last executing test programs: 2.994822103s ago: executing program 1 (id=12601): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x78, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x80, 0x35}}}}, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x34}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3a}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7fff}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x331}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x32e}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x7}]}, 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x80) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r2, 0x20, 0x70bd2d, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x4, @bearer=@l2={'ib', 0x3a, 'rose0\x00'}}}}, ["", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000084}, 0x10) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000400)={r0, &(0x7f0000000300)='\xb7\x00', 0x400240, &(0x7f0000000340)={@align=0x7, {0x9, 0xe4, 0x80000000, 0x334e}}, 0x401, &(0x7f0000000380), &(0x7f00000003c0)=0x10001}) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r3, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x408}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x30, 0x1412, 0x800, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004010}, 0x4000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000580), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000005c0)=0x0) sendmsg$NFC_CMD_LLC_GET_PARAMS(r4, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x20, r5, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@NFC_ATTR_FIRMWARE_NAME={0x4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) sendmsg$NFC_CMD_SE_IO(r4, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0xb8, r5, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_SE_APDU={0x72, 0x19, "33eeda45ba7be4b84ccb02432af34d80ca10745aca0d8b671edce3cceedadc6816abce94e27d0d42d058bc0f614014db9cb9f7a91a3f33930e3f45ef51fa6dc4cc611d7393f34f492e92cf464d8809abeed3b6581c34739ed8a64c67df14f6103cde0bfab19fd182e0d8c50d1447"}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0x2}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4000}, 0x4) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000880), r4) sendmsg$NL802154_CMD_NEW_INTERFACE(r4, &(0x7f0000000980)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x74, r7, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_IFTYPE={0x8, 0x5, 0x3}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0302}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan4\x00'}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000015}, 0x4040) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000009c0)={'wpan3\x00'}) syz_genetlink_get_family_id$batadv(0x0, r0) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000b80), r0) sendmsg$DEVLINK_CMD_SB_POOL_GET(r0, &(0x7f0000000d00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0xd0, r8, 0x200, 0x70bd25, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7ab}, {0x6, 0x11, 0x5faa}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x12}, {0x6, 0x11, 0x9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xb7}, {0x6, 0x11, 0xf}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x6}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x20000090}, 0x40) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000e40)={&(0x7f0000000dc0)={0x70, 0x0, 0x8, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @icmp=[@CTA_TIMEOUT_ICMP_TIMEOUT={0x8}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x80}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xffff}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x9}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x21}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x17}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xd}]}, 0x70}, 0x1, 0x0, 0x0, 0x44040}, 0x8000901) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000ec0), 0x2, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(r4, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000f40)={0x54, 0x0, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x11}, 0x20004000) connect$bt_sco(r3, &(0x7f0000001040), 0x8) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000021c0)={0x5, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000022c0)={0x5, 0x18, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}, [@map_fd={0x18, 0x5, 0x1, 0x0, r3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @call={0x85, 0x0, 0x0, 0x82}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @map_fd={0x18, 0x2, 0x1, 0x0, r3}]}, &(0x7f0000001140)='GPL\x00', 0x80000001, 0x1000, &(0x7f0000001180)=""/4096, 0x41100, 0x71, '\x00', 0x0, @fallback=0x15, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002180)={0x2, 0x5, 0x4, 0x401}, 0x10, r9, 0xffffffffffffffff, 0x3, 0x0, &(0x7f0000002280)=[{0x4, 0x1, 0x6, 0xb}, {0x2, 0x5, 0x2, 0x3}, {0x3, 0x2, 0x3, 0xa}], 0x10, 0x9}, 0x94) 2.770074723s ago: executing program 0 (id=12604): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x7d4165c9) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000011) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x0, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r7, 0x0) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9234751", 0x81}], 0x1}, 0x4040) 2.479834273s ago: executing program 0 (id=12606): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x808000}, 0x8) getsockopt$bt_hci(r0, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000001140)={'ip_vti0\x00', &(0x7f00000010c0)={'sit0\x00', r2, 0x20, 0x80, 0x280000, 0x4, {{0xc, 0x4, 0x2, 0x7, 0x30, 0x65, 0x0, 0x14, 0x4, 0x0, @local, @private=0xa010102, {[@lsrr={0x83, 0x1b, 0x51, [@loopback, @multicast1, @multicast2, @loopback, @multicast1, @local]}, @end]}}}}}) pipe(&(0x7f0000001180)={0xffffffffffffffff}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000011c0)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0xcf48, '\x00', r4, r5, 0x1, 0x4}, 0x50) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x1, 0x0, 0x6}}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_raw(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@can={{0x3, 0x1, 0x1, 0x1}, 0x8, 0x1, 0x0, 0x0, "6a5feb87d8d474dd"}, 0x10}, 0x1, 0x0, 0x0, 0x20000444}, 0x0) read(r1, &(0x7f0000000140)=""/55, 0x37) ioctl$XFS_IOC_OPEN_BY_HANDLE(r0, 0xc038586b, &(0x7f0000000280)={r1, &(0x7f00000000c0)='\\&\x00', 0x604480, &(0x7f0000000100)={@_ha_fsid={[0x4, 0x4]}, {0x5b7d, 0x7fff, 0x6, 0x8}}, 0x100, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0xfffffffa}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r7) sendmsg$DEVLINK_CMD_RELOAD(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, r8, 0x1, 0x0, 0x0, {0x7}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000080)=0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x31}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x66, &(0x7f00000001c0)={r9, 0x9}, &(0x7f00000002c0)=0x8) 2.390655422s ago: executing program 1 (id=12608): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x34, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 2.226275054s ago: executing program 1 (id=12610): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8b34, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000700000005000000000000060404000000000000006100"], 0x0, 0x2b, 0x0, 0x1}, 0x28) r2 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r3, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x8, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0) recvfrom$inet6(r3, 0x0, 0x0, 0x10000, 0x0, 0x0) ioctl$SIOCGSTAMPNS(r3, 0x8907, &(0x7f0000000000)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}}}, 0x24}}, 0x0) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xfffa, 0xe}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}]}}]}, 0x44}}, 0x24004000) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000140)=0x1, 0x4) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x6, 0x4, 0x3a7, 0x1, 0xffffffffffffffff, 0x2, '\x00', 0x0, r1, 0x0, 0x1}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xac, 0xac, 0x7, [@decl_tag={0x5, 0x0, 0x0, 0x11, 0x3, 0x6}, @enum64={0x1, 0xa, 0x0, 0x13, 0x0, 0x0, [{0xd, 0x5, 0x2}, {0x4, 0x9, 0x80}, {0x8, 0x2, 0xa005}, {0x8, 0x2, 0x7}, {0xf, 0x6, 0x1}, {0x10, 0x847, 0x9}, {0xc, 0xffffe206, 0x9}, {0xa, 0xf, 0x7}, {0x5, 0x6a, 0x8}, {0x3, 0x5, 0x2}]}, @float={0xe, 0x0, 0x0, 0x10, 0x8}, @fwd={0x1}]}, {0x0, [0x61, 0x0, 0x61, 0x61, 0x5f]}}, &(0x7f00000003c0)=""/168, 0xcb, 0xa8, 0x1, 0x2}, 0x28) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000080)=ANY=[], 0x10448) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@newqdisc={0x34, 0x24, 0x239, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}}, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r10, 0x710, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6=r7}, @L2TP_ATTR_DEBUG={0x8}]}, 0x24}}, 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, r7, 0x75, '\x00', r9, 0xffffffffffffffff, 0x4, 0x4}, 0x50) 2.050916538s ago: executing program 3 (id=12612): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@alg={0xe8, 0x10, 0x1, 0x0, 0x0, {{'drbg_pr_hmac_sha384\x00'}}, [{0x8}]}, 0xe8}}, 0x0) (fail_nth: 6) 2.004740061s ago: executing program 3 (id=12613): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000480)={0x18}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @local}, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000), 0x3) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303, 0x39}, "1f00", "0bf70000000000000000061000000001", "00000004", '\x00\x00\b\x00'}, 0x28) r3 = socket$netlink(0x10, 0x3, 0x4) epoll_wait(r1, &(0x7f0000000300)=[{}], 0x1, 0x10001) writev(r3, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 1.991177194s ago: executing program 1 (id=12614): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x2, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x0, 0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_ECN={0x8}]}}]}, 0x3c}}, 0x2000400c) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) r3 = accept4(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0xe}, &(0x7f0000000200)=0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000020ee010026bd7000000000fb0a2000000000b13b85660000140003006c6f00009281000000003d0000000000000001000000000000f00000000000089119"], 0x44}}, 0x40000) 1.919321056s ago: executing program 4 (id=12615): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x3, 0xff) socket$netlink(0x10, 0x3, 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101100, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.880300352s ago: executing program 2 (id=12616): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x7d4165c9) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000011) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x0, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r7, 0x0) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9234751", 0x81}], 0x1}, 0x4040) 1.843754233s ago: executing program 3 (id=12617): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r3, r2}, 0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newlink={0x60, 0x10, 0x503, 0x70bd29, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0xe}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x6}, @IFLA_BR_NF_CALL_IP6TABLES={0x5}, @IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x12}]}}}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r3, r2}, 0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newlink={0x60, 0x10, 0x503, 0x70bd29, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_BR_FORWARD_DELAY={0x8, 0x1, 0xe}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x6}, @IFLA_BR_NF_CALL_IP6TABLES={0x5}, @IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x12}]}}}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) (async) 1.760316559s ago: executing program 4 (id=12618): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @empty, 0x4e23, 0x3, 'ovf\x00', 0x5, 0x7, 0x4f}, 0x2c) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCOUTQ(r1, 0x5411, &(0x7f0000005280)) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x20, 0x1405, 0x1, 0x0, 0x0, "", [{{0x8}, {0x8}}]}, 0x20}}, 0x20000014) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x83, 'sh\x00', 0x0, 0x1, 0xc}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x4e22, 0x12002, 0xf, 0xe194, 0xfffffffd}}, 0x44) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f0000000000)={0x6, 'wg0\x00', {}, 0x1}) 1.679141865s ago: executing program 1 (id=12619): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0x68, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_sample={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x3ff, 0x4000000, 0x0, 0x0, 0x1}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895c679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d120ea257bba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2bc30a96767f500b9e26e3b12854da63083320d8bfe49d85e0842803dc59d6375bce2b8a93caf39c0ba767880bbb9bf9407e6a6c0f9a43d1ab51dabf9423b482e848fbe1653ff0c6161fa43543546ce17a42e6cddadaf0767d84407478ffe2d0b567d81201efc81e800d4c0874235ff5cd7f5f0ee71cc2b0193bfc9290627ceaeb0b02931a817688f3a51fa2861e70cbab50a5d434ed8d8841694dba46f3d5a95ae86e4d471684ccf427b2ba53a157b2a7cf7a4c10051bb77822190a14c2ab1f271a7cf9c240b99"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{0x1}, &(0x7f0000000200), 0x0}, 0x20) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'aead\x00', 0x11, 0x0, 'aegis256-generic\x00'}, 0x58) bind$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f0000000200)={0xa, 0x4e23, 0x3ff, @loopback, 0x10001}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x81, "7bf8ec152fa16d39e4553d9607191c01003f4f261459314625abafbae09b2f3f5bd1d92f8a3b28f86ac6911e26622113c1d519b46c2b1bb9b76cf8008d37a06e88b31100ae16fcb20ca3c5e2bc78d0014278c1e4c7fb4ab35e2c3ae32abc7bf205fd325765be5684ece2933f3325ec9cb8b4725605bf2722d1ded87089430c8a35"}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x40040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_newaddrlabel={0x38, 0x48, 0x1, 0x70bd2d, 0x25dfdbfb, {0xa, 0x0, 0x80}, [@IFAL_LABEL={0x8, 0x2, 0xc}, @IFAL_ADDRESS={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}]}, 0x38}}, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x2, 0x7, 0x0, 0x1, 0x5392, 0xc, 0x9, {0x0, @in6={{0xa, 0x4e20, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x10}}, 0x81, 0x3, 0xc, 0x4b, 0x9}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES8, @ANYBLOB="010026bd7000fddbdf2506000000140002002001000000000000000000000000000114000300fe88000000000000000000000000010108000400ac1414bb2b00070073797374656d5f753a6f626a6563745f723a7373685f"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0xc8a0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 1.677859162s ago: executing program 2 (id=12620): r0 = accept(0xffffffffffffffff, &(0x7f0000000080)=@sco={0x1f, @none}, &(0x7f0000000100)=0x80) sendmsg$kcm(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000001c0)="0b6baa39fe6be7f7", 0x8}, {&(0x7f0000000200)="03a6839c576a2fe4253f844295321d2af6a98fdb2718760768a56d7c665a9ae5a785c01791649d46fe19c72b36ee62a8b7c3e60efb306aa500166637c4c44ee0dcf06e2cb84d8a763eb22f6719fe9bf592f14307f87d692adc494abeba857a53397b31ccf2fed43fff366a1edc5f0b2b7fcaf8eee1c5aac5b5a6630fab81fffc09bc6164e6ef97a9c4974d9bc836a61378e1916c61e36461293232ce7915d3f1f5e2633d871c5cea4660e92a738307214e939ebbeaf602357d06a398f7a366be587481df61efcf77d30a23034fe7835d73fad6c18755eac48f4e048feab362196ba94960d33817353bf2e0dbfaf67c95894fe059f1536fe5864035643cd99f2715ae260b8d29d75cb62a6dfb7dc1664b0f69b863bd9b133f1285d9f049694375b61196036db92041734b597b518b1e27304dbeb98c8b6114df64b2b1297f70721a1672511cb7a008b3dbfd5164cfe50e5d56fcff1f5146f161de407130dbc5df915ced4d44156e42047e3b68fc9cc9b53041fd8ddcb73f493415d8764cbc9f8f", 0x180}], 0x2}, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a0000000500010007"], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) listen(r1, 0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), 0xffffffffffffffff) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r4 = accept4(r3, 0x0, 0x0, 0x800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 1.522853356s ago: executing program 2 (id=12621): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x12, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000061117c0000000000850000000100000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) 1.450888861s ago: executing program 0 (id=12622): r0 = socket$rds(0x15, 0x5, 0x0) close(r0) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r0, 0x4018f50b, &(0x7f0000000080)={0x1, 0x100, 0xfffffffffffff1c4}) bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x4}, @cswp={0x58, 0x114, 0x7, {{0x8, 0x5}, &(0x7f00000000c0)=0xfffffffffffffffd, &(0x7f0000000100), 0xffc, 0x4, 0xc0000000000000, 0x1c, 0x28}}], 0x70, 0x810}, 0x4000001) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_GETPARENTS_BY_HANDLE(r1, 0xc040583f, &(0x7f00000003c0)={{@_ha_fsid={[0x76, 0x30000000]}, {0x4, 0xfff2, 0x7, 0x5}}, {{[0xbae, 0x3, 0x7, 0x5]}, 0x0, 0x1, 0x2, 0x0, &(0x7f0000000340)=[{{@_ha_fsid={[0xff, 0x5]}, {0x7, 0xfc7, 0x4, 0x8}}, 0x4, 0x0, 'nl80211\x00'}, {{@_ha_fsid={[0x1, 0xa7]}, {0xe3f6, 0x7f, 0x5, 0x6}}, 0x1, 0x0, 'nl80211\x00'}, {{@_ha_fsid={[0x5, 0x7]}, {0x3, 0x4, 0x7, 0x1}}, 0x8, 0x0, 'O\x00'}]}}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000002c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r2, 0x4, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xe0000, 0x5a}}}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x340}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x15403582622a94fe) bind$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000440)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0xc0, r2, 0x400, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_STA_EXT_CAPABILITY={0x4f, 0xac, "7187b3ab10212df799ce2252492da247ff78a615635aa7fc61dbf1ccfa1f25cbadd5161ba8a25811fab79e3057779d096ecb5108f875c45fa774674a96d0dcc57577fa6cb3b529b485c22c"}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x1}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x2}, @NL80211_ATTR_STA_WME={0x44, 0x81, [@NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x93}, @NL80211_STA_WME_UAPSD_QUEUES={0x5}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x10}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x6}, @NL80211_STA_WME_MAX_SP={0x5}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x1}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xb5}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20048040}, 0x4000000) 1.44406621s ago: executing program 2 (id=12623): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x34, r3, 0x1, 0x1070bd0c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x2}}, 0x26) ioctl$PPPIOCGMRU(r5, 0x80047453, &(0x7f0000000100)) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r6, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r7) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYRES8=r0, @ANYBLOB="953a04"], 0x24}, 0x1, 0x0, 0x0, 0x20000014}, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r11 = socket$kcm(0x2, 0xa, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000100001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r10, &(0x7f0000000240)=ANY=[@ANYBLOB="1c0000f5"], 0xfd1) recvmmsg$unix(r9, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000008c0)=""/200, 0xc8}, {&(0x7f0000000640)=""/249, 0xf9}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000007c0)=""/97, 0x61}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000300)=""/25, 0x19}, {&(0x7f0000000380)=""/130, 0x82}, {&(0x7f00000009c0)=""/133, 0x85}], 0x9}}], 0x1, 0x2080, 