e7b0376e"}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x3, 0xffffffffffffffff}]}, 0x1be) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xfff, 0x40, 0x172}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000841}, 0x3000c81c) 2.829026928s ago: executing program 3 (id=2802): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = getpid() sendmmsg$unix(r3, &(0x7f00000017c0)=[{{&(0x7f0000000180)=@abs={0x1, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000001780)=[@rights={{0x14, 0x1, 0x1, [r3]}}, @cred={{0x1c, 0x1, 0x2, {r4}}}], 0x38, 0x40004}}], 0x1, 0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, r2, 0x401, 0x70bd26, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}}, 0x0) socket$netlink(0x10, 0x3, 0x4) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f00000000c0)={0x41, 0x12}, 0x10) (async) r7 = socket$tipc(0x1e, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) (async) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x3}, 0x10) (async) r8 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000100)={0x41}, 0x1be) (async) getsockopt$TIPC_NODE_RECVQ_DEPTH(r7, 0x10f, 0x83, &(0x7f0000000140), &(0x7f00000002c0)=0x4) (async) sendmsg$tipc(r7, &(0x7f0000000240)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x18}}, 0x10, 0x0}, 0x0) write$nci(r0, &(0x7f0000000280)=@NCI_OP_RF_DISCOVER_NTF={0x1, 0x0, 0x3, 0x3, 0x2, @f={0x7, 0x3, 0x2, 0xe5, {0x5, 0x12, "c71dcc80b3c4f576ebda506287a4ebf7e501"}, 0x2}}, 0x1c) 2.680354516s ago: executing program 2 (id=2805): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20040000) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f0000000040)={'nat\x00', 0x2, [{}, {}]}, 0x48) sendfile(r0, r3, 0x0, 0x20000000002) 2.551975908s ago: executing program 3 (id=2807): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='b '], 0x47) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = openat$cgroup_devices(r2, &(0x7f0000000380)='devices.allow\x00', 0x2, 0x0) splice(r0, 0x0, r3, 0x0, 0x6, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0xb, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}}, 0x20008004) 2.412935086s ago: executing program 3 (id=2808): socket$kcm(0x11, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b86803000aab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e", 0x8b) getsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="500000001000370400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="c304010000000000280012800b000100697036746e6c00001800028014000300fc000000dd0000000000000000000000080004000d01"], 0x50}, 0x1, 0x0, 0x0, 0x4c011}, 0x0) clock_gettime(0x0, &(0x7f00000000c0)) write$tun(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0800080001030300ffff140005004510002800000000002f9078ac1efc01ac1414aa00004e20", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50200005780000"], 0x36) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, 0x0, 0x50) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r6, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x5}, &(0x7f0000000080)=0x8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) r7 = socket$rds(0x15, 0x5, 0x0) bind$rds(r7, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0x3}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000001}, 0x8) 2.229223016s ago: executing program 1 (id=2811): bpf$PROG_LOAD(0x5, &(0x7f0000001440)={0x1e, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="850000008c000000040000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1}, 0x94) (async, rerun: 32) r0 = socket(0x400000000010, 0x3, 0x0) (rerun: 32) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r3 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet(r3, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x5000000, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x27, 0x0) (async, rerun: 64) r4 = socket$alg(0x26, 0x5, 0x0) (rerun: 64) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) (async, rerun: 64) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) (rerun: 64) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 64) close(0x4) (async, rerun: 64) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="040100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001200000080001"], 0x104}}, 0x0) (async) r6 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@assoc={0x18, 0x117, 0x4, 0x10}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x40040}], 0x1, 0x8040) (async) sendmsg$RDMA_NLDEV_CMD_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000000114000425bd7000ffdbdf25080001000000000008000100000000000800010000000000f2841a71d3080001000201"], 0x38}}, 0x0) (async, rerun: 64) recvmsg(r6, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001240)=""/47, 0x2f}, {&(0x7f0000001280)=""/211, 0xd3}], 0x2}, 0x10002) (rerun: 64) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r2, {0x0, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @broadcast}, @TCA_FLOWER_KEY_ARP_SIP_MASK={0x8, 0x3a, 0xffffffff}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) (async) connect$bt_sco(r0, &(0x7f0000000040), 0x8) 2.167390741s ago: executing program 4 (id=2812): socket$key(0xf, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) epoll_create1(0x80000) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0xffffffffffffffdd, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'dh\x00', 0x4, 0x3ef4, 0x20000265}, 0x2c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x34, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000ca8b9c0c732da71065ec9db04aa087c04d50247d0b45b48b766f4f64ffc3fad2a035c3e74dfa37e2919c6e5320b04a9cd05dc8761b6bd42834fb21fcc79870f5b31f61c1c5c89a900ddeca874582a84393bbde8ea534560de31f833a34bc4e0094b232aa6f2024895286444d5e157d22ade3f37fe11f8dfc6842b7f92b51d763fe573d1a5e9a2560935b2ceca8cc1a2565e9c70a973bc9735b41630a114fa11885fa089fe25b0167eec9b02376c5ef9d0a74ea549b68c85490434e7cfde14c84e51eec576363000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00f0ff0000000000000000000000000000000000000000ffffdeffffd075abf1bb899b2cc56a7a3d570844035b543d967d8c0c"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x19, 0x17, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000010000000000000098110000378323082247a81de441d464714db59352fed759380f4ebd04103d70c6b1d98d4053b521cadb1a5714d756287b4d0000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09110000000000660901000000000006002020702500000000002020207b9af8ff00000000ad91000000000000370100ffffb702000008000000b70300000200000056000000060000002c95aaab6e6d6b8b897ac0ba8793000000000000b5030000000000008500000075fff800b700"/160], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000001c40)=0x4) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) 1.936656183s ago: executing program 1 (id=2813): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="020100090a0000000000000000000200030006000000000002000000ac1414bb00000000000000003800010000000000fd000504feffff4b030005000000000002004e21e00000020000000000000000"], 0x50}}, 0x0) (async) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000060000000000000000004907cf8c000000000000000000c80300000000020400000300000000000000040008000000000800000000000000005f"], 0x0, 0x4e, 0x0, 0x8}, 0x28) (async) sendmsg$802154_dgram(r1, &(0x7f0000000040)={&(0x7f0000000100)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0302}}}, 0x14, &(0x7f0000000080)={0x0}, 0x7, 0x0, 0x0, 0x98a594acd120b8d5}, 0x40) (async) r2 = socket(0x23, 0x5, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x113, 0x40, 0x0, 0x0) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r3, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000a00)={0x624, 0xd, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x5fc, 0x3, 0x0, 0x1, [{0x5f8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x100, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x14, 0x1, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, ["", "", "", "", "", "", ""]}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0x10, 0x1, 0x0, 0x1, @hash={{0x9}, @void}}, {0x14, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, ["", "", ""]}}}, {0x70, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}, {0x10, 0x1, 0x0, 0x1, @xfrm={{0x9}, @void}}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x4d8, 0xb, 0x0, 0x1, [{0x4d4, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x4c4, 0x2, 0x0, 0x1, [@NFTA_BITWISE_DATA={0x160, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0xaf, 0x1, "83db9d2702d2bc7b0652246ebe8f917616892cde672725eaacbe4ac77f9d84f754b797c4820aeca124d2be239218b201cc7804dda59ecc1097beb699a296a46aaf460ccc8aa28339108b849ea1bd913e9cc7a5c480a166f9674844fe0f1b6f7180a6e3b88243fed2d340927d49d00621f168a07bec80d7ddaf3fb89c8e840f22bf78a9418f4aaa15fe17d16d873dd8e23ff5a7d9fbaf68d77d33f9aabf58c7321202c8a551558c4572d10d"}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x62, 0x1, "8f32f898be8b27b16b4a08b0b223f0b85ada6b6d59781597fa72a2c5ec3b7aa01a7b40c05708d446361e1f55d84b0d386a9dacb3de20dd6b597df584be1901342a17d733cfb6797d394b81ebefb2b581235954e79b4f353f4a4e88feefa0"}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x10000}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_BITWISE_DATA={0x338, 0x7, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x4}]}, @NFTA_DATA_VERDICT={0x5c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x25, 0x1, "7df8d68d5eaa1a281e4e0231b448364de126fd8ac4331b71b73523767edf6f1570"}, @NFTA_DATA_VALUE={0xe4, 0x1, "9a498b0af04316b74aead309ac113b562ad258d7a06d4b1ab304eed05f7eaa49eede791053998ea8b2bab289f9164e4c85065a77077bacc18addbe0dd869e787898c8b6f7a17b7e0a77781f38a505b136925d18cdd5657698b41edc95d6e3d3f163ba6f0f7712d3f96d67405a3361cd17efdf522cc6dd0909ec4dadd3e1b8351ec8d3e3a75faa408b8dc206bece9320b2429a1c4e23d2583104cdaaa067e67ed8decd177f32dc5dbf0a6189070e3e075aa085001c0318e9eb7f50b9a52f8bbe429292934909ed682344797d39dc6c2c2b69596e900be3bb861cbb5646499846e"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x37, 0x1, "8bab2a12805772744a283123aea5b5b85fb7cdf13de904c6e463382a55cdb9bf8aee81407394879706f24929bdfccf1adfc459"}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VALUE={0x89, 0x1, "04f333b45486a589dfee0db14eb01be3fef5e03007a8e2d1c22cc9eccfab9bbf192efb0a7926f5a94d469196e6791c9eb6d94475959c05e5b653b3a942911bd19f42323a984044cedaf47695e0071da35fe3fdbcde310e6fa390181194284408abf734d43cb08ef515c2012caa5fbed0c4278c1ebecfa479b22367ebee0770006e4258f89c"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}}}]}, @NFTA_SET_ELEM_USERDATA={0x9, 0x6, 0x1, 0x0, "44b7e92fec"}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @objref={{0xb}, @void}}]}]}]}, 0x624}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r6, 0x20, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a0b040000000000000000020000005c000480580001800a0001006d617463680000004800028008000240000000001c0003004cb43801b2486e8f58c2052fade1bc2c62cdeb7521cf85f60e0001007374617469737469630000000e000100636f6e6e62797465730000000900010073797a30000000000900020073797a32"], 0xb0}}, 0x0) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f00000006c0)={r5, @in6={{0xa, 0x4e21, 0x2001, @mcast1, 0x58}}}, 0x84) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r9, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, 0x0, 0x0, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) (async) r10 = socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) (async) r11 = socket(0x840000000002, 0x3, 0x100) setsockopt$bt_hci_HCI_FILTER(r11, 0x0, 0x2, &(0x7f0000000200)={0x1, [0x2, 0x5], 0x2}, 0x10) connect$inet(r11, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r11, &(0x7f0000005240), 0x4000095, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 1.71332942s ago: executing program 2 (id=2816): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYRES16, @ANYRES32], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xe, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) connect$inet(r1, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44840) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r0) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, 0x0, 0x20008000) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xd0f, 0x70bd2b, 0xfffffffc, {0x60, 0x0, 0x0, r5, {0x0, 0x8}, {0xfff3, 0xffff}, {0x0, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x4e21, 0x3, 'rr\x00', 0x1b, 0x4, 0x8}, 0x2c) socket$kcm(0xa, 0x2, 0x0) unshare(0x2040400) socket$kcm(0x29, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x800) socket$nl_route(0x10, 0x3, 0x0) ioctl$NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0) 1.509463079s ago: executing program 1 (id=2817): r0 = socket$caif_seqpacket(0x25, 0x5, 0x0) write(r0, 0x0, 0x0) setsockopt$CAIFSO_LINK_SELECT(r0, 0x116, 0x7f, &(0x7f0000000000)=0x465f, 0x4) 1.452425731s ago: executing program 1 (id=2818): r0 = socket(0x1e, 0x4, 0x0) getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl0\x00', r1, 0x29, 0x0, 0x8, 0x800, 0x5, @dev={0xfe, 0x80, '\x00', 0x28}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10, 0x0, 0xe7, 0x1}}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x0) ioctl$sock_TIOCOUTQ(r5, 0x5411, &(0x7f0000000000)) r6 = socket(0xa, 0x5, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x140000) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r8}, 0x10) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r9, 0x800448f0, &(0x7f00000000c0)={0x0, 0x2, '\x00', 0x9, 0xf8}) openat$tun(0xffffffffffffff9c, 0x0, 0x60280, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r10, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f00000007c0)={r11, @in6={{0xa, 0x4e23, 0x6, @empty, 0x2}}, 0xfad, 0x4}, 0x90) r12 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x7}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r13, {0x8, 0x7}, {}, {0xfff3, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 1.319829534s ago: executing program 0 (id=2819): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r2, @ANYBLOB="080003"], 0x44}}, 0x10) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000000)=0xfffffffa, 0x4) 1.161126127s ago: executing program 1 (id=2820): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x2, 0x8000000000000000, 0xffffffffffff0000}) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000040)="043c529201aa66ecba407abc9ba0fd8ec0796e16d910ad1a5d0ee4598406e109e1ae36600b471f37521bda6c9eee6a9deb4969e2a9627cd324d9f41a280fa4ca457923d11e8d49b0f83a17844fb3569d05b58b07bb9e72edea2e97d1dc5111144d4eb98b640a757d469c08ffd8e2eb0940dc5b49b8411d945121fe5ddf75fd94b1437b52ec6419488fc9c0a26b9abbe03f27d358ae3d3ae50a19f3cbce6630b8bd7ee79cebddcd8c49b9a0e68301e6cdd65be1f591bf45e05364acdc461b170500b62accd914f9d2f7470ae0716096706c3a5d788d07c22686318f560a82f0e7e8f71fc9bdd134ba9968e46a4409d9cbb16d3cec92addd8ff317cae63dc431fa") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x18, r2, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_TXQ_PARAMS={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4055}, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r3, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xb8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x24004000}, 0x48040) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000003c0)={'veth0_to_bond\x00', 0x800}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r1) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f0000001840)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001800)={&(0x7f0000000480)={0x1380, r4, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK={0x9c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdcd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NET={0x38, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fffffffffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_NODE={0x10d4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x6c, 0x3, "cd086de67bea3f225e218f505874e18a235b158bb179dec6af4fd201728db188ea923b21da0df4ee049a21d4b8c212ee239d30acdcc9d03887280d5708216fef059b932f2ff4623c833b5565eeef8b823d053cee3d371407544dab8ced4cf31eec0750ab3f7a9b8d"}, @TIPC_NLA_NODE_ID={0x1004, 0x3, "d4f12154d4418ecf72fe11f95bd0bd775acb994342d75ce155e6c8dba42fae9366107eeaab0ac4f0b92fd568b0e0ca132731d93a8478f124292834de56b6392996b4dc10225cbeba09664369f05e06b5ca8c25da732e6d1d35ecb8c82a1fc315d511b6eef4da4c7128350791795dc82125ae43a0c20d399e090c076fa532e2bf06ac23427423169a93338e800a0ac47a169d54a6a811479d19152c63f9a1360cc6b045caaa3ec6dfbcb483f792f6cfef2c761fb71891e31621eda73e37a205b9e6b0c6f998d18cb93968e4eefc7d870b0dea54aa21faa57151a8088945b0cccf83dca10bd6559cf8a34692ee8aaf52ac43806810f937e667fa860cc9767f9d8fb28473400b03be38ed776914d6605c89fb550ac830e7e7f97d8612960b3534cd0b95c85805fcdc20d789780742622cd9c6e95d853febff018735a6a7bc93ef7dbb25a8b9c891d792b2ec4d9b625ec0440d265822806f3f9ca62be482c4ec461bc4f6ed5d62ed51e62c45339d53e1f3613154bf84c279fb6d53a31050b03cf4ef403a4dffb57f220092534f3e0b822a91bc3f3a6af2f1667dcf5d0271ef83dafe5bd89a9cec493896d84343ba03af933bf16fdf786551c4324a49c7577fee8ae557c15dc760245cf4072d07fd4b650e12011792ef13e04451e21e1ef76caffa37bc3738b8c555091b59c5e5f1d2f11d013751e50ff2513fdc1a0268223fe224333667db7d9caab1c42da9d6dfcbe80d4e189c16af62e510b226f2128ae88e236e781ff33b750db0b83105af20ed1357a4bc10315b8834f13f5d5ac4ce6c3051b85c04ef99747d221309dc825133a9e0e29ba72cf965080c731fd25d5092da7d94362f7a2c640e3eb19ab82540538163a1e65d3a3035becfa7cdf520d7cd02745972b03f6b8f8769b59d280bc0307a501b201975d178a6a34c28c732a5f544acc14699505dc7b0ab6fe313c6f2cff638a58b81b20ecb59666e82910c6dd9c6c4684da85ed353b1c2ec6851db40b44810b0949a611fd49ac265000f9dac302e2415be245a0712297ad784709f2802302a11d510dde1c90cf322308529df9209fee3b27d1b8f4db831fb909efafb180ed250aa561ff40f80c1d2b1d4e80d82d0a1f3fede96af81ee9f4a1b0be00f086f9a3059cdc914361b7f02613a8ef4d0b9e3db815e1c07b0252d9486ef494e7dbfdd9538c415e8d15ae41d9a16a6f8d1d03992660fe838fc2340faeb88e633b1ee6379ea41f7aa144b07bb38ac4e3076884e6f37aeb6402d11dfa63046fd633af9dc3b43cf357f578e89f1eb43cfc75420f80b41c8d33d634f38553876639503b588bae79ebbd0cc064d529bc7968ade1611fc9c79df15fb1d4093b3b62e604ecd28f6bd0c2d214d4f1f169078a28b7ca93750ebe29a169ef79a55b94f4da82f5bbfe155f98f4cf879a6493487e18eabdd2f86e970adc92a02a3cc66733f2c8e2645f05291f581e012eb7c4557f579eaa2f42912081d7f186c74c9ffb8d2347391e2a20a91cea98fc540816939034cbf03a7566891858f6a3f36d8c8462b61e6eeba1b2d666e0f59ef014897ee128831a2f314fc1342b193821f12c671f571e0de1e512f7dbf4a1e0dd567edfd13cec2d55cdb98dd7c6db8c40439c1e7cd3c44cd2c0b8068093f751e503d01f5146a938bb1383f3268aafc79a292cd6d940271340293b26ec1384570c3582796c7f56f8049bfe961ca20de0ab8e70bc008e90c42b7f75ad6aa14d3cac40d88d48efb62c3269aa6fd78bca8b704bd3e9b39d305ccc5576a60b412bd4243c31cebf542ecdb1c067aa55657fda4e88a5dfb7ab184e483bb079c7e78239071265d72e019f2538e9298b1654932a3ff53cd2097a9c1fa5389c47327f219dad175d89d64036298a6a1c76599e0d30a9dc5f20862057de9147d6745724f9c5e61665df125be6be4d16d9849f5bbc88beb92e691ea2a9603f29e6b1b0751325555d0e7af7e784182d21d30c62c4038bd57f172cd0d1c3e5d05b6a862f2b28837c765734fdc9ef527a9ad699c70ba64a2b3d62d4a4492297120e9fd541b3905e1963ca8736666d3aac769a39aa6bd5c866aaee10eca79e4d2f93300e10cde6be6c6f1945af07e715ab1eea51017d725b271f4548537c8f43eff6969dc7ccf4a31a8ef000e628ef3fed706203e9d1761f5987c3a7f80f8f8759604a43675235e4af68452f38659c795e01f34e7b17995642325dc8bd22fe61b4a4b9ec5d2b29852b98fcc70ac1453f94a3e6b5e8ac6eab4308bc52645945e2279fc9b57b1915a7a54d24cd4970ee3ac70feed150f9c523f2ac8da9d1db4e4b0d424fe8ecad5ceb30730e9db0ad4cd8b2d04a6899b20bda61e5589b9e3f1092425ddaffe70bc06783fc12b761acc1fe6b46d472ef15cf1bf0f8fab9fb0c28cb042d613d7abc9aa66eb4ac53fd275341d861dfd3f06aebc24f35dae9ee54744f1fcf7e662e4c4cb31ed57acf4dd8d4e41ae92117d4fc4a36f2087d96196344c9d663157af4f8cf576ef72ea68f0cb54a6763e9cd2877948edc3765d9511d4c3f6918a74e177e388254dc0120275f07941347f656f56542e173202445adc929b7f8c3bf6dffb84445972acf96b8734f30db5f04916827a699d0ff82a0643b2e11850b59e1f7047092d774c76ba69316f7b28f4a1f2aeaf354304b1cdc7851bf26667779a6c8d332dc365873abbb6100773426dd563d7fd79ce07d4518185cbce2014f278ce7bb5fb8f1cf7f2eebd4689b0c6ed4248df43c6a33d31ca8d7c97b634631cb3ba7d8dba53266d81d05e1ba75e1dda1f0893735495f8d1dbaf69697926bbf1380591380412f4da0c2c1626ca170f2dbd13a31d8223236025b9111bea54f756f4032fd7fc6bd494d7b5ff8b5cf54bcfcec769b42fa84d1cbd2efa193d748f7393b70c8c5bdf2a6ce9c4fbe57f8a5f35251b9fd36af2d42ecedc7b59c272743561724ec23af508c65c35d94eed4d6e324b0db62137b54ec63231337c72f2761fcdc5e6cdac118d10078d9536b0b91f71f33c37d23ca1a9b2ccf7b361a7067fcd2b16150dfa2cc757a453204cb0d3859c5f4be5239751e842120dea9d2b51bfe133a715704f325dd445fd95d8c5195e7f51029565692b1be11e38821c6803ac6144f4d939be1a758a05619b5f4426325131c357cfcce41b000a9f8443cb7c821c68e9de62275bc6e2ade58336f4a72b617bd4254fdf22677e94f01e1f4beff4be2b2ed0a995c1e44ed7408630029ec23f84e55f21960cfa803487788c3b9ecc5ea77a91131