last executing test programs: 41.473983423s ago: executing program 2 (id=8477): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[], 0x104}}, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000280)={0x1f, 0xfffe}, 0xe) listen(r1, 0x0) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newtaction={0x80, 0x30, 0xb, 0x70bd2d, 0x0, {}, [{0x6c, 0x1, [@m_ct={0x68, 0x1, 0x0, 0x0, {{0x7}, {0x40, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000003, 0x0, 0x8, 0x0, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @private0={0xfc, 0x0, '\x00', 0x1}}, @TCA_CT_NAT_PORT_MIN={0x6, 0xd, 0x4e24}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8890}, 0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) unshare(0x2a060400) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x1, 0x1, 0x107fff, 0x1, 0x4, 0x89, 0x0, 0xffb, 0x7, 0xb6b, 0x0, 0x4, 0x1, 0x3, 0x9, 0xff, 0x1000, 0xc, 0x3, 0x3, 0x80000001, 0xfffffffa, 0x0, 0x1, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x9, 0x3, 0x63c, 0xe, 0x6, 0x2, 0x6, 0x1bfa, 0xb, 0x40, 0x40bed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x3, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xa, 0x1fa0860a, 0x7, 0x100aa, 0x7f, 0x2, 0x180000, 0x4003, 0x8b, 0x5, 0x2af, 0x3, 0x5, 0x2, 0x1, 0x9, 0x4, 0x7, 0x1, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10000, 0x3f6, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x0, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x4, 0x20004, 0xc50, 0x2, 0xb, 0x2, 0xd9a, 0xc8, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x5, 0x1fc, 0x1ff, 0xffffffff]}}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newsa={0x148, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@multicast2, 0x1, 0x714, 0x4e23, 0x5, 0x2, 0x0, 0x0, 0x3a}, {@in=@broadcast, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x193, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x0, 0xfffffffc, 0xfff}, 0x70bd2a, 0x0, 0x2, 0x1, 0x0, 0x58}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @replay_val={0x10, 0xa, {0x70bd2a, 0x70bd29, 0xfffffffc}}]}, 0x148}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x34, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x2001}, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010029bd7000fcdbdf250300000008000100000000000c00060002"], 0x28}}, 0x40000) 40.633703028s ago: executing program 2 (id=8480): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000004d80)={'sit0\x00', &(0x7f0000004cc0)={'ip_vti0\x00', 0x0, 0x1, 0x10, 0xffff0001, 0xf, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x67, 0x0, 0x10, 0x29, 0x0, @multicast2, @broadcast}}}}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$inet6(0xa, 0x4, 0x26) ioctl$SIOCGSKNS(r1, 0x894c, &(0x7f0000000340)={'veth0_to_batadv\x00', 0x400}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000440)={0x3, 'vlan0\x00', {}, 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x8001000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdc04, {0x0, 0x0, 0x0, r11, {0xffff, 0xa4e61f2c188b8b6d}, {0xffff, 0xb}, {0xffef, 0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x849d, 0x55a}}}}]}, 0x44}}, 0x4890) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x38, 0x26, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r11, {0xb, 0x7}, {0x9, 0xa}, {0x0, 0xd}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x240080c1}, 0x404c0c0) ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) 38.967861583s ago: executing program 1 (id=8500): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r2 = socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000100000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014006a00b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0xf2a9a9ee94caf607, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r3, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x63, 0x0, &(0x7f0000000000)="ff", 0x0, 0x149d, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x60000002}]}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}, 0x1, 0x0, 0x0, 0x2400c000}, 0x0) 38.961191511s ago: executing program 2 (id=8501): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd364158a4591c559f76c0130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce74c4dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f00c484d339c480f70006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08ef74c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d3287a7b01ab84d336f3c0f45a0642d6f2c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d253e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd3153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be15579518540000bc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e99948a9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676080000007229e0237c1e34641848531712ff09e89fb062a3e66f4f3c9d7a7fc9aab1ced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a690bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b270a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b380380020000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async, rerun: 64) socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2d}, 0x90) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r2, r4, 0x25, 0x2, @void}, 0x10) (async) pselect6(0x40, &(0x7f0000000040)={0x2, 0xb, 0x11, 0x7fc0000000000003, 0x20000001, 0x1007, 0x7, 0x1}, 0x0, 0x0, 0x0, 0x0) (async) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120012000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 38.348666582s ago: executing program 1 (id=8510): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000b"], 0x50) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x2, 0x0, &(0x7f0000000000)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x2, 0x0, 0x3}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x22000042, 0x1, 0x2}, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r7, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0102}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40800}, 0x24000094) sendmsg$tipc(r2, &(0x7f00000006c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2002, 0x50000000}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4040041}, 0x200008c0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYRES32=r3, @ANYRES32=r9, @ANYBLOB="0000000000000000240012800b000100627269646765000014000280060027000000000005002d"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x0) r10 = socket(0x10, 0x803, 0x0) r11 = socket(0x29, 0x5, 0x0) ioctl$SIOCX25GFACILITIES(r11, 0x89e2, &(0x7f0000001540)) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0x9}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) socket$netlink(0x10, 0x3, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000001900)) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000008d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 38.000795256s ago: executing program 1 (id=8514): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x1000800800f3d, 0x7) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r5) sendmsg$NL802154_CMD_DEL_SEC_KEY(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000001800000008000300", @ANYRES32=r6, @ANYBLOB="100030800c000180080001000100000090592614b41ec034f5598983f7e3f5d46a3741dbccfbd62e1085957677dd4183a956eaaa4c5064b0eee26fb2645999a3269585c2fbd9f4a8e627d731e4c56126a3268d755e541180b3ed4b31fe5ac4b26a350787b4b4e2275416e3ca7e40539c4ca5641cfc264c97409338e46fc44d357d5ae9ed5b16f3b62e6ce28903c8efbf52d750cc2f95e7bafbc5"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) r8 = gettid() sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r3, &(0x7f0000000600)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0x64, r4, 0x221, 0x70bd27, 0x25dfdbfd, {}, [@NL802154_ATTR_NETNS_FD={0x8, 0x1d, r2}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r2}, @NL802154_ATTR_PID={0x8, 0x1c, r8}]}, 0x64}}, 0x90) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a80)={0x38, 0x41, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x47}, @nested={0x18, 0x1, 0x0, 0x1, [@nested={0x14, 0x10, 0x0, 0x1, [@typed={0x0, 0x46, 0x0, 0x0, @pid=r8}, @typed={0x8, 0x9d, 0x0, 0x0, @uid}]}]}, @typed={0x5c, 0x2, 0x0, 0x0, @pid}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 37.068883161s ago: executing program 2 (id=8521): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xb, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1800002b0000787d0510c6f1c21c90aedbeb28e000000000000000000000850000000e485d4a7692eebc1428e848f4f0ba0e7c781669ce20875632217b0b97b391d18e3d7753d2f5afa5c288f778cf7ee17018a54e6dc5127053c222c6c4f2fb031326a3ace036620a568a89a7da0645dd9be85d7c7f5a8dbf6ffdf49fe122c835cbaec1f623842a741383287ac385c603a32109c19f768cd4af46e80f0000000000000ecff0824dffd82b"], 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffdfffd}, 0x94) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x1, &(0x7f0000000b00)=ANY=[@ANYBLOB="4d47f4f7010018970b95bf202b146d299240dc282977c363680f90e0eb38a900"/46], &(0x7f0000000400)='syzkaller\x00', 0x7f, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000680)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000006c0)={0x3, 0xb, 0x5, 0x4aa}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000700)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff], &(0x7f0000000740)=[{0x1, 0x1, 0xf, 0x3}, {0x5, 0x3, 0xf, 0x6}, {0x2, 0x4, 0x2, 0x3}], 0x10, 0x7}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0x6, &(0x7f0000000000)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x5, 0xc8, &(0x7f0000000240)=""/200, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x20, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) unshare(0x22020600) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="180700001000001400000000000000000200000000000000e4c0b5"], 0x0, 0x2}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000c00)=ANY=[@ANYBLOB="2800000002030102000000000000000001000008090002000000000900000000080001000100001a9ce960c1562b066f00d0c1750ba888dbcb4f1e810fb13e7ee2c728d3adbb1cc98572e8fe48e9bef481e6cfe29e356f5ea6dbdfbbff6466df3520971bf4486e0e13e543684c36b5b918f51dad2b1db57c87572014babf7c6a531894f98fd583a2a38aa71832141e40752daac4b24ce6c1891693c9bfc1ac09e2000889d02b95a2142b589af022fb0aa4a1185135b11352276027a5c4346534efc7e3e809177d3b4e13740c53dea79c666892f9f28017c1c57f93226fdce7182759bb3026df667f51860c3489f07556e21ca575f57ed4db993b9499a2ff564e927aba9ebd382cc66319ebd0e38e8a3c558135323f09c48c1d01a1138e749d325fbd75dd26b738f38c7e8993eb20cbfb13c032e7bb9d5fa0399b9377ac7b40249d0710a6ad0e402b1a2ba5e807999a46eb20e2514f75e9cf20ea7207c5419b36344d26c7ab7957a6d3524eefe38f7daac34c5bcaf6637bc3f35c2fb868ec89a72b47cf9f5d04e4d05ca40445436bdc04062c1a3f5c79"], 0x28}, 0x1, 0x0, 0x0, 0x4000004}, 0x804) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r8], 0x1c}}, 0x840) unshare(0x2c020400) write$nci(r5, &(0x7f0000001180)=ANY=[@ANYBLOB="7105b80807068202074a0064ffa40901ea1e9cc9e9796b22dcdd93f6a4c0cc90edafb2c50ff1f68ffd899c5e55c8e38b0970986651a26b8f43b630e7e87f84c03ca69f099429604a0fdd3742957b67cd54d3ea4f4cd2e0f92cd9754aca9b512f5bb33e279c79afeb41b0812bd4095542b062a3abb85af10faa71d799fcaf539b0a9905f3b2155147b61b2fb67be23dc10fdf779b6f554d89b6a384453110d5d9a61848a2555b25d68b1682af457495fc650460ce525e8a363428fea908b79b5f87317898ddb1c13e209a02d64782d2306146244629cb891815657ca66fb92a6d1d33cf4ea128074feda48da8b0195230f4528df913c100d33a2629c30d8d452dd58f1cb4865eaa60db49a9108c6eb7f33e83efeb4198092ddde082a024cc9db6bb13a285cd23b0ce17a574364a0caae47a07860a905e02fb67a3fb8c0f7f1c742fa2dc1f60fd9f334ece8cf03dce2dea7dea3d8c125f97d768846fbd5bf2bd008ee8d19c3ab03ab9047899a3ad672632fdfa45480df0a93cbedca79200a7371908527030ba09989ee7797bdfc1f6bcea09407da7982dc4157b71f3a54fb05b12fa987d05505837352bc69a1ba732b626fcbb495ff4574439322507f38c50b60f9294fcd9a6fc2537f5698c2f1e410e88181c100300a6408b568ff3347745edd12a575bba7d6b90253c9fe02125ed478ed1a183fb4a888da66aeebceb1c60eceb661724a4e92deb61704739d8033bb2eb8f24c28f1e05ee6fa852eeb878263e2db15773784658b70614e748db70498e68fa00ed69b5017f988eb514b0f4e1bbcee378158dcc9b0203d1a3068df3bb6e1804c022938f25b2b7e6cf68b99b070eda70ce2df324559e0cdfab5e285b852ea71f2bb2ba15a5d21797976f3e6479f713e2b0c05439047fa7c55a3afc5ae332418aa0b9c2d32599db551861635e46b6f891a84912d0f978d3f3b3b48921b77db0e5e5e8c9d83052640ea11065b7f96111d93be3e6d9a34285e9b351dbfde29267713640b534970bd0a8cc0288de72dd18221d0fc31952eef7a685466f17b407fcb0a1f2cb10caf546c9c1e41232fbc7eea71943d9576f5f19bded9d0260b25d51f0c6e676037363208a6ff141909e9a391d08bd9f41df430e09ab28353a4b569f74d69d9d43cf70cc6b908eb8949bb7ac9bca4f8f911c5ec4ca4711af207072294ecc6f3d2afb67141b39e943a72174a9f13a858d018fe0f52852fa4d5e5fb96e8b2e827ced624c83f5f83ce9bac2b080dec674eabc0bceba4a0e5e721b69bb51b23bffe74bc0e74a7c765862e367c019c07259e8aae1089e328c3133e2ce355c7268d1e05762700f7cdeb70c98b681227912ea56dda845beccde2b5f0c1e83f0d783e001629145518334fc9bbae266fabecc36f24a23acc47f9b5ce6599fc4a8f0dd686a689a2b961f72c701952ea643244800200d63dc8b44e821c4aaf07938309ba8913ec4e12a5216c1efe6eca08c7329aa5889169e0f839e26b3562e0bbd46816a999efde0a07b271c80f7cf911b09d3f4ad6c4cb1b4a6dc2a884d1fc599181e63ba5cfa077b25b63378c645155b563a2edf8563d46a4fcd25786869b093aee0a92edfef47591b6680aba4d2d800c643349664363dbdcd836036e9a82b65815e5f039fd0bcc29b06dd41ea30f787ecb53fd18a524edb06ea8f5c2306fa503f72292fb8129ba4a64066a1010fc159b11174b18cb68bcb94aa86d7374a7197c84c2981ee4ce6a938c3f10e10cc73bdf5572aa55c9d8da034b676863c73a43a2058a88b0aab870b0b3593ed8fa2b295a269b05b1d1c244d4d9c22ace67df87f7476ac0fc11dc89484a6fafb008dd752dc7320924590a0de0ce57e332627a1d4237ef953258c9f7d8161b73479111fe56df7558224cd22ea9aa1e6fe1abd6e505ee4af6dcad1a291f81d09773820a7f9fc682d8208233eacbc18ceb95ab84e76a56409ea0742802509f273f1efb3da082582a47206f48142701cd0370f9f26f3eed2588430fc003938bc22d1cb9c1ffd95870aadb6fdb25d5945545bf269ccf2666915ef2d377e98afeb8ac4002ace9808c3f7a08dc501bb7e4d87338d6113d93980c3d0934199e8ca505d3c36e68dbd0731b896360c77cb1d25f9f43e766643e70a178c185aedfc8d64ac7941536c1349ba973c6876bc"], 0x611) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000001, 0x12, r9, 0x2000) r10 = socket$unix(0x1, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r9, 0x11b, 0x6, &(0x7f0000000600)=0x20080, 0x4) connect$unix(r10, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x4) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r11, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r11, 0x84, 0x80, &(0x7f00000002c0)="0000000000000002", 0x8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x65, &(0x7f0000000340)={@loopback, @multicast2}, &(0x7f0000000380)=0xc) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x6, 0x9}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000980)=@o_path={&(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x18, r3}, 0x18) 35.995265093s ago: executing program 2 (id=8529): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x806000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r2, 0xe6905000) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r1, &(0x7f0000000280)={0xa, 0x4e22, 0x8, @local, 0xc4ca}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x303}, "dce02de9d7bd466b", "72e64b3892060025848c9f40363cf916", "000400", "e2b768b4bb9e0d9b"}, 0x28) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r1, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000000)=0x2100e6d4, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x800452d3, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x2c, r5, 0x21, 0x72bd25, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4800) 35.917001951s ago: executing program 4 (id=8530): r0 = socket$alg(0x26, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) ioctl$FIOCLEX(0xffffffffffffffff, 0x5451) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000004000000000000000000008500000036000000850000000700000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r4, r3, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0x36, &(0x7f0000000600)=ANY=[], 0x0) r6 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412b", 0xf}, {&(0x7f0000000140)="ebe3", 0x2}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) socket$igmp(0x2, 0x3, 0x2) 35.568079169s ago: executing program 4 (id=8534): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010700000018000000006700000008003e"], 0x1c}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000100000079104800000000007b0a00ff000000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) unshare(0x2040400) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442e05d9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="12000000050000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYRES16=r3], 0x10) 35.506558319s ago: executing program 4 (id=8536): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f0000000300), 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c0001800500010003000000060004000a0a0000"], 0xbc}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r1, &(0x7f0000000600)={0x2, 0x6bb, @loopback}, 0x10) listen(r1, 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000700)={0x2, 0x3039, @loopback}, 0x10) connect$inet(r2, &(0x7f0000000800)={0x2, 0x6bb, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) write(r2, &(0x7f0000000900)="009c00011a2b3c4d00010000010000000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/157, 0x9d) socket(0x2000000015, 0x80005, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x14, 0x30, 0x9}, 0x14}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) socket(0x40000000015, 0x5, 0x0) r4 = socket(0x15, 0x5, 0x0) bind$inet(r4, 0x0, 0x0) getsockopt(r4, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, 0x0) write(r3, &(0x7f0000000a00)="009c00011a2b3c4d00020000010001000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/172, 0x9c) write(r2, &(0x7f0000000b00)="00a800011a2b3c4d00070000000100010000012c05f5e100000000030000000300400000000000000000000000000000000000000000000000000000000000000000001100"/168, 0xa8) write(r3, &(0x7f0000000c00)="002000011a2b3c4d0008", 0xa) 35.375013926s ago: executing program 0 (id=8538): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x30, 0x10, 0x605, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'dummy0\x00'}]}, 0x30}}, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000018000506000000000000000023000000fe00000100000000050001000400000008000400", @ANYRES32=r3], 0x2c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=@dellink={0x20, 0x11, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, r3}}, 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a41800000000001f03000000000000e5000300000000002604fdffff02000014010000033800001d130000000000007a0af8ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xf8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27}, 0x48) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000180), 0x4) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a090000000000000000000200000009000200737900640000000008000440000000000900010073797a30000000000800034000000001"], 0x64}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$tun(r8, &(0x7f0000000280)=ANY=[@ANYRESOCT=r6, @ANYRESDEC=0x0, @ANYRES8=r7, @ANYRES8, @ANYRESHEX=r4], 0x33) sendfile(r8, r7, 0x0, 0x10000) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)={0x44, r10, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x44}}, 0x20000800) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = getgid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001900)=[{{&(0x7f0000000f80)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f00000011c0)=[{&(0x7f0000001000)="d504b0e048fba24bf370c3323d8a6e13d986368ee3174791b895925caa2ffa00333619ad86150be45c5a8dba0329680f8e748141f4241be8f155774e25bb6c29a1fd87d33f7366900a7cc77f4182e27fd42279f5de", 0x55}, {&(0x7f00000010c0)="f4f5cde668756bdca46c44f343154aa3dce08e187fd7a9e3cd54dce7b7097a83c33f66187c832e4fb585dea51b527fc9559683fec695199ca6d8", 0x3a}, {&(0x7f0000001100)="bf941fc5a0875148f1d44e84b05b4dae401e3d7064673db8b7664013af51247f8e72b190ebd6899b7351a03b0affe93a37febf030b0cd7fbba9c9a0d49a5360fc929aa73073a74f99a1b9475cea316f49b3d265760c752d2257ea746f10699eb4cd27ab9bc251a9fbe1a89334afece37c1b7f35d9b5c5a455e71c9786ff018761e0e46fbdb73984de2f9f2647680006f09984ce0c963d8881d6e6f1c5461dcbe34e858bc8b082d24bd5711", 0xab}], 0x3, &(0x7f0000001200)=ANY=[@ANYRES32=r8, @ANYRES32=r4, @ANYBLOB="14000000000000000100000001000000", @ANYRES64=r11, @ANYRES32=r5, @ANYRES32=r0, @ANYRES32=r7, @ANYRES32=r11, @ANYRES32, @ANYRES32=r9, @ANYRES32=r4, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r6, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r12, @ANYBLOB='\x00Z\x00\x00'], 0xc0, 0xc001}}, {{0x0, 0x0, &(0x7f0000001880), 0x0, &(0x7f00000018c0)=[@rights={{0x18, 0x1, 0x1, [r9, r0]}}], 0x18, 0x44}}], 0x2, 0x40004) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYBLOB="0100000000000000000005000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(r13, 0xc010f508, 0x0) connect$bt_l2cap(r13, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r13, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) 35.335048998s ago: executing program 3 (id=8539): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r1, &(0x7f0000001b40)={&(0x7f0000000140)=@ieee802154={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0202}}}, 0x80, 0x0, 