last executing test programs: 19.490646752s ago: executing program 3 (id=1280): r0 = epoll_create1(0x0) epoll_pwait(r0, 0xfffffffffffffffc, 0x0, 0x8000002, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xdfbd5000) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r7, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r7, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x7, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r7, 0x29, 0x2c, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x1, @mcast1={0xff, 0x7}, 0x8002}}, {{0xa, 0xfffd, 0xea, @remote, 0xfffffffc}}}, 0x108) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x1}]}}}]}, 0x38}}, 0x0) r8 = socket$rds(0x15, 0x5, 0x0) bind$rds(r8, &(0x7f0000000040)={0x2, 0x2, @loopback}, 0x10) sendmsg$rds(r8, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) 19.272773333s ago: executing program 2 (id=1285): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000001280)=0x9, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000a00)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@deltaction={0xf0, 0x31, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x88, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @TCA_ACT_TAB={0x34, 0x1, [{0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x14, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7f}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x240000a1}, 0x4890) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x6, 0xb}, {0xfff3, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x10, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xfffffffffffffff7}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) socket$nl_route(0x10, 0x3, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="bc000000", @ANYRES16=0x0, @ANYBLOB="6ba425bd7000fbdbdf250100000008001900e000000106001a004e23000008001900e000000108001800ac1414bb06001d0006000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x40004) r6 = socket$inet_icmp(0x2, 0x2, 0x1) r7 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=@getqdisc={0x48, 0x26, 0x8, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x4, 0x2}, {0x8, 0xb}, {0xd, 0xffe0}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r12, 0x0, 0x0, 0x50040, &(0x7f00000001c0)={0x11, 0x3, r11, 0x1, 0xd8}, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r14, @ANYRES32=0x0, @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x20000080) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0xe0, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001240), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000200), &(0x7f0000001300)=[0x0, 0x0], 0x0, 0xd5, &(0x7f0000001340)=[{}], 0x8, 0x10, &(0x7f0000001380), &(0x7f00000013c0), 0x8, 0x8d, 0x8, 0x8, &(0x7f0000001400)}}, 0xfffffffffffffddf) sendmmsg$inet(r6, &(0x7f0000003780)=[{{&(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000280)="4ba1cbd9b09e12217bcc3dc6ef817902c77047ca6d5e28c2f3cc2e0a2ba708c6af9d9f4e1cdae1f771a63ace3d813f5fb11f97159540375b9c5273489413819322f1b213b5013bf003b7703142c39087c49ec51fc55f1d27f6485c6ff948f05032285a29147e34e8", 0x68}, {&(0x7f0000000300)="594a59d745c7a8352773e453fb16b47a1bcd716f26bf3b0d2e005609c0f947548e6a8204feecffedac8b97ef1178b3dc440f23490bbffd00428968d967d5ef09977bfaa8a5cc33ef2a25426faa20a79a730f01bf504d21c07023f73e740eb4f84c2639de1df9b71e451da3fccf328db47bb2bc8a0af545ddb9c4455f124b09c3f0c01ead6265c3a08e3fe73d6f773691ee1148017a0b18e69250c234c4ddc63008b22dda7ec81ea42b634eef69d39ab783a69b775108bc6b2188f9256a4c077ca33d07d5a3ba548865a8d25c5839ac734a310e03521413a992", 0xd9}, {&(0x7f0000000400)}, {&(0x7f0000000440)="ed3509aa51c9638cefb732d7d55081858803a97b2bf919581aa69c7b69b1c62f532f5ff889b0332bca8abc398598c0f8d9ca3b23ab75b97c803f3d66cc96a31b319dfe7ba0b4a1b10b272dcad6d6f6bf81eecd687d0e72cbb6948a281b482e5f671def567b20b256720239ad521ad5510dec5c43e087e792d8fcb7555ecbb66f6419a7f038dd21bcf7efd2aca44fd9496c7319b6cc0ac4e941803c7923763d93b481d787747b3f3a52f6ab3400854d2352d49106d961747c565628f27b780d75de7d8d9fda119a78a20ed2", 0xcb}, {&(0x7f0000000540)="d58bc4deb90bf2a7e6a4bd001a3e2d246e3f05902f9de9471bf967e31340aff31efdd3328258ce42f9e176d6ddf7e3df257990a60ebe7bf01757155b86242e76c35179e3471a129c6b2e659f5644f9511cbf4c7884227df26961238705c53e5d7df4397fd667bf394dd279e7659d30f73efac6174c7a835d945091167f75c168e91763c6b07f0fc3a653c4c02869bbda8e66f1c3b15df042ac37eb7cf3a74f12908bcf6066e0a7ad490d8086816d9611eaafab58463488a8301cba4be10b517480318b328a1716f7182feaf745db6c9e972ed7d7f61db5b80ab195cd172c8a9b2a1a", 0xe2}], 0x5}}, {{&(0x7f00000006c0)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000ec0)=[{&(0x7f0000000c00)="3aaba59464a77c98979d9c20a7e8ee7f4df027325ae9c605110c9696cdd8eb179828eb5e04e9daa3160e5fb223bbb84dbaa8df8df9b22b287353fafce2ed94512fba34059a6fb6bd1a665b15b667a1ef10398608feea661dbbe90b3cf45a2c112298dbbb0f5ac8ed45aecdecd442f214fc7386afd582ab812a2f8a65f9987786ac0a798dd53822b9c2f66aa4b145f82550cc97713ee3ff5a97220734d64d6d7001497350950bf698feb93c5f176a9a3edc57099ac7dd87f75d591541e4bb2e59f090dbd914983cbf06055609c379", 0xce}, {&(0x7f0000000d00)="a94124b05cf8b2ada2f490b2cf89ae2bccb7a8235618c21cb2635d181ca440732c2784c04620f53374b9fb9138c81b1f42458aeb42b689b19f712882431711afc193386c605fd2f763530b84c08fdeb72b11e32a49bb72aa60e6e00340f1a2e4a3edd5a0842653c78d4cf367a49340c135e81adff05e6029f8a01d4eb67e9a2a902fb15bf198a8389373d0f334f541c921d3ffab0cbdfea69dbe9700d3133703c97f7f781074071a6a1d0cf2657190fd438f7f16b895ec311d4e87382c1acf55ee045b03ab16199da11ce3345853b6a040e3ef86996a24880de559adb99487839eb4a1b535623b914fd6fcab8feebcbccfc0", 0xf2}, {&(0x7f0000000e00)="e24d35bbd60a7b6392951829ddae52fcfddaf0fe4350cfdbc560fe4f3e92b6c6dc6d73158b0bf4798009bdef720b6de47e817df640c94edcce0230b6d95e703c39c845450544caf29ea8c2cd8b520a", 0x4f}, {&(0x7f0000000e80)="1fc28921d3da8a4b9957f2b0f3b8416b236ce48597b74aa7f4af4340ce228f97df48f7", 0x23}], 0x4, &(0x7f0000000f00)=[@ip_retopts={{0x30, 0x0, 0x7, {[@generic={0x82, 0x12, "dd62b866cb2b48b4d3f5af2897bb4fe3"}, @lsrr={0x83, 0xb, 0xed, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x97dd}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r9, @multicast2, @empty}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x800}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}, @ip_retopts={{0x28, 0x0, 0x7, {[@lsrr={0x83, 0x17, 0x79, [@multicast1, @loopback, @private=0xa010100, @local, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}], 0xf8}}, {{&(0x7f0000001000)={0x2, 0x4e23, @private=0xa010102}, 0x10, &(0x7f00000010c0)=[{&(0x7f0000001040)="4c6c32b56a9c672b2c1b544c485067805ce9779886be0d10085777c9202fedacc9957543ac485b316faab09c979019cc37160d83e35420223f308c4141aa4a154f2e49ce1621f31ee83a8743d50dc3f6051e3f03dc40092f7914c32952ca5bd6cfa7fa87e5ee9ff4056670f77533d31c7cab3d2b", 0x74}], 0x1}}, {{&(0x7f0000001100)={0x2, 0x4e20, @multicast2}, 0x10, &(0x7f0000001200)=[{&(0x7f0000001140)="63cebea42bdd70a72e02a05a201478c364ac5b19b6a0b9a87317a9f6bbfbc83a", 0x20}, {&(0x7f0000001180)="2c2c1f8147a8dc545a878ee749a854bb4547bdc281faea45ec4a6ba424dc240a5a39ec6cd0d8c51d71f5318489498ca281a92ffb41e2dd4d0fad3b3871184d1bd32799482418061960fe8024fe6c", 0x4e}], 0x2, &(0x7f0000001740)=ANY=[@ANYBLOB="1400000000000000000000000100000003000000000000001c000000000000000000000008000000", @ANYRES32=r14, @ANYBLOB="7f000001ac1414aa020000001c000000000000000000000007000000890b9ae00000017f00000100000000001c000000000000000000000008000000", @ANYRES32=r9, @ANYBLOB="00000000ffffffff0000000014000000000000000000000001000000fbffffff000000001c000000000000000000000008000000", @ANYRES32=r15, @ANYBLOB="000000000a01010100000000140000000000000000000000010000000707000000000000"], 0xc8}}, {{&(0x7f0000001640)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000003300)=[{&(0x7f0000001680)="48324e3abc071cbda7c31b4db3b5e84b06dbefe119fb8b5bd9d4ca7dc119ba6886b4444b3ebb102affda118e89792d4798dd1ef0042b6feb7ef5749520d09e37c6f29206a5eaefa13239e12a5e12cc8fb8c78f9be0b7ee3b5d20a464b7f43a07a7b31bb5a44d20dd900b8025673b0e71a917fdc89e16b8c7913d8a56e468c5ed604f3306156c761e51387317de7dc6ad70e727696e052deebd0afe70f3c6cd3f1b7bd3dbfabfc868ca421f0e", 0xac}, {&(0x7f0000002000)="3c6f4f5195bb1d723c335a22376182c05254f33b1b697c299d472f32e4bceaf4c88513d6dc63bb00c02213278ebc6562cd5397a296f774b02ca9d74650327211fe6c47d24c5f8dd2e1dafff0bb811ec4177916cb6860f47260a36067f79cfe9cb2c5a7a5e86cdff4e38c94b966c2e5a2a78ed17ee8d69549a3ef2a6075e9bf27fb03b5af66a0f89e21f0affb1dcc67f2247969dfdc997b0cdd8a9019b5cd9542d7c711ac6c4e692177fa3e7b121ab90f26364d580b9727b5a786c213ba9535dfdbce854adaee2fc47a21afcb709f543206cb3c5813392052be2efdb709aa52742a6d8cdf4fde835b77f6953b0f98dda9476ef45a08fb3b3d4ed26531bcb3b102a97dacabf4d6de08d834cd594313105a71f512e12e7828e7d600641a09812556d518d86ca24aaa603e9bbea8f41f21782364228157e041f261dbbe74ff15897dc04a2b22809b1aff46abf256e4574e5114a1fcace69ac3dccfbc6c9740455c4fd55aa0ee37676e0ad147789951a4c8e48b0b8956a764dea292ebc8c0bd7049413c0d26c4f7676bddd5b9ba6708af39a06d2d97f34f4c3d4a3fb2ba7d5a8af3b2c0c269576435157fd4abc0565232a1418b0a154c68746b27c93b168c2ec703051602252f720722838f7b5140d5d4509d669013d18995ff5ac354333d54eacc9ccbe4e92d5d3fa80bd0b4a292d8d9498a3a1cff928539ce258db0d8c09921646c620efd903ac0ea769a6e77cae8b0edb8aa5c99625041f6bc99e4b5f2c07e21820488f2db804430ef79138bbaff714712b6244bde820ec1c9b2770fd58672e5cee80a8b8cf05c0e30af6bd92e67c5e3c8983b1d061d406483c989ca000260058ac164f39168040dff1029dea3f8c205afa4c895bc57b4900b5100795d563c99906a9fe265ba63659fc5a612567d23d21794d3afbdbb6c189786acff0a997ac1370db400e452dc1f1e253ea275ff784e0a2bd68dd1b858a776233413b8f351ce530732b0feb848684eb35df57c4f1469aa93e7800d060751c672badcc62a95fb4ca01c3f79718134204b73505009bbdcf11635c3c5c7d84b869661cd57606e1c20514cc86ce0ef5a451fcc2ceada53318ba3b0660927627691fd5d8231601d90c98730a77350800670de48af269115b1284d40e10615a096ef1d76cb946551e6718042049abd066a38bf48b21e6d631b2c3cdd6494872b995c03159d95e218c88d4545e712dcfc483db797e20e1312bb777fd345210990ece3007544e8241e18dbc77c3437070215cfa70fa96d7c78b4bcf58c203946fb56c67a841a116c06a09361bff53059d66c5e427903e462e7ccd5d90961e67f16b9eeda91d5e2bb5cc82465ccc5c539266279bd9bce655cbc365a5f9089576397ebfb397c1eb3ed9955a5b7b9ab787571e5267f2c21e4766336687a380f8fc6aecc73d205f0abdafd6e9cb37f8c28fbdc57203256b8208a01b0a72b679831e04c16248135595bb1dd58478dc9dfd8114ae5050d4e9d5706b0bbf6599b0130094fdbcac5118503105eb17c0c366e3e45bdac67a3c009a36eafdb218e7fd58ad38c2bf7e997084c3fd1d07e3b3a6d9f5471a234cb7adf8546cfd172e9dfa73854d2b8e2216d8aa38c3595bfff72afc6663a8065f68b30435a6c30cfff135bb646c8cbc746b6e52fdf61469dc780181195552c063254b382d750cf39ce7fc61370bd5936e70d79054468728d39cc9bcaeb8c16ca18b835cea5c00b6cecfa881d7ac932b37a36f825a1f54ca0f941f643bbc836b1a14cd29bd7bfb0e978677667e58d086cd37f37bb5f379b431d7a1c626be5ccf1b2757bef242908997341514580a3527b54460eac715955b7d9db655179499aca8176b2a96f1b88ec2f0ed7e5e0621057c0ea15c7ed02fc5b12991572b23d70263d15618fbfec50c8b1d0fc3517914442c8711769118ad02c6d56ecb6792ed14bc41582e39f705d732fa1449401ca039f914dac3fa3d69959a39152f8b85a43972ad0931cb83d5de2ffe178c467fd299edbc11f959440ddb11204ad19bdb0018b0ff8d45393fb8e837b2c14a03c2fb22f1bcfea959b9fdd157fb691a310b9fa11cdca1b8d18ffdff1617feea55ad76f163f5ca15aecbe9bd2e921318f1f8f99dac323a4749d56b2412d1a7b3c3e128eb135bb5d3fa2785212a96e98cf3e52eb4ae5d66399a22c0d754d7f619b7825d4a7838857364ced4d6d6638078a6ce21c0f1622ab6b68a7b3b4476232c8e86544d4469f2a9f42c5c040a6db864c56c6899083e1cf8b2b236b77942228db217fb1432b2dc13c8c2d8903473ef8f7116eb177988091a26ac131fb930688cc02905253811d7034c0f8b8ea3c0e7a55dfe6d010ee2fa5b2f05ecdf2f4a4c25b48932408a8afd3a37b6aba6a186e20be821364cd5ee5658e4570616b31e78e81a5e8a8ea2317451425647ac9bde8cb6912df647daafb5531656d12c6f426eee676c99b1b7e576da8c2adbfde64104655dfdb3c65a26f9ffbc61d8d9be545d87858eb56df90a95383d6e3f479c2462b10926b18c005e93e358f72b121917082088d9788d3585fdca80115ba4741e9494c278ef0ec60b856fcf757593a67ee5581539e9697460f474d61b548acf63ea5ee901f16e521193b015ff2af39a71d436cda5e325c0fba9c2ec3c76788f1b08494c1ee7164b8a61de56594c7fc459883799a64e906bda72c03fbbf790bd6f95802169c5ad4c933c6e04f49e4e7f814f45bb8ef3d90fa03f792b4edbae08c0a177499b8ba621e0a3f9290cb336b3b14a3374fc7552d3e764f7718159dcfc21d9d07b077336cffa5fae48582d7a96b017dcc33157ef5cb563bf808fec6b558471fa741b960c5ec117426e62090bec0dcd5ad5208791827c205343ca3ce9f9f935e9529597766d865fde77f64676fa6d6e66840449b3490f07fdad46c8731d7231392c287a9559d74ecf5a8e0071bc6308ea42396a52f49011243bb922a435b997e7510ec795abbea84e5a413f675c6717ae4001fd04ca17f58de79b20558a83fec81bec6a9183273543f5bd03cb508524bfdba9695f4ec10dc6ad2b3022d344c22ef5bb7740028681395abaf74c16e09c241675a71a174f4d309a610898ac27f604b214180c172c98f22b620644e02b5e538f34bfbe590df46ccc019cf7aaa340cb5a6013eedaed018b9384a1031d54aea9f9803cab58a70dabbdd3d6c14b8e5575cb304266c2570082b57d5f1bb591aa2673b65c20875bfb5ef91a08ba82ce09a58c0b7d5d8fe8c504aa59e0fff872d15037ed1439a7e1d7a224bf92d2458713ff947a4c14530e521e447e6337c58c60a895b5da327ad0b1caea367bf6b2c0c856e8060fc479fe8fdd960482e0f883411d76067cc0a040f6e5ac8988db9bcf2820c5019e0d636e0b4e8502bd496c82a487a19469902770f1c555515177d9e519e728caa82f6ad430cd3c12cee691c89cd768ef24fba1070b6744af35c6aff14f752607e4092bab0f533fc554a30a705eb3baa549e907c0ff852ea1da855ff874aa72664afb48cadc5ac60871514132eada6198f07fb95dbd31479b256e62a2e4d003cf2d794e951512904c1256528ac40104cf09421701c03bd1812b67dc5708e3b20f5c8e013b45246bac40cc6bdd018ea1f15e4144e4d03695f426dd21d2435c57bb13e43407902ffa423a39926d63e730ec59a8c9b6bde29e20e9b8bc3776d4b43bb238f39213103ce3326804702b9d777f9792409a51d397c2fe8cea3e7c93a30d7cda46f01f6edbf2f083490a35ac251eb4e70c6b5ba8855d85cacbadcbd0a01c29c37766304c4365c31dead2df6c20931dacbf8c086c766eb7049029bffde63084d0ba494555a88416923db79f9f87230cae211138e6ee601aef2709487aa02536cd103d04f542326d3b1a84a84043dbc599cc46817986062b54a61361e095e8d902f64a8707fc3ed73c4efec6fb45bae934c88bc5af7398d4ce7e489f76252cdb207ebff3fb9dd7d60b933aba882861cdb58c05980135f8a3eb7fbc985beeb5d0393e466063cb36f73431c07c4cdc94567c8b41a34df3d11385b7e7e33f1773532bffda49736ffd3caf4a566dea9b105c4984fef10c2a459dc5360e25a798e4dd177b059f0c2d78c2f6ffbb8eb470c74724cc2ea2342e7ed5460a5d09ca16712307e56e799016e8855b472c4661868a5ea49429312a72cf6c75eeb339c762205787ab4f599e61095fbf87e14725f452f12511a13ef1ef316fa25155d864911520600c2c6fcde9aba98771db90ea0f19c56e3e02026a46a3ba4720347bd11afc0b206dfd13cd9c54eccd1d42facacfcad48a0a01b1dba721f5772d9e73fcf329b404efc7ef0564c83bef3edd0c5a1b6f05d2e17e45229d786d35f407d53cfe736d067068606e19b759f52e5a8709f4ef259986eb87a80ee09569e71690800c0a0d95019054339a162766108bf8e7fe10c56a3db0161b048b5518f6534a2fe9f79e6d74da235cb86b020992378cc798f73611fc4b4c25004455e4c94317e66f94ab7b2c5c4e9c8668a867b36e343aa67019fccea35117b100a14192ce00fa9d48b34246b7397e0db52760f61a50a13709b29821fd12f1616f9639ee0474fa23613d481521100ae4efb4a8ac86f20d7355fc3cdb67d4e51b7f6665353dbc310628dd3cd47e4e55c019c1a529ff909c7428a8cabc76599a3c53598cf6dd30d10b449b8ed34f675a5fcdc4332ecd2dfb100fd7e52628aedd658fa762f88757ac7f522c161fe66387650aa387baac582918b40d294d01d1f674450c0008803b2ce2dde22be41df373e6d61ce458be01e63af54ec620c73fc7dc7ed4a5aeaff22e04c931442a21abb3f2da96e843b0eb7291a7ad1a731ceb59555c5671b63a937b7d792074686cbf176c078897b5359fe47ac60136bccfaa427d99ee605f969d4bbe09ac19d70816b104fdafeba7f0a89c0af982484137c363b3ab7a6d6f1bb1f99604213dadc109407a245695e57cb8f5b17a95f966c7654e89ba35cf05a651187ea65de1ab54f7fbdd90cabd817baf32cb54cd71561598c1152c9fa05853c702ccdbb0441a0604ca938c02e16e3df33533fc69bd200231569bcf6025890731bf00407fe40195e698791f07294e896156b634c06a181240ba3b1f41c3bc268d631523e47b2660df7e4b51122943035b0ae7b757ec3d95e9aaa5ec5d4a72ccab051fff0a2e9e0fdca490186e0382bb0a1d8d1aac22b26f54492c60009af028fdd9e5febe2d72e38b0500bf4184dc4d44885a9302b76fe014be0801616fbe55c5abee886b12c711034458950ffeec588e9b6c8363d9c9ed231b4c6a06a63ee2109293a967072264947bdec5b51c94fbe35ae0dc261d78f9e60984c0191fd8fd53289a6ce5b255a563eba73221e93d49e0f78898a31c850c6cb8fc7ee25d7b92763c8b7ea714389f83a6764c9d85baa904fe0c8f73d2413d07763a39c5f0e5e32826a671348ede401d264650681cbc8b04b5050c8d4b4bd67af207ef743c56faca777f936194d8666810c3fcb47bc35cc2f19bbdeea0f18ffb1bc194de08f683d4564f73462b3b94f049686a1f8c07a0c7cb04e7d430573ced4234477b568ada57797fb920bc0925f6b943dfe7bb375842069df3280b2f54d9ff5a1cbf5a05076a37663cbee6c55363fb9424f5ca1dc03bf0912d5e8bea06e8efb32d3abeaeee768364adc79dfb75a115f5d3524a571a64b24a30b3ea141dcdf9d835477b57387750c401408e8a380152011d67de5568e1cdeeab93a281fff7d1858592718", 0x1000}, {&(0x7f0000003000)="ef124a27a249bbd71a69c6a8a5e243e81361dc6f85bfc034741f0aa0ca17c92ab022dbd11934a7d719a80cfbb6daed8e9913c7aab56438e96e07c2f7dc30d93835b62ee389043c25892d29d05b7f62d85dc4d14c7ba61378d4d6", 0x5a}, {&(0x7f0000000700)="f8a5f8fcd4c0208b6f64a9e97c4863c36e9b91852b930762d7cfb9c18d89f9883396fd81b74dbe5663dc556513b60a9effc211dae40134a827e4e6c0ec315406c46025d500241febe28ec8cbefe09d7e16f7896c8c55bef9b5bec9bb6bb88f81130bd69a90bf3ae00d079fd5fcedd86066e426354f44aa1086e26ddaf22deb6b8a07e9ee60950841d16241b05c04649be6ab395344061fe41f6af711f84f264fe7c6747b6f9dbbd42997c7ec6c22aad14f96ce077d2046bd463285b813cd06f35b28c8acfd945a01676be8fb0b27534685b7a087e046139e249a79b21d227fda1eb36b4c3bee81494e21c3f90c2a5837fe35e930dce4d260508c3364768e02dfcde220cf60d1b7af55efdf072820e99ae26cf2ec4a144ee61cb02bd58c7178857be3ee19964d66075d047dc4d4334b07380b1070ad5367c664ec35b3be317af4dd5179a0dd6051efec44abb9", 0x14c}, {&(0x7f0000003180)="ef884c78377384b361b89440231b39098b8b0c7734686eec050ba2f35c902555cb7b4052c2c0e8f63350d0ccec7753018a83e32b90483514d674e07bdd9dae967b5d4886c1f312e4335be6c84c86db56c2f6f105f8997480eb64a9331dc80e54c2397fe64d4a8c027cc313fdd35d577c7a4aa63a0b11fe4ebbf367aa41e8d0166e0a4b6572519236fce671a94ba2e753c8631b651c534e964817d086673e76d67195e93da43c3cba31978f8efc07377bb87b1127baccebcd9afe40902ad6dc1a5aab55b924dc9038d7ba79e8ceb6873bf1b12c32", 0xd4}, {&(0x7f0000003280)="d8e03e29a7a2e492c9ad6601ba5fd94d59861ac74f76da134235d4091eaaff9f2f9f2086dbcdd3df7a9b3d12", 0x2c}, {&(0x7f00000032c0)="e9739072aea4007547254777fe58b84c7c6d56e1cdb451fa981f6019a7ea61eea2960c0488bb4bb6b73d5374d530", 0x2e}], 0x7, &(0x7f0000003380)=[@ip_ttl={{0x14, 0x0, 0x2, 0x3}}, @ip_ttl={{0x14, 0x0, 0x2, 0x9d8f}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}], 0x60}}, {{&(0x7f0000003400)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000003600)=[{&(0x7f0000003440)="af848a18c04329e4244d173bdfbfea849b72b49d7c2d1507b9e99d2afd2eb3fcdd2304fedc5e79f5ce6b3b807cb99d0f14", 0x31}, {&(0x7f0000003480)="32721da6618f5b269306abc264f4a091af5ab16d18cf9113f038ff0a07926af4f1fa981e0eedf5a1b312d57b7a8dec0bbc0178b337015d198410", 0x3a}, {&(0x7f0000003540)="61c8614cc176f9c4eccdef9217ad11f2d64b1d527af4a3d01ec626b9db1c3639bbc0b314971614f1d257d189e5eadcc59343feb7073f049b0d5e3b34b706afeb82bc219610564d83a099379b1682af03831e9624d78356454263eb79cbfb611166ac4ffdd44ed060488f23a3fda4de3bd4f856b4f5aeffbc5ec5a50adcb7bfd0398ea25ebc4d89db13c9250bbc2d02f9bdbe6b2d5026e3ad1b561caa620c1d3d26b9f286ac48", 0xa6}], 0x3, &(0x7f0000001840)=[@ip_retopts={{0x94, 0x0, 0x7, {[@ssrr={0x89, 0x23, 0xd0, [@loopback, @loopback, @multicast2, @remote, @rand_addr=0x64010101, @multicast1, @private=0xa010100, @empty]}, @rr={0x7, 0xb, 0x44, [@initdev={0xac, 0x1e, 0x5, 0x0}, @local]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x26, 0x3, [{0x5, 0x12, "e9c30b745685059c8f4db11f765ffcef"}, {0x2, 0xe, "08059e66eeed4e10ea85a13d"}]}, @rr={0x7, 0x7, 0x83, [@rand_addr=0x64010102]}, @timestamp_prespec={0x44, 0x4, 0xf0, 0x3, 0xa}, @generic={0x44, 0x11, "b5c9c326c52888a7941db94dbd4263"}, @generic={0x94, 0x10, "425c11b44f8ec2bb883576e285a2"}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0xc8}}], 0x6, 0x4004010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@ipv4_newrule={0x2c, 0x20, 0x1, 0x70bd26, 0x25dfdbfb, {0x2, 0x10, 0x10, 0x0, 0x9, 0x0, 0x0, 0x6, 0x10006}, [@FRA_SRC={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2a}}, @FRA_DST={0x8, 0x1, @empty}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4004804) r16 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r16, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='L'], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 19.169025776s ago: executing program 1 (id=1286): socket(0x2c, 0x800, 0xffffffff) (async) r0 = socket(0x2c, 0x800, 0xffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x48}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) bind$xdp(r0, &(0x7f0000000000)={0x2d, 0x0, 0x0, 0x12, r0}, 0x10) 18.999266166s ago: executing program 0 (id=1288): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, 0x2, 0x9, 0x801, 0x0, 0x0, {}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x7}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_STATUS={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x8091}, 0x800) (fail_nth: 2) 18.979034082s ago: executing program 1 (id=1289): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="660a0000000000006111b8000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x90) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x120, r1, 0x100, 0x70bd28, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}]}, 0x120}, 0x1, 0x0, 0x0, 0x24044085}, 0x28000010) recvmmsg(r0, &(0x7f00000009c0)=[{{&(0x7f00000003c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000900)=[{&(0x7f0000000440)=""/244, 0xf4}, {&(0x7f0000000540)=""/132, 0x84}, {&(0x7f0000000600)=""/198, 0xc6}, {&(0x7f0000000700)=""/168, 0xa8}, {&(0x7f00000007c0)=""/62, 0x3e}, {&(0x7f0000000800)=""/211, 0xd3}], 0x6, &(0x7f0000000980)=""/55, 0x37}, 0x9}], 0x1, 0x12, &(0x7f0000000a00)={0x77359400}) 18.755482033s ago: executing program 0 (id=1290): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xffff, 0x0, 0x4e21, 0x7fff, 0xa, 0x0, 0x0, 0x1d}, {@in6=@local, 0xfe, 0x32}, @in6=@empty, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0xb, 0xa03, 0x543}, {0x4, 0x8000000000000002}, {0x2}, 0x70bd2c, 0x3500, 0xa, 0x4, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x7, 0x4e24, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r8, {0x5, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_MASK={0x8, 0x6, 0x5}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x7f, 0xffffffffffffffff, 0xc9d, 0xd155}, 0x5f}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x2) (async) close(r6) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$TUNSETVNETHDRSZ(r9, 0x400454d8, &(0x7f0000000140)=0x90) (async) write$tun(r9, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 32) r10 = socket$kcm(0x11, 0x3, 0x0) (rerun: 32) setsockopt$sock_attach_bpf(r10, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) sendmsg$kcm(r10, &(0x7f0000000280)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r8, 0x10042}, 0x80, &(0x7f0000003300)=[{&(0x7f00000001c0)="27030200dc0f14000e0000000025c1020000ff84125ce882cbf400930bf4533f00429c65112a", 0x26}, {&(0x7f00000022c0)="02db0b9ef1cafdab", 0xa888}], 0x2}, 0x4005) (async, rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8}]}}}]}, 0x38}}, 0x0) (rerun: 32) 18.695112402s ago: executing program 3 (id=1291): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wg1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000400)={'tunl0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x80, 0x20, 0xb, 0x7, {{0x2e, 0x4, 0x2, 0x0, 0xb8, 0x64, 0x0, 0x1, 0x2f, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x42}, {[@end, @lsrr={0x83, 0x2b, 0x24, [@dev={0xac, 0x14, 0x14, 0x2e}, @multicast1, @dev={0xac, 0x14, 0x14, 0x3d}, @multicast1, @rand_addr=0x64010101, @multicast2, @broadcast, @broadcast, @empty, @multicast2]}, @timestamp_addr={0x44, 0xc, 0x9c, 0x1, 0x7, [{@rand_addr=0x64010100, 0x4ba}]}, @cipso={0x86, 0xb, 0x1, [{0x7, 0x5, "75541c"}]}, @end, @timestamp_addr={0x44, 0x24, 0x38, 0x1, 0xd, [{@empty, 0x7fff}, {@multicast1, 0x1}, {@remote, 0x3}, {@multicast1, 0xff}]}, @ssrr={0x89, 0xb, 0xea, [@loopback, @multicast2]}, @timestamp={0x44, 0x14, 0x8, 0x0, 0xd, [0x2, 0x2, 0x8, 0x2]}, @timestamp_prespec={0x44, 0x1c, 0xad, 0x3, 0x7, [{@private=0xa010102, 0x4}, {@loopback, 0x90}, {@private=0xb, 0x3}]}]}}}}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r6 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r4, r5, 0x25, 0x0, @void}, 0x10) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r7, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xaa}}, 0x8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000440)={@multicast2, @private, 0x0}, &(0x7f0000000480)=0xc) sendmsg$nl_route(r0, &(0x7f00000005c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)=@RTM_DELMDB={0x98, 0x55, 0x100, 0x70bd28, 0x25dfdbfb, {0x7, r1}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x7, 0x0, {@in6_addr=@private1={0xfc, 0x1, '\x00', 0x4}, 0x86dd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x0, 0x1, 0x4, {@ip4=@dev={0xac, 0x14, 0x14, 0x2f}, 0x86dd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r5, 0x0, 0x2, 0x0, {@ip4=@dev={0xac, 0x14, 0x14, 0xe}, 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r8, 0x0, 0x1, 0x4, {@ip4=@broadcast}}}]}, 0x98}, 0x1, 0x0, 0x0, 0x400c0}, 0x20000000) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r9, &(0x7f0000000040)={0x1f, 0x0, @none}, 0xe) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f00000000c0)={0xffffffffffffffff}) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r11, &(0x7f00000013c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x3c, r12, 