b1af2125c90a42e37c3928db39a66c9b14e3dd80acf0b40d77b8246970adf6a05574a8023ab69ca9a700485b3b037f2325b7ce128f26a25ec537fc5e19b9aac982728392e22fc8722e93013f1543f2fba7088eba51862582d424393536a20bff88a62bbb442e72ca3db85e53c826b43242c2f0cb181e5bccc3d0e7c7b5bd02a7d0afee2ad9a41ddaae14208f8b5227f0d5f2b88da88af77f115cefd9fc1499e93e177919b8869f29791f84d53f3a30f7cc2cc43518a7c8ec5ab9ecdbdbef68593326b55bbc1af8cb60dea587f40e657302e30176432b152570999a330f68920defb1a5a6c5137a8cf11dd36070a71964cd3f2aedb53d83c6465bb75fa02731974bd797b5092a320ea5979eb673bede5a914eccdc2c5fa1e55f2b5cb9244d36adba6294a0420f6d657e6a840593a27628d28b8703a34c7541f92c7f988e288335d07ef5497287dc61b37224d8c4b50ca55e544e667283c3afcb15dc4cbfde19a0ee4dc72afa1fde1e38c7769aff23d8ab2ccb83098309caa9f1811e7578a45a6382cf38b418bcfd2093a705a8a327c08dfccd03013e116b4cf210010cede82cf919b7032166fbf60301087c239d69486403c9344894fea10f8175e236468009d3c4419719671d72d614b47fd19a3e28ed67c757e63a65edbde76ef1d0095b0368a8d027514fa0b766cb688eaa6c55cf34bf9dc3992ee6da0ab7c73212be1442fb1c25ef80f77b21c6297b6ec3851d240fe90bd831ad5d66f9c6c75e2d5469d15416ff799b346fcefc58054309fb893b28d4324be3b233f41c54ba5d46e29e4bd2372768fb1c165c9f3e1d14cdee8041f3f588724db0fb4b965e796cac71d5f6be548f8a0760b5774fd8e3f105f31c792e94cbce641bbe1d55d65d20f738e5d43e2fd4ddcdb02fa361ba49ec5988f7d7701b50e1b7dabb0bc2589ff52f524de152f0805ff531068389e0034f1650d0d3d3f1986154b78c8eca274a4da2d59968c10a2f84887717b8dec7efd9ba6cfac24ca6b50cbf27c2ea36b6fc7c258e9cd5f98d55e2318a48408bd217ee7d32315be95b516ddfec471fd8c3bb328acef63f0d4c38b78c1fce00531a3cac614cef0c1f27e05af838c0578c7016473aa2fd765726ae67945ca628c7d86c4f423bb9ecd4372865bcc649853f85f24842728d872ada89d900f72cb0f53a382acdfdfc03091162152e289fec92fae57cb4e510278dcb9d4d8b67f2f9e12dfd3fd06b5030880d216ba657029ac66b359d155329ca2381297c106379139bb05a52c4a9af1eb6b9a6d8810a3561ac9e39d26a721c2da7ff109a543fb72ccf348d68c9d45ef34fa74ee6c28904a65eafbc5ffef47a71c211b8b36b74959ab7819dd53cc6be34959c9d29078231b1aa5fe655426eb75e551bdf79156c24f38dddbca51f4d5f2ad2b690672042f595429bd324cc556f2a65906e82c4dbd24a10e13fdedff4175a42c680815c8ab0dd91c90c72e2f156c2d050cef9c215aba66c30efe7d178dbdade1e8e84920a3a640036ca4c58ad3f1285b46e89b55d8db0509804aca4a841c246c8ae1307f7d12768cc6c4ad8d240f72f3ef0e31c995a56061e69a901d219100089a3defae8ceecc0a87c2a844a3cb4577776bc901625fef2dbbe3f98ae8e42ae55cd1d2e44679578560da13552e58145de12a1e49756c49fb9a2f7c0fac4002320615e5b4f7b4d8b489139ea9fdb1d47cf31465787f0448f4290c2431b6d99068dd02ccf1981eb6104b2950e22aaec546a6a5ae92735936be43c3fee4a362779b5fd8743d077e75c1dd2ebf76d3ea21b5306859826d67f7555daf9759d29331bfe01b33a515a9c715b2ed2b4695cd854625b18f864339f9571a2b6dfedc3a369955d8e2184ffd25d68ad15767e4ec56833f0b01eea5ab6362815377e89f9287de7224e65fc7d56740bda9f6b9ae74f1e8f803a32c5f83441a568dd97c7ee502f0f89e91bdce0d6d62c55a45bff486046aee1382b910196c53cf7ce564e2710fb7fed2382e99b5584e51400b21635b92d283ede145af56ccfa070db9f3155fe92b7f340da8473f9bf752667ecd11241dbc07dfcc65e495c6b787871954ad0531a793ae7ad5a22c6bfb4dfb6156ce5912a3ff9e080482d2d9bcb67773ebd3161960b42eb651e98d231a5c6a6b1fa77de169a5051c6fb0d472be9869cc056508e595a49d91eacdd252f31b5d9fde01eeb44d4b16d27cfec022e0f306ba962adf274e19b629b2a15edef8bd6e515974c28cf390e72fa46787db01a0dcc62c599117c089b2103147f9d42194ce18ceda45ec8dc69f71a38469e37b3eaaa8382f52a159f10dcb4f3939a0d4e184bdefe8abea0edf94bfec7835d07c604371d27da267ed5338342560511cd8f79406b9560bcd559f9928110a9ebfd8981c8a903e87c71cb3b46c5e5725e293bfb59add038752d83ab0fda24ea8a08292e2839f5f122db7f9f68d5954b1a04e7930ccbd1ff27da8135dafdc35915927df4685"}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "4f7dd9573a97cacda143e874fb8ad3782cbe3389bd49"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_REKEYING={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7f4a}]}, @TIPC_NLA_MEDIA={0x78, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xb4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xf}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xcf}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}, @TIPC_NLA_NET={0x6c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7fffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x14}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x81}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7fffffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x100000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x522}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffff7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}]}, @TIPC_NLA_LINK={0x4c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf255}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}]}]}, 0x1380}}, 0x1) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001980)={r0, r0, 0xe, 0x0, @val=@uprobe_multi={&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)=[0x0, 0x7, 0x4, 0xd09, 0x2, 0x143, 0x1, 0x5, 0x6, 0x8], &(0x7f0000001940)=[0x1, 0x1, 0x4, 0x2], 0xc000000000, 0xa}}, 0x40) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f00000019c0)={0x0, r1, 0x3a, 0x4, 0x8, 0x9}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r6, &(0x7f0000001ac0)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a40)={0x2c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@ETHTOOL_A_RINGS_RX={0x8, 0x6, 0xa7a}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x5}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8011}, 0x4040000) accept4$alg(r0, 0x0, 0x0, 0x80000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001cc0)={r0, 0x0, 0x3c, 0x5d, &(0x7f0000001b00)="fece0e944308c7cee9089c2b80d6e12d0bd55895960a98c0fe2b46faf2c7e29d7c1911f9eb857272b895611f8d6a198701dc5ef3180554bb0319d4fe", &(0x7f0000001b40)=""/93, 0xf, 0x0, 0x41, 0x7c, &(0x7f0000001bc0)="e9ddc4e6529f20b297ff40e74ee338f5f75a11951e9fb86289742833423190901104f7917bb90adb4e1f7f4aa7839ea31557a3f79307d4405cdfd3b108172a2bde", &(0x7f0000001c40)="758ef187db03867727876aa2c3b3e44103a25e1df6a292f8fd700103150fe576b90239bd93c94e2358208dc1a1cb734250f98f1904775f91d609e18d66277ebe09b5bd42e8922166bbe6f74afe79853585fabed5e9c91696699679e466c31a38d5674ddf171280a3dd6824b9149a0957893f88ee8f53abe8ac17baec", 0x0, 0x0, 0x3}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001d80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000001e40)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001e00)={&(0x7f0000001dc0)={0x1c, r2, 0x200, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0xc0c5) socket$nl_xfrm(0x10, 0x3, 0x6) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000001ec0), r1) sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f00000020c0)={&(0x7f0000001e80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000002080)={&(0x7f0000001f00)={0x144, r8, 0x4, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x6}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x87c}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xffff0000}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x8000}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x4}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}]}, 0x144}}, 0x20000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002100)) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000003280)={0xe, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000003300)={0x18, 0x13, &(0x7f0000002140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xa}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x88}, @jmp={0x5, 0x1, 0x1, 0x2, 0x7, 0x0, 0xfffffffffffffffc}, @exit, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000002200)='syzkaller\x00', 0x7, 0x1000, &(0x7f0000002240)=""/4096, 0x41000, 0x1, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, &(0x7f0000003240)={0x8, 0x3}, 0x8, 0x10, 0x0, 0x0, r9, r0, 0x1, 0x0, &(0x7f00000032c0)=[{0x0, 0x5, 0x4, 0x1}], 0x10, 0xfffffff8}, 0x94) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000003400), r0) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f00000034c0)={&(0x7f00000033c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003480)={&(0x7f0000003440)={0x3c, r10, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000001) r11 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_SECURITY(r11, 0x0, 0x1, &(0x7f0000003500), &(0x7f0000003540)=0x4) sendmsg$NL80211_CMD_DEL_MPATH(r1, &(0x7f0000003640)={&(0x7f0000003580)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000003600)={&(0x7f00000035c0)={0x40, r2, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x4a, 0x64}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x40}, 0x1, 0x0, 0x0, 0x280088c0}, 0x1d) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000003680), &(0x7f00000036c0)=0x4) 1.078712416s ago: executing program 4 (id=2821): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001c00010028bd7000fcdbdf2507000000", @ANYRES32, @ANYBLOB="8f70120b0a000200aaaaaaaaaabb000004000f"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000019000100000000000000000002"], 0x2c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x4c, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x14}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x4}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x57}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x4d}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4081) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r2, 0x200, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x63419586, 0x7e}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x20040090}, 0x20000004) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 1.070152192s ago: executing program 0 (id=2822): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, r0, 0x0, 0x0, 0x5}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r1, 0x84, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c80)=@newtfilter={0x3c, 0x2c, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xc, 0xa}, {0x2, 0x1001e}, {0xc, 0x7}}, [@TCA_RATE={0x6, 0x5, {0x5, 0xd}}, @TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_RATE={0x6, 0x5, {0xb5, 0x1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000044}, 0x0) 985.65945ms ago: executing program 1 (id=2823): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) getsockopt$rose(0xffffffffffffffff, 0x104, 0x7, 0x0, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xb2b3}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x9c, &(0x7f0000001300)=""/156, 0x0, 0xa}, 0x94) mmap(&(0x7f000081c000/0x4000)=nil, 0x4000, 0x0, 0x50, r4, 0x0) 969.249159ms ago: executing program 3 (id=2824): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000500)=ANY=[], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400"], 0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000080)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r1, &(0x7f0000000000)="3f000000010000", 0x7) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) (async, rerun: 64) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000380), &(0x7f00000003c0)=0xc) (async, rerun: 64) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000440)={0x0, 0x10, &(0x7f0000000400)=[@in={0x2, 0x4e20, @multicast2}]}, &(0x7f0000000500)=0x10) sendmsg$ETHTOOL_MSG_EEE_GET(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000008c0)={0x2c, r4, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000090}, 0x80) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x51b23}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gre={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000094}, 0x20040040) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r0, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x68, r4, 0x8, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x25}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xff}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0xf}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x68}, 0x1, 0x0, 0x0, 0xc850}, 0x810) 965.214286ms ago: executing program 0 (id=2825): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x3, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xfffb}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80884}, 0x20000000) 716.794213ms ago: executing program 4 (id=2826): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x8, 0x0, 0x0, {{@in=@multicast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x4, 0x3}, {}, 0x400000}}, 0xb8}}, 0x0) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 64) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 32) close(0x4) (rerun: 32) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r3, 0x5) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) (async) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmmsg(r6, &(0x7f0000009640)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1073eedab59a32", 0x7}, {&(0x7f0000000240)="02a2f97a177137003d9b418698b97c81bf1bde7a9b76365fd7b1bbae5f5e09cb9b4432ed011564c718321c92affddb69470547b1baefcdb5445c31a7d34e0b20bddd0e2357b50d72", 0x48}, {&(0x7f00000038c0)="f9db6d4e6ca7d40c978d37d3ea23d92438e15c1b6ce255bbee36e2dd57ae11821c1af092de99be476596eb92bc722e1b34a6ef9d82e4d70fcf379419bfdb759f54b461633cc8099c9cf1a921921f65a149e1bc3789ee998403a87f2f59f5b66b2627741662f5c1ebc1c63385e103734c8639f135f74b6660a0006033de0760b4a70fb6dfb36ad9374cf7f623cbd748fc8b593c521a8e7c790287ce4968ec6fb36c2cac4d2fbd2a408595579e23489649d76df75d416d79057fd7faf3d6a6b8b7f6387c6e0c421d663e3e1585307ad01149f5829b3499748a4c2202db18148844f1cdf7544b7b8c7eae685bd678cdf88eb6443b24035ab0fd678e8a2c79983fb568f57979f7a31293067caf5be041fd38cab2088e5400110024c9b9e5c985ac7472b7991ad56d78bedea9285ad4f9f7b04c3888c33f15ced41146d833770ae6ca503aff03170d8c2cf31ae0578afd708860936241cd7ae3bdb46ec3041b4ac9a2fb158d35bb9f743a8857dfbabc6df23e37a685743760a43da3a2d48be814d0070550f21b71435f7fc2e2c8d4872f1a2ba607cd257f5bce59c453070dc3fe710ffd41c815bbd9a760e70056b9767f17b0084f8c532b504b95550ca445b7c2ccb14250bc66af4dd9cd86bb91d40cd54da79240a457905c892151cbc8cddcdf39ca1b5117043cf0d35127ff44529c6dc6892749d44baa10e4dd7b78b647a65e5c099a8ba6bf790a6b24eb4144255f154b8cb80beff39069da12d0a1be35f39abd7ff8e591822aca3670d8d5846844288e780f", 0x231}], 0x3}}], 0x1, 0x8810) (async, rerun: 32) recvmsg$unix(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001f00)=""/4096, 0x1000}], 0x1}, 0x12060) (async, rerun: 32) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = socket$kcm(0x2, 0x3, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x40000104}, 0x4000841) (async) ioctl$SIOCSIFHWADDR(r7, 0x8b0b, &(0x7f0000000200)={'wlan1\x00', @random="9ffff7070600"}) socket$inet_udp(0x2, 0x2, 0x0) (async) close(0x4) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000040)={0x4, &(0x7f0000000080)=[{0x35, 0x0, 0x2, 0x90}, {0x6, 0x2, 0x9, 0xfffffff7}, {0x4, 0x9, 0x1, 0x3}, {0x6, 0x2, 0x4, 0x5e}]}, 0x10) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000002000000e0000001000000000000000000000000e00000010000000000000000000000004e24000000000000020000100000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="000000000000000000000000000000000000000000000000f9ffff3f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000325b6b3fcac1d56300"/101], 0xb8}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x4000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x800000}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0xffffff1f}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 712.084389ms ago: executing program 0 (id=2827): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = socket$inet6(0xa, 0x805, 0x0) close(0x3) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$bt_hci(r1, 0x84, 0x81, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x9, 0x3032, 0xffffffffffffffff, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x1c, r7, 0x331, 0x0, 0x0, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r7, 0x800, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x11) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$IP6T_SO_GET_ENTRIES(r9, 0x29, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d6188676c02000000000000080000000000000000000000050000847c7e6aeb17a32db40425f9c8cfd4e94eb10147e688"], &(0x7f0000000100)=0x2d) 683.734463ms ago: executing program 3 (id=2828): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x2000}, 0x90) select(0x40, &(0x7f0000000080)={0x2, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, &(0x7f0000000100)={0x7fffffffffffffff}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) 297.18075ms ago: executing program 4 (id=2829): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}, 0x4}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f0000000000)=0x1, &(0x7f0000000040)=0x4) sendmsg$tipc(r2, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f00000a6000/0x3000)=nil, 0x3000, 0x3000006, 0x12, r4, 0x180000000) 254.347018ms ago: executing program 0 (id=2830): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000004040)=ANY=[@ANYBLOB="0e0000000c000000ffffff7f0400000001100300", @ANYRES32, @ANYBLOB="07000000000000000000000000000000000000001b7ba4ef75a76f1856571b534c3ede1af43500eefbb24f4de403f8493220e6871f7a6b54ae8d656c7bbb8e5c457250090be1782e5b5b7b86037033af295eff25a6699297153d13dd10ddcfc32fb5f4ddc07b4cc587ebcaf2d2dd9c9466463fb960d6cf2e1925260a3455c6e963f844423934fcea683300485296cae907775c4af88293791015ee02ddf7ee79ccc7af482e", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000010000000200"/24, @ANYRES32, @ANYBLOB], 0x50) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001400)={0xffffffffffffffff, 0xe0, &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001100)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, &(0x7f0000001140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001180)=[0x0, 0x0], 0x0, 0x6d, &(0x7f00000011c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000001240), &(0x7f0000001280), 0x8, 0xc3, 0x8, 0x8, &(0x7f00000012c0)}}, 0x10) (async) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001540)={&(0x7f0000001440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb2, 0xb2, 0x5, [@func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{0xe, 0x1}, {0x0, 0x4}, {0x0, 0x1}, {0xe, 0x5}, {0x0, 0x2}, {0xb, 0x5}]}, @float={0x10, 0x0, 0x0, 0x10, 0x8}, @datasec={0x5, 0x5, 0x0, 0xf, 0x2, [{0x2, 0x0, 0x5}, {0x5, 0xd07, 0x1}, {0x5, 0x4, 0x10}, {0x3, 0x40, 0x88fd}, {0x5, 0x80, 0x9}], "a442"}, @int={0x9, 0x0, 0x0, 0x1, 0x0, 0x4c, 0x0, 0x2a, 0x2}, @decl_tag={0x8, 0x0, 0x0, 0x11, 0x2, 0x3}]}, {0x0, [0x0, 0x0, 0x2e]}}, &(0x7f0000002dc0)=""/4096, 0xd1, 0x1000, 0x1, 0x7}, 0x28) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001980)={0xffffffffffffffff, 0xe0, &(0x7f0000001880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001600)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, &(0x7f0000001640)=[0x0, 0x0], &(0x7f0000001680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xec, &(0x7f00000016c0)=[{}], 0x8, 0x10, &(0x7f0000001700), &(0x7f0000001740), 0x8, 0x2b, 0x8, 0x8, &(0x7f0000001780)}}, 0x10) (async) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001b40)={0x18, 0x12, &(0x7f00000019c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xf21}, {}, {}, [@btf_id={0x18, 0x3, 0x3, 0x0, 0x5}, @alu={0x4, 0x1, 0x4, 0x1, 0x6, 0xffffffffffffffff, 0x10}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001a80)='syzkaller\x00', 0x9, 0x0, 0x0, 0x40f00, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001ac0)=[0x1, 0x1], 0x0, 0x10, 0x2}, 0x94) r13 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r13}, &(0x7f0000000200), &(0x7f0000000280)='%pK \x00'}, 0x20) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001c00)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001cc0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)='%-010d \x00'}, 0x20) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r17 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="120000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r17, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r16}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000003fc0)=ANY=[@ANYBLOB="18fe1da35e043e1cfde35fc900000000000000181100"/31, @ANYRES32=r18, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000003dc0)={{0x1, 0xffffffffffffffff}, &(0x7f0000001d00), &(0x7f0000001d40)='%+9llu \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000003e80)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000003e00), &(0x7f0000003e40)='%ps \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000003f00)={0x6, 0x10, &(0x7f0000000f80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9cf, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x10}, @map_fd={0x18, 0x8, 0x1, 0x0, r8}]}, &(0x7f0000000080)='syzkaller\x00', 0x4, 0xdd, &(0x7f0000001000)=""/221, 0x41000, 0xc, '\x00', r9, @xdp, r10, 0x8, &(0x7f0000001580)={0x7, 0x3}, 