last executing test programs: 1m6.155491819s ago: executing program 3 (id=1176): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r1, 0x0, 0x8000, 0x2) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r7, @ANYBLOB="0c000280060001"], 0x24}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_DAEMON(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x18, r4, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4004041}, 0x40080) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r9, 0x84, 0x77, 0x0, &(0x7f0000000040)) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x7c, r4, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_AF={0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010100}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfa4}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1a}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000801}, 0xc040) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r10, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffd7b, 0x0}}, 0x10) pipe(&(0x7f0000000280)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000600)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r11}}, @map_val={0x18, 0x4, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0xaa56}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_fd={0x18, 0xb, 0x1, 0x0, r3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @map_idx={0x18, 0x5, 0x5, 0x0, 0xc}], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x0, 0x2}, 0x366, 0x10, &(0x7f0000000000), 0x2b2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x8c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r13, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x28, 0x0, 0x0, 0xfff7f038}, {0x6}]}, 0x10) sendmmsg$unix(r12, &(0x7f0000000c00)=[{{&(0x7f0000000780)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000140)=[{&(0x7f0000000800)="39b0e52f", 0xb039}], 0x1, 0x0, 0x0, 0x4000801}}], 0x1, 0x4002104) 1m5.768130046s ago: executing program 3 (id=1182): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)={{0x14}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x141}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x5}]}], {0x14, 0x10}}, 0x80}, 0x1, 0x0, 0x0, 0x4004}, 0x8000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf5}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040050) 53.071328612s ago: executing program 3 (id=1182): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)={{0x14}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x141}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x5}]}], {0x14, 0x10}}, 0x80}, 0x1, 0x0, 0x0, 0x4004}, 0x8000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf5}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040050) 40.630755604s ago: executing program 3 (id=1182): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)={{0x14}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x141}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x5}]}], {0x14, 0x10}}, 0x80}, 0x1, 0x0, 0x0, 0x4004}, 0x8000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf5}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040050) 28.187838425s ago: executing program 3 (id=1182): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)={{0x14}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x141}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x5}]}], {0x14, 0x10}}, 0x80}, 0x1, 0x0, 0x0, 0x4004}, 0x8000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf5}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040050) 11.88422981s ago: executing program 3 (id=1182): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)={{0x14}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x141}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x5}]}], {0x14, 0x10}}, 0x80}, 0x1, 0x0, 0x0, 0x4004}, 0x8000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf5}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040050) 4.040468539s ago: executing program 1 (id=1655): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) listen(r1, 0x0) listen(r1, 0x9ce2) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000080)={r0, 0xe, 0x1eba, 0xe000000000000000}) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000000c0)={'bridge_slave_0\x00', @random="f03e3f683a71"}) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000021401002abd700001dcdf25080009"], 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) 3.94353046s ago: executing program 2 (id=1656): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000a3773c39361a4e82055400100001040000", @ANYRES32=0x0, @ANYBLOB="03000000000000003000128008000100736974002400028008000100", @ANYRES32=0x0, @ANYBLOB="08000200ac14144005000900890000000600080017000000"], 