0x0) write(r9, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1200000003000000040000001200000000000000", @ANYRES32, @ANYBLOB="01f8ffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000000000000000000000000000000000000000000000000000016ff34bb"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r12}, &(0x7f00000002c0), &(0x7f0000000440)=r7}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1e, 0x4, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000000000000091124200000000009500000000000000214f11ed60eab39cd065767639bec93e1888ce1962655d549c71f962c75c329fffade1d780f2f1c76ec956f4f34d08e547da4edb6692bca6fed2128a7131db4a04f997723aaade1c7f6ab4d7ec406805e349f7b05735d030e3cc1e7833a19d696c394036ac9b1f2b4c322c9d297a68d471efe9ca818ea6c4cf6fcbb9f99445af728581fdfa98ddad60b63d2c7033bad0b4d8a14cd64b7f7ca37c35d61270629f70f1076d358b13f2a3a074cb22b56c92a23a8527"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r13 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r13, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r8, {0x2, 0x4e24, @multicast2}, 0x2, 0x0, 0x3}}, 0x26) 1.338385061s ago: executing program 4 (id=12624): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) (fail_nth: 4) 1.319418007s ago: executing program 1 (id=12625): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00'}) socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r1, 0x215eb000) r2 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000080)={'security\x00', 0x0, [0xfffff801, 0x80000001, 0xe, 0x4, 0x6]}, &(0x7f0000000140)=0x54) 1.306712795s ago: executing program 3 (id=12626): socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000680)) socket$inet_mptcp(0x2, 0x1, 0x106) socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r0, @ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 955.18619ms ago: executing program 0 (id=12627): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x0, 0x0, 0x28, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0x0, 0x700}, @generic={0x0, 0x2, "d58838000391"}]}}}}}}, 0xfd6c) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0xba9, 0x1, 0x1}, 0x48) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @loopback}, &(0x7f00000001c0)=0x10) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f00000004c0)={{0x2, 0x4e20, @empty}, {0x1, @random="0d8bc024dade"}, 0x60, {0x2, 0x4e24, @multicast1}, 'nicvf0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1e, 0x4, &(0x7f0000000300)=ANY=[@ANYRESHEX, @ANYRESOCT=r0, @ANYRES8=r0, @ANYBLOB="33f4185d0cf5aee2844914ef55652d18be0614226072e950dd4de2cbac6a31dc9c7d49ff6f14973e6762c80a868d97041199a1", @ANYRESDEC=r0, @ANYRESHEX=r0, @ANYRESHEX=r0, @ANYRES32=r0, @ANYBLOB="b926bf2c5e8f1e19ec74290e93da38066cb6a2597172403e15a17c9e214f349fa76cf5762e7fe8b88f17f869102c801f676b9af8365c2af43ca2630a0560cf472ce975f1d0f1e31168652ccecf7439c68773312079cde1758332108e9cced1cb06b0d3db6fe07651bf898d059a235cadea772a6a632f475e41f57b453283eb7bf23ca988fdedd0dac86189c6b257eaecb59ca03fea4b664eb84cb79787efba55a8562a751ec82c204fbb40dd5f9f4c3e52c9541c3ef65e7464c73b1b8b4562cce88a456886f863c69a5730435645ca2d3f53371cbf78bee229bf6e0b3ce5e9d00e3cec6573c7b28e8a06bc3781", @ANYRESHEX], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 889.350517ms ago: executing program 4 (id=12628): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x3, 0xff) socket$netlink(0x10, 0x3, 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101100, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 879.454848ms ago: executing program 3 (id=12629): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000300)=0x2) ioctl$PPPIOCSACTIVE(r0, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) pwritev(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)="1832", 0x2}], 0x1, 0xa, 0x10) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0x8, 0x7f}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000240)=ANY=[@ANYBLOB="18080000060000001810000000000000000008000000000000000000", @ANYRES32=r1, @ANYBLOB="00000000000000000f8000000000000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) read(r0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000200)={@val, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x1c, 0xe4, 0x0, 0x1, 0x32, 0x0, @dev={0xac, 0x14, 0x14, 0x29}, @rand_addr=0x64010100}, "7fe59ce22cbe5943"}}}}}, 0x36) 575.151863ms ago: executing program 0 (id=12630): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0xfffffffb}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@getlink={0x30, 0x12, 0x2fa9ccd93d5c0297, 0x70bd28, 0x0, {0x7}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x4}}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 574.580108ms ago: executing program 2 (id=12631): r0 = accept(0xffffffffffffffff, &(0x7f0000000080)=@sco={0x1f, @none}, &(0x7f0000000100)=0x80) sendmsg$kcm(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000001c0)="0b6baa39fe6be7f7", 0x8}, {&(0x7f0000000200)="03a6839c576a2fe4253f844295321d2af6a98fdb2718760768a56d7c665a9ae5a785c01791649d46fe19c72b36ee62a8b7c3e60efb306aa500166637c4c44ee0dcf06e2cb84d8a763eb22f6719fe9bf592f14307f87d692adc494abeba857a53397b31ccf2fed43fff366a1edc5f0b2b7fcaf8eee1c5aac5b5a6630fab81fffc09bc6164e6ef97a9c4974d9bc836a61378e1916c61e36461293232ce7915d3f1f5e2633d871c5cea4660e92a738307214e939ebbeaf602357d06a398f7a366be587481df61efcf77d30a23034fe7835d73fad6c18755eac48f4e048feab362196ba94960d33817353bf2e0dbfaf67c95894fe059f1536fe5864035643cd99f2715ae260b8d29d75cb62a6dfb7dc1664b0f69b863bd9b133f1285d9f049694375b61196036db92041734b597b518b1e27304dbeb98c8b6114df64b2b1297f70721a1672511cb7a008b3dbfd5164cfe50e5d56fcff1f5146f161de407130dbc5df915ced4d44156e42047e3b68fc9cc9b53041fd8ddcb73f493415d8764cbc9f8f", 0x180}], 0x2}, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a0000000500010007"], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) listen(r1, 0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), 0xffffffffffffffff) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 472.951773ms ago: executing program 4 (id=12632): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x2000000, 0x482, &(0x7f0000000040)={0x84, @empty, 0x4e23, 0x3, 'ovf\x00', 0x1, 0x7, 0x4f}, 0x2c) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x4e21, 0x12002, 0xf, 0xe1b2, 0xfffffffd}}, 0x44) 433.015234ms ago: executing program 0 (id=12633): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24008881) r2 = getpid() r3 = syz_open_procfs$namespace(0x0, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)={0x54, r1, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_PID={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_PID={0x8, 0x1c, r2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_NETNS_FD={0x8}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r3}, @NL802154_ATTR_NETNS_FD={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x200000c5}, 0x4880) (fail_nth: 5) 298.976471ms ago: executing program 2 (id=12634): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xfff3, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000022c0)=@newtfilter={0x880, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x5}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_basic={{0xa}, {0x850, 0x2, [@TCA_BASIC_ACT={0x4}, @TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x4, 0x1c1, 0x7, 0x9, {0x5, 0x2, 0x5, 0x9, 0x6, 0x2}, {0x9, 0x0, 0x3, 0x7881, 0x9, 0x5}, 0x3, 0x1, 0xfffffffb}}, @TCA_POLICE_RATE={0x404, 0x2, [0x10, 0x7, 0x5, 0x80000000, 0x1, 0x7, 0x400, 0xfffffffb, 0x9, 0xffffffff, 0xfffffffa, 0x2, 0x7, 0x5, 0x401, 0x2, 0x4fb, 0x2, 0x2, 0x6, 0x3, 0x3, 0x7f9, 0x2, 0x8, 0xffff8001, 0x2, 0x1, 0x0, 0x5, 0x7, 0x7, 0x2, 0xfff, 0x4, 0x2, 0x9, 0x80000000, 0x67b, 0x1000, 0xfffffff7, 0x8, 0x7a, 0x1, 0x3, 0x39, 0xf2c6, 0xfffffff9, 0xa4, 0x4, 0xe8ee, 0x0, 0x2, 0x3, 0x7, 0x5, 0x4, 0x42befca, 0x36, 0x80000000, 0x2, 0x5, 0xc3fa, 0x3, 0x0, 0x8, 0x5, 0x8, 0x400, 0x3, 0x7, 0xfffffff9, 0x5, 0x8, 0x5, 0x1, 0xffffffff, 0x7, 0xfffffff7, 0x2, 0x2, 0xa, 0xd6, 0x0, 0xd, 0x1, 0xf33, 0x7, 0x200, 0x800, 0x25, 0x80000000, 0x27, 0x7, 0x6, 0x8, 0x1, 0x7ff, 0x2, 0x2, 0x10001, 0x6, 0x5, 0x2, 0x0, 0xffff, 0x11, 0x10000, 0x9, 0x80000001, 0x3, 0x4, 0x1, 0x0, 0x1ff, 0xd, 0x8000, 0x0, 0x2, 0x4, 0x2, 0xffffffba, 0xb08, 0xfb19, 0x6, 0x8, 0x7, 0x7ff, 0x1, 0xb, 0x6, 0xfffffff7, 0x7fff, 0x4, 0x8, 0xf, 0x2, 0x80000000, 0x1ff, 0x7, 0x8, 0xa4, 0x91, 0x5, 0x81, 0x1, 0x9, 0x8, 0x2, 0x7, 0x7615cdba, 0x46915c50, 0x3, 0x6, 0x0, 0x7, 0x3, 0x4, 0x21, 0x12, 0x7fffffff, 0x5, 0x9, 0x3, 0x6, 0x7, 0x7, 0x3ff, 0x6, 0x8001, 0xe, 0xffff43e6, 0x7, 0x6, 0x5, 0x98, 0xd, 0x8, 0xa6eb, 0x4, 0x9, 0x5, 0x2, 0x1, 0x1000, 0x2, 0x7fff, 0x40, 0x8, 0x101, 0x4, 0x9, 0x5c51, 0xffff5ee4, 0x0, 0xe, 0x1, 0x8, 0xb, 0x6, 0x4, 0xb, 0x5, 0xfffffff9, 0x1c, 0x4, 0x4, 0x7ff, 0x1, 0x2, 0x3, 0x0, 0x7, 0x7f, 0x0, 0x1, 0x9, 0x7, 0x1c, 0x1, 0xda, 0x8001, 0x9, 0x7ff, 0x0, 0xfff, 0xf1c2, 0x1ff, 0xb, 0x83, 0x2, 0x7, 0x8, 0x5, 0x9, 0x10001, 0x5, 0xc9, 0xe3b8, 0xc, 0x40, 0x4, 0xed, 0x8000, 0xff56, 0x8, 0x4, 0x800, 0x9, 0x4, 0x8e, 0x0, 0xe0, 0x200, 0x3, 0x2]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8, 0x6, 0x1e, 0x7, 0x6, 0xd, 0x2, 0x80000001, 0x7, 0x0, 0x3, 0x3, 0x40, 0x7ff, 0x2, 0x81, 0x2b7, 0x8000, 0x9, 0x2, 0x2, 0x5, 0x606a, 0x8, 0xf4, 0x2538, 0x8, 0xffffffff, 0xe, 0x81, 0x4, 0x2, 0x0, 0xfffffeff, 0x3, 0xd, 0xc6, 0x3, 0x4, 0xd0, 0x0, 0x6, 0x2, 0x4, 0x0, 0x6, 0x2, 0x4, 0x7, 0x6, 0x0, 0x2, 0x71, 0x3, 0x21, 0x5, 0x95, 0x10000, 0x6, 0x1, 0xfe0000, 0x7ff, 0x8, 0x3, 0x10, 0x8, 0xc4, 0x6, 0x3, 0x8, 0x3ff, 0x9, 0x3, 0x200, 0x4, 0x5, 0x6, 0xffffffff, 0xa, 0x7fffffff, 0x1, 0x9, 0x9, 0x7, 0x0, 0x3, 0x38b3, 0x8, 0x3, 0xf4f2, 0x0, 0x9, 0xe, 0x0, 0x50, 0x6, 0x7, 0x5, 0x2, 0x686f, 0x9, 0x986, 0x7, 0x7, 0xd81, 0x9, 0x6, 0x8e, 0x5, 0x0, 0x7, 0x3, 0x3, 0x9, 0xfffffffe, 0x1, 0x80000000, 0x4, 0x5, 0x100, 0x80, 0x7, 0xf, 0x5, 0x0, 0x9, 0x10000, 0x6, 0x7, 0x80, 0x1, 0x80000001, 0x200, 0x6, 0x80000001, 0x0, 0x7, 0x641640fb, 0x5db, 0x5, 0x3, 0x6, 0x3, 0x3, 0xd8, 0x3, 0xe9, 0x8, 0xfffffff0, 0x5, 0x2, 0x0, 0x8, 0x9, 0x5, 0x7, 0x7056c30b, 0x3, 0x5, 0x40, 0x8, 0x2, 0x21, 0x1, 0x7fffffff, 0xfff, 0x1, 0x6, 0x7, 0x1, 0x2, 0x4, 0x5, 0x60ea1cca, 0x4, 0x3, 0x5, 0xffffffff, 0xf, 0x80000000, 0xffffffff, 0x1, 0x5, 0xfffffffc, 0x8000, 0x1, 0x6, 0x0, 0x75, 0x9, 0x1ff, 0x10, 0x5, 0x10, 0x3257, 0x42, 0x7fff, 0x10001, 0xdf, 0x36dc00, 0x3ff, 0x0, 0x7, 0xddd7, 0x3, 0xffffffff, 0x7, 0x40, 0x4c, 0x1, 0x3, 0x9, 0xfffffffb, 0x7, 0x2, 0x10, 0x7, 0x8, 0x5, 0x4, 0xb4d, 0xfffffffc, 0xef4c, 0x6, 0xa30, 0xef, 0x80, 0x400, 0x9, 0x8001, 0x4e38, 0x5, 0x9, 0x400, 0x9, 0x1, 0x2, 0x2, 0x2, 0xf3, 0x1, 0x1, 0x7, 0x7, 0x6, 0x0, 0x6, 0x8001, 0x5, 0xef64, 0x1, 0x245, 0x3, 0xa444680e, 0x9, 0x3]}]}]}}]}, 0x880}}, 0x800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) 298.491101ms ago: executing program 3 (id=12635): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0x68, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_sample={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x3ff, 0x4000000, 0x0, 0x0, 0x1}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895c679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d120ea257bba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2bc30a96767f500b9e26e3b12854da63083320d8bfe49d85e0842803dc59d6375bce2b8a93caf39c0ba767880bbb9bf9407e6a6c0f9a43d1ab51dabf9423b482e848fbe1653ff0c6161fa43543546ce17a42e6cddadaf0767d84407478ffe2d0b567d81201efc81e800d4c0874235ff5cd7f5f0ee71cc2b0193bfc9290627ceaeb0b02931a817688f3a51fa2861e70cbab50a5d434ed8d8841694dba46f3d5a95ae86e4d471684ccf427b2ba53a157b2a7cf7a4c10051bb77822190a14c2ab1f271a7cf9c240b99"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{0x1}, &(0x7f0000000200), 0x0}, 0x20) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'aead\x00', 0x11, 0x0, 'aegis256-generic\x00'}, 0x58) bind$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f0000000200)={0xa, 0x4e23, 0x3ff, @loopback, 0x10001}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x81, "7bf8ec152fa16d39e4553d9607191c01003f4f261459314625abafbae09b2f3f5bd1d92f8a3b28f86ac6911e26622113c1d519b46c2b1bb9b76cf8008d37a06e88b31100ae16fcb20ca3c5e2bc78d0014278c1e4c7fb4ab35e2c3ae32abc7bf205fd325765be5684ece2933f3325ec9cb8b4725605bf2722d1ded87089430c8a35"}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x40040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_newaddrlabel={0x38, 0x48, 0x1, 0x70bd2d, 0x25dfdbfb, {0xa, 0x0, 0x80}, [@IFAL_LABEL={0x8, 0x2, 0xc}, @IFAL_ADDRESS={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}]}, 0x38}}, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x2, 0x7, 0x0, 0x1, 0x5392, 0xc, 0x9, {0x0, @in6={{0xa, 0x4e20, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x10}}, 0x81, 0x3, 0xc, 0x4b, 0x9}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES8, @ANYBLOB="010026bd7000fddbdf2506000000140002002001000000000000000000000000000114000300fe88000000000000000000000000010108000400ac1414bb2b00070073797374656d5f753a6f626a6563745f723a7373685f"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0xc8a0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 0s ago: executing program 4 (id=12636): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e20}, 0x15) connect$unix(r0, &(0x7f0000000580)=@abs={0x1, 0x0, 0x4e5c}, 0x6e) kernel console output (not intermixed with test programs): 548.200007][T26890] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 548.210993][T17347] syzkaller1: tun_net_xmit 90 [ 548.231197][T26890] syzkaller1: Linktype set failed because interface is up [ 548.273166][T26895] netlink: 'syz.0.9945': attribute type 21 has an invalid length. [ 548.294859][T26895] netlink: 128 bytes leftover after parsing attributes in process `syz.0.9945'. [ 548.384619][T26895] netlink: 'syz.0.9945': attribute type 5 has an invalid length. [ 548.401199][T26895] netlink: 'syz.0.9945': attribute type 6 has an invalid length. [ 548.451963][T26895] netlink: 3 bytes leftover after parsing attributes in process `syz.0.9945'. [ 548.543470][T26906] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9950'. [ 548.554671][T26906] netlink: 'syz.3.9950': attribute type 7 has an invalid length. [ 548.583846][T26906] netlink: 'syz.3.9950': attribute type 8 has an invalid length. [ 548.602837][T26906] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9950'. [ 549.091814][T19384] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 549.102048][T19384] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 549.125022][T26916] IPv6: sit2: Disabled Multicast RS [ 549.567178][ T5737] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 550.644546][T26981] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9978'. [ 550.667055][T26981] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9978'. [ 550.738916][T26983] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.9979'. [ 550.946544][ T1052] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.965600][ T1052] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.990496][ T1052] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 551.014563][ T1052] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 553.126689][ C0] net_ratelimit: 1 callbacks suppressed [ 553.126788][ C0] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 554.832521][T27089] __nla_validate_parse: 5 callbacks suppressed [ 554.832541][T27089] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10016'. [ 554.851717][T27089] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10016'. [ 554.902075][T27091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10017'. [ 555.094918][T27023] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 555.594558][T27122] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10030'. [ 555.637511][T27122] validate_nla: 4 callbacks suppressed [ 555.637556][T27122] netlink: 'syz.0.10030': attribute type 7 has an invalid length. [ 555.654764][T27122] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10030'. [ 555.728339][T27122] erspan0: entered promiscuous mode [ 555.746613][T27122] gretap0: entered promiscuous mode [ 555.756974][T27122] hsr1: Slave A (erspan0) is not up; please bring it up to get a fully working HSR network [ 555.768646][T27122] hsr1: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 556.642891][T27164] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10046'. [ 557.336905][T27183] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10053'. [ 557.519495][T27190] bond9: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 557.608518][T27190] bond9: (slave lo): Enslaving as an active interface with an up link [ 557.643001][T27190] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 557.837639][T27201] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10059'. [ 557.920931][T27201] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10059'. [ 558.519802][T27227] trusted_key: syz.1.10063 sent an empty control message without MSG_MORE. [ 558.808640][T27237] netlink: 'syz.0.10067': attribute type 21 has an invalid length. [ 558.833708][T27237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10067'. [ 558.882844][T27237] netlink: 'syz.0.10067': attribute type 21 has an invalid length. [ 560.502762][T27285] __nla_validate_parse: 1 callbacks suppressed [ 560.502784][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10084'. [ 560.549870][T27285] netlink: 'syz.2.10084': attribute type 1 has an invalid length. [ 560.577822][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10084'. [ 560.621411][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10084'. [ 560.652478][T27285] netlink: 'syz.2.10084': attribute type 1 has an invalid length. [ 560.675558][T27285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10084'. [ 561.529704][ C0] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 561.889661][T27322] netlink: 33 bytes leftover after parsing attributes in process `syz.3.10099'. [ 561.915244][T27322] netlink: 140 bytes leftover after parsing attributes in process `syz.3.10099'. [ 561.941695][T27322] netlink: 33 bytes leftover after parsing attributes in process `syz.3.10099'. [ 562.181051][T27328] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 562.705296][T27337] netlink: 140 bytes leftover after parsing attributes in process `syz.3.10106'. [ 563.072550][T27345] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10109'. [ 563.601140][T27355] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10114'. [ 564.171514][T27374] netlink: 'syz.3.10122': attribute type 1 has an invalid length. [ 564.403659][T27374] 8021q: adding VLAN 0 to HW filter on device bond3 [ 564.541202][T27378] bond3: (slave geneve4): making interface the new active one [ 564.586926][T27378] bond3: (slave geneve4): Enslaving as an active interface with an up link [ 565.064876][T27394] netlink: 'syz.2.10130': attribute type 14 has an invalid length. [ 565.088569][T27394] netlink: 'syz.2.10130': attribute type 14 has an invalid length. [ 565.667691][ T156] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 566.082990][T27431] bridge4: entered promiscuous mode [ 566.125332][T27431] bridge4: entered allmulticast mode [ 566.155073][T27438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 567.403088][T27480] netlink: 'syz.2.10158': attribute type 8 has an invalid length. [ 567.431982][T27480] __nla_validate_parse: 4 callbacks suppressed [ 567.432000][T27480] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10158'. [ 567.523734][T27480] bond0: entered promiscuous mode [ 567.533869][T27480] bond_slave_0: entered promiscuous mode [ 567.546054][T27480] bond_slave_1: entered promiscuous mode [ 567.561832][T27480] bond0: left promiscuous mode [ 567.578915][T27480] bond_slave_0: left promiscuous mode [ 567.595626][T27480] bond_slave_1: left promiscuous mode [ 568.063040][T27497] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10162'. [ 568.557226][T27505] vlan1: entered allmulticast mode [ 568.577007][T27505] bond0: entered allmulticast mode [ 568.596368][T27507] netlink: 14 bytes leftover after parsing attributes in process `syz.4.10165'. [ 