0x8, 0x10, &(0x7f00000015c0)={0x4, 0xc, 0x8, 0x2}, 0x10, r11, r12, 0x0, &(0x7f0000003ec0)=[r13, r14, r15, r18, r19, 0xffffffffffffffff, r20], 0x0, 0x10, 0x7}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a4f8ff000000001f03000000000000e5000300000000002604fdffff02000014010000033800001d130000000000007a0af8ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xf8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27}, 0x48) 196.876713ms ago: executing program 4 (id=2831): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x80}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0x42, 0x4, 0x12f0, 0xffffffff, 0x98, 0x0, 0x98, 0xffffffff, 0xffffffff, 0x1258, 0x1258, 0x1258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {}, {}, 0x0, 0x2}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@empty, @remote, 0xff, 0x0, 'veth0_to_batadv\x00', 'team_slave_1\x00'}, 0x287, 0x10e8, 0x1128, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0x4000000000000000}}}, @common=@unspec=@limit={{0x48}, {0xfffffffe, 0x7, 0x0, 0x2, 0x0, 0x0, 0x2}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x3, {0x8}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x1ff, 0x2, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x1350) 97.68508ms ago: executing program 3 (id=2832): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) close(0x3) (async) r1 = socket(0x2, 0x80805, 0x0) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r3 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r3, 0x2}, {r3}], 0x2, 0x7f) (async) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000240), 0x4) (async) shutdown(r2, 0x0) (async) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x180}], 0x1, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) (async) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000080)={0x0, 0x2, 0x1, "fa"}, 0x9) (async) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000040)={0x0, 0x2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x2, 0x0, 0x0, 0x0, 0x61, 0x18, 0x50}, [@ldst={0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x27}]}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x3}, 0x28) 94.512209ms ago: executing program 2 (id=2833): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115, 0x2081}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_MIIMON={0x8, 0x3, 0xfffffff7}]}}}]}, 0x44}}, 0x28000000) 91.213387ms ago: executing program 0 (id=2834): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) (async) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$vsock_stream(r1, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff}, 0x10) (async) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) (async, rerun: 32) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) (async, rerun: 32) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) (async, rerun: 32) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) (rerun: 32) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) (async) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000ac0)=@updpolicy={0x23c, 0x13, 0x1, 0x70bd2b, 0x0, {{@in6=@private0, @in6=@empty, 0x4e21, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x2b, 0x0, 0xee01}, {0x0, 0x0, 0x6}, {0x0, 0x0, 0x7}, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3}, [@tmpl={0x184, 0x5, [{{@in6=@mcast2, 0x4d6, 0x33}, 0xa, @in=@broadcast, 0x3501, 0x3, 0x3, 0x2, 0x4, 0x9, 0x9}, {{@in=@empty, 0x4d4, 0x32}, 0xa, @in=@multicast2, 0x3503, 0x4, 0x1, 0x59, 0x5, 0x8, 0x8000000}, {{@in=@empty, 0x4d6, 0x3c}, 0x2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x1, 0x2, 0x1, 0xa, 0x20800, 0xfb82}, {{@in6=@loopback, 0x4d6, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1, 0x2, 0xf8, 0x8, 0x2, 0x1}, {{@in=@multicast1, 0x4d5, 0x3c}, 0xa, @in=@remote, 0x3507, 0x0, 0x2, 0x9, 0x8659, 0x8, 0x1}, {{@in6=@mcast1, 0x4d3, 0x32}, 0x0, @in6=@mcast2, 0x3504, 0x4, 0x0, 0x6, 0x8320, 0x1, 0x8001}]}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4010}, 0x4000) (async) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000180)=@netrom={'nr', 0x0}, 0x10) 0s ago: executing program 4 (id=2835): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x42441, 0x0) (async) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r1, 0x29, 0xcb, 0x0, 0x15) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x58, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_FAST_LEAVE={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x8000) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000e40)={0x30, r4, 0x601, 0x70bd29, 0x0, {}, [@TIPC_NLA_LINK={0x1c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_NAME={0x0, 0x1, 'broadcast-link\x00'}]}]}, 0xffd2}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) r5 = socket$kcm(0x2, 0xa, 0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r6, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r8 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r7, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000040)=r8, 0x4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r0, &(0x7f0000000280)={@void, @val={0x1, 0x0, 0x92fd, 0x0, 0x3e}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x84, 0x0, @multicast1, @local}, {{0x0, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x1c, {[@window={0xa, 0x3}, @timestamp={0x5, 0xa}, @nop]}}}}}}, 0x42) kernel console output (not intermixed with test programs): s in process `syz.2.1293'. [ 361.853930][T11089] wireguard0: entered promiscuous mode [ 361.871873][T11089] wireguard0: entered allmulticast mode [ 361.902234][T11089] team0: Port device wireguard0 added [ 362.237769][T11109] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 362.265638][T11109] dvmrp1: linktype set to 774 [ 363.134222][T11150] IPVS: set_ctl: invalid protocol: 51 172.20.20.59:20000 [ 363.195719][T11157] syzkaller0: entered promiscuous mode [ 363.209982][T11157] syzkaller0: entered allmulticast mode [ 363.695181][T11173] syzkaller0: create flow: hash 3785891131 index 1 [ 363.818596][T11184] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1319'. [ 363.829467][T11183] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1319'. [ 363.932219][ T8659] syzkaller0: tun_net_xmit 76 [ 363.939796][ T8659] syzkaller0: tun_net_xmit 48 [ 363.958294][ T9] syzkaller0: tun_net_xmit 76 [ 364.019886][T11181] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1318'. [ 364.232309][T11169] syzkaller0: delete flow: hash 3785891131 index 1 [ 367.000691][ T30] audit: type=1804 audit(1765212114.795:4): pid=11199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1321" name="/newroot/291/cgroup.controllers" dev="tmpfs" ino=1519 res=1 errno=0 [ 367.030176][ T30] audit: type=1800 audit(1765212114.805:5): pid=11199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1321" name="cgroup.controllers" dev="tmpfs" ino=1519 res=0 errno=0 [ 367.056638][ T30] audit: type=1800 audit(1765212114.805:6): pid=11199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1321" name="cgroup.controllers" dev="tmpfs" ino=1519 res=0 errno=0 [ 368.081249][T11204] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1322'. [ 368.105433][T11206] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1323'. [ 368.331716][T11224] syzkaller0: entered promiscuous mode [ 368.337260][T11224] syzkaller0: entered allmulticast mode [ 368.749865][T11245] netlink: 'syz.4.1328': attribute type 11 has an invalid length. [ 368.757749][T11245] netlink: 'syz.4.1328': attribute type 11 has an invalid length. [ 368.806392][T11245] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1328'. [ 369.009923][T11227] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 369.532853][T11271] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1340'. [ 369.851342][T11287] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 369.872028][T11287] syzkaller0: linktype set to 780 [ 369.878952][T11284] ip6tnl0: Caught tx_queue_len zero misconfig [ 370.019672][T11293] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 370.115721][T11292] dummy0: entered allmulticast mode [ 370.125716][T11302] netlink: 'syz.2.1349': attribute type 4 has an invalid length. [ 370.146365][T11291] dummy0: left allmulticast mode [ 370.171036][T11308] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1350'. [ 370.345583][T11315] netlink: 'syz.1.1351': attribute type 5 has an invalid length. [ 370.432512][T11322] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1354'. [ 370.500515][T11322] vlan0: entered allmulticast mode [ 370.514703][T11322] gretap0: entered allmulticast mode [ 370.546143][T11318] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1353'. [ 370.571205][T11318] bridge: RTM_NEWNEIGH with invalid ether address [ 370.933813][T11344] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1357'. [ 371.589047][T11355] bond6: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 371.603234][T11355] bond6 (unregistering): Released all slaves [ 372.654202][ T6680] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 372.664983][ T6680] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 372.748399][ T6680] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 372.762332][ T6680] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 372.843738][T11418] netlink: 'syz.0.1379': attribute type 10 has an invalid length. [ 373.101925][T11433] netlink: 28252 bytes leftover after parsing attributes in process `syz.4.1384'. [ 373.134695][T11435] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1385'. [ 373.408534][T11452] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1391'. [ 373.444273][T11452] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1391'. [ 373.501037][T11444] netlink: 'syz.4.1387': attribute type 4 has an invalid length. [ 373.584599][T11447] netlink: 'syz.4.1387': attribute type 4 has an invalid length. [ 373.629456][T11466] x_tables: unsorted underflow at hook 3 [ 374.151675][T11480] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 374.159352][T11480] syzkaller1: linktype set to 825 [ 374.165563][ T152] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.246243][ T152] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 374.265391][ T152] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 374.280578][ T152] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.296854][ T152] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 374.314755][ T152] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 374.370708][ T152] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.379771][ T152] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 374.388976][ T152] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 374.412630][ T152] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.430642][ T152] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 374.450472][ T152] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 374.571354][T11491] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1402'. [ 374.626981][T11495] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1404'. [ 374.800867][T11499] netlink: set zone limit has 4 unknown bytes [ 374.857668][T11502] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1406'. [ 375.549124][T11526] netlink: 'syz.1.1412': attribute type 10 has an invalid length. [ 375.576758][T11526] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1412'. [ 375.598657][T11526] dummy0: entered promiscuous mode [ 375.620258][T11526] bridge0: port 3(dummy0) entered blocking state [ 375.647295][T11526] bridge0: port 3(dummy0) entered disabled state [ 375.659377][T11546] netlink: 'syz.4.1415': attribute type 11 has an invalid length. [ 375.670717][T11526] dummy0: entered allmulticast mode [ 375.695291][T11526] bridge0: port 3(dummy0) entered blocking state [ 375.701907][T11526] bridge0: port 3(dummy0) entered forwarding state [ 375.710149][T11542] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1414'. [ 375.809785][T11552] netlink: 'syz.3.1418': attribute type 13 has an invalid length. [ 375.818155][T11545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1414'. [ 375.840486][T11552] netlink: 'syz.3.1418': attribute type 17 has an invalid length. [ 375.871218][T11552] lo: left promiscuous mode [ 375.911379][T11552] tunl0: left promiscuous mode [ 375.937675][T11552] gre0: left promiscuous mode [ 375.960240][T11552] gretap0: left promiscuous mode [ 375.977754][T11552] erspan0: left allmulticast mode [ 375.990031][T11552] ip_vti0: left promiscuous mode [ 375.996964][T11552] ip6_vti0: left promiscuous mode [ 376.015818][T11552] sit0: left promiscuous mode [ 376.027372][T11552] ip6tnl0: left promiscuous mode [ 376.034745][T11552] ip6gre0: left promiscuous mode [ 376.042464][T11552] syz_tun: left promiscuous mode [ 376.071852][T11552] ip6gretap0: left promiscuous mode [ 376.082134][T11552] vcan0: left promiscuous mode [ 376.090137][T11552] bond0: left promiscuous mode [ 376.096077][T11552] 8021q: adding VLAN 0 to HW filter on device bond0 [ 376.105735][T11552] team0: left promiscuous mode [ 376.113294][T11552] 8021q: adding VLAN 0 to HW filter on device team0 [ 376.122091][T11552] nlmon0: left promiscuous mode [ 376.129430][T11552] caif0: left promiscuous mode [ 376.134425][T11552] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 376.399459][T11566] syzkaller1: entered promiscuous mode [ 376.404996][T11566] syzkaller1: entered allmulticast mode [ 376.575271][T11578] netlink: 'syz.4.1423': attribute type 23 has an invalid length. [ 376.798311][T11584] netlink: 'syz.3.1425': attribute type 1 has an invalid length. [ 376.836390][T11588] netlink: 'syz.0.1422': attribute type 4 has an invalid length. [ 377.015845][T11592] tipc: Enabling of bearer rejected, failed to enable media [ 377.880120][T11649] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 378.415422][T11657] syzkaller0: entered promiscuous mode [ 378.421378][T11657] syzkaller0: entered allmulticast mode [ 378.471441][T11659] syzkaller1: entered promiscuous mode [ 378.477182][T11659] syzkaller1: entered allmulticast mode [ 378.555257][T11672] netlink: 'syz.4.1446': attribute type 10 has an invalid length. [ 378.601585][T11672] veth0_vlan: left promiscuous mode [ 378.615473][T11672] veth0_vlan: entered promiscuous mode [ 378.624546][T11678] __nla_validate_parse: 7 callbacks suppressed [ 378.624548][T11672] `: Device veth0_vlan failed to register rx_handler [ 378.624568][T11678] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1446'. [ 378.649081][T11678] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1446'. [ 378.724265][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 378.735449][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.980279][T11701] netlink: 'syz.3.1454': attribute type 12 has an invalid length. [ 379.038508][T11707] syzkaller0: entered promiscuous mode [ 379.044038][T11707] syzkaller0: entered allmulticast mode [ 379.079572][T11711] veth0_vlan: entered allmulticast mode [ 379.114635][T11714] netlink: 'syz.4.1457': attribute type 1 has an invalid length. [ 379.130679][T11714] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1457'. [ 379.168869][T11714] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1457'. [ 379.262262][T11725] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1460'. [ 379.320675][T11726] batman_adv: batadv0: Adding interface: ip6gretap1 [ 379.344904][T11726] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 379.376473][T11726] batman_adv: batadv0: Not using interface ip6gretap1 (retrying later): interface not active [ 379.468758][T11742] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1466'. [ 379.473547][T11734] 8021q: adding VLAN 0 to HW filter on device team0 [ 379.487475][T11734] bond0: (slave team0): Enslaving as an active interface with an up link [ 379.668358][T11755] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1469'. [ 380.885564][T11786] netlink: 'syz.1.1474': attribute type 11 has an invalid length. [ 381.120590][T11783] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1475'. [ 381.147381][T11783] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 381.559845][T11804] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1479'. [ 381.814388][T11814] validate_nla: 2 callbacks suppressed [ 381.814407][T11814] netlink: 'syz.4.1484': attribute type 11 has an invalid length. [ 381.871969][T11815] IPv6: addrconf: prefix option has invalid lifetime [ 382.062316][T11820] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1485'. [ 382.742216][T11848] ip6gre1: entered promiscuous mode [ 382.747511][T11848] ip6gre1: entered allmulticast mode [ 382.763397][ T3439] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 382.777327][ T3439] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 382.799489][ T5940] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 383.078576][ T5940] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 383.158253][ T5940] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 383.386657][T11889] syzkaller0: entered promiscuous mode [ 383.386985][T11899] netlink: 'syz.4.1505': attribute type 14 has an invalid length. [ 383.401084][T11889] syzkaller0: entered allmulticast mode [ 383.408283][T11899] netlink: 'syz.4.1505': attribute type 11 has an invalid length. [ 384.179340][T11939] __nla_validate_parse: 6 callbacks suppressed [ 384.179359][T11939] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.1515'. [ 384.205479][T11937] tipc: Enabling of bearer rejected, already enabled [ 384.206415][T11936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1514'. [ 384.409992][T11943] sctp: [Deprecated]: syz.3.1516 (pid 11943) Use of int in maxseg socket option. [ 384.409992][T11943] Use struct sctp_assoc_value instead [ 384.440992][T11947] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1519'. [ 384.499955][T11948] netlink: 'syz.1.1518': attribute type 1 has an invalid length. [ 384.507079][T11947] pim6reg: entered allmulticast mode [ 384.579415][T11948] 8021q: adding VLAN 0 to HW filter on device bond5 [ 384.628326][T11958] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1520'. [ 384.680119][T11956] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1521'. [ 384.698370][T11956] geneve4: entered promiscuous mode [ 384.717805][ T6661] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20002 - 0 [ 384.738664][ T6661] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20002 - 0 [ 384.747080][ T6661] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20002 - 0 [ 384.874310][ T6661] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20002 - 0 [ 384.968819][T11969] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1524'. [ 385.089611][T11978] netlink: 'syz.2.1527': attribute type 4 has an invalid length. [ 385.168078][T11985] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1527'. [ 385.291012][T11985] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1527'. [ 385.301669][T11988] bond6: entered promiscuous mode [ 385.306905][T11988] bond6: entered allmulticast mode [ 385.314294][T11988] 8021q: adding VLAN 0 to HW filter on device bond6 [ 385.329542][T11993] netlink: 'syz.0.1531': attribute type 21 has an invalid length. [ 385.362002][T11997] netlink: 'syz.3.1532': attribute type 1 has an invalid length. [ 385.373935][T11993] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1531'. [ 385.645030][T12006] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1533'. [ 385.751153][T12011] syzkaller1: entered promiscuous mode [ 385.773995][T12011] syzkaller1: entered allmulticast mode [ 386.022328][T12035] SET target dimension over the limit! [ 386.031201][T12032] veth4: entered allmulticast mode [ 386.086827][T12033] veth6: entered allmulticast mode [ 386.103231][T12042] netlink: 'syz.4.1544': attribute type 21 has an invalid length. [ 386.132079][T12043] bridge7: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 386.167269][T12045] geneve5: entered promiscuous mode [ 386.193312][T12045] geneve5: entered allmulticast mode [ 386.222150][ T8661] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 386.233093][ T8661] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 386.265848][ T8661] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 386.298357][ T8661] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 386.888152][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 387.244935][T12058] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 387.484998][T12094] 8021q: adding VLAN 0 to HW filter on device bond6 [ 387.522135][T12094] bond6: entered promiscuous mode [ 387.539473][T12094] team0: Port device bond6 added [ 387.601342][T12106] netlink: 'syz.4.1559': attribute type 16 has an invalid length. [ 387.623509][T12106] netlink: 'syz.4.1559': attribute type 17 has an