0x50}}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000003000000000000000200001302000000010000000000000000000000fdffffff0000000000000000002e0085539bc5083648620da1056cafaf845299e57dbc5814ec71416cdea0bca03b1e29603626b95ad665e64b4a8ed64e4ff3593c69d003c06f7e211c898fcc8f6b37c19f719c2f3a0bf3d54fe2b24c0ba02ceac06e80a50f7365d54fade060b45bac271661c6ebc764ea97edbe64e7f6682582002565032be7e03ef96e474fe2eb0c626fd1ea7af4d855e62d871bd55a82e9e28050e72adc423e246bd5c48a0e51330a1f06da4103fe05fd00"/245], 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x4001, 0x0, 0x0, 0x9}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=@ipv6_getaddr={0x18, 0x16, 0x1, 0x70bd27, 0x25dfdbfc, {0xa, 0x0, 0x40}}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) accept4$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000180)=0x1c, 0x100000) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000080)=0xe8) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x4000, r2}, 0x18) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r5, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r7}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) r11 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000220c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="0000002100000000050000000000000095c333d4c0a3ecdd69086b8e4c36439a8808b90ea579cdf8bd475a470064827701f4169ebebecb5bba94f06f020fb64e5594a86f5f00000000000008c7533dc98a94008d7d2a7d2c23bc3f4cc1992aebd29fd21e95b3c7c49de340c24cb6ba1a33740825c424ecd87a3b02ae7840be900964b6948074a8f2ed867fd6601b0ca02215f4c2a5157135575fa1903abe92246853cb7cb868a3b2524a92bfa8aaeaf3ff3f08fb97ec0c126bfea903ef567bdf48aecb23342c8102732b7257f65b1f7d82adec836fd77d2f5c6e6c18ae428531d9e4d906b0a19827bffab9ced1e24e8f063d44fb76dd59e75486"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2d) r12 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r12, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000003c00)=ANY=[@ANYBLOB="e00000001000090500c63703b60000000000d00008004300ff030000a90000002b0e13e735a3184f123d6da2f1acfac0ee2dd2b184b27d08000000337c000400bf852c8986626691b01b5f44e4ce28715f2d"], 0xe0}], 0x1}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)={@ifindex, r11, 0x11, 0x0, 0x0, @void, @value=r10}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x8, 0x9, 0xff, 0x10800, r4, 0x0, '\x00', r7, r10, 0x2, 0x4, 0x2, 0x5, @void, @value, @value=r1}, 0x50) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@loopback, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e21, 0x2, 0x4e23, 0x6, 0xa, 0x20, 0x0, 0x32, 0x0, r3}, {0x1ff, 0xa, 0x3ff, 0x0, 0xfffffffffffffffa, 0x80000000, 0x2a6, 0xffffffff00000000}, {0x4b, 0x8, 0xffffffff851f9688, 0xfff}, 0x3, 0x6e6bb5, 0x2, 0x0, 0x2, 0x2}, {{@in6=@loopback, 0x4d6, 0x6c}, 0x8, @in6=@private0, 0x3503, 0x1, 0x0, 0x4, 0x77, 0x7ff, 0x81}}, 0xe8) 3.885007919s ago: executing program 1 (id=1657): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_WPAN_PHY(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="100028bd7000fcdbdf250100000008000100000000000c00060003000000030000000c00060000000000000000000c0006000300000003000000080003009c2955342455eb90d836f5f703f4631b90de83232ff1d97346549bed5783211d0900000000000000c7926bb2c243ca7790efb118ae7669931e6607be0a70164c3a40516a5a7d3c0de5d17a2d6d43d184d12e05660a6a627c41030904e0079ba74f1d0dfe5515a97a154fad7894474f8fb4ad6d9c627c3713dcaa50124064c212588ff6efca989e2087ba22b8c5c177da5748edf8471f7929142aaea2e364c61a17ef89921c43b086eaf880e50e6ee6997a97e8db97297c00"/259, @ANYRES32=r3, @ANYBLOB="0c00060003000000030000000800010002000000"], 0x5c}, 0x1, 0x0, 0x0, 0x200400c0}, 0x80) openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r4 = socket$inet6(0xa, 0x6, 0x5) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r4, 0x8982, &(0x7f0000000000)) r5 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=r6, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c000280080007003b070000"], 0x4c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x8, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x20000010) close(r7) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 3.63937328s ago: executing program 1 (id=1659): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x4055131, 0xffffffffffffffff, 0x4000) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0a000000000000d420518e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000500"/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0f00000004000000080000000800000000000000", @ANYRES32=r0, @ANYBLOB='\x00'/25, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200"/28], 