568.628379][T27505] bond_slave_0: entered allmulticast mode [ 568.657260][T27505] bond_slave_1: entered allmulticast mode [ 568.769253][T27507] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 569.111090][T27507] bond_slave_0: left allmulticast mode [ 569.166630][T27507] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 569.207018][T27507] bond_slave_1: left allmulticast mode [ 569.269113][T27507] bond0 (unregistering): Released all slaves [ 569.655140][T27518] netlink: 'syz.3.10171': attribute type 7 has an invalid length. [ 569.683841][T27518] netlink: 'syz.3.10171': attribute type 7 has an invalid length. [ 570.021522][T27525] syzkaller1: entered promiscuous mode [ 570.052639][T27525] syzkaller1: entered allmulticast mode [ 570.545542][T27544] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10183'. [ 570.618474][T27546] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10184'. [ 570.644332][T27546] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10184'. [ 570.684218][T27546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10184'. [ 570.788440][ T134] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.798865][T27546] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10184'. [ 570.810063][ T134] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.820677][T27546] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10184'. [ 570.832190][ T134] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.843620][ T134] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.853883][T27546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10184'. [ 571.588395][T27574] netlink: Unknown conntrack attr (type=2304, max=9) [ 572.330303][T27596] netlink: 'syz.4.10206': attribute type 21 has an invalid length. [ 572.340141][T27596] netlink: 'syz.4.10206': attribute type 22 has an invalid length. [ 572.362650][T27596] netlink: 'syz.4.10206': attribute type 23 has an invalid length. [ 572.384831][T27596] netlink: 'syz.4.10206': attribute type 25 has an invalid length. [ 572.412636][T27596] netlink: 'syz.4.10206': attribute type 26 has an invalid length. [ 572.439915][T27596] __nla_validate_parse: 1 callbacks suppressed [ 572.439933][T27596] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10206'. [ 572.473634][T27600] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10208'. [ 572.526046][T27600] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10208'. [ 572.936172][T27611] netlink: 'syz.1.10213': attribute type 5 has an invalid length. [ 573.104629][T27614] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.112047][T27614] bridge0: port 2(bridge_slave_1) entered listening state [ 573.119496][T27614] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.126712][T27614] bridge0: port 1(bridge_slave_0) entered listening state [ 573.323881][T27614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 573.383430][T27614] 8021q: adding VLAN 0 to HW filter on device bond1 [ 573.457661][T27614] 8021q: adding VLAN 0 to HW filter on device bond2 [ 573.548434][T27614] 8021q: adding VLAN 0 to HW filter on device bond3 [ 573.602123][T27614] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 573.723100][T27628] syzkaller1: entered promiscuous mode [ 573.748100][T27628] syzkaller1: entered allmulticast mode [ 573.755051][T27638] netlink: 51 bytes leftover after parsing attributes in process `syz.3.10221'. [ 573.907167][ T134] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 573.938442][ T134] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 574.171121][T27647] atomic_op ffff8880563fd998 conn xmit_atomic 0000000000000000 [ 574.514840][T27663] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10235'. [ 574.917137][T27656] nbd0: detected capacity change from 0 to 63 [ 574.940683][T27661] block nbd0: NBD_DISCONNECT [ 574.967144][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.993886][T17328] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.011415][ T5629] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.056966][ T5629] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.086244][T27661] block nbd0: Disconnected due to user request. [ 575.117694][T27661] block nbd0: shutting down sockets [ 575.167138][ C0] blk_print_req_error: 138 callbacks suppressed [ 575.167186][ C0] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.184468][ C0] buffer_io_error: 138 callbacks suppressed [ 575.184483][ C0] Buffer I/O error on dev nbd0, logical block 0, async page read [ 575.214236][ C1] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.223412][ C1] Buffer I/O error on dev nbd0, logical block 1, async page read [ 575.231276][ C1] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.240362][ C1] Buffer I/O error on dev nbd0, logical block 2, async page read [ 575.248186][ C1] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.257271][ C1] Buffer I/O error on dev nbd0, logical block 3, async page read [ 575.269670][ T5730] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.290114][ T5730] Buffer I/O error on dev nbd0, logical block 0, async page read [ 575.320494][ T5730] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.333002][ T5730] Buffer I/O error on dev nbd0, logical block 1, async page read [ 575.342381][ T5730] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.353056][ T5730] Buffer I/O error on dev nbd0, logical block 2, async page read [ 575.398981][ T5730] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.438580][ T5730] Buffer I/O error on dev nbd0, logical block 3, async page read [ 575.474608][ T5730] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.500419][ T5730] Buffer I/O error on dev nbd0, logical block 0, async page read [ 575.516255][ T5730] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 575.572094][ T5730] Buffer I/O error on dev nbd0, logical block 1, async page read [ 575.631861][ T5730] ldm_validate_partition_table(): Disk read failed. [ 575.658934][ T5730] Dev nbd0: unable to read RDB block 0 [ 575.683014][ T5730] nbd0: unable to read partition table [ 575.760347][ T5730] ldm_validate_partition_table(): Disk read failed. [ 575.802157][ T5730] Dev nbd0: unable to read RDB block 0 [ 575.833746][ T5730] nbd0: unable to read partition table [ 575.994444][T27696] ref_ctr_offset mismatch. inode: 0x46 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x6 [ 576.340869][T27711] netlink: 'syz.2.10254': attribute type 11 has an invalid length. [ 576.367272][T27705] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 576.486305][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 576.496434][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.401284][T27744] netlink: 'syz.1.10269': attribute type 1 has an invalid length. [ 577.678642][T27754] netlink: 'syz.4.10274': attribute type 1 has an invalid length. [ 577.767418][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 577.923055][T27769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10276'. [ 578.006069][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 578.092597][T27759] bond0: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 578.104401][T17328] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.175166][ C0] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 578.179510][T27759] bond0: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 578.193065][ T134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.321904][T27759] bond0: (slave ip6gre1): making interface the new active one [ 578.404649][T27759] bond0: (slave ip6gre1): Enslaving as an active interface with an up link [ 579.741288][T27817] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10298'. [ 579.764478][T27817] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10298'. [ 580.572562][T27842] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10310'. [ 580.598878][T27842] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10310'. [ 580.727927][ T1052] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.739398][T17349] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.750261][ T5629] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.219140][T27859] netlink: 51 bytes leftover after parsing attributes in process `syz.4.10318'. [ 581.261876][T19384] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x1 [ 581.629952][T27872] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.10322'. [ 581.665382][T27872] netlink: Unknown conntrack attr (0) [ 581.677927][T27873] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10321'. [ 582.594945][T27904] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.10337'. [ 583.203287][T27925] syz_tun: entered allmulticast mode [ 583.537713][T27935] ip6tnl3: entered promiscuous mode [ 583.544643][T27937] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.10350'. [ 583.766590][ T5629] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.927910][T19384] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.375379][T27961] syzkaller1: entered promiscuous mode [ 584.400989][T27961] syzkaller1: entered allmulticast mode [ 584.717724][T27972] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.033039][T27981] netlink: 'syz.0.10373': attribute type 1 has an invalid length. [ 585.139995][T27989] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.10374'. [ 585.205874][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 585.261967][T27981] 8021q: adding VLAN 0 to HW filter on device bond10 [ 585.287348][T27982] syzkaller1: entered promiscuous mode [ 585.312465][T27982] syzkaller1: entered allmulticast mode [ 585.434546][T27996] veth1_macvtap: entered allmulticast mode [ 585.453834][T27996] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10377'. [ 585.849564][ T134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.878362][ T5629] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.918070][T17329] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.950747][T28011] netlink: 'syz.1.10382': attribute type 11 has an invalid length. [ 585.991909][T28011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10382'. [ 586.261201][T28012] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 586.304369][T28012] syzkaller1: Refused to change device type [ 586.331578][T28011] netlink: 'syz.1.10382': attribute type 11 has an invalid length. [ 586.355360][T28011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10382'. [ 586.485890][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 587.444093][T28056] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.10397'. [ 588.629881][T28092] netlink: 51 bytes leftover after parsing attributes in process `syz.0.10407'. [ 588.966877][T17329] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.154169][T28080] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 589.689708][T19384] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.855421][T28119] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10416'. [ 590.085064][T28127] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10419'. [ 590.685608][T28138] netlink: 'syz.0.10422': attribute type 1 has an invalid length. [ 590.736904][T28138] netlink: 'syz.0.10422': attribute type 1 has an invalid length. [ 591.150271][T28148] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 591.313785][T28148] bond4: (slave lo): Enslaving as an active interface with an up link [ 591.398786][T28148] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 591.528264][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.012851][T17329] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.393138][T28185] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.10440'. [ 593.874915][T28214] syzkaller1: entered promiscuous mode [ 594.052142][T28214] syzkaller1: entered allmulticast mode [ 595.048236][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.059976][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.070778][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.081439][T17329] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.447912][T18337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.616496][T28333] netlink: 'syz.3.10477': attribute type 2 has an invalid length. [ 597.650835][T28333] netlink: 'syz.3.10477': attribute type 2 has an invalid length. [ 598.086283][T17328] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.176000][T28343] syzkaller1: entered promiscuous mode [ 598.207105][T28343] syzkaller1: entered allmulticast mode [ 599.053252][T28348] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 599.286086][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 599.485555][T28390] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10494'. [ 599.518456][T28390] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10494'. [ 599.630786][T28387] syzkaller1: entered promiscuous mode [ 599.643144][T28387] syzkaller1: entered allmulticast mode [ 599.748035][T28390] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10494'. [ 599.786644][T28390] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10494'. [ 601.281257][T28436] bond4: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 601.302870][T28436] bond4 (unregistering): Released all slaves [ 601.905348][T28461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10517'. [ 601.953968][T28461] netlink: 'syz.4.10517': attribute type 29 has an invalid length. [ 601.991012][T28461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10517'. [ 602.082310][T28467] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10517'. [ 602.128528][T28472] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 602.145116][T28467] netlink: 'syz.4.10517': attribute type 29 has an invalid length. [ 602.167850][T28467] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10517'. [ 602.485886][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 602.896439][T28489] netlink: 'syz.2.10524': attribute type 1 has an invalid length. [ 602.907118][T28490] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 602.935616][T28490] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 603.118059][T28489] bond2: entered promiscuous mode [ 603.128059][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 603.194809][T28489] 8021q: adding VLAN 0 to HW filter on device bond2 [ 603.238338][T28504] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10529'. [ 603.363757][T28496] 8021q: adding VLAN 0 to HW filter on device bond2 [ 603.397610][T28496] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 603.447290][T28496] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 603.474098][T28496] bond2: (slave ip6gre1): making interface the new active one [ 603.484202][T28496] ip6gre1: entered promiscuous mode [ 603.495020][T28496] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 603.508780][T28504] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10529'. [ 603.727270][T28514] bridge: RTM_NEWNEIGH with invalid ether address [ 603.740507][T28514] bridge: RTM_NEWNEIGH with invalid ether address [ 603.770654][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 605.074305][T28556] __nla_validate_parse: 4 callbacks suppressed [ 605.074362][T28556] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10548'. [ 605.700379][T28574] xt_hashlimit: size too large, truncated to 1048576 [ 606.855735][T28613] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10566'. [ 607.033965][T28616] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.10567'. [ 607.139541][T28613] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10566'. [ 607.319341][T28620] netlink: 184 bytes leftover after parsing attributes in process `syz.4.10568'. [ 608.491754][T28653] tls_set_device_offload: netdev not found [ 610.143527][T28708] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10600'. [ 611.286222][ T5637] Bluetooth: hci4: command 0x0405 tx timeout [ 612.372711][T28765] netlink: 52 bytes leftover after parsing attributes in process `syz.0.10617'. [ 612.549861][T28768] netlink: 52 bytes leftover after parsing attributes in process `syz.0.10617'. [ 613.130221][T28771] netlink: 208240 bytes leftover after parsing attributes in process `syz.0.10621'. [ 613.255520][T28774] tipc: Failed to remove unknown binding: 66,1,1/2886997007:2018978788/2018978790 [ 613.356962][T28774] tipc: Failed to remove unknown binding: 66,1,1/2886997007:2018978788/2018978790 [ 613.368848][ C0] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 613.461243][T28778] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10623'. [ 614.654770][T28812] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10636'. [ 614.930153][T28812] bond5: entered promiscuous mode [ 615.288794][T28835] netlink: 'syz.0.10644': attribute type 21 has an invalid length. [ 615.324594][T28835] netlink: 'syz.0.10644': attribute type 22 has an invalid length. [ 615.359180][T28835] netlink: 'syz.0.10644': attribute type 23 has an invalid length. [ 615.382147][T28835] netlink: 'syz.0.10644': attribute type 25 has an invalid length. [ 615.391228][T28835] netlink: 96 bytes leftover after parsing attributes in process `syz.0.10644'. [ 615.822427][T28850] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10650'. [ 615.832624][T28850] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10650'. [ 616.312691][T28862] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 616.429255][T28865] netlink: 'syz.2.10656': attribute type 1 has an invalid length. [ 616.456300][T28865] netlink: 'syz.2.10656': attribute type 4 has an invalid length. [ 616.474939][T28865] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.10656'. [ 617.101708][T28880] veth0: entered promiscuous mode [ 617.162659][T28880] veth0: left promiscuous mode [ 617.274483][T28885] netlink: 240 bytes leftover after parsing attributes in process `syz.2.10661'. [ 617.431581][T28890] netlink: 'syz.4.10664': attribute type 4 has an invalid length. [ 619.011385][T28923] policy can only be matched on NF_INET_PRE_ROUTING [ 619.011406][T28923] unable to load match [ 619.792749][T28942] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.10684'. [ 620.620366][ T48] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 620.824051][T28975] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.10697'. [ 621.169063][T28984] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.10701'. [ 622.230665][T29018] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.10716'. [ 622.846226][T29032] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10723'. [ 623.488859][T28962] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 623.827638][T29057] GUP no longer grows the stack in syz.4.10735 (29057): 200000003000-20000000a000 (200000001000) [ 623.879701][T29057] CPU: 1 UID: 0 PID: 29057 Comm: syz.4.10735 Not tainted syzkaller #0 PREEMPT(full) [ 623.879740][T29057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 623.879771][T29057] Call Trace: [ 623.879782][T29057] [ 623.879791][T29057] dump_stack_lvl+0xe8/0x150 [ 623.879829][T29057] __get_user_pages+0x2378/0x2720 [ 623.879863][T29057] ? __gup_longterm_locked+0xc4e/0x1630 [ 623.879910][T29057] ? __gup_longterm_locked+0xc4e/0x1630 [ 623.879937][T29057] ? down_read_killable+0x1bb/0x340 [ 623.880048][T29057] __gup_longterm_locked+0xdcf/0x1630 [ 623.880081][T29057] ? lock_acquire+0x106/0x350 [ 623.880140][T29057] gup_fast_fallback+0x1d84/0x20d0 [ 623.880205][T29057] ? __pfx_gup_fast_fallback+0x10/0x10 [ 623.880234][T29057] ? is_valid_gup_args+0x11f/0x200 [ 623.880264][T29057] ? get_user_pages_fast+0x4d/0xb0 [ 623.880294][T29057] __iov_iter_get_pages_alloc+0x370/0xa10 [ 623.880420][T29057] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 623.880470][T29057] iov_iter_get_pages2+0x5e/0xa0 [ 623.880508][T29057] __se_sys_vmsplice+0x7c7/0x1620 [ 623.880561][T29057] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 623.880593][T29057] ? __pfx_futex_wait+0x10/0x10 [ 623.880650][T29057] ? lockdep_hardirqs_on+0x7a/0x110 [ 