invalid length. [ 387.704658][ T8658] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 20002 - 0 [ 387.713574][ T8658] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 387.798708][ T8658] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 20002 - 0 [ 387.807200][ T8658] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 387.980880][ T8658] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 20002 - 0 [ 388.008271][ T8658] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 388.168232][ T8658] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 20002 - 0 [ 388.176836][ T8658] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 388.478119][ T5847] Bluetooth: hci1: command 0x0406 tx timeout [ 388.895564][T12145] netlink: 'syz.4.1565': attribute type 27 has an invalid length. [ 388.964594][T12152] openvswitch: netlink: IP tunnel TTL not specified. [ 388.997088][T12153] openvswitch: netlink: IP tunnel TTL not specified. [ 389.199116][T12158] __nla_validate_parse: 7 callbacks suppressed [ 389.199136][T12158] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1568'. [ 389.221809][T12155] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1567'. [ 389.432899][T12161] wireguard0: entered promiscuous mode [ 389.446196][T12161] wireguard0: entered allmulticast mode [ 390.317342][T12204] tipc: Enabling of bearer rejected, already enabled [ 390.889587][T12221] xt_CT: No such helper "snmp" [ 391.397842][T12242] syzkaller0: entered promiscuous mode [ 391.417987][T12242] syzkaller0: entered allmulticast mode [ 391.498778][T12253] netlink: 'syz.0.1592': attribute type 1 has an invalid length. [ 391.553173][T12255] x_tables: ip6_tables: SNPT target: used from hooks FORWARD, but only usable from INPUT/POSTROUTING [ 391.566659][T12249] pim6reg: entered allmulticast mode [ 391.574559][T12249] pim6reg: left allmulticast mode [ 391.635472][T12255] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1591'. [ 391.795037][T12264] bridge0: port 3(dummy0) entered disabled state [ 391.801778][T12264] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.809553][T12264] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.016443][T12264] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 392.059200][T12264] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 392.261946][ T8656] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.299443][ T8656] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.334534][ T8656] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.417932][ T8656] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.442007][ T8656] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.457955][ T8656] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.466375][ T8656] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 392.499236][ T8656] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.627725][T12290] netlink: 732 bytes leftover after parsing attributes in process `syz.3.1601'. [ 392.641808][T12292] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1602'. [ 392.664285][T12290] netlink: 732 bytes leftover after parsing attributes in process `syz.3.1601'. [ 392.684119][T12292] 0ªî{X¹¦: renamed from gretap0 [ 392.700809][T12292] 0ªî{X¹¦: entered allmulticast mode [ 392.709057][T12292] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 393.845890][T12310] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1606'. [ 393.992781][T12318] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1608'. [ 394.357726][T12333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1612'. [ 394.718257][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 394.867681][T12342] tipc: Enabling of bearer rejected, failed to enable media [ 394.919897][T12343] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1614'. [ 394.958257][T12347] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1616'. [ 395.139233][T12356] netlink: 'syz.2.1618': attribute type 1 has an invalid length. [ 395.460612][T12379] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1626'. [ 395.556863][T12386] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 395.655093][T12391] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1628'. [ 395.681471][T12391] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1628'. [ 395.683359][T12390] IPVS: set_ctl: invalid protocol: 51 224.0.0.1:20004 [ 395.701555][T12391] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1628'. [ 395.775897][T12391] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1628'. [ 395.873739][T12396] IPVS: set_ctl: invalid protocol: 137 224.0.0.1:0 [ 396.450314][T12421] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1637'. [ 396.630034][T12421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1637'. [ 397.620347][T12459] dummy0: left allmulticast mode [ 398.200070][T12468] netlink: 'syz.2.1650': attribute type 1 has an invalid length. [ 399.176545][T12497] dummy0: Caught tx_queue_len zero misconfig [ 399.380849][T12507] __nla_validate_parse: 7 callbacks suppressed [ 399.380868][T12507] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1658'. [ 399.415563][T12510] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1657'. [ 399.427324][T12507] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1658'. [ 399.786207][T12526] netlink: 'syz.3.1660': attribute type 3 has an invalid length. [ 399.830187][T12517] netlink: 212324 bytes leftover after parsing attributes in process `syz.1.1661'. [ 400.723140][T12576] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1673'. [ 401.000744][T12548] batadv1: entered promiscuous mode [ 401.016040][T12558] netlink: 'syz.4.1668': attribute type 12 has an invalid length. [ 401.047514][T12559] 8021q: VLANs not supported on ipvlan0 [ 401.264250][T12581] netlink: 'syz.0.1675': attribute type 3 has an invalid length. [ 402.121619][T12612] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1685'. [ 402.143916][T12612] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1685'. [ 402.203577][T12615] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 402.243942][T12619] netlink: 'syz.2.1687': attribute type 1 has an invalid length. [ 402.285379][T12619] 8021q: adding VLAN 0 to HW filter on device bond8 [ 402.312950][T12619] bond8: (slave veth3): Enslaving as an active interface with a down link [ 402.329159][T12619] bond8: entered allmulticast mode [ 402.390575][T12622] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 402.679815][T12648] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1696'. [ 402.779402][T12652] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 403.180320][T12669] 8021q: adding VLAN 0 to HW filter on device bond4 [ 403.365996][T12680] A link change request failed with some changes committed already. Interface veth0_to_team may have been left with an inconsistent configuration, please check. [ 403.539361][T12688] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1710'. [ 403.546731][T12689] netlink: 'syz.4.1711': attribute type 8 has an invalid length. [ 404.424522][T12709] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 404.429043][T12721] netlink: 'syz.2.1717': attribute type 1 has an invalid length. [ 404.475789][T12721] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1717'. [ 404.483366][T12709] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1714'. [ 404.522281][T12726] netlink: 'syz.1.1719': attribute type 10 has an invalid length. [ 404.530666][T12726] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1719'. [ 404.544936][T12726] geneve0: entered promiscuous mode [ 404.560527][T12726] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 404.628342][T12726] team0: Failed to send options change via netlink (err -105) [ 404.648108][T12726] team0: Port device geneve0 added [ 404.669448][T12730] netlink: 'syz.2.1720': attribute type 13 has an invalid length. [ 404.708269][ T2141] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.716541][ T2141] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.749918][ T2141] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.777051][ T2141] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.241492][T12737] tipc: Enabled bearer , priority 0 [ 405.257308][T12742] vlan2: entered allmulticast mode [ 405.263165][T12744] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1724'. [ 405.268599][T12742] bridge_slave_0: entered allmulticast mode [ 405.278050][T12744] netlink: 'syz.2.1724': attribute type 30 has an invalid length. [ 405.304780][T12742] bridge0: port 1(vlan2) entered blocking state [ 405.311489][T12742] bridge0: port 1(vlan2) entered disabled state [ 405.330434][T12742] vlan2: entered promiscuous mode [ 405.335536][T12742] bridge_slave_0: entered promiscuous mode [ 405.349501][T12737] syzkaller0: entered promiscuous mode [ 405.359518][T12742] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1725'. [ 405.368687][T12737] syzkaller0: entered allmulticast mode [ 405.391105][ T6680] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.394322][T12744] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1724'. [ 405.400320][ T6680] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.409639][T12742] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1725'. [ 405.436295][T12737] tipc: Resetting bearer [ 405.447712][ T6680] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.448435][T12744] netlink: 'syz.2.1724': attribute type 30 has an invalid length. [ 405.473202][ T6680] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.512384][T12754] tipc: Enabling of bearer rejected, already enabled [ 405.556685][T12736] tipc: Resetting bearer [ 405.599259][T12736] tipc: Disabling bearer [ 405.818346][T12771] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1732'. [ 405.827359][T12771] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1732'. [ 405.877682][T12774] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1731'. [ 405.893306][T12775] netlink: 'syz.2.1733': attribute type 1 has an invalid length. [ 405.970389][T12775] 8021q: adding VLAN 0 to HW filter on device bond9 [ 405.981240][T12779] bond9: entered promiscuous mode [ 405.986364][T12779] bond9: entered allmulticast mode [ 406.305942][T12779] bond9 (unregistering): Released all slaves [ 406.409132][T12798] macvtap0: entered promiscuous mode [ 406.427418][T12798] syz_tun: entered promiscuous mode [ 406.460487][T12798] macvtap0: entered allmulticast mode [ 406.466027][T12798] syz_tun: entered allmulticast mode [ 406.527274][T12798] syz_tun: left allmulticast mode [ 406.533854][T12798] syz_tun: left promiscuous mode [ 406.871888][T12819] netlink: 'syz.1.1743': attribute type 1 has an invalid length. [ 407.298121][T12844] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 407.345718][T12847] syzkaller1: entered promiscuous mode [ 407.353491][T12847] syzkaller1: entered allmulticast mode [ 407.924304][T12886] openvswitch: netlink: Flow key attr not present in new flow. [ 408.977025][T12933] dummy0: left allmulticast mode [ 408.983749][T12933] bridge0: port 3(dummy0) entered disabled state [ 409.010727][T12933] bridge_slave_1: left allmulticast mode [ 409.026398][T12933] bridge_slave_1: left promiscuous mode [ 409.033194][T12933] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.049301][T12933] bridge_slave_0: left allmulticast mode [ 409.075651][T12933] bridge_slave_0: left promiscuous mode [ 409.090538][T12933] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.580589][T12961] netlink: 'syz.1.1783': attribute type 4 has an invalid length. [ 409.594642][T12960] __nla_validate_parse: 14 callbacks suppressed [ 409.594663][T12960] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1781'. [ 409.657459][T12959] netlink: 'syz.1.1783': attribute type 4 has an invalid length. [ 409.720443][T12959] netlink: 'syz.1.1783': attribute type 4 has an invalid length. [ 409.815296][T12962] syzkaller0: entered promiscuous mode [ 409.844024][T12969] sctp: [Deprecated]: syz.4.1786 (pid 12969) Use of int in max_burst socket option deprecated. [ 409.844024][T12969] Use struct sctp_assoc_value instead [ 409.858192][T12962] syzkaller0: entered allmulticast mode [ 409.867304][T12959] netlink: 'syz.1.1783': attribute type 4 has an invalid length. [ 409.886737][T12959] netlink: 'syz.1.1783': attribute type 4 has an invalid length. [ 410.082647][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 411.234825][T12973] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1786'. [ 411.244189][T12973] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1786'. [ 411.262062][T12976] bridge0: port 2(erspan0) entered blocking state [ 411.270227][T12976] bridge0: port 2(erspan0) entered disabled state [ 411.277164][T12976] erspan0: entered allmulticast mode [ 411.285558][T12976] erspan0: entered promiscuous mode [ 411.294447][T12977] erspan0: left allmulticast mode [ 411.300405][T12977] erspan0: left promiscuous mode [ 411.305911][T12977] bridge0: port 2(erspan0) entered disabled state [ 411.464749][T12989] netlink: 'syz.1.1791': attribute type 1 has an invalid length. [ 411.505728][T12989] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1791'. [ 411.625707][T12991] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.1790'. [ 411.895478][T13008] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 412.179773][ T5912] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 412.359118][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1800'. [ 412.385977][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1800'. [ 412.429456][ T5912] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 412.511851][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1800'. [ 412.598929][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1800'. [ 412.609315][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1800'. [ 412.694319][T13032] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.718887][T13032] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 412.761607][T13031] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 412.846726][T13053] IPVS: sync thread started: state = BACKUP, mcast_ifn = tunl0, syncid = 3, id = 0 [ 413.119038][ T152] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 413.177729][T13062] xt_TPROXY: Can be used only with -p tcp or -p udp [ 414.419108][ T8656] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 414.437209][ T8656] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 414.600962][T13096] netlink: 'syz.0.1817': attribute type 3 has an invalid length. [ 414.638047][T13096] netlink: 'syz.0.1817': attribute type 1 has an invalid length. [ 414.645917][T13096] __nla_validate_parse: 95 callbacks suppressed [ 414.645937][T13096] netlink: 212 bytes leftover after parsing attributes in process `syz.0.1817'. [ 414.725286][T13096] NCSI netlink: No device for ifindex 813332851 [ 414.748281][ T185] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 414.796900][T13102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1819'. [ 415.072368][T13109] ip_vti0: entered promiscuous mode [ 415.077809][T13109] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1821'. [ 415.131590][T13113] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1822'. [ 415.205450][T13114] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1823'. [ 415.941877][T13144] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 415.981324][T13144] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1830'. [ 416.070597][T13147] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1830'. [ 416.186674][T13144] macvtap0: entered promiscuous mode [ 416.212706][T13144] veth1_to_hsr: entered promiscuous mode [ 416.236013][T13144] macvtap0: entered allmulticast mode [ 416.362598][T13138] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1828'. [ 416.418985][T13144] veth1_to_hsr: entered allmulticast mode [ 416.772126][T13161] nbd: socks must be embedded in a SOCK_ITEM attr [ 416.806927][T13161] block nbd1: shutting down sockets [ 416.889937][T13169] syzkaller0: entered promiscuous mode [ 416.895461][T13169] syzkaller0: entered allmulticast mode [ 416.960000][T13169] netlink: 62 bytes leftover after parsing attributes in process `syz.2.1836'. [ 417.021975][T13175] netlink: 'syz.3.1839': attribute type 4 has an invalid length. [ 417.187178][T13182] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1841'. [ 417.264244][T13188] wireguard0: entered promiscuous mode [ 417.290526][T13188] wireguard0: entered allmulticast mode [ 417.326725][T13188] team0: Device wireguard0 is of different type [ 417.433751][T13194] netlink: 'syz.1.1846': attribute type 2 has an invalid length. [ 417.487475][T13194] @„;: entered promiscuous mode [ 418.558059][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 418.635442][T13234] ip_vti0: left promiscuous mode [ 418.679524][T13234] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.709595][T13234] 8021q: adding VLAN 0 to HW filter on device ` [ 418.722234][T13234] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 418.761973][T13237] syz.3.1853: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 418.798250][T13237] CPU: 1 UID: 0 PID: 13237 Comm: syz.3.1853 Not tainted syzkaller #0 PREEMPT(full) [ 418.798281][T13237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 418.798299][T13237] Call Trace: [ 418.798311][T13237] [ 418.798320][T13237] dump_stack_lvl+0x189/0x250 [ 418.798353][T13237] ? __pfx_dump_stack_lvl+0x10/0x10 [ 418.798376][T13237] ? __pfx__printk+0x10/0x10 [ 418.798405][T13237] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 418.798446][T13237] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 418.798480][T13237] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 418.798515][T13237] warn_alloc+0x214/0x310 [ 418.798550][T13237] ? __pfx_warn_alloc+0x10/0x10 [ 418.798587][T13237] ? __get_vm_area_node+0x28f/0x300 [ 418.798612][T13237] ? xskq_create+0xbf/0x170 [ 418.798640][T13237] __vmalloc_node_range_noprof+0x690/0x12d0 [ 418.798703][T13237] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 418.798735][T13237] ? __kasan_kmalloc+0x93/0xb0 [ 418.798770][T13237] vmalloc_user_noprof+0xad/0xf0 [ 418.798796][T13237] ? xskq_create+0xbf/0x170 [ 418.798820][T13237] xskq_create+0xbf/0x170 [ 418.798847][T13237] xsk_init_queue+0xb0/0x110 [ 418.798872][T13237] xsk_setsockopt+0x57b/0x8d0 [ 418.798897][T13237] ? __pfx_xsk_setsockopt+0x10/0x10 [ 418.798922][T13237] ? __pfx_aa_sk_perm+0x10/0x10 [ 418.798955][T13237] ? aa_sock_opt_perm+0xff/0x1a0 [ 418.798978][T13237] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 418.799006][T13237] ? __pfx_xsk_setsockopt+0x10/0x10 [ 418.799029][T13237] do_sock_setsockopt+0x17c/0x1b0 [ 418.799064][T13237] __x64_sys_setsockopt+0x13f/0x1b0 [ 418.799100][T13237] do_syscall_64+0xfa/0xf80 [ 418.799128][T13237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.799150][T13237] ? clear_bhb_loop+0x60/0xb0 [ 418.799174][T13237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.799193][T13237] RIP: 0033:0x7fce60d8f749 [ 418.799211][T13237] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 418.799228][T13237] RSP: 002b:00007fce61c8e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 418.799251][T13237] RAX: ffffffffffffffda RBX: 00007fce60fe6180 RCX: 00007fce60d8f749 [ 418.799266][T13237] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000007 [ 418.799278][T13237] RBP: 00007fce60e13f91 R08: 0000000000000004 R09: 0000000000000000 [ 418.799291][T13237] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 418.799304][T13237] R13: 00007fce60fe6218 R14: 00007fce60fe6180 R15: 00007ffcb1d68688 [ 418.799339][T13237] [ 418.799359][T13237] Mem-Info: [ 419.059715][T13237] active_anon:6669 inactive_anon:0 isolated_anon:0 [ 419.059715][T13237] active_file:3208 inactive_file:39984 isolated_file:0 [ 419.059715][T13237] unevictable:768 dirty:160 writeback:0 [ 419.059715][T13237] slab_reclaimable:12299 slab_unreclaimable:140769 [ 419.059715][T13237] mapped:30035 shmem:1357 pagetables:991 [ 419.059715][T13237] sec_pagetables:0 bounce:0 [ 419.059715][T13237] kernel_misc_reclaimable:0 [ 419.059715][T13237] free:1274475 free_pcp:17550 free_cma:0 [ 419.105244][T13237] Node 0 active_anon:26676kB inactive_anon:0kB active_file:12832kB inactive_file:159736kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120140kB dirty:640kB writeback:0kB shmem:3892kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13232kB pagetables:3832kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 419.208121][T13237] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 419.319712][T13237] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 419.436568][T13237] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 419.456867][T13237] Node 0 DMA32 