0x50) r1 = socket$igmp6(0xa, 0x3, 0x2) ioctl$F2FS_IOC_COMPRESS_FILE(r1, 0xf518, 0x0) r2 = socket(0x2b, 0x1, 0x1) openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x84, &(0x7f0000000000)={r5, @in={{0x2, 0x0, @empty}}}, 0x90) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x21}}, 0x1c) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="480000000209010800000000000000000a000001080005400000001a0c000480080001001d0000050c00048008000140000007390c00048008000140000000090800054000000000"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000400), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r6, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r7}, @FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x2) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) bind$rds(r8, &(0x7f0000000700)={0x2, 0x4e20, @loopback}, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r11 = socket(0x0, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r10, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5", @ANYRESHEX=r3, @ANYBLOB='L'], 0x44}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r10, {}, {}, {0xfff3}}}, 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000001000000009700000100000085000000b48000009500000000b1b19f"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r12 = socket$pppl2tp(0x18, 0x1, 0x1) r13 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r12, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r13, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r14 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='memory.events\x00', 0x0, 0x0) openat$cgroup_devices(r14, &(0x7f0000000140)='devices.allow\x00', 0x2, 0x0) 3.636768675s ago: executing program 2 (id=1660): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) r3 = socket(0x22, 0x2, 0x3) recvmmsg(r3, &(0x7f0000003a80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2062, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c00000010000100"/20, @ANYRES32=r2, @ANYBLOB="00000000000000002c0012800b00010065727370616e00001c000280050016000000000006000f000000000006000e0040"], 0x4c}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000180001000000000000000000020000000000000900000000060015000a0000000c001680080002007f00"], 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000c80)=[@in6={0xa, 0x4e23, 0xfc, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8a1}], 0x1c) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r6, 0x0, 0xd}, 0x18) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg$sock(r7, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) shutdown(r7, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40600000000000073113900f60000008510000002000000b7000000000000009500c200000000009500001200000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x3) ioctl$int_in(r8, 0x5452, &(0x7f0000000000)=0xf4e) writev(r8, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=@framed={{}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r9}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r10}, 0x10) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f0000000b40)=@raw={'raw\x00', 0x3c1, 0x3, 0x520, 0x0, 0x9403, 0x0, 0x340, 0x2c0, 0x450, 0x3d8, 0x3d8, 0x450, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x0, 'syz0\x00'}}, @common=@inet=@hashlimit3={{0x158}, {'syz_tun\x00', {0xffffffffffffffff, 0x7, 0xa, 0x0, 0x0, 0x1, 0x6}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x580) poll(&(0x7f0000002100)=[{r8, 0x400}], 0x1, 0xe) getsockopt$bt_BT_SNDMTU(r8, 0x112, 0xc, &(0x7f00000001c0)=0x300, &(0x7f0000000200)=0x2) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="20002abd7000ffdbdf25100000000c000300060027004e24000b0800060008000000"], 0x28}, 0x1, 0x0, 0x0, 0x4002881}, 0x20040044) 3.277727701s ago: executing program 2 (id=1663): r0 = socket$igmp(0x2, 0x3, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7c, 0x7c, 0x2, [@var, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}, @func, @volatile, @volatile, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x96, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) (async) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180000002000000000000000000000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a00)={r2, 0xd8, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001000), 0x8, 0x0, 0x8, 0x0, 0x0}}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}}, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x2, [@restrict, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x0, 