623.880776][T29057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.880802][T29057] do_syscall_64+0x15f/0xf80 [ 623.880835][T29057] ? trace_irq_disable+0x3b/0x140 [ 623.880869][T29057] ? clear_bhb_loop+0x40/0x90 [ 623.880898][T29057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.880920][T29057] RIP: 0033:0x7ff96ab9ce59 [ 623.880942][T29057] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 623.880962][T29057] RSP: 002b:00007ff96b9d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 623.880987][T29057] RAX: ffffffffffffffda RBX: 00007ff96ae15fa0 RCX: 00007ff96ab9ce59 [ 623.881004][T29057] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 623.881017][T29057] RBP: 00007ff96ac32d6f R08: 0000000000000000 R09: 0000000000000000 [ 623.881030][T29057] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 623.881043][T29057] R13: 00007ff96ae16038 R14: 00007ff96ae15fa0 R15: 00007ffdf88d2568 [ 623.881079][T29057] [ 624.633917][T29074] netlink: 'syz.3.10742': attribute type 1 has an invalid length. [ 624.894885][T29074] bond4: entered promiscuous mode [ 624.908102][T29074] 8021q: adding VLAN 0 to HW filter on device bond4 [ 625.031715][T29083] 8021q: adding VLAN 0 to HW filter on device bond4 [ 625.059661][T29083] bond4: (slave vti0): The slave device specified does not support setting the MAC address [ 625.122544][T29083] bond4: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 625.172065][T29083] bond4: (slave vti0): making interface the new active one [ 625.183154][T29083] vti0: entered promiscuous mode [ 625.193571][T29083] bond4: (slave vti0): Enslaving as an active interface with an up link [ 625.203454][T29084] netlink: 76 bytes leftover after parsing attributes in process `syz.4.10744'. [ 625.521488][T29100] syz_tun: entered allmulticast mode [ 625.559088][T29096] syz_tun: left allmulticast mode [ 625.788069][T29104] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10750'. [ 625.840527][T29104] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10750'. [ 627.445887][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 627.969141][T18335] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 629.949371][T29209] netlink: 92 bytes leftover after parsing attributes in process `syz.4.10790'. [ 630.717389][T29153] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 631.421701][T29242] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10805'. [ 631.453640][T29242] netlink: 'syz.0.10805': attribute type 7 has an invalid length. [ 631.476083][T29242] netlink: 'syz.0.10805': attribute type 8 has an invalid length. [ 631.506582][T29242] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10805'. [ 633.206516][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 633.213830][ C1] bridge0: topology change detected, propagating [ 633.845767][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 633.853069][ C1] bridge0: topology change detected, propagating [ 633.861285][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 633.870185][T29273] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 634.329770][T29299] netlink: 212360 bytes leftover after parsing attributes in process `syz.2.10824'. [ 634.693359][T29304] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10826'. [ 635.260996][T29322] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10833'. [ 635.323305][T29320] netlink: 'syz.4.10831': attribute type 1 has an invalid length. [ 635.424298][T29322] netlink: 92 bytes leftover after parsing attributes in process `syz.0.10833'. [ 635.907119][T29338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 636.180447][T29350] netlink: 'syz.1.10844': attribute type 1 has an invalid length. [ 636.234700][T29350] netlink: 'syz.1.10844': attribute type 4 has an invalid length. [ 636.262492][T29350] netlink: 9491 bytes leftover after parsing attributes in process `syz.1.10844'. [ 636.605137][T29358] syzkaller1: entered promiscuous mode [ 636.646566][T29358] syzkaller1: entered allmulticast mode [ 636.654291][T29362] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10848'. [ 636.695398][T29364] netlink: 'syz.3.10851': attribute type 1 has an invalid length. [ 636.908114][T29370] bond5: (slave geneve5): Opening slave failed [ 637.324720][T29380] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.10857'. [ 637.368992][T29382] netlink: 'syz.0.10856': attribute type 1 has an invalid length. [ 637.570926][T29386] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10858'. [ 637.620026][T29384] macvlan3: entered promiscuous mode [ 637.675087][T29384] macvlan3: entered allmulticast mode [ 637.717535][T29384] bond11: entered promiscuous mode [ 637.753765][T29384] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 637.789714][T29384] bond11: left promiscuous mode [ 637.953927][T29396] netlink: 'syz.3.10862': attribute type 9 has an invalid length. [ 637.985893][T29396] netlink: 16166 bytes leftover after parsing attributes in process `syz.3.10862'. [ 638.613759][T29409] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10868'. [ 638.969921][T29419] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10872'. [ 639.175492][T29429] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10874'. [ 639.336899][T29436] sctp: [Deprecated]: syz.4.10876 (pid 29436) Use of int in maxseg socket option. [ 639.336899][T29436] Use struct sctp_assoc_value instead [ 640.367877][T29454] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10885'. [ 641.804310][T29486] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10895'. [ 642.227377][T29487] wg1 speed is unknown, defaulting to 1000 [ 642.253213][T29487] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 642.311624][T29499] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 642.396609][T29499] xt_hashlimit: size too large, truncated to 1048576 [ 642.841627][T29508] netlink: 'syz.3.10901': attribute type 1 has an invalid length. [ 642.932927][T29512] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10901'. [ 643.022041][T29512] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10901'. [ 643.092237][T29508] bond6: entered promiscuous mode [ 643.128575][T29522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10905'. [ 643.144361][T29508] 8021q: adding VLAN 0 to HW filter on device bond6 [ 643.542438][T29520] bond6: (slave bridge11): making interface the new active one [ 643.571099][T29520] bridge11: entered promiscuous mode [ 643.589822][T29520] bond6: (slave bridge11): Enslaving as an active interface with an up link [ 643.998980][T29527] syzkaller1: entered promiscuous mode [ 644.028342][T29527] syzkaller1: entered allmulticast mode [ 644.050453][T29532] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10907'. [ 644.210696][T29534] netlink: 'syz.0.10908': attribute type 1 has an invalid length. [ 644.248478][T29487] »»»»»» speed is unknown, defaulting to 1000 [ 644.264349][T29536] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10909'. [ 644.451216][T29534] 8021q: adding VLAN 0 to HW filter on device bond12 [ 644.605513][T29552] netlink: 'syz.2.10913': attribute type 1 has an invalid length. [ 644.633903][T29538] 8021q: adding VLAN 0 to HW filter on device bond12 [ 644.667788][T29538] bond12: (slave vcan0): The slave device specified does not support setting the MAC address [ 644.704165][T29538] bond12: (slave vcan0): Error -95 calling set_mac_address [ 644.909284][T29552] 8021q: adding VLAN 0 to HW filter on device bond3 [ 645.095577][T29555] bond3: (slave veth9): Enslaving as an active interface with a down link [ 645.211248][T29556] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 645.236545][T29556] bond3: (slave batadv2): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 645.932641][T29581] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 646.271389][T29588] netlink: 'syz.2.10925': attribute type 3 has an invalid length. [ 646.512486][T29596] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10927'. [ 646.593364][T29603] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10927'. [ 646.738848][T29572] scsi_nl_rcv_msg: discarding partial skb [ 647.951708][T29615] syzkaller0: entered promiscuous mode [ 647.967146][T29615] syzkaller0: entered allmulticast mode [ 648.967456][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 649.845921][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 650.034721][T29662] tipc: Failed to remove unknown binding: 66,1,1/2886997007:3512383884/3512383886 [ 652.832528][T29691] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10957'. [ 653.491594][T29701] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10960'. [ 654.027831][T29708] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10962'. [ 654.145217][T29710] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.10963'. [ 655.042577][T29721] netlink: 14544 bytes leftover after parsing attributes in process `syz.0.10966'. [ 655.412456][T29736] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10974'. [ 655.606025][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 656.402792][T29759] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10981'. [ 657.148591][T29777] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10987'. [ 657.489459][T29781] netlink: 144 bytes leftover after parsing attributes in process `syz.2.10989'. [ 658.002411][T29795] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10996'. [ 658.966443][T25698] Bluetooth: hci3: command 0x0406 tx timeout [ 659.088158][T29824] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 659.095460][T29824] IPv6: NLM_F_CREATE should be set when creating new route [ 660.339067][T29846] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 660.549012][T29855] sctp: [Deprecated]: syz.4.11018 (pid 29855) Use of struct sctp_assoc_value in delayed_ack socket option. [ 660.549012][T29855] Use struct sctp_sack_info instead [ 661.006000][T29862] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 661.032502][T29862] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 661.705327][T29883] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11030'. [ 662.035095][T29890] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11032'. [ 662.099900][T29894] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11034'. [ 662.153940][T29897] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11034'. [ 662.886159][ T9871] page_pool_release_retry() stalled pool shutdown: id 89, 1 inflight 60 sec [ 662.917177][T29882] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.2.11029:29882 [ 663.168666][T29917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11041'. [ 663.444845][T29920] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11042'. [ 663.454321][T29920] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11042'. [ 667.403753][T29956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11054'. [ 667.767840][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 669.004139][T29991] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11068'. [ 669.253383][T29991] 8021q: adding VLAN 0 to HW filter on device bond5 [ 669.411094][T29995] ipvlan0: entered allmulticast mode [ 669.455067][T29995] bond5: entered allmulticast mode [ 669.582843][T29999] bond5: (slave ipip1): refused to change device type [ 669.843876][T30005] syzkaller1: entered promiscuous mode [ 669.881528][T30005] syzkaller1: entered allmulticast mode [ 670.511800][T30027] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11077'. [ 670.545530][T30027] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11077'. [ 671.352727][T29983] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 671.374440][T30048] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.11086'. [ 671.545554][T30050] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11087'. [ 672.797571][T30076] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11097'. [ 672.855250][T30076] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11097'. [ 673.066279][T30081] bridge6: port 1(vlan0) entered blocking state [ 673.090077][T30081] bridge6: port 1(vlan0) entered disabled state [ 673.100808][T30081] vlan0: entered allmulticast mode [ 673.107465][T30081] bridge6: entered allmulticast mode [ 673.136602][T30081] vlan0: left allmulticast mode [ 673.164816][T30081] bridge6: left allmulticast mode [ 673.789232][T30103] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11104'. [ 674.270613][T30113] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11108'. [ 675.144518][T30141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11118'. [ 675.909292][T30157] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11122'. [ 677.036228][T30181] tipc: Enabled bearer , priority 0 [ 677.400818][T30181] syzkaller0: entered promiscuous mode [ 677.410452][T30181] syzkaller0: entered allmulticast mode [ 677.418609][T30181] tipc: Resetting bearer [ 677.442641][T30199] tipc: Enabled bearer , priority 0 [ 677.475278][T30196] syzkaller0: MTU too low for tipc bearer [ 677.481721][T30196] tipc: Disabling bearer [ 677.603384][T30180] tipc: Resetting bearer [ 681.121746][T30180] tipc: Disabling bearer [ 681.406875][T30243] netlink: 180 bytes leftover after parsing attributes in process `syz.4.11153'. [ 681.810974][T30256] netlink: 'syz.0.11161': attribute type 1 has an invalid length. [ 682.060614][T30256] 8021q: adding VLAN 0 to HW filter on device bond13 [ 682.248636][T30263] bond13: (slave geneve2): making interface the new active one [ 682.299441][T30263] bond13: (slave geneve2): Enslaving as an active interface with an up link [ 682.761207][T30278] netlink: 'syz.0.11165': attribute type 12 has an invalid length. [ 685.688685][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 685.690394][ C0] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 685.949824][T30354] bond9: (slave lo): Releasing backup interface [ 685.971681][T30354] bond9: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 686.024125][T30354] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 686.132623][T30360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11196'. [ 686.149071][T30357] ip6gre2: entered allmulticast mode [ 686.159449][T30357] team0: Device ip6gre2 is of different type [ 686.810072][ T12] af_packet: tpacket_rcv: packet too big, clamped from 24 to 4294967272. macoff=96 [ 687.349842][T30382] bond6: entered promiscuous mode [ 687.418999][T30385] macvlan2: entered promiscuous mode [ 687.431498][T30385] macvlan2: entered allmulticast mode [ 687.446883][T30385] bond6: (slave macvlan2): Opening slave failed [ 687.981025][T30390] syzkaller1: entered promiscuous mode [ 688.002053][T30390] syzkaller1: entered allmulticast mode [ 688.586481][T30422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11217'. [ 688.595747][T30422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11217'. [ 688.881999][T18335] syzkaller0: tun_net_xmit 76 [ 688.908069][ T9871] syzkaller0: tun_net_xmit 76 [ 688.913671][T18335] syzkaller0: tun_net_xmit 48 [ 688.979659][T30405] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 689.047463][ T9871] syzkaller0: tun_net_xmit 76 [ 689.516520][T17349] syzkaller0: tun_net_xmit 76 [ 690.276474][T17349] syzkaller0: tun_net_xmit 76 [ 690.308836][T30423] syzkaller0: delete flow: hash 3507640769 index 1 [ 690.630423][T30455] tipc: Failed to remove unknown binding: 66,0,0/4269801494:46657796/46657797 [ 690.665161][T30455] tipc: Failed to remove unknown binding: 66,0,0/4269801494:46657796/46657797 [ 692.086074][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 692.094835][T30431] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 695.008393][T30495] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11233'. [ 695.161323][T30499] xt_CT: You must specify a L4 protocol and not use inversions on it [ 695.449596][T30499] netlink: 'syz.0.11235': attribute type 1 has an invalid length. [ 695.471748][T30499] netlink: 224 bytes leftover after parsing attributes in process `syz.0.11235'. [ 695.593319][T30512] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11240'. [ 695.991654][T30526] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11244'. [ 696.245547][T30539] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 696.257054][T30526] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11244'. [ 696.506768][T30547] bond4: entered allmulticast mode [ 696.516871][T30547] vti0: entered allmulticast mode [ 696.524761][T30547] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11251'. [ 696.558683][T30546] bond4: left allmulticast mode [ 696.564078][T30546] vti0: left allmulticast mode [ 696.570150][T30549] openvswitch: netlink: EtherType 50a is less than min 600 [ 696.751500][T30525] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 696.944570][T30554] bridge0: port 2(bridge_slave_1) entered disabled state [ 696.952930][T30554] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.019353][T30559] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11255'. [ 697.371274][T30569] syzkaller1: entered promiscuous mode [ 697.387908][T30569] syzkaller1: entered allmulticast mode [ 698.127082][T30593] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11263'. [ 698.353848][T30598] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11266'. [ 698.470659][T30598] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 699.054556][T30598] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 699.081278][T28233] smc: removing ib device syz1 [ 699.169296][ T9871] syz1: Port: 1 Link DOWN [ 699.261263][T30611] netlink: 'syz.3.11270': attribute type 4 has an invalid length. [ 699.319713][ T9871] »»»»»» speed is unknown, defaulting to 1000 [ 699.358459][ T9871] syú2: Port: 1 Link DOWN [ 699.371085][T30613] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11271'. [ 699.512636][T28233] smbdirect: ib_dev[syz1] removed [ 701.046179][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 701.632177][T30649] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11282'. [ 702.383359][T30661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11287'. [ 702.428575][T30661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11287'. [ 702.819839][T30670] dvmrp0: entered allmulticast mode [ 703.035113][T30677] netlink: 52 bytes leftover after parsing attributes in process `syz.1.11291'. [ 703.093833][T30678] netlink: 76 bytes leftover after parsing attributes in process `syz.1.11291'. [ 703.130875][T30677] bridge0: port 2(bridge_slave_1) entered disabled state [ 703.138394][T30677] bridge0: port 1(bridge_slave_0) entered disabled state [ 703.240392][T30678] bridge0: port 2(bridge_slave_1) entered blocking state [ 703.247764][T30678] bridge0: port 2(bridge_slave_1) entered forwarding state [ 703.255284][T30678] bridge0: port 1(bridge_slave_0) entered blocking state [ 703.262471][T30678] bridge0: port 1(bridge_slave_0) entered forwarding state [ 703.340061][T30678] netlink: 52 bytes leftover after parsing attributes in process `syz.1.11291'. [ 703.402160][T30678] bridge0: port 2(bridge_slave_1) entered disabled state [ 703.409474][T30678] bridge0: port 1(bridge_slave_0) entered disabled state [ 703.430101][T30684] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11293'. [ 703.510637][T30684] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 703.645285][T30684] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 704.740105][T30705] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 704.819816][T30710] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.11300'. [ 705.015344][T30709] syzkaller0: entered promiscuous mode [ 705.034202][T30709] syzkaller0: entered allmulticast mode [ 705.284958][T30718] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11304'. [ 705.434046][T30723] netlink: 548 bytes leftover after parsing attributes in process `syz.0.11305'. [ 705.571572][T30718] bond4: entered promiscuous mode [ 705.577725][T30718] 8021q: adding VLAN 0 to HW filter on device bond4 [ 705.585139][T30720] netlink: 