free:1178944kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27976kB inactive_anon:0kB active_file:12832kB inactive_file:159736kB unevictable:1536kB writepending:640kB zspages:0kB present:3129332kB managed:2564516kB mlocked:0kB bounce:0kB free_pcp:61232kB local_pcp:32768kB free_cma:0kB [ 419.528464][T13237] lowmem_reserve[]: 0 0 0 0 0 [ 419.533259][T13237] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 419.563814][T13237] lowmem_reserve[]: 0 0 0 0 0 [ 419.573263][T13237] Node 1 Normal free:3900348kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:12512kB local_pcp:6560kB free_cma:0kB [ 419.606492][T13237] lowmem_reserve[]: 0 0 0 0 0 [ 419.614798][T13237] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 419.628289][T13237] Node 0 DMA32: 2065*4kB (UME) 300*8kB (UME) 122*16kB (UME) 203*32kB (UME) 72*64kB (UME) 94*128kB (UME) 67*256kB (UME) 10*512kB (UM) 5*1024kB (UM) 4*2048kB (UME) 270*4096kB (UM) = 1177252kB [ 419.649818][T13237] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 419.667051][T13237] Node 1 Normal: 157*4kB (UM) 59*8kB (UME) 43*16kB (UME) 134*32kB (UME) 32*64kB (UME) 6*128kB (UME) 5*256kB (UME) 4*512kB (UME) 1*1024kB (M) 2*2048kB (UE) 948*4096kB (M) = 3900348kB [ 419.691238][T13237] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 419.709275][T13237] Node 0 hugepages_total=3 hugepages_free=0 hugepages_surp=1 hugepages_size=2048kB [ 419.719710][T13237] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 419.729461][T13237] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 419.741009][T13237] 45521 total pagecache pages [ 419.745744][T13237] 0 pages in swap cache [ 419.750077][T13237] Free swap = 124996kB [ 419.763927][T13237] Total swap = 124996kB [ 419.848456][T13237] 2097051 pages RAM [ 419.858082][T13237] 0 pages HighMem/MovableOnly [ 419.877813][T13237] 424280 pages reserved [ 419.882373][T13237] 0 pages cma reserved [ 419.931135][T13271] __nla_validate_parse: 22 callbacks suppressed [ 419.931155][T13271] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1861'. [ 419.989013][T13271] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1861'. [ 420.147200][T13281] tipc: Enabled bearer , priority 0 [ 420.195644][T13281] syzkaller0: entered promiscuous mode [ 420.214725][T13281] syzkaller0: entered allmulticast mode [ 420.365436][T13285] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1865'. [ 420.381873][T13285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1865'. [ 420.520816][T13287] netlink: 165 bytes leftover after parsing attributes in process `syz.4.1864'. [ 422.076151][T13283] tipc: Resetting bearer [ 422.089856][ T44] tipc: Node number set to 3500103894 [ 422.097625][T13276] tipc: Resetting bearer [ 422.144271][T13276] tipc: Disabling bearer [ 422.163896][T13303] netlink: 'syz.3.1868': attribute type 1 has an invalid length. [ 422.296945][T13312] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.299440][T13309] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 422.536952][T13321] sch_tbf: burst 1447 is lower than device macvtap0 mtu (1514) ! [ 422.640828][T13328] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1873'. [ 422.650881][T13328] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1873'. [ 422.661356][T13327] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1874'. [ 422.671235][T13326] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1876'. [ 422.704022][T13321] sch_tbf: burst 1447 is lower than device macvtap0 mtu (1514) ! [ 422.726348][T13327] netlink: 'syz.1.1874': attribute type 3 has an invalid length. [ 422.745972][T13331] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1876'. [ 422.845577][T13335] openvswitch: netlink: nsh attr 0 has unexpected len 32768 expected 0 [ 422.868102][T13335] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.902937][T13339] openvswitch: netlink: nsh attr 0 has unexpected len 32768 expected 0 [ 422.951907][T13339] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 423.204085][T13351] delete_channel: no stack [ 423.252613][T13360] netlink: 'syz.3.1884': attribute type 33 has an invalid length. [ 423.269547][T13360] `: renamed from team0 [ 423.325302][T13366] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 423.448059][T13363] bond0: (slave team0): Releasing backup interface [ 423.457519][T13363] team0 (unregistering): left promiscuous mode [ 423.464349][T13363] team_slave_0: left promiscuous mode [ 423.470520][T13363] team_slave_1: left promiscuous mode [ 423.476332][T13363] bond6: left promiscuous mode [ 423.489346][T13363] team0 (unregistering): Port device team_slave_0 removed [ 423.506414][T13363] team0 (unregistering): Port device team_slave_1 removed [ 423.523931][T13363] team0 (unregistering): Port device bond6 removed [ 424.291591][T13417] Bluetooth: MGMT ver 1.23 [ 424.817086][T13451] bond9: invalid ARP target 0.0.0.0 specified for addition [ 424.825786][T13451] bond9: option arp_ip_target: invalid value (0) [ 424.836045][T13451] bond9 (unregistering): Released all slaves [ 425.102592][T13481] netlink: 'syz.1.1917': attribute type 1 has an invalid length. [ 425.180632][T13481] bond7: entered promiscuous mode [ 425.192709][T13481] 8021q: adding VLAN 0 to HW filter on device bond7 [ 425.239029][T13488] bond7: (slave veth9): making interface the new active one [ 425.247366][T13488] veth9: entered promiscuous mode [ 425.253592][T13488] bond7: (slave veth9): Enslaving as an active interface with an up link [ 425.446779][T13504] __nla_validate_parse: 10 callbacks suppressed [ 425.446802][T13504] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1924'. [ 425.524430][T13504] team0 (uninitialized): Failed to send options change via netlink (err -105) [ 425.547526][ T5154] Bluetooth: hci4: link tx timeout [ 425.552808][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.561387][ T5154] Bluetooth: hci4: link tx timeout [ 425.567341][T13504] team0: entered promiscuous mode [ 425.567516][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.572700][T13504] team0: entered allmulticast mode [ 425.581550][ T5154] Bluetooth: hci4: link tx timeout [ 425.590969][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.598864][ T5154] Bluetooth: hci4: link tx timeout [ 425.604081][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.612033][ T5154] Bluetooth: hci4: link tx timeout [ 425.617269][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.625089][ T5154] Bluetooth: hci4: link tx timeout [ 425.630404][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.638368][ T5154] Bluetooth: hci4: link tx timeout [ 425.643594][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.651466][ T5154] Bluetooth: hci4: link tx timeout [ 425.656851][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.688673][ T5154] Bluetooth: hci4: link tx timeout [ 425.693899][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.701960][ T5154] Bluetooth: hci4: link tx timeout [ 425.707182][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.715160][ T5154] Bluetooth: hci4: link tx timeout [ 425.721856][ T5154] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 425.885599][T13523] netlink: 'syz.2.1929': attribute type 1 has an invalid length. [ 425.996853][T13529] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1930'. [ 426.008457][ T5154] Bluetooth: hci4: command 0x0405 tx timeout [ 426.012877][T13523] 8021q: adding VLAN 0 to HW filter on device bond9 [ 426.036218][T13529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1930'. [ 426.058282][T13529] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1930'. [ 426.067377][T13529] netlink: 'syz.1.1930': attribute type 3 has an invalid length. [ 426.105870][T13529] netlink: 'syz.1.1930': attribute type 2 has an invalid length. [ 426.113884][T13529] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1930'. [ 426.162131][T13529] netlink: 'syz.1.1930': attribute type 2 has an invalid length. [ 426.323450][T13551] lo: Caught tx_queue_len zero misconfig [ 426.417253][T13545] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 426.435609][T13554] netlink: 'syz.3.1939': attribute type 12 has an invalid length. [ 426.517122][T13556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1939'. [ 426.558588][T13556] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1939'. [ 426.595829][T13556] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for erspan1 [ 426.633729][T13556] erspan1: entered allmulticast mode [ 426.718067][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 427.382382][T13613] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1954'. [ 428.078690][ T5154] Bluetooth: hci4: command 0x0405 tx timeout [ 428.400868][T13641] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 428.469663][T13641] dvmrp1: linktype set to 774 [ 428.489342][T13645] tipc: Enabled bearer , priority 0 [ 428.716729][T13655] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.759524][T13657] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1960'. [ 428.783722][T13645] tipc: Resetting bearer [ 428.832957][T13636] tipc: Disabling bearer [ 428.864607][T13655] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.951878][T13655] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.045756][T13655] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.180800][ T152] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.303457][T13667] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1965'. [ 429.336559][ T152] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.400643][T13669] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 429.416480][ T8656] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.511204][ T3439] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.712606][T13684] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 429.795390][T13684] batadv2: entered promiscuous mode [ 429.834143][T13684] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 430.004850][T13692] gretap1: entered promiscuous mode [ 430.028377][T13692] batman_adv: batadv0: Adding interface: gretap1 [ 430.049691][T13692] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 430.106103][T13692] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 430.172447][T13705] nbd: must specify a size in bytes for the device [ 430.286281][T13709] netlink: 'syz.2.1977': attribute type 7 has an invalid length. [ 430.390911][T13709] netlink: 'syz.2.1977': attribute type 7 has an invalid length. [ 430.662236][T13729] netlink: 'syz.2.1981': attribute type 1 has an invalid length. [ 431.100328][T13729] 8021q: adding VLAN 0 to HW filter on device bond10 [ 431.205147][T13737] veth7: entered promiscuous mode [ 431.232865][T13737] bond10: (slave veth7): Enslaving as an active interface with an up link [ 431.529973][T13763] __nla_validate_parse: 2 callbacks suppressed [ 431.529995][T13763] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1984'. [ 431.595734][T13763] vlan3: entered allmulticast mode [ 431.609569][T13763] erspan0: entered allmulticast mode [ 432.092714][T13784] tipc: Enabled bearer , priority 0 [ 432.117765][T13784] syzkaller0: entered promiscuous mode [ 432.137616][T13784] syzkaller0: entered allmulticast mode [ 432.182848][T13782] tipc: Resetting bearer [ 432.205582][T13796] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1995'. [ 432.212796][T13782] tipc: Disabling bearer [ 432.286601][T13796] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1995'. [ 432.296193][T13796] netem: invalid attributes len -18 [ 432.301776][T13796] netem: change failed [ 432.397457][T13802] netlink: 'syz.2.1997': attribute type 1 has an invalid length. [ 432.419978][T13802] tipc: Enabling of bearer rejected, failed to enable media [ 432.545341][T13806] syz_tun: entered allmulticast mode [ 432.558061][T13805] syz_tun: left allmulticast mode [ 433.119556][T13833] netlink: 'syz.4.2002': attribute type 29 has an invalid length. [ 433.416175][T13841] netlink: 'syz.3.2006': attribute type 3 has an invalid length. [ 433.434360][T13841] netlink: 'syz.3.2006': attribute type 1 has an invalid length. [ 433.455203][T13841] netlink: 212 bytes leftover after parsing attributes in process `syz.3.2006'. [ 433.511055][T13826] lo speed is unknown, defaulting to 1000 [ 433.517157][T13826] lo speed is unknown, defaulting to 1000 [ 433.532243][T13826] lo speed is unknown, defaulting to 1000 [ 433.541941][T13841] NCSI netlink: No device for ifindex 813332851 [ 433.552819][T13826] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 433.630025][T13826] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 433.714490][T13846] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2008'. [ 433.812402][T13826] lo speed is unknown, defaulting to 1000 [ 433.820976][T13826] lo speed is unknown, defaulting to 1000 [ 433.861608][T13826] lo speed is unknown, defaulting to 1000 [ 433.870374][T13826] lo speed is unknown, defaulting to 1000 [ 433.884778][T13826] lo speed is unknown, defaulting to 1000 [ 433.902683][T13826] lo speed is unknown, defaulting to 1000 [ 434.010967][T13860] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2011'. [ 434.020057][T13849] netlink: 'syz.4.2009': attribute type 10 has an invalid length. [ 434.141243][T13863] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2012'. [ 434.486351][T13879] netlink: 'syz.3.2016': attribute type 32 has an invalid length. [ 434.719247][T13890] tipc: Enabled bearer , priority 0 [ 434.728722][T13896] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2022'. [ 434.856392][T13890] syzkaller0: entered promiscuous mode [ 434.897047][T13890] syzkaller0: entered allmulticast mode [ 434.907769][T13890] tipc: Resetting bearer [ 434.948508][T13889] tipc: Resetting bearer [ 435.288080][T13921] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 435.295343][T13921] IPv6: NLM_F_CREATE should be set when creating new route [ 435.303007][T13921] IPv6: NLM_F_CREATE should be set when creating new route [ 435.310290][T13921] IPv6: NLM_F_CREATE should be set when creating new route [ 435.450721][T13928] ieee802154 phy0 wpan0: encryption failed: -22 [ 435.554538][T13933] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2029'. [ 435.573601][T13933] x_tables: duplicate entry at hook 3 [ 436.837256][T13889] tipc: Disabling bearer [ 436.984843][T13955] netlink: 280 bytes leftover after parsing attributes in process `syz.4.2033'. [ 437.012619][T13957] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2031'. [ 437.170742][T13968] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2037'. [ 437.195691][T13968] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2037'. [ 437.395460][T13982] tipc: Enabled bearer , priority 0 [ 437.403125][T13982] syzkaller0: entered promiscuous mode [ 437.408784][T13982] syzkaller0: entered allmulticast mode [ 437.450779][T13982] tipc: Resetting bearer [ 437.471995][T13982] tipc: Disabling bearer [ 437.639591][T13989] Bluetooth: hci1: too big key_count value 29096 [ 437.790281][T13949] lo speed is unknown, defaulting to 1000 [ 438.161220][T14011] netlink: 'syz.4.2047': attribute type 32 has an invalid length. [ 438.185319][T14013] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.613830][T14035] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2051'. [ 438.852449][T14040] 0ªî{X¹¦: left allmulticast mode [ 438.865479][T14043] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2055'. [ 438.868808][T14040] erspan0: left promiscuous mode [ 438.920949][T14040] 8021q: adding VLAN 0 to HW filter on device bond0 [ 438.934162][T14040] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 439.463328][T14062] tipc: Enabled bearer , priority 0 [ 439.495214][T14059] syzkaller1: entered promiscuous mode [ 439.501607][T14059] syzkaller1: entered allmulticast mode [ 439.527129][T14064] netlink: 'syz.3.2059': attribute type 2 has an invalid length. [ 439.535655][T14046] lo speed is unknown, defaulting to 1000 [ 439.699196][T14052] tipc: Disabling bearer [ 440.161413][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 440.170517][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.798195][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 442.718225][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 475.358147][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 501.598113][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 501.608135][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 501.617161][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 525.698557][T14096] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2066'. [ 525.728716][T14096] ip_vti0: Master is either lo or non-ether device [ 526.086203][T14122] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2076'. [ 526.567417][T14149] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2081'. [ 527.158811][T14180] tipc: Enabled bearer , priority 0 [ 527.170888][T14179] tipc: Enabled bearer , priority 0 [ 527.201165][T14176] syzkaller0: entered promiscuous mode [ 527.206684][T14176] syzkaller0: entered allmulticast mode [ 527.255895][T14186] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2093'. [ 527.277082][T14176] tipc: Resetting bearer [ 527.300177][T14178] tipc: Disabling bearer [ 527.331773][T14175] tipc: Resetting bearer [ 527.351236][T14175] tipc: Disabling bearer [ 527.446875][T14193] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2095'. [ 527.487121][T14193] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2095'. [ 527.513395][T14193] netlink: 'syz.3.2095': attribute type 12 has an invalid length. [ 527.783465][T14220] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2104'. [ 528.068962][T14238] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2109'. [ 528.185549][T14243] syzkaller0: entered promiscuous mode [ 528.203757][T14243] syzkaller0: entered allmulticast mode [ 528.271540][T14246] netlink: 'syz.2.2111': attribute type 1 has an invalid length. [ 528.279476][T14243] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2110'. [ 528.482824][T14250] netlink: 'syz.2.2113': attribute type 2 has an invalid length. [ 528.501866][T14250] : entered promiscuous mode [ 528.524613][T14255] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2113'. [ 528.557353][T14259] IPVS: set_ctl: invalid protocol: 58 127.0.0.1:20001 [ 528.754959][T14269] xt_nat: multiple ranges no longer supported [ 528.834010][T14273] tipc: Can't bind to reserved service type 2 [ 529.211257][T14296] netlink: 'syz.1.2126': attribute type 10 has an invalid length. [ 529.555529][T14317] bond5: option packets_per_slave: invalid value (1056006) [ 529.567467][T14317] bond5: option packets_per_slave: allowed values 0 - 65535 [ 529.578964][T14322] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 529.607540][T14317] bond5 (unregistering): Released all slaves [ 529.675954][T14320] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.718649][T14322] 8021q: VLANs not supported on wg1 [ 529.726089][T14334] 0ªîf„X¹¦: renamed from gretap0 (while UP) [ 529.754560][T14334] 0ªîf„X¹¦: entered allmulticast mode [ 529.776793][T14334] A link change request failed with some changes committed already. Interface 30ªîf„X¹¦ may have been left with an inconsistent configuration, please check. [ 529.826312][T14320] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.903304][T14349] netlink: 'syz.3.2140': attribute type 10 has an invalid length. [ 530.034144][T14358] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 530.073489][T14349] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 530.112194][T14320] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.237310][T14320] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.355837][T14370] netlink: 'syz.4.2145': attribute type 1 has an invalid length. [ 530.388115][T14370] netlink: 'syz.4.2145': attribute type 2 has an invalid length. [ 530.405839][T14369] netlink: 'syz.4.2145': attribute type 1 has an invalid length. [ 530.414343][T14369] netlink: 'syz.4.2145': attribute type 2 has an invalid length. [ 530.462941][ T3439] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.499236][ T8660] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.552707][ T8660] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.604083][ T8660] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.592034][T14418] netlink: 'syz.4.2157': attribute type 2 has an invalid length. [ 531.618693][T14418] __nla_validate_parse: 17 callbacks suppressed [ 531.618713][T14418] netlink: 108 bytes leftover after parsing attributes in process `syz.4.2157'. [ 531.650904][T14418] tunl0: Caught tx_queue_len zero misconfig [ 532.153212][T14436] IPVS: sync thread started: state = BACKUP, mcast_ifn = tunl0, syncid = 3, id = 0 [ 532.348691][T14411] lo