0x0, &(0x7f00000022c0)=ANY=[@ANYBLOB="10100000000000000d010000000000003b555bb8d0d436d5ea81762bb1fe8b6d68da7ea410044406715193065b5b00b6ce8aabe2669ee8a7a581b5fd12b700921003d456472a1055d5cc5cc16303622c496db81667c7e6421a0f13bcca97a6f3a814215579692e63aee6522382b0a4c7246bd188568280d6380800b9a84f43a24c6b590660e4830aac135ff6c8c5de27c27fd54cccc3381be7cf019edede5eb71a4a094395bf16c8bf684a96209ebcd3a778a3d6ac85d9f007745b00907aed50623fe2e5cf906695bb604ba693ec195b3593a738bbcbb252af7a39a34d57f723b4fab0ac070b3401dbd9b5d8e43e9c34407cc9cefb6e4d32b2a16290d7aed6b6f098db70b6cb53fb7b55d9e520a9a8a37f4bf3ef26f25f0ec010e0269156352ff0bc8f812263402c3e49772213c8906b4287b07ff1ba4c5cc4f84db4c18f5a6a9a87dc9db0acaf58740124f819d7765abc2536ab12d96ed7253e896c78322de199ade86a8b616df2cb9f0fff2e84405f9cd5fd29d4c3a3d0a6b332244e43190998a37a044fbac196fa2f5d2b7ecd969f872070ad78b4b5f405d0dd691dd269874794fe5cc5d966ca20d840ec7e5b9b1b4130ce2882d688924de2c02be8abd58624b11714fa68e96b3b1c5a7e2b5d78c9da2ac8a1c25001239915369a2396dc6f6922421f900c66cf84f4502556a8bd9d5e293b6ef36b80b1d98ad158934f25f1543424e5b19d1d33beb6ef70357e63f384f2b0ed0d6c68b9a372cba34b7cb2f5919ef1f1cbd0baaa7a6f772dd201ee4672b9f928829f4acec62db9a5b799e33f9c403997df34f1249cef3398496d984a3bf30712d155dc1571cfc02e7b22b501d34637aca7a9cb2df5712426d294856936f565b83ec137587342cbc0fdbaf2a83a1a790d2e18c914213aba8d7f4ffae7934386e1a338626718af2d70e37e60a6a35c76b8d7880a8ac16292406c80ffb2f500ab6523ab1c80d934950b83254f442f62864891b13a3679a00643dc8c73faf2f5396d977a3f21743bd503cd6fffc53433302986455aad36f90cff5f01bd9fee3f6f0fe3c8284e9e85922f04b55fd8e7676cd12e0a3440192320f2f64f22cc69f80bd16a8b8e25a71ab77fea23cfc53367d77f7d74022419ef185f9065d8e88938d7acbd7d226924b412c485ca24a24123660034b6a026a87b069de453ce23bc660e34062d66a3c6ff7f0a46202488e21763bede2551586a4ab4e0d723c5354cc6355d9e06b78b3ed698b57d07c37525c676871c7fee75a1ea64de888d253430ea9a6bc77a758e0d6fef7b1dd9ba956f6fe1368d5390d6683da7474859d91dccda08889146602fc94acf0b739a619960dd6b36c7909ee820e83481e1eaacc45587f5950b9e6cfa882759113951d26754d1640f87e5a5e1a8dd3b3a607e136229d1c8890533ed9b34e94a924827df72118b9fd0a109b68fefa8b69c8122da4f099eccd6477d810d063a53f7c9410299e2dd63eca9f0fb0899cf7f979c3950893bf66cd4420bcc5867b9234da65d75da686c436783cb7d925a6cb46879b179d49aed09442358e04bc0d12460255ab570b589a914a97b9204712a47dff5ca36ee005d8a1956d33db8012e58b032fab6036bb76b4e362f1feef926674db4a35b901b776bcdc2746982799fb89f127d400739e9b623f5887782b38c6a6801a5296b2269fe5bad630386af325d7456a1ed71a19ff903988ec596aaf8fee9112beba9317e826cbe06933abb73d649a31ba43943a481dd294f244d9dc089c12ae97f424ad3310bb3e45c5db931e8c6fbc31154cfaad17b7f06de53bee005ca6c7dbceaf636dbe400048fff21a0e2ed1521281e2b9511c7c83db6eea58079756b0417066652dc2821dd21258edf2a2dce95464fe83db40cc3817bdb3c2fe171eb2cefa4de1ecc1b4fea374ec064a0f5829cd26bcbea10d5ae1b63b1b54b5f49083f11355bd9586f4710521282e52d6bf8e5e2957e653673a28faaea757f50c1d5e60d7a8935dc0d8f59961f22b0c68df530aaf9746f468e8928829e89a6055c6611fd4b4e590e3f060cec3560d8dec2d34c5a0943462f33a773986125b6e9e8b22c39a3eea9636f285e054db329e6748bfc8fc931bfa4b79da9a0fe0236e86456120a1f571d5e164d98305bdbf05160296790c68ba4ac4fd78dece5efff91178f46921cc8690c6bdb5c71141a4f7feeeb55b1807bbabac7fd2d90ea0b5522c3d7c1e67da5212b1c6535373f16fe92b2c63d6c6bd7cb62630dc6bec902c91a8bace1f76f21b1c7b93fb01cb0c486c22a98cb9e002f7eef6d25057a26f7770022175decdb0a97c057532f2869eb0943298b0ad8f412bec502604319ece2017cc9a5496f1e8ceb3a787e6fe811a399ccf61e4ac176e7cc9d5fd90decf08cd718403e6e0444e67eb469e66a744370ad072bb61b81b3d5f86eb7ba99115d60a7b7d48d093a5b67cd5f8607e52c9a8f7d671ce36830a55a5af79a9f484dfe741a769b18e68cab419d8c662b062b1a9dbbd6fbe1971a44080d41549fc41be3e84659520652d3b330890059b2da149c174c74e8b87cb834bcc26ca4f9a1f31b0c19389019d6fee2fffd2679cd91674c5de19ec5df7bfb292227fe546b8a83d5ffa0c0bc9b4580b63e08d615476a2477fbeb8f154ebd36c71af22d46c01d03da91ca512fa855b594370b62ef71b5059bc7da641644407c17701b5e8995091eceea647eae2ea2103f46efe6e7df8168a7cc0d2f4a5eeb98585c40f7fdf9f94a2541850ab8230eefa094b4e8ec49115bac542dcc9bdd10dad02ef65362854a1b298fd0f70f6bc751dc8c2d68b6c80dac93438d12b0b9709fb9c09d400116b1cfa119e03f3c03f0e3b9da366887f4356870ae3aa86bcbc2df011b872c168faea5b4c0a3173c0cdfe3699d164c47618bf97bbbc6092c9e605c16f95fbda7cd4b3c395301352614f220a6dd20319503ffeea744f38dc38da9a030a1a3b5c3236e906a834646f4d8ea9a5346813e4ced9ce55fc65000ea232c0c0b5beb58ada3344f13778d021f5ce1daff30265d09a332321e2a10b83c8459d5314ef1d2601d029f10f0e99d3bd82abe21389c37c4bfcc4834cd7c1745ec9a0ee70ba952f3ae9e4b6b71e698db2c565bba0a23fa37ad15aa0fab04b0a383c10e1f1e84220df2c4385323554fe4f9c9ebe467ef4ea792adb40732d2f9821944bc649a5230c8f9e1f98e94bf56b8f9298e2ba5fa15bf71ffc3733ae5d65e87c466cb8677954194e026f448c77be6dad007c57fcff1138003f11562c7cfcd578e92b8620cce07e172e95a23739b9636d9bbc3e458e5c48cf9e5ccb7ba1e188f45977a01d5bad0dd51fd62c1bb8ea6aa1a54e1cd2e09e0ca4e882d255941288cf32ea36088d6dd10087fcea51fa3073df6e03c955b450a88b8d1675fec75bb9c141596c19ccb57aa974e3f3763a0d112833bd42e756b9ff1854ffcf28fae7db7d453e04937f1a34f43a248d58d38b38b6c514df0e1bf9a5dd216465601fbe798631d75ad3769ba54b1f03bdafd3358f83956452a817494c2f75fff2d886c932475e15c00c679e3b0b07c9e6cb18127252a8403538139104a6189c69bc30ab5a39281ea6c9df80fb9bc2404f8459efa6c7664fb7f6e64df52f08d7b21146358f7b4a036bcd332765d9c2c81e559d73a95a96b1fe6cac296148d052ce736245506d6937c61255afc765c9bfeacf7f6210973fe72b1695dae0645c1ac9d69265a68891b7069fa45998f6f0349d13c954e076f5cccb9adcf37690a843b95af4b4267990dda9c52031255c4f22468941389adbcbaf2b6f232ce57993e9333c4262d7bb2b4dd78e4398e0e81efd2423884876751279a628783de4035a26899d6775ce09777ac38488e62ceade58ed3592058c872624e9b0b400ded87cf1a4b9239b8b1ce6aa537fce19197620850e8cbc344bee3971af9378b38b0f9e5491b84f66dc234128faca674e7ae95cdfaac349e370bfe4d8b0d66d4a62463cbd008a9e921bc7b96837fa17c56a38a44b0d071f95c22e39908250b7bc52412a45f53dfdbf17e510d06711693bb770e1b9aec3eee1e7e9402397777e4cbfb39cfd6e483557ee5703f84ea47aaf28e2c3a09741950002b6f4f9b3f5b0dc69c81856511a10aeddd9a28bed888b4b1aa5364a8af3045821c235df1338217900c3b90a9de86ada2ce4537bbc870c3101f54fb004ec16ad147cf94820c82c404dd96af142c8460107a96f48822386494e7bf0348873cddb453c1d40d087e53171a9f14447a4915bd6cde0924ea6663eaa43bc6067dec664c3ceda3991ba39cd316e65efbdf97487a1812c4e051eadbda7c5242bbd6533881d9138103706b40d2b9c5db23fca81c379a2973fac277212957159fa5cd3c01e15a12c1c104f3353f4e038a71393c051ed2033f99cf9fee2b76a0b11010d407011b02546087aa26dd1d00d4b75ef7f392b0ff7f6ed66f869e871f3ec81b827dc1f5496bbef34e26fde31ca75c1ed87147b5cca50c6f72d16b63c9026bbfe8db9f9648b90e899b1ec83eb07f4cdfd3854c58b0a0bf178e7e8eeca8393da0d5a7b616cdb7e825251fca56e1019969751cd35a6340fe7c511b5474e1e08151c1d26880d763ae35f26fce9f6cfb98f7d37f454e609b715f0c90a9db0dc47dd98dd2c37927d1bf171d35ba84e2cffacba41adffff0cb1b7d5532aa5505b9a133641eb0cc3fac2667d5c81b0f1ebadb914db0181951c0ba4cffcd0f7f9e54af7d1d00e4aafd770f0503850eb02630ea3806f4b2b0c4b8f9bde685cca15653723cfc81c301691d39d15bd89f255ce9cc940741c9352e910006fc92d572ebfb80ebfd2eff90fd8a8dd4ab15ab0253ef477105a4393d8bcdeb606fa5ca8827cc78cd1734932b4fd5cb17ea38f67d0729554b9bd959f1a34f2a251c5796d7594a6c8acef103e15be91736fb5979c8bc7e1ec0f6538d265552a12fcf17aef790ea76b2ba764743aaff80598918b7d5f946f1225cafaf02a8963c36e9a31a210415aac93c559b68ab52cff3779d9de46cb6a3038630a108b0e39930da2d540e80e31dbc367662af9372d79d42591041051ae52694749947c1c7cf5ecc6ab0db136641186f0203daee5ec8389f16e8af94e3cef892da6cc3b321627568ee294a772daed79d5331a0545ed39c5aba9bb300523309847799d5c54a6f23ad3654f16817bf20cc891bdcb732026c47cf4b9b4e0ef8280734c82904f84d05f6d46dc0a1f9bc8372e6fe4cfe4cd1df96aef3cd129806b5d33607976be9a56b0516ae962e173a2a529cf55c4604d7d54cf97597ab11a8637e60a20360c9bf87bd9ae19906849aa13db849d7921445ef56cdfaca9eec084e24022b14e9b66ef22af47b81d76505dafefc45f8bbb71fd755b2e2caa050f47d4f88ae4b086b695d720589451ea95778ab3d476fbf9908be4fa4833510194d92d80ad0c6ef92ef29b996cdf122876ca7f8fcf471aa70fdc2ce9a091dd6ab5d1597b45064755fbed5c949f2f67311bd5ccb5553939473387faa22720c1971f952f17d52216b6fdb28cf050fa06da28597283544d982ecb245ecc94672ac43a90dd0e5a26c9c717e013a564feaeffd8c1529ecdfc6a013fd518a048594f18c31c3782597c305f70ab864634f4a2184d40236963870b4a4ba0043a53c0a80fbac416c1cd124ed470bd467216c60932cfca5917ef0a08eed9e6a9d689d35884df69f4577f5d4a47d75b5942155219717ba2083b82d7be9b5cd592a217282aa2db0a1b457ede948e6dc3c2eeb893c00010000000000001301000001f1"], 0x1230}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040), 0x4) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r3, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x50000000}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0xac}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x68}, 0x94) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f00000001c0)=ANY=[@ANYBLOB="12e001f001dd7a39d43e2405000000031d00ec8661f09c7727b2b0ecb3f957bcb3587d"], 0x1000f) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x15, 0x0, 0x0, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) 35.228226466s ago: executing program 3 (id=8540): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x3) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0x7c, 0x4, 0x8, 0x301, 0x0, 0x0, {0x5, 0x0, 0x8}, [@CTA_TIMEOUT_DATA={0x44, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED={0x8, 0x9, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_SCTP_SHUTDOWN_RECD={0x8, 0x6, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED={0x8, 0x9, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_SCTP_CLOSED={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_SCTP_ESTABLISHED={0x8, 0x4, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_SCTP_SHUTDOWN_SENT={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_SCTP_SHUTDOWN_SENT={0x8, 0x5, 0x1, 0x0, 0xa}, @CTA_TIMEOUT_SCTP_COOKIE_WAIT={0x8, 0x2, 0x1, 0x0, 0x3}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x22f0}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x9300}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x312}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r1) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r5, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r7, 0x2, 0x70bd27, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x24000004) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6], 0x4c}}, 0x884) 35.060821755s ago: executing program 3 (id=8541): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) listen(0xffffffffffffffff, 0x5) write$tun(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d23210000000000000000001000013"], 0x4a) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000380)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="68050240fa1a22748391c78159020300c9020302008607592b134000"], 0x13) close(r0) 35.014338232s ago: executing program 2 (id=8542): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0x9, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f0000000340)={&(0x7f0000000440)=@xdp={0x2c, 0xdd86, r4, 0x13}, 0x80, &(0x7f0000000740)=[{&(0x7f00000005c0)="691e243e3a6328ceb31c80645b76129e", 0x10}], 0x1}, 0x20008110) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x80d, 0x0, 0x10000000, 0x5, 0x4}, 0x1, r8}}]}, {0x0, 0xa}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x1}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4008001}, 0x0) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r5) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="997425bd7000fbdbdf25150000004c0001800d0001007549bc9aca1a590b9d"], 0x60}, 0x1, 0x0, 0x0, 0x24000884}, 0x2400c000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x3, &(0x7f0000000240)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r12, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_int(r12, 0x6, 0x20, &(0x7f0000000000)=0x39c4, 0x4) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x44, r9, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x2}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x44) r13 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x98, 0x98, 0xa, [@fwd={0x3}, @fwd={0xe}, @func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{0x2}, {0x6, 0x4}, {0x9, 0x1}, {0x8, 0x1}, {0x3, 0x4}, {0x10}, {0x9, 0x5}, {}]}, @restrict={0xa}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x3, 0xa}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x1, 0x8001}}]}, {0x0, [0x30, 0x5f, 0x5c, 0x0, 0x5f, 0xfc, 0x2e, 0x2e]}}, &(0x7f0000000340)=""/86, 0xba, 0x56, 0x0, 0x401}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000800)={r13, 0x20, &(0x7f00000007c0)={&(0x7f0000000600)=""/203, 0xcb, 0x0, &(0x7f0000000700)=""/155, 0x9b}}, 0x10) 34.949889908s ago: executing program 1 (id=8543): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x20) (async) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000003c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) accept(r1, &(0x7f0000000680)=@nfc, &(0x7f0000000700)=0x80) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454da, &(0x7f00000001c0)={'bond_slave_0\x00'}) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x80400, 0x0) ioctl$TUNSETIFF(r3, 0x400454da, &(0x7f00000002c0)={'bond0\x00', 0x4000}) (async) ioctl$TUNSETIFF(r3, 0x400454da, &(0x7f00000002c0)={'bond0\x00', 0x4000}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000280)=@framed={{}, [@jmp={0x5, 0x1, 0x4}]}, &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000007d00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'nicvf0\x00', 0x1432}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) r6 = socket$rxrpc(0x21, 0x2, 0x2) sendto$rxrpc(r6, 0x0, 0x0, 0x8000, 0x0, 0x0) (async) sendto$rxrpc(r6, 0x0, 0x0, 0x8000, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={0x0}}, 0x0) (async) sendmsg$nl_xfrm(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={0x0}}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x38, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}, [@nested={0x24, 0x11, 0x0, 0x1, [@generic="e796bd6dd42541affac6ff415af85ab494e09d498fc605baa5fe20e0f8a725f9", @generic]}]}, 0x38}, 0x1, 0x0, 0x0, 0x42804}, 0x84) (async) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x38, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}, [@nested={0x24, 0x11, 0x0, 0x1, [@generic="e796bd6dd42541affac6ff415af85ab494e09d498fc605baa5fe20e0f8a725f9", @generic]}]}, 0x38}, 0x1, 0x0, 0x0, 0x42804}, 0x84) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x3) 34.512905411s ago: executing program 4 (id=8544): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async) mmap(&(0x7f00001e5000/0x2000)=nil, 0x2000, 0x0, 0x2010, r0, 0x217eb000) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{}, &(0x7f0000000080), &(0x7f00000000c0)='%-5lx \x00'}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000fc0)={0x0, 0x0, {0x0, @struct}, {}, {0x0, @struct}}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) (async, rerun: 32) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) (async, rerun: 32) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000400100004112200a4e2000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000580), 0x2000cc0, r3}, 0x38) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x1, r3}, 0x38) (async, rerun: 64) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (rerun: 64) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) close(0x3) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x4001, 0x3, 0x300, 0x0, 0x0, 0x148, 0x138, 0x148, 0x268, 0x240, 0x240, 0x268, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0xd0, 0x138, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[0x4e24, 0x4e20], [0x4e21, 0x4e23], 0x4, 0x40, 0x4, 0x2}}, @common=@inet=@esp={{0x30}, {[0x4d3, 0x4d3], 0x1}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0xe, 0x3ff, 0x8, 0x6, 'pptp\x00', 'syz1\x00', {0x7}}}}, {{@ip={@local, @multicast1, 0xff000000, 0xffffff00, 'tunl0\x00', 'pimreg1\x00', {0xff}, {}, 0x89, 0x3, 0x60}, 0x0, 0xe8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@multiport={{0x50}, {0x1, 0x86, [0x4e24, 0x4e22, 0x4e24, 0x4e22, 0x4e22, 0x4e24, 0x4e21, 0x4a21, 0xe20, 0x4e22, 0x4e20, 0x4e23, 0x4e23, 0x4e24, 0x4e24], [0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1], 0x5}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0xc7e, 0x8, 0x7, '\x00', {0x20}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x360) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'veth0_macvtap\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000580)={'wlan1\x00'}) (async, rerun: 64) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r6) syz_genetlink_get_family_id$nbd(&(0x7f0000000100), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 34.471672561s ago: executing program 4 (id=8545): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x2090) r1 = socket$key(0xf, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001780)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x4, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x1, 0x1}]}]}, {0x0, [0x2e, 0x3e]}}, 0x0, 0x30, 0x0, 0x0, 0x4}, 0x28) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0xfffc, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={0x14, 0x56, 0x1, 0x0, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x0) unshare(0x24020400) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa000000}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r6}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x6, 0x21, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2239}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) getsockopt$XDP_STATISTICS(r3, 0x11b, 0x7, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x5}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2c, 0x0, 0xee01}, {0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x2, 0x7}, {0x0, 0xfffffffffffffffd, 0x400000000}, 0x0, 0x6e6bb9, 0x1, 0x0, 0x0, 0x3}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2f}, 0x8, 0x32}, 0x0, @in6=@mcast2, 0x0, 0x0, 0x0, 0xb7, 0xffffffff, 0xfffffffe, 0x3000}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x1, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x4f26c}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}, @IFLA_MASTER={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000441}, 0x48080) 34.45482864s ago: executing program 0 (id=8546): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0xa, 0x3, 0x87) r1 = socket$inet6(0xa, 0x80002, 0x0) sendmsg$sock(r1, &(0x7f0000000540)={&(0x7f0000000580)=@in6={0xa, 0x4e20, 0x81, @empty, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000000180)=[@mark={{0x14, 0x11, 0x51, 0x10a}}], 0x18}, 0x5000000) socket$packet(0x11, 0x2, 0x300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x8, 0x3032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) unshare(0x2c020400) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={@map=r5, 0x26, 0x0, 0xf51, &(0x7f0000001440)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001", @ANYRES16=r0, @ANYRES64=r3], 0xfdef) 34.169167317s ago: executing program 0 (id=8547): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000001c0), &(0x7f0000000200)=0x8) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@can_delroute={0x13, 0x19, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@CGW_MOD_SET={0x15, 0x4, {{{0x0, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "9094a9b270de6dc2"}}}]}, 0x2c}}, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x45, 0x0, 0x4}, {0x80, 0x3}, {0x0, 0xfd}, {0x4, 0x0, 0xfe, 0x10000002}, {0x0, 0x0, 0x0, 0xffffffff}, {0x10, 0x0, 0xf8}, {0x6, 0x80}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x6, 0xaf, 0x5}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x6, 'geneve0\x00', {}, 0x7e}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000180)={0x0, 'veth0_vlan\x00', {0x2}, 0x3}) 34.059617573s ago: executing program 0 (id=8548): r0 = socket(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x1, @empty, 0x65}, 0x1c) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000a00)={'syztnl2\x00', &(0x7f0000000380)={'syztnl1\x00', 0x0, 0x29, 0x81, 0xf, 0x200, 0x10, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @dev={0xfe, 0x80, '\x00', 0x42}, 0x7, 0x700, 0x6, 0x8}}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="180500000800850e0000000000000000850000007b00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x990c, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffc}, 0x50) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$XFS_IOC_FSGEOMETRY_V4(r2, 0x8070587c, &(0x7f0000000140)) 34.020848828s ago: executing program 3 (id=8549): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030428bd78000000000000000000", @ANYRES32=0x0, @ANYBLOB="4606090000000000140012800b0001006970766c616e0000040d028008000500996ac447a323e6dffaa2eded82293d50382fdf8eccf635523fa90c9ca13d5cb2b91dfecaa0716325b7c7520131014a0a6ad43104361e146e6dc7c29261d06ccddfcc083ca7a68d91bb911f2c9bebf0f345d4cfd6aa73f7146ebf6e1671cf460b86068399be454f9ac8b70c664217830c2fea4f70346c2695e86ba188c01706003783d135f94ce9d839ab152d5e1321f757e91672d88d610698e1e3f251ec1db86914d316d13862d6076e300f437b3ef44842145818924ae443e6", @ANYRES32=r6, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x400000000000235, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 33.776884444s ago: executing program 1 (id=8550): r0 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e22}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8000) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (rerun: 64) sendmsg$NL80211_CMD_TESTMODE(r1, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8afc01853e7d6b2b}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xf8, r2, 0x800, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TESTDATA={0xdc, 0x45, "b348eb39e058e1c1b3dea167d9eea6c6929aa9084b3f0fccf45f2349993a05eda628ee942ac541a91aaeb9c4116fc0a4583701ac1e6f86a4097a78fa7c6b2e7117bc1b39181c3d18c681084c7eb71a4074dd69fa144e2d3ab28314984152e59e7885248212c6c6ca42b71df7adf14cdc07d4ef3ee592f28ce0e2e89d2fe851f77a50015e6f58d1aa43b8ad1d1b3ad5e3ae2f631c01fd3dce049c8f564ca6599839ff39651bccef69d24faad2ade50eba5d42ad53dd501c4f64d04d488d314e5110f3d087162493514987a8f12ed5b2cb0b9ce78e532d2c2c"}]}, 0xf8}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETGEN(r3, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, 0x10, 0xa, 0x801, 0x0, 0x0, {0xa}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004801}, 0x20008000) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000480)=@gcm_256={{0x303}, "f7bb8c0af3f4fbb7", "fe0d6faaeaa9106a5f3ce46ba2757881c8b25b5b255c6a1c0546dfa390680a32", "b0f49b8d", "8d309330768be6b9"}, 0x38) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500), r1) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000006c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x130, r5, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfff}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x101}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xc8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffe}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x800}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x828}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}]}, @IPVS_CMD_ATTR_SERVICE={0x7c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x27}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@empty}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x20}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}]}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}]}]}, 0x130}, 0x1, 0x0, 0x0, 0x48010}, 0x20004001) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, 0x9, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x80}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x400040c0}, 0x20000000) (async, rerun: 64) sendmsg$802154_dgram(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000800)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0102}}}, 0x14, &(0x7f00000008c0)={&(0x7f0000000840)="bf27b86f66b1a60190b76f9039a8503d64a45f4837207373114549b26e168be1c7f41f1a147f39623fd364ce606c843c5d276b4cee93208c501ed59c0cb4d8961e4fe92eb67e97800d75362dde73d8eb040ab610b0fb00f29916e0856d", 0x5d}, 0x1, 0x0, 0x0, 0x4}, 0x8010) (async, rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000940)='freezer.self_freezing\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r6, 0x800454d3, &(0x7f0000000980)) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000a00), r1) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000a40)={'batadv0\x00', 0x0}) (rerun: 32) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r1, &(0x7f0000000b00)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x1c, r7, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000b40)='veth0_to_hsr\x00', 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_SIGNAL_INFO(r6, &(0x7f0000000c40)={&(0x7f0000000b80), 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x10, 0x3f2, 0x200, 0x70bd2d, 0x25dfdbfc, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000001}, 0x4c00d) (async, rerun: 64) r9 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000cc0)={'team0\x00', 0x0}) (async) getpeername$packet(r6, &(0x7f0000000d00)={0x11, 0x0, 0x0}, &(0x7f0000000d40)=0x14) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000d80)={'team0\x00', 0x0}) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000dc0)={'team0\x00', 0x0}) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000e80)={r6, 0x58, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000ec0)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000001c80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001c40)={&(0x7f0000001180)={0xaa0, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {}, [{{0x8, 0x1, r10}, {0x14c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0xc0d4, 0x4, 0x7, 0x3}, {0xfc00, 0x98, 0xff, 0x3}, {0x878d, 0x6, 0x8, 0x1}, {0x2, 0xfe, 0x8d, 0x1000}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r12}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x39b}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}]}}, {{0x8, 0x1, r13}, {0x180, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r8}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r15}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8, 0x1, r16}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x101}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x22c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2b}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x41}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xd}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x290, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x8001, 0x6, 0x8a, 0x4f}]}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0x1, 0x81, 0x2, 0x8}, {0x0, 0x1, 0x0, 0x800}, {0x3, 0x1, 0x5, 0x1ff}, {0x1ae, 0x8, 0x4, 0x7}, {0x84, 0x80, 0x9, 0x18000000}, {0xfff9, 0x1, 0x4, 0x3}, {0xffff, 0x7, 0x7f, 0x6}, {0xdf8, 0xf8, 0x56, 0x7fffffff}]}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r8}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xeda}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0xbc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0xaa0}, 0x1, 0x0, 0x0, 0x4001}, 0x40000) 33.735039702s ago: executing program 3 (id=8551): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000080)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2a}}, 