'syz.0.11305': attribute type 29 has an invalid length. [ 705.619299][T30721] bridge4: entered promiscuous mode [ 705.626318][T30721] bond4: (slave bridge4): Enslaving as an active interface with an up link [ 706.813952][T30693] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 707.772246][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 708.750704][T30722] netlink: 'syz.0.11305': attribute type 29 has an invalid length. [ 709.284375][T30772] netlink: 'syz.0.11320': attribute type 1 has an invalid length. [ 709.316186][T30773] netlink: 'syz.4.11321': attribute type 1 has an invalid length. [ 709.374743][T30772] 8021q: adding VLAN 0 to HW filter on device bond14 [ 709.454666][T30779] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11322'. [ 709.533893][T30776] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 709.544675][T30776] bond6: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 709.561280][T30776] bond6: (slave vxcan3): making interface the new active one [ 709.571524][T30776] bond6: (slave vxcan3): Enslaving as an active interface with an up link [ 709.615512][T30781] siw: device registration error -23 [ 710.180198][T30796] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 710.187606][T30796] IPv6: NLM_F_CREATE should be set when creating new route [ 710.266693][T30796] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11327'. [ 711.529477][T30826] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 712.748087][T30853] netlink: 'syz.4.11347': attribute type 27 has an invalid length. [ 712.758703][T30853] netlink: 'syz.4.11347': attribute type 4 has an invalid length. [ 712.774834][T30853] netlink: 144 bytes leftover after parsing attributes in process `syz.4.11347'. [ 712.912888][T30857] tipc: Failed to remove unknown binding: 66,0,0/4269801494:2096346798/2096346800 [ 712.962630][T30857] tipc: Failed to remove unknown binding: 66,0,0/4269801494:2096346798/2096346799 [ 713.004598][T30857] tipc: Failed to remove unknown binding: 66,0,0/4269801494:2096346798/2096346800 [ 713.024695][T30857] tipc: Failed to remove unknown binding: 66,0,0/4269801494:2096346798/2096346799 [ 713.845965][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 714.682413][T30912] netlink: 'syz.1.11370': attribute type 39 has an invalid length. [ 715.069300][T30917] netlink: 'syz.0.11371': attribute type 1 has an invalid length. [ 715.544877][T30935] syzkaller0: entered promiscuous mode [ 715.563764][T30935] syzkaller0: entered allmulticast mode [ 716.950994][T30961] netlink: 'syz.3.11384': attribute type 4 has an invalid length. [ 716.992157][T30961] netlink: 'syz.3.11384': attribute type 4 has an invalid length. [ 717.081965][T30605] »»»»»» speed is unknown, defaulting to 1000 [ 717.113767][T30605] syú2: Port: 1 Link ACTIVE [ 717.268300][T30965] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11385'. [ 717.628492][T30967] syzkaller0: entered promiscuous mode [ 717.653429][T30967] syzkaller0: entered allmulticast mode [ 718.470526][T30982] netlink: 'syz.0.11390': attribute type 1 has an invalid length. [ 718.723365][T30988] netlink: 40 bytes leftover after parsing attributes in process `syz.0.11392'. [ 718.948589][T30997] bridge_slave_0: left allmulticast mode [ 718.984753][T30997] bridge_slave_0: left promiscuous mode [ 719.023275][T30997] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.085077][T30997] bridge_slave_1: left allmulticast mode [ 719.119938][T30997] bridge_slave_1: left promiscuous mode [ 719.145918][T30997] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.261934][T30997] bond0: (slave bond_slave_0): Releasing backup interface [ 719.290109][T31007] IPv4: Oversized IP packet from 127.202.26.0 [ 719.348572][T30997] bond0: (slave bond_slave_1): Releasing backup interface [ 719.500957][T30997] team0: Port device team_slave_0 removed [ 719.547879][T30997] team0: Port device team_slave_1 removed [ 719.577602][T30997] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 719.587487][T30997] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 719.634682][T30997] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 720.441542][T31032] syzkaller0: entered promiscuous mode [ 720.470641][T31032] syzkaller0: entered allmulticast mode [ 720.772583][T31040] syzkaller0: entered promiscuous mode [ 720.805247][T31040] syzkaller0: entered allmulticast mode [ 721.551895][T31072] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11415'. [ 721.986972][T31079] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11417'. [ 722.303755][T31083] bond5: entered promiscuous mode [ 722.402214][T31083] bond5: entered allmulticast mode [ 722.518930][T31095] xt_hashlimit: size too large, truncated to 1048576 [ 722.911085][T31099] syzkaller0: entered promiscuous mode [ 722.941283][T31099] syzkaller0: entered allmulticast mode [ 723.464260][T31108] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 723.606284][T31108] team0: Mode changed to "activebackup" [ 723.643044][T31108] tipc: Enabled bearer , priority 0 [ 724.011129][T31119] netlink: 'syz.3.11429': attribute type 1 has an invalid length. [ 724.385481][T31130] syzkaller0: entered promiscuous mode [ 724.422190][T31130] syzkaller0: entered allmulticast mode [ 725.536668][T31154] syzkaller0: entered promiscuous mode [ 725.571909][T31154] syzkaller0: entered allmulticast mode [ 725.681610][T31159] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11444'. [ 725.711947][T31161] netlink: 'syz.2.11443': attribute type 1 has an invalid length. [ 725.744618][T31159] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11444'. [ 726.006122][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 726.141747][T31161] 8021q: adding VLAN 0 to HW filter on device bond6 [ 726.172080][T31159] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 726.193459][T31159] netdevsim netdevsim0 netdevsim1: left promiscuous mode [ 726.279663][T31157] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 726.335086][T31132] geneve0: entered promiscuous mode [ 726.499082][T31164] bond6: (slave veth11): Enslaving as an active interface with a down link [ 726.519803][T31164] netlink: 'syz.2.11443': attribute type 1 has an invalid length. [ 726.546285][T31164] netlink: 'syz.2.11443': attribute type 2 has an invalid length. [ 726.552608][T31176] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11448'. [ 727.249792][T31198] syzkaller0: entered promiscuous mode [ 727.294753][T31198] syzkaller0: entered allmulticast mode [ 727.626098][T31211] syzkaller0: entered promiscuous mode [ 727.641907][T31211] syzkaller0: entered allmulticast mode [ 728.468188][T31230] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 728.560751][T31230] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 728.609965][T31231] ip6_vti0: entered promiscuous mode [ 728.616852][T31231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11460'. [ 728.741495][T31233] netlink: 'syz.0.11461': attribute type 1 has an invalid length. [ 728.775867][T31233] 8021q: adding VLAN 0 to HW filter on device bond15 [ 728.812698][T31233] bond15: (slave veth0_to_bond): making interface the new active one [ 728.839521][T31233] bond15: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 728.909669][T31233] 8021q: adding VLAN 0 to HW filter on device bond16 [ 728.920510][T31233] bond15: (slave bond16): Enslaving as an active interface with a down link [ 729.184666][T31242] bridge11: entered promiscuous mode [ 729.190767][T31242] bridge11: entered allmulticast mode [ 729.204111][T31242] team0: Port device bridge11 added [ 729.223278][T31242] bridge0: port 1(team0) entered blocking state [ 729.231176][T31242] bridge0: port 1(team0) entered disabled state [ 729.239761][T31242] team0: entered allmulticast mode [ 729.247753][T31242] team_slave_0: entered allmulticast mode [ 729.253671][T31242] team_slave_1: entered allmulticast mode [ 729.262813][T31242] team0: entered promiscuous mode [ 729.268204][T31242] team_slave_0: entered promiscuous mode [ 729.274931][T31242] team_slave_1: entered promiscuous mode [ 729.553773][T31249] netlink: 'syz.0.11467': attribute type 1 has an invalid length. [ 729.636358][T31249] 8021q: adding VLAN 0 to HW filter on device bond18 [ 729.645187][T31249] bond17: (slave bond18): making interface the new active one [ 729.653972][T31249] bond17: (slave bond18): Enslaving as an active interface with an up link [ 729.696998][T31249] bond17: (slave gretap2): Enslaving as a backup interface with an up link [ 729.711439][T31249] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11467'. [ 729.725322][T31181] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 729.774673][T31249] 8021q: adding VLAN 0 to HW filter on device bond17 [ 730.234162][T31255] syzkaller0: entered promiscuous mode [ 730.275324][T31255] syzkaller0: entered allmulticast mode [ 730.349994][T31263] syzkaller0: entered promiscuous mode [ 730.384546][T31263] syzkaller0: entered allmulticast mode [ 735.000920][T31337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11487'. [ 735.327086][T31346] bond19: entered promiscuous mode [ 735.359562][T31346] bond19: entered allmulticast mode [ 735.672514][T31352] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11489'. [ 735.713525][T31355] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11490'. [ 737.059977][T31387] syzkaller0: entered promiscuous mode [ 737.066788][T31387] syzkaller0: entered allmulticast mode [ 737.748133][T31326] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 738.164882][T31409] syzkaller0: entered promiscuous mode [ 738.206332][T31409] syzkaller0: entered allmulticast mode [ 739.240523][T31427] syzkaller0: entered promiscuous mode [ 739.262018][T31427] syzkaller0: entered allmulticast mode [ 740.220129][T31453] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11512'. [ 740.484340][T31461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11515'. [ 740.841881][T31461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11515'. [ 741.073781][T31471] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 741.104811][T31476] netlink: 'syz.2.11520': attribute type 1 has an invalid length. [ 741.111281][T31471] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 741.790342][T31481] bond7: (slave bridge5): making interface the new active one [ 741.802433][T31481] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 741.875282][T31488] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 741.928640][T31489] syzkaller0: entered promiscuous mode [ 741.953012][T31489] syzkaller0: entered allmulticast mode [ 742.006142][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 742.280362][T31507] netlink: 'syz.0.11525': attribute type 1 has an invalid length. [ 742.394941][T31512] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 742.403011][T31512] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 742.422384][T31507] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11525'. [ 742.454593][T31507] bond20: (slave bridge12): making interface the new active one [ 742.510783][T31510] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11525'. [ 742.540725][T31507] bond20: (slave bridge12): Enslaving as an active interface with an up link [ 742.608296][T31510] 8021q: adding VLAN 0 to HW filter on device bond20 [ 742.634678][T31516] netlink: 'syz.3.11528': attribute type 13 has an invalid length. [ 743.341855][T31535] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 743.383010][T31535] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 743.871645][T31553] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11534'. [ 743.918466][T31541] syzkaller0: entered promiscuous mode [ 743.926449][T31541] syzkaller0: entered allmulticast mode [ 744.004533][T31560] netlink: 'syz.0.11537': attribute type 13 has an invalid length. [ 747.427159][T31560] tipc: Resetting bearer [ 747.606165][T17349] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 747.760788][T31562] mac80211_hwsim hwsim11 syzkaller0: Caught tx_queue_len zero misconfig [ 747.783766][T31568] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 747.792907][T31568] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 748.192329][T31595] syzkaller0: entered promiscuous mode [ 748.208298][T31595] syzkaller0: entered allmulticast mode [ 748.228209][T17349] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 748.939827][T31606] syzkaller0: entered promiscuous mode [ 748.996050][T31606] syzkaller0: entered allmulticast mode [ 749.893621][T31658] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11555'. [ 750.326120][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 752.814043][T31632] syzkaller0: entered promiscuous mode [ 752.824850][T31632] syzkaller0: entered allmulticast mode [ 756.053042][T31690] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 756.445115][T31722] syzkaller0: entered promiscuous mode [ 756.481994][T31722] syzkaller0: entered allmulticast mode [ 756.964839][T31715] syzkaller0: entered promiscuous mode [ 756.971562][T31715] syzkaller0: entered allmulticast mode [ 760.300440][T31755] tc action pedit 'at' offset 6 out of bounds [ 760.610945][ T30] audit: type=1804 audit(1778672653.755:4): pid=31771 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.11573" name="/newroot/2326/cgroup.controllers" dev="tmpfs" ino=11720 res=1 errno=0 [ 760.637066][ T30] audit: type=1800 audit(1778672653.755:5): pid=31771 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.11573" name="cgroup.controllers" dev="tmpfs" ino=11720 res=0 errno=0 [ 762.815454][T31808] syzkaller0: entered promiscuous mode [ 762.843272][T31808] syzkaller0: entered allmulticast mode [ 763.059521][T31815] netlink: 'syz.1.11585': attribute type 10 has an invalid length. [ 763.207103][T31815] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 763.226008][T31815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 763.274304][T31764] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 763.697615][T31819] xt_hashlimit: size too large, truncated to 1048576 [ 766.793251][T31827] netlink: 76 bytes leftover after parsing attributes in process `syz.4.11587'. [ 766.843939][T31838] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 767.244646][T31842] syzkaller0: entered promiscuous mode [ 767.300469][T31842] syzkaller0: entered allmulticast mode [ 767.985236][T31855] syzkaller0: entered promiscuous mode [ 768.046135][T31855] syzkaller0: entered allmulticast mode [ 768.282111][T31859] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 768.315292][T31859] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 771.587197][T31892] bridge0: port 3(veth1_to_hsr) entered blocking state [ 771.607190][T31892] bridge0: port 3(veth1_to_hsr) entered disabled state [ 771.621861][T31892] veth1_to_hsr: entered allmulticast mode [ 771.631443][T31892] veth1_to_hsr: entered promiscuous mode [ 771.643487][T31892] bridge0: port 3(veth1_to_hsr) entered blocking state [ 771.651550][T31892] bridge0: port 3(veth1_to_hsr) entered listening state [ 771.957944][T31909] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 771.966565][T31915] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 771.997345][T31909] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 772.235376][T31920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11604'. [ 772.301005][T31920] tipc: Resetting bearer [ 772.324792][T31926] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 772.484983][T31920] tipc: Disabling bearer [ 772.558922][T31927] netdevsim netdevsim0 : renamed from netdevsim0 (while UP) [ 772.820602][T31938] syzkaller0: entered promiscuous mode [ 772.832675][T31938] syzkaller0: entered allmulticast mode [ 773.123967][T31947] netlink: 'syz.1.11613': attribute type 12 has an invalid length. [ 773.158123][T31944] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 773.175329][T31944] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 773.995238][T31968] team0: Device macvlan1 failed to change mtu [ 774.594620][T31984] syzkaller0: entered promiscuous mode [ 774.681192][T31984] syzkaller0: entered allmulticast mode [ 775.012857][T31999] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11636'. [ 776.055246][T32027] netlink: 1 bytes leftover after parsing attributes in process `syz.3.11649'. [ 776.137497][T32027] xt_policy: neither incoming nor outgoing policy selected [ 777.644637][T32070] ip6tnl0: Caught tx_queue_len zero misconfig [ 777.920082][T32076] vlan0: entered allmulticast mode [ 777.992461][T32076] bond0: entered allmulticast mode [ 778.008035][T32076] bond_slave_0: entered allmulticast mode [ 778.032846][T32076] bond_slave_1: entered allmulticast mode [ 778.071647][T32085] netlink: 'syz.3.11673': attribute type 1 has an invalid length. [ 778.354631][T32093] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11673'. [ 778.420293][T32090] bond7: (slave ip6gretap0): Enslaving as a backup interface with an up link [ 778.609824][T32085] veth13: entered promiscuous mode [ 778.635252][T32093] 8021q: adding VLAN 0 to HW filter on device bond7 [ 778.676648][T27215] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 778.888724][ T48] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 779.427767][T32123] lo: Caught tx_queue_len zero misconfig [ 779.450678][T32123] netlink: 'syz.0.11687': attribute type 8 has an invalid length. [ 779.493243][T32123] sch_fq: defrate 0 ignored. [ 779.660870][T32132] netlink: 44 bytes leftover after parsing attributes in process `syz.4.11688'. [ 779.709625][T32132] bridge0: port 3(veth1_to_hsr) entered disabled state [ 779.717667][T32132] bridge0: port 2(bridge_slave_1) entered disabled state [ 779.725903][T32132] bridge0: port 1(bridge_slave_0) entered disabled state [ 779.862136][T32135] netlink: 'syz.0.11691': attribute type 1 has an invalid length. [ 779.936347][T32135] netlink: 'syz.0.11691': attribute type 1 has an invalid length. [ 779.993191][T32135] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11691'. [ 780.330354][T32150] netlink: 248 bytes leftover after parsing attributes in process `syz.1.11697'. [ 780.391020][T32150] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11697'. [ 780.441736][T32150] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11697'. [ 781.013224][T32170] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11703'. [ 781.462672][T32181] netlink: 248 bytes leftover after parsing attributes in process `syz.3.11709'. [ 781.478734][T32181] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11709'. [ 781.501482][T32181] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11709'. [ 782.323213][T32203] netlink: 'syz.1.11718': attribute type 1 has an invalid length. [ 782.563670][T32203] veth1: entered promiscuous mode [ 782.584650][T32203] bond7: (slave veth1): Enslaving as a backup interface with a down link [ 783.203128][T32224] netem: change failed [ 783.518382][T32235] netem: change failed [ 783.527841][T32234] xt_hashlimit: size too large, truncated to 1048576 [ 783.728354][T32243] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11734'. [ 784.502104][T32262] netlink: 'syz.3.11742': attribute type 1 has an invalid length. [ 784.980539][T32266] veth15: entered promiscuous mode [ 785.033878][T32266] bond8: (slave veth15): Enslaving as a backup interface with a down link [ 785.580493][T32290] xt_hashlimit: size too large, truncated to 1048576 [ 785.652026][T32293] xt_hashlimit: size too large, truncated to 1048576 [ 786.391035][T32311] netlink: 'syz.3.11759': attribute type 1 has an invalid length. [ 786.730827][T32311] 8021q: adding VLAN 0 to HW filter on device bond9 [ 786.855865][T32316] bond9: entered promiscuous mode [ 786.891541][T32316] bond9: entered allmulticast mode [ 786.963046][T32319] macvlan2: entered promiscuous mode [ 786.990387][T32319] macvlan2: entered allmulticast mode [ 787.036308][T32319] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 