speed is unknown, defaulting to 1000 [ 532.635134][T14440] tipc: Enabled bearer , priority 0 [ 532.776959][T14441] validate_nla: 1 callbacks suppressed [ 532.776981][T14441] netlink: 'syz.0.2165': attribute type 10 has an invalid length. [ 532.865475][T14441] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2165'. [ 532.899566][T14438] syzkaller0: entered promiscuous mode [ 532.905877][T14438] syzkaller0: entered allmulticast mode [ 532.957074][T14444] tipc: Resetting bearer [ 532.974166][T14441] batadv0: entered promiscuous mode [ 532.984142][T14441] batadv0: entered allmulticast mode [ 532.998441][T14441] bridge0: port 1(batadv0) entered blocking state [ 533.008068][T14441] bridge0: port 1(batadv0) entered disabled state [ 533.029713][T14437] tipc: Resetting bearer [ 533.055377][T14437] tipc: Disabling bearer [ 533.095851][T14430] lo speed is unknown, defaulting to 1000 [ 533.306878][T14451] netlink: 'syz.2.2167': attribute type 29 has an invalid length. [ 533.317526][T14451] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2167'. [ 533.370921][T14455] netlink: 'syz.0.2166': attribute type 1 has an invalid length. [ 533.429163][ T152] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 533.438908][ T152] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 533.456568][T14460] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2169'. [ 533.468490][T14460] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2169'. [ 533.482261][T14455] 8021q: adding VLAN 0 to HW filter on device bond5 [ 533.510352][T14449] bond5: (slave veth7): Enslaving as an active interface with a down link [ 533.521387][T14459] netlink: 'syz.2.2170': attribute type 12 has an invalid length. [ 533.586708][T14462] bond5: (slave dummy0): making interface the new active one [ 533.639678][T14462] dummy0: entered promiscuous mode [ 533.652066][T14462] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 533.920474][T14449] bond5 (unregistering): (slave veth7): Releasing active interface [ 533.944657][T14449] bond5 (unregistering): (slave dummy0): Releasing active interface [ 533.965888][T14449] bond5 (unregistering): Released all slaves [ 534.390001][T14487] veth9: entered allmulticast mode [ 534.406308][T14489] netlink: 'syz.0.2177': attribute type 4 has an invalid length. [ 534.602385][T14496] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2180'. [ 534.768058][T14507] netlink: 'syz.0.2181': attribute type 6 has an invalid length. [ 534.990162][T14520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2185'. [ 535.191536][T14501] lo speed is unknown, defaulting to 1000 [ 535.299157][T14529] dummy0: entered promiscuous mode [ 535.304803][T14529] macsec0: entered promiscuous mode [ 535.310280][T14529] macsec0: entered allmulticast mode [ 535.316031][T14529] dummy0: entered allmulticast mode [ 535.323207][T14529] dummy0: left allmulticast mode [ 535.329241][T14529] dummy0: left promiscuous mode [ 535.413452][T14526] syzkaller0: entered promiscuous mode [ 535.419124][T14526] syzkaller0: entered allmulticast mode [ 535.762254][T14553] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2193'. [ 535.796342][T14553] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2193'. [ 535.822573][T14556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2194'. [ 537.236253][T14567] __nla_validate_parse: 4 callbacks suppressed [ 537.236272][T14567] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2198'. [ 537.352464][T14570] netlink: 'syz.0.2196': attribute type 1 has an invalid length. [ 537.465731][T14582] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 537.473281][T14582] IPv6: NLM_F_CREATE should be set when creating new route [ 537.480579][T14582] IPv6: NLM_F_CREATE should be set when creating new route [ 537.501864][T14582] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 537.559242][T14584] netlink: 'syz.3.2200': attribute type 83 has an invalid length. [ 537.574345][T14570] bond5: entered promiscuous mode [ 537.585389][T14570] 8021q: adding VLAN 0 to HW filter on device bond5 [ 537.683136][T14581] 8021q: adding VLAN 0 to HW filter on device bond5 [ 537.708671][T14581] bond5: (slave wireguard0): The slave device specified does not support setting the MAC address [ 537.730646][T14581] bond5: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 537.776115][T14581] bond5: (slave wireguard0): making interface the new active one [ 537.870542][T14581] wireguard0: entered promiscuous mode [ 537.902282][T14581] bond5: (slave wireguard0): Enslaving as an active interface with an up link [ 538.075340][T14597] : renamed from bond_slave_0 [ 538.413408][T14610] netlink: 'syz.1.2206': attribute type 4 has an invalid length. [ 538.438081][T14611] netlink: 'syz.1.2206': attribute type 4 has an invalid length. [ 538.465078][T14613] netlink: 'syz.1.2206': attribute type 4 has an invalid length. [ 538.520813][ T185] lo speed is unknown, defaulting to 1000 [ 538.547159][ T185] lo speed is unknown, defaulting to 1000 [ 538.721141][T14628] netlink: 'syz.0.2207': attribute type 33 has an invalid length. [ 538.762559][T14628] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2207'. [ 538.775250][T14628] `: renamed from team0 (while UP) [ 538.939515][T14639] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 538.967483][T14639] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 538.982143][T14639] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 539.116250][T14648] IPVS: set_ctl: invalid protocol: 8 172.30.1.5:20004 [ 539.123596][ T30] audit: type=1800 audit(1765212286.915:7): pid=14649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2216" name="memory.events" dev="tmpfs" ino=2202 res=0 errno=0 [ 539.167965][ T30] audit: type=1804 audit(1765212286.955:8): pid=14649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2216" name="memory.events" dev="tmpfs" ino=2202 res=1 errno=0 [ 539.403072][T14658] netlink: 'syz.1.2219': attribute type 2 has an invalid length. [ 539.499275][T14662] tap0: tun_chr_ioctl cmd 2148553947 [ 539.507104][T14662] tap0: tun_chr_ioctl cmd 2147767521 [ 539.515128][T14662] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2220'. [ 539.533150][T14662] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 539.541380][T14653] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2214'. [ 539.561725][T14662] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 539.599237][T14662] bond0: (slave batadv0): Releasing backup interface [ 539.610414][T14662] batadv0 (unregistering): left promiscuous mode [ 539.715638][T14653] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2214'. [ 539.929743][T14674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2223'. [ 540.017201][T14679] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2223'. [ 540.253403][T14688] ipvlan3: entered promiscuous mode [ 540.659491][T14696] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2228'. [ 540.674627][T14696] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2228'. [ 540.846265][T14705] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 541.392432][T14727] netlink: 216 bytes leftover after parsing attributes in process `syz.3.2235'. [ 541.693342][T14718] lo speed is unknown, defaulting to 1000 [ 541.772049][T14747] netlink: 'syz.1.2239': attribute type 1 has an invalid length. [ 541.874037][T14747] 8021q: adding VLAN 0 to HW filter on device bond9 [ 542.021660][T14757] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 542.143548][T14761] netlink: 'syz.1.2242': attribute type 1 has an invalid length. [ 542.173915][T14761] netlink: 'syz.1.2242': attribute type 3 has an invalid length. [ 542.559107][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 542.628415][T14770] netlink: 'syz.1.2245': attribute type 2 has an invalid length. [ 542.643689][T14771] netlink: 'syz.1.2245': attribute type 2 has an invalid length. [ 542.929432][T14782] __nla_validate_parse: 4 callbacks suppressed [ 542.929454][T14782] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2248'. [ 543.834070][T14770] lo speed is unknown, defaulting to 1000 [ 544.390448][T14803] netlink: 'syz.3.2252': attribute type 1 has an invalid length. [ 544.446480][T14803] 8021q: adding VLAN 0 to HW filter on device bond5 [ 544.510740][T14803] bond6: Unable to set up delay as MII monitoring is disabled [ 544.539927][T14803] bond6 (unregistering): Released all slaves [ 544.879742][T14811] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2254'. [ 545.224609][T14786] lo speed is unknown, defaulting to 1000 [ 545.234583][T14771] lo speed is unknown, defaulting to 1000 [ 545.254690][T14777] lo speed is unknown, defaulting to 1000 [ 545.304339][T14776] lo speed is unknown, defaulting to 1000 [ 546.664799][T14841] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 546.838738][T14844] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2261'. [ 547.285109][ T1113] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.312391][ T1113] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.351146][ T1113] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.414728][ T1113] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.480973][T14872] netlink: 'syz.2.2270': attribute type 1 has an invalid length. [ 547.490911][T14872] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2270'. [ 547.535632][T14872] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2270'. [ 547.762382][T14887] bond11: option lp_interval: invalid value (0) [ 547.774488][T14887] bond11: option lp_interval: allowed values 1 - 2147483647 [ 547.802300][T14887] bond11 (unregistering): Released all slaves [ 547.888318][T14899] syzkaller0: entered promiscuous mode [ 547.893976][T14899] syzkaller0: entered allmulticast mode [ 547.931701][T14897] netlink: 'syz.0.2278': attribute type 1 has an invalid length. [ 548.275531][T14913] netlink: 'syz.2.2281': attribute type 1 has an invalid length. [ 548.288544][T14913] netlink: 'syz.2.2281': attribute type 4 has an invalid length. [ 548.339444][T14913] netlink: 15558 bytes leftover after parsing attributes in process `syz.2.2281'. [ 548.436564][T14918] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 548.593174][T14925] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2286'. [ 548.625575][T14925] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2286'. [ 548.951960][T14940] netlink: 'syz.1.2292': attribute type 10 has an invalid length. [ 548.960203][T14940] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2292'. [ 548.989165][ T6680] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.016192][ T6680] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.047987][ T6680] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.077001][ T6680] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.298286][T14952] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 549.455385][T14964] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2297'. [ 549.481764][T14964] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2297'. [ 549.587663][T14964] macvtap1: entered promiscuous mode [ 549.593879][T14964] vlan0: entered promiscuous mode [ 549.748681][T14969] macsec2: entered promiscuous mode [ 549.754269][T14969] mac80211_hwsim hwsim8 wlan1: entered promiscuous mode [ 549.829456][T14971] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2298'. [ 549.880486][T14971] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2298'. [ 549.953227][T14977] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2300'. [ 550.018387][T14980] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2303'. [ 550.194512][T14988] ip6erspan1: entered allmulticast mode [ 550.278257][T14988] netlink: 'syz.3.2305': attribute type 1 has an invalid length. [ 550.612576][T15007] nbd: socks must be embedded in a SOCK_ITEM attr [ 550.906719][T15021] sctp: [Deprecated]: syz.1.2315 (pid 15021) Use of struct sctp_assoc_value in delayed_ack socket option. [ 550.906719][T15021] Use struct sctp_sack_info instead [ 551.451951][T15018] lo speed is unknown, defaulting to 1000 [ 551.974829][T15066] netlink: 'syz.4.2326': attribute type 1 has an invalid length. [ 552.019559][T15062] xt_CT: You must specify a L4 protocol and not use inversions on it [ 552.672303][T15083] netlink: 'syz.4.2330': attribute type 13 has an invalid length. [ 552.688559][T15083] netlink: 'syz.4.2330': attribute type 17 has an invalid length. [ 553.188945][T15078] netlink: 'syz.2.2328': attribute type 322 has an invalid length. [ 553.229279][T15064] lo speed is unknown, defaulting to 1000 [ 553.368496][T15100] vxcan3: entered allmulticast mode [ 553.384818][T15106] __nla_validate_parse: 7 callbacks suppressed [ 553.384839][T15106] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2335'. [ 553.437237][T15108] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2335'. [ 553.536460][T15112] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 553.619228][T15112] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 553.971653][T15114] syzkaller0: entered promiscuous mode [ 554.008196][T15114] syzkaller0: entered allmulticast mode [ 554.204445][T15108] lo speed is unknown, defaulting to 1000 [ 555.808149][T15136] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2343'. [ 556.130716][T15159] netlink: 'syz.4.2345': attribute type 1 has an invalid length. [ 556.169801][T15157] syzkaller1: entered promiscuous mode [ 556.175331][T15157] syzkaller1: entered allmulticast mode [ 556.181913][T15159] netlink: 'syz.4.2345': attribute type 11 has an invalid length. [ 556.181949][T15159] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2345'. [ 556.429105][T15132] lo speed is unknown, defaulting to 1000 [ 556.617204][T15173] x_tables: duplicate underflow at hook 1 [ 556.989315][T15179] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 557.157385][T15153] lo speed is unknown, defaulting to 1000 [ 557.903464][T15199] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2361'. [ 557.924551][T15199] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2361'. [ 558.226816][T15212] GUP no longer grows the stack in syz.1.2366 (15212): 200000003000-20000000a000 (200000001000) [ 558.264992][T15214] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2365'. [ 558.270583][T15212] CPU: 0 UID: 0 PID: 15212 Comm: syz.1.2366 Not tainted syzkaller #0 PREEMPT(full) [ 558.270617][T15212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 558.270633][T15212] Call Trace: [ 558.270642][T15212] [ 558.270653][T15212] dump_stack_lvl+0x189/0x250 [ 558.270692][T15212] ? __pfx_dump_stack_lvl+0x10/0x10 [ 558.270721][T15212] ? __pfx__printk+0x10/0x10 [ 558.270752][T15212] ? find_vma+0xe7/0x160 [ 558.270799][T15212] __get_user_pages+0x2470/0x2a00 [ 558.270866][T15212] ? __pfx___bpf_trace_mmap_lock_acquire_returned+0x10/0x10 [ 558.270931][T15212] ? rcu_is_watching+0x15/0xb0 [ 558.270967][T15212] __gup_longterm_locked+0xde4/0x1660 [ 558.271003][T15212] ? try_grab_folio_fast+0x1bf/0x6a0 [ 558.271046][T15212] ? gup_fast_fallback+0x1b86/0x22d0 [ 558.271077][T15212] gup_fast_fallback+0x1d65/0x22d0 [ 558.271152][T15212] ? __pfx_gup_fast_fallback+0x10/0x10 [ 558.271174][T15212] ? __mutex_lock+0x335/0x1350 [ 558.271218][T15212] ? is_valid_gup_args+0x11f/0x200 [ 558.271247][T15212] ? get_user_pages_fast+0x4d/0xb0 [ 558.271276][T15212] __iov_iter_get_pages_alloc+0x39f/0xb40 [ 558.271321][T15212] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 558.271346][T15212] ? wait_for_space+0x248/0x2d0 [ 558.271370][T15212] iov_iter_get_pages2+0x5e/0xa0 [ 558.271409][T15212] __se_sys_vmsplice+0x548/0x10d0 [ 558.271458][T15212] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 558.271488][T15212] ? __pfx_futex_wake+0x10/0x10 [ 558.271518][T15212] ? restore_signal_shadow_stack+0x3b7/0x480 [ 558.271554][T15212] ? __ia32_sys_rt_sigreturn+0x743/0x860 [ 558.271651][T15212] ? do_syscall_64+0xbe/0xf80 [ 558.271687][T15212] do_syscall_64+0xfa/0xf80 [ 558.271720][T15212] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.271742][T15212] ? clear_bhb_loop+0x60/0xb0 [ 558.271771][T15212] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.271794][T15212] RIP: 0033:0x7fceab58f749 [ 558.271814][T15212] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 558.271835][T15212] RSP: 002b:00007fceac441038 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 558.271861][T15212] RAX: ffffffffffffffda RBX: 00007fceab7e5fa0 RCX: 00007fceab58f749 [ 558.271879][T15212] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 558.271899][T15212] RBP: 00007fceab613f91 R08: 0000000000000000 R09: 0000000000000000 [ 558.271914][T15212] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 558.271927][T15212] R13: 00007fceab7e6038 R14: 00007fceab7e5fa0 R15: 00007fff6fe4e198 [ 558.271970][T15212] [ 558.988814][T15243] macvtap2: entered allmulticast mode [ 559.008752][T15243] mac80211_hwsim hwsim7 wlan0: entered allmulticast mode [ 559.039961][T15243] mac80211_hwsim hwsim7 wlan0: left allmulticast mode [ 559.116190][T15221] lo speed is unknown, defaulting to 1000 [ 559.392324][T15255] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2375'. [ 559.616206][T15267] No such timeout policy "syz0" [ 560.429067][T15284] lo speed is unknown, defaulting to 1000 [ 560.783832][T15316] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 560.962090][T15323] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 561.054042][T15297] lo speed is unknown, defaulting to 1000 [ 561.091656][T15326] tipc: Enabling of bearer rejected, failed to enable media [ 561.469088][T15340] tipc: Enabled bearer , priority 10 [ 561.495766][T15342] bridge5: entered allmulticast mode [ 561.541860][T15337] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2399'. [ 561.662580][T15350] tc_dump_action: action bad kind [ 562.266897][T15361] netlink: 'syz.4.2404': attribute type 1 has an invalid length. [ 562.445396][T15369] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2407'. [ 562.468487][T15369] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2407'. [ 562.642033][T15377] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2408'. [ 562.750604][T15378] bond6 (unregistering): Released all slaves [ 563.043832][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 563.053446][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.533191][T15410] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2417'. [ 563.552721][T15410] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2417'. [ 563.564703][T15380] lo speed is unknown, defaulting to 1000 [ 563.571830][T15410] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2417'. [ 563.625742][T15410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2417'. [ 563.690587][T15410] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 564.028434][T15413] lo speed is unknown, defaulting to 1000 [ 564.211339][T15431] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 564.904717][T15456] veth10: entered allmulticast mode [ 564.969018][T15466] netlink: 'syz.4.2432': attribute type 4 has an invalid length. [ 564.977437][T15467] netlink: 'syz.4.2432': attribute type 4 has an invalid length. [ 565.633826][T15494] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2439'. [ 565.647595][T15494] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2439'. [ 565.954242][T15503] tipc: Enabled bearer , priority 0 [ 565.988784][T15503] syzkaller0: entered promiscuous mode [ 566.005966][T15503] syzkaller0: entered allmulticast mode [ 566.051986][T15509] netlink: 'syz.4.2445': attribute type 39 has an invalid length. [ 566.065749][T15503] tipc: Resetting bearer [ 566.088900][T15501] tipc: Resetting bearer [ 566.106262][T15501] tipc: Disabling bearer [ 566.186223][T15512] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2446'. [ 566.380290][T15524] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2449'. [ 566.407212][T15524] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2449'. [ 566.422318][T15512] bond0 (unregistering): left promiscuous mode [ 566.429918][T15512] bond_slave_0: left promiscuous mode [ 566.435804][T15512] bond_slave_1: left promiscuous mode [ 566.443089][T15512] team0: left promiscuous mode [ 566.448703][T15512] team_slave_0: left promiscuous mode [ 566.454485][T15512] team_slave_1: left promiscuous mode [ 566.460750][T15512] bond1: left promiscuous mode [ 566.465778][T15528] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2451'. [ 566.475246][T15512] geneve0: left promiscuous mode [ 566.481038][T15528] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2451'. [ 566.490844][T15512] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 566.502808][T15512] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 566.513818][T15512] bond0 (unregistering): (slave