0x10, &(0x7f0000000040)=[{&(0x7f00000002c0)="d2d5b3208e86ce9bc1aa", 0xa}], 0x1}}], 0x1, 0x20008000) socket$nl_generic(0x10, 0x3, 0x10) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x9}, @NFTA_EXTHDR_OP={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x7c}}, 0x0) bind$bt_hci(r4, &(0x7f0000000000)={0x27}, 0x62) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x1a, 0x0, 0x0) syz_emit_ethernet(0xae, &(0x7f0000000680)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xa0, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x24, 0x0, {0x21, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x6f, 0x0, [{0x0, 0xc, "e256b28c04000000fb52"}, {0x0, 0x9, "789607675ca638"}, {0x4, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x6, 0x7, "cfa11cab1a"}, {0x5, 0x10, "c600"/14}, {0x0, 0xa, "65807fe97612fe86"}, {0x0, 0x12, "73bc2300ad9d19a30000000000000000"}, {0x6, 0xa, "c8f46976e79e56c7"}]}]}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) listen(r4, 0x0) epoll_create(0x5) socket$packet(0x11, 0x2, 0x300) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0xfffffffffffffffd, 0x0, 0x9, 0xfffffffffffffffc, 0x0, 0x80000001}, 0x0, 0x0) close(0x4) shutdown(r3, 0x1) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_FWMARK={0x8}, @IFLA_GRE_ERSPAN_VER={0x5}, @IFLA_GRE_ENCAP_TYPE={0x6}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x50}}, 0x0) 33.546779192s ago: executing program 0 (id=8552): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc020000000000000000000000000000140004"], 0x84}}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [], {0xfffffffffffffef8}}, 0x28}}, 0x4000040) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$kcm(r0, &(0x7f0000001700)={&(0x7f0000000280)=@vsock, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000300)="1e7a028451aa15c432464aea64a99fd7c62d0cbbe571ad92b8726e8c7433d040df7ea8763d7985b50a09b34e25361b0f63464fe0de4e36d1ced3c33758ca2278777ed993e09f92f5e5b6e1531b61b4fd0de833faef5ff86dc93f49fb57d5a8b6b93e3034ee8013088d2b2db14f19a6a49a1c0f7d6a7ba46fe646ed05f74f97a45a9585b0bf52d5fb8474d33cb2994185110c11fbe2c4a45c8d879adcf46a2ce86a417f4fb3bbe8346f9bba8b06", 0xad}], 0x1, &(0x7f0000000540)=[{0xa0, 0x104, 0x7, "b538d8ce82c6cac312f947f4fe04f7b0a3e12a61850a63629921ae5527028c4ee28ea3f8bab8773b9ecf51749f9cd4577fa85760d9e33a2cc48f1e768d97d89b29bafe0d64d0ee11d7ee2fad4317edfa74cb5cbd0a68a88f59ed44f969bbc729876bebaf77a249bc9b2963892b99f63f057f74b927fc1a31002a06a266e6a0690d61a9fb16c63c637c"}, {0x1010, 0x112, 0x33, "66b7f2338fb71c6e2d1b809559f8abf37107db360d2251fb35c03d30a2cd183dd5d0ca386bcaf7eea7351789dec700b0735fb7e5a4d5bce04c774dfb73c171e2a43384f57534ec614c9a10859037ae3f20de145842d9568eb70a7ab9e780f10d84939aad4b2fef8c31c1a9b9f732bcf4f1729c65b435d151a132e3142f252d3e5b433e1f0649fa8e0ae435daa35755bd9003a1462c1847dea3a4e0d296987cfc768875f0620d49046c7555a3e2a7966e06bb5e2802ff060250ee03965d4d344fe44d6edcfe8cb4c5a730da4446d698a06c16e2445b6cbf375a21ab1110f2e620c68e7f99d3948ad75803a5000fe8c51a0e8bac8e41e74d53d574d9dd9a3884530cfac3cd598ad5ae2c491f821c1c5980f3e1b9778439cde1a074656bf9039783ba9e14971c7fcfe3b4a72ecaa5d69e581c54784175e450acf8b1e866ae14e31014b9af97c4f20c8dae203b84533de3e95a230d17d515c6e247037b63a0f1ecac4c09110f47a2d1c357f7547611bc28a7c6c3c4cf9bcc43f8195dee5b0810d9618e0d8119d02fda4037e820e90b7fbcd298f1c8eedf591ef6127fb8718d3c99dbce9d149c28f0bca36b2a3fbdc700c46567b807c4a41ef67d740830e0a9a5b9d83df8a080fabc30898dd9a33b6e2bd0fb19a7606724f38bb9bd58d4bc6ea75ca304ceb003f3b193c1c4a9033ab408ac9f98012c4eea473327acaf834e576fc2a8543a503bacb774e42c709d93dba89c55421dd2b1fc06ceed9c26beeadfda26c128833aa7bb7ea289a9cafcd156a87b3acc76393dfaa5aa68d9f3adad3f5efd9b724d55a347184a374d62bf4a10a92ba94c773646fd141d81d8f86ca4fe25134aa14d569ccff283f4fdc898d55c4be55db4283f1e31989d06839527f64329fafe7891fb2f9992baea2d31e6cd2309c14cc146f326ef8c1027b885e393aa7d6261051de63e23ccbb6b90220549a93c7cb9b9e3f557757e7e74ade6e4263db80e48f8026553f493aa283e1ec12713669aaa4ad95d55b5cb0ed1bb71eed3619c6a2c3e58c766b11e81969ef3337713c365eda6a514dc1c3a903766a47b99d2310523270df18f5c344ca09d015365f6eedec963b363523bb3bac4d22f07fae010f780a2b0fad03eb1cc761d766a04c0787b92d80ac896137ab6fdaa55db0cc33dc941c84c100cd2857d026c7ff4bd9604780c271edb968a946c20ab263f598294fd37a40f4490d1d3c24acbf77b89c058a5062b5ac5dbd59dd42468633392d8f3cea0fcc8bf5c9d007c51aeb25fcccce2811653f0d37114ea3fb29c169795e2061ad50670deb719fb19bf47f40936d18d67bd841335bc54e9ae026f0c86a53b96e8c9c2caf23df94742d66b015cf6e3665fd40cbcd10020378cc4862d79ca38ecc728b8ccf32d85900c45badb5af9521e6e031d0747a6c0d01593165765c1b4ac9e338abb423dcdd9ddfb62a561439a96966cdb2fd196ae53b2c0a8cde2fd0bafc61bc104335d0f6b3c489e756b7526b10b112803181ec4c96a8acff233d8ac1d1b7f61890ebb48a73c7aa6ae8f901570dc6142f59afb5406ad29b2efce4c2d59accd46775a884eff78989049ba1a011fe93f5576c14196a0c05e7089e25b64e619ce8a6601815a78267def65358a3a532d9b163505b902486956455b5f9e2aca7df464a8941a895f218d145b61a73e0db0664d3db7dbcb367cf2b8b499085ce4d7080bdbaf05aed8ddaccb07e1e2f121f49cf102e923d5974ec66b93f8a01fdd65d76608ec6b93da21b9f56cfb9cd4f939886fabf3e2ba95b7c5ca9d6e0477b57f742003466a737b3ca5b61ba00efd306657168012b8bc4c4e8be247cb9ffba8df8f6e4182c529587bf1de6af4f563a65a11f51f5ae9291d3df8b98c48cc1291dd4a69ef69c93d4560087d0269469c110ac22575662bf5d8dfa31f224861c21a94046e3485f62fa0a64a2b0655c53a0b221081aaca963c08c34bc897449a2bf9a08cef5047fff36316ded5db8ea3d4df79f2d952fd14fc1076d0d2ca71f8c70494f6e72742d83f7f4bd5d63a18f6a2a3d6a513403f1faff67fccb353b4e33c3c45547692cd89af8e8048ea333e596002ea0362d0b785a282fd4610fe99bad6c0c1f064b05f872352e8fc78ca60c483a1f3b8c839790055d28dbdd08d02dda3eecf40f94d630cddd354ffbad4d43f92de72048756bf9a53227eabb13dc1dca5e5f9282209bd0b00ff23ba8c3f3daf055b7deb4c3f41a3fcb51d011e57352de22bcf13dee94cdf7a3563f7d313869bea8194fa52b1952a9a52d97660e2c31df33b45947d68b33404d3d441498165e2f858876f3340ca3349e1614f170e0361740126e414b507d901795062c0340d6a4c370ac88f086e0bc95dede5d008b33ac0f05fda7ce70d45bc388a1c7e625b8769a366d7eb822296deeca9fdc4a586454f4e711d1c6ec88e1e288e0f166d6eb603267b9bcb37d464296fedf1d2cc8fa2407ad1756a645111fdc800ecab4588d40d035cd7266a6a61cf8da82e58d8698b8e019657615d54035f775fa219313540ea53551d7db0292e425ac60cb453dd31236ae77ee0375b6e7331ce49b3931fb2fd9982eb2b0b2c93a24ec58e4d85e05c8c6a33e4f338aad57d1e6f126e19f409271bb33ebed1cb067532fb2e944218fd506af5b5fe991b08a5d6f88f9200f1c14e59935b158f207080535eb6881420608bd7e7f6b1b606f48cc5d23fba0c046607cf121c036f9f30f73e7109ef09001ffc298174b7f9d2ac512a666be83a4f504ccab28550e212031d9bdcaa3ec6c41da2fda8d50b707851378536d5031a6ac151715ff3c7e7040596e27357a75a0899afa3b26beb1237c7c73f4ec3cc60706382ba6daac767794d217399d3b71d3e50d9a2f944ff6842a9e11a627f6871ce0b2e65a6a997a17c03f9de4413f6cd15717d30a8cbb04b39d8bdc3a3b040f2ac3e340e6e4a4e97bcfdf17078df484d4df573be8ae79b8b9350e68b4b3e59ae4963fe7f23fb1d6d3900a70bdc40a070f797f8f75bad8c21dda9daca31b5036981abdcc36e7d0bbe346f2b2481aacc53dd96a74882b565d39b206fa40debf6c6c426bb09c33436f35902aaa9c7f197ef39e691d6e2f005504f19665a35441d75a5eba09023d4254d236cfe2aa0c64eac58438b915f2fed041617d6f2dc252ba4a9bc75296ddb15d6a3c23398d44de4067bdec2785674a8cec0057ee745348bb4c454d0b96b42745a1e0125b5251ecc809b3054e194e992d5ac3586ac90173512a5a8f33f79e5c621fe21968b182724efb71d5aa082c218602f9b2b88ee5a8165831897f9cb740384af6348aab5757dd095edb80583d8aea0a8bac5f15c2425d1225bf9cf96b05206ec62dd8fb9a316c339d86494d784597271987707adf571d5b1e1eb4d14d95db6502004a0d7e608e09ba516c3414eb5662ca7a1fa6d343dec06da302933aec191673d6f35325b70d6225091eeedb76ce0c8d7211abc360b8bf860014514a1c2d157c54b6188ca873673f5569646226d4156c942f6ba33c73f6da69d1eed75bf0e74976a34a8653a4b0435945d201e921bca308805d78e5ae86d82aed59459e348ffb844f0f1343e8cd4c07e522e223b46066f2b8b210e581bd0e7fb0666e4cca5d8cad06356cfdefa2f47a59c1585563f7335a6cc611c428eb0088fb99349aa1c65c67e9edf95b48afe33bb4a65b6863b4b77a3966e81d5ed3418a726af4b3f28eeca2e5ec513426421fbfdf314951895b0ce7d400e2214e5ce673d0a3e6f25d5756a77bb1ba4c387472f119319c424978f0ee4a75118d9b51ecfb4840d90e671641e171ad9b5828ae27999ba11cf3954e24dc9ba738c09b93921d0b4ea0b24a6e16fe2fd5a5ca60223f1575df2a1c39f7b318f7d178b3408e24fb9c51452e0a2b181edc3a08786a4d615ef1fd452485a2fe33b78209f2bfe71c03e57925611ec1e74d94ff76f7e93cefe5890c699aa326165127a350faae3777451a127546f5fb2049acc526fbab15f5b795b3654e9e2bcafbdad88817388b6a57112772a5bfa02a6cd7a1a4523bd6d7380e52d3b176b22e4adc3d36a4a79dfcfec268cd910a53c702dc8b53a02711e88f93c0f4120ec5d7576be76fb26e70c153b77d9dab716b6465995673211cb022907c0cd56cf5571a0f365169c09479fdf28dd081c49d4fad8b9991ccee86ea3d7d4375cbc308e2b290f743eff87a4e5db492f6a63d526b7bfdc825d8a4f42929eb5a738447d953e597790f3cc3258e40e3f6c37505714bf7fd26763206ccfaef813fa14c9b80d49527b5bf8dd748c7f073e22ce95e4b0989e186ed390754e4e03af2c0fff37d9c3408e968502fa77f4d0446d32886b01f7adc79b45bc451dd9ce0a98c49596c528f4fb55ff1aaf2858fc7a66d1f5625d7a27e46513c2cd78be4b0391300a46252a8aaca509742d90401b48153f1184162367d49ef711f61e3a5d221b49c81f171468fc4fd60e55d2591a8e6021dce6f9b72ed8cc8e55f5552fb1b150fd2f1a2a4c5c13bbb2a9c0c2d392e39b097772351bef3fd2fbca26087a5b2a8d948e57954c9d6e271bf2bb1c864bfd84829ce41e595988d5878163a89fe3cf5dc582f886f434ffeaa5726f1eaad0a8f3165e1af300b6149234b6537a87f6a258315be7e723a427247f3cd68a9e627c208bfa3a1d2b606d54117a68560618c150f108eac6fe61598cfadc4aaf6f1eb79a3833a51849a63de8f32c051e684c2d360ff527e632872bdf2679c4286d92931eeaa437474616b89cdc86bf863d471c4eb81a509140b59f04053fc03f39fca395e742f6659a04d9a3148708fb8f99ac0eafe943e57c36e10aada1f46e928bff4a6fb927d21baf354fbf91bfb52ed275c5b40abea3a874dc604e02deacfba0c4297b58291cd01ad72e00d5672d35547811d721e2951ac9b2123d464306d76782b766a5349405796623611d64d9a480870dc5a3884193cf18fed0ad6870bddb5ba8387c99aecc4eca671db73d7248b291764ae6b48b94f31c2a2f3dfef259b0d3aa757a30e2bfdc3d44f268ab79627399d9ddbb8965463ad4ab54981e4e314f482cb3c72ea186dae4b7174a1edd4d25c6f0deb6c9e471c03631b52585e92ca7b86586670ae76505ee8eff92497220808da7e7a3b1809ac271b17a50123e8e7c69eae49dcae830592473947a8e0f42e929b2941e1bbaa5299a5fa60ffefccbd407de971aea3b9343d126c6f3bfcd3c9d23c3df057e50c61704346a6fb917b1a83847bb176739cb8ddaef231b7a9cf7fe32f533c17e53a77dc0e1a22e66a7497e69b7225b3806fcef67aa2433647d63fa82cb7f86bc49fc02c83d32b7efbdf433e1a8e9ac9c3f706c9ca654c50397216e2b58d753a6e60be00a7c11dd7a11052b4d9aedbd1bcf7ad3c618f55645784e833d6739cd0f7c7f2e045837ae8432c460f71c75c1dae2bfcf0f5c2cb840be3201ad0dafac4d23d586c589298768c9adf619dc4ff9a9ca9a86536be8089f0ddfce00eac06e4e2d8b8d296ecbd51de8d59da118a122c0dce10717822ce2a6195750cc5bf2ce63c8498ae51e4fdf29fd2ef98461e639376560e3128d8bab2d6748f90a16d4be001dc2be22f8a08b1b2c60cfbc0e67164dc5667fb3e1bb29f5f65ecdf7f1610ba9a8ee6b91df2fe45bb4999b941a372a2719578120d469ab29f640f58d19a16641b43cddf9154c19a2f7096244f284a758d8f8315288cef16c1e906af996b3a85045b44ccceaa83271fe38e697a6b100707701e30e0a52780bb0667d3c24bcd0"}, {0x30, 0x29, 0x1, "dfd03aa40d6d6115f6e65265759b8829b24c6ebdc0fd036eb1d7cee00a"}, {0x70, 0x10e, 0x8, "1a719fede24167f9b07b3e6c63c303843dbeb6b182a8e6fbf9bdb3797564f1500d0ac9d11cd6774f805b6e767ed42a880717b6b36b1a4b31d8689f7c8023216fe9a32d41fd696ebc7723f4ea6317b01da8269714c7b311945a0f01"}, {0x38, 0x118, 0x8, "8beafe3caded76a4b11997e787d8312d31ce688473c8b8db8e2bf3da0112de2659bd"}], 0x1188}, 0x20000090) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) 33.239850175s ago: executing program 4 (id=8553): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="bc0000000002010400000000000000000a000005300001802c0001801400030000000000000000000000ffff0000000014000400fe8000000000000000000000000000aa3c0003800c00028005000100000000002c0001800e000300fe80000000000000000000000000001c14000400fe8800000000000000000000000000013c0002800c00028005000100000000002c00018014000300ff010000000000000000000000000001140004"], 0xbc}}, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r3, &(0x7f0000000380)=@abs={0x1, 0x0, 0x4e20}, 0x6e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) r6 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$XFS_IOC_FD_TO_HANDLE(r7, 0xc038586a, &(0x7f0000000840)={r7, &(0x7f0000000580)='team_slave_0\x00', 0x400, &(0x7f00000005c0)={@_ha_fsid={[0x3, 0x7]}, {0xd9, 0x4051, 0x5, 0x3}}, 0x58, &(0x7f00000006c0), &(0x7f0000000740)=0x7}) sendmsg$GTP_CMD_ECHOREQ(r4, &(0x7f0000000a40)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000a80)=ANY=[@ANYBLOB="78dce70000ffff0300000000000000", @ANYRES16=0x0, @ANYBLOB="000127bd7000fcdbdf250300000008000700", @ANYRES32, @ANYBLOB="080009000200000014000c000000000000000000000000000000000108000200000000000c000300010000000000000008000700", @ANYRES32, @ANYBLOB="0c000300040000000000000005000d001e000000080004006401010208000700", @ANYRES32=r9, @ANYBLOB], 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r10, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r8}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1e, 0xc, &(0x7f0000000300)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r11}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sk_lookup, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000180)=r12, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2608054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) connect$unix(r3, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e20}, 0x6e) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r7, 0x40106e80, &(0x7f00000000c0)={0x2}) r14 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_int(r14, 0x1, 0x5, 0x0, &(0x7f0000000600)) r15 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r13, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010003b1500000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="41040000015001001800128008000100677470000c00028008000100", @ANYRES32=r15], 0x40}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x88}, [@generic={0x91, 0x1, 0x1, 0x96}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, 0x94) close(0x4) getsockopt$sock_buf(r2, 0x1, 0x1a, &(0x7f00000027c0)=""/4096, &(0x7f0000000100)=0x1000) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000080)={0x0, 'team_slave_0\x00', {0x1}, 0x8}) 32.997127777s ago: executing program 1 (id=8554): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/18, @ANYRES32, @ANYBLOB="00001700000000001c0037800b0001"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f00000004c0)={@pptp={0x18, 0x2, {0x1, @private=0xa010102}}, {&(0x7f00000003c0)=""/187, 0xbb}, &(0x7f0000000480), 0x10}, 0xa0) getsockopt$inet_int(r2, 0x0, 0x31, 0x0, &(0x7f0000000040)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) socket$kcm(0x10, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0xe) sendmsg$nl_route_sched(r4, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r5, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r3, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(r3, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000440)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f0000000540)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a085852456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe12", 0xde9}, {&(0x7f0000000240)="b0c089c1c3e1216756615dde8fd8e358908803df4459f506479ab9cf61eb0266", 0x20}], 0x6) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r6) 32.694437936s ago: executing program 3 (id=8555): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f0000000300), 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c0001800500010003000000060004000a0a0000"], 0xbc}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r1, &(0x7f0000000600)={0x2, 0x6bb, @loopback}, 0x10) listen(r1, 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000700)={0x2, 0x3039, @loopback}, 0x10) connect$inet(r2, &(0x7f0000000800)={0x2, 0x6bb, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) write(r2, &(0x7f0000000900)="009c00011a2b3c4d00010000010000000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/157, 0x9d) socket(0x2000000015, 0x80005, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x14, 0x30, 0x9}, 0x14}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) socket(0x40000000015, 0x5, 0x0) r4 = socket(0x15, 0x5, 0x0) bind$inet(r4, 0x0, 0x0) getsockopt(r4, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, 0x0) write(r3, &(0x7f0000000a00)="009c00011a2b3c4d00020000010001000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/172, 0x9c) write(r2, &(0x7f0000000b00)="00a800011a2b3c4d00070000000100010000012c05f5e100000000030000000300400000000000000000000000000000000000000000000000000000000000000000001200"/168, 0xa8) write(r3, &(0x7f0000000c00)="002000011a2b3c4d0008", 0xa) 32.62873515s ago: executing program 0 (id=8556): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'veth1_to_team\x00', &(0x7f0000002fc0)=@ethtool_wolinfo={0x3, 0x8, 0x4, "050000009582"}}) (async) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4084) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) (async) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)={0x24, 0x24, 0x107, 0x70bd2e, 0x25dfdbfb, {0x2, 0x7c}, [@nested={0x10, 0x1, 0x0, 0x1, [@typed={0xa, 0x53, 0x0, 0x0, @binary="dd2e5edb36ed"}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2e}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000a40)=@mangle={'mangle\x00', 0x44, 0x6, 0x498, 0x98, 0x290, 0x290, 0x138, 0x138, 0x400, 0x400, 0x400, 0x400, 0x400, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x4}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x40}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0xfffffffe, 0x0, @local, 0x2}}}, {{@uncond, 0x0, 0x130, 0x158, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x8, 0x3, 'fsm\x00', "320ed162cd7bbb5c623b980ee055668b8f3f37bc739cba06a6605408a96fb717fd4766f42da23c709c33f142c91d568e249b1538c77b20b7a8f1463c65099f65e88d93e223d375ba102a44e0b5a6092ab2c8ef1600ed1b4c255dfb8fb0c6e89f5aa8086005f19e9d7d50aafd97b9a468bb568b0d52b485deac7342bcf62ba601", 0x4f, 0x2, {0x100000003}}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x7, 0x6}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x40, 0x8, @rand_addr=0x64010101, 0x4e21}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'erspan0\x00', {0xff}}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4f8) 0s ago: executing program 32 (id=8542): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0x9, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f0000000340)={&(0x7f0000000440)=@xdp={0x2c, 0xdd86, r4, 0x13}, 0x80, &(0x7f0000000740)=[{&(0x7f00000005c0)="691e243e3a6328ceb31c80645b76129e", 0x10}], 0x1}, 0x20008110) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x80d, 0x0, 0x10000000, 0x5, 0x4}, 0x1, r8}}]}, {0x0, 0xa}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x1}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4008001}, 0x0) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r5) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="997425bd7000fbdbdf25150000004c0001800d0001007549bc9aca1a590b9d"], 0x60}, 0x1, 0x0, 0x0, 0x24000884}, 0x2400c000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x3, &(0x7f0000000240)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r12, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_int(r12, 0x6, 0x20, &(0x7f0000000000)=0x39c4, 0x4) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x44, r9, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x2}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x44) r13 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x98, 0x98, 0xa, [@fwd={0x3}, @fwd={0xe}, @func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{0x2}, {0x6, 0x4}, {0x9, 0x1}, {0x8, 0x1}, {0x3, 0x4}, {0x10}, {0x9, 0x5}, {}]}, @restrict={0xa}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x3, 0xa}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x1, 0x8001}}]}, {0x0, [0x30, 0x5f, 0x5c, 0x0, 0x5f, 0xfc, 0x2e, 0x2e]}}, &(0x7f0000000340)=""/86, 0xba, 0x56, 0x0, 0x401}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000800)={r13, 0x20, &(0x7f00000007c0)={&(0x7f0000000600)=""/203, 0xcb, 0x0, &(0x7f0000000700)=""/155, 0x9b}}, 0x10) kernel console output (not intermixed with test programs): 0.6903'. [ 866.955172][ T550] bond4: option packets_per_slave: invalid value (808482864) [ 866.962876][ T550] bond4: option packets_per_slave: allowed values 0 - 65535 [ 866.984860][ T550] bond4 (unregistering): Released all slaves [ 867.094057][ T553] bond4: option packets_per_slave: invalid value (808482864) [ 867.117312][ T553] bond4: option packets_per_slave: allowed values 0 - 65535 [ 867.126815][ T553] bond4 (unregistering): Released all slaves [ 867.396038][ T563] __nla_validate_parse: 1 callbacks suppressed [ 867.396087][ T563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6916'. [ 867.462388][ T567] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6917'. [ 867.486973][ T568] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6917'. [ 867.592306][ T577] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6919'. [ 868.360533][ T608] netlink: 'syz.3.6922': attribute type 1 has an invalid length. [ 868.397005][ T608] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6922'. [ 869.251491][ T618] lo speed is unknown, defaulting to 1000 [ 869.812166][ T635] netlink: 'syz.4.6933': attribute type 4 has an invalid length. [ 869.913011][ T640] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6934'. [ 869.963933][ T618] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6928'. [ 869.983755][ T618] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6928'. [ 870.486030][ T648] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6937'. [ 870.532188][ T648] netlink: 'syz.3.6937': attribute type 1 has an invalid length. [ 870.594870][ T649] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6937'. [ 871.207296][ T662] ip6gre2: entered promiscuous mode [ 871.214108][ T662] ip6gre2: entered allmulticast mode [ 871.394026][ T678] tc action pedit offset must be on 32 bit boundaries [ 871.852874][ T694] netlink: 'syz.0.6947': attribute type 1 has an invalid length. [ 871.937535][ T693] tipc: Enabled bearer , priority 10 [ 872.071911][ T701] netlink: zone id is out of range [ 872.089457][ T701] netlink: zone id is out of range [ 872.094951][ T701] netlink: zone id is out of range [ 872.144698][ T701] netlink: zone id is out of range [ 872.159565][ T701] netlink: zone id is out of range [ 872.175242][ T701] netlink: zone id is out of range [ 872.199385][ T701] netlink: zone id is out of range [ 872.206163][ T701] netlink: zone id is out of range [ 872.219625][ T701] netlink: zone id is out of range [ 872.230259][ T701] netlink: zone id is out of range [ 872.457455][ T718] __nla_validate_parse: 4 callbacks suppressed [ 872.457487][ T718] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6954'. [ 872.492369][ T720] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6955'. [ 872.669832][ T718] 8021q: adding VLAN 0 to HW filter on device bond3 [ 872.771568][ T723] bond3: (slave macvlan3): Opening slave failed [ 873.011166][ T733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 873.052217][ T733] 8021q: adding VLAN 0 to HW filter on device team0 [ 873.090825][ T733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 873.148692][ T743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6957'. [ 873.332161][ T733] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 873.365505][ T733] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 873.715262][ T762] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6962'. [ 873.846664][ T770] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6965'. [ 874.498546][ T800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6973'. [ 874.550577][ T802] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6973'. [ 874.572831][ T767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 874.597145][ T802] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6973'. [ 874.637147][ T802] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6973'. [ 874.677699][ T802] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6973'. [ 875.402743][ T850] netlink: 'syz.4.6986': attribute type 32 has an invalid length. [ 875.651782][ T855] ipvlan2: entered promiscuous mode [ 875.669219][ T855] bridge0: port 4(ipvlan2) entered blocking state [ 875.684670][ T855] bridge0: port 4(ipvlan2) entered disabled state [ 875.692435][ T855] ipvlan2: entered allmulticast mode [ 875.697783][ T855] bridge0: entered allmulticast mode [ 875.709814][ T855] ipvlan2: left allmulticast mode [ 875.715064][ T855] bridge0: left allmulticast mode [ 875.737409][ T865] Cannot find del_set index 17 as target [ 876.178256][ T878] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 876.207833][ T878] bond7 (unregistering): Released all slaves [ 876.975064][ T918] sctp: [Deprecated]: syz.1.7004 (pid 918) Use of int in max_burst socket option deprecated. [ 876.975064][ T918] Use struct sctp_assoc_value instead [ 877.942500][ T951] __nla_validate_parse: 66 callbacks suppressed [ 877.942536][ T951] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7013'. [ 877.977208][ T953] net_ratelimit: 19 callbacks suppressed [ 877.977256][ T953] openvswitch: netlink: Key type 309 is out of range max 32 [ 877.996823][ T954] netlink: 'syz.0.7012': attribute type 1 has an invalid length. [ 878.042827][ T953] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7014'. [ 878.255453][ T963] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 878.419837][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 878.470968][ T971] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7017'. [ 878.573374][ T975] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7017'. [ 878.711173][ T980] netlink: 80 bytes leftover after parsing attributes in process `syz.3.7020'. [ 878.750831][ T980] siw: device registration error -23 [ 878.795876][ T982] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7021'. [ 878.984254][ T987] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7023'. [ 879.013194][ T987] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7023'. [ 879.309196][ T993] netlink: 76 bytes leftover after parsing attributes in process `syz.0.7027'. [ 879.391245][ T993] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7027'. [ 879.433813][ T993] geneve0: entered promiscuous mode [ 879.675645][ T1001] netlink: 'syz.4.7030': attribute type 29 has an invalid length. [ 879.727382][ T1007] syzkaller0: entered promiscuous mode [ 879.744702][ T1007] syzkaller0: entered allmulticast mode [ 879.759467][T32698] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.791987][T32698] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.839480][T32698] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.850890][T32698] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.876148][ T1010] xt_hashlimit: max too large, truncated to 1048576 [ 880.453352][ T1032] FAULT_INJECTION: forcing a failure. [ 880.453352][ T1032] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 880.469003][ T1032] CPU: 1 UID: 0 PID: 1032 Comm: syz.1.7038 Not tainted syzkaller #0 PREEMPT(full) [ 880.469027][ T1032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 880.469039][ T1032] Call Trace: [ 880.469047][ T1032] [ 880.469056][ T1032] dump_stack_lvl+0xe8/0x150 [ 880.469091][ T1032] should_fail_ex+0x40c/0x560 [ 880.469120][ T1032] _copy_from_user+0x2d/0xb0 [ 880.469141][ T1032] __sys_bpf+0x2e7/0xd90 [ 880.469176][ T1032] ? __pfx___sys_bpf+0x10/0x10 [ 880.469213][ T1032] ? __fget_files+0x2a/0x420 [ 880.469263][ T1032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.469297][ T1032] __x64_sys_bpf+0xba/0xd0 [ 880.469320][ T1032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.469341][ T1032] do_syscall_64+0x174/0x580 [ 880.469366][ T1032] ? trace_irq_disable+0x3b/0x140 [ 880.469391][ T1032] ? clear_bhb_loop+0x40/0x90 [ 880.469414][ T1032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.469433][ T1032] RIP: 0033:0x7f1a9699e019 [ 880.469450][ T1032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.469468][ T1032] RSP: 002b:00007f1a9789d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 880.469489][ T1032] RAX: ffffffffffffffda RBX: 00007f1a96c25fa0 RCX: 00007f1a9699e019 [ 880.469504][ T1032] RDX: 0000000000000050 RSI: 0000200000001180 RDI: e4ffffff00000000 [ 880.469517][ T1032] RBP: 00007f1a9789d090 R08: 0000000000000000 R09: 0000000000000000 [ 880.469530][ T1032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 880.469547][ T1032] R13: 00007f1a96c26038 R14: 00007f1a96c25fa0 R15: 00007ffe7bb62728 [ 880.469595][ T1032] [ 880.785364][ T1040] tipc: Enabling of bearer rejected, media not registered [ 880.945178][ T1053] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65568) ! [ 881.701185][ T1088] openvswitch: netlink: Key 32 has unexpected len 4 expected 2 [ 881.980398][T32695] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 881.991593][T32695] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.000090][T32695] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.008475][T32695] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.207500][ T1143] netlink: 'syz.0.7061': attribute type 1 has an invalid length. [ 882.239011][ T1143] 8021q: adding VLAN 0 to HW filter on device bond7 [ 882.745993][ T1165] x_tables: unsorted underflow at hook 2 [ 883.450549][ T1206] __nla_validate_parse: 13 callbacks suppressed [ 883.450570][ T1206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7084'. [ 883.466241][ T1206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7084'. [ 883.508270][ T1209] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 883.568537][ T1209] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 883.581352][ T1209] bond0 (unregistering): Released all slaves [ 884.485375][ T30] audit: type=1800 audit(1785801904.929:19): pid=1260 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7101" name="r" dev="tmpfs" ino=1987 res=0 errno=0 [ 884.902385][ T1280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7109'. [ 885.012804][ T1281] syzkaller0: entered promiscuous mode [ 885.034460][ T1281] syzkaller0: entered allmulticast mode [ 885.065037][ T1271] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7105'. [ 885.077971][ T1271] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7105'. [ 885.565674][ T1295] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7114'. [ 885.979927][ T1305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7117'. [ 886.460032][ T1345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7126'. [ 886.483844][ T1345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7126'. [ 886.648037][ T1351] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7128'. [ 886.697474][ T1353] netlink: 'syz.0.7129': attribute type 2 has an invalid length. [ 886.772792][ T1353] netlink: 'syz.0.7129': attribute type 1 has an invalid length. [ 887.062851][ T1374] tipc: Enabled bearer , priority 0 [ 887.167510][ T1372] tipc: Disabling bearer [ 887.699400][ T1398] netlink: 'syz.0.7143': attribute type 10 has an invalid length. [ 888.443722][ T1441] lo speed is unknown, defaulting to 1000 [ 888.447131][ T1427] syzkaller1: entered promiscuous mode [ 888.454975][ T1427] syzkaller1: entered allmulticast mode [ 888.698179][ T1445] syzkaller0: entered promiscuous mode [ 888.705120][ T1451] __nla_validate_parse: 5 callbacks suppressed [ 888.705136][ T1451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7158'. [ 888.705142][ T1445] syzkaller0: entered allmulticast mode [ 888.740452][ T1451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7158'. [ 889.006134][ T1468] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7164'. [ 889.741287][ T1499] bond8: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 889.752974][ T1499] bond8 (unregistering): Released all slaves [ 889.834829][ T1509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7170'. [ 889.930535][ T1504] bond8: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 889.939928][ T1509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7170'. [ 889.968423][ T1504] bond8 (unregistering): Released all slaves [ 890.033214][ T1514] syzkaller0: left promiscuous mode [ 890.038453][ T1514] syzkaller0: left allmulticast mode [ 890.072241][ T1514] netlink: 'syz.4.7173': attribute type 33 has an invalid length. [ 890.135291][ T1519] netlink: 'syz.2.7175': attribute type 4 has an invalid length. [ 890.143237][ T1519] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7175'. [ 890.263379][ T1528] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7178'. [ 890.364284][ T1538] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7181'. [ 890.610610][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 890.644683][ T1550] nbd: must specify an index to disconnect [ 890.679416][ T1553] netlink: 'syz.4.7185': attribute type 1 has an invalid length. [ 891.127120][ T1560] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7187'. [ 891.261123][ T1570] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7190'. [ 891.313284][ T1573] block nbd1: NBD_DISCONNECT [ 891.317929][ T1573] block nbd1: Send disconnect failed -32 [ 891.323585][ T1573] block nbd1: shutting down sockets [ 891.645078][ T1587] openvswitch: netlink: IP tunnel attribute has 1 unknown bytes. [ 892.167884][ T1596] IPVS: persistence engine module ip_vs_pe_ not found [ 893.026449][ T1640] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 893.302978][T32691] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 893.313768][T12809] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 893.323512][T12809] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 893.339797][T12809] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 893.453833][ T1669] syzkaller0: entered promiscuous mode [ 893.469383][ T1669] syzkaller0: entered allmulticast mode [ 893.489220][ T1671] syzkaller0: entered promiscuous mode [ 893.494904][ T1671] syzkaller0: entered allmulticast mode [ 893.805571][ T1685] __nla_validate_parse: 14 callbacks suppressed [ 893.805591][ T1685] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7224'. [ 894.079082][ T1699] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7226'. [ 894.483735][ T1718] netlink: 56 bytes leftover after parsing attributes in process `syz.0.7231'. [ 894.684929][ T1727] syzkaller0: entered promiscuous mode [ 894.697190][ T1727] syzkaller0: entered allmulticast mode [ 894.737376][ T1727] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7235'. [ 894.766301][ T1732] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7237'. [ 895.079463][ T1741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7240'. [ 895.415521][ T1759] netlink: 'syz.1.7245': attribute type 4 has an invalid length. [ 895.473211][ T1761] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7246'. [ 895.501118][ T1761] openvswitch: ovs-system: Dropping previously announced user features [ 895.579499][ T1765] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7248'. [ 895.784413][ T1775] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7248'. [ 895.982695][ T1781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 895.991123][ T1781] 8021q: adding VLAN 0 to HW filter on device team0 [ 896.001360][ T1781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 896.125253][ T1781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 896.168215][ T1781] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 896.217073][ T1781] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 896.232100][ T1781] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 896.256053][T12809] bridge0: port 1(bridge_slave_0) entered blocking state [ 896.263280][T12809] bridge0: port 1(bridge_slave_0) entered forwarding state [ 896.272545][T12809] bridge0: port 2(bridge_slave_1) entered blocking state [ 896.279723][T12809] bridge0: port 2(bridge_slave_1) entered forwarding state [ 896.332979][T12809] bridge0: port 3(team0) entered blocking state [ 896.339409][T12809] bridge0: port 3(team0) entered forwarding state [ 896.910501][ T1807] bridge0: entered allmulticast mode [ 897.028662][ T1819] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7258'. [ 897.109093][ T1823] netlink: 'syz.0.7261': attribute type 1 has an invalid length. [ 897.192116][ T1823] bond8: entered promiscuous mode [ 897.197630][ T1823] 8021q: adding VLAN 0 to HW filter on device bond8 [ 897.274902][ T1825] lo speed is unknown, defaulting to 1000 [ 897.572387][ T1854] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 897.596099][ T1855] vti0: entered promiscuous mode [ 897.601320][ T1855] vti0: entered allmulticast mode [ 897.770784][ T1861] netlink: 'syz.2.7269': attribute type 11 has an invalid length. [ 897.779553][ T1861] netlink: Invalid conntrack helper [ 897.784810][ T1861] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 898.150094][ T1887] netlink: zone id is out of range [ 898.161813][ T1887] netlink: zone id is out of range [ 898.183631][ T1887] netlink: zone id is out of range [ 898.198089][ T1887] netlink: zone id is out of range [ 898.212837][ T1887] netlink: zone id is out of range [ 898.227424][ T1887] netlink: zone id is out of range [ 898.244862][ T1887] netlink: zone id is out of range [ 898.261575][ T1893] netlink: 'syz.4.7281': attribute type 1 has an invalid length. [ 898.321920][ T1893] 8021q: adding VLAN 0 to HW filter on device bond0 [ 898.351333][ T1893] bond0: (slave geneve3): making interface the new active one [ 898.360453][ T1893] bond0: (slave geneve3): Enslaving as an active interface with an up link [ 898.982205][ T1931] __nla_validate_parse: 21 callbacks suppressed [ 898.982223][ T1931] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7291'. [ 899.034020][ T1086] udevd[1086]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 899.174663][ T1927] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7292'. [ 899.388219][ T1950] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7296'. [ 899.687582][ T1958] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7298'. [ 899.815395][ T1965] netlink: 'syz.4.7301': attribute type 23 has an invalid length. [ 900.081213][ T1970] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20255 [ 900.192329][ T1979] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7306'. [ 900.556496][ T1994] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7310'. [ 900.565307][ T1996] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7311'. [ 900.592789][ T1996] netlink: 'syz.4.7311': attribute type 1 has an invalid length. [ 900.797735][ T2009] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7315'. [ 900.971874][ T2016] netlink: 'syz.3.7318': attribute type 3 has an invalid length. [ 901.233618][ T2022] ip6_vti0: Master is either lo or non-ether device [ 901.536229][ T2035] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7326'. [ 902.119133][ T2069] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7333'. [ 902.314877][ T2077] netlink: 'syz.1.7337': attribute type 1 has an invalid length. [ 902.408368][ T2084] bond4: (slave geneve3): making interface the new active one [ 902.417398][ T2084] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 902.440361][ T2087] netlink: 'syz.4.7340': attribute type 29 has an invalid length. [ 902.459088][ T2077] 8021q: adding VLAN 0 to HW filter on device bond4 [ 902.512931][ T2087] netlink: 'syz.4.7340': attribute type 29 has an invalid length. [ 902.541596][T32691] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 902.551919][T32691] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 902.560952][T32691] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 902.570254][T32691] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 902.622308][ T2092] xfrm1: entered allmulticast mode [ 902.794183][ T2107] net_ratelimit: 4 callbacks suppressed [ 902.794201][ T2107] openvswitch: netlink: Unknown key attributes 2 [ 903.146007][ T2127] lo speed is unknown, defaulting to 1000 [ 903.193479][ T2129] netlink: 'syz.3.7354': attribute type 6 has an invalid length. [ 903.311785][ T2132] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 903.457448][ T2140] netlink: 'syz.2.7352': attribute type 4 has an invalid length. [ 903.955742][ T2158] netlink: 'syz.1.7364': attribute type 1 has an invalid length. [ 903.966342][ T2158] __nla_validate_parse: 11 callbacks suppressed [ 903.966358][ T2158] netlink: 220 bytes leftover after parsing attributes in process `syz.1.7364'. [ 904.016474][ T2167] netlink: 'syz.3.7366': attribute type 10 has an invalid length. [ 904.024319][ T2167] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7366'. [ 904.192328][ T2180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7371'. [ 904.202592][ T2180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7371'. [ 904.357896][ T2177] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7368'. [ 904.388740][ T2177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7368'. [ 904.418551][ T2177] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7368'. [ 904.701694][ T2198] netlink: 'syz.2.7375': attribute type 4 has an invalid length. [ 904.729278][ T2203] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7376'. [ 904.739898][ T2203] netlink: 48 bytes leftover after parsing attributes in process `syz.1.7376'. [ 904.751801][ T2185] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7372'. [ 904.932291][T32693] tipc: Subscription rejected, illegal request [ 905.365624][ T2214] hsr_slave_1 (unregistering): left promiscuous mode [ 905.701667][ T2237] validate_nla: 1 callbacks suppressed [ 905.701684][ T2237] netlink: 'syz.1.7384': attribute type 5 has an invalid length. [ 906.017998][ T2253] bridge0: port 1(bridge_slave_0) entered disabled state [ 906.717753][ T2295] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 908.139651][ T2357] netlink: 'syz.4.7411': attribute type 16 has an invalid length. [ 908.422459][ T2370] netlink: 'syz.3.7415': attribute type 12 has an invalid length. [ 908.597423][ T2373] netlink: 'syz.0.7414': attribute type 29 has an invalid length. [ 909.433655][ T2430] netlink: 'syz.0.7427': attribute type 4 has an invalid length. [ 909.828799][ T2433] syzkaller0: entered promiscuous mode [ 909.834568][ T2433] syzkaller0: entered allmulticast mode [ 909.995889][ T2446] __nla_validate_parse: 6 callbacks suppressed [ 909.995908][ T2446] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7432'. [ 910.108703][ T2446] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 910.260104][ T2457] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7435'. [ 910.645715][ T2487] x_tables: duplicate underflow at hook 2 [ 910.654189][ T2487] IPVS: set_ctl: invalid protocol: 29 172.20.20.49:20000 [ 910.654456][ T2489] syzkaller1: entered promiscuous mode [ 910.667138][ T2489] syzkaller1: entered allmulticast mode [ 910.925538][ T2509] tipc: Enabled bearer , priority 0 [ 910.939715][ T2509] syzkaller0: entered promiscuous mode [ 910.945255][ T2509] syzkaller0: entered allmulticast mode [ 910.958044][ T2506] tipc: Resetting bearer [ 911.024797][ T2506] tipc: Disabling bearer [ 911.190641][ T2525] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 911.265705][ T2525] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7453'. [ 911.295216][ T2525] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7453'. [ 911.321871][ T2525] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7453'. [ 911.432502][ T2542] netlink: 820 bytes leftover after parsing attributes in process `syz.0.7460'. [ 911.441720][ T2542] netlink: 820 bytes leftover after parsing attributes in process `syz.0.7460'. [ 911.587218][ T2551] IPVS: Unknown mcast interface: syzkaller0 [ 911.593520][ T2551] IPVS: set_ctl: invalid protocol: 2 172.20.20.187:20480 [ 911.619879][ T2561] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 911.782604][ T2566] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7466'. [ 911.793541][ T2566] netlink: 75 bytes leftover after parsing attributes in process `syz.1.7466'. [ 911.882269][ T2575] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7468'. [ 912.288926][ T2603] syzkaller0: entered promiscuous mode [ 912.296794][ T2603] syzkaller0: entered allmulticast mode [ 912.304139][ T2605] tipc: Enabled bearer , priority 0 [ 912.336716][ T2605] tipc: Resetting bearer [ 912.349937][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 912.386217][ T2605] tipc: Disabling bearer [ 912.506343][ T2614] netlink: 'syz.4.7478': attribute type 9 has an invalid length. [ 912.624679][ T2617] sctp: [Deprecated]: syz.2.7479 (pid 2617) Use of struct sctp_assoc_value in delayed_ack socket option. [ 912.624679][ T2617] Use struct sctp_sack_info instead [ 912.805623][ T2626] lo speed is unknown, defaulting to 1000 [ 912.950330][ T2638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 913.056283][ T2646] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 913.112384][ T2648] bridge0: port 2(bridge_slave_1) entered disabled state [ 913.352064][ C1] vcan0: j1939_tp_rxtimer: 0xffff888082c08c00: rx timeout, send abort [ 913.447746][ T2665] Bluetooth: MGMT ver 1.23 [ 913.791057][ C1] vcan0: j1939_tp_rxtimer: 0xffff888052656400: rx timeout, send abort [ 913.898450][ C1] vcan0: j1939_tp_rxtimer: 0xffff888082c08c00: abort rx timeout. Force session deactivation [ 914.306451][ T2699] netlink: 'syz.3.7501': attribute type 4 has an invalid length. [ 914.314411][ T2700] netlink: 'syz.3.7501': attribute type 4 has an invalid length. [ 914.333891][ C1] vcan0: j1939_tp_rxtimer: 0xffff888052656400: abort rx timeout. Force session deactivation [ 914.612211][ T2711] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 914.620897][ T2711] netlink: 'syz.4.7503': attribute type 1 has an invalid length. [ 915.729776][ T2736] __nla_validate_parse: 11 callbacks suppressed [ 915.729798][ T2736] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7510'. [ 915.925943][ T2768] TC_ACT_REPEAT abuse ? [ 916.103346][ T2760] nbd: socks must be embedded in a SOCK_ITEM attr [ 916.110088][ T2760] block nbd3: shutting down sockets [ 916.207857][ T2759] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 916.638397][ T2817] netlink: 220 bytes leftover after parsing attributes in process `syz.4.7520'. [ 916.708913][ T2793] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 917.185876][ T2852] netlink: 144 bytes leftover after parsing attributes in process `syz.0.7528'. [ 917.338688][ T2878] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7532'. [ 917.410759][ T2882] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 917.419411][ T2882] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 917.462969][ T2882] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 917.958324][ T2881] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 918.073240][ T2916] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7542'. [ 918.274123][ T2916] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7542'. [ 918.388966][ T2922] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7545'. [ 918.412319][ T2922] vlan2: entered promiscuous mode [ 918.417379][ T2922] bridge0: entered promiscuous mode [ 918.480944][ T2926] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7547'. [ 918.897069][ T2945] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 919.032479][ T2952] netlink: 'syz.0.7556': attribute type 1 has an invalid length. [ 919.061863][ T2952] bond9: entered promiscuous mode [ 919.067568][ T2952] 8021q: adding VLAN 0 to HW filter on device bond9 [ 919.087779][ T2952] macvtap1: entered allmulticast mode [ 919.163727][ T2952] bond9: (slave bridge11): making interface the new active one [ 919.171338][ T2952] bridge11: entered promiscuous mode [ 919.182287][ T2952] bond9: (slave bridge11): Enslaving as an active interface with an up link [ 919.280184][ T2961] netlink: 'syz.3.7560': attribute type 8 has an invalid length. [ 919.388591][ T2968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7562'. [ 919.591497][ T2972] netlink: 'syz.3.7563': attribute type 8 has an invalid length. [ 919.949546][ T3000] netlink: 'syz.3.7569': attribute type 210 has an invalid length. [ 920.228227][ T2996] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7567'. [ 920.280064][ T2695] Set syz1 is full, maxelem 65536 reached [ 921.068321][ T3036] netlink: 'syz.1.7577': attribute type 13 has an invalid length. [ 921.141130][ T3038] netlink: 'syz.0.7578': attribute type 10 has an invalid length. [ 921.228018][ T3050] __nla_validate_parse: 3 callbacks suppressed [ 921.228036][ T3050] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7577'. [ 921.463531][ T3066] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7581'. [ 