0x401, 0x70bd2e, 0x25dfdbfc, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}]}, 0x3c}}, 0x14008080) sendmsg$ETHTOOL_MSG_RINGS_SET(r10, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x480045}, 0xc, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="000127bd7000ffdbdf251000000008000800000400000c000180080003000200080006000400000008000600040000003b5c72a8d80548bc49bad7e00136ec0812174a71c8ba53d75c1677170ec5b7100993e060"], 0x40}, 0x1, 0x0, 0x0, 0x4000800}, 0x4048040) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda106000000000047010000f8ffffffb702000008000000b70300000040000085000000050000001801000020696c250000000000202021db1af8ff51000000bda102000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r6) setsockopt$bt_BT_DEFER_SETUP(r9, 0x112, 0xf, &(0x7f0000000080), 0x4) listen(r9, 0x0) 18.694714557s ago: executing program 2 (id=1292): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000300)={0x1f, 0x9, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0xe) 18.5102623s ago: executing program 0 (id=1294): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) (async) sendto$inet6(r0, &(0x7f00000009c0)='\\', 0x1, 0x20000081, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000580)={0x41, 0x84, 0x7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x1}, 0xe) (async) recvmmsg(r0, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) (async) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x30008014}, 0x4004810) (async) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000080)={r4, 0xfffff86f}, 0x8) 18.428212664s ago: executing program 3 (id=1295): r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x4, 0x2, 0x1000004, 0x3, {0xa, 0x4e21, 0x1, @mcast1, 0xb75}}}, 0x3a) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0x38}, 0x9}]}, &(0x7f0000000040)=0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000b, 0x200000005c831, 0xffffffffffffffff, 0x18ba3000) shutdown(r1, 0x2) getsockopt(r0, 0x111, 0x6, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6100000000f13afffe8000000000000000000000000000aa0000000000000000000000000000000186009078002d06009909000032590000"], 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000003c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0x1, 0x0, &(0x7f0000000000)="ff", 0x0, 0x836, 0x503, 0x0, 0x0, 0x0, 0x0, 0x6, 0xffff80fe}, 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000140)={'wlan1\x00', @random="0100000000eb"}) close(r0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e21, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000080)='vegas', 0x7) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x4) socket$inet6_sctp(0xa, 0x5, 0x84) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f03446b000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) recvmmsg(r8, &(0x7f0000000f00)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000280)=""/38, 0x26}], 0x1}, 0x3ff}], 0x1, 0x40002020, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)) socket$l2tp(0x2, 0x2, 0x73) 18.247206659s ago: executing program 0 (id=1297): setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000640)={@ieee802154={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0102}}}, {0x0}, 0x0, 0x59}, 0xa0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r0, 0x215eb000) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet(r1, &(0x7f0000002180)=[{{&(0x7f0000000080)={0x2, 0x4e20, @private=0xa010102}, 0x10, &(0x7f00000001c0)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000180), &(0x7f0000000280)=0x4) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000028000000280000000400000002000000000000110300001000000000000000000000000d0000000002fe1870d10e72f42f00000000006100"], 0x0, 0x44}, 0x28) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x2000c084) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x47}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22}, 0x80) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="180000007200330306000000040000000700200047be"], 0x18}}, 0x20000810) 18.213260283s ago: executing program 3 (id=1298): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x15c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0xa0, 0x21, r3, 0xee00}, {@in6=@private1, 0x4d6, 0x32}, @in=@private=0xa010100, {0x0, 0xe839, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x6, 0x0, 0xfffffffffffffffe}, {}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x70}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {r3, 0x2}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8040880}, 0x2014) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x15c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0xa0, 0x21, r3, 0xee00}, {@in6=@private1, 0x4d6, 0x32}, @in=@private=0xa010100, {0x0, 0xe839, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x6, 0x0, 0xfffffffffffffffe}, {}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x70}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {r3, 0x2}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8040880}, 0x2014) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) (async) r9 = socket$unix(0x1, 0x5, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x34, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x59}]}]}]}, 0x34}}, 0x0) (async) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x34, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x59}]}]}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_GET_REG(r8, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xcc, r11, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NL80211_ATTR_REG_RULES={0xb8, 0x22, 0x0, 0x1, [{0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x2}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xda65}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xc}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x6e7}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xffff}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x3}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x2}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x5}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xa1}, @NL80211_ATTR_FREQ_RANGE_END={0x8}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7fffffff}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xff}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x81}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xfffff3f2}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x2}]}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x801}, 0x24048850) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0x1}, {0xffff, 0xffff}, {0xfff8, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r13, {0xd, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x54, 0x2, [@TCA_ROUTE4_ACT={0x50, 0x6, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x4005, 0x20, 0x7, 0x8}, 0x7e}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xfc, 0x3}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20008010}, 0x0) (async) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r13, {0xd, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x54, 0x2, [@TCA_ROUTE4_ACT={0x50, 0x6, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x4005, 0x20, 0x7, 0x8}, 0x7e}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xfc, 0x3}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20008010}, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8, "00000400"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8, "00000400"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000022c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r14, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x4, 0xb}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44000}, 0x20000000) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) 17.862586007s ago: executing program 1 (id=1300): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000001c80)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x1, @private0, 0x3}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000280)={r1, 0x7, 0x104, 0xfffffffe}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) sendmmsg$inet6(r0, &(0x7f0000001c80)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x1, @private0, 0x3}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) (async) shutdown(r0, 0x1) (async) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c"], 0x44}}, 0x0) (async) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000280)={r1, 0x7, 0x104, 0xfffffffe}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) (async) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) 17.837524255s ago: executing program 3 (id=1301): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$FOU_CMD_DEL(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ba3c0000", @ANYRES16=r4, @ANYBLOB="01002abd7000ffdbdf250200000008000800ac141425"], 0x1c}, 0x1, 0x0, 0x0, 0x40000810}, 0x40000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x2, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x20040084) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r7, {0xb, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0xfb55}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x7f, 0x3, 0xc9d, 0xd155}, 0x5f}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0xec}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(0xffffffffffffffff) r8 = socket$key(0xf, 0x3, 0x2) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r9, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x81, @empty, 0x4}], 0x1c) sendto$inet6(r9, &(0x7f0000000040)='l', 0x1, 0x24004881, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @loopback, 0x879}, 0x1c) sendmsg$key(r8, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000200)={0x0, 0x1, 0x30}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000006c0)={r10, 0x58, &(0x7f0000000640)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x5}, @in6={0xa, 0x4e23, 0x6, @mcast2, 0x9}]}, &(0x7f0000000700)=0x10) sendmsg$key(r8, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$kcm(0x11, 0x3, 0x0) 17.775285799s ago: executing program 2 (id=1302): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000580)=@base={0xf, 0x4, 0x8, 0x2}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r1, r0, 0x7}, 0x10) close(r1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a430fe0000000071302000000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a00ff040400007203000000000000b500f7ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3380d28e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51bf900000000000000d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93020000000000000080e69db384ac7eeedcf2ba3a9508f9d6aba582a896a9f1e096df6ecea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6032399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000)={0x0, 0x3}, 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0xffffffa0}, 0x48) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000280)={@private1, @mcast1, @remote, 0x1, 0x0, 0x9, 0x100, 0x4000000010000009, 0x10200}) 17.741177442s ago: executing program 1 (id=1303): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x15c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0xa0, 0x21, r1, 0xee00}, {@in6=@private1, 0x4d6, 0x32}, @in=@private=0xa010100, {0x0, 0xe839, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x6, 0x0, 0xfffffffffffffffe}, {}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x70}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {r1, 0x2}}]}, 0x15c}, 0x1, 0x800000000000000, 0x0, 0x8040880}, 0x2014) 17.637061516s ago: executing program 2 (id=1305): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000200)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000000000000000000000ffffffffffffffff018000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000000000000000044000500ac1e0101000000000000000000000000000000043c00000000000000fe880000000000000000000021000101020000000400"/180], 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="bc000000210001000400000000000000fc020000000000000000000000000001ff02000000000000000000000000000100000000000000020a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000050001100fc0000000000000000000000000000017f000001000000000000000000000000fc020000000000000000000000000001c80000010000000000000000000000003c04"], 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 17.569774745s ago: executing program 1 (id=1306): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x9000000, &(0x7f0000000700)={0xa, 0x1234, 0x0, @loopback}, 0x1c) 17.491557778s ago: executing program 2 (id=1307): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0x28, &(0x7f0000000140)={&(0x7f0000000100)={0x38, 0x2, 0x9, 0x801, 0x0, 0x0, {}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x7}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_STATUS={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x8091}, 0x800) 17.438190816s ago: executing program 1 (id=1309): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r2, @ANYBLOB="010027bd7000ffdbdf25030000000c00040003000000000000000c00080001000000000000000c00020007000000000000000c00050008010000000000000c00060003000000000000000c00020072af000000000000280007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c000180fffffeff", @ANYRES32, @ANYBLOB="080001"], 0x8c}, 0x1, 0x0, 0x0, 0x24060801}, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x7, 0x30}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000024010000050a01020000000000000000010000000c00024000000000000000010900010073797a3100000000040004800a000700726f75746500"], 0x1ac}}, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x7d, 0x0, 0x0) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f00000005c0), r1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000600)=0x0) sendmsg$NFC_CMD_ENABLE_SE(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x1c, r5, 0x8, 0x70bd2c, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r7, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) close(r9) close(0xffffffffffffffff) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200000000310000000008000a40fffffffc08000340000000140c0009800800014000000081140000001100010000"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r11 = accept4(r8, 0x0, 0x0, 0x0) sendmsg$kcm(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000004c0), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000740)=ANY=[@ANYBLOB="2cafe6e59cb479100000", @ANYRES16=r12, @ANYBLOB="000227bd7000fcdbdf2501000000080004000300000008000800e000000108000800ac1414aa"], 0x2c}, 0x1, 0x0, 0x0, 0x40004000}, 0x20000004) 17.35979545s ago: executing program 3 (id=1310): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0x6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}, &(0x7f0000000300)=0xb0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x2dc, @dev={0xfe, 0x80, '\x00', 0x32}, 0x9}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040), 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001fc0), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(r3, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002000)={0x20, r4, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x80d4) sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9000000065233201cae12043c94dad1210e03ec4a6d4c8b290b6a7d0f68ae6970dfb20dd93b18689263063190e4f204b891b3b4b030f944d2df4ab5d17fb381204f3874b6694e96d441ab7299d8bbb2a78769c4798e81d88ee46c987867baf2554071bb9bef4e15a938ef0812e016b3ebf", @ANYRES16=r4, @ANYBLOB="02002abd7000fedbdf250300000008000500ffffffff1c00028006000f0000a0000006000b000a0000000800040056000000080006000500000038000180060001000a0000000c000700220000000100000008000b007369700008000b00736970000800090012000000080009006800000008000400fdffffff08000400080000000800060003000000"], 0x90}, 0x1, 0x0, 0x0, 0x4000840}, 0x40) listen(r1, 0x9) accept$inet6(r1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 17.307500269s ago: executing program 2 (id=1311): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x6c, r1, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}, 0x1, 0x0, 0x400000000000000}, 0x0) 17.15612345s ago: executing program 0 (id=1313): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000140007030000f1feffff720af0fff8ffffff71a4f0ff0000000071103100000000001d400500000000004704000001ed00000f030000000000006f44000000000000730a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) 17.116007674s ago: executing program 0 (id=1314): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000c300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14}}, 0x64}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r4) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x100000000, 0xca8}, {}, 0x0, 0x6e6bb3, 0x0, 0x1}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x4d5, 0x2b}, 0x0, @in=@broadcast}, {{@in6=@remote, 0x0, 0xff}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x1}, {{@in=@private=0xa010102, 0x0, 0x6c}, 0x0, @in=@local}, {{@in6=@rand_addr=' \x01\x00', 0x0, 0x33}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x3, 0x0, 0x0, 0x81}, {{@in6=@mcast1, 0x0, 0x6d}, 0xa, @in6=@private1, 0x0, 0x4, 0x0, 0x2}]}]}, 0x1fc}}, 0x0) writev(r1, &(0x7f00000006c0)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}, {&(0x7f0000000300)="1100f8ae", 0x4}, {&(0x7f00000002c0)="00020021", 0x4}], 0x3) 16.31456826s ago: executing program 4 (id=1315): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=@bridge_getvlan={0x18, 0x72, 0x333, 0x6, 0x4}, 0x18}}, 0x20000010) (async) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'veth1_to_team\x00', &(0x7f0000000440)=@ethtool_dump={0x3f, 0xfffffff7, 0x7, 0x8f, "624f505eeaef2668a5dffbd299bd716604d79b7b87c1ee71dc148b48b500f590c8db0765a0429fcfe6e7787e911cd83879aea294ce9d4138a54231d260eb26eb04e1e3343cbc138ac96733ce2d3061d45619047c8d2b1ddb094e089b34d795c3bd98dca513d4cb7e35ac67cc71344663e12488693428ef0c94a4d688c71a1ddc0ba1ae3ff044bfe8a2b4dda87aec80"}}) (async) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0x1f8, 0x1f8, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast2, @loopback, 0xffffffff, 0xffffffff, 0x7, 0x9, {@mac=@random="3b4c52fb5365", {[0xff, 0x0, 0xff, 0x0, 0xff]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}, {[0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x50, 0x1, 0xe, 0x9cd4, 0x0, 0xffff, 'veth0_to_team\x00', 'ip_vti0\x00', {}, {0xff}, 0x0, 0x202}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x3f0}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @empty, @local, @multicast2, 0x2}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x20, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2a}}, {}, 0x0, 0x0, 0x0, 0x0, 0xfff9, 0x0, 'veth0_to_batadv\x00', 'netpci0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x3f}, 0x8, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) (async) recvmsg$unix(r0, &(0x7f0000001880)={0x0, 0x0, 0x0}, 0x0) 16.222106052s ago: executing program 4 (id=1316): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x10000000, 0x6, 0x3fe}, 0x4}}]}, {0xd}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0xc0}, 0x20044004) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r10, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r12, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r13, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r14 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000200), r11) sendmsg$MPTCP_PM_CMD_GET_ADDR(r11, &(0x7f0000000780)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, r14, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xa}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xe}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44010}, 0x1004) sendmsg$nl_route_sched(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=@delqdisc={0x5c, 0x25, 0x2d25d55c8bc3e0f1, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r13, {0x0, 0xd}, {0xe, 0xe}, {0x6, 0xa}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x2, 0x0, 0xfffffbff, 0x1, 0xcfd4, 0x9, 0x2}}, {0x8, 0x2, [0x800, 0x1]}}]}, @TCA_RATE={0x6, 0x5, {0x6, 0x5}}]}, 0x5c}}, 0x4000800) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r15, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a300000000054000000090a01040000000000000000070000008ae41f3dde49a76482bfdb08000a40000000000900020073797a310000000009010073797a30fe4f7dbcf5cac3f20000000c08000340000000088808000740000000310800064000cf0000480000000c0a0101000000000000000007000000ac2b515a73797a31000000000900010033797a30008000001f0003801800008008000340000000020c0002800700010029924600140000001000010000000000000000000084005acc4315195e6a3f04de9d0a003b986e67dfcbb8a380d053f03b84bf9f652c5d722905b86bf38030f09f1d912d70de9ddee7f18bd5fb5eb01fb6d59948"], 0xe4}}, 0x0) 16.064360175s ago: executing program 4 (id=1317): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xa4}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000200)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000000000000000000000ffffffffffffffff018000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000000000000000044000500ac1e0101000000000000000000000000000000043c00000000000000fe880000000000000000000021000101020000000400"/180], 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="bc000000210001000400000000000000fc020000000000000000000000000001ff02000000000000000000000000000100000000000000020a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000050001100fc0000000000000000000000000000017f000001000000000000000000000000fc020000000000000000000000000001c80000010000000000000000000000003c04"], 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 16.007424898s ago: executing program 4 (id=1318): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18020000f9ffffff0000000000000000850000004100000095000000000000003d789ade838a5adf0c21f97a9d6f55528c474cb385573d9fd2aff88c497a5d0ab93dbb1df77098cacd277206f0902cf2c1d66e1ef4fe6deeaf8739f048bff4c9d61b5c334ef7384130fd875789e46307b8f29c46149360bea59a42011aabc5001093a06d23b6cf4f033c6000c3ab63ee036fe7023574b86c8964c32f955d410083f7567735a2ca0100000000000000c644e801f17579bac767236f2b3addb04f55cee250cb376879ae14b9e1ab98703bc7db41925c55b0a4141ae3c08d264831d0f6365469c35621850000f6ff0000000000000000000000000000000000317dc59df6de3bfd0d7f785ff1e9606c84574e4b80937ae83516d820278c4c3fda817aeb17be0cca599b7c4bf6350dcb747508404034d9478ff88e1cbfe43f46a1a5d9239e393f2bb309160118a787cb0c64b606ffe744f79c1bba0ca081302b0f04e377f1b6a3646cbe934ef6ad95d4f160a9dcc9550f9777ca5d2daa2b239547f27a221d2eefb2c40ffe95c97ce091b7c2a8c0471b9124af726edb5a3b9aba486b93cb5ea7fff68f53401f8e826d5afbb98ed8b015dc328a507d15260a18a79110e68f1d43dad73121b60ec43e98e3f522b61a4f8fc0ba0257e8fd5ac428b986c49c76395b5a51c2c75d8c1453771915705bd0925cf573b0a9c01d8e552fe288d3c0433cbe801747f335448deb0e7164f6df7d3554bc66ff51352f912d76519aa6290fe7e72402000000e85552c5c049dde27c5294dc77c8a4490492a6deb8108c14ac9a261e2d990f65ea36f217783759c06e37c3a2f3b0b3c3893700152cdca1a4a045b3645b827c989b6a42f3a19d7df9b6c176a209afe66b38ab5a44bffc22ff89f0f03345e2f83f38b01df7ad086b462aad68f9fdf167f53fac61f511bf206de4eaf6d3eabde1bbe1077c3df5ff031bb8e9fc7f562c68e71db1dc7e61eb73a7b068ed9782ab069743d99dfe6209bd936d3e706df924e7043c5a66b730b6c64b6df44ad36788bd93ac57fd67baf927ec64f9ba759e7d4ed9bcf1a33ca39864d3bde66ad03a491ddfd17a3189ad7340ef90306e8dca300131219a55bbbd21289cf14fe40ef8fad89488df3503a766a8edf43bf816f4a5f0d8b1a0c183575a1589994054af2338e49a18186b94de6151107353eccd2817a075f9c4da88c31af5af5c981c6d72edb4df8b352a7d339e903a81b3c4eb51d8a286d0505cf8ee7c0daba3c2beb61865ee571a16cfb00e99088c8236964c798972daa234a0f055e33ea334d85a01d6f53da316813ea458430671b5eb59007a3e0a359aeb67a512576c942d187e5e9a905b18a303303e05266ecd0ab77f0ef4ae42d4c8d21c65fcedc6876ff461de2e2fa8c262b489edf06065535cb58820cfc9d3c1a93976d085a70000"], &(0x7f0000000240)='syzkaller\x00', 0x4, 0xff0, &(0x7f000062b000)=""/4080, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x3d) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0xa0001f98, 0x15, 0x0, &(0x7f0000000280)="4c1b84bdac37f4451b20a3066494677ee389d422a1", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 15.911234014s ago: executing program 4 (id=1319): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x40000000, &(0x7f0000000700)={0xa, 0x1234, 0x0, @loopback}, 0x1c) 15.907977632s ago: executing program 4 (id=1320): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$FOU_CMD_DEL(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ba3c0000", @ANYRES16=r4, @ANYBLOB="01002abd7000ffdbdf250200000008000800ac141425"], 0x1c}, 0x1, 0x0, 0x0, 0x40000810}, 0x40000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x2, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x20040084) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r7, {0xb, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0xfb55}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x7f, 0x3, 0xc9d, 0xd155}, 0x5f}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0xec}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(0xffffffffffffffff) r8 = socket$key(0xf, 0x3, 0x2) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r9, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x81, @empty, 