team0): Releasing backup interface [ 566.526029][T15512] bond0 (unregistering): Released all slaves [ 566.572587][T15515] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 566.772764][T15544] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2453'. [ 566.890625][T15550] Cannot find set identified by id 65534 to match [ 566.946481][T15556] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2459'. [ 567.116645][T15551] 8021q: adding VLAN 0 to HW filter on device team0 [ 567.196773][T15574] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2462'. [ 567.281168][T15551] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 567.329360][T15574] bridge_slave_1: left allmulticast mode [ 567.335079][T15574] bridge_slave_1: left promiscuous mode [ 567.343694][T15574] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.370988][T15574] bridge_slave_0: left allmulticast mode [ 567.376693][T15574] bridge_slave_0: left promiscuous mode [ 567.389818][T15574] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.530254][T15545] lo speed is unknown, defaulting to 1000 [ 567.559040][ T5956] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 567.712089][T15592] bond7: option resend_igmp: invalid value (2878) [ 567.719190][T15592] bond7: option resend_igmp: allowed values 0 - 255 [ 567.729866][T15592] bond7 (unregistering): Released all slaves [ 568.143451][T15619] netlink: 'syz.2.2473': attribute type 5 has an invalid length. [ 568.189574][T15623] 8021q: VLANs not supported on ip6_vti0 [ 568.398105][ T6328] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 568.406058][ T6328] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 568.524066][T15639] tipc: Enabled bearer , priority 0 [ 568.570877][T15639] syzkaller0: entered promiscuous mode [ 568.576400][T15639] syzkaller0: entered allmulticast mode [ 568.643465][T15639] tipc: Resetting bearer [ 568.688278][T15638] tipc: Resetting bearer [ 568.745410][T15638] tipc: Disabling bearer [ 569.013069][T15667] netlink: 'syz.1.2492': attribute type 13 has an invalid length. [ 569.021437][T15667] netlink: 'syz.1.2492': attribute type 17 has an invalid length. [ 569.084308][T15667] dummy0: left promiscuous mode [ 569.094555][T15667] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 569.111836][ T5912] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 569.308973][ T8662] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 569.325463][ T8662] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 569.708499][ T5940] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 569.770748][ T5912] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 569.876958][T15711] tipc: Failed to remove unknown binding: 66,1,1/3500103894:389539151/389539153 [ 569.909384][T15711] tipc: Failed to remove unknown binding: 66,1,1/3500103894:389539151/389539153 [ 570.033985][T15717] tipc: Failed to remove unknown binding: 66,1,1/3500103894:389539151/389539153 [ 570.056024][T15717] tipc: Failed to remove unknown binding: 66,1,1/3500103894:389539151/389539153 [ 570.454596][T15749] netlink: 'syz.2.2511': attribute type 3 has an invalid length. [ 570.491860][T15749] bridge8: entered allmulticast mode [ 570.532573][T15749] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 570.568387][T15754] netlink: 'syz.1.2514': attribute type 5 has an invalid length. [ 570.578077][T15747] bridge8: left allmulticast mode [ 570.670701][T15764] __nla_validate_parse: 13 callbacks suppressed [ 570.670722][T15764] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2513'. [ 570.731127][T15763] tipc: Enabled bearer , priority 0 [ 570.736214][T15768] netlink: 'syz.1.2518': attribute type 1 has an invalid length. [ 570.841243][T15768] bond0: entered promiscuous mode [ 570.846723][T15768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 570.869972][T15763] syzkaller0: entered promiscuous mode [ 570.875470][T15763] syzkaller0: entered allmulticast mode [ 570.883039][T15778] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2518'. [ 570.893509][T15774] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 570.915878][T15763] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 570.928634][T15778] bond0: entered allmulticast mode [ 570.974314][T15762] tipc: Resetting bearer [ 570.992998][T15768] xt_l2tp: v2 sid > 0xffff: 16776960 [ 571.007131][T15762] tipc: Disabling bearer [ 571.020462][T15776] tipc: Enabled bearer , priority 0 [ 571.029691][T15779] syzkaller0: entered promiscuous mode [ 571.037252][T15779] syzkaller0: entered allmulticast mode [ 571.057444][T15768] bond0: (slave bridge6): making interface the new active one [ 571.066067][T15768] bridge6: entered promiscuous mode [ 571.071779][T15768] bridge6: entered allmulticast mode [ 571.080925][T15768] bond0: (slave bridge6): Enslaving as an active interface with an up link [ 571.104276][T15781] pimreg: tun_chr_ioctl cmd 1074025680 [ 571.120186][T15776] tipc: Resetting bearer [ 571.126540][T15781] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2521'. [ 571.145136][T15775] tipc: Resetting bearer [ 571.174955][T15775] tipc: Disabling bearer [ 571.215753][T15786] netlink: 'syz.3.2523': attribute type 1 has an invalid length. [ 571.286414][T15786] 8021q: adding VLAN 0 to HW filter on device bond6 [ 571.351894][T15787] vlan3: entered promiscuous mode [ 571.356990][T15787] bond6: entered promiscuous mode [ 571.376932][T15787] vlan3: entered allmulticast mode [ 571.382787][T15787] bond6: entered allmulticast mode [ 571.516812][T15803] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2529'. [ 571.563061][T15806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2530'. [ 571.588670][T15805] bond7: ARP target 9.0.0.0 is already present [ 571.595549][T15805] bond7: option arp_ip_target: invalid value (9) [ 571.605822][T15809] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2528'. [ 571.643935][T15805] bond7 (unregistering): Released all slaves [ 571.672446][T15812] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2530'. [ 571.809251][T15818] netlink: 'syz.1.2533': attribute type 1 has an invalid length. [ 571.830186][T15818] netlink: 'syz.1.2533': attribute type 27 has an invalid length. [ 571.878443][T15820] netlink: 'syz.3.2534': attribute type 3 has an invalid length. [ 571.893854][T15824] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 571.909805][T15820] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2534'. [ 571.961418][T15829] netlink: 119 bytes leftover after parsing attributes in process `syz.2.2536'. [ 571.979751][T15828] netlink: 119 bytes leftover after parsing attributes in process `syz.2.2536'. [ 572.264217][T15837] 8021q: adding VLAN 0 to HW filter on device bond7 [ 572.409935][T15837] erspan0: entered allmulticast mode [ 572.776474][T15878] tipc: Enabled bearer , priority 0 [ 572.784088][T15878] syzkaller0: entered promiscuous mode [ 572.789948][T15878] syzkaller0: entered allmulticast mode [ 572.826672][T15878] tipc: Resetting bearer [ 572.836261][T15876] tipc: Resetting bearer [ 572.860760][T15876] tipc: Disabling bearer [ 573.358081][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 574.710744][T15903] syzkaller1: entered promiscuous mode [ 574.721228][T15903] syzkaller1: entered allmulticast mode [ 575.024239][T15928] bond8: option tlb_dynamic_lb: invalid value (5) [ 575.040694][T15928] bond8 (unregistering): Released all slaves [ 575.074888][T15893] lo speed is unknown, defaulting to 1000 [ 575.118683][T15929] tap0: tun_chr_ioctl cmd 1074812118 [ 575.237001][T15939] --map-set only usable from mangle table [ 575.317980][T15936] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 575.602924][T15908] lo speed is unknown, defaulting to 1000 [ 575.648209][T15935] lo speed is unknown, defaulting to 1000 [ 576.177557][T15963] syzkaller0: entered promiscuous mode [ 576.187870][T15963] syzkaller0: entered allmulticast mode [ 576.302965][T15966] __nla_validate_parse: 5 callbacks suppressed [ 576.302987][T15966] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2573'. [ 576.352430][T15966] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 576.370425][T15971] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2574'. [ 576.391408][T15971] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 576.438976][T15972] validate_nla: 3 callbacks suppressed [ 576.438995][T15972] netlink: 'syz.1.2574': attribute type 29 has an invalid length. [ 576.453017][T15971] netlink: 'syz.1.2574': attribute type 29 has an invalid length. [ 576.466230][T15972] netlink: 500 bytes leftover after parsing attributes in process `syz.1.2574'. [ 576.478294][T15973] netlink: 500 bytes leftover after parsing attributes in process `syz.1.2574'. [ 576.652443][T15980] xt_CT: You must specify a L4 protocol and not use inversions on it [ 577.025211][T16001] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2582'. [ 577.062112][T16002] IPVS: set_ctl: invalid protocol: 58 100.1.1.1:20002 [ 577.115254][T15978] lo speed is unknown, defaulting to 1000 [ 577.197552][T16009] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2585'. [ 577.452269][T16017] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2587'. [ 577.490526][T16023] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2586'. [ 577.709928][T15977] lo speed is unknown, defaulting to 1000 [ 577.833305][T16015] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 578.004037][T16044] netlink: 'syz.2.2594': attribute type 1 has an invalid length. [ 578.087036][T16048] sock: sock_timestamping_bind_phc: sock not bind to device [ 578.202280][T16044] bond11: entered promiscuous mode [ 578.208191][T16055] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2596'. [ 578.219530][T16044] 8021q: adding VLAN 0 to HW filter on device bond11 [ 578.252779][T16055] 8021q: adding VLAN 0 to HW filter on device bond7 [ 578.496221][T16055] bond7 (unregistering): Released all slaves [ 579.150290][T16059] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 579.368227][T16084] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2603'. [ 579.622543][T16095] netlink: 'syz.2.2606': attribute type 1 has an invalid length. [ 579.646188][T16060] lo speed is unknown, defaulting to 1000 [ 579.801528][T16098] bond12: (slave gretap2): making interface the new active one [ 579.841024][T16098] bond12: (slave gretap2): Enslaving as an active interface with an up link [ 579.929786][ T5838] bond0: (slave syz_tun): Releasing backup interface [ 580.075512][ T5847] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 580.090122][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 580.103234][ T5847] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 580.111749][ T5847] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 580.119546][T16113] nbd: socks must be embedded in a SOCK_ITEM attr [ 580.119657][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 580.400508][ T5154] Bluetooth: hci4: command 0x0405 tx timeout [ 580.879953][ T8661] vlan2: left promiscuous mode [ 580.885115][ T8661] bridge_slave_0: left promiscuous mode [ 580.919112][ T8661] bridge0: port 1(vlan2) entered disabled state [ 581.115706][ T8661] batman_adv: batadv0: Removing interface: ip6gretap1 [ 581.161412][T16150] netlink: 'syz.4.2618': attribute type 7 has an invalid length. [ 581.598010][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 581.941204][ T8661] batman_adv: batadv0: Removing interface: macvlan2 [ 581.952088][ T8661] bond0 (unregistering): Released all slaves [ 581.966982][ T8661] bond1 (unregistering): Released all slaves [ 582.103595][ T8661] bond2 (unregistering): Released all slaves [ 582.164297][ T5154] Bluetooth: hci0: command tx timeout [ 582.231916][ T8661] bond3 (unregistering): (slave veth5): Releasing active interface [ 582.241177][ T8661] bond3 (unregistering): Released all slaves [ 582.363188][ T8661] bond4 (unregistering): Released all slaves [ 582.498772][ T8661] bond5 (unregistering): Released all slaves [ 582.636152][ T8661] bond6 (unregistering): Released all slaves [ 582.755877][ T8661] bond7 (unregistering): Released all slaves [ 582.773670][T16108] lo speed is unknown, defaulting to 1000 [ 582.783226][T16150] __nla_validate_parse: 4 callbacks suppressed [ 582.783247][T16150] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2618'. [ 582.808836][T16150] netlink: 'syz.4.2618': attribute type 7 has an invalid length. [ 582.965273][ T8661] tipc: Left network mode [ 583.025137][ T8661] IPVS: stopping backup sync thread 13053 ... [ 583.047111][T16161] xt_CT: You must specify a L4 protocol and not use inversions on it [ 583.073885][T16164] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2624'. [ 583.121190][T16164] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2624'. [ 583.291954][T16161] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 583.316156][T16161] bridge0: entered allmulticast mode [ 583.385690][T16108] chnl_net:caif_netlink_parms(): no params data found [ 583.481044][T16178] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2628'. [ 583.502569][T16178] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 583.549440][T16178] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2628'. [ 583.699974][T16185] netlink: 'syz.0.2627': attribute type 12 has an invalid length. [ 584.238349][ T5154] Bluetooth: hci0: command tx timeout [ 584.341648][T16198] netlink: 'syz.0.2632': attribute type 1 has an invalid length. [ 584.593715][T16204] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2632'. [ 584.754008][T16108] bridge0: port 1(bridge_slave_0) entered blocking state [ 584.778051][T16108] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.800263][T16108] bridge_slave_0: entered allmulticast mode [ 584.815472][T16108] bridge_slave_0: entered promiscuous mode [ 584.833565][T16108] bridge0: port 2(bridge_slave_1) entered blocking state [ 584.854112][T16108] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.869636][T16108] bridge_slave_1: entered allmulticast mode [ 584.886179][T16108] bridge_slave_1: entered promiscuous mode [ 584.993985][T16221] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2637'. [ 585.058735][T16108] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 585.075109][T16222] veth0: entered promiscuous mode [ 585.107555][ T8661] mac80211_hwsim hwsim8 wlan1 (unregistering): left promiscuous mode [ 585.163981][T16108] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 585.197958][T16222] veth0: left promiscuous mode [ 585.310743][T16108] team0: Port device team_slave_0 added [ 585.340345][T16108] team0: Port device team_slave_1 added [ 585.482317][T16230] tipc: Enabled bearer , priority 0 [ 585.518611][T16108] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 585.525664][T16108] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 585.552831][T16108] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 585.564321][T16230] syzkaller0: entered promiscuous mode [ 585.570139][T16230] syzkaller0: entered allmulticast mode [ 585.578450][T16207] lo speed is unknown, defaulting to 1000 [ 585.598694][T16108] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 585.606113][T16108] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 585.684414][T16108] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 585.740519][T16230] tipc: Resetting bearer [ 585.815940][T16229] tipc: Resetting bearer [ 585.845030][T16229] tipc: Disabling bearer [ 585.899968][ T8661] hsr_slave_0: left promiscuous mode [ 585.920168][ T8661] hsr_slave_1: left promiscuous mode [ 585.927431][ T8661] veth1_to_hsr: left allmulticast mode [ 585.933103][ T8661] veth1_to_hsr: left promiscuous mode [ 586.011008][ T8661] ` (unregistering): Port device wireguard0 removed [ 586.318566][ T5154] Bluetooth: hci0: command tx timeout [ 586.701275][T16249] bridge_slave_0: default FDB implementation only supports local addresses [ 586.863249][T16108] hsr_slave_0: entered promiscuous mode [ 586.880555][T16108] hsr_slave_1: entered promiscuous mode [ 586.887065][T16108] debugfs: 'hsr0' already exists in 'hsr' [ 586.895902][T16108] Cannot create hsr debugfs directory [ 587.043048][T16255] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 587.205751][T16255] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 587.252694][T16265] netlink: 'syz.1.2649': attribute type 10 has an invalid length. [ 587.304103][T16265] veth0_vlan: left promiscuous mode [ 587.306156][T16267] netlink: 'syz.0.2650': attribute type 1 has an invalid length. [ 587.310591][T16268] netlink: 'syz.1.2649': attribute type 1 has an invalid length. [ 587.325337][T16267] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2650'. [ 587.337491][T16265] veth0_vlan: entered promiscuous mode [ 587.345488][T16265] team0: Device veth0_vlan failed to register rx_handler [ 587.364244][T16267] netlink: 'syz.0.2650': attribute type 29 has an invalid length. [ 587.386680][T16267] netlink: 'syz.0.2650': attribute type 29 has an invalid length. [ 587.447286][ T8661] IPVS: stop unused estimator thread 0... [ 587.895630][T16108] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 587.918501][T16108] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 587.944243][T16108] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 587.974574][T16108] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 588.043359][T16287] netlink: 'syz.0.2654': attribute type 32 has an invalid length. [ 588.063307][T16287] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2654'. [ 588.150850][T16287] bond7: option coupled_control: invalid value (12) [ 588.167162][T16287] bond7 (unregistering): Released all slaves [ 588.236661][T16279] lo speed is unknown, defaulting to 1000 [ 588.353216][T16108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 588.395341][T16108] 8021q: adding VLAN 0 to HW filter on device team0 [ 588.400039][ T5154] Bluetooth: hci0: command tx timeout [ 588.410132][ T8656] bridge0: port 1(bridge_slave_0) entered blocking state [ 588.417324][ T8656] bridge0: port 1(bridge_slave_0) entered forwarding state [ 588.495153][T16300] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2657'. [ 588.516341][ T8656] bridge0: port 2(bridge_slave_1) entered blocking state [ 588.523567][ T8656] bridge0: port 2(bridge_slave_1) entered forwarding state [ 588.581872][T16300] macvlan2: entered promiscuous mode [ 588.595139][T16300] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 588.627134][T16310] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2659'. [ 588.637276][T16310] block nbd0: reconnected socket [ 588.643446][ T5154] block nbd0: Receive control failed (result -32) [ 588.919442][T16318] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 588.952984][T16324] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2661'. [ 589.068587][T16331] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2663'. [ 589.242440][T16318] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 589.342390][T16318] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 589.452164][T16318] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 589.556487][T16108] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 589.680633][ T8658] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 589.755411][ T8659] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 589.824437][ T3439] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 589.871939][ T8659] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 589.889478][T16108] veth0_vlan: entered promiscuous mode [ 589.950417][T16108] veth1_vlan: entered promiscuous mode [ 590.030414][T16108] veth0_macvtap: entered promiscuous mode [ 590.051462][T16108] veth1_macvtap: entered promiscuous mode [ 590.088820][T16108] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 590.104966][T16366] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2670'. [ 590.105393][T16364] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2671'. [ 590.126836][T16366] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2670'. [ 590.128582][T16108] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 590.140790][T16367] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2670'. [ 590.167196][T16365] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2670'. [ 590.227103][ T3439] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.254229][ T3439] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.275571][ T3439] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.307169][ T3439] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.478459][ T8658] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.478534][ T5154] Bluetooth: hci0: command tx timeout [ 590.488286][ T8658] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.579824][T16389] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 