921.589186][ T3057] gre0: left promiscuous mode [ 921.639084][ T3057] macsec0: left promiscuous mode [ 921.721254][ T3057] bond1: left promiscuous mode [ 921.726989][ T3057] vlan2: left promiscuous mode [ 921.731786][ T3057] hsr0: left promiscuous mode [ 921.738348][ T3057] ip6gre1: left promiscuous mode [ 921.747066][ T3057] bond3: left promiscuous mode [ 921.751883][ T3057] bridge3: left promiscuous mode [ 921.789342][ T3057] ip6gre2: left promiscuous mode [ 921.810457][ T3057] 8021q: adding VLAN 0 to HW filter on device bond5 [ 921.834382][T12809] bridge0: port 2(bridge_slave_1) entered blocking state [ 921.841619][T12809] bridge0: port 2(bridge_slave_1) entered forwarding state [ 922.231255][ T3096] lo speed is unknown, defaulting to 1000 [ 923.072100][ T3098] syz.3.7589 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 923.103702][ T3098] CPU: 0 UID: 0 PID: 3098 Comm: syz.3.7589 Not tainted syzkaller #0 PREEMPT(full) [ 923.103729][ T3098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 923.103742][ T3098] Call Trace: [ 923.103751][ T3098] [ 923.103760][ T3098] dump_stack_lvl+0xe8/0x150 [ 923.103797][ T3098] dump_header+0xd3/0x4b0 [ 923.103828][ T3098] oom_kill_process+0x3ab/0x970 [ 923.103874][ T3098] out_of_memory+0x1064/0x1480 [ 923.103896][ T3098] ? try_charge_memcg+0xbca/0x1590 [ 923.103942][ T3098] ? __pfx_out_of_memory+0x10/0x10 [ 923.103972][ T3098] ? do_raw_spin_unlock+0xf5/0x210 [ 923.104011][ T3098] try_charge_memcg+0xc74/0x1590 [ 923.104060][ T3098] ? __pfx_try_charge_memcg+0x10/0x10 [ 923.104090][ T3098] ? percpu_ref_tryget+0x15/0x180 [ 923.104147][ T3098] ? charge_memcg+0x20/0x2b0 [ 923.104181][ T3098] charge_memcg+0x19c/0x2b0 [ 923.104213][ T3098] ? mem_cgroup_swapin_charge_folio+0x2b/0x390 [ 923.104244][ T3098] mem_cgroup_swapin_charge_folio+0x25a/0x390 [ 923.104280][ T3098] swap_cache_alloc_folio+0x4de/0x990 [ 923.104322][ T3098] swap_cache_read_folio+0x44/0x120 [ 923.104351][ T3098] swap_cluster_readahead+0x3a0/0x640 [ 923.104386][ T3098] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 923.104428][ T3098] ? get_vma_policy+0x27b/0x3c0 [ 923.104465][ T3098] swapin_readahead+0x19a/0xc10 [ 923.104496][ T3098] ? swap_table_get+0x1e/0x260 [ 923.104521][ T3098] ? swap_table_get+0x1e/0x260 [ 923.104546][ T3098] ? __pfx_swapin_readahead+0x10/0x10 [ 923.104574][ T3098] ? swap_table_get+0x1e/0x260 [ 923.104597][ T3098] ? swap_table_get+0x1e/0x260 [ 923.104618][ T3098] ? swap_table_get+0x1e/0x260 [ 923.104642][ T3098] ? swap_table_get+0x216/0x260 [ 923.104668][ T3098] ? swap_cache_get_folio+0x2e7/0x2f0 [ 923.104700][ T3098] do_swap_page+0x455/0x5060 [ 923.104739][ T3098] ? __pte_offset_map+0x29/0x240 [ 923.104773][ T3098] ? __lock_acquire+0x683/0x2cf0 [ 923.104801][ T3098] ? do_swap_page+0x124/0x5060 [ 923.104825][ T3098] ? __pfx_do_swap_page+0x10/0x10 [ 923.104846][ T3098] ? __pte_offset_map+0x1ae/0x240 [ 923.104875][ T3098] ? pte_offset_map_rw_nolock+0xea/0x160 [ 923.104904][ T3098] handle_mm_fault+0x124c/0x3080 [ 923.104945][ T3098] ? handle_mm_fault+0xec/0x3080 [ 923.104988][ T3098] ? __pfx_handle_mm_fault+0x10/0x10 [ 923.105011][ T3098] ? lock_vma_under_rcu+0x45a/0x500 [ 923.105070][ T3098] do_user_addr_fault+0xa4d/0x1340 [ 923.105116][ T3098] ? trace_page_fault_user+0x84/0x1e0 [ 923.105151][ T3098] exc_page_fault+0x6a/0xc0 [ 923.105184][ T3098] asm_exc_page_fault+0x26/0x30 [ 923.105206][ T3098] RIP: 0033:0x7f4a53159143 [ 923.105226][ T3098] Code: 25 00 03 00 00 e8 9d 50 06 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 53 49 89 ca 64 48 8b 1c 25 10 00 00 00 8b 83 08 03 00 00 <80> 3d 6e a5 29 00 00 75 44 a8 01 75 40 a8 10 75 3c 41 51 4c 8d 9b [ 923.105245][ T3098] RSP: 002b:00007ffc7f670fe0 EFLAGS: 00010246 [ 923.105265][ T3098] RAX: 0000000000000000 RBX: 0000555590281500 RCX: 0000000000000000 [ 923.105280][ T3098] RDX: 00007ffc7f671020 RSI: 0000000000000000 RDI: 0000000000000000 [ 923.105293][ T3098] RBP: 00007f4a53427da0 R08: 0000000000000000 R09: 0000000000000000 [ 923.105308][ T3098] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000e1557 [ 923.105322][ T3098] R13: 00007f4a5342609c R14: 00000000000e12f8 R15: 00007f4a53426090 [ 923.105362][ T3098] [ 923.105557][ T3098] memory: usage 307200kB, limit 307200kB, failcnt 716 [ 923.465565][ T3098] memory+swap: usage 307388kB, limit 9007199254740988kB, failcnt 0 [ 923.473497][ T3098] kmem: usage 307192kB, limit 9007199254740988kB, failcnt 0 [ 923.480791][ T3098] Memory cgroup stats for /syz3: [ 923.481130][ T3098] cache 0 [ 923.489006][ T3098] rss 0 [ 923.491788][ T3098] rss_huge 0 [ 923.494995][ T3098] shmem 0 [ 923.497949][ T3098] mapped_file 0 [ 923.501421][ T3098] dirty 0 [ 923.504382][ T3098] writeback 0 [ 923.507687][ T3098] workingset_refault_anon 5 [ 923.621777][ T3098] workingset_refault_file 2 [ 923.640153][ T3098] swap 192512 [ 923.645259][ T3098] swapcached 221184 [ 923.649110][ T3098] pgpgin 246481 [ 923.659641][ T3098] pgpgout 246479 [ 923.669186][ T3098] pgfault 412694 [ 923.683081][ T3098] pgmajfault 8 [ 923.698284][ T3098] inactive_anon 4096 [ 923.709849][ T3098] active_anon 4096 [ 923.729687][ T3098] inactive_file 0 [ 923.736578][ T3098] active_file 0 [ 923.767258][ T3098] unevictable 0 [ 923.777323][ T3098] hierarchical_memory_limit 314572800 [ 923.795197][ T3098] hierarchical_memsw_limit 9223372036854771712 [ 923.816638][ T3098] total_cache 0 [ 923.826139][ T3098] total_rss 0 [ 923.835476][ T3098] total_rss_huge 0 [ 923.849598][ T3098] total_shmem 0 [ 923.857557][ T3098] total_mapped_file 0 [ 923.867662][ T3098] total_dirty 0 [ 923.877742][ T3098] total_writeback 0 [ 923.883111][ T3098] total_workingset_refault_anon 5 [ 923.893249][ T3098] total_workingset_refault_file 2 [ 923.918051][ T3098] total_swap 192512 [ 923.929383][ T3098] total_swapcached 221184 [ 923.942793][ T3098] total_pgpgin 246489 [ 923.957067][ T3098] total_pgpgout 246487 [ 923.963795][ T3098] total_pgfault 412735 [ 923.972493][ T3098] total_pgmajfault 8 [ 923.979499][ T3098] total_inactive_anon 4096 [ 923.990043][ T3098] total_active_anon 4096 [ 923.998831][ T3098] total_inactive_file 0 [ 924.006172][ T3098] total_active_file 0 [ 924.015568][ T3098] total_unevictable 0 [ 924.027110][ T3141] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7600'. [ 924.027456][ T3098] anon_cost 0 [ 924.053925][ T3098] file_cost 0 [ 924.060538][ T3098] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.7589,pid=3098,uid=0 [ 924.094235][ T3098] Memory cgroup out of memory: Killed process 3098 (syz.3.7589) total-vm:102312kB, anon-rss:1252kB, file-rss:22668kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 924.755775][ T3167] netlink: 'syz.4.7608': attribute type 1 has an invalid length. [ 924.791763][ T3167] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 925.167755][ T3180] netlink: 'syz.0.7614': attribute type 1 has an invalid length. [ 925.184312][ T3180] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7614'. [ 925.274811][ T3182] lo speed is unknown, defaulting to 1000 [ 925.427045][ T3189] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7617'. [ 925.702031][ T3202] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7619'. [ 925.712675][ T3202] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7619'. [ 926.090248][ T3227] netlink: 'syz.0.7623': attribute type 2 has an invalid length. [ 926.099675][ T3227] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7623'. [ 926.386747][ T3244] netlink: 'syz.1.7628': attribute type 3 has an invalid length. [ 926.394613][ T3244] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7628'. [ 926.403617][ T3249] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7629'. [ 926.412576][ T3249] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7629'. [ 927.145484][ T3275] syzkaller0: left promiscuous mode [ 927.151890][ T3275] syzkaller0: left allmulticast mode [ 927.248027][ T3268] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7635'. [ 927.318413][ T3282] netlink: 'syz.3.7637': attribute type 5 has an invalid length. [ 927.326478][ T3282] netlink: 'syz.3.7637': attribute type 9 has an invalid length. [ 927.335945][ T3282] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7637'. [ 927.426413][ T3286] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7638'. [ 927.700349][ T3275] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 928.114277][ T3321] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7647'. [ 928.133260][ T3321] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7647'. [ 928.142155][ T3321] netlink: 'syz.4.7647': attribute type 11 has an invalid length. [ 928.403860][ T3337] gretap0: entered promiscuous mode [ 928.429182][ T3337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 928.437992][ T3337] 8021q: adding VLAN 0 to HW filter on device team0 [ 928.493740][ T3337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 928.605758][ T3337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 928.617052][ T3337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 928.633878][ T3337] veth1_macvtap: left promiscuous mode [ 928.640667][ T3337] veth0_macvtap: left promiscuous mode [ 928.665058][ T3337] veth0_macvtap: entered promiscuous mode [ 928.691428][ T3337] veth1_macvtap: entered promiscuous mode [ 928.706577][ T3337] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 928.715491][ T3337] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 928.724078][ T3337] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 928.732272][ T3337] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 928.744170][ T3337] bridge0: port 2(vlan2) entered blocking state [ 928.750536][ T3337] bridge0: port 2(vlan2) entered forwarding state [ 928.778534][ T3337] 8021q: adding VLAN 0 to HW filter on device bond1 [ 928.811434][ T3337] 8021q: adding VLAN 0 to HW filter on device bond2 [ 928.843935][ T3337] 8021q: adding VLAN 0 to HW filter on device bond5 [ 928.845101][ T3361] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 928.854437][ T3337] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 928.879689][T32691] bridge0: port 1(bridge_slave_0) entered blocking state [ 928.886847][T32691] bridge0: port 1(bridge_slave_0) entered forwarding state [ 928.955789][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 928.966367][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 928.975856][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 928.986734][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 928.996333][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 929.005878][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 929.016695][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 929.026273][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 929.035944][ T3363] ip_tunnel_core: Dead loop on virtual device geneve0 (net 701), fix it urgently! [ 929.982202][ T3386] tunl0: Caught tx_queue_len zero misconfig [ 930.090480][ T3397] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7666'. [ 933.603685][ T3432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7674'. [ 933.625902][ T3434] netlink: 324 bytes leftover after parsing attributes in process `syz.3.7675'. [ 933.637758][ T3434] netlink: 'syz.3.7675': attribute type 1 has an invalid length. [ 933.648904][ T3434] netlink: 9528 bytes leftover after parsing attributes in process `syz.3.7675'. [ 933.715593][ T3441] netlink: 'syz.2.7673': attribute type 11 has an invalid length. [ 933.723442][ T3441] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7673'. [ 933.771986][ T3440] can: request_module (can-proto-0) failed. [ 933.778868][ T3440] netlink: 'syz.3.7677': attribute type 1 has an invalid length. [ 933.811050][ T3440] netlink: 356 bytes leftover after parsing attributes in process `syz.3.7677'. [ 933.820230][ T3440] netlink: 'syz.3.7677': attribute type 1 has an invalid length. [ 933.874810][ T3447] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7679'. [ 933.889219][ T3449] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7679'. [ 934.379958][ T3453] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7681'. [ 934.763684][ T3487] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7691'. [ 934.856647][ T3490] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7692'. [ 935.163310][ T3503] lo speed is unknown, defaulting to 1000 [ 936.733875][ T3560] bridge0: port 1(bridge_slave_0) entered disabled state [ 936.794592][ T3568] net_ratelimit: 1179 callbacks suppressed [ 936.794609][ T3568] IPv6: addrconf: prefix option has invalid lifetime [ 936.838353][ T3560] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 936.853659][ T3560] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 937.660409][T32693] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 937.672513][T32693] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.684553][T32693] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 937.694465][T32693] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.703533][T32693] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 937.712600][T32693] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.721518][T32693] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 937.735133][T32693] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.978785][ T3600] IPVS: ip_vs_edit_dest(): server weight less than zero [ 938.095660][ T3600] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 938.102975][ T3600] IPv6: NLM_F_CREATE should be set when creating new route [ 938.596504][ T3620] sit0: entered promiscuous mode [ 938.743679][ T3620] netlink: 'syz.2.7727': attribute type 1 has an invalid length. [ 938.751521][ T3620] __nla_validate_parse: 4 callbacks suppressed [ 938.751538][ T3620] netlink: 9 bytes leftover after parsing attributes in process `syz.2.7727'. [ 938.766770][ T3622] netlink: 'syz.0.7728': attribute type 13 has an invalid length. [ 938.818716][ T3615] lo speed is unknown, defaulting to 1000 [ 939.007936][ T3609] netlink: 72 bytes leftover after parsing attributes in process `syz.3.7723'. [ 939.286040][ T3642] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7731'. [ 939.367705][ T3648] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7733'. [ 939.412413][ T3624] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7727'. [ 939.525007][ T3642] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7731'. [ 939.957159][ T3669] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7739'. [ 939.967151][ T3669] netlink: 64 bytes leftover after parsing attributes in process `syz.1.7739'. [ 940.126927][ T3678] macvtap0: entered promiscuous mode [ 940.235358][ T3680] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7743'. [ 940.419636][ T3690] tipc: Started in network mode [ 940.424568][ T3690] tipc: Node identity 46a63b75227e, cluster identity 4711 [ 940.456370][ T3690] tipc: Enabled bearer , priority 0 [ 940.506073][ T3692] tipc: Disabling bearer [ 940.642697][ T3698] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7747'. [ 940.652996][ T3698] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 940.721782][ T3698] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 941.443062][ T3731] ip6gre3: entered promiscuous mode [ 941.448436][ T3731] ip6gre3: entered allmulticast mode [ 941.588349][ T3744] netlink: 'syz.3.7761': attribute type 8 has an invalid length. [ 941.638537][ T3749] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 941.702224][ T3755] IPVS: set_ctl: invalid protocol: 59 172.30.0.2:60193 [ 942.067085][ T3774] tc action pedit offset must be on 32 bit boundaries [ 942.418727][ T3787] tcf_pedit_act: 7 callbacks suppressed [ 942.418749][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.432679][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.438758][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.444864][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.450976][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.457054][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.463141][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.469197][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.475283][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.481369][ T3787] tc action pedit 'at' offset 5 out of bounds [ 942.487436][ T3787] 0: reclassify loop, rule prio 0, protocol 800 [ 942.752976][ T3790] lo: Caught tx_queue_len zero misconfig [ 942.760252][ T3790] syzkaller0: Caught tx_queue_len zero misconfig [ 942.912123][ T3798] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 942.928282][ T3800] syzkaller1: entered promiscuous mode [ 942.934320][ T3799] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 942.943117][ T3800] syzkaller1: entered allmulticast mode [ 943.087040][ T3806] syzkaller0: entered promiscuous mode [ 943.092543][ T3806] syzkaller0: entered allmulticast mode [ 943.106356][ T3806] netlink: 'syz.2.7781': attribute type 1 has an invalid length. [ 943.106354][ T3807] netlink: 'syz.2.7781': attribute type 1 has an invalid length. [ 943.152051][ T3807] 8021q: adding VLAN 0 to HW filter on device bond6 [ 943.168324][ T3806] bond6: (slave geneve5): making interface the new active one [ 943.177047][ T3806] bond6: (slave geneve5): Enslaving as an active interface with an up link [ 943.619589][ T3834] netlink: 'syz.3.7787': attribute type 2 has an invalid length. [ 943.931066][ T3852] netlink: 'syz.0.7794': attribute type 3 has an invalid length. [ 943.955695][ T3851] __nla_validate_parse: 9 callbacks suppressed [ 943.955712][ T3851] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7793'. [ 944.050949][ T3861] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7796'. [ 944.169003][ T3861] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7796'. [ 944.232155][ T3866] veth0: entered promiscuous mode [ 944.237983][ T3866] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7797'. [ 944.262263][ T3865] veth0: left promiscuous mode [ 944.378326][ T3868] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 944.482171][ T3875] netlink: 'syz.1.7800': attribute type 1 has an invalid length. [ 944.490080][ T3875] netlink: 'syz.1.7800': attribute type 7 has an invalid length. [ 944.497900][ T3875] netlink: 'syz.1.7800': attribute type 8 has an invalid length. [ 944.506821][ T3875] netlink: 164 bytes leftover after parsing attributes in process `syz.1.7800'. [ 944.516311][ T3875] NCSI netlink: No device for ifindex 1073545264 [ 944.528807][ T3877] netlink: 60 bytes leftover after parsing attributes in process `syz.0.7801'. [ 944.695491][ T3883] syzkaller0: entered promiscuous mode [ 944.704630][ T3883] syzkaller0: entered allmulticast mode [ 947.295809][ T3914] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7812'. [ 947.309032][ T3910] pim6reg: entered allmulticast mode [ 947.344489][ T3912] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7811'. [ 947.370242][ T3912] nbd: must specify at least one socket [ 947.728631][ T3928] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7816'. [ 947.746363][ T3926] pim6reg: entered allmulticast mode [ 947.951797][ T3938] netlink: 100 bytes leftover after parsing attributes in process `syz.1.7819'. [ 947.961823][ T3933] xt_l2tp: v2 doesn't support IP mode [ 947.968118][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.002933][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.008805][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.015056][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.020573][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.037099][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.042609][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.048098][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.053632][ T3933] xt_l2tp: v2 doesn't support IP mode [ 948.236478][ T3957] lo speed is unknown, defaulting to 1000 [ 948.402989][ T3971] sctp: [Deprecated]: syz.2.7829 (pid 3971) Use of int in maxseg socket option. [ 948.402989][ T3971] Use struct sctp_assoc_value instead [ 948.444442][ T3971] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 948.579090][ T3974] syzkaller0: entered promiscuous mode [ 948.584670][ T3974] syzkaller0: entered allmulticast mode [ 948.594419][ T3974] tipc: Enabled bearer , priority 0 [ 948.602848][ T3973] tipc: Resetting bearer [ 948.656785][ T3973] tipc: Disabling bearer [ 948.670629][ T3957] dvmrp0: entered allmulticast mode [ 948.795354][ T3977] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 949.011195][ T3985] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7835'. [ 949.361844][ T4024] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 949.369484][ T4024] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 949.427532][T32693] dvmrp0: left allmulticast mode [ 949.604991][ T4035] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7847'. [ 949.732420][ T4042] netlink: 'syz.2.7849': attribute type 6 has an invalid length. [ 949.861911][ T4045] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 950.030438][ T4045] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 950.241283][ T4056] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7855'. [ 950.264459][ T4058] pim6reg1: entered promiscuous mode [ 950.269883][ T4058] pim6reg1: entered allmulticast mode [ 950.605401][ T4085] openvswitch: netlink: Message has 8 unknown bytes. [ 951.149108][ T4112] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7873'. [ 951.364610][ T4123] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 951.481314][ T4132] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7875'. [ 951.542354][ T4136] netlink: 'syz.1.7877': attribute type 1 has an invalid length. [ 951.555015][ T4136] netlink: 'syz.1.7877': attribute type 12 has an invalid length. [ 951.563958][ T4136] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7877'. [ 951.609168][ T4138] netlink: 'syz.0.7878': attribute type 1 has an invalid length. [ 951.620306][ T4138] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7878'. [ 951.642009][ T4136] netlink: 'syz.1.7877': attribute type 1 has an invalid length. [ 951.661613][ T4136] netlink: 'syz.1.7877': attribute type 12 has an invalid length. [ 951.672574][ T4136] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7877'. [ 951.853702][ T4158] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7883'. [ 952.398811][ T4185] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7891'. [ 952.466101][T32698] IPVS: starting estimator thread 0... [ 952.578649][ T4190] veth0_to_bridge: entered promiscuous mode [ 952.607538][ T4186] IPVS: using max 31 ests per chain, 74400 per kthread [ 952.859215][ T4203] syzkaller0: entered promiscuous mode [ 952.864741][ T4203] syzkaller0: entered allmulticast mode [ 952.886042][ T4203] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 952.891985][ T4203] syzkaller1: linktype set to 780 [ 953.325140][ T4225] xt_TCPMSS: Only works on TCP SYN packets [ 954.227611][ T4236] __nla_validate_parse: 7 callbacks suppressed [ 954.227624][ T4236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7908'. [ 954.330520][ T4239] ip6t_srh: unknown srh invflags BA61 [ 954.407440][ T4244] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7913'. [ 954.481482][ T4248] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7914'. [ 954.499579][ T4248] openvswitch: netlink: Missing key (keys=c0, expected=20100) [ 954.521482][ T4248] team0: No ports can be present during mode change [ 954.693717][ T4256] netlink: 'syz.0.7918': attribute type 1 has an invalid length. [ 954.716098][ T4259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7919'. [ 954.746966][ T4264] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7916'. [ 954.771821][ T4256] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7918'. [ 954.843841][ T4267] netlink: 'syz.1.7920': attribute type 1 has an invalid length. [ 954.863747][ T4267] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7920'. [ 954.938739][ T4259] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 232 [ 955.006341][ T4277] lo speed is unknown, defaulting to 1000 [ 955.082744][ T4280] syzkaller0: entered promiscuous mode [ 955.088331][ T4280] syzkaller0: entered allmulticast mode [ 955.332237][ T4277] netlink: 5 bytes leftover after parsing attributes in