0x3}]}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}]}}, &(0x7f0000001b80)=""/4090, 0x46, 0xffa, 0xa, 0x0, 0x0, @void, @value}, 0x20) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r5) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYBLOB='4\x00', @ANYRES16=r6, @ANYBLOB="0b06000000000000000030000000050036000000000008000200", @ANYRES32=r7, @ANYBLOB="05003500040000000500330009000000"], 0x34}}, 0x4004844) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r11, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c0001800500020000000000080004000500000008000100030000"], 0x7c}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r8, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000c40)=ANY=[@ANYBLOB="f8010000", @ANYRES16=r10, @ANYBLOB="08002dbd7000fedbdf251800000008000300", @ANYRES32=0x0, @ANYBLOB="0c000600030000000300000008001393b3e1015efbff", @ANYRES32=r12, @ANYBLOB="700030802400030038bb26aa30d0f4a9332017ea5f2a74d4c0342ec39b2dba68cf3a73fd5ec1090b05000200020000002400030022c4d48b8d8b9dd789c6d8ce0b6b35dc1c270195f8b2c23c4e8e15ce7ecc7393140004001b295bd91d00a67e5adce53a632907a505000200a0000000a0003080140004007016feef322a291f8c5096bc901b16211400018005000200030000000800010002000000100001800c0005000f0000000000000014000400a636fe680e2d436f66803e64f8a83645050002000600000024000300548b5a08b09b61152fd6833269714df001af7cd02343fe04aafbc975c8fd526724000300019f6b80baf7a8c192df5a7e61ed6b4a2a4c050b29bbd7df288e78f7a836adaeac0030804c0001800800040006000000080004000500000005000200030000000c00050005000000000000000c000380080002000100000005000200000000000800010001000000050002000000000024000300e7d588b51735ea3dc11f9625f652adf79fbe0fdaf27b475acc65ff8b8b628298240003002e638283a3a84829b682849ed508653c18c96724e574830fb99ade856967c3db14000400fafacf79de66cedad526275240b494c50c0006000300000003000000"], 0x1f8}, 0x1, 0x0, 0x0, 0x4844}, 0x44024) (async) r13 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r13, 0x89e3, &(0x7f0000000000)={0x58, 0x800, 0xb, 0x9, 0x8000, 0x11}) (async) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000040)=0xc, 0x4) 3.02216089s ago: executing program 2 (id=1665): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000440)="d800000018008106bc65f782db44b904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014001000000036010fab94dcf5c04e04bcb726f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x4004010) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@gettfilter={0x24, 0x2e, 0x1, 0x5, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xd, 0xc}, {}, {0xa, 0x8}}}, 0x24}}, 0x404c080) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) epoll_pwait(r2, 0x0, 0x0, 0x10001, &(0x7f0000000180)={[0xffffffffe277652b]}, 0x8) 2.673315511s ago: executing program 2 (id=1666): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@security={'security\x00', 0x44, 0x4, 0x478, 0xffffffff, 0x2f8, 0x228, 0x228, 0xffffffff, 0xffffffff, 0x470, 0x470, 0x470, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x203, 0xa8, 0x1d0, 0x8502}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:initctl_t:s0\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x11}}, @common=@unspec=@NFQUEUE2={0x28}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, [0xff, 0xffffffff, 0xff000000, 0xff000000], 0x0, 0x4e21, 0x0, 0x4e23, 0x0, 0x8000}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d8) socketpair(0x2a, 0x2, 0x4, &(0x7f0000000500)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000580), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCBRDELBR(r5, 0x89a3, &(0x7f0000000200)='veth1_to_hsr\x00') r6 = socket(0x26, 0x3, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) getsockopt$EBT_SO_GET_ENTRIES(r6, 0x0, 0x81, 0x0, &(0x7f0000000500)) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r8, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r8, 0x4030582a, &(0x7f0000000380)={0x0, 0x0, 0x10, 0x80000000}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00'}, 0x10) ioctl$SIOCSIFHWADDR(r7, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000a00"}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000940)={0xe4, r9, 0x800, 0xffffffff, 0xfffffffd, {{0x7e}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffffb}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xa8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0xffff}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x14}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x179}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xa}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x25a}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x1}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1e}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x1}]}, 