590.645094][ T8658] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.655931][ T8658] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 591.260194][T16428] bridge7: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 591.466972][T16437] netlink: 'syz.4.2687': attribute type 1 has an invalid length. [ 591.770788][T16407] lo speed is unknown, defaulting to 1000 [ 592.035587][T16466] netlink: 'syz.2.2696': attribute type 23 has an invalid length. [ 592.194392][T16473] IPVS: set_ctl: invalid protocol: 59 172.20.20.170:20003 [ 592.291198][T16477] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 592.301726][T16480] netlink: 'syz.2.2700': attribute type 12 has an invalid length. [ 592.657223][T16486] netlink: 'syz.2.2701': attribute type 12 has an invalid length. [ 593.109210][T16506] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 593.113343][T16504] __nla_validate_parse: 11 callbacks suppressed [ 593.113366][T16504] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2707'. [ 593.182894][T16502] bridge1: entered allmulticast mode [ 593.656325][T16521] netlink: 55 bytes leftover after parsing attributes in process `syz.4.2709'. [ 593.697543][T16530] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2712'. [ 593.741254][T16532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 594.591217][T16569] xt_socket: unknown flags 0xfc [ 594.622631][T16571] pimreg3: entered allmulticast mode [ 594.709536][T16562] bond1: option arp_validate: invalid value (18446744073491447809) [ 594.730317][T16562] bond1 (unregistering): Released all slaves [ 594.757426][T16580] sock: sock_timestamping_bind_phc: sock not bind to device [ 594.788767][T16583] IPv6: Can't replace route, no match found [ 595.287283][T16610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2736'. [ 595.298368][T16611] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2736'. [ 595.311065][T16610] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2736'. [ 595.333185][T16610] geneve3: entered promiscuous mode [ 595.338943][T16610] geneve3: entered allmulticast mode [ 595.346632][ T6661] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.365912][ T6661] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.384092][ T6661] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.406292][ T6661] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.593394][T16620] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2737'. [ 596.018199][T16619] vlan2: left allmulticast mode [ 596.023144][T16619] bond3: left allmulticast mode [ 596.032507][T16619] gretap1: left allmulticast mode [ 596.054668][T16619] ip6gre1: left promiscuous mode [ 596.065805][T16619] ip6gre1: left allmulticast mode [ 596.115231][T16619] bond5: left promiscuous mode [ 596.126428][T16619] wireguard0: left promiscuous mode [ 596.155901][T16619] bridge5: left allmulticast mode [ 596.203658][T16619] geneve3: left promiscuous mode [ 596.217882][T16619] geneve3: left allmulticast mode [ 596.227318][T16588] lo speed is unknown, defaulting to 1000 [ 596.233551][ T6661] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 596.249876][ T6661] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.262790][ T6661] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 596.271613][ T6661] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.300221][ T6661] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 596.310903][ T6661] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.327162][ T6661] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 596.345998][ T6661] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.483652][T16650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2745'. [ 596.684697][T16659] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2748'. [ 596.784496][T16632] lo speed is unknown, defaulting to 1000 [ 597.165545][ T30] audit: type=1800 audit(1765212344.965:9): pid=16679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2750" name="x000000000000000600000000000000000000006" dev="tmpfs" ino=2853 res=0 errno=0 [ 597.219821][ T30] audit: type=1804 audit(1765212344.965:10): pid=16679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.2750" name="x000000000000000600000000000000000000006" dev="tmpfs" ino=2853 res=1 errno=0 [ 597.350362][T16651] lo speed is unknown, defaulting to 1000 [ 597.598385][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 597.812374][T16697] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 598.171664][T16704] warn_alloc: 1 callbacks suppressed [ 598.171684][T16704] syz.0.2756: vmalloc error: size 100663296, failed to allocated page array size 196608, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 598.263843][T16704] CPU: 0 UID: 0 PID: 16704 Comm: syz.0.2756 Not tainted syzkaller #0 PREEMPT(full) [ 598.263875][T16704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 598.263902][T16704] Call Trace: [ 598.263911][T16704] [ 598.263920][T16704] dump_stack_lvl+0x189/0x250 [ 598.263952][T16704] ? __pfx_dump_stack_lvl+0x10/0x10 [ 598.263975][T16704] ? __pfx__printk+0x10/0x10 [ 598.264005][T16704] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 598.264038][T16704] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 598.264073][T16704] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 598.264116][T16704] warn_alloc+0x214/0x310 [ 598.264151][T16704] ? __pfx_warn_alloc+0x10/0x10 [ 598.264190][T16704] ? __get_vm_area_node+0x28f/0x300 [ 598.264215][T16704] ? bpf_uprobe_multi_link_attach+0x54b/0xee0 [ 598.264246][T16704] __vmalloc_node_range_noprof+0x690/0x12d0 [ 598.264274][T16704] ? __alloc_frozen_pages_noprof+0x9f/0x370 [ 598.264332][T16704] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 598.264360][T16704] ? bpf_uprobe_multi_link_attach+0x54b/0xee0 [ 598.264389][T16704] ? rcu_is_watching+0x15/0xb0 [ 598.264414][T16704] ? bpf_uprobe_multi_link_attach+0x54b/0xee0 [ 598.264440][T16704] __kvmalloc_node_noprof+0x670/0x910 [ 598.264467][T16704] ? bpf_uprobe_multi_link_attach+0x54b/0xee0 [ 598.264491][T16704] ? __kmalloc_cache_noprof+0x3d5/0x6f0 [ 598.264515][T16704] ? bpf_uprobe_multi_link_attach+0x527/0xee0 [ 598.264546][T16704] bpf_uprobe_multi_link_attach+0x54b/0xee0 [ 598.264589][T16704] ? __pfx_bpf_uprobe_multi_link_attach+0x10/0x10 [ 598.264614][T16704] ? __fget_files+0x2a/0x420 [ 598.264636][T16704] ? __fget_files+0x2a/0x420 [ 598.264654][T16704] ? __fget_files+0x2a/0x420 [ 598.264677][T16704] ? bpf_prog_attach_check_attach_type+0x453/0x540 [ 598.264712][T16704] link_create+0x673/0x850 [ 598.264745][T16704] __sys_bpf+0x6be/0x860 [ 598.264772][T16704] ? __pfx___sys_bpf+0x10/0x10 [ 598.264818][T16704] ? rcu_is_watching+0x15/0xb0 [ 598.264851][T16704] __x64_sys_bpf+0x7c/0x90 [ 598.264874][T16704] do_syscall_64+0xfa/0xf80 [ 598.264902][T16704] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.264923][T16704] ? clear_bhb_loop+0x60/0xb0 [ 598.264948][T16704] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.264968][T16704] RIP: 0033:0x7f97e978f749 [ 598.264986][T16704] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 598.265004][T16704] RSP: 002b:00007f97e79f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 598.265026][T16704] RAX: ffffffffffffffda RBX: 00007f97e99e6090 RCX: 00007f97e978f749 [ 598.265041][T16704] RDX: 0000000000000040 RSI: 0000200000000180 RDI: 000000000000001c [ 598.265054][T16704] RBP: 00007f97e9813f91 R08: 0000000000000000 R09: 0000000000000000 [ 598.265067][T16704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 598.265086][T16704] R13: 00007f97e99e6128 R14: 00007f97e99e6090 R15: 00007fffc31143d8 [ 598.265121][T16704] [ 598.265129][T16704] Mem-Info: [ 598.511713][T16717] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2761'. [ 598.517080][T16704] active_anon:5380 inactive_anon:0 isolated_anon:0 [ 598.517080][T16704] active_file:3208 inactive_file:40041 isolated_file:0 [ 598.517080][T16704] unevictable:768 dirty:81 writeback:0 [ 598.517080][T16704] slab_reclaimable:12608 slab_unreclaimable:159113 [ 598.517080][T16704] mapped:29053 shmem:1427 pagetables:1042 [ 598.517080][T16704] sec_pagetables:0 bounce:0 [ 598.517080][T16704] kernel_misc_reclaimable:0 [ 598.517080][T16704] free:1260093 free_pcp:11456 free_cma:0 [ 598.535861][T16717] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2761'. [ 598.541449][T16704] Node 0 active_anon:21520kB inactive_anon:0kB active_file:12832kB inactive_file:159964kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116212kB dirty:320kB writeback:0kB shmem:4172kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12948kB pagetables:4036kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 598.668268][T16704] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 598.713147][T16704] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 598.744607][T16704] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 598.752028][T16704] Node 0 DMA32 free:1122840kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21520kB inactive_anon:0kB active_file:12832kB inactive_file:159964kB unevictable:1536kB writepending:320kB zspages:0kB present:3129332kB managed:2564516kB mlocked:0kB bounce:0kB free_pcp:35132kB local_pcp:20452kB free_cma:0kB [ 598.801882][T16704] lowmem_reserve[]: 0 0 0 0 0 [ 598.806686][T16704] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 598.840589][T16704] lowmem_reserve[]: 0 0 0 0 0 [ 598.845378][T16704] Node 1 Normal free:3902172kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:10760kB local_pcp:4964kB free_cma:0kB [ 598.880716][T16704] lowmem_reserve[]: 0 0 0 0 0 [ 598.892720][T16704] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 598.906258][T16704] Node 0 DMA32: 636*4kB (ME) 285*8kB (UME) 153*16kB (M) 200*32kB (UME) 103*64kB (UME) 98*128kB (UME) 99*256kB (UME) 33*512kB (UME) 11*1024kB (UME) 4*2048kB (UM) 251*4096kB (UM) = 1122600kB [ 598.926176][T16704] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 598.968110][T16704] Node 1 Normal: 157*4kB (UM) 59*8kB (UME) 43*16kB (UME) 169*32kB (UME) 41*64kB (UME) 7*128kB (UME) 5*256kB (UME) 4*512kB (UME) 1*1024kB (M) 2*2048kB (UE) 948*4096kB (M) = 3902172kB [ 599.025425][T16704] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 599.035848][T16704] Node 0 hugepages_total=3 hugepages_free=0 hugepages_surp=1 hugepages_size=2048kB [ 599.047064][T16704] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 599.057412][T16704] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 599.068136][T16704] 44654 total pagecache pages [ 599.072243][T16733] xt_policy: too many policy elements [ 599.073701][T16704] 0 pages in swap cache [ 599.106907][T16704] Free swap = 124996kB [ 599.111319][T16704] Total swap = 124996kB [ 599.148498][T16704] 2097051 pages RAM [ 599.152532][T16704] 0 pages HighMem/MovableOnly [ 599.157233][T16704] 424280 pages reserved [ 599.217892][T16704] 0 pages cma reserved [ 599.283427][T16750] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2770'. [ 599.380184][T16759] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2770'. [ 599.605615][ T3439] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 599.630502][ T3439] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.655648][ T3439] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 599.675255][ T3439] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.699995][ T3439] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 599.710812][ T3439] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.739328][ T3439] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 599.753553][T16770] openvswitch: netlink: nsh attr 60 is out of range max 3 [ 599.759784][ T3439] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.782230][T16770] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 599.924701][T16783] netlink: 124 bytes leftover after parsing attributes in process `syz.0.2777'. [ 599.973937][T16783] nbd: nbd0 already in use [ 599.985956][T16790] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2778'. [ 599.999044][T16784] nbd: nbd0 already in use [ 600.026274][T16790] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2778'. [ 600.185130][T16798] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2780'. [ 600.231768][T16798] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2780'. [ 600.265366][T16798] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2780'. [ 600.284706][T16806] netlink: 'syz.4.2780': attribute type 5 has an invalid length. [ 600.314618][T16798] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 601.050672][T16844] openvswitch: netlink: nsh attr 60 is out of range max 3 [ 601.060624][T16844] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 602.308703][T16839] lo speed is unknown, defaulting to 1000 [ 602.440091][T16884] syzkaller1: entered promiscuous mode [ 602.445620][T16884] syzkaller1: entered allmulticast mode [ 602.702800][T16892] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 602.862856][T16906] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 602.883908][ T5154] block nbd2: Receive control failed (result -1) [ 603.116731][T16922] netlink: 'syz.0.2810': attribute type 13 has an invalid length. [ 603.565843][T16945] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 603.573485][T16934] syzkaller0: entered promiscuous mode [ 603.607895][T16934] syzkaller0: entered allmulticast mode [ 603.670311][T16953] __nla_validate_parse: 9 callbacks suppressed [ 603.670331][T16953] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2815'. [ 604.071848][T16944] lo speed is unknown, defaulting to 1000 [ 604.111847][T16959] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 604.503773][T16973] netlink: 'syz.4.2821': attribute type 2 has an invalid length. [ 604.566321][T16973] netlink: 'syz.4.2821': attribute type 15 has an invalid length. [ 604.857447][T16989] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2816'. [ 605.079085][T16994] netlink: 'syz.3.2828': attribute type 58 has an invalid length. [ 605.103307][T16994] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2828'. [ 605.353343][T17006] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2831'. [ 605.473131][T17013] ------------[ cut here ]------------ [ 605.479194][T17013] refcount_t: addition on 0; use-after-free. [ 605.485233][T17013] WARNING: lib/refcount.c:25 at 0x0, CPU#0: syz.0.2834/17013 [ 605.492882][T17013] Modules linked in: [ 605.497115][T17013] CPU: 0 UID: 0 PID: 17013 Comm: syz.0.2834 Not tainted syzkaller #0 PREEMPT(full) [ 605.506659][T17013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 605.516848][T17013] RIP: 0010:refcount_warn_saturate+0x9f/0x110 [ 605.523140][T17013] Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 eb d2 36 fd 48 8d 3d 74 26 00 0b 67 48 0f b9 3a eb 4a e8 d8 d2 36 fd 48 8d 3d 71 26 00 0b <67> 48 0f b9 3a eb 37 e8 c5 d2 36 fd 48 8d 3d 6e 26 00 0b 67 48 0f [ 605.543403][T17013] RSP: 0018:ffffc900030b7d28 EFLAGS: 00010293 [ 605.551341][T17013] RAX: ffffffff848a7788 RBX: 0000000000000002 RCX: ffff888076de0000 [ 605.560072][T17013] RDX: 0000000000000000 RSI: ffffffff8e67b660 RDI: ffffffff8f8a9e00 [ 605.568670][T17013] RBP: ffffc900030b7e38 R08: ffff888076de0000 R09: 0000000000000005 [ 605.576685][T17013] R10: 0000000000000004 R11: 0000000000000000 R12: 1ffff11003970a05 [ 605.585921][T17013] R13: 1ffff92000616fb0 R14: ffff888075ca2ec8 R15: dffffc0000000000 [ 605.594372][T17013] FS: 00007f97ea5596c0(0000) GS:ffff8881260b1000(0000) knlGS:0000000000000000 [ 605.603726][T17013] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.610799][T17013] CR2: 00007f97e79d4f98 CR3: 0000000076690000 CR4: 00000000003526f0 [ 605.619098][T17013] Call Trace: [ 605.622415][T17013] [ 605.625371][T17013] ax25_setsockopt+0xabb/0xc20 [ 605.630269][T17013] ? __pfx_ax25_setsockopt+0x10/0x10 [ 605.635606][T17013] ? aa_sock_opt_perm+0xff/0x1a0 [ 605.640653][T17013] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 605.646250][T17013] ? __pfx_ax25_setsockopt+0x10/0x10 [ 605.651637][T17013] do_sock_setsockopt+0x17c/0x1b0 [ 605.656741][T17013] __x64_sys_setsockopt+0x13f/0x1b0 [ 605.662157][T17013] do_syscall_64+0xfa/0xf80 [ 605.666707][T17013] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.672901][T17013] ? clear_bhb_loop+0x60/0xb0 [ 605.677622][T17013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.683649][T17013] RIP: 0033:0x7f97e978f749 [ 605.688229][T17013] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 605.707920][T17013] RSP: 002b:00007f97ea559038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 605.716348][T17013] RAX: ffffffffffffffda RBX: 00007f97e99e5fa0 RCX: 00007f97e978f749 [ 605.724391][T17013] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000008 [ 605.732653][T17013] RBP: 00007f97e9813f91 R08: 0000000000000010 R09: 0000000000000000 [ 605.740830][T17013] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 605.748941][T17013] R13: 00007f97e99e6038 R14: 00007f97e99e5fa0 R15: 00007fffc31143d8 [ 605.756985][T17013] [ 605.760131][T17013] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 605.767427][T17013] CPU: 0 UID: 0 PID: 17013 Comm: syz.0.2834 Not tainted syzkaller #0 PREEMPT(full) [ 605.776799][T17013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 605.786893][T17013] Call Trace: [ 605.790181][T17013] [ 605.793131][T17013] dump_stack_lvl+0x99/0x250 [ 605.797738][T17013] ? __asan_memcpy+0x40/0x70 [ 605.802350][T17013] ? __pfx_dump_stack_lvl+0x10/0x10 [ 605.807575][T17013] ? __pfx__printk+0x10/0x10 [ 605.812186][T17013] vpanic+0x237/0x6d0 [ 605.816180][T17013] ? __pfx_vpanic+0x10/0x10 [ 605.820695][T17013] ? is_bpf_text_address+0x292/0x2b0 [ 605.825990][T17013] ? is_bpf_text_address+0x26/0x2b0 [ 605.831231][T17013] panic+0xb9/0xc0 [ 605.834964][T17013] ? __pfx_panic+0x10/0x10 [ 605.839404][T17013] __warn+0x317/0x4b0 [ 605.843405][T17013] __report_bug+0x288/0x500 [ 605.847929][T17013] ? __pfx___report_bug+0x10/0x10 [ 605.852957][T17013] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 605.858863][T17013] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 605.865332][T17013] ? stack_depot_save_flags+0x422/0x850 [ 605.870907][T17013] report_bug_entry+0x16a/0x220 [ 605.875771][T17013] ? refcount_warn_saturate+0x9f/0x110 [ 605.881243][T17013] ? refcount_warn_saturate+0xa4/0x110 [ 605.886717][T17013] handle_bug+0xca/0x200 [ 605.890975][T17013] exc_invalid_op+0x1a/0x50 [ 605.895491][T17013] asm_exc_invalid_op+0x1a/0x20 [ 605.900343][T17013] RIP: 0010:refcount_warn_saturate+0x9f/0x110 [ 605.906423][T17013] Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 eb d2 36 fd 48 8d 3d 74 26 00 0b 67 48 0f b9 3a eb 4a e8 d8 d2 36 fd 48 8d 3d 71 26 00 0b <67> 48 0f b9 3a eb 37 e8 c5 d2 36 fd 48 8d 3d 6e 26 00 0b 67 48 0f [ 605.927008][T17013] RSP: 0018:ffffc900030b7d28 EFLAGS: 00010293 [ 605.933366][T17013] RAX: ffffffff848a7788 RBX: 0000000000000002 RCX: ffff888076de0000 [ 605.941369][T17013] RDX: 0000000000000000 RSI: ffffffff8e67b660 RDI: ffffffff8f8a9e00 [ 605.949364][T17013] RBP: ffffc900030b7e38 R08: ffff888076de0000 R09: 0000000000000005 [ 605.957352][T17013] R10: 0000000000000004 R11: 0000000000000000 R12: 1ffff11003970a05 [ 605.965333][T17013] R13: 1ffff92000616fb0 R14: ffff888075ca2ec8 R15: dffffc0000000000 [ 605.973332][T17013] ? refcount_warn_saturate+0x98/0x110 [ 605.978836][T17013] ? refcount_warn_saturate+0x98/0x110 [ 605.984313][T17013] ax25_setsockopt+0xabb/0xc20 [ 605.989099][T17013] ? __pfx_ax25_setsockopt+0x10/0x10 [ 605.994492][T17013] ? aa_sock_opt_perm+0xff/0x1a0 [ 605.999439][T17013] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 606.004997][T17013] ? __pfx_ax25_setsockopt+0x10/0x10 [ 606.010296][T17013] do_sock_setsockopt+0x17c/0x1b0 [ 606.015340][T17013] __x64_sys_setsockopt+0x13f/0x1b0 [ 606.020559][T17013] do_syscall_64+0xfa/0xf80 [ 606.025080][T17013] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.031165][T17013] ? clear_bhb_loop+0x60/0xb0 [ 606.035857][T17013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.041767][T17013] RIP: 0033:0x7f97e978f749 [ 606.046196][T17013] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 606.065813][T17013] RSP: 002b:00007f97ea559038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 606.074326][T17013] RAX: ffffffffffffffda RBX: 00007f97e99e5fa0 RCX: 00007f97e978f749 [ 606.082305][T17013] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000008 [ 606.090283][T17013] RBP: 00007f97e9813f91 R08: 0000000000000010 R09: 0000000000000000 [ 606.098260][T17013] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 606.106252][T17013] R13: 00007f97e99e6038 R14: 00007f97e99e5fa0 R15: 00007fffc31143d8 [ 606.114245][T17013] [ 606.117554][T17013] Kernel Offset: disabled [ 606.121892][T17013] Rebooting in 86400 seconds..