process `syz.1.7924'. [ 955.344458][ T4277] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 959.357696][ T4307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7932'. [ 959.524792][ T4314] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 959.623896][ T4309] syzkaller1: entered promiscuous mode [ 959.644983][ T4309] syzkaller1: entered allmulticast mode [ 960.028943][ T4332] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 960.531105][ T4355] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7946'. [ 960.641039][ T4360] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7947'. [ 960.875311][ T4376] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7947'. [ 961.039522][ T4383] syzkaller0: left promiscuous mode [ 961.049349][ T4383] syzkaller0: left allmulticast mode [ 961.100020][ T4385] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7955'. [ 961.109522][ T4385] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7955'. [ 961.140420][ T4385] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7955'. [ 961.149301][ T4385] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7955'. [ 961.210915][ T4385] GUP no longer grows the stack in syz.3.7955 (4385): 200000003000-20000000a000 (200000001000) [ 961.221731][ T4385] CPU: 1 UID: 0 PID: 4385 Comm: syz.3.7955 Not tainted syzkaller #0 PREEMPT(full) [ 961.221755][ T4385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 961.221768][ T4385] Call Trace: [ 961.221777][ T4385] [ 961.221786][ T4385] dump_stack_lvl+0xe8/0x150 [ 961.221820][ T4385] __get_user_pages+0x238c/0x2720 [ 961.221846][ T4385] ? __gup_longterm_locked+0xc3b/0x15c0 [ 961.221906][ T4385] __gup_longterm_locked+0xd52/0x15c0 [ 961.221932][ T4385] ? lock_acquire+0x106/0x350 [ 961.221976][ T4385] gup_fast_fallback+0x1d8c/0x20e0 [ 961.221996][ T4385] ? lockdep_hardirqs_on+0x7a/0x110 [ 961.222055][ T4385] ? __pfx_gup_fast_fallback+0x10/0x10 [ 961.222080][ T4385] ? is_valid_gup_args+0x11f/0x200 [ 961.222104][ T4385] ? get_user_pages_fast+0x4d/0xb0 [ 961.222129][ T4385] __iov_iter_get_pages_alloc+0x378/0xa40 [ 961.222166][ T4385] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 961.222191][ T4385] iov_iter_get_pages2+0x5e/0xa0 [ 961.222225][ T4385] __se_sys_vmsplice+0x7b5/0x1660 [ 961.222273][ T4385] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 961.222307][ T4385] ? __pfx_futex_wake+0x10/0x10 [ 961.222392][ T4385] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.222416][ T4385] do_syscall_64+0x174/0x580 [ 961.222442][ T4385] ? trace_irq_disable+0x3b/0x140 [ 961.222468][ T4385] ? clear_bhb_loop+0x40/0x90 [ 961.222492][ T4385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.222512][ T4385] RIP: 0033:0x7f4a5319e019 [ 961.222530][ T4385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 961.222548][ T4385] RSP: 002b:00007f4a54024028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 961.222569][ T4385] RAX: ffffffffffffffda RBX: 00007f4a53425fa0 RCX: 00007f4a5319e019 [ 961.222584][ T4385] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000007 [ 961.222597][ T4385] RBP: 00007f4a5323500c R08: 0000000000000000 R09: 0000000000000000 [ 961.222609][ T4385] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 961.222620][ T4385] R13: 00007f4a53426038 R14: 00007f4a53425fa0 R15: 00007ffc7f670ee8 [ 961.222651][ T4385] [ 961.229629][ T4393] netlink: 'syz.4.7957': attribute type 4 has an invalid length. [ 962.068570][ T4437] pim6reg: left allmulticast mode [ 962.212822][ T4445] netlink: 'syz.1.7971': attribute type 6 has an invalid length. [ 962.519091][T32698] pim6reg99999999: left allmulticast mode [ 963.574178][T32698] bond0 (unregistering): Released all slaves [ 963.592907][T32698] bond1 (unregistering): Released all slaves [ 963.612634][T32698] bond2 (unregistering): Released all slaves [ 963.659974][T32698] bond3 (unregistering): Released all slaves [ 963.677994][T32698] bond4 (unregistering): Released all slaves [ 963.694784][T32698] bond6 (unregistering): Released all slaves [ 963.785315][ T4486] bridge0: port 1(bridge_slave_0) entered blocking state [ 963.792517][ T4486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 963.800178][ T4486] bridge_slave_0: left allmulticast mode [ 963.805868][ T4486] bridge_slave_0: left promiscuous mode [ 963.836229][ T4486] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.145932][ T4501] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7986'. [ 964.197477][T32698] tipc: Disabling bearer [ 964.229850][T32698] tipc: Disabling bearer [ 964.240163][T32698] tipc: Disabling bearer [ 964.262309][T32698] tipc: Left network mode [ 964.386661][ T4515] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7991'. [ 964.439575][ T4515] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7991'. [ 964.494074][ T4509] netlink: 'syz.4.7990': attribute type 1 has an invalid length. [ 964.501838][ T4509] netlink: 232 bytes leftover after parsing attributes in process `syz.4.7990'. [ 964.637251][ T4509] netlink: 'syz.4.7990': attribute type 1 has an invalid length. [ 964.893586][ T4540] openvswitch: netlink: Unexpected mask (mask=10000010, allowed=10058) [ 965.331930][ T30] audit: type=1804 audit(1785801985.739:20): pid=4556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.8004" name="/newroot/568/cgroup.controllers" dev="tmpfs" ino=2934 res=1 errno=0 [ 965.408939][ T30] audit: type=1800 audit(1785801985.739:21): pid=4556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8004" name="cgroup.controllers" dev="tmpfs" ino=2934 res=0 errno=0 [ 965.439990][ T30] audit: type=1800 audit(1785801985.859:22): pid=4556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8004" name="cgroup.controllers" dev="tmpfs" ino=2934 res=0 errno=0 [ 965.473490][ T4571] netlink: 'syz.0.8006': attribute type 1 has an invalid length. [ 965.559555][ T4573] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8007'. [ 965.591137][ T4571] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 965.591736][ T4573] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8007'. [ 965.609590][ T4577] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8008'. [ 965.677920][ T4577] netlink: 'syz.3.8008': attribute type 4 has an invalid length. [ 965.699360][ T4577] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8008'. [ 966.348300][ T4589] sit0: left promiscuous mode [ 966.470743][ T4589] bridge0: port 3(team0) entered disabled state [ 966.477730][ T4589] bridge0: port 2(bridge_slave_1) entered disabled state [ 966.788848][ T4589] vlan1: left allmulticast mode [ 966.793766][ T4589] veth0_vlan: left allmulticast mode [ 966.799893][ T4589] macvtap0: left promiscuous mode [ 966.805188][ T4589] geneve0: left promiscuous mode [ 966.811645][ T4589] bridge2: left allmulticast mode [ 966.816798][ T4589] bridge3: left allmulticast mode [ 966.822659][ T4589] bridge7: left allmulticast mode [ 966.865372][ T4589] bond6: left promiscuous mode [ 966.917834][ T4589] bond8: left promiscuous mode [ 966.936073][ T4589] vti0: left promiscuous mode [ 966.948768][ T4589] vti0: left allmulticast mode [ 966.987616][ T4589] bond9: left promiscuous mode [ 966.992392][ T4589] bridge11: left promiscuous mode [ 967.006147][ T4589] macvtap1: left allmulticast mode [ 967.059435][ T4591] lo speed is unknown, defaulting to 1000 [ 967.065277][T32695] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 967.104321][T12809] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 967.113144][T12809] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 967.121511][T12809] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 967.435983][ T4627] netlink: 'syz.2.8019': attribute type 2 has an invalid length. [ 967.436682][ T4629] syzkaller0: create flow: hash 2042784956 index 1 [ 967.535621][ T4628] syzkaller0: delete flow: hash 2042784956 index 1 [ 967.831828][ T4646] netlink: 68 bytes leftover after parsing attributes in process `syz.2.8022'. [ 970.418384][ T4665] netlink: 'syz.1.8026': attribute type 1 has an invalid length. [ 970.445940][ T4665] 8021q: adding VLAN 0 to HW filter on device bond5 [ 970.489168][ T4670] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8027'. [ 970.845915][ T4679] bridge0: port 2(vlan2) entered disabled state [ 970.852396][ T4679] bridge0: port 1(bridge_slave_0) entered disabled state [ 970.970791][ T4688] netlink: 'syz.2.8030': attribute type 13 has an invalid length. [ 971.026744][ T4688] netlink: 'syz.2.8030': attribute type 17 has an invalid length. [ 971.301131][ T4679] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 971.328840][ T4679] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 971.622660][ T4679] batman_adv: batadv0: Interface deactivated: gretap1 [ 971.929878][ T4685] veth0_to_bridge: left promiscuous mode [ 971.960789][ T4685] veth1_vlan: left promiscuous mode [ 971.966796][ T4685] veth0_vlan: left promiscuous mode [ 971.973052][ T4685] veth0_vlan: entered promiscuous mode [ 971.980056][ T4685] veth1_vlan: entered promiscuous mode [ 972.025052][ T4685] 8021q: adding VLAN 0 to HW filter on device eth0 [ 972.032467][ T4685] 8021q: adding VLAN 0 to HW filter on device eth1 [ 972.039952][ T4685] 8021q: adding VLAN 0 to HW filter on device eth2 [ 972.047416][ T4685] 8021q: adding VLAN 0 to HW filter on device eth3 [ 972.078210][ T4685] 8021q: adding VLAN 0 to HW filter on device bond1 [ 972.085349][ T4685] bond1: entered promiscuous mode [ 972.090783][ T4685] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 972.120655][ T4685] 8021q: adding VLAN 0 to HW filter on device bond2 [ 972.132065][ T4685] batman_adv: batadv0: Interface activated: ip6gretap1 [ 972.143395][ T4685] 8021q: adding VLAN 0 to HW filter on device bond3 [ 972.172440][ T4685] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 972.184273][ T4685] nicvf0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 972.220873][T32691] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 972.233682][T32691] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 972.272596][ T4688] gretap0: left promiscuous mode [ 972.304335][ T4688] sit0: left promiscuous mode [ 972.330526][ T4688] bridge0: left allmulticast mode [ 972.362260][ T4688] 8021q: adding VLAN 0 to HW filter on device bond0 [ 972.370212][ T4688] 8021q: adding VLAN 0 to HW filter on device team0 [ 972.379086][ T4688] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 972.402134][ T4688] bridge0: port 1(bridge_slave_0) entered blocking state [ 972.409229][ T4688] bridge0: port 1(bridge_slave_0) entered forwarding state [ 972.427648][ T4688] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 972.436988][ T4688] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 972.479587][ T4688] veth1_macvtap: left promiscuous mode [ 972.487210][ T4688] veth0_macvtap: left promiscuous mode [ 972.499762][ T4688] veth0_macvtap: entered promiscuous mode [ 972.515027][ T4688] veth1_macvtap: entered promiscuous mode [ 972.528695][ T4688] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 972.539895][ T4688] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 972.583984][ T4688] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 972.595703][ T4688] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 972.608764][ T4688] bridge0: port 2(vlan2) entered blocking state [ 972.615086][ T4688] bridge0: port 2(vlan2) entered forwarding state [ 972.622567][ T4688] gretap0: entered promiscuous mode [ 972.629961][ T4688] batman_adv: batadv0: Interface activated: gretap1 [ 972.644014][ T4688] 8021q: adding VLAN 0 to HW filter on device bond1 [ 972.663953][ T4688] gretap2: left allmulticast mode [ 972.677112][ T4688] 8021q: adding VLAN 0 to HW filter on device bond2 [ 972.714699][ T4688] bond3: left promiscuous mode [ 972.722105][ T4688] 8021q: adding VLAN 0 to HW filter on device bond3 [ 972.731355][ T4688] geneve3: left promiscuous mode [ 972.736878][ T4688] geneve3: left allmulticast mode [ 972.757923][ T4688] gretap3: left promiscuous mode [ 972.768595][ T4688] bond4: left promiscuous mode [ 972.774113][ T4688] ip6gre2: left promiscuous mode [ 972.782031][ T4688] 8021q: adding VLAN 0 to HW filter on device bond4 [ 972.792039][ T4688] bond5: left promiscuous mode [ 972.797201][ T4688] 8021q: adding VLAN 0 to HW filter on device bond5 [ 972.812494][ T4688] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 972.831964][ T4695] hsr0: entered promiscuous mode [ 972.895828][ T4701] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8035'. [ 972.947610][T32707] ip6_tunnel:  xmit: Local address not yet configured! [ 972.968199][T32707] ip6_tunnel:  xmit: Local address not yet configured! [ 972.977176][T32707] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 972.984851][T32707] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 972.995571][T32707] ip6_tunnel: - xmit: Local address not yet configured! [ 973.018577][ T3573] ip6_tunnel:  xmit: Local address not yet configured! [ 973.030984][ T3573] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 973.126275][ T5636] ip6_tunnel:  xmit: Local address not yet configured! [ 973.180214][T32699] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 973.188940][T32699] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 973.347237][ T5636] ip6_tunnel:  xmit: Local address not yet configured! [ 973.417955][T32698] hsr_slave_0: left promiscuous mode [ 973.423980][T32698] hsr_slave_1: left promiscuous mode [ 973.454641][T32698] veth1_macvtap: left promiscuous mode [ 973.460668][T32698] veth0_macvtap: left allmulticast mode [ 973.466406][T32698] veth0_macvtap: left promiscuous mode [ 973.472064][T32698] veth1_vlan: left promiscuous mode [ 973.477391][T32698] veth0_vlan: left promiscuous mode [ 973.570724][ T3573] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 973.945336][T32113] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 973.955045][T32113] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 973.964413][T32113] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 973.972233][T32113] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 973.981766][T32113] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 974.570181][T32685] smbdirect: ib_dev[syz2] removed [ 974.572071][T32699] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 974.600204][T32699] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 974.699116][ T3573] lo speed is unknown, defaulting to 1000 [ 974.699265][ T4728] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 974.707427][ T3573] infiniband syz2: ib_query_port failed (-19) [ 974.742040][T32707] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 974.761314][T32707] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 974.871381][T27178] bond2: (slave syz_tun): Removing an active aggregator [ 974.889041][T27178] bond2: (slave syz_tun): Releasing backup interface [ 974.931933][ T4750] netlink: 'syz.0.8046': attribute type 5 has an invalid length. [ 975.070796][T32682] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 975.094758][T32682] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 975.148837][T32682] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 975.192487][T32682] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 975.233271][ T4767] sctp: [Deprecated]: syz.0.8051 (pid 4767) Use of int in max_burst socket option deprecated. [ 975.233271][ T4767] Use struct sctp_assoc_value instead [ 976.022506][ T50] Bluetooth: hci0: command tx timeout [ 976.281195][ T4799] xt_cluster: node mask cannot exceed total number of nodes [ 976.464086][ T4732] bridge0: port 1(bridge_slave_0) entered blocking state [ 976.490141][ T4732] bridge0: port 1(bridge_slave_0) entered disabled state [ 976.519413][ T4732] bridge_slave_0: entered allmulticast mode [ 976.532036][ T4732] bridge_slave_0: entered promiscuous mode [ 976.557341][ T4804] veth8: entered promiscuous mode [ 976.739173][ T4732] bridge0: port 2(bridge_slave_1) entered blocking state [ 976.764901][ T4732] bridge0: port 2(bridge_slave_1) entered disabled state [ 976.800970][ T4732] bridge_slave_1: entered allmulticast mode [ 976.825096][ T4732] bridge_slave_1: entered promiscuous mode [ 976.935388][T32698] IPVS: stop unused estimator thread 0... [ 976.988328][ T4732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 977.037276][ T4732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 977.178439][ T4732] team0: Port device team_slave_0 added [ 977.211942][ T4732] team0: Port device team_slave_1 added [ 977.327678][ T4732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 977.352829][ T4732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 977.431184][ T4732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 977.460619][ T4732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 977.480392][ T4732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 977.564264][ T4732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 977.746172][ T4732] hsr_slave_0: entered promiscuous mode [ 977.762498][ T4732] hsr_slave_1: entered promiscuous mode [ 977.775721][ T4732] debugfs: 'hsr0' already exists in 'hsr' [ 977.793947][ T4732] Cannot create hsr debugfs directory [ 978.066136][ T4861] netlink: 'syz.2.8052': attribute type 2 has an invalid length. [ 978.077716][ T4863] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8064'. [ 978.109546][ T50] Bluetooth: hci0: command tx timeout [ 978.158569][ T4732] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 978.175201][ T4732] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.205700][ T4869] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8065'. [ 978.375627][ T4732] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 978.386496][ T4732] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.462301][ T4877] netlink: 68 bytes leftover after parsing attributes in process `syz.1.8069'. [ 978.497229][ T4732] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 978.523086][ T4732] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.557438][ T4881] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8069'. [ 978.665809][ T4732] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 978.687800][ T4732] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.724452][ T4888] syzkaller0: entered promiscuous mode [ 978.730373][ T4888] syzkaller0: entered allmulticast mode [ 978.881784][ T4891] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8071'. [ 979.164818][ T4894] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8071'. [ 979.415621][ T4732] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 979.459012][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 979.480529][ T4732] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 979.498823][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 979.514576][ T4732] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 979.532821][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 979.549816][ T4732] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 979.578522][ T4732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 979.618613][ T4924] tipc: Enabled bearer , priority 0 [ 979.649991][ T4924] syzkaller0: entered promiscuous mode [ 979.666314][ T4924] syzkaller0: entered allmulticast mode [ 979.737610][ T4924] tipc: Resetting bearer [ 979.794170][ T4923] tipc: Resetting bearer [ 979.824122][ T4923] tipc: Disabling bearer [ 979.837195][ T4940] team0: Caught tx_queue_len zero misconfig [ 979.902413][ T4732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 979.947811][ T4732] 8021q: adding VLAN 0 to HW filter on device team0 [ 979.969076][T32691] bridge0: port 1(bridge_slave_0) entered blocking state [ 979.976273][T32691] bridge0: port 1(bridge_slave_0) entered forwarding state [ 980.068251][T32707] bridge0: port 2(bridge_slave_1) entered blocking state [ 980.075472][T32707] bridge0: port 2(bridge_slave_1) entered forwarding state [ 980.180445][ T50] Bluetooth: hci0: command tx timeout [ 980.492799][ T4972] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 980.593640][ T4972] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 980.649672][ T4980] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8087'. [ 980.684429][T32682] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 980.697606][ T4980] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8087'. [ 980.704043][T32682] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 980.729766][T32682] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 980.769743][T32695] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 980.871841][ T4732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 980.929686][ T4732] veth0_vlan: entered promiscuous mode [ 980.945884][ T4732] veth1_vlan: entered promiscuous mode [ 981.015495][ T4732] veth0_macvtap: entered promiscuous mode [ 981.025940][ T4732] veth1_macvtap: entered promiscuous mode [ 981.043482][ T4732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 981.058277][ T4732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 981.110565][T32682] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.190569][T32693] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.202239][T32693] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.218826][T32693] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.229585][T32698] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 981.255203][T32698] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 981.297880][T32707] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 981.314309][T32707] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 981.614550][ T5006] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8092'. [ 981.853975][ T5018] netlink: 'syz.1.8098': attribute type 1 has an invalid length. [ 981.920203][ T5018] 8021q: adding VLAN 0 to HW filter on device bond6 [ 982.017373][ T5018] macvlan3: entered promiscuous mode [ 982.033051][ T5018] macvlan3: entered allmulticast mode [ 982.050882][ T5018] bond6: entered promiscuous mode [ 982.056618][ T5018] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 982.256423][ T5018] bond6: left promiscuous mode [ 982.272685][ T50] Bluetooth: hci0: command tx timeout [ 982.411242][ T5037] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8100'. [ 982.634858][ T5043] team0: Port device team_slave_0 removed [ 982.741106][ C0] ip6_tnl_xmit_ctl: 4 callbacks suppressed [ 982.741123][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 982.938453][ T5066] netlink: 'syz.0.8110': attribute type 3 has an invalid length. [ 982.970306][ T5064] batadv0: entered promiscuous mode [ 982.984785][ T5064] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 983.131147][ T5070] can: request_module (can-proto-0) failed. [ 983.284331][ T5084] __nla_validate_parse: 2 callbacks suppressed [ 983.284351][ T5084] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8114'. [ 983.427509][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.449611][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.465476][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.480836][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.500034][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.519597][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.528789][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.565612][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.603225][ T5091] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 983.977231][T32113] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 983.990841][T32113] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 984.004069][T32113] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 984.015904][T32113] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 984.025316][T32113] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 984.327528][ T5099] bond11: Removing last arp target with arp_interval on [ 984.622942][ T5107] bridge0: port 2(vlan4) entered blocking state [ 984.646090][ T5107] bridge0: port 2(vlan4) entered disabled state [ 984.655041][ T5107] vlan4: entered allmulticast mode [ 984.665383][ T5107] geneve0: entered allmulticast mode [ 984.674842][ T5107] vlan4: entered promiscuous mode [ 984.689225][ T5107] geneve0: entered promiscuous mode [ 985.299741][ C1] ip6_tunnel: - xmit: Local address not yet configured! [ 985.715383][ T5152] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20001 [ 985.939813][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 985.947750][ C1] ip6_tunnel:  xmit: Local address not yet configured! [ 986.036922][ T5167] netlink: 'syz.3.8132': attribute type 1 has an invalid length. [ 986.180876][T32113] Bluetooth: hci1: command tx timeout [ 986.228227][ T5102] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.235634][ T5102] bridge0: port 1(bridge_slave_0) entered disabled state [ 986.244730][ T5102] bridge_slave_0: entered allmulticast mode [ 986.259582][ T5102] bridge_slave_0: entered promiscuous mode [ 986.268912][ T5102] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.290061][ T5102] bridge0: port 2(bridge_slave_1) entered disabled state [ 986.304774][ T5102] bridge_slave_1: entered allmulticast mode [ 986.321787][ T5102] bridge_slave_1: entered promiscuous mode [ 986.342350][ T5184] netlink: 'syz.0.8134': attribute type 1 has an invalid length. [ 986.371648][ T5184] netlink: 'syz.0.8134': attribute type 3 has an invalid length. [ 986.455479][ T5102] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 986.474144][ T5102] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 986.514028][ T5186] syzkaller0: entered promiscuous mode [ 986.529744][ T5186] syzkaller0: entered allmulticast mode [ 986.541187][ T5102] team0: Port device team_slave_0 added [ 986.565026][ T5102] team0: Port device team_slave_1 added [ 986.573839][ T5187] tipc: Started in network mode [ 986.578971][ T5187] tipc: Node identity ba74c49379c7, cluster identity 4711 [ 986.591607][ T5187] tipc: Enabled bearer , priority 0 [ 986.624961][ T5186] tipc: Enabling of bearer rejected, already enabled [ 986.651278][ T5185] tipc: Resetting bearer [ 986.700500][ T5185] tipc: Disabling bearer [ 986.722152][ T5102] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 986.729120][ T5102] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.760108][ T5102] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 986.782319][ T5102] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 986.791690][ T5102] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.818118][ T5102] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 986.917273][ T5102] hsr_slave_0: entered promiscuous mode [ 986.924347][ T5102] hsr_slave_1: entered promiscuous mode [ 986.935302][ T5102] debugfs: 'hsr0' already exists in 'hsr' [ 986.942518][ T5102] Cannot create hsr debugfs directory [ 986.977607][ T5198] macvlan2: entered allmulticast mode [ 986.986291][ T5198] team0: Device macvlan2 is already an upper device of the team interface [ 987.025353][ T5200] batadv_slave_1: entered promiscuous mode [ 987.445104][ T5102] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 987.469628][ T5102] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 987.489717][ T5102] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 987.784964][ T5102] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 987.797535][ T5102] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 987.809216][ T5102] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 987.851571][ T5226] netlink: 'syz.4.8148': attribute type 3 has an invalid length. [ 987.985666][ T5102] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 987.996609][ T5102] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 988.010327][ T5102] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 988.166210][ T5102] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 988.178791][ T5102] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 988.189446][ T5102] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 988.260732][T32113] Bluetooth: hci1: command tx timeout [ 988.359001][ T5249] FAULT_INJECTION: forcing a failure. [ 988.359001][ T5249] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 988.379877][ T5247] netlink: 'syz.0.8154': attribute type 4 has an invalid length. [ 988.409227][ T5249] CPU: 1 UID: 0 PID: 5249 Comm: syz.3.8155 Not tainted syzkaller #0 PREEMPT(full) [ 988.409249][ T5249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 988.409262][ T5249] Call Trace: [ 988.409269][ T5249] [ 988.409276][ T5249] dump_stack_lvl+0xe8/0x150 [ 988.409306][ T5249] should_fail_ex+0x40c/0x560 [ 988.409331][ T5249] _copy_from_iter+0x1d3/0x1660 [ 988.409353][ T5249] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 988.409375][ T5249] ? rcu_is_watching+0x15/0xb0 [ 988.409390][ T5249] ? trace_kmem_cache_alloc+0x29/0xe0 [ 988.409411][ T5249] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 988.409431][ T5249] ? __pfx__copy_from_iter+0x10/0x10 [ 988.409455][ T5249] ? __alloc_skb+0x276/0x7a0 [ 988.409474][ T5249] ? __alloc_skb+0x276/0x7a0 [ 988.409500][ T5249] ? netlink_sendmsg+0x650/0xb40 [ 988.409524][ T5249] ? skb_put+0x112/0x210 [ 988.409548][ T5249] netlink_sendmsg+0x6c0/0xb40 [ 988.409582][ T5249] ? __pfx_netlink_sendmsg+0x10/0x10 [ 988.409610][ T5249] ? aa_sock_msg_perm+0xf1/0x1b0 [ 988.409638][ T5249] ? __pfx_netlink_sendmsg+0x10/0x10 [ 988.409661][ T5249] sock_sendmsg_nosec+0x13a/0x180 [ 988.409694][ T5249] ____sys_sendmsg+0x54e/0x850 [ 988.409723][ T5249] ? __pfx_____sys_sendmsg+0x10/0x10 [ 988.409756][ T5249] ? import_iovec+0x73/0xa0 [ 988.409778][ T5249] ___sys_sendmsg+0x2a5/0x360 [ 988.409801][ T5249] ? __lock_acquire+0x683/0x2cf0 [ 988.409832][ T5249] ? __pfx____sys_sendmsg+0x10/0x10 [ 988.409890][ T5249] ? __fget_files+0x2a/0x420 [ 988.409915][ T5249] ? __fget_files+0x3a2/0x420 [ 988.409950][ T5249] __x64_sys_sendmsg+0x1b1/0x290 [ 988.409978][ T5249] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 988.410020][ T5249] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.410040][ T5249] do_syscall_64+0x174/0x580 [ 988.410067][ T5249] ? trace_irq_disable+0x3b/0x140 [ 988.410092][ T5249] ? clear_bhb_loop+0x40/0x90 [ 988.410122][ T5249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.410141][ T5249] RIP: 0033:0x7ff720d9e019 [ 988.410159][ T5249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 988.410175][ T5249] RSP: 002b:00007ff721cfa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 988.410195][ T5249] RAX: ffffffffffffffda RBX: 00007ff721025fa0 RCX: 00007ff720d9e019 [ 988.410208][ T5249] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 988.410221][ T5249] RBP: 00007ff721cfa090 R08: 0000000000000000 R09: 0000000000000000 [ 988.410232][ T5249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 988.410243][ T5249] R13: 00007ff721026038 R14: 00007ff721025fa0 R15: 00007ffc55bf2cd8 [ 988.410275][ T5249] [ 988.678649][ T5245] netlink: 'syz.4.8153': attribute type 5 has an invalid length. [ 988.702133][ T5102] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 988.753302][ T5102] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 988.761978][ T5102] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 988.773186][ T5102] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 988.791227][ T5102] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 988.814881][ T5102] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 988.824469][ T5102] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 988.851266][ T5102] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 988.888469][ T5253] __nla_validate_parse: 69 callbacks suppressed [ 988.888485][ T5253] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8157'. [ 988.921624][ T5262] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8158'. [ 988.929715][ T5253] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8157'. [ 988.941315][ T5253] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8157'. [ 989.095199][ T5102] 8021q: adding VLAN 0 to HW filter on device bond0 [ 989.147092][ T5102] 8021q: adding VLAN 0 to HW filter on device team0 [ 989.201793][T32693] bridge0: port 1(bridge_slave_0) entered blocking state [ 989.208968][T32693] bridge0: port 1(bridge_slave_0) entered forwarding state [ 989.219142][ T5276] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8160'. [ 989.248765][ T5276] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8160'. [ 989.262896][T32685] bridge0: port 2(bridge_slave_1) entered blocking state [ 989.270058][T32685] bridge0: port 2(bridge_slave_1) entered forwarding state [ 989.305660][ T5276] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8160'. [ 989.386847][ T5286] netlink: 'syz.0.8161': attribute type 2 has an invalid length. [ 989.677796][ T5301] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8164'. [ 989.720311][ T5301] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8164'. [ 990.207648][ T5316] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8168'. [ 990.348272][T32113] Bluetooth: hci1: command tx timeout [ 990.453836][ T5102] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 990.507156][ T5326] batman_adv: batadv0: Adding interface: ip6gretap1 [ 990.514760][ T5326] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 990.545455][ T5326] batman_adv: batadv0: Not using interface ip6gretap1 (retrying later): interface not active [ 990.573160][ T5332] netlink: 'syz.0.8173': attribute type 1 has an invalid length. [ 990.640703][ T5332] 8021q: adding VLAN 0 to HW filter on device bond12 [ 990.682626][ T5332] bond12: (slave bridge0): Enslaving as an active interface with a down link [ 990.706766][ T5102] veth0_vlan: entered promiscuous mode [ 990.733394][ T5102] veth1_vlan: entered promiscuous mode [ 990.883543][ T5102] veth0_macvtap: entered promiscuous mode [ 990.906507][ T5102] veth1_macvtap: entered promiscuous mode [ 990.926861][ T5102] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 990.943608][ T5102] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 990.981404][T32695] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.004117][T32695] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.043430][T32691] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.056017][T32707] tipc: Subscription rejected, illegal request [ 991.075988][T32691] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 991.352215][T32699] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 991.381251][T32699] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 991.392669][ T5359] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 991.435571][ T5363] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 991.446468][T32699] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 991.471513][T32699] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 991.710200][ T5371] IPVS: set_ctl: invalid protocol: 51 0.0.0.0:20004 [ 992.041484][ T5381] bridge0: port 1(bridge_slave_0) entered disabled state [ 992.380015][ T5389] netlink: 'syz.0.8182': attribute type 1 has an invalid length. [ 992.420080][T32113] Bluetooth: hci1: command tx timeout [ 992.468368][ T5371] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 992.483220][ T5389] bond13: entered promiscuous mode [ 992.522779][ T5389] 8021q: adding VLAN 0 to HW filter on device bond13 [ 992.566606][ T5394] bond13 (unregistering): Released all slaves [ 993.546249][ T5431] IPv6: NLM_F_CREATE should be specified when creating new route [ 993.748948][ T5430] "syz.4.8193" (5430) uses obsolete ecb(arc4) skcipher [ 993.780838][T32113] Bluetooth: hci0: command 0x0401 tx timeout [ 994.202191][ T5463] netlink: 'syz.4.8201': attribute type 2 has an invalid length. [ 994.258611][ T5466] __nla_validate_parse: 7 callbacks suppressed [ 994.258628][ T5466] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8202'. [ 994.443568][ T5472] openvswitch: netlink: IP tunnel attribute has 5393 unknown bytes. [ 994.496728][ T5472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8204'. [ 994.663847][ T5482] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8206'. [ 994.693307][ T5483] "syz.0.8206" (5483) uses obsolete ecb(arc4) skcipher [ 994.705275][ T5482] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8206'. [ 995.436866][ T5512] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 995.557407][ T5523] netlink: 'syz.3.8219': attribute type 2 has an invalid length. [ 995.601612][ T5527] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8214'. [ 995.645667][ T5531] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8218'. [ 995.899980][ T5521] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8218'. [ 995.920971][ T5521] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8218'. [ 995.949804][T32685] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 995.973040][T32685] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 995.994197][T32685] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.023981][T32685] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.140024][ T5542] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8221'. [ 996.289070][ T5555] IPVS: set_ctl: invalid protocol: 135 172.20.20.187:20000 [ 996.370904][ T5558] netlink: 'syz.0.8229': attribute type 5 has an invalid length. [ 996.548991][ T5569] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8232'. [ 997.457862][ T5588] gretap1: entered allmulticast mode [ 997.779130][ T5615] netdevsim netdevsim1 : renamed from netdevsim0 (while UP) [ 998.025708][ T5626] netlink: 'syz.1.8248': attribute type 7 has an invalid length. [ 998.128082][ T5631] bond0: entered promiscuous mode [ 998.145929][ T5631] bond_slave_0: entered promiscuous mode [ 998.180044][ T5631] bond_slave_1: entered promiscuous mode [ 998.197528][ T5631] batadv0: entered promiscuous mode [ 998.241241][ T5631] debugfs: 'hsr1' already exists in 'hsr' [ 998.273921][ T5631] Cannot create hsr debugfs directory [ 998.317252][ T5631] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 998.519582][ T5631] bond0: left promiscuous mode [ 998.525217][ T5631] bond_slave_0: left promiscuous mode [ 998.531369][ T5631] bond_slave_1: left promiscuous mode [ 998.537860][ T5631] batadv0: left promiscuous mode [ 998.588811][ T5635] netlink: 'syz.3.8249': attribute type 2 has an invalid length. [ 998.609238][ T5635] bond0: entered promiscuous mode [ 998.629319][ T5635] bond_slave_0: entered promiscuous mode [ 998.654967][ T5635] bond_slave_1: entered promiscuous mode [ 998.674056][ T5635] batadv0: entered promiscuous mode [ 998.688530][ T5656] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 998.691658][ T5635] debugfs: 'hsr1' already exists in 'hsr' [ 998.719466][ T5635] Cannot create hsr debugfs directory [ 998.729855][ T5635] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 998.752027][ T5635] bond0: left promiscuous mode [ 998.765836][ T5635] bond_slave_0: left promiscuous mode [ 998.780859][ T5635] bond_slave_1: left promiscuous mode [ 998.794768][ T5635] batadv0: left promiscuous mode [ 999.083680][ T5666] syzkaller0: entered promiscuous mode [ 999.101509][ T5666] syzkaller0: entered allmulticast mode [ 999.109994][ T5667] netlink: 'syz.0.8254': attribute type 2 has an invalid length. [ 999.202226][ T5665] IPVS: Unknown mcast interface: rose0 [ 999.421544][ T5684] __nla_validate_parse: 2 callbacks suppressed [ 999.421562][ T5684] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8255'. [ 999.548934][ T5677] xt_CT: No such helper "netbios-ns" [ 999.738161][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 999.759500][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 999.769070][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 999.785507][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 999.794603][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 999.914623][ T5701] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8259'. [ 1000.762934][ T5691] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8258'. [ 1001.300062][ C1] ip6_tunnel: - xmit: Local address not yet configured! [ 1001.331762][ T5692] bridge0: port 1(bridge_slave_0) entered blocking state [ 1001.339069][ T5692] bridge0: port 1(bridge_slave_0) entered disabled state [ 1001.357864][ T5692] bridge_slave_0: entered allmulticast mode [ 1001.386374][ T5692] bridge_slave_0: entered promiscuous mode [ 1001.403423][ T5692] bridge0: port 2(bridge_slave_1) entered blocking state [ 1001.429415][ T5692] bridge0: port 2(bridge_slave_1) entered disabled state [ 1001.444218][ T5692] bridge_slave_1: entered allmulticast mode [ 1001.468096][ T5692] bridge_slave_1: entered promiscuous mode [ 1001.608089][ T5692] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1001.647209][ T5692] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1001.728292][ T5780] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8269'. [ 1001.738491][ T5780] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8269'. [ 1001.767458][ T5692] team0: Port device team_slave_0 added [ 1001.790446][ T5692] team0: Port device team_slave_1 added [ 1001.818783][ T5782] block nbd3: Unsupported socket: should be TCP or UNIX. [ 1001.823382][T32682] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1001.859595][ T50] Bluetooth: hci4: command tx timeout [ 1001.929492][T32707] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1002.041730][T32707] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1002.053991][ T5692] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1002.069529][ T5692] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1002.124879][ T5692] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1002.146868][ T5692] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1002.167288][ T5692] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1002.229332][ T5692] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1002.274983][ T5791] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8273'. [ 1002.316298][ T5791] erspan0: entered promiscuous mode [ 1002.361378][ T5692] hsr_slave_0: entered promiscuous mode [ 1002.371615][ T5692] hsr_slave_1: entered promiscuous mode [ 1002.378048][ T5692] debugfs: 'hsr0' already exists in 'hsr' [ 1002.384388][ T5692] Cannot create hsr debugfs directory [ 1002.469426][T32707] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1002.768998][ T5803] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8277'. [ 1002.836319][ T5805] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8277'. [ 1003.140082][ T5811] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8280'. [ 1003.149577][ T5811] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8280'. [ 1003.237187][ T5813] netlink: 'syz.1.8281': attribute type 2 has an invalid length. [ 1003.335288][ T5815] can: request_module (can-proto-0) failed. [ 1003.445804][ T5822] netlink: 'syz.3.8284': attribute type 21 has an invalid length. [ 1003.490881][ T5822] netlink: 'syz.3.8284': attribute type 21 has an invalid length. [ 1003.718581][ T5834] netlink: 'syz.3.8288': attribute type 1 has an invalid length. [ 1003.769121][ T5834] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1003.796241][ T5692] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1003.823075][ T5692] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1003.831184][ T5692] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1003.843712][ T5692] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1003.857766][ T5692] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1003.867669][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1003.896871][ T5692] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1003.915664][ T5692] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1003.932702][ T5692] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1003.941073][ T50] Bluetooth: hci4: command tx timeout [ 1004.033035][ T5849] syzkaller0: entered promiscuous mode [ 1004.038680][ T5849] syzkaller0: entered allmulticast mode [ 1004.053388][ T5850] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1004.501629][ C1] ip6_tunnel:  xmit: Local address not yet configured! [ 1004.543869][ T5861] netlink: 'syz.2.8294': attribute type 2 has an invalid length. [ 1004.763547][ T5692] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1004.796172][ T5872] __nla_validate_parse: 8 callbacks suppressed [ 1004.796188][ T5872] netlink: 172 bytes leftover after parsing attributes in process `syz.1.8298'. [ 1004.803524][ T5873] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8300'. [ 1004.855403][ T5873] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8300'. [ 1004.873942][ T5692] 8021q: adding VLAN 0 to HW filter on device team0 [ 1004.887911][T32685] bridge0: port 1(bridge_slave_0) entered blocking state [ 1004.895121][T32685] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1004.948819][T31041] bridge0: port 2(bridge_slave_1) entered blocking state [ 1004.956002][T31041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1005.718948][ T5902] bridge2: entered promiscuous mode [ 1005.744958][ T5902] bridge2: entered allmulticast mode [ 1006.019569][ T50] Bluetooth: hci4: command tx timeout [ 1006.107930][ T5692] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1006.181666][ T5692] veth0_vlan: entered promiscuous mode [ 1006.211026][ T5692] veth1_vlan: entered promiscuous mode [ 1006.322690][ T5692] veth0_macvtap: entered promiscuous mode [ 1006.361947][ T5692] veth1_macvtap: entered promiscuous mode [ 1006.490803][ T5911] netlink: 'syz.3.8307': attribute type 1 has an invalid length. [ 1006.502568][ T5692] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1006.581099][ T5911] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1006.597427][ T5692] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1006.659980][ T5914] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1006.672059][ T5914] bond2: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 1006.683717][ T5914] bond2: (slave ip6gre0): Error -95 calling set_mac_address [ 1006.710335][ T5926] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1006.763186][T32707] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.773344][ T5914] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8307'. [ 1006.881489][T32691] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.896550][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8313'. [ 1006.909504][T32691] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1006.941478][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8313'. [ 1007.072856][T32691] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.166670][T31041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1007.191374][T31041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1007.268437][T32682] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1007.302248][T32682] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1007.492524][ T5954] netlink: 'syz.3.8316': attribute type 1 has an invalid length. [ 1007.514965][ T5954] netlink: 220 bytes leftover after parsing attributes in process `syz.3.8316'. [ 1008.050626][ T5977] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8317'. [ 1008.099969][ T50] Bluetooth: hci4: command tx timeout [ 1008.108305][ T5980] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8318'. [ 1008.500397][ T5986] netlink: 'syz.1.8320': attribute type 2 has an invalid length. [ 1008.670024][ T5992] xt_bpf: check failed: parse error [ 1008.961391][ T5996] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8322'. [ 1009.109457][ T6000] netlink: 'syz.0.8324': attribute type 1 has an invalid length. [ 1009.181867][ T6001] bridge0: port 2(bridge_slave_1) entered disabled state [ 1009.191384][ T6001] bridge0: port 1(bridge_slave_0) entered disabled state [ 1009.516032][ T6007] netlink: 'syz.3.8325': attribute type 1 has an invalid length. [ 1010.005527][ T6024] syzkaller0: entered promiscuous mode [ 1010.013319][ T6024] syzkaller0: entered allmulticast mode [ 1010.043894][ T6030] __nla_validate_parse: 5 callbacks suppressed [ 1010.043924][ T6030] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8333'. [ 1010.087262][ T6030] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8333'. [ 1010.101773][ T6030] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8333'. [ 1010.145081][ T6036] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8335'. [ 1010.154782][ T6036] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8335'. [ 1010.264493][ T6040] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8337'. [ 1010.284253][ T6038] netlink: 164 bytes leftover after parsing attributes in process `syz.3.8336'. [ 1010.303590][ T6044] netlink: 'syz.0.8338': attribute type 2 has an invalid length. [ 1010.311539][ T6038] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8336'. [ 1010.467820][ T6052] netlink: 'syz.3.8340': attribute type 15 has an invalid length. [ 1013.623384][ T6094] netlink: 'syz.4.8352': attribute type 2 has an invalid length. [ 1013.658175][ T6096] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8353'. [ 1014.346186][ T6109] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8355'. [ 1014.759661][ T6120] netlink: 'syz.3.8359': attribute type 5 has an invalid length. [ 1015.048104][ T6138] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1015.091201][T32707] bridge0: port 1(bridge_slave_0) entered blocking state [ 1015.098342][T32707] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1015.238652][ T6156] netlink: 'syz.2.8368': attribute type 2 has an invalid length. [ 1015.564116][ T6165] __nla_validate_parse: 1 callbacks suppressed [ 1015.564132][ T6165] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8371'. [ 1015.588072][ T6165] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8371'. [ 1015.904425][ T6166] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8371'. [ 1015.916957][ T6166] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8371'. [ 1016.067136][ T6169] netlink: 128 bytes leftover after parsing attributes in process `syz.4.8372'. [ 1016.087716][ T6169] netlink: 'syz.4.8372': attribute type 1 has an invalid length. [ 1016.227222][ T6176] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8372'. [ 1016.254007][ T6176] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8372'. [ 1016.323352][ T6169] bond4: (slave geneve4): making interface the new active one [ 1016.335880][ T6169] bond4: (slave geneve4): Enslaving as an active interface with an up link [ 1016.359791][T32684] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1016.377797][T32684] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1016.398892][T32684] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1016.412526][T32684] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1016.770913][ T6198] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 1016.885262][ T6200] netlink: 'syz.3.8383': attribute type 2 has an invalid length. [ 1017.021904][ C0] vcan0: j1939_tp_rxtimer: 0xffff888049310800: rx timeout, send abort [ 1017.520578][ C0] vcan0: j1939_tp_rxtimer: 0xffff888049310000: rx timeout, send abort [ 1017.530878][ C0] vcan0: j1939_tp_rxtimer: 0xffff888049310800: abort rx timeout. Force session deactivation [ 1017.823941][ T6240] netlink: 'syz.0.8396': attribute type 2 has an invalid length. [ 1017.857155][ T6243] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8397'. [ 1017.924512][ T6248] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8395'. [ 1018.028874][ C0] vcan0: j1939_tp_rxtimer: 0xffff888049310000: abort rx timeout. Force session deactivation [ 1018.232015][ T6267] IPVS: set_ctl: invalid protocol: 163 0.0.0.0:20001 [ 1018.274865][ T6269] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8402'. [ 1018.555133][ T6281] netlink: 'syz.0.8406': attribute type 1 has an invalid length. [ 1018.787753][ T6295] netlink: 'syz.2.8410': attribute type 2 has an invalid length. [ 1018.898366][ T6303] openvswitch: netlink: Unexpected mask (mask=200440, allowed=10048) [ 1018.943070][ T6285] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1018.957317][ T6285] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1019.154970][ T6285] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1019.170070][ T6285] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1019.338326][ T6285] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1019.350884][ T6285] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1019.440607][ T6285] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1019.452777][ T6285] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1019.552157][ T6290] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1019.883169][ T6321] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1019.908232][ T6321] bond5: (slave macvlan3): making interface the new active one [ 1019.930284][ T6321] bond5: (slave macvlan3): Enslaving as an active interface with an up link [ 1019.947954][T32699] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.000754][T32699] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.098971][ T6329] netlink: 'syz.0.8420': attribute type 10 has an invalid length. [ 1020.108806][T12809] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.127784][T12809] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.177087][ T6329] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1020.218969][ T6329] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1020.239717][T31041] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.247944][T31041] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.546436][T32699] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.554834][T32699] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.563681][T32698] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.604455][T32698] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.643549][T32698] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1020.669627][T32682] netdevsim netdevsim1 : set [0, 0] type 1 family 0 port 8472 - 0 [ 1020.984888][ T6365] __nla_validate_parse: 10 callbacks suppressed [ 1020.984909][ T6365] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8428'. [ 1021.258016][ T6363] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8423'. [ 1021.268641][ T6363] tipc: Invalid UDP bearer configuration [ 1021.268674][ T6363] tipc: Enabling of bearer rejected, failed to enable media [ 1021.341968][ T6377] bond1 (unregistering): Released all slaves [ 1021.393175][ T6379] smc: net device lo applied user defined pnetid SYZ0 [ 1021.441864][ T6384] netlink: 768 bytes leftover after parsing attributes in process `syz.2.8432'. [ 1021.454969][ T6384] netlink: 768 bytes leftover after parsing attributes in process `syz.2.8432'. [ 1021.573112][ T6390] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8435'. [ 1022.095817][ T6413] netlink: 128 bytes leftover after parsing attributes in process `syz.4.8441'. [ 1022.253531][ T6420] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8443'. [ 1022.687110][ T6442] batadv_slave_1: entered promiscuous mode [ 1022.843736][ T6451] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8454'. [ 1022.959075][ T6458] netlink: 'syz.4.8456': attribute type 5 has an invalid length. [ 1023.005097][ T6460] syzkaller0: entered promiscuous mode [ 1023.023649][ T6460] syzkaller0: entered allmulticast mode [ 1023.327652][ T6470] netlink: 164 bytes leftover after parsing attributes in process `syz.3.8458'. [ 1023.367121][ T6470] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8458'. [ 1023.444921][ T6481] netlink: 'syz.4.8462': attribute type 3 has an invalid length. [ 1023.762881][ T6490] bridge0: port 3(syz_tun) entered blocking state [ 1023.775390][ T6490] bridge0: port 3(syz_tun) entered disabled state [ 1023.798100][ T6490] syz_tun: entered allmulticast mode [ 1023.856274][ T6490] syz_tun: entered promiscuous mode [ 1023.887497][ T6490] bridge0: port 3(syz_tun) entered blocking state [ 1023.894104][ T6490] bridge0: port 3(syz_tun) entered forwarding state [ 1024.511916][ T6520] netlink: 'syz.0.8469': attribute type 5 has an invalid length. [ 1025.169092][ T6558] netlink: 'syz.4.8476': attribute type 1 has an invalid length. [ 1025.498025][ T6558] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1025.992514][ T6577] netlink: 'syz.3.8482': attribute type 24 has an invalid length. [ 1026.141357][ T6583] __nla_validate_parse: 6 callbacks suppressed [ 1026.141378][ T6583] netlink: 7 bytes leftover after parsing attributes in process `syz.4.8484'. [ 1026.202483][ T6583] netlink: 'syz.4.8484': attribute type 1 has an invalid length. [ 1026.262402][ T6591] netlink: 236 bytes leftover after parsing attributes in process `syz.1.8485'. [ 1026.278695][ T6585] veth2: entered promiscuous mode [ 1026.300037][ T6591] netlink: 236 bytes leftover after parsing attributes in process `syz.1.8485'. [ 1026.552091][ T6608] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8491'. [ 1027.809927][ T6652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8506'. [ 1027.835554][ T6652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8506'. [ 1028.045981][ T6664] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1028.100897][ T6670] Bluetooth: MGMT ver 1.23 [ 1028.429856][ T6686] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8516'. [ 1028.511528][ T6691] netlink: 'syz.3.8513': attribute type 1 has an invalid length. [ 1028.594844][ T6697] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8514'. [ 1028.610513][ T6697] openvswitch: netlink: Flow actions attr not present in new flow. [ 1029.199941][ T6691] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1029.288860][ T6710] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8520'. [ 1029.308873][ T6710] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8520'. [ 1029.350574][ T6711] bond0: (slave batadv0): Releasing backup interface [ 1029.411613][ T6711] bridge_slave_0: left allmulticast mode [ 1029.417431][ T6711] bridge_slave_0: left promiscuous mode [ 1029.424195][ T6711] bridge0: port 1(bridge_slave_0) entered disabled state [ 1029.455877][ T6711] bridge_slave_1: left allmulticast mode [ 1029.487441][ T6711] bridge_slave_1: left promiscuous mode [ 1029.505909][ T6711] bridge0: port 2(bridge_slave_1) entered disabled state [ 1029.551710][ T6711] bond0: (slave bond_slave_0): Releasing backup interface [ 1029.600026][ T6711] bond0: (slave bond_slave_1): Releasing backup interface [ 1029.657698][ T6711] team0: Port device team_slave_0 removed [ 1029.684118][ T6711] team0: Port device team_slave_1 removed [ 1029.702410][ T6711] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1029.717022][ T6711] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1029.729756][ T6711] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1029.737636][ T6711] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1029.744973][ T6720] netlink: 'syz.3.8523': attribute type 5 has an invalid length. [ 1029.756289][ T6711] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1030.078281][ T6732] openvswitch: netlink: Message has 5 unknown bytes. [ 1030.739594][ C1] ip6_tunnel: - xmit: Local address not yet configured! [ 1030.827572][ T6765] netlink: 'syz.4.8534': attribute type 62 has an invalid length. [ 1030.876918][ T30] audit: type=1804 audit(1785802051.329:23): pid=6753 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.8529" name="/newroot/548/cgroup.controllers" dev="tmpfs" ino=2817 res=1 errno=0 [ 1030.987096][ T30] audit: type=1800 audit(1785802051.439:24): pid=6753 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8529" name="cgroup.controllers" dev="tmpfs" ino=2817 res=0 errno=0 [ 1031.176996][ T6781] netlink: 'syz.3.8540': attribute type 1 has an invalid length. [ 1031.221370][ T6781] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1031.373496][T32700] nci: nci_ntf_packet: unknown ntf opcode 0x805 [ 1031.472760][ T6791] syzkaller0: entered promiscuous mode [ 1031.478540][ T6791] syzkaller0: entered allmulticast mode [ 1031.487922][ T6791] __nla_validate_parse: 5 callbacks suppressed [ 1031.487937][ T6791] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8542'. [ 1031.504181][ T6791] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8542'. [ 1031.514045][ T6791] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8542'. [ 1031.527059][ T6791] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8542'. [ 1032.222614][ T6785] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1032.236930][ T6794] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 疽m%AAZZI % [ 1032.436961][ T6828] netlink: 'syz.3.8549': attribute type 1 has an invalid length. [ 1032.506467][ T6831] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8549'. [ 1032.537993][ T6828] bond4: entered promiscuous mode [ 1032.543712][ T6828] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1032.571948][ T6828] bond4: (slave bridge1): making interface the new active one [ 1032.580072][ T6828] bridge1: entered promiscuous mode [ 1032.587731][ T6828] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 1033.175988][ T6857] netlink: 'syz.0.8552': attribute type 1 has an invalid length. [ 1033.251843][ T6857] netlink: 76 bytes leftover after parsing attributes in process `syz.0.8552'. [ 1033.628492][ T6860] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8553'. [ 1037.589274][ C0] sched: DL replenish lagged too much [ 1040.351695][ C1] ip6_tunnel:  xmit: Local address not yet configured! [ 1040.980964][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1090.267691][ C1] ip6_tunnel: - xmit: Local address not yet configured! [ 1106.128129][ T4938] Bluetooth: hci0: command 0x0401 tx timeout [ 1115.863024][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1115.870899][ C1] ip6_tunnel:  xmit: Local address not yet configured! [ 1115.879519][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1213.141678][ C1] ip6_tunnel: - xmit: Local address not yet configured! [ 1217.052076][ T4614] page_pool_release_retry() stalled pool shutdown: id 390, 51 inflight 67 sec [ 1264.347637][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1274.589097][ C1] ip6_tunnel:  xmit: Local address not yet configured! [ 1279.179167][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1279.186203][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6863/1:b..l [ 1279.194769][ C0] rcu: (detected by 0, t=10503 jiffies, g=194641, q=50155 ncpus=2) [ 1279.202816][ C0] task:syz.1.8554 state:R running task stack:26624 pid:6863 tgid:6862 ppid:5102 task_flags:0x40054c flags:0x00080003 [ 1279.217985][ C0] Call Trace: [ 1279.221314][ C0] [ 1279.224277][ C0] __schedule+0x17d9/0x56c0 [ 1279.228838][ C0] ? __lock_acquire+0x683/0x2cf0 [ 1279.233839][ C0] ? __pfx___schedule+0x10/0x10 [ 1279.238741][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 1279.244033][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 1279.249463][ C0] preempt_schedule_common+0x82/0xd0 [ 1279.254810][ C0] ? cfg80211_mlme_unregister_socket+0x2c8/0x650 [ 1279.261367][ C0] preempt_schedule_thunk+0x16/0x40 [ 1279.266628][ C0] __local_bh_enable_ip+0xe1/0x130 [ 1279.271795][ C0] cfg80211_mlme_unregister_socket+0x2c8/0x650 [ 1279.278002][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 1279.283618][ C0] nl80211_netlink_notify+0x35d/0x860 [ 1279.289044][ C0] ? nl80211_netlink_notify+0x75/0x860 [ 1279.294563][ C0] notifier_call_chain+0x1a5/0x3d0 [ 1279.299738][ C0] blocking_notifier_call_chain+0x6a/0x90 [ 1279.305632][ C0] netlink_release+0x11f8/0x1a80 [ 1279.310633][ C0] ? netlink_release+0x106/0x1a80 [ 1279.315705][ C0] ? __pfx_netlink_release+0x10/0x10 [ 1279.321035][ C0] ? down_write+0x16d/0x200 [ 1279.325571][ C0] ? __pfx_down_write+0x10/0x10 [ 1279.330483][ C0] sock_close+0xad/0x220 [ 1279.334771][ C0] ? __pfx_sock_close+0x10/0x10 [ 1279.339667][ C0] __fput+0x418/0xa50 [ 1279.343707][ C0] task_work_run+0x1d9/0x270 [ 1279.348336][ C0] ? __pfx_task_work_run+0x10/0x10 [ 1279.353488][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 1279.358649][ C0] do_exit+0x73a/0x2360 [ 1279.362864][ C0] ? cgroup1_freezing+0x20/0x350 [ 1279.367868][ C0] ? __pfx_do_exit+0x10/0x10 [ 1279.372508][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1279.377594][ C0] do_group_exit+0x22d/0x2f0 [ 1279.382235][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1279.387600][ C0] get_signal+0x121b/0x12c0 [ 1279.392188][ C0] arch_do_signal_or_restart+0xbb/0x860 [ 1279.397791][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1279.404018][ C0] exit_to_user_mode_loop+0x104/0x730 [ 1279.409453][ C0] ? rcu_is_watching+0x15/0xb0 [ 1279.414268][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1279.420392][ C0] do_syscall_64+0x353/0x580 [ 1279.425038][ C0] ? trace_irq_disable+0x3b/0x140 [ 1279.430118][ C0] ? clear_bhb_loop+0x40/0x90 [ 1279.434837][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1279.440767][ C0] RIP: 0033:0x7f8fb619e019 [ 1279.445218][ C0] RSP: 002b:00007f8fb706c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1279.453716][ C0] RAX: fffffffffffffe00 RBX: 00007f8fb6425fa8 RCX: 00007f8fb619e019 [ 1279.461818][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8fb6425fa8 [ 1279.469879][ C0] RBP: 00007f8fb6425fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1279.477937][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1279.485945][ C0] R13: 00007f8fb6426038 R14: 00007fff0c18af60 R15: 00007fff0c18b048 [ 1279.493943][ C0] [ 1279.497006][ C0] rcu: rcu_preempt kthread starved for 223 jiffies! g194641 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 1279.508202][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1279.518245][ C0] rcu: RCU grace-period kthread stack dump: [ 1279.524165][ C0] task:rcu_preempt state:R running task stack:27496 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1279.537737][ C0] Call Trace: [ 1279.541059][ C0] [ 1279.544020][ C0] __schedule+0x17d9/0x56c0 [ 1279.548557][ C0] ? __lock_acquire+0x683/0x2cf0 [ 1279.553619][ C0] ? __pfx___schedule+0x10/0x10 [ 1279.558535][ C0] ? schedule+0x90/0x2b0 [ 1279.562842][ C0] schedule+0x164/0x2b0 [ 1279.567042][ C0] schedule_timeout+0x152/0x2c0 [ 1279.571939][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1279.577359][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1279.582684][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1279.588533][ C0] ? prepare_to_swait_event+0x322/0x350 [ 1279.594123][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 1279.599039][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 1279.605239][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1279.610567][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1279.615826][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 1279.620460][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1279.625703][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1279.630684][ C0] ? __kthread_parkme+0x196/0x1f0 [ 1279.635757][ C0] kthread+0x388/0x470 [ 1279.639878][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1279.645122][ C0] ? __pfx_kthread+0x10/0x10 [ 1279.649786][ C0] ret_from_fork+0x514/0xb70 [ 1279.654429][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1279.659583][ C0] ? __switch_to+0xc89/0x1420 [ 1279.664303][ C0] ? __pfx_kthread+0x10/0x10 [ 1279.668954][ C0] ret_from_fork_asm+0x1a/0x30 [ 1279.673775][ C0] [ 1279.676820][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1279.683197][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1279.688446][ C1] NMI backtrace for cpu 1 [ 1279.688471][ C1] CPU: 1 UID: 0 PID: 3229 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) [ 1279.688502][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1279.688521][ C1] Workqueue: bat_events batadv_tt_purge [ 1279.688624][ C1] RIP: 0010:unwind_next_frame+0xcd7/0x2550 [ 1279.688649][ C1] Code: 00 00 fc ff df 48 8b 44 24 20 42 80 3c 20 00 4d 8d 7e 48 74 08 4c 89 ff e8 96 0d bd 00 49 89 1f 48 8b 44 24 38 42 80 3c 20 00 <49> 8d 5e 38 4c 8b 6c 24 18 74 08 48 89 df e8 76 0d bd 00 48 8b 04 [ 1279.688665][ C1] RSP: 0018:ffffc90000a07f80 EFLAGS: 00000246 [ 1279.688681][ C1] RAX: 1ffff9200014100c RBX: ffffffff8234a410 RCX: 1ffff92000141001 [ 1279.688696][ C1] RDX: ffffc90000a083a8 RSI: 0000000000000002 RDI: ffffc90000a083a8 [ 1279.688710][ C1] RBP: 1ffffffff21f9560 R08: ffffc90000a083b0 R09: 0000000000000000 [ 1279.688724][ C1] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: dffffc0000000000 [ 1279.688738][ C1] R13: ffffc90000a09000 R14: ffffc90000a08028 R15: ffffc90000a08070 [ 1279.688753][ C1] FS: 0000000000000000(0000) GS:ffff88812504f000(0000) knlGS:0000000000000000 [ 1279.688769][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1279.688782][ C1] CR2: 000055558b872a38 CR3: 000000007c3f8000 CR4: 00000000003526f0 [ 1279.688800][ C1] Call Trace: [ 1279.688808][ C1] [ 1279.688821][ C1] ? kasan_save_track+0x3e/0x80 [ 1279.688854][ C1] ? unwind_next_frame+0x8f/0x2550 [ 1279.688876][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1279.688902][ C1] arch_stack_walk+0x11b/0x150 [ 1279.688925][ C1] ? kasan_save_free_info+0x40/0x50 [ 1279.688949][ C1] stack_trace_save+0xa9/0x100 [ 1279.688972][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1279.688994][ C1] ? kfree+0x1c5/0x640 [ 1279.689018][ C1] ? __lock_acquire+0x683/0x2cf0 [ 1279.689048][ C1] kasan_save_track+0x3e/0x80 [ 1279.689071][ C1] ? kasan_save_track+0x3e/0x80 [ 1279.689131][ C1] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 1279.689189][ C1] kasan_save_free_info+0x40/0x50 [ 1279.689210][ C1] __kasan_slab_free+0x5c/0x80 [ 1279.689237][ C1] kmem_cache_free+0x182/0x650 [ 1279.689267][ C1] nft_synproxy_eval_v4+0x36a/0x4e0 [ 1279.689291][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 1279.689313][ C1] ? nf_ip_checksum+0x13c/0x510 [ 1279.689337][ C1] nft_synproxy_do_eval+0x335/0x550 [ 1279.689360][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 1279.689384][ C1] ? unwind_next_frame+0x8f/0x2550 [ 1279.689403][ C1] ? lock_acquire+0x106/0x350 [ 1279.689434][ C1] nft_do_chain+0x48d/0x1b10 [ 1279.689513][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 1279.689539][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 1279.689626][ C1] nft_do_chain_inet+0x360/0x4b0 [ 1279.689670][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1279.689691][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 1279.689720][ C1] ? nf_nat_ipv4_local_in+0x21f/0x720 [ 1279.689770][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1279.689791][ C1] nf_hook_slow+0xc5/0x220 [ 1279.689850][ C1] NF_HOOK+0x21f/0x3c0 [ 1279.689921][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 1279.689950][ C1] ? NF_HOOK+0x9e/0x3c0 [ 1279.689976][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1279.690004][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 1279.690036][ C1] ? ip_local_deliver+0x113/0x190 [ 1279.690065][ C1] NF_HOOK+0x336/0x3c0 [ 1279.690091][ C1] ? kasan_quarantine_put+0xbb/0x1f0 [ 1279.690116][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 1279.690143][ C1] ? NF_HOOK+0x9e/0x3c0 [ 1279.690169][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1279.690197][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 1279.690224][ C1] ? ip_rcv_core+0x88d/0xd50 [ 1279.690254][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 1279.690280][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 1279.690308][ C1] process_backlog+0xa34/0x1860 [ 1279.690354][ C1] ? process_backlog+0x3c3/0x1860 [ 1279.690383][ C1] __napi_poll+0xaa/0x330 [ 1279.690403][ C1] net_rx_action+0x61d/0xf50 [ 1279.690430][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 1279.690468][ C1] handle_softirqs+0x225/0x840 [ 1279.690493][ C1] ? do_softirq+0x76/0xd0 [ 1279.690518][ C1] ? batadv_tt_purge+0x4ae/0xa10 [ 1279.690538][ C1] do_softirq+0x76/0xd0 [ 1279.690559][ C1] [ 1279.690566][ C1] [ 1279.690572][ C1] __local_bh_enable_ip+0xf8/0x130 [ 1279.690595][ C1] batadv_tt_purge+0x4ae/0xa10 [ 1279.690622][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 1279.690644][ C1] process_scheduled_works+0xa8e/0x14e0 [ 1279.690684][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1279.690705][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 1279.690732][ C1] ? assign_work+0x3af/0x5d0 [ 1279.690756][ C1] rescuer_thread+0x7b6/0x10b0 [ 1279.690784][ C1] ? rescuer_thread+0xb8/0x10b0 [ 1279.690821][ C1] kthread+0x388/0x470 [ 1279.690854][ C1] ? __pfx_rescuer_thread+0x10/0x10 [ 1279.690877][ C1] ? __pfx_kthread+0x10/0x10 [ 1279.690917][ C1] ret_from_fork+0x514/0xb70 [ 1279.690946][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1279.690973][ C1] ? __switch_to+0xc89/0x1420 [ 1279.690997][ C1] ? __pfx_kthread+0x10/0x10 [ 1279.691024][ C1] ret_from_fork_asm+0x1a/0x30 [ 1279.691051][ C1]