787.420837][T32341] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11771'. [ 788.396564][T32368] netlink: 'syz.1.11783': attribute type 1 has an invalid length. [ 788.668073][T32381] netlink: 212 bytes leftover after parsing attributes in process `syz.4.11787'. [ 788.717970][T32368] 8021q: adding VLAN 0 to HW filter on device bond8 [ 788.764629][T32381] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11787'. [ 788.779726][T32381] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11787'. [ 788.829380][T32373] macvlan2: entered promiscuous mode [ 788.842314][T32373] macvlan2: entered allmulticast mode [ 788.853425][T32373] bond8: entered promiscuous mode [ 788.877801][T32373] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 788.913356][T32373] bond8: left promiscuous mode [ 789.915435][T32411] netlink: 212 bytes leftover after parsing attributes in process `syz.3.11799'. [ 790.002607][T32411] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11799'. [ 790.076302][T32411] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11799'. [ 790.434596][T32423] xt_hashlimit: size too large, truncated to 1048576 [ 791.590609][T32457] netlink: 212 bytes leftover after parsing attributes in process `syz.4.11816'. [ 791.639880][T32457] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11816'. [ 791.711408][T32457] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11816'. [ 791.788047][T32462] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11818'. [ 792.069600][T32466] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11819'. [ 792.930737][T32492] xt_hashlimit: size too large, truncated to 1048576 [ 793.590266][T32510] veth0: entered promiscuous mode [ 793.638406][T32509] veth0: left promiscuous mode [ 794.844980][T32537] xt_hashlimit: size too large, truncated to 1048576 [ 795.876221][T32567] netlink: 'syz.4.11855': attribute type 4 has an invalid length. [ 796.212544][T32581] xt_hashlimit: size too large, truncated to 1048576 [ 796.940455][T32597] netlink: 'syz.2.11865': attribute type 4 has an invalid length. [ 797.162533][T32603] xt_hashlimit: size too large, truncated to 1048576 [ 798.220746][T32630] netlink: 'syz.4.11877': attribute type 25 has an invalid length. [ 798.325858][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 798.620216][T32637] netlink: 'syz.2.11883': attribute type 15 has an invalid length. [ 799.234832][T32654] syzkaller0: entered promiscuous mode [ 799.251716][T32654] syzkaller0: entered allmulticast mode [ 799.924289][T32671] netlink: 'syz.0.11893': attribute type 25 has an invalid length. [ 801.984615][T32711] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11908'. [ 802.023810][T32716] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11910'. [ 802.075532][T32716] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11910'. [ 802.140671][T32716] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11910'. [ 802.171994][T32716] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11910'. [ 802.195394][T32718] netlink: 'syz.0.11911': attribute type 1 has an invalid length. [ 802.296721][T32718] 8021q: adding VLAN 0 to HW filter on device bond21 [ 802.322076][T32720] bond21: (slave gretap3): making interface the new active one [ 802.334489][T32720] bond21: (slave gretap3): Enslaving as an active interface with an up link [ 802.529720][T32725] netlink: 'syz.1.11914': attribute type 24 has an invalid length. [ 802.789697][T32730] netlink: 208 bytes leftover after parsing attributes in process `syz.3.11916'. [ 803.455988][ C1] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 806.655871][ T348] xt_hashlimit: size too large, truncated to 1048576 [ 807.235016][T18335] nci: nci_data_exchange_complete: no rx callback, dropping rx data... [ 807.671837][ T357] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 807.844866][ T391] netlink: 'syz.0.11950': attribute type 1 has an invalid length. [ 808.161066][ T391] 8021q: adding VLAN 0 to HW filter on device bond22 [ 808.191150][ T398] netlink: 'syz.2.11952': attribute type 1 has an invalid length. [ 808.244811][ T392] bond15: (slave veth0_to_bond): Releasing active interface [ 808.265246][ T392] bond15: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 808.358319][ T392] bond22: (slave veth0_to_bond): making interface the new active one [ 808.379137][ T392] bond22: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 808.394043][ T410] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11952'. [ 808.454164][ T390] macvlan3: entered promiscuous mode [ 808.478417][ T390] macvlan3: entered allmulticast mode [ 808.498472][ T390] bond22: entered promiscuous mode [ 808.517418][ T390] veth0_to_bond: entered promiscuous mode [ 808.534459][ T390] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 808.543051][ T390] bond22: (slave macvlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 808.564047][ T390] bond22: left promiscuous mode [ 808.588793][ T390] veth0_to_bond: left promiscuous mode [ 808.946543][ T406] veth13: entered promiscuous mode [ 810.533099][ T458] netlink: 'syz.2.11966': attribute type 1 has an invalid length. [ 810.683038][ T463] netlink: 'syz.4.11968': attribute type 1 has an invalid length. [ 810.782654][ T458] 8021q: adding VLAN 0 to HW filter on device bond9 [ 810.834769][ T461] bond6: (slave veth0_to_bond): Releasing active interface [ 810.842883][ T461] bond6: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 810.890272][ T473] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11968'. [ 810.900135][ T445] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 810.920319][ T461] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 811.057430][ T464] macvlan0: entered promiscuous mode [ 811.063518][ T464] macvlan0: entered allmulticast mode [ 811.073938][ T464] bond9: entered promiscuous mode [ 811.092789][ T464] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 811.102969][ T464] bond9: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 811.169271][ T464] bond9: left promiscuous mode [ 811.290573][ T469] veth7: entered promiscuous mode [ 811.589035][ T476] bridge0: entered promiscuous mode [ 811.644341][ T476] bridge0: entered allmulticast mode [ 811.795436][ T489] xt_hashlimit: size too large, truncated to 1048576 [ 813.002322][ T519] netlink: 'syz.4.11980': attribute type 1 has an invalid length. [ 815.585809][ T519] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 815.853232][ T527] netlink: 'syz.0.11982': attribute type 1 has an invalid length. [ 816.137765][ T535] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11982'. [ 816.279863][ T527] veth5: entered promiscuous mode [ 816.526739][ T551] netlink: 'syz.1.11989': attribute type 1 has an invalid length. [ 816.814279][ T551] bond9: entered promiscuous mode [ 816.837721][ T551] 8021q: adding VLAN 0 to HW filter on device bond9 [ 816.965495][ T554] bond9: (slave bridge10): making interface the new active one [ 817.014977][ T554] bridge10: entered promiscuous mode [ 817.038068][ T554] bond9: (slave bridge10): Enslaving as an active interface with an up link [ 817.097808][ T558] bond9: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 817.112914][ T558] bond9: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 819.266901][ T620] syzkaller0: entered allmulticast mode [ 819.353844][ T625] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 819.739268][ T636] bridge0: port 2(bridge_slave_1) entered blocking state [ 819.746554][ T636] bridge0: port 2(bridge_slave_1) entered forwarding state [ 819.754121][ T636] bridge0: port 1(bridge_slave_0) entered blocking state [ 819.761359][ T636] bridge0: port 1(bridge_slave_0) entered forwarding state [ 819.973400][ T636] 8021q: adding VLAN 0 to HW filter on device bond2 [ 820.039910][ T636] gretap0: entered promiscuous mode [ 820.069758][ T636] A link change request failed with some changes committed already. Interface pimreg may have been left with an inconsistent configuration, please check. [ 820.391569][ T652] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 821.084363][ T675] netlink: 'syz.0.12019': attribute type 16 has an invalid length. [ 821.124980][ T675] netlink: 'syz.0.12019': attribute type 17 has an invalid length. [ 821.154065][ T678] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12019'. [ 821.222865][ T654] syzkaller0: entered promiscuous mode [ 821.248502][ T654] syzkaller0: entered allmulticast mode [ 821.296388][T25698] Bluetooth: hci2: command 0x0406 tx timeout [ 821.727928][ T690] netlink: 'syz.4.12022': attribute type 4 has an invalid length. [ 821.788408][ T691] netlink: 'syz.4.12022': attribute type 4 has an invalid length. [ 823.927568][ C0] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 824.426762][ T675] tipc: Resetting bearer [ 824.432599][ T675] tipc: Resetting bearer [ 824.464494][ T675] ip6_vti0: left promiscuous mode [ 824.577876][ T675] 8021q: adding VLAN 0 to HW filter on device  [ 824.603313][ T675] bridge0: port 1(team0) entered blocking state [ 824.610538][ T675] bridge0: port 1(team0) entered forwarding state [ 824.618675][ T675] 8021q: adding VLAN 0 to HW filter on device team0 [ 824.633286][ T675] bridge0: port 1(team0) entered disabled state [ 824.665432][ T675] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 824.796016][ T675] macvlan0: left promiscuous mode [ 824.816305][ T675] tipc: Resetting bearer [ 824.868012][ T675] mac80211_hwsim hwsim11 wlan1: left allmulticast mode [ 824.875840][ T675] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 825.125120][ T699] tipc: Enabling of bearer rejected, failed to enable media [ 825.364492][ T713] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 825.381900][ T713] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 826.556580][ T730] tipc: Enabled bearer , priority 0 [ 826.684236][ T730] syzkaller0: entered promiscuous mode [ 826.694361][ T730] syzkaller0: entered allmulticast mode [ 826.701214][ T730] tipc: Resetting bearer [ 826.707869][ T735] bridge0: port 1(bridge_slave_0) entered listening state [ 826.795661][ T728] tipc: Resetting bearer [ 827.089701][ T743] xt_hashlimit: size too large, truncated to 1048576 [ 829.046557][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 830.942472][ T728] tipc: Disabling bearer [ 831.267417][ T804] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 831.609595][ T809] syzkaller0: entered promiscuous mode [ 831.633426][ T809] syzkaller0: entered allmulticast mode [ 831.653688][ T818] netlink: 'syz.0.12050': attribute type 13 has an invalid length. [ 831.665252][ T813] syzkaller0: entered promiscuous mode [ 831.671941][ T813] syzkaller0: entered allmulticast mode [ 831.682413][ T818] tipc: Resetting bearer [ 831.820616][ T818] tipc: Resetting bearer [ 831.945909][ T9871] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 832.065817][ T819] mac80211_hwsim hwsim11 syzkaller0: Caught tx_queue_len zero misconfig [ 832.166348][T17349] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 832.781535][ T839] netlink: 'syz.0.12056': attribute type 1 has an invalid length. [ 832.922784][ T846] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12056'. [ 833.041717][ T846] bond24 (unregistering): Released all slaves [ 833.283427][ T851] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 833.290779][ T851] IPv6: NLM_F_CREATE should be set when creating new route [ 833.582533][ T861] xt_hashlimit: size too large, truncated to 1048576 [ 834.429010][ T876] netlink: 'syz.4.12065': attribute type 13 has an invalid length. [ 837.555431][ T903] netlink: 'syz.0.12069': attribute type 1 has an invalid length. [ 837.693212][T30603] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 837.710532][ T877] mac80211_hwsim hwsim10 syzkaller0: Caught tx_queue_len zero misconfig [ 837.750275][ T890] syzkaller0: entered promiscuous mode [ 837.760421][ T890] syzkaller0: entered allmulticast mode [ 837.807991][ T899] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 837.977044][T30603] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 838.051492][ T908] veth7: entered promiscuous mode [ 838.061167][ T908] bond24: (slave veth7): Enslaving as a backup interface with a down link [ 838.077582][ T913] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12071'. [ 838.572126][ T919] syzkaller0: entered promiscuous mode [ 838.594965][ T919] syzkaller0: entered allmulticast mode [ 838.666229][ T926] xt_hashlimit: size too large, truncated to 1048576 [ 839.874350][ T959] netlink: 14 bytes leftover after parsing attributes in process `syz.3.12080'. [ 840.632021][ T987] netlink: 76 bytes leftover after parsing attributes in process `syz.3.12086'. [ 840.725384][ T993] syzkaller0: entered promiscuous mode [ 840.739950][ T993] syzkaller0: entered allmulticast mode [ 840.769888][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.778000][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.784873][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.791719][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.798554][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.805344][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.812171][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.819003][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.825831][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.832618][ T987] tc action pedit offset must be on 32 bit boundaries [ 840.839784][ T987] 0: reclassify loop, rule prio 0, protocol 800 [ 841.432737][ T1007] netlink: 'syz.1.12093': attribute type 1 has an invalid length. [ 841.578987][ T1007] 8021q: adding VLAN 0 to HW filter on device bond10 [ 841.814987][ T1009] veth3: entered allmulticast mode [ 841.875336][ T1009] bond10: (slave veth3): Enslaving as an active interface with a down link [ 842.028700][ T1007] bond10 (unregistering): (slave veth3): Releasing active interface [ 842.093402][ T1007] bond10 (unregistering): Released all slaves [ 842.352494][ T1017] syzkaller0: entered promiscuous mode [ 842.379071][ T1017] syzkaller0: entered allmulticast mode [ 842.491014][ T1040] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 842.906207][ T1050] nbd: couldn't find a device at index 2 [ 843.545197][ T1075] xt_hashlimit: size too large, truncated to 1048576 [ 843.670133][ T1083] syzkaller0: entered promiscuous mode [ 843.683090][ T1083] syzkaller0: entered allmulticast mode [ 844.033117][ T1089] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 844.059052][ T1089] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 844.754753][ T1107] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 844.811840][ T1107] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 844.874784][ T1111] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12122'. [ 844.894521][ T1113] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 845.551234][ T1131] netlink: 44 bytes leftover after parsing attributes in process `syz.3.12130'. [ 845.943389][ T1139] bond9: (slave veth0_to_bond): Releasing active interface [ 847.098742][ T1165] bond22: (slave veth0_to_bond): Releasing active interface [ 847.310012][ T1171] xt_hashlimit: size too large, truncated to 1048576 [ 848.540408][ T1207] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12162'. [ 848.561120][ T1207] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12162'. [ 849.000356][ T1216] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 849.008001][ T1216] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 849.261843][ T1219] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12168'. [ 849.544024][ T1228] syzkaller0: entered promiscuous mode [ 849.556223][ T1228] syzkaller0: entered allmulticast mode [ 849.991706][ T1239] ip6_tunnel: non-ECT from fe88:a43d:e1a4:0000:0000:0000:0000:7d01 with DS=0x2 [ 850.261717][ T1250] lo: Caught tx_queue_len zero misconfig [ 850.626080][ T1256] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.638725][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.944918][ T1264] netlink: 'syz.4.12188': attribute type 1 has an invalid length. [ 851.144640][ T1264] 8021q: adding VLAN 0 to HW filter on device bond8 [ 852.093232][ T3266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 852.330407][T30605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 853.541124][ T1380] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 854.280968][ T1406] netlink: 'syz.1.12231': attribute type 1 has an invalid length. [ 854.402829][ T1406] bond10: entered promiscuous mode [ 854.410697][ T1406] bond10: entered allmulticast mode [ 854.420464][ T1406] 8021q: adding VLAN 0 to HW filter on device bond10 [ 854.478912][ T1410] macvlan2: entered promiscuous mode [ 854.496814][ T1410] macvlan2: entered allmulticast mode [ 854.505765][ T1412] xt_hashlimit: size too large, truncated to 1048576 [ 854.523967][ T1410] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 854.840388][ T1420] syzkaller1: entered promiscuous mode [ 854.854618][ T1420] syzkaller1: entered allmulticast mode [ 854.996179][T27214] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 855.366128][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.446543][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807cf32400: rx timeout, send abort [ 855.458445][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff88807cf32400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 857.846880][ T382] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 857.857517][ T1422] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 858.066481][ T1457] netlink: 'syz.3.12247': attribute type 2 has an invalid length. [ 858.110143][ T1457] netlink: 'syz.3.12247': attribute type 2 has an invalid length. [ 858.184404][ T1466] netlink: 51 bytes leftover after parsing attributes in process `syz.0.12249'. [ 858.378155][ T1470] xt_hashlimit: size too large, truncated to 1048576 [ 858.406129][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.473611][ T1473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.503329][ T1476] sock: sock_set_timeout: `syz.3.12254' (pid 1476) tries to set negative timeout [ 858.588432][ T1477] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.648897][ T1485] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12257'. [ 858.704489][ T1485] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12257'. [ 858.773027][ T1473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.891119][ T1477] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.945473][ T1477] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.967987][ T1477] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 859.187218][ T1500] syzkaller1: entered promiscuous mode [ 859.192923][ T1500] syzkaller1: entered allmulticast mode [ 859.602033][ T1511] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12267'. [ 859.729202][ T1516] netlink: 'syz.3.12268': attribute type 1 has an invalid length. [ 859.880618][ T1516] 8021q: adding VLAN 0 to HW filter on device bond10 [ 860.190722][ T1535] xt_hashlimit: size too large, truncated to 1048576 [ 860.271263][ T1538] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12275'. [ 860.615318][ T1551] gretap1: entered promiscuous mode [ 860.692149][ T1555] net_ratelimit: 2 callbacks suppressed [ 860.692168][ T1555] Dead loop on virtual device ip6_vti0 (net 40), fix it urgently! [ 861.055493][ T1572] xt_hashlimit: size too large, truncated to 1048576 [ 861.446892][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 862.078496][ T1591] syzkaller0: entered promiscuous mode [ 862.104228][ T1591] syzkaller0: entered allmulticast mode [ 862.206427][ T1606] netlink: 'syz.4.12296': attribute type 1 has an invalid length. [ 862.313785][ T1606] 8021q: adding VLAN 0 to HW filter on device bond9 [ 863.608502][T27216] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 863.962403][ T1566] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 