0x4}], 0x1c) sendto$inet6(r9, &(0x7f0000000040)='l', 0x1, 0x24004881, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @loopback, 0x879}, 0x1c) sendmsg$key(r8, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000200)={0x0, 0x1, 0x30}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000006c0)={r10, 0x58, &(0x7f0000000640)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x5}, @in6={0xa, 0x4e23, 0x6, @mcast2, 0x9}]}, &(0x7f0000000700)=0x10) sendmsg$key(r8, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 2.019579733s ago: executing program 32 (id=1314): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000c300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14}}, 0x64}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r4) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x100000000, 0xca8}, {}, 0x0, 0x6e6bb3, 0x0, 0x1}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x4d5, 0x2b}, 0x0, @in=@broadcast}, {{@in6=@remote, 0x0, 0xff}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x1}, {{@in=@private=0xa010102, 0x0, 0x6c}, 0x0, @in=@local}, {{@in6=@rand_addr=' \x01\x00', 0x0, 0x33}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x3, 0x0, 0x0, 0x81}, {{@in6=@mcast1, 0x0, 0x6d}, 0xa, @in6=@private1, 0x0, 0x4, 0x0, 0x2}]}]}, 0x1fc}}, 0x0) writev(r1, &(0x7f00000006c0)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}, {&(0x7f0000000300)="1100f8ae", 0x4}, {&(0x7f00000002c0)="00020021", 0x4}], 0x3) 1.986688115s ago: executing program 33 (id=1309): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r2, @ANYBLOB="010027bd7000ffdbdf25030000000c00040003000000000000000c00080001000000000000000c00020007000000000000000c00050008010000000000000c00060003000000000000000c00020072af000000000000280007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c000180fffffeff", @ANYRES32, @ANYBLOB="080001"], 0x8c}, 0x1, 0x0, 0x0, 0x24060801}, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x7, 0x30}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000024010000050a01020000000000000000010000000c00024000000000000000010900010073797a3100000000040004800a000700726f75746500"], 0x1ac}}, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x7d, 0x0, 0x0) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f00000005c0), r1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000600)=0x0) sendmsg$NFC_CMD_ENABLE_SE(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x1c, r5, 0x8, 0x70bd2c, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r7, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) close(r9) close(0xffffffffffffffff) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200000000310000000008000a40fffffffc08000340000000140c0009800800014000000081140000001100010000"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r11 = accept4(r8, 0x0, 0x0, 0x0) sendmsg$kcm(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000004c0), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000740)=ANY=[@ANYBLOB="2cafe6e59cb479100000", @ANYRES16=r12, @ANYBLOB="000227bd7000fcdbdf2501000000080004000300000008000800e000000108000800ac1414aa"], 0x2c}, 0x1, 0x0, 0x0, 0x40004000}, 0x20000004) 1.930456035s ago: executing program 34 (id=1311): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x6c, r1, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}, 0x1, 0x0, 0x400000000000000}, 0x0) 1.860613418s ago: executing program 35 (id=1310): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0x6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}, &(0x7f0000000300)=0xb0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x2dc, @dev={0xfe, 0x80, '\x00', 0x32}, 0x9}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000040), 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001fc0), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(r3, &(0x7f0000002140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002000)={0x20, r4, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x80d4) sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9000000065233201cae12043c94dad1210e03ec4a6d4c8b290b6a7d0f68ae6970dfb20dd93b18689263063190e4f204b891b3b4b030f944d2df4ab5d17fb381204f3874b6694e96d441ab7299d8bbb2a78769c4798e81d88ee46c987867baf2554071bb9bef4e15a938ef0812e016b3ebf", @ANYRES16=r4, @ANYBLOB="02002abd7000fedbdf250300000008000500ffffffff1c00028006000f0000a0000006000b000a0000000800040056000000080006000500000038000180060001000a0000000c000700220000000100000008000b007369700008000b00736970000800090012000000080009006800000008000400fdffffff08000400080000000800060003000000"], 0x90}, 0x1, 0x0, 0x0, 0x4000840}, 0x40) listen(r1, 0x9) accept$inet6(r1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 0s ago: executing program 36 (id=1320): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$FOU_CMD_DEL(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ba3c0000", @ANYRES16=r4, @ANYBLOB="01002abd7000ffdbdf250200000008000800ac141425"], 0x1c}, 0x1, 0x0, 0x0, 0x40000810}, 0x40000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x2, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x20040084) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r7, {0xb, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0xfb55}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x7f, 0x3, 0xc9d, 0xd155}, 0x5f}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0xec}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(0xffffffffffffffff) r8 = socket$key(0xf, 0x3, 0x2) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r9, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x81, @empty, 0x4}], 0x1c) sendto$inet6(r9, &(0x7f0000000040)='l', 0x1, 0x24004881, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @loopback, 0x879}, 0x1c) sendmsg$key(r8, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000200)={0x0, 0x1, 0x30}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000006c0)={r10, 0x58, &(0x7f0000000640)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x5}, @in6={0xa, 0x4e23, 0x6, @mcast2, 0x9}]}, &(0x7f0000000700)=0x10) sendmsg$key(r8, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) kernel console output (not intermixed with test programs): set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.052212][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.059701][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.073218][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.086911][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.096434][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.104267][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.115289][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.124851][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.142938][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.156560][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.163579][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.171502][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.179525][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.190890][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.196677][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.203927][ T5838] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 96.298124][ T1175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.316460][ T1175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.447150][ T5843] syzkaller0: entered promiscuous mode [ 96.453006][ T5843] syzkaller0: entered allmulticast mode [ 96.466988][ T109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.491444][ T109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.777622][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.802316][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.821400][ T5850] syzkaller0: entered promiscuous mode [ 96.843657][ T5850] syzkaller0: entered allmulticast mode [ 96.934141][ T5850] tipc: Started in network mode [ 96.951456][ T5850] tipc: Node identity , cluster identity 4711 [ 96.967437][ T5850] tipc: Failed to obtain node identity [ 96.983467][ T5850] tipc: Enabling of bearer rejected, failed to enable media [ 97.212718][ T5871] netlink: 48 bytes leftover after parsing attributes in process `syz.2.18'. [ 97.359400][ T5864] 8021q: adding VLAN 0 to HW filter on device bond1 [ 97.624776][ T5888] tipc: Started in network mode [ 97.652150][ T5888] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 97.675355][ T5888] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 97.690747][ T5888] tipc: Enabled bearer , priority 10 [ 97.877017][ T5895] netlink: 24 bytes leftover after parsing attributes in process `syz.2.24'. [ 98.062857][ T5911] Zero length message leads to an empty skb [ 98.320351][ T5920] netlink: 24 bytes leftover after parsing attributes in process `syz.1.28'. [ 98.339301][ T5924] netlink: 28 bytes leftover after parsing attributes in process `syz.3.27'. [ 98.361006][ T5924] netlink: 28 bytes leftover after parsing attributes in process `syz.3.27'. [ 98.390396][ T5920] netlink: 24 bytes leftover after parsing attributes in process `syz.1.28'. [ 98.524120][ T5914] netlink: 64 bytes leftover after parsing attributes in process `syz.3.27'. [ 98.647260][ T5938] netlink: 48 bytes leftover after parsing attributes in process `syz.2.31'. [ 98.700010][ T189] tipc: Node number set to 1 [ 99.120389][ T5960] netlink: 104 bytes leftover after parsing attributes in process `syz.2.35'. [ 99.724520][ T5976] syz.3.42 (5976) used greatest stack depth: 18312 bytes left [ 99.947732][ T5991] Bluetooth: MGMT ver 1.23 [ 100.189333][ T6004] netlink: 244 bytes leftover after parsing attributes in process `syz.1.54'. [ 100.229688][ T6008] openvswitch: netlink: Message has 8 unknown bytes. [ 100.250412][ T6008] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 101.028560][ T6045] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.073186][ T6045] openvswitch: netlink: ct_state flags ffffffff unsupported [ 101.407902][ T6060] netlink: 'syz.4.73': attribute type 1 has an invalid length. [ 101.434570][ T6058] syz.2.72 uses obsolete (PF_INET,SOCK_PACKET) [ 101.521542][ T6065] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.930526][ T6087] netlink: 'syz.3.80': attribute type 22 has an invalid length. [ 102.199478][ T6087] netlink: 'syz.3.80': attribute type 22 has an invalid length. [ 102.233194][ T1175] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 102.242619][ T6087] __nla_validate_parse: 3 callbacks suppressed [ 102.242637][ T6087] netlink: 4 bytes leftover after parsing attributes in process `syz.3.80'. [ 102.278807][ T1175] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 102.301643][ T1175] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 102.338443][ T1175] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 102.374610][ T6102] netlink: 8 bytes leftover after parsing attributes in process `syz.4.85'. [ 102.430106][ T6102] netlink: 28 bytes leftover after parsing attributes in process `syz.4.85'. [ 102.453450][ T6102] netlink: 'syz.4.85': attribute type 7 has an invalid length. [ 102.519638][ T6102] netlink: 12 bytes leftover after parsing attributes in process `syz.4.85'. [ 102.972227][ T6129] netlink: 80 bytes leftover after parsing attributes in process `syz.3.91'. [ 103.064482][ T6135] netlink: 8 bytes leftover after parsing attributes in process `syz.4.94'. [ 103.521893][ T6147] netlink: 8 bytes leftover after parsing attributes in process `syz.2.98'. [ 103.562054][ T6147] netlink: 'syz.2.98': attribute type 30 has an invalid length. [ 103.634913][ T6155] IPVS: length: 251 != 8 [ 103.649555][ T1115] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.672952][ T1115] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.702008][ T1115] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.741170][ T1115] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 103.954667][ T6167] netlink: 20 bytes leftover after parsing attributes in process `syz.2.105'. [ 103.982857][ T6167] netlink: 20 bytes leftover after parsing attributes in process `syz.2.105'. [ 104.114553][ T6177] netlink: 12 bytes leftover after parsing attributes in process `syz.3.107'. [ 104.426816][ T6185] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 104.443575][ T6185] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 104.461840][ T6185] bond0 (unregistering): Released all slaves [ 104.567710][ T6185] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 105.125269][ T6219] netlink: 'syz.0.121': attribute type 1 has an invalid length. [ 105.147777][ T6219] netlink: 'syz.0.121': attribute type 1 has an invalid length. [ 105.798724][ T6247] xt_TCPMSS: Only works on TCP SYN packets [ 106.050149][ T6267] netlink: 'syz.3.135': attribute type 8 has an invalid length. [ 106.076497][ T6267] sch_fq: defrate 0 ignored. [ 106.368527][ T6278] syzkaller0: entered promiscuous mode [ 106.379386][ T6278] syzkaller0: entered allmulticast mode [ 106.893933][ T6301] xt_TCPMSS: Only works on TCP SYN packets [ 107.170076][ T6321] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 107.404019][ T6331] __nla_validate_parse: 6 callbacks suppressed [ 107.404038][ T6331] netlink: 8 bytes leftover after parsing attributes in process `syz.3.155'. [ 108.105737][ T6356] xt_TCPMSS: Only works on TCP SYN packets [ 108.347980][ T6373] geneve2: entered promiscuous mode [ 108.364528][ T6373] geneve2: entered allmulticast mode [ 108.776290][ T6401] syzkaller0: entered promiscuous mode [ 108.789984][ T6401] syzkaller0: entered allmulticast mode [ 109.020942][ T6417] FAULT_INJECTION: forcing a failure. [ 109.020942][ T6417] name failslab, interval 1, probability 0, space 0, times 0 [ 109.034573][ T6417] CPU: 0 UID: 0 PID: 6417 Comm: syz.0.175 Not tainted syzkaller #0 PREEMPT(full) [ 109.034602][ T6417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 109.034624][ T6417] Call Trace: [ 109.034632][ T6417] [ 109.034641][ T6417] dump_stack_lvl+0xe8/0x150 [ 109.034688][ T6417] should_fail_ex+0x40c/0x560 [ 109.034723][ T6417] should_failslab+0xa8/0x100 [ 109.034759][ T6417] __kmalloc_noprof+0xfe/0x720 [ 109.034788][ T6417] ? rcu_is_watching+0x15/0xb0 [ 109.034810][ T6417] ? tomoyo_realpath_from_path+0xef/0x640 [ 109.034859][ T6417] ? tomoyo_realpath_from_path+0xef/0x640 [ 109.034900][ T6417] tomoyo_realpath_from_path+0xef/0x640 [ 109.034938][ T6417] ? tomoyo_path_number_perm+0x219/0x5f0 [ 109.034974][ T6417] tomoyo_path_number_perm+0x246/0x5f0 [ 109.035013][ T6417] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 109.035047][ T6417] ? __lock_acquire+0x683/0x2cf0 [ 109.035096][ T6417] ? hook_file_ioctl+0x1f0/0x5f0 [ 109.035142][ T6417] ? __fget_files+0x2a/0x420 [ 109.035176][ T6417] ? __fget_files+0x2a/0x420 [ 109.035206][ T6417] ? __fget_files+0x3a2/0x420 [ 109.035235][ T6417] ? __fget_files+0x2a/0x420 [ 109.035271][ T6417] security_file_ioctl+0xc3/0x2a0 [ 109.035307][ T6417] __se_sys_ioctl+0x47/0x170 [ 109.035330][ T6417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.035355][ T6417] do_syscall_64+0x174/0x580 [ 109.035380][ T6417] ? trace_irq_disable+0x3b/0x140 [ 109.035409][ T6417] ? clear_bhb_loop+0x40/0x90 [ 109.035436][ T6417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.035459][ T6417] RIP: 0033:0x7fc4eb19de99 [ 109.035485][ T6417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.035503][ T6417] RSP: 002b:00007fc4ec010028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 109.035527][ T6417] RAX: ffffffffffffffda RBX: 00007fc4eb425fa0 RCX: 00007fc4eb19de99 [ 109.035543][ T6417] RDX: 0000200000000240 RSI: 000000000000890b RDI: 0000000000000003 [ 109.035557][ T6417] RBP: 00007fc4ec010090 R08: 0000000000000000 R09: 0000000000000000 [ 109.035569][ T6417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.035582][ T6417] R13: 00007fc4eb426038 R14: 00007fc4eb425fa0 R15: 00007fff8937a6e8 [ 109.035618][ T6417] [ 109.248676][ T6420] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.172'. [ 109.275916][ T6417] ERROR: Out of memory at tomoyo_realpath_from_path. [ 110.452149][ T6425] sock: sock_timestamping_bind_phc: sock not bind to device [ 110.464373][ T6425] netdevsim netdevsim0: Firmware load for './file0/file0/..' refused, path contains '..' component [ 110.499230][ T6414] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode [ 110.521480][ T6414] batman_adv: batadv0: Adding interface: wlan0 [ 110.533980][ T6414] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.567972][ T6414] batman_adv: batadv0: Interface activated: wlan0 [ 110.868712][ T6442] xt_TCPMSS: Only works on TCP SYN packets [ 110.966279][ T6447] netlink: 12 bytes leftover after parsing attributes in process `syz.0.181'. [ 111.173006][ T6376] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 111.827320][ T6477] nftables ruleset with unbound set [ 111.964247][ T6489] netlink: 'syz.2.194': attribute type 1 has an invalid length. [ 112.008885][ T6490] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 112.154763][ T6490] xt_SECMARK: invalid mode: 9 [ 112.222801][ T6496] bond1: (slave veth0_to_bond): making interface the new active one [ 112.243885][ T6496] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 112.260220][ T6500] netlink: 20 bytes leftover after parsing attributes in process `syz.1.195'. [ 113.142042][ T6538] tipc: Started in network mode [ 113.150284][ T6538] tipc: Node identity 04000000000000000000000000000001, cluster identity 4711 [ 113.163760][ T6538] tipc: Enabling of bearer rejected, failed to enable media [ 113.243551][ T6544] netlink: 8 bytes leftover after parsing attributes in process `syz.0.207'. [ 114.114155][ T6587] openvswitch: netlink: Message has 8 unknown bytes. [ 114.239599][ T6591] netlink: 12 bytes leftover after parsing attributes in process `syz.2.223'. [ 114.261968][ T6592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.226'. [ 114.345025][ T6599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.226'. [ 114.572172][ T6599] team1: entered promiscuous mode [ 114.577513][ T6599] team1: entered allmulticast mode [ 114.643190][ T6594] tipc: Enabled bearer , priority 0 [ 114.722275][ T6613] trusted_key: syz.4.232 sent an empty control message without MSG_MORE. [ 114.810625][ T6617] xt_ipcomp: unknown flags 1D [ 114.879827][ T6600] syzkaller0: entered promiscuous mode [ 114.886736][ T6600] syzkaller0: entered allmulticast mode [ 114.905305][ T6594] tipc: Resetting bearer [ 115.007354][ T6631] openvswitch: netlink: Unknown key attributes 20 [ 116.340983][ T6594] tipc: Disabling bearer [ 116.350756][ T6613] netlink: 68 bytes leftover after parsing attributes in process `syz.4.232'. [ 116.369470][ T6620] netlink: 32 bytes leftover after parsing attributes in process `syz.0.234'. [ 116.443056][ T5637] tipc: Node number set to 67108865 [ 116.620713][ T6653] openvswitch: netlink: Unknown key attributes 20 [ 116.668896][ T6655] netlink: 76 bytes leftover after parsing attributes in process `syz.1.240'. [ 116.754121][ T6665] netlink: zone id is out of range [ 116.763932][ T6665] netlink: zone id is out of range [ 116.769209][ T6665] netlink: zone id is out of range [ 116.774483][ T6665] netlink: zone id is out of range [ 116.781883][ T6665] netlink: zone id is out of range [ 117.052461][ T6668] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.382440][ T6691] netlink: 16 bytes leftover after parsing attributes in process `syz.0.252'. [ 117.505550][ T6697] openvswitch: netlink: Unknown key attributes 20 [ 117.629919][ T6699] netlink: 4 bytes leftover after parsing attributes in process `syz.4.258'. [ 117.724910][ T6708] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 117.774684][ T6699] hsr_slave_1 (unregistering): left promiscuous mode [ 117.844421][ T6714] netlink: 4 bytes leftover after parsing attributes in process `syz.2.264'. [ 118.050904][ T6722] ieee802154 phy0 wpan0: encryption failed: -22 [ 118.531267][ T6743] openvswitch: netlink: Unknown key attributes 20 [ 118.863153][ T6759] __nla_validate_parse: 2 callbacks suppressed [ 118.863173][ T6759] netlink: 48 bytes leftover after parsing attributes in process `syz.3.280'. [ 119.064079][ T6772] netlink: 'syz.0.282': attribute type 21 has an invalid length. [ 119.099719][ T6772] IPv6: NLM_F_CREATE should be specified when creating new route [ 119.358814][ T6791] openvswitch: netlink: Unknown key attributes 20 [ 119.501938][ T6774] syzkaller0: entered promiscuous mode [ 119.519287][ T6774] syzkaller0: entered allmulticast mode [ 119.924465][ T6814] FAULT_INJECTION: forcing a failure. [ 119.924465][ T6814] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 119.946440][ T6814] CPU: 0 UID: 0 PID: 6814 Comm: syz.2.294 Not tainted syzkaller #0 PREEMPT(full) [ 119.946470][ T6814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 119.946482][ T6814] Call Trace: [ 119.946491][ T6814] [ 119.946499][ T6814] dump_stack_lvl+0xe8/0x150 [ 119.946546][ T6814] should_fail_ex+0x40c/0x560 [ 119.946582][ T6814] _copy_to_user+0x31/0xb0 [ 119.946606][ T6814] simple_read_from_buffer+0xe1/0x170 [ 119.946644][ T6814] proc_fail_nth_read+0x1bb/0x230 [ 119.946680][ T6814] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 119.946715][ T6814] ? rw_verify_area+0x24a/0x4c0 [ 119.946752][ T6814] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 119.946784][ T6814] vfs_read+0x213/0xa80 [ 119.946812][ T6814] ? __pfx___mutex_lock+0x10/0x10 [ 119.946843][ T6814] ? __pfx_vfs_read+0x10/0x10 [ 119.946867][ T6814] ? __fget_files+0x2a/0x420 [ 119.946903][ T6814] ? __fget_files+0x3a2/0x420 [ 119.946932][ T6814] ? __fget_files+0x2a/0x420 [ 119.946973][ T6814] ksys_read+0x150/0x270 [ 119.946998][ T6814] ? __pfx_ksys_read+0x10/0x10 [ 119.947030][ T6814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.947055][ T6814] do_syscall_64+0x174/0x580 [ 119.947079][ T6814] ? trace_irq_disable+0x3b/0x140 [ 119.947109][ T6814] ? clear_bhb_loop+0x40/0x90 [ 119.947137][ T6814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.947159][ T6814] RIP: 0033:0x7ff44df5e6ce [ 119.947185][ T6814] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 119.947203][ T6814] RSP: 002b:00007ff44ee56fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 119.947231][ T6814] RAX: ffffffffffffffda RBX: 00007ff44ee576c0 RCX: 00007ff44df5e6ce [ 119.947248][ T6814] RDX: 000000000000000f RSI: 00007ff44ee570a0 RDI: 0000000000000004 [ 119.947262][ T6814] RBP: 00007ff44ee57090 R08: 0000000000000000 R09: 0000000000000000 [ 119.947276][ T6814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 119.947289][ T6814] R13: 00007ff44e226038 R14: 00007ff44e225fa0 R15: 00007fffd7f63d98 [ 119.947325][ T6814] [ 120.267501][ T6819] IPv6: NLM_F_CREATE should be specified when creating new route [ 120.279483][ T6819] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 120.287353][ T6819] IPv6: NLM_F_CREATE should be set when creating new route [ 120.298241][ T6819] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 120.305608][ T6819] IPv6: NLM_F_CREATE should be set when creating new route [ 121.476997][ T6812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 121.580663][ T1175] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.587911][ T1175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.923142][ T6847] netlink: 44 bytes leftover after parsing attributes in process `syz.3.303'. [ 121.953423][ T6847] IPVS: set_ctl: invalid protocol: 1 255.255.255.255:20000 [ 122.514999][ T1175] tipc: Subscription rejected, illegal request [ 122.573922][ T6877] openvswitch: netlink: Unknown key attributes 20 [ 122.670833][ T6889] bridge0: port 3(ipvlan2) entered blocking state [ 122.688733][ T6889] bridge0: port 3(ipvlan2) entered disabled state [ 122.706300][ T6889] ipvlan2: entered allmulticast mode [ 122.717422][ T6889] bridge0: entered allmulticast mode [ 122.735150][ T6889] ipvlan2: left allmulticast mode [ 122.771539][ T6889] bridge0: left allmulticast mode [ 123.110892][ T6898] netlink: 28 bytes leftover after parsing attributes in process `syz.1.315'. [ 123.125935][ T6898] netlink: 'syz.1.315': attribute type 7 has an invalid length. [ 123.181203][ T6898] netlink: 'syz.1.315': attribute type 8 has an invalid length. [ 123.274743][ T6898] netlink: 4 bytes leftover after parsing attributes in process `syz.1.315'. [ 123.419676][ T6922] openvswitch: netlink: Missing valid actions attribute. [ 123.437536][ T6922] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 123.473882][ T6922] openvswitch: netlink: Missing valid actions attribute. [ 123.530156][ T6922] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 123.634742][ T6940] netlink: 16 bytes leftover after parsing attributes in process `syz.1.321'. [ 123.711607][ T6945] xt_ecn: cannot match TCP bits for non-tcp packets [ 124.263660][ T6924] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 124.483299][ T6949] netlink: 36 bytes leftover after parsing attributes in process `syz.2.323'. [ 124.976681][ T6977] netlink: 24 bytes leftover after parsing attributes in process `syz.0.333'. [ 125.181352][ T6986] netlink: 1220 bytes leftover after parsing attributes in process `syz.1.336'. [ 125.589212][ T7009] netlink: 20 bytes leftover after parsing attributes