864.487035][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 865.381890][ T1662] xt_hashlimit: size too large, truncated to 1048576 [ 866.502876][ T1676] netlink: 44 bytes leftover after parsing attributes in process `syz.1.12308'. [ 866.763071][ T1681] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12311'. [ 867.030543][ T1686] syzkaller0: entered promiscuous mode [ 867.054715][ T1686] syzkaller0: entered allmulticast mode [ 867.526061][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 867.727981][ T1696] xt_hashlimit: size too large, truncated to 1048576 [ 867.920066][ T1701] syzkaller0: entered promiscuous mode [ 867.931066][ T1701] syzkaller0: entered allmulticast mode [ 868.326664][ T1713] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12320'. [ 868.610065][ T1717] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12322'. [ 868.692043][ T1719] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 869.369253][T18335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.052848][ T1688] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 870.443960][ T1735] syzkaller0: entered promiscuous mode [ 870.486309][ T1735] syzkaller0: entered allmulticast mode [ 870.543487][ T1735] netlink: 64 bytes leftover after parsing attributes in process `syz.2.12328'. [ 870.569960][ T1749] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12326'. [ 870.580991][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.889549][ T1760] syzkaller0: entered promiscuous mode [ 870.909373][ T1760] syzkaller0: entered allmulticast mode [ 870.969851][ T1765] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12334'. [ 871.128276][ T1769] netlink: 'syz.0.12335': attribute type 1 has an invalid length. [ 871.144875][ T1765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 871.214251][ T1774] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12335'. [ 871.242734][ T1769] bond25: entered promiscuous mode [ 871.250863][ T1769] 8021q: adding VLAN 0 to HW filter on device bond25 [ 871.260848][ T1774] bond25: entered allmulticast mode [ 871.511648][ T1769] bond25: (slave bridge13): making interface the new active one [ 871.561997][ T1769] bridge13: entered promiscuous mode [ 871.583221][ T1769] bridge13: entered allmulticast mode [ 871.624538][ T1769] bond25: (slave bridge13): Enslaving as an active interface with an up link [ 871.825945][ T1786] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 871.838441][ T1786] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 872.052189][ T1795] syzkaller0: entered promiscuous mode [ 872.077716][ T1795] syzkaller0: entered allmulticast mode [ 872.359361][ T1825] netlink: 'syz.4.12348': attribute type 1 has an invalid length. [ 872.380087][ T1826] netlink: 'syz.2.12349': attribute type 16 has an invalid length. [ 872.401909][ T1826] netlink: 'syz.2.12349': attribute type 17 has an invalid length. [ 872.432376][ T1828] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12349'. [ 873.610581][T30605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 874.487909][T18335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 874.792571][ T1810] syzkaller0: entered promiscuous mode [ 874.798626][ T1810] syzkaller0: entered allmulticast mode [ 874.826502][ T1825] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 874.849776][ T1826] gretap0: entered promiscuous mode [ 874.919460][ T1826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 874.933982][ T1826] 8021q: adding VLAN 0 to HW filter on device team0 [ 874.942696][ T1826] tipc: Resetting bearer [ 874.949432][ T1826] tipc: Resetting bearer [ 874.959066][ T1826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 875.002136][ T1826] veth1_to_bridge: left allmulticast mode [ 875.022192][ T1826] tipc: Resetting bearer [ 875.028429][ T1826] tipc: Resetting bearer [ 875.037994][ T1826] 0·: left allmulticast mode [ 875.042603][ T1826] hsr_slave_0: left allmulticast mode [ 875.048934][ T1826] hsr_slave_1: left allmulticast mode [ 875.058403][ T1826] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 875.491667][ T1851] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12353'. [ 876.647546][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 877.673452][T17347] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 877.681613][T17347] syz0: Port: 1 Link ACTIVE [ 877.688691][ T1843] wg1 speed is unknown, defaulting to 1000 [ 877.705690][ T1843] syz2: Port: 1 Link ACTIVE [ 877.713359][ T1851] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 877.733735][ T1853] team_slave_1: entered promiscuous mode [ 877.821915][ T1853] team0: Port device team_slave_1 removed [ 878.296934][ T1888] netlink: 'syz.3.12363': attribute type 13 has an invalid length. [ 878.448406][ T1894] netlink: 'syz.2.12364': attribute type 13 has an invalid length. [ 878.535978][ T36] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.575713][ T1052] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.584256][ T1894] tipc: Resetting bearer [ 878.603383][ T1894] tipc: Resetting bearer [ 878.616903][T27216] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.635753][ T36] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.653453][ T1894] tipc: Resetting bearer [ 878.666488][ T1052] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.707218][T28232] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.735859][T27214] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.797318][ T60] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.837495][ T1052] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.871477][ T60] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.927855][T18335] bond7: (slave ip6gretap0): link status up again after 0 ms [ 878.945630][ T36] bond7: (slave ip6gretap0): link status up again after 0 ms [ 879.025190][ T1897] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 879.045304][ T1897] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 879.480564][ T1921] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12371'. [ 879.782983][ T1927] netlink: 'syz.4.12377': attribute type 13 has an invalid length. [ 879.932902][ T1940] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12380'. [ 880.475150][ T1957] mac80211_hwsim hwsim10 syzkaller0: Caught tx_queue_len zero misconfig [ 880.790887][ T1971] netlink: 'syz.3.12393': attribute type 13 has an invalid length. [ 881.122410][ T1984] netlink: 'syz.2.12400': attribute type 1 has an invalid length. [ 881.180416][ T1984] bond10: (slave vxcan1): The slave device specified does not support setting the MAC address [ 881.192112][ T1984] bond10: (slave vxcan1): Error -95 calling set_mac_address [ 881.295481][ T1986] bond10: (slave bridge6): Enslaving as an active interface with a down link [ 881.317733][ T1988] team0: No ports can be present during mode change [ 881.487158][ T1994] syzkaller0: entered promiscuous mode [ 881.505977][ T1994] syzkaller0: entered allmulticast mode [ 881.879112][ T2006] tipc: New replicast peer: 224.0.0.1 [ 881.978800][ T2014] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12411'. [ 882.389450][ T2034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12419'. [ 882.540741][ T2037] tc action pedit 'at' offset -36994 out of bounds [ 882.837207][ T2042] syzkaller0: entered promiscuous mode [ 882.863048][ T2042] syzkaller0: entered allmulticast mode [ 885.290213][ C0] net_ratelimit: 44 callbacks suppressed [ 885.290228][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 885.377096][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 885.768057][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 886.306051][T28232] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 886.448802][ T1052] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 886.519189][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 886.597190][ T36] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 886.926727][ T1052] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 887.044686][ T2112] batman_adv: batadv0: Adding interface: dummy0 [ 887.071587][ T2112] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 887.097422][ T2112] batman_adv: batadv0: Interface activated: dummy0 [ 887.219317][ T2115] batadv0: mtu less than device minimum [ 887.265546][ T2115] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 887.330698][ T2130] netlink: 'syz.3.12451': attribute type 1 has an invalid length. [ 887.417370][ T2130] 8021q: adding VLAN 0 to HW filter on device bond11 [ 887.427399][ T2125] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 887.440778][ T2125] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 888.373871][ T2172] syzkaller0: entered promiscuous mode [ 888.381698][ T2172] syzkaller0: entered allmulticast mode [ 888.502613][ T2174] syzkaller0: entered promiscuous mode [ 888.508552][ T2174] syzkaller0: entered allmulticast mode [ 889.111277][ T2189] syzkaller0: entered promiscuous mode [ 889.131591][ T2189] syzkaller0: entered allmulticast mode [ 890.345906][ T1052] net_ratelimit: 43 callbacks suppressed [ 890.345941][ T1052] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 890.505849][T28232] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 890.595126][ T2143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 890.637542][ T36] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 890.829362][ T2206] netlink: 76 bytes leftover after parsing attributes in process `syz.4.12472'. [ 890.858944][ T2206] bridge0: port 3(veth1_to_hsr) entered blocking state [ 890.861595][ T2209] netlink: 'syz.0.12473': attribute type 1 has an invalid length. [ 890.866007][ T2206] bridge0: port 3(veth1_to_hsr) entered listening state [ 890.866381][ T2206] bridge0: port 2(bridge_slave_1) entered blocking state [ 890.888361][ T2206] bridge0: port 2(bridge_slave_1) entered listening state [ 890.895789][ T2206] bridge0: port 1(bridge_slave_0) entered blocking state [ 890.903081][ T2206] bridge0: port 1(bridge_slave_0) entered listening state [ 891.045813][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 891.108307][ T2209] 8021q: adding VLAN 0 to HW filter on device bond26 [ 891.123177][ T2221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12476'. [ 891.143236][T18335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 891.203112][ T2212] bond26: (slave geneve3): making interface the new active one [ 891.215022][ T2212] bond26: (slave geneve3): Enslaving as an active interface with an up link [ 891.236258][ T2216] syzkaller0: entered promiscuous mode [ 891.248173][ T2216] syzkaller0: entered allmulticast mode [ 891.335986][ T382] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 891.622110][ T2231] syzkaller0: entered promiscuous mode [ 891.634972][ T2231] syzkaller0: entered allmulticast mode [ 891.668470][T18336] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 891.686039][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 891.845793][T30603] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 891.855710][T18335] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 892.107099][ T2247] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 892.125658][ T2247] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 892.153681][ T2255] syzkaller0: entered promiscuous mode [ 892.160020][ T2255] syzkaller0: entered allmulticast mode [ 892.352778][ T2260] netlink: 'syz.4.12487': attribute type 13 has an invalid length. [ 892.465054][ T2263] mac80211_hwsim hwsim10 syzkaller0: Caught tx_queue_len zero misconfig [ 892.546626][ T2262] syzkaller0: entered promiscuous mode [ 892.552306][ T2262] syzkaller0: entered allmulticast mode [ 892.699781][ T2267] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 892.713815][ T2267] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 893.141585][ T2282] netlink: 212 bytes leftover after parsing attributes in process `syz.0.12493'. [ 893.180993][ T2282] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12493'. [ 893.206151][ T2282] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12493'. [ 893.220680][ T2280] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12493'. [ 893.416601][ T2286] netlink: 212 bytes leftover after parsing attributes in process `syz.0.12494'. [ 893.434504][ T2286] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12494'. [ 893.449529][ T2286] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12494'. [ 893.462306][ T2284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12494'. [ 893.989700][ T2302] syzkaller0: entered promiscuous mode [ 893.995205][ T2302] syzkaller0: entered allmulticast mode [ 894.086187][ T995] Bluetooth: hci4: command 0x0405 tx timeout [ 895.051741][ T2250] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 895.306067][ T2305] netlink: 'syz.0.12500': attribute type 1 has an invalid length. [ 895.359424][ T2308] xt_hashlimit: size too large, truncated to 1048576 [ 896.747821][ T2305] workqueue: Failed to create a rescuer kthread for wq "bond27": -EINTR [ 896.805798][ C1] net_ratelimit: 17 callbacks suppressed [ 896.805819][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.828345][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.836765][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.845183][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.853570][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.862077][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.870451][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.878835][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.887204][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.898300][T28232] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.920379][ T2319] veth9: entered promiscuous mode [ 896.932557][ T2323] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 896.955977][ T2323] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 897.151642][ T2342] __nla_validate_parse: 4 callbacks suppressed [ 897.151673][ T2342] netlink: 76 bytes leftover after parsing attributes in process `syz.3.12505'. [ 897.887368][ T2373] netlink: 'syz.4.12515': attribute type 13 has an invalid length. [ 897.948476][ T2378] xt_hashlimit: size too large, truncated to 1048576 [ 897.976287][ T2377] xt_hashlimit: size too large, truncated to 1048576 [ 898.404674][ T2394] veth17: entered promiscuous mode [ 898.718360][ T2399] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 898.769654][ T2399] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 898.804270][ T2401] netlink: 76 bytes leftover after parsing attributes in process `syz.3.12522'. [ 899.640260][ T2437] netlink: 'syz.0.12531': attribute type 13 has an invalid length. [ 899.695265][ T2437] tipc: Resetting bearer [ 899.948030][ T2437] tipc: Resetting bearer [ 900.099007][ T1843] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 900.244623][ T2440] mac80211_hwsim hwsim11 syzkaller0: Caught tx_queue_len zero misconfig [ 900.751412][ T2484] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12535'. [ 900.994900][ T2474] syzkaller0: entered promiscuous mode [ 901.001872][ T2474] syzkaller0: entered allmulticast mode [ 901.049703][T17347] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 901.098161][ T2502] netlink: 212 bytes leftover after parsing attributes in process `syz.4.12538'. [ 901.124802][ T2502] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12538'. [ 901.156194][ T2502] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12538'. [ 902.656453][T18337] net_ratelimit: 44 callbacks suppressed [ 902.656473][T18337] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 903.654905][ T2508] mac80211_hwsim hwsim10 syzkaller0: Caught tx_queue_len zero misconfig [ 903.716165][T27215] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 903.847301][T27215] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 904.006406][T30605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 904.125850][T18337] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 904.162401][ T2545] FAULT_INJECTION: forcing a failure. [ 904.162401][ T2545] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 904.177689][ T2545] CPU: 0 UID: 0 PID: 2545 Comm: syz.1.12547 Not tainted syzkaller #0 PREEMPT(full) [ 904.177713][ T2545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 904.177725][ T2545] Call Trace: [ 904.177732][ T2545] [ 904.177740][ T2545] dump_stack_lvl+0xe8/0x150 [ 904.177771][ T2545] should_fail_ex+0x412/0x560 [ 904.177985][ T2545] _copy_from_user+0x2d/0xb0 [ 904.178042][ T2545] __sys_bpf+0x229/0x950 [ 904.178075][ T2545] ? __pfx___sys_bpf+0x10/0x10 [ 904.178122][ T2545] ? ksys_write+0x242/0x270 [ 904.178162][ T2545] ? __pfx_ksys_write+0x10/0x10 [ 904.178195][ T2545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.178219][ T2545] __x64_sys_bpf+0x7c/0x90 [ 904.178247][ T2545] do_syscall_64+0x15f/0xf80 [ 904.178284][ T2545] ? trace_irq_disable+0x3b/0x140 [ 904.178313][ T2545] ? clear_bhb_loop+0x40/0x90 [ 904.178337][ T2545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.178357][ T2545] RIP: 0033:0x7fac96b9ce59 [ 904.178375][ T2545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 904.178392][ T2545] RSP: 002b:00007fac979dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 904.178412][ T2545] RAX: ffffffffffffffda RBX: 00007fac96e15fa0 RCX: 00007fac96b9ce59 [ 904.178426][ T2545] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 0000000000000000 [ 904.178438][ T2545] RBP: 00007fac979dd090 R08: 0000000000000000 R09: 0000000000000000 [ 904.178449][ T2545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 904.178460][ T2545] R13: 00007fac96e16038 R14: 00007fac96e15fa0 R15: 00007fff6d808348 [ 904.178491][ T2545] [ 904.406399][ T3266] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 904.515110][ T2549] netlink: 44 bytes leftover after parsing attributes in process `syz.0.12548'. [ 904.532533][ T60] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 904.619483][ T2553] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 904.691345][T18337] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 904.816528][ T134] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 904.959755][T27215] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 905.364928][ T2596] FAULT_INJECTION: forcing a failure. [ 905.364928][ T2596] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 905.407919][ T2596] CPU: 0 UID: 0 PID: 2596 Comm: syz.0.12556 Not tainted syzkaller #0 PREEMPT(full) [ 905.407949][ T2596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 905.407962][ T2596] Call Trace: [ 905.407971][ T2596] [ 905.407980][ T2596] dump_stack_lvl+0xe8/0x150 [ 905.408012][ T2596] should_fail_ex+0x412/0x560 [ 905.408046][ T2596] _copy_from_user+0x2d/0xb0 [ 905.408079][ T2596] ___sys_sendmsg+0x1c6/0x360 [ 905.408110][ T2596] ? __lock_acquire+0x6b5/0x2cf0 [ 905.408139][ T2596] ? __pfx____sys_sendmsg+0x10/0x10 [ 905.408216][ T2596] ? __fget_files+0x2a/0x420 [ 905.408271][ T2596] ? __fget_files+0x3a0/0x420 [ 905.408308][ T2596] __x64_sys_sendmsg+0x1bd/0x2a0 [ 905.408341][ T2596] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 905.408382][ T2596] ? __pfx_ksys_write+0x10/0x10 [ 905.408422][ T2596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.408445][ T2596] do_syscall_64+0x15f/0xf80 [ 905.408474][ T2596] ? trace_irq_disable+0x3b/0x140 [ 905.408503][ T2596] ? clear_bhb_loop+0x40/0x90 [ 905.408529][ T2596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.408549][ T2596] RIP: 0033:0x7f4e6779ce59 [ 905.408568][ T2596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 905.408587][ T2596] RSP: 002b:00007f4e685bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 905.408609][ T2596] RAX: ffffffffffffffda RBX: 00007f4e67a15fa0 RCX: 00007f4e6779ce59 [ 905.408624][ T2596] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006 [ 905.408638][ T2596] RBP: 00007f4e685bf090 R08: 0000000000000000 R09: 0000000000000000 [ 905.408650][ T2596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 905.408662][ T2596] R13: 00007f4e67a16038 R14: 00007f4e67a15fa0 R15: 00007ffc16f706f8 [ 905.408696][ T2596] [ 905.693824][ T2600] xt_hashlimit: size too large, truncated to 1048576 [ 905.846813][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 906.537146][ T2614] syzkaller0: entered promiscuous mode [ 906.542765][ T2614] syzkaller0: entered allmulticast mode [ 906.744440][ T2616] netlink: 44 bytes leftover after parsing attributes in process `syz.2.12560'. [ 906.922249][ T2619] netlink: 'syz.2.12561': attribute type 21 has an invalid length. [ 906.970852][ T2534] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 907.739469][ T3266] net_ratelimit: 23 callbacks suppressed [ 907.739488][ T3266] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 907.803267][ T2663] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12571'. [ 907.916489][ T60] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 908.046477][T18337] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 908.186570][ T36] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 908.279706][ T2690] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12579'. [ 908.322007][T18337] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 908.326347][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 908.407457][ T134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 908.458205][ T36] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 908.595931][T27216] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 908.720121][ T60] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 909.273403][ T2740] tipc: Enabled bearer , priority 0 [ 909.543304][ T2740] syzkaller0: entered promiscuous mode [ 909.554596][ T2740] syzkaller0: entered allmulticast mode [ 909.571659][ T2740] tipc: Resetting bearer [ 909.588418][ T2759] netlink: 'syz.0.12595': attribute type 13 has an invalid length. [ 909.611256][ T2759] tipc: Resetting bearer [ 909.706752][ T2759] tipc: Resetting bearer [ 909.786084][ T1843] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 909.863064][ T2771] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12597'. [ 909.863594][ T2761] mac80211_hwsim hwsim11 syzkaller0: Caught tx_queue_len zero misconfig [ 910.056685][ T2738] tipc: Resetting bearer [ 910.276529][T17347] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 912.459569][ T2738] tipc: Disabling bearer [ 912.816941][ T60] net_ratelimit: 10 callbacks suppressed [ 912.816961][ T60] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 912.998676][T27214] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.127721][T30605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.138455][T27214] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.163397][ T2813] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12603'. [ 913.267469][ T3266] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.393923][ T2828] ip6tnl0: Caught tx_queue_len zero misconfig [ 913.475722][ T134] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.530276][ T134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.596085][T27214] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.706560][T27216] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.835951][ T3266] bond7: (slave ip6gretap0): failed to get link speed/duplex [ 913.920481][ T2861] netlink: 'syz.3.12617': attribute type 1 has an invalid length. [ 914.004245][ T2874] netlink: 56 bytes leftover after parsing attributes in process `syz.2.12620'. [ 914.014657][ T2874] netlink: 48 bytes leftover after parsing attributes in process `syz.2.12620'. [ 914.071224][ T2861] bond12: entered promiscuous mode [ 914.119068][ T2861] 8021q: adding VLAN 0 to HW filter on device bond12 [ 914.308375][ T2888] FAULT_INJECTION: forcing a failure. [ 914.308375][ T2888] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 914.321881][ T2888] CPU: 0 UID: 0 PID: 2888 Comm: syz.4.12624 Not tainted syzkaller #0 PREEMPT(full) [ 914.321921][ T2888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 914.321940][ T2888] Call Trace: [ 914.321952][ T2888] [ 914.321965][ T2888] dump_stack_lvl+0xe8/0x150 [ 914.322007][ T2888] should_fail_ex+0x412/0x560 [ 914.322040][ T2888] _copy_from_iter+0x1d3/0x1670 [ 914.322071][ T2888] ? rcu_is_watching+0x15/0xb0 [ 914.322133][ T2888] ? __pfx__copy_from_iter+0x10/0x10 [ 914.322182][ T2888] ? netlink_sendmsg+0x650/0xb40 [ 914.322292][ T2888] ? skb_put+0x11b/0x210 [ 914.322350][ T2888] netlink_sendmsg+0x6c0/0xb40 [ 914.322384][ T2888] ? __pfx_netlink_sendmsg+0x10/0x10 [ 914.322414][ T2888] ? aa_sock_msg_perm+0xf1/0x1b0 [ 914.322444][ T2888] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 914.322474][ T2888] ____sys_sendmsg+0x972/0x9f0 [ 914.322499][ T2888] ? __might_fault+0xaf/0x130 [ 914.322548][ T2888] ? __pfx_____sys_sendmsg+0x10/0x10 [ 914.322588][ T2888] ? import_iovec+0x73/0xa0 [ 914.322623][ T2888] ___sys_sendmsg+0x2a5/0x360 [ 914.322651][ T2888] ? __lock_acquire+0x6b5/0x2cf0 [ 914.322677][ T2888] ? __pfx____sys_sendmsg+0x10/0x10 [ 914.322745][ T2888] ? __fget_files+0x2a/0x420 [ 914.322770][ T2888] ? __fget_files+0x3a0/0x420 [ 914.322806][ T2888] __x64_sys_sendmsg+0x1bd/0x2a0 [ 914.322839][ T2888] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 914.322879][ T2888] ? __pfx_ksys_write+0x10/0x10 [ 914.322919][ T2888] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 914.322943][ T2888] do_syscall_64+0x15f/0xf80 [ 914.322972][ T2888] ? trace_irq_disable+0x3b/0x140 [ 914.323016][ T2888] ? clear_bhb_loop+0x40/0x90 [ 914.323042][ T2888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 914.323064][ T2888] RIP: 0033:0x7ff96ab9ce59 [ 914.323083][ T2888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 914.323100][ T2888] RSP: 002b:00007ff96b9d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 914.323122][ T2888] RAX: ffffffffffffffda RBX: 00007ff96ae15fa0 RCX: 00007ff96ab9ce59 [ 914.323137][ T2888] RDX: 0000000000000030 RSI: 0000200000000140 RDI: 0000000000000005 [ 914.323150][ T2888] RBP: 00007ff96b9d4090 R08: 0000000000000000 R09: 0000000000000000 [ 914.323162][ T2888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 914.323175][ T2888] R13: 00007ff96ae16038 R14: 00007ff96ae15fa0 R15: 00007ffdf88d2568 [ 914.323209][ T2888] [ 915.112988][ T2906] netlink: 56 bytes leftover after parsing attributes in process `syz.2.12631'. [ 915.144377][ T2906] netlink: 48 bytes leftover after parsing attributes in process `syz.2.12631'. [ 915.253296][ T2909] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 915.320247][ T2911] FAULT_INJECTION: forcing a failure. [ 915.320247][ T2911] name failslab, interval 1, probability 0, space 0, times 0 [ 915.392243][ T2911] CPU: 1 UID: 0 PID: 2911 Comm: syz.0.12633 Not tainted syzkaller #0 PREEMPT(full) [ 915.392272][ T2911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 915.392285][ T2911] Call Trace: [ 915.392293][ T2911] [ 915.392302][ T2911] dump_stack_lvl+0xe8/0x150 [ 915.392333][ T2911] should_fail_ex+0x412/0x560 [ 915.392367][ T2911] should_failslab+0xa8/0x100 [ 915.392410][ T2911] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 915.392443][ T2911] ? device_rename+0xb3/0x210 [ 915.392574][ T2911] kstrdup+0x42/0x100 [ 915.392609][ T2911] device_rename+0xb3/0x210 [ 915.392640][ T2911] cfg802154_switch_netns+0x1ff/0x3d0 [ 915.392718][ T2911] nl802154_wpan_phy_netns+0x13e/0x3d0 [ 915.392752][ T2911] genl_family_rcv_msg_doit+0x22a/0x330 [ 915.392777][ T2911] ? __asan_memcpy+0x40/0x70 [ 915.392807][ T2911] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 915.392845][ T2911] ? bpf_lsm_capable+0x9/0x20 [ 915.392865][ T2911] ? security_capable+0x7e/0x2c0 [ 915.392962][ T2911] genl_rcv_msg+0x61c/0x7a0 [ 915.392992][ T2911] ? __pfx_genl_rcv_msg+0x10/0x10 [ 915.393012][ T2911] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 915.393037][ T2911] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 915.393065][ T2911] ? __pfx_nl802154_post_doit+0x10/0x10 [ 915.393108][ T2911] netlink_rcv_skb+0x232/0x4b0 [ 915.393138][ T2911] ? __pfx_genl_rcv_msg+0x10/0x10 [ 915.393162][ T2911] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 915.393209][ T2911] ? down_read+0x270/0x2e0 [ 915.393227][ T2911] ? genl_rcv+0xd/0x40 [ 915.393250][ T2911] genl_rcv+0x28/0x40 [ 915.393269][ T2911] netlink_unicast+0x75c/0x8e0 [ 915.393327][ T2911] netlink_sendmsg+0x813/0xb40 [ 915.393369][ T2911] ? __pfx_netlink_sendmsg+0x10/0x10 [ 915.393412][ T2911] ? aa_sock_msg_perm+0xf1/0x1b0 [ 915.393444][ T2911] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 915.393478][ T2911] ____sys_sendmsg+0x972/0x9f0 [ 915.393509][ T2911] ? __might_fault+0xaf/0x130 [ 915.393548][ T2911] ? __pfx_____sys_sendmsg+0x10/0x10 [ 915.393591][ T2911] ? import_iovec+0x73/0xa0 [ 915.393628][ T2911] ___sys_sendmsg+0x2a5/0x360 [ 915.393657][ T2911] ? __lock_acquire+0x6b5/0x2cf0 [ 915.393687][ T2911] ? __pfx____sys_sendmsg+0x10/0x10 [ 915.393763][ T2911] ? __fget_files+0x2a/0x420 [ 915.393790][ T2911] ? __fget_files+0x3a0/0x420 [ 915.393830][ T2911] __x64_sys_sendmsg+0x1bd/0x2a0 [ 915.393865][ T2911] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 915.393909][ T2911] ? __pfx_ksys_write+0x10/0x10 [ 915.393952][ T2911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.393976][ T2911] do_syscall_64+0x15f/0xf80 [ 915.394006][ T2911] ? trace_irq_disable+0x3b/0x140 [ 915.394038][ T2911] ? clear_bhb_loop+0x40/0x90 [ 915.394065][ T2911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.394087][ T2911] RIP: 0033:0x7f4e6779ce59 [ 915.394107][ T2911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 915.394126][ T2911] RSP: 002b:00007f4e685bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 915.394150][ T2911] RAX: ffffffffffffffda RBX: 00007f4e67a15fa0 RCX: 00007f4e6779ce59 [ 915.394166][ T2911] RDX: 0000000000004880 RSI: 00002000000005c0 RDI: 0000000000000004 [ 915.394180][ T2911] RBP: 00007f4e685bf090 R08: 0000000000000000 R09: 0000000000000000 [ 915.394193][ T2911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 915.394206][ T2911] R13: 00007f4e67a16038 R14: 00007f4e67a15fa0 R15: 00007ffc16f706f8 [ 915.394243][ T2911] [ 915.738326][ T2911] ------------[ cut here ]------------ [ 915.743937][ T2911] err [ 915.743962][ T2911] WARNING: net/ieee802154/core.c:258 at cfg802154_switch_netns+0x3c7/0x3d0, CPU#1: syz.0.12633/2911 [ 915.758084][ T2911] Modules linked in: [ 915.762339][ T2911] CPU: 1 UID: 0 PID: 2911 Comm: syz.0.12633 Not tainted syzkaller #0 PREEMPT(full) [ 915.772787][ T2911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 915.783260][ T2911] RIP: 0010:cfg802154_switch_netns+0x3c7/0x3d0 [ 915.790073][ T2911] Code: e1 07 38 c1 7c 8d 4c 89 e7 e8 85 7b d4 f6 eb 83 e8 9e 40 69 f6 e9 62 fe ff ff e8 94 40 69 f6 e9 58 fe ff ff e8 8a 40 69 f6 90 <0f> 0b 90 e9 4a fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 915.809832][ T2911] RSP: 0018:ffffc9000307f3c0 EFLAGS: 00010293 [ 915.816793][ T2911] RAX: ffffffff8b5c7ee6 RBX: 00000000fffffff4 RCX: ffff888030299ec0 [ 915.824828][ T2911] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 915.832892][ T2911] RBP: 0000000000000000 R08: ffff8880296341d3 R09: 1ffff110052c683a [ 915.840938][ T2911] R10: dffffc0000000000 R11: ffffed10052c683b R12: ffff888029634198 [ 915.849592][ T2911] R13: 1ffff9200060fe90 R14: dffffc0000000000 R15: ffff88807cb9cd80 [ 915.857675][ T2911] FS: 00007f4e685bf6c0(0000) GS:ffff88812538d000(0000) knlGS:0000000000000000 [ 915.867024][ T2911] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 915.873632][ T2911] CR2: 00005555701c9a38 CR3: 00000000a5330000 CR4: 00000000003526f0 [ 915.882305][ T2911] Call Trace: [ 915.885828][ T2911] [ 915.888797][ T2911] nl802154_wpan_phy_netns+0x13e/0x3d0 [ 915.894304][ T2911] genl_family_rcv_msg_doit+0x22a/0x330 [ 915.899977][ T2911] ? __asan_memcpy+0x40/0x70 [ 915.905018][ T2911] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 915.911758][ T2911] ? bpf_lsm_capable+0x9/0x20 [ 915.916529][ T2911] ? security_capable+0x7e/0x2c0 [ 915.921522][ T2911] genl_rcv_msg+0x61c/0x7a0 [ 915.926140][ T2911] ? __pfx_genl_rcv_msg+0x10/0x10 [ 915.931200][ T2911] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 915.937307][ T2911] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 915.943326][ T2911] ? __pfx_nl802154_post_doit+0x10/0x10 [ 915.949006][ T2911] netlink_rcv_skb+0x232/0x4b0 [ 915.953813][ T2911] ? __pfx_genl_rcv_msg+0x10/0x10 [ 915.958944][ T2911] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 915.964283][ T2911] ? down_read+0x270/0x2e0 [ 915.969322][ T2911] ? genl_rcv+0xd/0x40 [ 915.973454][ T2911] genl_rcv+0x28/0x40 [ 915.977556][ T2911] netlink_unicast+0x75c/0x8e0 [ 915.982401][ T2911] netlink_sendmsg+0x813/0xb40 [ 915.987263][ T2911] ? __pfx_netlink_sendmsg+0x10/0x10 [ 915.992603][ T2911] ? aa_sock_msg_perm+0xf1/0x1b0 [ 915.998195][ T2911] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 916.003529][ T2911] ____sys_sendmsg+0x972/0x9f0 [ 916.008579][ T2911] ? __might_fault+0xaf/0x130 [ 916.013302][ T2911] ? __pfx_____sys_sendmsg+0x10/0x10 [ 916.018720][ T2911] ? import_iovec+0x73/0xa0 [ 916.023275][ T2911] ___sys_sendmsg+0x2a5/0x360 [ 916.028680][ T2911] ? __lock_acquire+0x6b5/0x2cf0 [ 916.033663][ T2911] ? __pfx____sys_sendmsg+0x10/0x10 [ 916.039008][ T2911] ? __fget_files+0x2a/0x420 [ 916.043649][ T2911] ? __fget_files+0x3a0/0x420 [ 916.048411][ T2911] __x64_sys_sendmsg+0x1bd/0x2a0 [ 916.053398][ T2911] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 916.059546][ T2911] ? __pfx_ksys_write+0x10/0x10 [ 916.064474][ T2911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.070663][ T2911] do_syscall_64+0x15f/0xf80 [ 916.075291][ T2911] ? trace_irq_disable+0x3b/0x140 [ 916.080412][ T2911] ? clear_bhb_loop+0x40/0x90 [ 916.085130][ T2911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.092683][ T2911] RIP: 0033:0x7f4e6779ce59 [ 916.097209][ T2911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 916.117456][ T2911] RSP: 002b:00007f4e685bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 916.126074][ T2911] RAX: ffffffffffffffda RBX: 00007f4e67a15fa0 RCX: 00007f4e6779ce59 [ 916.134088][ T2911] RDX: 0000000000004880 RSI: 00002000000005c0 RDI: 0000000000000004 [ 916.142152][ T2911] RBP: 00007f4e685bf090 R08: 0000000000000000 R09: 0000000000000000 [ 916.150816][ T2911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 916.158951][ T2911] R13: 00007f4e67a16038 R14: 00007f4e67a15fa0 R15: 00007ffc16f706f8 [ 916.167982][ T2911] [ 916.171065][ T2911] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 916.178363][ T2911] CPU: 1 UID: 0 PID: 2911 Comm: syz.0.12633 Not tainted syzkaller #0 PREEMPT(full) [ 916.187794][ T2911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 916.197872][ T2911] Call Trace: [ 916.201167][ T2911] [ 916.204139][ T2911] vpanic+0x56c/0xa60 [ 916.208193][ T2911] ? __pfx__printk+0x10/0x10 [ 916.212817][ T2911] ? __pfx_vpanic+0x10/0x10 [ 916.217352][ T2911] ? is_bpf_text_address+0x292/0x2b0 [ 916.222663][ T2911] ? is_bpf_text_address+0x26/0x2b0 [ 916.227892][ T2911] panic+0xc5/0xd0 [ 916.231638][ T2911] ? __pfx_panic+0x10/0x10 [ 916.236096][ T2911] __warn+0x315/0x4c0 [ 916.240101][ T2911] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 916.245692][ T2911] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 916.251276][ T2911] __report_bug+0x29a/0x540 [ 916.255913][ T2911] ? irqentry_exit+0x218/0x730 [ 916.260717][ T2911] ? trace_irq_disable+0x3b/0x140 [ 916.265803][ T2911] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 916.271374][ T2911] ? __pfx___report_bug+0x10/0x10 [ 916.276445][ T2911] ? dump_stack_lvl+0x135/0x150 [ 916.281338][ T2911] ? dump_stack_lvl+0x137/0x150 [ 916.286229][ T2911] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 916.291793][ T2911] report_bug+0x16a/0x220 [ 916.296140][ T2911] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 916.301708][ T2911] ? cfg802154_switch_netns+0x3c9/0x3d0 [ 916.307281][ T2911] handle_bug+0x9c/0x200 [ 916.311539][ T2911] exc_invalid_op+0x1a/0x50 [ 916.316049][ T2911] asm_exc_invalid_op+0x1a/0x20 [ 916.320904][ T2911] RIP: 0010:cfg802154_switch_netns+0x3c7/0x3d0 [ 916.327066][ T2911] Code: e1 07 38 c1 7c 8d 4c 89 e7 e8 85 7b d4 f6 eb 83 e8 9e 40 69 f6 e9 62 fe ff ff e8 94 40 69 f6 e9 58 fe ff ff e8 8a 40 69 f6 90 <0f> 0b 90 e9 4a fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 916.346684][ T2911] RSP: 0018:ffffc9000307f3c0 EFLAGS: 00010293 [ 916.352783][ T2911] RAX: ffffffff8b5c7ee6 RBX: 00000000fffffff4 RCX: ffff888030299ec0 [ 916.360766][ T2911] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 916.368755][ T2911] RBP: 0000000000000000 R08: ffff8880296341d3 R09: 1ffff110052c683a [ 916.376743][ T2911] R10: dffffc0000000000 R11: ffffed10052c683b R12: ffff888029634198 [ 916.384724][ T2911] R13: 1ffff9200060fe90 R14: dffffc0000000000 R15: ffff88807cb9cd80 [ 916.392710][ T2911] ? cfg802154_switch_netns+0x3c6/0x3d0 [ 916.398285][ T2911] nl802154_wpan_phy_netns+0x13e/0x3d0 [ 916.403796][ T2911] genl_family_rcv_msg_doit+0x22a/0x330 [ 916.409363][ T2911] ? __asan_memcpy+0x40/0x70 [ 916.413964][ T2911] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 916.420060][ T2911] ? bpf_lsm_capable+0x9/0x20 [ 916.424753][ T2911] ? security_capable+0x7e/0x2c0 [ 916.429706][ T2911] genl_rcv_msg+0x61c/0x7a0 [ 916.434224][ T2911] ? __pfx_genl_rcv_msg+0x10/0x10 [ 916.439261][ T2911] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 916.444738][ T2911] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 916.450733][ T2911] ? __pfx_nl802154_post_doit+0x10/0x10 [ 916.456308][ T2911] netlink_rcv_skb+0x232/0x4b0 [ 916.461103][ T2911] ? __pfx_genl_rcv_msg+0x10/0x10 [ 916.466136][ T2911] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 916.471457][ T2911] ? down_read+0x270/0x2e0 [ 916.475889][ T2911] ? genl_rcv+0xd/0x40 [ 916.479972][ T2911] genl_rcv+0x28/0x40 [ 916.483962][ T2911] netlink_unicast+0x75c/0x8e0 [ 916.488748][ T2911] netlink_sendmsg+0x813/0xb40 [ 916.493557][ T2911] ? __pfx_netlink_sendmsg+0x10/0x10 [ 916.498861][ T2911] ? aa_sock_msg_perm+0xf1/0x1b0 [ 916.503817][ T2911] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 916.509129][ T2911] ____sys_sendmsg+0x972/0x9f0 [ 916.513906][ T2911] ? __might_fault+0xaf/0x130 [ 916.518600][ T2911] ? __pfx_____sys_sendmsg+0x10/0x10 [ 916.523908][ T2911] ? import_iovec+0x73/0xa0 [ 916.528425][ T2911] ___sys_sendmsg+0x2a5/0x360 [ 916.533118][ T2911] ? __lock_acquire+0x6b5/0x2cf0 [ 916.538072][ T2911] ? __pfx____sys_sendmsg+0x10/0x10 [ 916.543319][ T2911] ? __fget_files+0x2a/0x420 [ 916.547929][ T2911] ? __fget_files+0x3a0/0x420 [ 916.552625][ T2911] __x64_sys_sendmsg+0x1bd/0x2a0 [ 916.557584][ T2911] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 916.563083][ T2911] ? __pfx_ksys_write+0x10/0x10 [ 916.567957][ T2911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.574037][ T2911] do_syscall_64+0x15f/0xf80 [ 916.578640][ T2911] ? trace_irq_disable+0x3b/0x140 [ 916.583688][ T2911] ? clear_bhb_loop+0x40/0x90 [ 916.588409][ T2911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.594307][ T2911] RIP: 0033:0x7f4e6779ce59 [ 916.598752][ T2911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 916.618374][ T2911] RSP: 002b:00007f4e685bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 916.626803][ T2911] RAX: ffffffffffffffda RBX: 00007f4e67a15fa0 RCX: 00007f4e6779ce59 [ 916.634786][ T2911] RDX: 0000000000004880 RSI: 00002000000005c0 RDI: 0000000000000004 [ 916.642766][ T2911] RBP: 00007f4e685bf090 R08: 0000000000000000 R09: 0000000000000000 [ 916.650749][ T2911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 916.658729][ T2911] R13: 00007f4e67a16038 R14: 00007f4e67a15fa0 R15: 00007ffc16f706f8 [ 916.666728][ T2911] [ 916.670697][ T2911] Kernel Offset: disabled [ 916.675027][ T2911] Rebooting in 86400 seconds..