in process `syz.1.344'. [ 125.894370][ T7023] netlink: 'syz.0.350': attribute type 12 has an invalid length. [ 125.995344][ T7027] warning: `syz.3.352' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 126.011617][ T7027] netlink: 12 bytes leftover after parsing attributes in process `syz.3.352'. [ 126.049355][ T7028] Driver unsupported XDP return value 0 on prog (id 67) dev N/A, expect packet loss! [ 126.196038][ T7034] netlink: 'syz.3.354': attribute type 4 has an invalid length. [ 126.255885][ T7038] netlink: 'syz.3.354': attribute type 1 has an invalid length. [ 126.927838][ T7075] openvswitch: netlink: IP tunnel dst address not specified [ 127.059805][ T7081] netlink: 'syz.1.369': attribute type 1 has an invalid length. [ 127.085153][ T7081] netlink: 'syz.1.369': attribute type 2 has an invalid length. [ 127.591644][ T7108] syzkaller1: entered promiscuous mode [ 127.603974][ T7108] syzkaller1: entered allmulticast mode [ 127.621820][ T7111] netlink: 324 bytes leftover after parsing attributes in process `syz.0.377'. [ 127.633332][ T7108] netlink: 20 bytes leftover after parsing attributes in process `syz.2.379'. [ 127.653194][ T7108] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 127.676969][ T7108] openvswitch: netlink: Unknown key attributes 20 [ 127.914626][ T7122] netlink: 132 bytes leftover after parsing attributes in process `syz.2.382'. [ 128.594897][ T7160] netlink: 170676 bytes leftover after parsing attributes in process `syz.3.392'. [ 128.606524][ T7160] openvswitch: netlink: ufid size 41726 bytes exceeds the range (1, 16) [ 128.614930][ T7160] openvswitch: netlink: Message has 512 unknown bytes. [ 130.758286][ T7116] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 130.977210][ T7165] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 131.334643][ T7183] xt_l2tp: v2 doesn't support IP mode [ 131.351849][ T7183] netlink: 120 bytes leftover after parsing attributes in process `syz.3.401'. [ 131.600003][ T7189] vlan3: entered allmulticast mode [ 131.615832][ T7189] bond0: entered allmulticast mode [ 131.628447][ T7189] bond_slave_0: entered allmulticast mode [ 131.650745][ T7189] bond_slave_1: entered allmulticast mode [ 131.667471][ T7194] netlink: 20 bytes leftover after parsing attributes in process `syz.1.404'. [ 131.690937][ T7201] netlink: 32 bytes leftover after parsing attributes in process `syz.0.407'. [ 131.706275][ T7198] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 131.713846][ T7192] bond0: entered promiscuous mode [ 131.731956][ T7205] netlink: 32 bytes leftover after parsing attributes in process `syz.0.407'. [ 131.758503][ T7192] bond_slave_0: entered promiscuous mode [ 131.778027][ T7192] bond_slave_1: entered promiscuous mode [ 131.810656][ T7192] batadv0: entered promiscuous mode [ 131.836425][ T7192] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 132.140107][ T7221] netlink: 28 bytes leftover after parsing attributes in process `syz.3.413'. [ 132.207959][ T7228] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 132.251669][ T7225] netlink: 8 bytes leftover after parsing attributes in process `syz.0.415'. [ 132.307059][ T7227] syzkaller0: entered promiscuous mode [ 132.312608][ T7227] syzkaller0: entered allmulticast mode [ 132.332504][ T7229] bridge1: entered promiscuous mode [ 132.339189][ T7225] netlink: 'syz.0.415': attribute type 1 has an invalid length. [ 132.349487][ T7225] netlink: 'syz.0.415': attribute type 2 has an invalid length. [ 132.540741][ T30] audit: type=1800 audit(1785166394.933:2): pid=7239 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.418" name="memory.events" dev="tmpfs" ino=538 res=0 errno=0 [ 132.619903][ T30] audit: type=1804 audit(1785166394.973:3): pid=7240 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.418" name="/newroot/102/memory.events" dev="tmpfs" ino=538 res=1 errno=0 [ 132.741144][ T7250] netlink: 'syz.4.421': attribute type 1 has an invalid length. [ 132.980674][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.988545][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.920016][ T7247] ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 133.932310][ T7250] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 134.253855][ T7270] netlink: 28 bytes leftover after parsing attributes in process `syz.0.427'. [ 134.308489][ T7273] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 134.547657][ T7286] netlink: 8 bytes leftover after parsing attributes in process `syz.2.431'. [ 134.578220][ T7286] netlink: 'syz.2.431': attribute type 2 has an invalid length. [ 134.594940][ T7286] netlink: 'syz.2.431': attribute type 2 has an invalid length. [ 134.830240][ T7300] netlink: 9 bytes leftover after parsing attributes in process `syz.4.434'. [ 134.858085][ T7300] netlink: 9 bytes leftover after parsing attributes in process `syz.4.434'. [ 134.994836][ T7304] netlink: 'syz.1.437': attribute type 9 has an invalid length. [ 135.282254][ T7317] netlink: 'syz.3.440': attribute type 1 has an invalid length. [ 136.109417][ T7352] syzkaller0: entered promiscuous mode [ 136.138549][ T7352] syzkaller0: entered allmulticast mode [ 136.476018][ T7374] openvswitch: netlink: Flow key attr not present in new flow. [ 136.569161][ T7377] openvswitch: netlink: Flow key attr not present in new flow. [ 136.686019][ T7381] bridge_slave_1: left allmulticast mode [ 136.696475][ T7381] bridge_slave_1: left promiscuous mode [ 136.702420][ T7381] bridge0: port 2(bridge_slave_1) entered disabled state [ 136.719668][ T7381] bridge_slave_0: left allmulticast mode [ 136.733819][ T7381] bridge_slave_0: left promiscuous mode [ 136.742046][ T7381] bridge0: port 1(bridge_slave_0) entered disabled state [ 136.908845][ T7397] __nla_validate_parse: 5 callbacks suppressed [ 136.908867][ T7397] netlink: 28 bytes leftover after parsing attributes in process `syz.0.462'. [ 137.519776][ T7423] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 137.534770][ T7412] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 137.568048][ T7412] syzkaller1: Refused to change device type [ 137.736305][ T7434] netlink: 12 bytes leftover after parsing attributes in process `syz.2.476'. [ 138.161721][ T7460] netlink: 12 bytes leftover after parsing attributes in process `syz.4.481'. [ 138.276570][ T7464] netlink: 8 bytes leftover after parsing attributes in process `syz.4.481'. [ 138.296629][ T7467] netlink: 'syz.3.483': attribute type 2 has an invalid length. [ 138.341757][ T7460] 8021q: adding VLAN 0 to HW filter on device bond1 [ 138.360946][ T7471] netlink: 'syz.3.483': attribute type 2 has an invalid length. [ 138.372795][ T7471] netlink: 27 bytes leftover after parsing attributes in process `syz.3.483'. [ 138.696141][ T7481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.489'. [ 138.716735][ T7481] netlink: 28 bytes leftover after parsing attributes in process `syz.0.489'. [ 139.594980][ T7493] netlink: 12 bytes leftover after parsing attributes in process `syz.2.492'. [ 139.602592][ T7490] netlink: 4 bytes leftover after parsing attributes in process `syz.2.492'. [ 139.607478][ T7488] netlink: 20 bytes leftover after parsing attributes in process `syz.1.491'. [ 139.637131][ T7488] veth0: entered promiscuous mode [ 139.662163][ T7497] geneve2: entered promiscuous mode [ 139.669223][ T7485] veth0: left promiscuous mode [ 140.020861][ T7504] 8021q: adding VLAN 0 to HW filter on device bond2 [ 140.068074][ T7517] tap0: tun_chr_ioctl cmd 2148553947 [ 140.107710][ T7520] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 140.662839][ T7545] netlink: 'syz.1.511': attribute type 1 has an invalid length. [ 140.894223][ T7545] bond1: entered promiscuous mode [ 140.919094][ T7545] 8021q: adding VLAN 0 to HW filter on device bond1 [ 141.064420][ T7551] vxcan0: tx address claim with different name [ 141.099856][ T7571] netlink: 'syz.0.517': attribute type 75 has an invalid length. [ 141.109057][ T7551] netlink: 'syz.1.511': attribute type 1 has an invalid length. [ 141.409679][ T7520] infiniband syz0: set down [ 141.432410][ T7520] infiniband syz0: added ipvlan1 [ 141.559337][ T7520] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 141.590197][ T7593] veth0_macvtap: left promiscuous mode [ 141.596576][ T7520] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 141.623298][ T7520] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 141.749570][ T7520] RDS/IB: syz0: added [ 141.764335][ T7520] smc: adding ib device syz0 with port count 1 [ 141.772321][ T7520] smc: ib device syz0 port 1 has no pnetid [ 142.059357][ T7608] __nla_validate_parse: 15 callbacks suppressed [ 142.059377][ T7608] netlink: 8 bytes leftover after parsing attributes in process `syz.3.526'. [ 142.209591][ T7608] netlink: 8 bytes leftover after parsing attributes in process `syz.3.526'. [ 142.361016][ T7620] netlink: 'syz.0.530': attribute type 1 has an invalid length. [ 142.375804][ T7620] netlink: 'syz.0.530': attribute type 2 has an invalid length. [ 143.281593][ T7655] netlink: 40 bytes leftover after parsing attributes in process `syz.1.539'. [ 143.303180][ T7649] netlink: 28 bytes leftover after parsing attributes in process `syz.0.535'. [ 143.321847][ T7659] netlink: 'syz.4.538': attribute type 12 has an invalid length. [ 143.335535][ T7659] netlink: 'syz.4.538': attribute type 29 has an invalid length. [ 143.355160][ T7659] netlink: 148 bytes leftover after parsing attributes in process `syz.4.538'. [ 143.381955][ T7659] netlink: 'syz.4.538': attribute type 3 has an invalid length. [ 143.399426][ T7659] netlink: 'syz.4.538': attribute type 2 has an invalid length. [ 143.420115][ T7659] netlink: 35 bytes leftover after parsing attributes in process `syz.4.538'. [ 143.661835][ T7669] netlink: 'syz.4.541': attribute type 12 has an invalid length. [ 144.927335][ T7713] netlink: 19 bytes leftover after parsing attributes in process `syz.1.545'. [ 145.251196][ T7720] netlink: 20 bytes leftover after parsing attributes in process `syz.0.547'. [ 145.276803][ T7720] geneve3: entered promiscuous mode [ 145.314267][ T7722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.548'. [ 145.451340][ T7630] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 145.486378][ T7713] netlink: 256 bytes leftover after parsing attributes in process `syz.1.545'. [ 145.538672][ T7731] bridge_slave_1: left allmulticast mode [ 145.554821][ T7731] bridge_slave_1: left promiscuous mode [ 145.585189][ T7731] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.635082][ T7731] bridge_slave_0: left allmulticast mode [ 145.662277][ T7731] bridge_slave_0: left promiscuous mode [ 145.693251][ T7731] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.806335][ T7732] syzkaller0: entered promiscuous mode [ 145.821275][ T7732] syzkaller0: entered allmulticast mode [ 145.832996][ T7745] netlink: 'syz.1.554': attribute type 5 has an invalid length. [ 145.960271][ T7750] bond3: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 145.975373][ T7750] bond3 (unregistering): Released all slaves [ 145.988736][ T7754] netlink: 'syz.3.556': attribute type 4 has an invalid length. [ 146.248583][ T7762] tipc: Started in network mode [ 146.258942][ T7762] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 146.272069][ T7762] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 146.280997][ T7762] tipc: Enabled bearer , priority 10 [ 146.490282][ T7766] nbd0: detected capacity change from 0 to 63 [ 146.550705][ T7777] syzkaller1: entered promiscuous mode [ 146.581790][ T7777] syzkaller1: entered allmulticast mode [ 146.646684][ T7779] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 146.711198][ T5648] block nbd0: Receive control failed (result -104) [ 147.097491][ T7805] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 147.120142][ T7805] netlink: 'syz.4.573': attribute type 21 has an invalid length. [ 147.145652][ T7805] __nla_validate_parse: 3 callbacks suppressed [ 147.145672][ T7805] netlink: 132 bytes leftover after parsing attributes in process `syz.4.573'. [ 147.276593][ T5825] tipc: Node number set to 1 [ 147.297116][ T7810] tipc: Enabling of bearer rejected, already enabled [ 147.747777][ T7833] netlink: 36 bytes leftover after parsing attributes in process `syz.0.581'. [ 148.077810][ T7847] netlink: 538 bytes leftover after parsing attributes in process `syz.4.586'. [ 148.094099][ T7801] infiniband syz1: set active [ 148.119607][ T7801] infiniband syz1: added veth0_macvtap [ 148.123986][ T7845] can: request_module (can-proto-0) failed. [ 148.156078][ T7801] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 148.176020][ T7801] infiniband syz1: Couldn't open port 1 [ 148.207308][ T7801] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 148.276079][ T7851] netlink: 9 bytes leftover after parsing attributes in process `syz.3.588'. [ 148.281925][ T7801] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 148.312703][ T7851] gretap0: entered promiscuous mode [ 148.357902][ T7801] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 148.481609][ T7867] syzkaller0: entered promiscuous mode [ 148.507670][ T7867] syzkaller0: entered allmulticast mode [ 148.533957][ T7801] RDS/IB: syz1: added [ 148.557522][ T7801] smc: adding ib device syz1 with port count 1 [ 148.580254][ T7801] smc: ib device syz1 port 1 has no pnetid [ 148.655950][ T7875] netlink: 20 bytes leftover after parsing attributes in process `syz.1.593'. [ 148.939290][ T7884] netlink: 148 bytes leftover after parsing attributes in process `syz.3.599'. [ 149.270894][ T7898] syzkaller1: entered promiscuous mode [ 149.303976][ T7898] syzkaller1: entered allmulticast mode [ 149.585065][ T7910] netlink: 28 bytes leftover after parsing attributes in process `syz.3.605'. [ 149.769385][ T7916] netlink: 44 bytes leftover after parsing attributes in process `syz.3.608'. [ 150.134341][ T7923] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 150.205688][ T7922] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 150.265093][ T7944] netlink: 'syz.1.614': attribute type 25 has an invalid length. [ 150.467269][ T109] bond0: (slave bond_slave_0): interface is now down [ 150.497898][ T109] bond0: (slave bond_slave_1): interface is now down [ 150.532788][ T109] bond0: now running without any active interface! [ 150.700567][ T7960] netlink: 28 bytes leftover after parsing attributes in process `syz.1.618'. [ 150.707434][ T7963] tipc: Enabling of bearer rejected, failed to enable media [ 150.754836][ T7966] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 150.967928][ T7977] netlink: 44 bytes leftover after parsing attributes in process `syz.4.623'. [ 151.174893][ T7984] netlink: 'syz.4.626': attribute type 21 has an invalid length. [ 152.013812][ T12] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x69 [ 152.032575][ T8025] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 152.211826][ T8030] xt_hashlimit: size too large, truncated to 1048576 [ 152.234631][ T8032] ip6t_srh: unknown srh invflags 4000 [ 153.262823][ T8062] __nla_validate_parse: 3 callbacks suppressed [ 153.262865][ T8062] netlink: 40 bytes leftover after parsing attributes in process `syz.4.652'. [ 153.941981][ T8088] vcan0: tx drop: invalid sa for name 0xfffffffffffffffe [ 154.129371][ T8093] tipc: New replicast peer: 172.20.20.170 [ 154.160630][ T8093] tipc: Enabled bearer , priority 10 [ 154.224131][ T8100] netlink: 24 bytes leftover after parsing attributes in process `syz.4.669'. [ 154.706582][ T8121] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 154.736124][ T8121] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 154.760865][ T8121] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 154.779256][ T8121] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 154.857871][ T8121] batadv0 (unregistering): left promiscuous mode [ 155.079498][ T8136] C: renamed from lo (while UP) [ 155.099070][ T8136] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 155.282573][ T8144] sock: sock_timestamping_bind_phc: sock not bind to device [ 155.328693][ T8138] bond2: entered promiscuous mode [ 155.370165][ T8138] bond2: entered allmulticast mode [ 155.395886][ T8138] 8021q: adding VLAN 0 to HW filter on device bond2 [ 155.428378][ T8152] netlink: 'syz.4.688': attribute type 1 has an invalid length. [ 155.635705][ T8152] bond3: option mode: invalid value (7) [ 155.659163][ T8152] bond3 (unregistering): Released all slaves [ 155.694713][ T8163] netlink: 4 bytes leftover after parsing attributes in process `syz.1.693'. [ 156.039476][ T8180] netlink: 284 bytes leftover after parsing attributes in process `syz.0.696'. [ 156.298167][ T8187] syzkaller0: entered promiscuous mode [ 156.316448][ T8187] syzkaller0: entered allmulticast mode [ 156.339027][ T8191] netlink: 44 bytes leftover after parsing attributes in process `syz.1.698'. [ 156.386427][ T8187] tipc: Enabled bearer , priority 0 [ 156.451861][ T8184] tipc: Resetting bearer [ 156.529684][ T8184] tipc: Disabling bearer [ 157.334702][ T8238] netlink: 284 bytes leftover after parsing attributes in process `syz.4.707'. [ 157.898205][ T8269] netlink: 244 bytes leftover after parsing attributes in process `syz.3.714'. [ 158.028043][ T8277] netlink: 'syz.2.713': attribute type 1 has an invalid length. [ 158.047959][ T8268] netlink: 40 bytes leftover after parsing attributes in process `syz.2.713'. [ 158.277430][ T8290] netlink: 28 bytes leftover after parsing attributes in process `syz.2.719'. [ 158.333714][ T8294] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 158.457679][ T8298] netlink: 8 bytes leftover after parsing attributes in process `syz.4.722'. [ 158.472594][ T8296] syzkaller0: entered promiscuous mode [ 158.481915][ T8296] syzkaller0: entered allmulticast mode [ 158.506377][ T8298] GUP no longer grows the stack in syz.4.722 (8298): 200000003000-20000000a000 (200000001000) [ 158.526263][ T8298] CPU: 0 UID: 0 PID: 8298 Comm: syz.4.722 Not tainted syzkaller #0 PREEMPT(full) [ 158.526293][ T8298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 158.526306][ T8298] Call Trace: [ 158.526315][ T8298] [ 158.526324][ T8298] dump_stack_lvl+0xe8/0x150 [ 158.526364][ T8298] __get_user_pages+0x238c/0x2720 [ 158.526394][ T8298] ? __gup_longterm_locked+0xc3b/0x15c0 [ 158.526451][ T8298] __gup_longterm_locked+0xd52/0x15c0 [ 158.526482][ T8298] ? lock_acquire+0x106/0x350 [ 158.526535][ T8298] gup_fast_fallback+0x1d8c/0x20e0 [ 158.526601][ T8298] ? __pfx_gup_fast_fallback+0x10/0x10 [ 158.526631][ T8298] ? is_valid_gup_args+0x11f/0x200 [ 158.526658][ T8298] ? get_user_pages_fast+0x4d/0xb0 [ 158.526684][ T8298] __iov_iter_get_pages_alloc+0x378/0xa40 [ 158.526725][ T8298] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 158.526754][ T8298] iov_iter_get_pages2+0x5e/0xa0 [ 158.526793][ T8298] __se_sys_vmsplice+0x7b5/0x1660 [ 158.526851][ T8298] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 158.526886][ T8298] ? __pfx_futex_wait+0x10/0x10 [ 158.526935][ T8298] ? vfs_write+0x9d5/0xba0 [ 158.527023][ T8298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.527050][ T8298] do_syscall_64+0x174/0x580 [ 158.527076][ T8298] ? trace_irq_disable+0x3b/0x140 [ 158.527107][ T8298] ? clear_bhb_loop+0x40/0x90 [ 158.527135][ T8298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.527158][ T8298] RIP: 0033:0x7ff33f99de99 [ 158.527180][ T8298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.527198][ T8298] RSP: 002b:00007ff340810028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 158.527224][ T8298] RAX: ffffffffffffffda RBX: 00007ff33fc25fa0 RCX: 00007ff33f99de99 [ 158.527241][ T8298] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000017 [ 158.527256][ T8298] RBP: 00007ff33fa33eaf R08: 0000000000000000 R09: 0000000000000000 [ 158.527271][ T8298] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 158.527284][ T8298] R13: 00007ff33fc26038 R14: 00007ff33fc25fa0 R15: 00007ffc7b544e38 [ 158.527320][ T8298] [ 158.763987][ T8298] netlink: 4 bytes leftover after parsing attributes in process `syz.4.722'. [ 159.213013][ T8318] syzkaller0: entered promiscuous mode [ 159.225346][ T8318] syzkaller0: entered allmulticast mode [ 159.371559][ T8329] netlink: 'syz.4.734': attribute type 9 has an invalid length. [ 159.466059][ T810] IPVS: starting estimator thread 0... [ 159.585551][ T8334] IPVS: using max 24 ests per chain, 57600 per kthread [ 159.756287][ T8355] FAULT_INJECTION: forcing a failure. [ 159.756287][ T8355] name failslab, interval 1, probability 0, space 0, times 0 [ 159.784472][ T8355] CPU: 0 UID: 0 PID: 8355 Comm: syz.1.741 Not tainted syzkaller #0 PREEMPT(full) [ 159.784502][ T8355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 159.784515][ T8355] Call Trace: [ 159.784523][ T8355] [ 159.784532][ T8355] dump_stack_lvl+0xe8/0x150 [ 159.784571][ T8355] should_fail_ex+0x40c/0x560 [ 159.784604][ T8355] should_failslab+0xa8/0x100 [ 159.784640][ T8355] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 159.784668][ T8355] ? local_lock_release+0x9c/0x160 [ 159.784704][ T8355] ? __alloc_skb+0x1d7/0x7a0 [ 159.784723][ T8355] ? __alloc_skb+0x1d7/0x7a0 [ 159.784750][ T8355] __alloc_skb+0x1d7/0x7a0 [ 159.784776][ T8355] netlink_ack+0x136/0xb30 [ 159.784799][ T8355] ? __pfx_genl_rcv_msg+0x10/0x10 [ 159.784849][ T8355] netlink_rcv_skb+0x2a4/0x4a0 [ 159.784876][ T8355] ? __pfx_genl_rcv_msg+0x10/0x10 [ 159.784909][ T8355] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 159.784959][ T8355] ? down_read+0x2be/0x330 [ 159.784992][ T8355] genl_rcv+0x28/0x40 [ 159.785021][ T8355] netlink_unicast+0x7bb/0x940 [ 159.785056][ T8355] netlink_sendmsg+0x813/0xb40 [ 159.785092][ T8355] ? __pfx_netlink_sendmsg+0x10/0x10 [ 159.785122][ T8355] ? aa_sock_msg_perm+0xf1/0x1b0 [ 159.785153][ T8355] ? __pfx_netlink_sendmsg+0x10/0x10 [ 159.785178][ T8355] sock_sendmsg_nosec+0x13a/0x180 [ 159.785212][ T8355] ____sys_sendmsg+0x54e/0x850 [ 159.785243][ T8355] ? __pfx_____sys_sendmsg+0x10/0x10 [ 159.785277][ T8355] ? import_iovec+0x73/0xa0 [ 159.785315][ T8355] ___sys_sendmsg+0x2a5/0x360 [ 159.785339][ T8355] ? __lock_acquire+0x683/0x2cf0 [ 159.785375][ T8355] ? __pfx____sys_sendmsg+0x10/0x10 [ 159.785440][ T8355] ? __fget_files+0x2a/0x420 [ 159.785471][ T8355] ? __fget_files+0x3a2/0x420 [ 159.785512][ T8355] __x64_sys_sendmsg+0x1b1/0x290 [ 159.785541][ T8355] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 159.785586][ T8355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.785611][ T8355] do_syscall_64+0x174/0x580 [ 159.785635][ T8355] ? trace_irq_disable+0x3b/0x140 [ 159.785665][ T8355] ? clear_bhb_loop+0x40/0x90 [ 159.785693][ T8355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.785716][ T8355] RIP: 0033:0x7f1c9039de99 [ 159.785736][ T8355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.785754][ T8355] RSP: 002b:00007f1c9127e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 159.785778][ T8355] RAX: ffffffffffffffda RBX: 00007f1c90625fa0 RCX: 00007f1c9039de99 [ 159.785795][ T8355] RDX: 0000000002000040 RSI: 0000200000001940 RDI: 0000000000000005 [ 159.785810][ T8355] RBP: 00007f1c9127e090 R08: 0000000000000000 R09: 0000000000000000 [ 159.785825][ T8355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.785838][ T8355] R13: 00007f1c90626038 R14: 00007f1c90625fa0 R15: 00007ffebf017fb8 [ 159.785874][ T8355] [ 160.102622][ T8358] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 160.196169][ T8331] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 160.403914][ T8369] ip6gre1: entered promiscuous mode [ 160.437240][ T8369] ip6gre1: entered allmulticast mode [ 160.464868][ T8373] openvswitch: netlink: IP tunnel dst address not specified [ 160.473015][ T8373] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 160.663369][ T8379] netlink: 348 bytes leftover after parsing attributes in process `syz.0.752'. [ 160.713492][ T8384] FAULT_INJECTION: forcing a failure. [ 160.713492][ T8384] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 160.745608][ T8384] CPU: 0 UID: 0 PID: 8384 Comm: syz.2.754 Not tainted syzkaller #0 PREEMPT(full) [ 160.745637][ T8384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 160.745654][ T8384] Call Trace: [ 160.745663][ T8384] [ 160.745671][ T8384] dump_stack_lvl+0xe8/0x150 [ 160.745710][ T8384] should_fail_ex+0x40c/0x560 [ 160.745744][ T8384] _copy_from_user+0x2d/0xb0 [ 160.745767][ T8384] kstrtouint_from_user+0xd6/0x180 [ 160.745800][ T8384] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 160.745849][ T8384] proc_fail_nth_write+0x8e/0x210 [ 160.745881][ T8384] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 160.745923][ T8384] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 160.745954][ T8384] vfs_write+0x296/0xba0 [ 160.745987][ T8384] ? __pfx_vfs_write+0x10/0x10 [ 160.746011][ T8384] ? __fget_files+0x2a/0x420 [ 160.746047][ T8384] ? __fget_files+0x3a2/0x420 [ 160.746076][ T8384] ? __fget_files+0x2a/0x420 [ 160.746117][ T8384] ksys_write+0x150/0x270 [ 160.746143][ T8384] ? __pfx_ksys_write+0x10/0x10 [ 160.746175][ T8384] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.746199][ T8384] do_syscall_64+0x174/0x580 [ 160.746224][ T8384] ? trace_irq_disable+0x3b/0x140 [ 160.746253][ T8384] ? clear_bhb_loop+0x40/0x90 [ 160.746281][ T8384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.746304][ T8384] RIP: 0033:0x7ff44df5e6ce [ 160.746324][ T8384] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 160.746343][ T8384] RSP: 002b:00007ff44ee56fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.746366][ T8384] RAX: ffffffffffffffda RBX: 00007ff44ee576c0 RCX: 00007ff44df5e6ce [ 160.746382][ T8384] RDX: 0000000000000001 RSI: 00007ff44ee570a0 RDI: 0000000000000003 [ 160.746404][ T8384] RBP: 00007ff44ee57090 R08: 0000000000000000 R09: 0000000000000000 [ 160.746418][ T8384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 160.746432][ T8384] R13: 00007ff44e226038 R14: 00007ff44e225fa0 R15: 00007fffd7f63d98 [ 160.746469][ T8384] [ 161.456769][ T5648] Bluetooth: hci0: command 0x0401 tx timeout [ 161.492438][ T8405] xt_TCPMSS: Only works on TCP SYN packets [ 161.634286][ T8412] syzkaller0: entered promiscuous mode [ 161.658209][ T8412] syzkaller0: entered allmulticast mode [ 161.726319][ T8415] netlink: 8 bytes leftover after parsing attributes in process `syz.1.763'. [ 162.586252][ T8456] xt_TCPMSS: Only works on TCP SYN packets [ 162.653924][ T8461] sch_tbf: peakrate 7 is lower than or equals to rate 2147483647 ! [ 162.911206][ T8476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.779'. [ 162.977134][ T8478] netlink: 8 bytes leftover after parsing attributes in process `syz.3.779'. [ 163.141798][ T8487] netlink: 'syz.3.782': attribute type 2 has an invalid length. [ 163.955978][ T8533] tipc: Enabling of bearer rejected, already enabled [ 164.437807][ T8551] syzkaller0: entered promiscuous mode [ 164.459898][ T8551] syzkaller0: entered allmulticast mode [ 164.786964][ T8569] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 164.837635][ T8569] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 164.872502][ T8576] netlink: 52 bytes leftover after parsing attributes in process `syz.1.811'. [ 165.154073][ T8584] netlink: 8 bytes leftover after parsing attributes in process `syz.4.815'. [ 165.254373][ T8597] bridge_slave_1: left allmulticast mode [ 165.307754][ T8597] bridge_slave_1: left promiscuous mode [ 165.331965][ T8597] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.393526][ T8597] bridge_slave_0: left allmulticast mode [ 165.436232][ T8597] bridge_slave_0: left promiscuous mode [ 165.445298][ T8597] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.556708][ T8613] tap0: tun_chr_ioctl cmd 1074025672 [ 165.564242][ T8613] tap0: ignored: set checksum disabled [ 165.693450][ T8620] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 166.019475][ T8638] netlink: 104 bytes leftover after parsing attributes in process `syz.4.828'. [ 166.688528][ T8665] netlink: 64 bytes leftover after parsing attributes in process `syz.1.834'. [ 166.723748][ T8665] nbd: must specify at least one socket [ 166.746477][ T8671] netlink: 64 bytes leftover after parsing attributes in process `syz.1.834'. [ 166.799177][ T8671] nbd: must specify at least one socket [ 167.343590][ T8693] netlink: 244 bytes leftover after parsing attributes in process `syz.3.842'. [ 167.542535][ T8703] netlink: 'syz.0.845': attribute type 1 has an invalid length. [ 167.821822][ T8708] bond0: (slave veth0_to_bond): making interface the new active one [ 167.838596][ T8708] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 167.863995][ T8720] xt_TCPMSS: Only works on TCP SYN packets [ 168.019997][ T8727] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 168.241236][ T8735] IPVS: set_ctl: invalid protocol: 59 10.1.1.2:20000 [ 168.462242][ T8745] pimreg: entered allmulticast mode [ 168.489723][ T8745] team0: entered promiscuous mode [ 168.495086][ T8745] team_slave_0: entered promiscuous mode [ 168.506094][ T8745] team_slave_1: entered promiscuous mode [ 168.540331][ T8747] team0 (unregistering): Port device team_slave_0 removed [ 168.555672][ T8747] team0 (unregistering): Port device team_slave_1 removed [ 168.577597][ T8748] netlink: 12 bytes leftover after parsing attributes in process `syz.2.860'. [ 168.770280][ T8758] netlink: 'syz.2.863': attribute type 1 has an invalid length. [ 168.980576][ T8764] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 169.358605][ T8780] netlink: 'syz.0.873': attribute type 4 has an invalid length. [ 169.386913][ T8780] netlink: 116 bytes leftover after parsing attributes in process `syz.0.873'. [ 169.423614][ T8776] xt_TCPMSS: Only works on TCP SYN packets [ 169.669116][ T8797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.876'. [ 169.722103][ T8799] netlink: 12 bytes leftover after parsing attributes in process `syz.3.879'. [ 169.790933][ T5648] block nbd2: Receive control failed (result -107) [ 169.876869][ T8807] netlink: 'syz.4.881': attribute type 1 has an invalid length. [ 170.491984][ T8828] xt_TCPMSS: Only works on TCP SYN packets [ 170.698254][ T8852] netlink: 'syz.4.896': attribute type 1 has an invalid length. [ 170.881603][ T8852] bond4: entered promiscuous mode [ 170.902944][ T8852] 8021q: adding VLAN 0 to HW filter on device bond4 [ 171.138400][ T8879] netlink: 'syz.1.903': attribute type 32 has an invalid length. [ 171.151126][ T8862] netlink: 12 bytes leftover after parsing attributes in process `syz.0.895'. [ 171.153234][ T8879] netlink: 8 bytes leftover after parsing attributes in process `syz.1.903'. [ 171.192544][ T8878] netlink: 8 bytes leftover after parsing attributes in process `syz.3.902'. [ 171.309355][ T8879] bond2: Setting coupled_control to off (0) [ 171.364217][ T8878] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 171.419744][ T8878] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 171.436778][ T8878] gretap1: entered promiscuous mode [ 171.454309][ T8878] gretap1: entered allmulticast mode [ 171.728565][ T8905] netlink: 20 bytes leftover after parsing attributes in process `syz.3.912'. [ 172.629465][ T8957] netlink: 4 bytes leftover after parsing attributes in process `syz.3.930'. [ 173.084989][ T8975] netlink: 28 bytes leftover after parsing attributes in process `syz.0.937'. [ 173.268061][ T8985] netlink: 'syz.4.939': attribute type 1 has an invalid length. [ 173.336310][ T8985] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 173.401093][ T8991] netlink: 80 bytes leftover after parsing attributes in process `syz.3.942'. [ 173.553121][ T9003] netlink: 'syz.0.944': attribute type 4 has an invalid length. [ 173.674592][ T9003] netlink: 12 bytes leftover after parsing attributes in process `syz.0.944'. [ 174.192594][ T9027] block nbd3: Unsupported socket: should be TCP or UNIX. [ 174.201371][ T9026] netlink: 28 bytes leftover after parsing attributes in process `syz.1.951'. [ 174.235340][ T9034] netlink: 24 bytes leftover after parsing attributes in process `syz.2.954'. [ 174.253651][ T9033] netlink: 'syz.0.955': attribute type 1 has an invalid length. [ 174.838405][ T9068] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 174.869497][ T9068] ieee802154 phy0 wpan0: encryption failed: -22 [ 175.232471][ T5648] Bluetooth: hci3: link tx timeout [ 175.238364][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.250252][ T5648] Bluetooth: hci3: link tx timeout [ 175.256159][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.269427][ T5648] Bluetooth: hci3: link tx timeout [ 175.276186][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.285076][ T5648] Bluetooth: hci3: link tx timeout [ 175.290485][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.298245][ T5648] Bluetooth: hci3: link tx timeout [ 175.303507][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.320442][ T5648] Bluetooth: hci3: link tx timeout [ 175.325862][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.333654][ T5648] Bluetooth: hci3: link tx timeout [ 175.339048][ T5648] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 175.366903][ T5648] Bluetooth: hci3: command tx timeout [ 175.578160][ T9097] lo: entered promiscuous mode [ 175.588248][ T9097] tunl0: entered promiscuous mode [ 175.600299][ T9097] gre0: entered promiscuous mode [ 175.645618][ T9097] gretap0: entered promiscuous mode [ 175.793334][ T9109] ipt_ECN: cannot use operation on non-tcp rule [ 175.801959][ T9097] erspan0: entered promiscuous mode [ 175.832748][ T9097] ip_vti0: entered promiscuous mode [ 175.857858][ T9097] ip6_vti0: entered promiscuous mode [ 175.897311][ T9097] sit0: entered promiscuous mode [ 175.940006][ T9097] ip6tnl0: entered promiscuous mode [ 176.061767][ T9097] ip6gre0: entered promiscuous mode [ 176.134962][ T9097] syz_tun: entered promiscuous mode [ 176.207207][ T9097] ip6gretap0: entered promiscuous mode [ 176.267058][ T9097] vcan0: entered promiscuous mode [ 176.364280][ T9097] team0: entered promiscuous mode [ 176.379381][ T9097] team_slave_0: entered promiscuous mode [ 176.392385][ T9097] team_slave_1: entered promiscuous mode [ 176.422187][ T9097] dummy0: entered promiscuous mode [ 176.468647][ T9097] nlmon0: entered promiscuous mode [ 176.504159][ T9097] batadv0: entered promiscuous mode [ 176.531514][ T9097] vxcan0: entered promiscuous mode [ 176.557194][ T9097] vxcan1: entered promiscuous mode [ 176.569840][ T9097] veth0: entered promiscuous mode [ 176.589964][ T9097] veth1: entered promiscuous mode [ 176.621033][ T9097] wg0: entered promiscuous mode [ 176.658256][ T9097] wg1: entered promiscuous mode [ 176.675194][ T9097] wg2: entered promiscuous mode [ 176.691571][ T9097] veth0_to_bridge: entered promiscuous mode [ 176.711246][ T9097] bridge_slave_0: entered promiscuous mode [ 176.730474][ T9097] veth1_to_bridge: entered promiscuous mode [ 176.747817][ T9097] bridge_slave_1: entered promiscuous mode [ 176.759158][ T9097] veth0_to_bond: entered promiscuous mode [ 176.823308][ T9097] bond_slave_0: entered promiscuous mode [ 176.836078][ T9097] veth1_to_bond: entered promiscuous mode [ 176.862146][ T9097] bond_slave_1: entered promiscuous mode [ 176.896147][ T9097] veth0_to_team: entered promiscuous mode [ 176.936157][ T9097] veth1_to_team: entered promiscuous mode [ 176.982376][ T9097] veth0_to_batadv: entered promiscuous mode [ 177.001120][ T9097] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 177.014072][ T9097] batadv_slave_0: entered promiscuous mode [ 177.027858][ T9097] veth1_to_batadv: entered promiscuous mode [ 177.040643][ T9097] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 177.055229][ T9097] batadv_slave_1: entered promiscuous mode [ 177.070013][ T9097] xfrm0: entered promiscuous mode [ 177.082968][ T9097] veth0_to_hsr: entered promiscuous mode [ 177.176420][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 30 seconds [ 177.188142][ T9097] veth1_to_hsr: entered promiscuous mode [ 177.194248][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 30 seconds [ 177.205348][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 30 seconds [ 177.219317][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 30 seconds [ 177.266054][ T9097] hsr0: entered promiscuous mode [ 177.279079][ T9097] veth1_virt_wifi: entered promiscuous mode [ 177.288764][ T9097] veth0_virt_wifi: entered promiscuous mode [ 177.305134][ T9097] virt_wifi0: entered promiscuous mode [ 177.335300][ T9097] vlan0: entered promiscuous mode [ 177.358080][ T9097] vlan1: entered promiscuous mode [ 177.455870][ T5649] Bluetooth: hci3: command 0x0406 tx timeout [ 177.473331][ T9097] macvlan0: entered promiscuous mode [ 177.487344][ T9097] macvlan1: entered promiscuous mode [ 177.499294][ T9097] ipvlan0: entered promiscuous mode [ 177.513366][ T9097] ipvlan1: entered promiscuous mode [ 177.544717][ T9097] macvtap0: entered promiscuous mode [ 177.561432][ T9097] macsec0: entered promiscuous mode [ 177.586322][ T9097] geneve0: entered promiscuous mode [ 177.596245][ T9097] geneve1: entered promiscuous mode [ 177.644478][ T9097] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 177.662013][ T9097] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 177.681184][ T9097] netdevsim netdevsim0 netdevsim2: entered promiscuous mode [ 177.697686][ T9097] netdevsim netdevsim0 netdevsim3: entered promiscuous mode [ 177.724442][ T9097] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 177.749932][ T9097] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 177.761809][ T9097] ip6tnl1: entered promiscuous mode [ 177.773624][ T9097] bridge1: entered promiscuous mode [ 177.793912][ T9097] mac80211_hwsim hwsim16 wlan2: entered promiscuous mode [ 177.817874][ T9097] ipip0: entered promiscuous mode [ 177.824501][ T9097] syztnl2: entered promiscuous mode [ 177.832752][ T9097] bridge2: entered promiscuous mode [ 177.852126][ T9097] vlan2: entered promiscuous mode [ 177.864587][ T9097] ;: entered promiscuous mode [ 177.869989][ T9097] syztnl1: entered promiscuous mode [ 177.876519][ T9097] bond0: entered promiscuous mode [ 177.882260][ T9097] bond1: entered promiscuous mode [ 177.888406][ T9097] bond2: entered promiscuous mode [ 177.894439][ T9101] tipc: Enabling of bearer rejected, already enabled [ 177.971557][ T9133] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 178.020619][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.073806][ T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.121956][ T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.157043][ T9151] __nla_validate_parse: 2 callbacks suppressed [ 178.157064][ T9151] netlink: 28 bytes leftover after parsing attributes in process `syz.2.980'. [ 178.225954][ T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.276603][ T9154] netlink: 12 bytes leftover after parsing attributes in process `syz.0.981'. [ 178.325370][ T9154] block nbd3: Unsupported socket: should be TCP or UNIX. [ 178.416816][ T9173] netlink: 'syz.3.986': attribute type 8 has an invalid length. [ 178.441000][ T9162] bond3: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 178.457982][ T9162] bond3 (unregistering): Released all slaves [ 178.531586][ T9157] tipc: Started in network mode [ 178.547452][ T9157] tipc: Node identity :-SUvS, cluster identity 4711 [ 178.563832][ T9157] tipc: Enabled bearer , priority 0 [ 178.675756][ T9176] syzkaller0: entered promiscuous mode [ 178.681608][ T9176] syzkaller0: entered allmulticast mode [ 178.689729][ T9176] tipc: Resetting bearer [ 178.734462][ T9153] tipc: Resetting bearer [ 180.003176][ T9221] netlink: 28 bytes leftover after parsing attributes in process `syz.3.995'. [ 181.351727][ T9153] tipc: Disabling bearer [ 181.369306][ T9138] tipc: Node number set to 1283347285 [ 181.556156][ T9231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.999'. [ 181.594593][ T9231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.999'. [ 181.630739][ T9231] veth1_to_bond: entered allmulticast mode [ 181.649511][ T9237] netlink: 'syz.3.1001': attribute type 7 has an invalid length. [ 181.672112][ T9231] veth1_to_bond: entered promiscuous mode [ 181.712061][ T9231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.999'. [ 181.728507][ T9237] netlink: 'syz.3.1001': attribute type 7 has an invalid length. [ 181.811244][ T9231] veth1_to_bond (unregistering): left allmulticast mode [ 181.840158][ T9231] veth1_to_bond (unregistering): left promiscuous mode [ 181.883454][ T9231] bond0: (slave bond_slave_1): Releasing backup interface [ 181.963235][ T9254] openvswitch: netlink: VXLAN extension message has 2 unknown bytes. [ 181.972681][ T9255] openvswitch: netlink: VXLAN extension message has 2 unknown bytes. [ 182.704996][ T9288] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1017'. [ 182.734959][ T9288] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1017'. [ 182.839052][ T9291] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1019'. [ 183.068858][ T9302] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1021'. [ 185.759411][ T9296] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 185.958875][ T9323] netlink: 'syz.4.1030': attribute type 1 has an invalid length. [ 185.991423][ T9323] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1030'. [ 186.314338][ T9345] tipc: Enabling of bearer rejected, already enabled [ 186.332970][ T9349] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 186.499877][ T9357] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1036'. [ 186.511339][ T9357] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1036'. [ 186.843194][ T9370] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1041'. [ 186.843523][ T9371] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1041'. [ 186.997284][ T9382] netlink: 'syz.0.1044': attribute type 1 has an invalid length. [ 187.124675][ T9382] dummy0: left promiscuous mode [ 187.283712][ T9391] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1047'. [ 187.293849][ T9391] openvswitch: netlink: Missing key (keys=40, expected=80) [ 187.903998][ T9419] can: request_module (can-proto-4) failed. [ 188.112364][ T9427] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1058'. [ 188.137755][ T9427] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1058'. [ 188.172955][ T9430] netlink: 'syz.2.1060': attribute type 13 has an invalid length. [ 188.303127][ T9434] netlink: 'syz.3.1061': attribute type 4 has an invalid length. [ 188.457837][ T9445] netlink: 'syz.0.1064': attribute type 1 has an invalid length. [ 188.516778][ T9445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1064'. [ 188.648453][ T9445] bond4: (slave bridge0): making interface the new active one [ 188.682965][ T9445] bond4: (slave bridge0): Enslaving as an active interface with an up link [ 188.753415][ T9460] netlink: 'syz.1.1066': attribute type 1 has an invalid length. [ 188.869597][ T9466] netlink: 'syz.2.1067': attribute type 1 has an invalid length. [ 188.941102][ T9470] openvswitch: netlink: Missing key (keys=40, expected=100) [ 189.223278][ T9485] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1072'. [ 189.406534][ T9495] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 189.413838][ T9495] IPv6: NLM_F_CREATE should be set when creating new route [ 189.467419][ T9498] netlink: 'syz.2.1075': attribute type 1 has an invalid length. [ 189.497087][ T9499] netlink: 'syz.2.1075': attribute type 1 has an invalid length. [ 189.521107][ T9498] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 189.553909][ T9499] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 190.518862][ T9561] netlink: 'syz.2.1097': attribute type 8 has an invalid length. [ 190.539821][ T9556] tipc: Enabling of bearer rejected, failed to enable media [ 190.730992][ T9560] bond5: entered promiscuous mode [ 190.994545][ T9580] xt_TCPMSS: Only works on TCP SYN packets [ 191.264841][ T9594] __nla_validate_parse: 11 callbacks suppressed [ 191.264860][ T9594] netlink: 35 bytes leftover after parsing attributes in process `syz.4.1104'. [ 191.782425][ T9620] netlink: 'syz.3.1112': attribute type 11 has an invalid length. [ 191.819810][ T9620] netlink: 'syz.3.1112': attribute type 4 has an invalid length. [ 191.854651][ T9620] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1112'. [ 191.911123][ T9626] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1116'. [ 191.982176][ T9622] xt_TCPMSS: Only works on TCP SYN packets [ 192.086558][ T9630] syzkaller0: entered promiscuous mode [ 192.099637][ T9630] syzkaller0: entered allmulticast mode [ 192.301698][ T9639] syzkaller0: entered promiscuous mode [ 192.308602][ T9639] syzkaller0: entered allmulticast mode [ 192.316712][ T9641] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1121'. [ 192.337210][ T9639] netlink: 'syz.3.1120': attribute type 1 has an invalid length. [ 192.360663][ T9639] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1120'. [ 192.554402][ T9653] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1126'. [ 192.694091][ T9653] 8021q: adding VLAN 0 to HW filter on device bond3 [ 192.734679][ T9653] bond3: entered allmulticast mode [ 192.749447][ T9653] bond0: (slave bond3): Enslaving as an active interface with an up link [ 192.768429][ T9665] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1128'. [ 193.014474][ T9673] xt_TCPMSS: Only works on TCP SYN packets [ 193.122133][ T9681] FAULT_INJECTION: forcing a failure. [ 193.122133][ T9681] name failslab, interval 1, probability 0, space 0, times 0 [ 193.136586][ T9681] CPU: 1 UID: 0 PID: 9681 Comm: syz.2.1135 Not tainted syzkaller #0 PREEMPT(full) [ 193.136629][ T9681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 193.136642][ T9681] Call Trace: [ 193.136650][ T9681] [ 193.136659][ T9681] dump_stack_lvl+0xe8/0x150 [ 193.136696][ T9681] should_fail_ex+0x40c/0x560 [ 193.136723][ T9681] should_failslab+0xa8/0x100 [ 193.136753][ T9681] __kmalloc_node_noprof+0x105/0x740 [ 193.136775][ T9681] ? crypto_alg_lookup+0x3d3/0x450 [ 193.136795][ T9681] ? crypto_create_tfm_node+0x81/0x3c0 [ 193.136824][ T9681] ? crypto_create_tfm_node+0x81/0x3c0 [ 193.136848][ T9681] crypto_create_tfm_node+0x81/0x3c0 [ 193.136869][ T9681] crypto_alloc_tfm_node+0x169/0x3e0 [ 193.136895][ T9681] ah6_init_state+0x140/0x680 [ 193.136926][ T9681] __xfrm_init_state+0x9dd/0x1320 [ 193.136947][ T9681] ? __xfrm_init_state+0x745/0x1320 [ 193.136968][ T9681] xfrm_add_sa+0x2f51/0x40d0 [ 193.136995][ T9681] ? __pfx_xfrm_add_sa+0x10/0x10 [ 193.137012][ T9681] ? apparmor_capable+0x126/0x170 [ 193.137041][ T9681] ? __nla_parse+0x40/0x60 [ 193.137070][ T9681] xfrm_user_rcv_msg+0x7a8/0xf30 [ 193.137090][ T9681] ? preempt_schedule_thunk+0x16/0x40 [ 193.137113][ T9681] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 193.137157][ T9681] ? __mutex_trylock_common+0x15f/0x270 [ 193.137179][ T9681] ? __pfx___mutex_trylock_common+0x10/0x10 [ 193.137200][ T9681] ? rcu_is_watching+0x15/0xb0 [ 193.137218][ T9681] ? trace_contention_end+0x3d/0x140 [ 193.137253][ T9681] netlink_rcv_skb+0x226/0x4a0 [ 193.137275][ T9681] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 193.137295][ T9681] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 193.137335][ T9681] xfrm_netlink_rcv+0x79/0x90 [ 193.137353][ T9681] netlink_unicast+0x7bb/0x940 [ 193.137380][ T9681] netlink_sendmsg+0x813/0xb40 [ 193.137408][ T9681] ? __pfx_netlink_sendmsg+0x10/0x10 [ 193.137432][ T9681] ? aa_sock_msg_perm+0xf1/0x1b0 [ 193.137456][ T9681] ? __pfx_netlink_sendmsg+0x10/0x10 [ 193.137476][ T9681] sock_sendmsg_nosec+0x13a/0x180 [ 193.137511][ T9681] ____sys_sendmsg+0x54e/0x850 [ 193.137535][ T9681] ? __pfx_____sys_sendmsg+0x10/0x10 [ 193.137562][ T9681] ? import_iovec+0x73/0xa0 [ 193.137593][ T9681] ___sys_sendmsg+0x2a5/0x360 [ 193.137611][ T9681] ? __lock_acquire+0x683/0x2cf0 [ 193.137645][ T9681] ? __pfx____sys_sendmsg+0x10/0x10 [ 193.137694][ T9681] ? __fget_files+0x2a/0x420 [ 193.137718][ T9681] ? __fget_files+0x3a2/0x420 [ 193.137751][ T9681] __x64_sys_sendmsg+0x1b1/0x290 [ 193.137773][ T9681] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 193.137808][ T9681] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.137828][ T9681] do_syscall_64+0x174/0x580 [ 193.137848][ T9681] ? trace_irq_disable+0x3b/0x140 [ 193.137872][ T9681] ? clear_bhb_loop+0x40/0x90 [ 193.137901][ T9681] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.137919][ T9681] RIP: 0033:0x7ff44df9de99 [ 193.137936][ T9681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.137951][ T9681] RSP: 002b:00007ff44ee57028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.137976][ T9681] RAX: ffffffffffffffda RBX: 00007ff44e225fa0 RCX: 00007ff44df9de99 [ 193.137990][ T9681] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 193.138002][ T9681] RBP: 00007ff44ee57090 R08: 0000000000000000 R09: 0000000000000000 [ 193.138013][ T9681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.138024][ T9681] R13: 00007ff44e226038 R14: 00007ff44e225fa0 R15: 00007fffd7f63d98 [ 193.138052][ T9681] [ 193.887076][ T9705] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1143'. [ 193.930426][ T9705] netlink: 'syz.3.1143': attribute type 39 has an invalid length. [ 194.121847][ T9720] netlink: 'syz.1.1147': attribute type 4 has an invalid length. [ 194.144028][ T9719] netlink: 'syz.1.1147': attribute type 4 has an invalid length. [ 194.337274][ T9731] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1151'. [ 194.369972][ T9731] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1151'. [ 194.419682][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.427957][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.728479][ T9742] xt_TCPMSS: Only works on TCP SYN packets [ 194.983549][ T9756] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 195.002469][ T9756] syzkaller1: linktype set to 823 [ 195.020693][ T9756] netlink: 'syz.0.1157': attribute type 11 has an invalid length. [ 195.757125][ T9780] xt_TCPMSS: Only works on TCP SYN packets [ 195.790318][ T9794] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 196.922109][ T9858] __nla_validate_parse: 33 callbacks suppressed [ 196.922130][ T9858] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1194'. [ 196.944239][ T9858] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1194'. [ 196.954045][ T9858] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1194'. [ 197.039395][ T9856] macvlan2: entered promiscuous mode [ 197.044997][ T9856] macvlan2: entered allmulticast mode [ 197.054329][ T9856] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 197.064244][ T9856] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 197.086939][ T9856] team0: Port device macvlan2 added [ 197.329586][ T9875] xt_hashlimit: size too large, truncated to 1048576 [ 197.402743][ T9884] xt_hashlimit: size too large, truncated to 1048576 [ 198.005790][ T9879] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 198.032552][ T9878] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 198.090440][ T9895] veth0_macvtap: Caught tx_queue_len zero misconfig [ 198.182963][ T9897] tipc: Started in network mode [ 198.192834][ T9897] tipc: Node identity 1ee68bda92e9, cluster identity 4711 [ 198.206445][ T9897] tipc: Enabled bearer , priority 0 [ 198.306766][ T9899] syzkaller0: entered promiscuous mode [ 198.312446][ T9899] syzkaller0: entered allmulticast mode [ 198.320632][ T9899] tipc: Resetting bearer [ 198.341654][ T9891] tipc: Resetting bearer [ 198.356462][ T9910] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1206'. [ 198.729204][ T9928] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1211'. [ 200.347374][ T9891] tipc: Disabling bearer [ 200.410520][ T9140] tipc: Node number set to 2349829082 [ 200.540958][ T9939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1215'. [ 200.571806][ T9939] openvswitch: netlink: Flow key attribute not present in set flow. [ 200.777096][ T9952] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1219'. [ 200.794795][ T9953] netlink: 'syz.2.1221': attribute type 39 has an invalid length. [ 200.803636][ T9946] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1217'. [ 200.824385][ T9948] syzkaller0: entered promiscuous mode [ 200.839693][ T9948] syzkaller0: entered allmulticast mode [ 200.922384][ T9959] xt_l2tp: missing protocol rule (udp|l2tpip) [ 201.566047][ T9988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1232'. [ 201.755546][ T9997] tc action pedit 'at' offset 6 out of bounds [ 201.795086][T10000] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1237'. [ 202.004642][T10012] __nla_validate_parse: 1 callbacks suppressed [ 202.004750][T10012] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1240'. [ 202.467016][T10037] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1247'. [ 202.523503][T10032] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 202.636249][T10042] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 202.663993][T10043] netlink: 'syz.3.1249': attribute type 10 has an invalid length. [ 202.692846][T10043] 8021q: adding VLAN 0 to HW filter on device team0 [ 202.722572][T10043] team0: entered promiscuous mode [ 202.738879][T10043] team_slave_0: entered promiscuous mode [ 202.748969][T10043] team_slave_1: entered promiscuous mode [ 202.775746][T10043] bond0: (slave team0): Enslaving as an active interface with an up link [ 202.831853][T10048] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 203.210563][T10067] syzkaller0: entered promiscuous mode [ 203.224441][T10067] syzkaller0: entered allmulticast mode [ 203.402058][T10076] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1262'. [ 203.855551][T10098] syzkaller0: entered promiscuous mode [ 203.861238][T10098] syzkaller0: entered allmulticast mode [ 204.280667][T10123] FAULT_INJECTION: forcing a failure. [ 204.280667][T10123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 204.294625][T10123] CPU: 0 UID: 0 PID: 10123 Comm: syz.1.1275 Not tainted syzkaller #0 PREEMPT(full) [ 204.294655][T10123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 204.294668][T10123] Call Trace: [ 204.294676][T10123] [ 204.294685][T10123] dump_stack_lvl+0xe8/0x150 [ 204.294721][T10123] should_fail_ex+0x40c/0x560 [ 204.294753][T10123] _copy_from_user+0x2d/0xb0 [ 204.294775][T10123] ___sys_sendmsg+0x1c6/0x360 [ 204.294798][T10123] ? __lock_acquire+0x683/0x2cf0 [ 204.294834][T10123] ? __pfx____sys_sendmsg+0x10/0x10 [ 204.294896][T10123] ? __fget_files+0x2a/0x420 [ 204.294926][T10123] ? __fget_files+0x3a2/0x420 [ 204.294967][T10123] __x64_sys_sendmsg+0x1b1/0x290 [ 204.294994][T10123] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 204.295038][T10123] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.295063][T10123] do_syscall_64+0x174/0x580 [ 204.295086][T10123] ? trace_irq_disable+0x3b/0x140 [ 204.295115][T10123] ? clear_bhb_loop+0x40/0x90 [ 204.295141][T10123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.295163][T10123] RIP: 0033:0x7f1c9039de99 [ 204.295184][T10123] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 204.295202][T10123] RSP: 002b:00007f1c9127e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 204.295226][T10123] RAX: ffffffffffffffda RBX: 00007f1c90625fa0 RCX: 00007f1c9039de99 [ 204.295242][T10123] RDX: 0000000000000800 RSI: 0000200000000180 RDI: 0000000000000003 [ 204.295257][T10123] RBP: 00007f1c9127e090 R08: 0000000000000000 R09: 0000000000000000 [ 204.295271][T10123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 204.295285][T10123] R13: 00007f1c90626038 R14: 00007f1c90625fa0 R15: 00007ffebf017fb8 [ 204.295320][T10123] [ 204.705443][T10134] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1279'. [ 204.723008][T10136] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 204.880091][T10144] netlink: 'syz.1.1283': attribute type 1 has an invalid length. [ 204.898311][T10144] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 205.036473][T10153] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1285'. [ 205.107692][T10161] FAULT_INJECTION: forcing a failure. [ 205.107692][T10161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 205.126028][T10161] CPU: 0 UID: 0 PID: 10161 Comm: syz.0.1288 Not tainted syzkaller #0 PREEMPT(full) [ 205.126059][T10161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 205.126071][T10161] Call Trace: [ 205.126080][T10161] [ 205.126088][T10161] dump_stack_lvl+0xe8/0x150 [ 205.126129][T10161] should_fail_ex+0x40c/0x560 [ 205.126162][T10161] _copy_from_user+0x2d/0xb0 [ 205.126186][T10161] __copy_msghdr+0x390/0x590 [ 205.126216][T10161] ___sys_sendmsg+0x213/0x360 [ 205.126239][T10161] ? __lock_acquire+0x683/0x2cf0 [ 205.126276][T10161] ? __pfx____sys_sendmsg+0x10/0x10 [ 205.126340][T10161] ? __fget_files+0x2a/0x420 [ 205.126378][T10161] ? __fget_files+0x3a2/0x420 [ 205.126420][T10161] __x64_sys_sendmsg+0x1b1/0x290 [ 205.126448][T10161] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 205.126493][T10161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.126518][T10161] do_syscall_64+0x174/0x580 [ 205.126542][T10161] ? trace_irq_disable+0x3b/0x140 [ 205.126572][T10161] ? clear_bhb_loop+0x40/0x90 [ 205.126599][T10161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.126622][T10161] RIP: 0033:0x7fc4eb19de99 [ 205.126643][T10161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 205.126660][T10161] RSP: 002b:00007fc4ec010028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 205.126684][T10161] RAX: ffffffffffffffda RBX: 00007fc4eb425fa0 RCX: 00007fc4eb19de99 [ 205.126700][T10161] RDX: 0000000000000800 RSI: 0000200000000180 RDI: 0000000000000003 [ 205.126715][T10161] RBP: 00007fc4ec010090 R08: 0000000000000000 R09: 0000000000000000 [ 205.126729][T10161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 205.126743][T10161] R13: 00007fc4eb426038 R14: 00007fc4eb425fa0 R15: 00007fff8937a6e8 [ 205.126778][T10161] [ 205.631019][T10180] gre2: entered promiscuous mode [ 205.673354][T10185] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 206.269048][T10208] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1300'. [ 206.548628][T10223] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1305'. [ 206.811765][T10233] sock: sock_set_timeout: `syz.3.1310' (pid 10233) tries to set negative timeout [ 206.849111][T10234] netlink: 232 bytes leftover after parsing attributes in process `syz.1.1309'. [ 207.047276][ T1162] bond0: (slave team0): interface is now down [ 207.056878][ T1162] bond0: now running without any active interface! [ 207.209533][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 60 seconds [ 207.222534][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 60 seconds [ 207.250398][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 60 seconds [ 207.261530][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 60 seconds [ 207.895755][T10254] syzkaller0: entered promiscuous mode [ 207.901288][T10254] syzkaller0: entered allmulticast mode [ 207.915030][T10254] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1316'. [ 207.940819][T10254] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1316'. [ 207.951676][T10254] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1316'. [ 208.067260][T10256] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1317'. [ 211.222886][ T4994] udevd[4994]: worker [5634] /devices/virtual/block/nbd0 is taking a long time [ 211.854406][ T5648] Bluetooth: hci0: command 0x0401 tx timeout [ 211.854503][ T50] Bluetooth: hci4: command 0x0406 tx timeout [ 211.860667][ T5631] Bluetooth: hci1: command 0x0406 tx timeout [ 211.866764][ T4944] Bluetooth: hci2: command 0x0406 tx timeout [ 222.355708][ T5640] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 222.372288][ T5640] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 222.381942][ T5640] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 222.391787][ T5645] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 222.392705][ T5640] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 222.411655][ T5645] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 222.415113][ T5640] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 222.427997][ T5645] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 222.443794][ T5645] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 222.462237][ T5645] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 222.520636][ T5635] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 222.532601][ T5635] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 222.540791][ T5635] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 222.551547][ T5635] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 222.563664][ T5635] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 222.728091][ T5645] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 222.745474][ T5645] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 222.765691][ T5645] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 222.775362][ T5645] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 222.789186][ T5645] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 224.345726][ T5645] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 224.360506][T10269] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.375654][ T5645] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 224.385984][ T5645] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 224.386151][T10269] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.402417][ T5645] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 224.410336][T10269] bridge_slave_0: entered allmulticast mode [ 224.417689][ T5645] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 224.429536][T10269] bridge_slave_0: entered promiscuous mode [ 224.486196][ T5635] Bluetooth: hci5: command tx timeout [ 224.493181][T10269] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.500762][ T5635] Bluetooth: hci6: command tx timeout [ 224.525585][T10269] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.545717][T10269] bridge_slave_1: entered allmulticast mode [ 224.554831][T10269] bridge_slave_1: entered promiscuous mode [ 224.647496][ T5635] Bluetooth: hci7: command tx timeout [ 224.701886][T10269] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 224.747678][T10269] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.806452][ T5635] Bluetooth: hci8: command tx timeout [ 224.870229][T10269] team0: Port device team_slave_0 added [ 224.890969][T10269] team0: Port device team_slave_1 added [ 224.954737][T10269] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 224.970464][T10269] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.025455][T10269] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 225.080608][T10269] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 225.087711][T10269] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.113978][T10269] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 225.390309][T10269] hsr_slave_0: entered promiscuous mode [ 225.406776][T10269] hsr_slave_1: entered promiscuous mode [ 225.418555][T10269] debugfs: 'hsr0' already exists in 'hsr' [ 225.429567][T10269] Cannot create hsr debugfs directory [ 225.703714][T10270] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.711786][T10270] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.721274][T10270] bridge_slave_0: entered allmulticast mode [ 225.730898][T10270] bridge_slave_0: entered promiscuous mode [ 225.778822][T10270] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.789784][T10270] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.798269][T10270] bridge_slave_1: entered allmulticast mode [ 225.806896][T10270] bridge_slave_1: entered promiscuous mode [ 225.973654][T10270] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 225.987331][T10270] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 226.104025][T10270] team0: Port device team_slave_0 added [ 226.169001][T10270] team0: Port device team_slave_1 added [ 226.295680][T10270] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 226.302680][T10270] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 226.329788][T10270] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 226.398338][T10270] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 226.405662][T10270] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 226.432799][T10270] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 226.460767][T10274] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.469642][T10274] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.477070][T10274] bridge_slave_0: entered allmulticast mode [ 226.484471][T10274] bridge_slave_0: entered promiscuous mode [ 226.490562][ T5635] Bluetooth: hci9: command tx timeout [ 226.512504][T10274] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.519904][T10274] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.527296][T10274] bridge_slave_1: entered allmulticast mode [ 226.534710][T10274] bridge_slave_1: entered promiscuous mode [ 226.575629][ T5635] Bluetooth: hci6: command tx timeout [ 226.575643][ T5645] Bluetooth: hci5: command tx timeout [ 226.671611][T10270] hsr_slave_0: entered promiscuous mode [ 226.678586][T10270] hsr_slave_1: entered promiscuous mode [ 226.685169][T10270] debugfs: 'hsr0' already exists in 'hsr' [ 226.691303][T10270] Cannot create hsr debugfs directory [ 226.712413][T10274] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 226.736617][ T5645] Bluetooth: hci7: command tx timeout [ 226.755910][T10274] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 226.868647][T10280] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.876796][T10280] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.884075][T10280] bridge_slave_0: entered allmulticast mode [ 226.890393][ T5645] Bluetooth: hci8: command tx timeout [ 226.898118][T10280] bridge_slave_0: entered promiscuous mode [ 226.907761][T10274] team0: Port device team_slave_0 added [ 226.927507][T10280] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.934726][T10280] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.942310][T10280] bridge_slave_1: entered allmulticast mode [ 226.950538][T10280] bridge_slave_1: entered promiscuous mode [ 226.959732][T10274] team0: Port device team_slave_1 added [ 227.053515][T10317] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.061044][T10317] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.068640][T10317] bridge_slave_0: entered allmulticast mode [ 227.077458][T10317] bridge_slave_0: entered promiscuous mode [ 227.088881][T10280] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 227.099042][T10274] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 227.106252][T10274] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.132556][T10274] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 227.150763][T10317] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.158065][T10317] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.165554][T10317] bridge_slave_1: entered allmulticast mode [ 227.173756][T10317] bridge_slave_1: entered promiscuous mode [ 227.184304][T10280] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 227.195051][T10274] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.202176][T10274] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.228595][T10274] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 227.328352][T10317] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 227.340421][T10280] team0: Port device team_slave_0 added [ 227.349393][T10280] team0: Port device team_slave_1 added [ 227.365328][T10317] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 227.472695][T10274] hsr_slave_0: entered promiscuous mode [ 227.479362][T10274] hsr_slave_1: entered promiscuous mode [ 227.487810][T10274] debugfs: 'hsr0' already exists in 'hsr' [ 227.493585][T10274] Cannot create hsr debugfs directory [ 227.501419][T10280] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 227.508438][T10280] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.535293][T10280] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 227.548609][T10317] team0: Port device team_slave_0 added [ 227.559286][T10317] team0: Port device team_slave_1 added [ 227.580066][T10280] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.587521][T10280] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.614965][T10280] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 227.728245][T10317] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 227.735746][T10317] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.761996][T10317] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 227.798075][T10280] hsr_slave_0: entered promiscuous mode [ 227.804693][T10280] hsr_slave_1: entered promiscuous mode [ 227.811421][T10280] debugfs: 'hsr0' already exists in 'hsr' [ 227.817385][T10280] Cannot create hsr debugfs directory [ 227.824100][T10317] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.831273][T10317] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.859701][T10317] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 228.035248][T10317] hsr_slave_0: entered promiscuous mode [ 228.042164][T10317] hsr_slave_1: entered promiscuous mode [ 228.048985][T10317] debugfs: 'hsr0' already exists in 'hsr' [ 228.054832][T10317] Cannot create hsr debugfs directory [ 228.565771][ T5645] Bluetooth: hci9: command tx timeout [ 228.645644][ T5635] Bluetooth: hci5: command tx timeout [ 228.646800][ T5645] Bluetooth: hci6: command tx timeout [ 228.805984][ T5645] Bluetooth: hci7: command tx timeout [ 228.965591][ T5645] Bluetooth: hci8: command tx timeout [ 230.645713][ T5645] Bluetooth: hci9: command tx timeout [ 230.725626][ T5645] Bluetooth: hci5: command tx timeout [ 230.726599][ T5635] Bluetooth: hci6: command tx timeout [ 230.885950][ T5635] Bluetooth: hci7: command tx timeout [ 231.045788][ T5635] Bluetooth: hci8: command tx timeout [ 232.725683][ T5635] Bluetooth: hci9: command tx timeout [ 237.287750][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 90 seconds [ 237.298530][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 90 seconds [ 237.309562][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 90 seconds [ 237.321622][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 90 seconds [ 255.856767][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.863247][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 267.368954][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 120 seconds [ 267.379827][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 120 seconds [ 267.390890][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 120 seconds [ 267.402015][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 120 seconds [ 282.888008][ T5645] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 282.903701][ T5645] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 282.917969][ T5645] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 282.932105][ T5645] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 282.940614][ T5645] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 282.979548][ T5635] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 282.993511][ T5635] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 283.003129][ T5635] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 283.014808][ T5635] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 283.027308][ T5635] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 283.108564][ T5645] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 283.127400][ T5645] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 283.139846][ T5645] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 283.151889][ T5645] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 283.163202][ T5645] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 283.208177][ T5635] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 283.218404][ T5635] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 283.228305][ T5635] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 283.238572][ T5635] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 283.249525][ T5635] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 284.326580][ T5645] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 284.336872][ T5645] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 284.348003][ T5645] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 284.359421][ T5645] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 284.369871][ T5645] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 284.971652][ T5645] Bluetooth: hci10: command tx timeout [ 285.125515][ T5645] Bluetooth: hci11: command tx timeout [ 285.200341][T10367] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.215751][ T5645] Bluetooth: hci12: command tx timeout [ 285.225928][T10367] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.233893][T10367] bridge_slave_0: entered allmulticast mode [ 285.244611][T10367] bridge_slave_0: entered promiscuous mode [ 285.274657][T10367] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.285678][ T5645] Bluetooth: hci13: command tx timeout [ 285.293900][T10367] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.315671][T10367] bridge_slave_1: entered allmulticast mode [ 285.324162][T10367] bridge_slave_1: entered promiscuous mode [ 285.442832][T10367] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 285.471776][T10367] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 285.575269][T10367] team0: Port device team_slave_0 added [ 285.614040][T10367] team0: Port device team_slave_1 added [ 285.770828][T10367] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 285.791425][T10367] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.847192][T10367] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 285.889056][T10367] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 285.905440][T10367] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 285.941267][T10367] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 286.123877][T10367] hsr_slave_0: entered promiscuous mode [ 286.130814][T10367] hsr_slave_1: entered promiscuous mode [ 286.138158][T10367] debugfs: 'hsr0' already exists in 'hsr' [ 286.143964][T10367] Cannot create hsr debugfs directory [ 286.405639][ T5645] Bluetooth: hci14: command tx timeout [ 286.463762][T10365] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.473045][T10365] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.481744][T10365] bridge_slave_0: entered allmulticast mode [ 286.491481][T10365] bridge_slave_0: entered promiscuous mode [ 286.536985][T10365] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.544132][T10365] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.551690][T10365] bridge_slave_1: entered allmulticast mode [ 286.559303][T10365] bridge_slave_1: entered promiscuous mode [ 286.623113][T10365] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 286.672035][T10365] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 286.786826][T10365] team0: Port device team_slave_0 added [ 286.834618][T10365] team0: Port device team_slave_1 added [ 286.885526][T10372] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.892839][T10372] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.900622][T10372] bridge_slave_0: entered allmulticast mode [ 286.908767][T10372] bridge_slave_0: entered promiscuous mode [ 286.919088][T10372] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.926352][T10372] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.933880][T10372] bridge_slave_1: entered allmulticast mode [ 286.942143][T10372] bridge_slave_1: entered promiscuous mode [ 287.012296][T10365] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 287.019480][T10365] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 287.045792][T10365] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 287.056526][ T5645] Bluetooth: hci10: command tx timeout [ 287.068359][T10365] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 287.076674][T10365] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 287.103576][T10365] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 287.130435][T10372] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.150968][T10372] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 287.206190][ T5645] Bluetooth: hci11: command tx timeout [ 287.270091][T10372] team0: Port device team_slave_0 added [ 287.279964][T10372] team0: Port device team_slave_1 added [ 287.286053][ T5645] Bluetooth: hci12: command tx timeout [ 287.365608][ T5645] Bluetooth: hci13: command tx timeout [ 287.422025][T10365] hsr_slave_0: entered promiscuous mode [ 287.428802][T10365] hsr_slave_1: entered promiscuous mode [ 287.435074][T10365] debugfs: 'hsr0' already exists in 'hsr' [ 287.440935][T10365] Cannot create hsr debugfs directory [ 287.448082][T10372] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 287.455140][T10372] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 287.481241][T10372] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 287.536815][T10372] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 287.543833][T10372] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 287.570362][T10372] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 287.632577][T10371] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.642505][T10371] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.649980][T10371] bridge_slave_0: entered allmulticast mode [ 287.657665][T10371] bridge_slave_0: entered promiscuous mode [ 287.710515][T10371] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.718107][T10371] bridge0: port 2(bridge_slave_1) entered disabled state [ 287.725963][T10371] bridge_slave_1: entered allmulticast mode [ 287.733394][T10371] bridge_slave_1: entered promiscuous mode [ 287.785025][T10372] hsr_slave_0: entered promiscuous mode [ 287.791767][T10372] hsr_slave_1: entered promiscuous mode [ 287.798247][T10372] debugfs: 'hsr0' already exists in 'hsr' [ 287.804864][T10372] Cannot create hsr debugfs directory [ 287.907438][T10371] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.922681][T10406] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.930271][T10406] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.938728][T10406] bridge_slave_0: entered allmulticast mode [ 287.946429][T10406] bridge_slave_0: entered promiscuous mode [ 287.978109][T10371] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 287.993427][T10406] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.001029][T10406] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.010283][T10406] bridge_slave_1: entered allmulticast mode [ 288.018146][T10406] bridge_slave_1: entered promiscuous mode [ 288.123146][T10406] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 288.141309][T10371] team0: Port device team_slave_0 added [ 288.161501][T10406] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 288.194660][T10371] team0: Port device team_slave_1 added [ 288.249510][T10406] team0: Port device team_slave_0 added [ 288.282010][T10406] team0: Port device team_slave_1 added [ 288.302595][T10371] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 288.309750][T10371] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.336911][T10371] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 288.377224][T10371] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 288.384281][T10371] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.411200][T10371] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 288.482399][T10406] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 288.489921][ T5645] Bluetooth: hci14: command tx timeout [ 288.495732][T10406] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.522969][T10406] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 288.552342][T10406] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 288.559596][T10406] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.586217][T10406] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 288.637276][T10371] hsr_slave_0: entered promiscuous mode [ 288.643825][T10371] hsr_slave_1: entered promiscuous mode [ 288.650764][T10371] debugfs: 'hsr0' already exists in 'hsr' [ 288.656559][T10371] Cannot create hsr debugfs directory [ 288.707402][T10406] hsr_slave_0: entered promiscuous mode [ 288.714267][T10406] hsr_slave_1: entered promiscuous mode [ 288.722827][T10406] debugfs: 'hsr0' already exists in 'hsr' [ 288.732607][T10406] Cannot create hsr debugfs directory [ 289.125700][ T5645] Bluetooth: hci10: command tx timeout [ 289.286342][ T5645] Bluetooth: hci11: command tx timeout [ 289.365541][ T5645] Bluetooth: hci12: command tx timeout [ 289.445847][ T5645] Bluetooth: hci13: command tx timeout [ 290.565751][ T5645] Bluetooth: hci14: command tx timeout [ 291.206079][ T5645] Bluetooth: hci10: command tx timeout [ 291.365817][ T5645] Bluetooth: hci11: command tx timeout [ 291.445486][ T5645] Bluetooth: hci12: command tx timeout [ 291.526417][ T5645] Bluetooth: hci13: command tx timeout [ 292.645574][ T5645] Bluetooth: hci14: command tx timeout [ 297.458226][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 150 seconds [ 297.469072][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 150 seconds [ 297.480280][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 150 seconds [ 297.491501][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 150 seconds [ 317.287963][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.295067][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 327.532833][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 180 seconds [ 327.543996][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 180 seconds [ 327.556248][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 180 seconds [ 327.567572][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 180 seconds [ 329.064853][ T4994] udevd[4994]: worker [5634] /devices/virtual/block/nbd0 timeout; kill it [ 329.074246][ T4994] udevd[4994]: seq 12133 '/devices/virtual/block/nbd0' killed [ 329.608555][ T5645] Bluetooth: hci3: command 0x0406 tx timeout [ 343.412692][ T5635] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 343.424250][ T5635] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 343.434820][ T5635] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 343.447001][ T5635] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 343.460630][ T5635] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 343.624084][ T5645] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 343.635027][ T5645] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 343.643753][ T5645] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 343.652191][ T5645] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 343.661588][ T5645] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 343.714203][ T5645] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 343.731553][ T5631] Bluetooth: hci18: unexpected cc 0x0c03 length: 249 > 1 [ 343.743129][ T5645] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 343.754584][ T5631] Bluetooth: hci18: unexpected cc 0x1003 length: 249 > 9 [ 343.764750][ T5645] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 343.775863][ T5645] Bluetooth: hci18: unexpected cc 0x1001 length: 249 > 9 [ 343.784710][ T5631] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 343.797898][ T5631] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 343.810129][ T5635] Bluetooth: hci18: unexpected cc 0x0c23 length: 249 > 4 [ 343.819631][ T5631] Bluetooth: hci18: unexpected cc 0x0c38 length: 249 > 2 [ 344.707651][ T5631] Bluetooth: hci19: unexpected cc 0x0c03 length: 249 > 1 [ 344.720073][ T5631] Bluetooth: hci19: unexpected cc 0x1003 length: 249 > 9 [ 344.729363][ T5631] Bluetooth: hci19: unexpected cc 0x1001 length: 249 > 9 [ 344.738723][ T5631] Bluetooth: hci19: unexpected cc 0x0c23 length: 249 > 4 [ 344.749180][ T5631] Bluetooth: hci19: unexpected cc 0x0c38 length: 249 > 2 [ 344.970552][ T5635] Bluetooth: hci6: command 0x0406 tx timeout [ 344.976454][ T5631] Bluetooth: hci5: command 0x0406 tx timeout [ 344.986289][ T5645] Bluetooth: hci7: command 0x0406 tx timeout [ 344.993361][ T5635] Bluetooth: hci8: command 0x0406 tx timeout [ 345.527723][ T50] Bluetooth: hci15: command tx timeout [ 345.685572][ T50] Bluetooth: hci16: command tx timeout [ 345.807980][T10461] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.815698][T10461] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.825831][T10461] bridge_slave_0: entered allmulticast mode [ 345.839361][T10461] bridge_slave_0: entered promiscuous mode [ 345.857430][ T50] Bluetooth: hci17: command tx timeout [ 345.882196][T10461] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.897151][T10461] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.915761][T10461] bridge_slave_1: entered allmulticast mode [ 345.925712][ T50] Bluetooth: hci18: command tx timeout [ 345.939336][T10461] bridge_slave_1: entered promiscuous mode [ 346.050765][T10461] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 346.088566][T10461] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 346.194508][T10461] team0: Port device team_slave_0 added [ 346.244320][T10461] team0: Port device team_slave_1 added [ 346.385898][T10461] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 346.407583][T10461] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.437160][T10461] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 346.490302][T10461] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 346.505503][T10461] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.551227][T10461] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.761713][T10461] hsr_slave_0: entered promiscuous mode [ 346.769159][T10461] hsr_slave_1: entered promiscuous mode [ 346.776505][T10461] debugfs: 'hsr0' already exists in 'hsr' [ 346.783593][T10461] Cannot create hsr debugfs directory [ 346.805675][ T50] Bluetooth: hci19: command tx timeout [ 346.924249][T10465] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.931520][T10465] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.939559][T10465] bridge_slave_0: entered allmulticast mode [ 346.947344][T10465] bridge_slave_0: entered promiscuous mode [ 346.986310][T10465] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.994291][T10465] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.001907][T10465] bridge_slave_1: entered allmulticast mode [ 347.009688][T10465] bridge_slave_1: entered promiscuous mode [ 347.133583][T10465] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 347.157657][T10465] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 347.222919][T10465] team0: Port device team_slave_0 added [ 347.232938][T10465] team0: Port device team_slave_1 added [ 347.350918][T10465] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 347.358560][T10465] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.385233][T10465] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 347.432766][T10465] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 347.439810][T10465] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.466247][T10465] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 347.616117][ T50] Bluetooth: hci15: command tx timeout [ 347.656256][T10471] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.663493][T10471] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.671086][T10471] bridge_slave_0: entered allmulticast mode [ 347.679548][T10471] bridge_slave_0: entered promiscuous mode [ 347.688659][T10471] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.696123][T10471] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.704757][T10471] bridge_slave_1: entered allmulticast mode [ 347.712943][T10471] bridge_slave_1: entered promiscuous mode [ 347.770296][ T50] Bluetooth: hci16: command tx timeout [ 347.827556][T10465] hsr_slave_0: entered promiscuous mode [ 347.834230][T10465] hsr_slave_1: entered promiscuous mode [ 347.842329][T10465] debugfs: 'hsr0' already exists in 'hsr' [ 347.853711][T10465] Cannot create hsr debugfs directory [ 347.913135][T10471] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 347.925705][ T50] Bluetooth: hci17: command tx timeout [ 347.975264][T10471] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 348.007496][ T4944] Bluetooth: hci18: command tx timeout [ 348.103610][T10471] team0: Port device team_slave_0 added [ 348.163052][T10471] team0: Port device team_slave_1 added [ 348.213809][T10468] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.222007][T10468] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.229489][T10468] bridge_slave_0: entered allmulticast mode [ 348.237285][T10468] bridge_slave_0: entered promiscuous mode [ 348.284548][T10468] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.292219][T10468] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.300326][T10468] bridge_slave_1: entered allmulticast mode [ 348.315999][T10468] bridge_slave_1: entered promiscuous mode [ 348.333328][T10502] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.340640][T10502] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.348226][T10502] bridge_slave_0: entered allmulticast mode [ 348.355913][T10502] bridge_slave_0: entered promiscuous mode [ 348.364544][T10502] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.371841][T10502] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.379291][T10502] bridge_slave_1: entered allmulticast mode [ 348.387755][T10502] bridge_slave_1: entered promiscuous mode [ 348.396136][T10471] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 348.403128][T10471] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 348.431155][T10471] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 348.484810][T10471] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 348.492346][T10471] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 348.518654][T10471] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 348.587248][T10468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 348.608768][T10502] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 348.635068][T10468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 348.657151][T10502] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 348.758900][T10502] team0: Port device team_slave_0 added [ 348.768094][T10502] team0: Port device team_slave_1 added [ 348.781563][T10471] hsr_slave_0: entered promiscuous mode [ 348.788432][T10471] hsr_slave_1: entered promiscuous mode [ 348.794808][T10471] debugfs: 'hsr0' already exists in 'hsr' [ 348.800734][T10471] Cannot create hsr debugfs directory [ 348.811160][T10468] team0: Port device team_slave_0 added [ 348.846100][T10468] team0: Port device team_slave_1 added [ 348.876187][T10502] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 348.883196][T10502] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 348.909534][ T4944] Bluetooth: hci19: command tx timeout [ 348.915303][T10502] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 348.930098][T10502] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 348.938407][T10502] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 348.964658][T10502] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 349.018002][T10468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 349.025025][T10468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.053114][T10468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 349.071334][T10468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 349.078731][T10468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.105227][T10468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 349.236769][T10502] hsr_slave_0: entered promiscuous mode [ 349.244983][T10502] hsr_slave_1: entered promiscuous mode [ 349.251699][T10502] debugfs: 'hsr0' already exists in 'hsr' [ 349.257511][T10502] Cannot create hsr debugfs directory [ 349.325843][T10468] hsr_slave_0: entered promiscuous mode [ 349.332551][T10468] hsr_slave_1: entered promiscuous mode [ 349.339434][T10468] debugfs: 'hsr0' already exists in 'hsr' [ 349.346248][T10468] Cannot create hsr debugfs directory [ 349.686466][ T4944] Bluetooth: hci15: command tx timeout [ 349.845558][ T4944] Bluetooth: hci16: command tx timeout [ 350.005726][ T4944] Bluetooth: hci17: command tx timeout [ 350.088405][ T4944] Bluetooth: hci18: command tx timeout [ 350.094069][ T5640] Bluetooth: hci9: command 0x0406 tx timeout [ 350.965699][ T50] Bluetooth: hci19: command tx timeout [ 351.765545][ T50] Bluetooth: hci15: command tx timeout [ 351.925629][ T50] Bluetooth: hci16: command tx timeout [ 352.085616][ T50] Bluetooth: hci17: command tx timeout [ 352.165917][ T50] Bluetooth: hci18: command tx timeout [ 353.045517][ T50] Bluetooth: hci19: command tx timeout [ 357.606031][ T25] block nbd0: Possible stuck request ffff888026fe5080: control (read@0,1024B). Runtime 210 seconds [ 357.616934][ T25] block nbd0: Possible stuck request ffff888026fe5240: control (read@1024,1024B). Runtime 210 seconds [ 357.628035][ T25] block nbd0: Possible stuck request ffff888026fe5400: control (read@2048,1024B). Runtime 210 seconds [ 357.639937][ T25] block nbd0: Possible stuck request ffff888026fe55c0: control (read@3072,1024B). Runtime 210 seconds [ 369.125860][ T31] INFO: task syz.1.1309:10231 blocked for more than 143 seconds. [ 369.135728][ T31] Not tainted syzkaller #0 [ 369.140750][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 369.149656][ T31] task:syz.1.1309 state:D stack:26376 pid:10231 tgid:10228 ppid:5629 task_flags:0x480140 flags:0x00080002 [ 369.161797][ T31] Call Trace: [ 369.165120][ T31] [ 369.168145][ T31] __schedule+0x17d9/0x56c0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 369.172800][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.178136][ T31] ? clockevents_program_event+0x491/0x630 [ 369.184041][ T31] ? __pfx___schedule+0x10/0x10 [ 369.191499][ T31] ? schedule+0x90/0x2b0 [ 369.197547][ T31] schedule+0x164/0x2b0 [ 369.201832][ T31] blk_mq_freeze_queue_wait+0x101/0x180 [ 369.210558][ T31] ? __pfx_blk_mq_freeze_queue_wait+0x10/0x10 [ 369.217020][ T31] ? queue_limits_commit_update_frozen+0x55/0xd0 [ 369.223431][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 369.229996][ T31] queue_limits_commit_update_frozen+0x55/0xd0 [ 369.239475][ T31] nbd_set_size+0x454/0x680 [ 369.249121][ T31] ? __pfx_nbd_set_size+0x10/0x10 [ 369.263719][ T31] ? nla_memcpy+0x5b/0xc0 [ 369.269942][ T31] nbd_genl_reconfigure+0x7e9/0x1e80 [ 369.277671][ T31] ? __pfx_nbd_genl_reconfigure+0x10/0x10 [ 369.283480][ T31] ? rcu_is_watching+0x15/0xb0 [ 369.300567][ T31] ? trace_kmalloc+0x2a/0xf0 [ 369.316031][ T31] ? __kmalloc_noprof+0x396/0x720 [ 369.330439][ T31] ? __nla_parse+0x40/0x60 [ 369.334961][ T31] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 369.341783][ T31] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 369.348518][ T31] genl_family_rcv_msg_doit+0x233/0x340 [ 369.354164][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 369.360745][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.366163][ T31] genl_rcv_msg+0x614/0x7a0 [ 369.370759][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.376287][ T31] ? __pfx_nbd_genl_reconfigure+0x10/0x10 [ 369.382096][ T31] netlink_rcv_skb+0x226/0x4a0 [ 369.387305][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.392417][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 369.398371][ T31] ? down_read+0x2be/0x330 [ 369.402881][ T31] genl_rcv+0x28/0x40 [ 369.409485][ T31] netlink_unicast+0x7bb/0x940 [ 369.415407][ T31] netlink_sendmsg+0x813/0xb40 [ 369.420266][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 369.425712][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 369.430738][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 369.436134][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 369.441217][ T31] ____sys_sendmsg+0x54e/0x850 [ 369.446251][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 369.451636][ T31] ? import_iovec+0x73/0xa0 [ 369.456284][ T31] ___sys_sendmsg+0x2a5/0x360 [ 369.460991][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.466032][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 369.471299][ T31] ? futex_wait+0x2a2/0x390 [ 369.475989][ T31] ? __fget_files+0x2a/0x420 [ 369.480629][ T31] ? __fget_files+0x3a2/0x420 [ 369.485472][ T31] __x64_sys_sendmsg+0x1b1/0x290 [ 369.490456][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 369.496049][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.502162][ T31] do_syscall_64+0x174/0x580 [ 369.506913][ T31] ? trace_irq_disable+0x3b/0x140 [ 369.511985][ T31] ? clear_bhb_loop+0x40/0x90 [ 369.517670][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.523616][ T31] RIP: 0033:0x7f1c9039de99 [ 369.528264][ T31] RSP: 002b:00007f1c9127e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 369.536798][ T31] RAX: ffffffffffffffda RBX: 00007f1c90625fa0 RCX: 00007f1c9039de99 [ 369.544833][ T31] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000005 [ 369.552917][ T31] RBP: 00007f1c90433eaf R08: 0000000000000000 R09: 0000000000000000 [ 369.560957][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 369.569019][ T31] R13: 00007f1c90626038 R14: 00007f1c90625fa0 R15: 00007ffebf017fb8 [ 369.577265][ T31] [ 369.580349][ T31] INFO: task syz.1.1309:10239 blocked for more than 143 seconds. [ 369.588172][ T31] Not tainted syzkaller #0 [ 369.593141][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 369.601958][ T31] task:syz.1.1309 state:D stack:28480 pid:10239 tgid:10228 ppid:5629 task_flags:0x400040 flags:0x00080002 [ 369.614181][ T31] Call Trace: [ 369.618590][ T31] [ 369.621586][ T31] __schedule+0x17d9/0x56c0 [ 369.626370][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.631414][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.636499][ T31] ? unwind_next_frame+0x8f/0x2550 [ 369.641660][ T31] ? __pfx___schedule+0x10/0x10 [ 369.646737][ T31] ? schedule+0x90/0x2b0 [ 369.651075][ T31] schedule+0x164/0x2b0 [ 369.655251][ T31] schedule_preempt_disabled+0x13/0x30 [ 369.660806][ T31] __mutex_lock+0x7bf/0x1550 [ 369.665521][ T31] ? __mutex_lock+0x5d4/0x1550 [ 369.670345][ T31] ? genl_rcv_msg+0x10b/0x7a0 [ 369.675040][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 369.680157][ T31] ? stack_trace_save+0xa9/0x100 [ 369.685157][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.690337][ T31] ? radix_tree_lookup+0x240/0x290 [ 369.695635][ T31] genl_rcv_msg+0x10b/0x7a0 [ 369.700207][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.705430][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.710457][ T31] netlink_rcv_skb+0x226/0x4a0 [ 369.715274][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.721320][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 369.726763][ T31] ? down_read+0x2be/0x330 [ 369.731236][ T31] genl_rcv+0x28/0x40 [ 369.735262][ T31] netlink_unicast+0x7bb/0x940 [ 369.740241][ T31] netlink_sendmsg+0x813/0xb40 [ 369.745062][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 369.750474][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 369.755568][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 369.760892][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 369.766262][ T31] __sys_sendto+0x408/0x5a0 [ 369.770853][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 369.775998][ T31] ? do_user_addr_fault+0xc4a/0x1340 [ 369.781341][ T31] __x64_sys_sendto+0xde/0x100 [ 369.786188][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.792292][ T31] do_syscall_64+0x174/0x580 [ 369.796963][ T31] ? trace_irq_disable+0x3b/0x140 [ 369.802030][ T31] ? clear_bhb_loop+0x40/0x90 [ 369.806813][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.812842][ T31] RIP: 0033:0x7f1c9035e6ce [ 369.817365][ T31] RSP: 002b:00007f1c9123ae88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 369.826717][ T31] RAX: ffffffffffffffda RBX: 00007f1c9123c6c0 RCX: 00007f1c9035e6ce [ 369.834768][ T31] RDX: 000000000000001c RSI: 00007f1c9123b000 RDI: 0000000000000005 [ 369.842876][ T31] RBP: 0000000000000000 R08: 00007f1c9123af04 R09: 000000000000000c [ 369.851530][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 369.859661][ T31] R13: 00007f1c9123af58 R14: 00007f1c9123b000 R15: 0000000000000000 [ 369.867767][ T31] [ 369.870855][ T31] INFO: task syz.1.1309:10244 blocked for more than 144 seconds. [ 369.878661][ T31] Not tainted syzkaller #0 [ 369.883631][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 369.893151][ T31] task:syz.1.1309 state:D stack:26536 pid:10244 tgid:10228 ppid:5629 task_flags:0x400140 flags:0x00080002 [ 369.905559][ T31] Call Trace: [ 369.908914][ T31] [ 369.911885][ T31] __schedule+0x17d9/0x56c0 [ 369.917082][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.922178][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.928700][ T31] ? unwind_next_frame+0x8f/0x2550 [ 369.933976][ T31] ? __pfx___schedule+0x10/0x10 [ 369.939042][ T31] ? schedule+0x90/0x2b0 [ 369.943326][ T31] schedule+0x164/0x2b0 [ 369.947595][ T31] schedule_preempt_disabled+0x13/0x30 [ 369.953132][ T31] __mutex_lock+0x7bf/0x1550 [ 369.957838][ T31] ? __mutex_lock+0x5d4/0x1550 [ 369.962646][ T31] ? genl_rcv_msg+0x10b/0x7a0 [ 369.967416][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 369.972513][ T31] ? stack_trace_save+0xa9/0x100 [ 369.977544][ T31] ? __lock_acquire+0x683/0x2cf0 [ 369.982534][ T31] ? radix_tree_lookup+0x240/0x290 [ 369.987751][ T31] genl_rcv_msg+0x10b/0x7a0 [ 369.992327][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 369.997475][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.002478][ T31] netlink_rcv_skb+0x226/0x4a0 [ 370.007725][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.012854][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 370.018246][ T31] ? down_read+0x2be/0x330 [ 370.022711][ T31] genl_rcv+0x28/0x40 [ 370.027661][ T31] netlink_unicast+0x7bb/0x940 [ 370.032499][ T31] netlink_sendmsg+0x813/0xb40 [ 370.037386][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.042734][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 370.047865][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.053216][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 370.058332][ T31] __sys_sendto+0x408/0x5a0 [ 370.062879][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 370.068079][ T31] ? do_user_addr_fault+0xc4a/0x1340 [ 370.073445][ T31] __x64_sys_sendto+0xde/0x100 [ 370.078306][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.084416][ T31] do_syscall_64+0x174/0x580 [ 370.089144][ T31] ? trace_irq_disable+0x3b/0x140 [ 370.094289][ T31] ? clear_bhb_loop+0x40/0x90 [ 370.099113][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.105055][ T31] RIP: 0033:0x7f1c9035e6ce [ 370.109628][ T31] RSP: 002b:00007f1c91219e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 370.118149][ T31] RAX: ffffffffffffffda RBX: 00007f1c9121b6c0 RCX: 00007f1c9035e6ce [ 370.126284][ T31] RDX: 0000000000000024 RSI: 00007f1c9121a000 RDI: 0000000000000005 [ 370.135544][ T31] RBP: 0000000000000000 R08: 00007f1c91219f04 R09: 000000000000000c [ 370.143592][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 370.151766][ T31] R13: 00007f1c91219f58 R14: 00007f1c9121a000 R15: 0000000000000000 [ 370.159917][ T31] [ 370.162996][ T31] INFO: task syz.3.1310:10233 blocked for more than 144 seconds. [ 370.172576][ T31] Not tainted syzkaller #0 [ 370.177716][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 370.186605][ T31] task:syz.3.1310 state:D stack:27872 pid:10233 tgid:10232 ppid:5633 task_flags:0x400040 flags:0x00080002 [ 370.198819][ T31] Call Trace: [ 370.202206][ T31] [ 370.205192][ T31] __schedule+0x17d9/0x56c0 [ 370.209872][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.214886][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.219958][ T31] ? __pfx___schedule+0x10/0x10 [ 370.224850][ T31] ? schedule+0x90/0x2b0 [ 370.229379][ T31] schedule+0x164/0x2b0 [ 370.234198][ T31] schedule_preempt_disabled+0x13/0x30 [ 370.240383][ T31] __mutex_lock+0x7bf/0x1550 [ 370.245069][ T31] ? __mutex_lock+0x5d4/0x1550 [ 370.250491][ T31] ? genl_rcv_msg+0x10b/0x7a0 [ 370.255760][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 370.260914][ T31] ? __dev_queue_xmit+0x29b/0x3820 [ 370.266243][ T31] ? radix_tree_lookup+0x240/0x290 [ 370.271451][ T31] genl_rcv_msg+0x10b/0x7a0 [ 370.276399][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.281625][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 370.287217][ T31] netlink_rcv_skb+0x226/0x4a0 [ 370.292039][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.297223][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 370.302613][ T31] ? down_read+0x2be/0x330 [ 370.307236][ T31] genl_rcv+0x28/0x40 [ 370.311314][ T31] netlink_unicast+0x7bb/0x940 [ 370.316195][ T31] netlink_sendmsg+0x813/0xb40 [ 370.321008][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.326684][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 370.331694][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.338109][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 370.343214][ T31] __sys_sendto+0x408/0x5a0 [ 370.347964][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 370.353118][ T31] ? do_user_addr_fault+0xc4a/0x1340 [ 370.358561][ T31] __x64_sys_sendto+0xde/0x100 [ 370.363374][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.369530][ T31] do_syscall_64+0x174/0x580 [ 370.374170][ T31] ? trace_irq_disable+0x3b/0x140 [ 370.379336][ T31] ? clear_bhb_loop+0x40/0x90 [ 370.384055][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.390301][ T31] RIP: 0033:0x7f25d335e6ce [ 370.394777][ T31] RSP: 002b:00007f25d41c9e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 370.403575][ T31] RAX: ffffffffffffffda RBX: 00007f25d41cb6c0 RCX: 00007f25d335e6ce [ 370.412819][ T31] RDX: 0000000000000020 RSI: 00007f25d41ca000 RDI: 0000000000000007 [ 370.421443][ T31] RBP: 0000000000000000 R08: 00007f25d41c9f04 R09: 000000000000000c [ 370.429870][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 370.438993][ T31] R13: 00007f25d41c9f58 R14: 00007f25d41ca000 R15: 0000000000000000 [ 370.447294][ T31] [ 370.450432][ T31] INFO: task syz.2.1311:10237 blocked for more than 144 seconds. [ 370.458385][ T31] Not tainted syzkaller #0 [ 370.463369][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 370.472192][ T31] task:syz.2.1311 state:D stack:27872 pid:10237 tgid:10235 ppid:5632 task_flags:0x400040 flags:0x00080002 [ 370.484290][ T31] Call Trace: [ 370.487800][ T31] [ 370.490797][ T31] __schedule+0x17d9/0x56c0 [ 370.495386][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.500387][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.505606][ T31] ? __pfx___schedule+0x10/0x10 [ 370.510547][ T31] ? schedule+0x90/0x2b0 [ 370.514832][ T31] schedule+0x164/0x2b0 [ 370.519157][ T31] schedule_preempt_disabled+0x13/0x30 [ 370.524654][ T31] __mutex_lock+0x7bf/0x1550 [ 370.529341][ T31] ? __mutex_lock+0x5d4/0x1550 [ 370.534195][ T31] ? genl_rcv_msg+0x10b/0x7a0 [ 370.539818][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 370.544905][ T31] ? __dev_queue_xmit+0x29b/0x3820 [ 370.550178][ T31] ? radix_tree_lookup+0x240/0x290 [ 370.555420][ T31] genl_rcv_msg+0x10b/0x7a0 [ 370.559974][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.565019][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 370.570601][ T31] netlink_rcv_skb+0x226/0x4a0 [ 370.575500][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.580565][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 370.586010][ T31] ? down_read+0x2be/0x330 [ 370.590497][ T31] genl_rcv+0x28/0x40 [ 370.594497][ T31] netlink_unicast+0x7bb/0x940 [ 370.599379][ T31] netlink_sendmsg+0x813/0xb40 [ 370.604224][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.609695][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 370.614690][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.620069][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 370.625154][ T31] __sys_sendto+0x408/0x5a0 [ 370.629805][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 370.634916][ T31] ? do_user_addr_fault+0xc4a/0x1340 [ 370.640534][ T31] __x64_sys_sendto+0xde/0x100 [ 370.646493][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.652644][ T31] do_syscall_64+0x174/0x580 [ 370.657454][ T31] ? trace_irq_disable+0x3b/0x140 [ 370.662540][ T31] ? clear_bhb_loop+0x40/0x90 [ 370.667463][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.673420][ T31] RIP: 0033:0x7ff44df5e6ce [ 370.678057][ T31] RSP: 002b:00007ff44ee55e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 370.686552][ T31] RAX: ffffffffffffffda RBX: 00007ff44ee576c0 RCX: 00007ff44df5e6ce [ 370.694533][ T31] RDX: 0000000000000020 RSI: 00007ff44ee56000 RDI: 0000000000000004 [ 370.702709][ T31] RBP: 0000000000000000 R08: 00007ff44ee55f04 R09: 000000000000000c [ 370.710858][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 370.719234][ T31] R13: 00007ff44ee55f58 R14: 00007ff44ee56000 R15: 0000000000000000 [ 370.727536][ T31] [ 370.730705][ T31] INFO: task syz.0.1314:10246 blocked for more than 144 seconds. [ 370.738640][ T31] Not tainted syzkaller #0 [ 370.744857][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 370.753768][ T31] task:syz.0.1314 state:D stack:26344 pid:10246 tgid:10245 ppid:5627 task_flags:0x400140 flags:0x00080002 [ 370.766106][ T31] Call Trace: [ 370.769443][ T31] [ 370.772399][ T31] __schedule+0x17d9/0x56c0 [ 370.777264][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.782309][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.787469][ T31] ? unwind_next_frame+0x8f/0x2550 [ 370.792643][ T31] ? __pfx___schedule+0x10/0x10 [ 370.797622][ T31] ? schedule+0x90/0x2b0 [ 370.801908][ T31] schedule+0x164/0x2b0 [ 370.806529][ T31] schedule_preempt_disabled+0x13/0x30 [ 370.812054][ T31] __mutex_lock+0x7bf/0x1550 [ 370.816780][ T31] ? __mutex_lock+0x5d4/0x1550 [ 370.821598][ T31] ? genl_rcv_msg+0x10b/0x7a0 [ 370.826933][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 370.832016][ T31] ? stack_trace_save+0xa9/0x100 [ 370.837182][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.842178][ T31] ? radix_tree_lookup+0x240/0x290 [ 370.848283][ T31] genl_rcv_msg+0x10b/0x7a0 [ 370.852897][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.858057][ T31] ? __lock_acquire+0x683/0x2cf0 [ 370.863053][ T31] netlink_rcv_skb+0x226/0x4a0 [ 370.868123][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 370.873217][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 370.878648][ T31] ? down_read+0x2be/0x330 [ 370.883110][ T31] genl_rcv+0x28/0x40 [ 370.887516][ T31] netlink_unicast+0x7bb/0x940 [ 370.892371][ T31] netlink_sendmsg+0x813/0xb40 [ 370.897254][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.902764][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 370.907979][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.913348][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 370.918524][ T31] __sys_sendto+0x408/0x5a0 [ 370.923065][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 370.928297][ T31] ? do_user_addr_fault+0xc4a/0x1340 [ 370.933756][ T31] __x64_sys_sendto+0xde/0x100 [ 370.938917][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.945064][ T31] do_syscall_64+0x174/0x580 [ 370.951046][ T31] ? trace_irq_disable+0x3b/0x140 [ 370.956347][ T31] ? clear_bhb_loop+0x40/0x90 [ 370.961070][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.967359][ T31] RIP: 0033:0x7fc4eb15e6ce [ 370.971840][ T31] RSP: 002b:00007fc4ec00ee88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 370.980345][ T31] RAX: ffffffffffffffda RBX: 00007fc4ec0106c0 RCX: 00007fc4eb15e6ce [ 370.988427][ T31] RDX: 0000000000000020 RSI: 00007fc4ec00f000 RDI: 0000000000000007 [ 370.996487][ T31] RBP: 0000000000000000 R08: 00007fc4ec00ef04 R09: 000000000000000c [ 371.004512][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 371.012723][ T31] R13: 00007fc4ec00ef58 R14: 00007fc4ec00f000 R15: 0000000000000000 [ 371.021008][ T31] [ 371.024088][ T31] INFO: task syz.4.1320:10262 blocked for more than 145 seconds. [ 371.032801][ T31] Not tainted syzkaller #0 [ 371.037848][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 371.046793][ T31] task:syz.4.1320 state:D stack:27464 pid:10262 tgid:10261 ppid:5628 task_flags:0x400140 flags:0x00080002 [ 371.059647][ T31] Call Trace: [ 371.062987][ T31] [ 371.066013][ T31] __schedule+0x17d9/0x56c0 [ 371.070586][ T31] ? __lock_acquire+0x683/0x2cf0 [ 371.075748][ T31] ? __lock_acquire+0x683/0x2cf0 [ 371.080756][ T31] ? __pfx___schedule+0x10/0x10 [ 371.085696][ T31] ? schedule+0x90/0x2b0 [ 371.089976][ T31] schedule+0x164/0x2b0 [ 371.094158][ T31] schedule_preempt_disabled+0x13/0x30 [ 371.099827][ T31] __mutex_lock+0x7bf/0x1550 [ 371.104484][ T31] ? __mutex_lock+0x5d4/0x1550 [ 371.109464][ T31] ? genl_rcv_msg+0x10b/0x7a0 [ 371.114199][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 371.119353][ T31] ? __dev_queue_xmit+0x29b/0x3820 [ 371.124519][ T31] ? radix_tree_lookup+0x240/0x290 [ 371.129718][ T31] genl_rcv_msg+0x10b/0x7a0 [ 371.134276][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 371.139424][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 371.144874][ T31] netlink_rcv_skb+0x226/0x4a0 [ 371.149783][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 371.155748][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 371.161162][ T31] ? down_read+0x2be/0x330 [ 371.165707][ T31] genl_rcv+0x28/0x40 [ 371.169741][ T31] netlink_unicast+0x7bb/0x940 [ 371.174576][ T31] netlink_sendmsg+0x813/0xb40 [ 371.179513][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.184847][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 371.189976][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.195441][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 371.200519][ T31] __sys_sendto+0x408/0x5a0 [ 371.205048][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 371.210500][ T31] ? do_user_addr_fault+0xc4a/0x1340 [ 371.215921][ T31] __x64_sys_sendto+0xde/0x100 [ 371.220742][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.226958][ T31] do_syscall_64+0x174/0x580 [ 371.231593][ T31] ? trace_irq_disable+0x3b/0x140 [ 371.236832][ T31] ? clear_bhb_loop+0x40/0x90 [ 371.241693][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.247757][ T31] RIP: 0033:0x7ff33f95e6ce [ 371.252217][ T31] RSP: 002b:00007ff34080ee88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 371.261640][ T31] RAX: ffffffffffffffda RBX: 00007ff3408106c0 RCX: 00007ff33f95e6ce [ 371.269746][ T31] RDX: 000000000000001c RSI: 00007ff34080f000 RDI: 0000000000000007 [ 371.277789][ T31] RBP: 0000000000000000 R08: 00007ff34080ef04 R09: 000000000000000c [ 371.285978][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 371.294076][ T31] R13: 00007ff34080ef58 R14: 00007ff34080f000 R15: 0000000000000000 [ 371.302265][ T31] [ 371.305526][ T31] [ 371.305526][ T31] Showing all locks held in the system: [ 371.313285][ T31] 1 lock held by khungtaskd/31: [ 371.318210][ T31] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 371.328186][ T31] 2 locks held by getty/5384: [ 371.332888][ T31] #0: ffff8880364770a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 371.342784][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 371.352982][ T31] 1 lock held by udevd/5634: [ 371.357674][ T31] #0: ffff888026ebf350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 [ 371.368222][ T31] 3 locks held by kworker/u8:12/6911: [ 371.373648][ T31] #0: ffff8880b863b160 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 371.383671][ T31] #1: ffff8880b8624440 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 [ 371.392654][ T31] #2: ffff8880b8626058 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1a9/0xed0 [ 371.401751][ T31] 5 locks held by kworker/u8:16/6918: [ 371.407238][ T31] 6 locks held by syz.1.1309/10231: [ 371.412473][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.420799][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.429860][ T31] #2: ffff888026ecb260 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_reconfigure+0x4bc/0x1e80 [ 371.440379][ T31] #3: ffff8880266e5a68 (&q->limits_lock){+.+.}-{4:4}, at: nbd_set_size+0x263/0x680 [ 371.450128][ T31] #4: ffff8880266e5430 (&q->q_usage_counter(io)#49){++++}-{0:0}, at: queue_limits_commit_update_frozen+0x55/0xd0 [ 371.462986][ T31] #5: ffff8880266e5468 (&q->q_usage_counter(queue)#33){+.+.}-{0:0}, at: queue_limits_commit_update_frozen+0x55/0xd0 [ 371.475655][ T31] 2 locks held by syz.1.1309/10239: [ 371.480902][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.489408][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.498799][ T31] 2 locks held by syz.1.1309/10244: [ 371.504043][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.512498][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.521800][ T31] 2 locks held by syz.3.1310/10233: [ 371.527268][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.535621][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.544672][ T31] 2 locks held by syz.2.1311/10237: [ 371.550194][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.558598][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.568616][ T31] 2 locks held by syz.0.1314/10246: [ 371.573861][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.582216][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.591503][ T31] 2 locks held by syz.4.1320/10262: [ 371.596822][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.605078][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.614637][ T31] 2 locks held by syz-executor/10269: [ 371.620263][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.628608][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.637709][ T31] 2 locks held by syz-executor/10270: [ 371.643102][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.651391][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.660617][ T31] 2 locks held by syz-executor/10274: [ 371.666858][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.675229][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.684357][ T31] 2 locks held by syz-executor/10280: [ 371.690033][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.698377][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.707501][ T31] 2 locks held by syz-executor/10317: [ 371.712909][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.721499][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.730606][ T31] 2 locks held by syz-executor/10365: [ 371.736082][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.744357][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.753471][ T31] 2 locks held by syz-executor/10367: [ 371.758954][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.768347][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.777474][ T31] 2 locks held by syz-executor/10371: [ 371.782847][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.791140][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.800348][ T31] 2 locks held by syz-executor/10372: [ 371.805842][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.814094][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.823262][ T31] 2 locks held by syz-executor/10406: [ 371.829162][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.837522][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.846747][ T31] 2 locks held by syz-executor/10461: [ 371.852176][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.860522][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.870585][ T31] 2 locks held by syz-executor/10465: [ 371.876246][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.884573][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.893760][ T31] 2 locks held by syz-executor/10468: [ 371.899312][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.907723][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.916851][ T31] 2 locks held by syz-executor/10471: [ 371.922258][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.930755][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.940169][ T31] 2 locks held by syz-executor/10502: [ 371.945684][ T31] #0: ffffffff9009daa8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.953958][ T31] #1: ffffffff9009d8e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 371.963231][ T31] [ 371.965660][ T31] ============================================= [ 371.965660][ T31] [ 371.974918][ T31] NMI backtrace for cpu 0 [ 371.974942][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 371.974966][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 371.974979][ T31] Call Trace: [ 371.974988][ T31] [ 371.974998][ T31] dump_stack_lvl+0xe8/0x150 [ 371.975035][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 371.975070][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 371.975106][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 371.975151][ T31] sys_info+0x135/0x170 [ 371.975179][ T31] watchdog+0xfd7/0x1030 [ 371.975216][ T31] ? watchdog+0x1c7/0x1030 [ 371.975252][ T31] kthread+0x388/0x470 [ 371.975285][ T31] ? __pfx_watchdog+0x10/0x10 [ 371.975314][ T31] ? __pfx_kthread+0x10/0x10 [ 371.975348][ T31] ret_from_fork+0x514/0xb70 [ 371.975384][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 371.975415][ T31] ? __switch_to+0xc89/0x1420 [ 371.975447][ T31] ? __pfx_kthread+0x10/0x10 [ 371.975480][ T31] ret_from_fork_asm+0x1a/0x30 [ 371.975516][ T31] [ 372.081073][ T31] Sending NMI from CPU 0 to CPUs 1: [ 372.086771][ C1] NMI backtrace for cpu 1 [ 372.086792][ C1] CPU: 1 UID: 0 PID: 6911 Comm: kworker/u8:12 Not tainted syzkaller #0 PREEMPT(full) [ 372.086815][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 372.086827][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 372.086855][ C1] RIP: 0010:match_held_lock+0x3/0xb0 [ 372.086879][ C1] Code: b9 3a 90 31 db 48 89 d8 5b 41 5e 41 5f c3 cc cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 56 53 01 00 00 00 48 39 77 10 74 6a 81 7f 20 00 00 20 00 72 5f 48 8b [ 372.086896][ C1] RSP: 0018:ffffc900033f7500 EFLAGS: 00000006 [ 372.086911][ C1] RAX: 0000000000000005 RBX: 0000000000000014 RCX: 0000000080000001 [ 372.086924][ C1] RDX: ffffc900033f7601 RSI: ffffffff8eb59c60 RDI: ffff888023786940 [ 372.086938][ C1] RBP: ffff888023786940 R08: ffffc900033f7760 R09: 0000000000000000 [ 372.086952][ C1] R10: ffffc900033f7678 R11: fffff5200067eed1 R12: 0000000000000004 [ 372.086966][ C1] R13: 0000000000000004 R14: ffffffff8eb59c60 R15: ffff888023785d00 [ 372.086979][ C1] FS: 0000000000000000(0000) GS:ffff888125050000(0000) knlGS:0000000000000000 [ 372.086995][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 372.087009][ C1] CR2: 00007ffefa017f50 CR3: 000000000e946000 CR4: 00000000003526f0 [ 372.087026][ C1] Call Trace: [ 372.087032][ C1] [ 372.087041][ C1] lock_release+0x10c/0x3c0 [ 372.087069][ C1] ? unwind_next_frame+0x8f/0x2550 [ 372.087090][ C1] ? unwind_next_frame+0x8f/0x2550 [ 372.087110][ C1] unwind_next_frame+0x1baa/0x2550 [ 372.087131][ C1] ? stack_trace_save+0xa9/0x100 [ 372.087154][ C1] ? unwind_next_frame+0x8f/0x2550 [ 372.087174][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 372.087205][ C1] arch_stack_walk+0x11b/0x150 [ 372.087227][ C1] ? kasan_save_track+0x3e/0x80 [ 372.087255][ C1] stack_trace_save+0xa9/0x100 [ 372.087277][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 372.087299][ C1] ? kfree+0x1c5/0x640 [ 372.087321][ C1] ? __lock_acquire+0x683/0x2cf0 [ 372.087349][ C1] kasan_save_track+0x3e/0x80 [ 372.087399][ C1] ? nsim_dev_trap_report_work+0x7ac/0xb40 [ 372.087420][ C1] kasan_save_free_info+0x40/0x50 [ 372.087440][ C1] __kasan_slab_free+0x5c/0x80 [ 372.087465][ C1] kmem_cache_free+0x182/0x650 [ 372.087493][ C1] nsim_dev_trap_report_work+0x7ac/0xb40 [ 372.087522][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 372.087544][ C1] process_scheduled_works+0xa8e/0x14e0 [ 372.087579][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 372.087603][ C1] ? assign_work+0x3cf/0x5d0 [ 372.087626][ C1] worker_thread+0xa47/0xfb0 [ 372.087661][ C1] kthread+0x388/0x470 [ 372.087687][ C1] ? __pfx_worker_thread+0x10/0x10 [ 372.087710][ C1] ? __pfx_kthread+0x10/0x10 [ 372.087737][ C1] ret_from_fork+0x514/0xb70 [ 372.087766][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 372.087793][ C1] ? __switch_to+0xc89/0x1420 [ 372.087817][ C1] ? __pfx_kthread+0x10/0x10 [ 372.087844][ C1] ret_from_fork_asm+0x1a/0x30 [ 372.087869][ C1] [ 372.390280][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 372.397203][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 372.406350][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 372.416434][ T31] Call Trace: [ 372.419732][ T31] [ 372.422683][ T31] vpanic+0x56c/0xa60 [ 372.426711][ T31] ? __pfx___schedule+0x10/0x10 [ 372.431576][ T31] ? __pfx_vpanic+0x10/0x10 [ 372.436096][ T31] ? nmi_trigger_cpumask_backtrace+0x207/0x380 [ 372.442295][ T31] panic+0xc5/0xd0 [ 372.446035][ T31] ? __pfx_panic+0x10/0x10 [ 372.450463][ T31] ? preempt_schedule_common+0x82/0xd0 [ 372.455936][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 372.461329][ T31] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 372.467499][ T31] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 372.473669][ T31] watchdog+0x1030/0x1030 [ 372.478017][ T31] ? watchdog+0x1c7/0x1030 [ 372.482452][ T31] kthread+0x388/0x470 [ 372.486540][ T31] ? __pfx_watchdog+0x10/0x10 [ 372.491254][ T31] ? __pfx_kthread+0x10/0x10 [ 372.495877][ T31] ret_from_fork+0x514/0xb70 [ 372.500521][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 372.505681][ T31] ? __switch_to+0xc89/0x1420 [ 372.510406][ T31] ? __pfx_kthread+0x10/0x10 [ 372.515038][ T31] ret_from_fork_asm+0x1a/0x30 [ 372.519844][ T31] [ 372.523532][ T31] Kernel Offset: disabled [ 372.527866][ T31] Rebooting in 86400 seconds..