0xe4}}, 0x4000054) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000900)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000008c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="53020000", @ANYRES16=r2, @ANYBLOB="000427bd7000fddbdf2501000000060006004e24000008000500000000000800050000000000140002007767320000000000000000000000000008000700090000000800070004000000080007000400000008000500010000006c0208801400008008000a0001000000060005000600000054020080480209801c00008006000100020000000800020000000000050003000100000094000080060001000a00000014000200ff0100000000000000000000000000010500030002000000060001000a00000014000200000000000000000000000000000000010500030003000000060001000a00000014000200fe8800000000000000000000000001010500030003000000060001000a00000014000200ff0200000000000000000000000000010500030000000000d0000080060001000200000008000200ac1414aa0500030002000000060001000a0000001400020000000000000000000000ffff0a01010005000300030000000600010002000000080002000a0101010500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200000000000000000000000000000000000500030003000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030003000000c4000080060001000a00000014000200fe8000000000000000000000000000310500030001000000060001000200000008000200ac14143f0500030003000000060001000a000000140002002001000000000000000000000000000205000300000000000600010002000000080002007f0000010500030003000000060001000a00000014000200fe8800000000000000000000000000010500030003000000060001000a000000140002002001000000000000000000000000000105000300010000000800030000000000060006004e2100"], 0x2d4}, 0x1, 0x0, 0x0, 0x891}, 0x41) socket$nl_netfilter(0x10, 0x3, 0xc) 2.450731364s ago: executing program 0 (id=1668): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller1\x00'}) socket(0x10, 0x80002, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) sendmsg$nl_route(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRESDEC=0x0, @ANYRESHEX=r1], 0x44}}, 0x40040c6) socket$inet6(0xa, 0x6, 0x3ff) 2.127004929s ago: executing program 0 (id=1669): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) sendto$inet6(r0, &(0x7f0000000800)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20d4774d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5207cc9bb8d686982c2f158e0d8f5c7ec6cbfd500"/1453, 0x5ad, 0x20000000, &(0x7f0000000080)={0xa, 0x4e21, 0x3, @mcast2}, 0x1c) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x40000000, 0x0) 1.982450551s ago: executing program 4 (id=1670): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x0, 0x4, 0x0, 0x0, @void, @value, @void, @value}, 0x50) 1.93684587s ago: executing program 0 (id=1671): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = gettid() write$cgroup_pid(r0, &(0x7f0000000040)=r2, 0x12) r3 = socket$caif_stream(0x25, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) connect$caif(r1, &(0x7f00000000c0)=@dgm={0x25, 0x7, 0x3}, 0x18) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, r1, 0x0, 0x3, &(0x7f0000000100)='&$\x00'}, 0x30) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r0) sendmsg$802154_raw(r0, &(0x7f0000000300)={&(0x7f00000001c0)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0202}}}, 0x14, &(0x7f00000002c0)={&(0x7f0000000200)="99295275c32e30935d0e712fbd26a913345f412d198a1d7794767de4c6db1eed05c5406a5a5d16f234dee9146d36ea9bd78658c4a2b908b734f58c6d6eb7048d26cea6d81bda3ff2c7192c2b42043589a2745ce523addc305196e8853f5d95b072cb92ba3d6dd6bdfdd1b42c9177166be9c88de9f4f90c34867ed306f5ea44f35084137cfcec294bbb04b9ea95c10f0b45f1df0371d270b9af25781a953b52c159ae", 0xa2}, 0x1, 0x0, 0x0, 0x20040080}, 0x0) r4 = openat$cgroup_type(r1, &(0x7f0000000340), 0x2, 0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r4, 0xf505, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r3, &(0x7f0000000380)) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r5, &(0x7f00000003c0)={0x1}) write(r3, &(0x7f0000000400)="975a6cf5fa573c6c6005769af67ab9abc994870379ff5b", 0x17) r8 = socket(0x8, 0x3, 0xe) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r8) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f00000005c0)={'erspan0\x00', &(0x7f00000004c0)={'syztnl1\x00', 0x0, 0x80, 0x8000, 0xdcd, 0xffff78c7, {{0x2b, 0x4, 0x3, 0x4, 0xac, 0x68, 0x0, 0x40, 0x29, 0x0, @private=0xa010100, @rand_addr=0x64010101, {[@timestamp_prespec={0x44, 0x2c, 0xaa, 0x3, 0xc, [{@dev={0xac, 0x14, 0x14, 0x3c}, 0x8000}, {@dev={0xac, 0x14, 0x14, 0x2a}}, {@private=0xa010101, 0x3}, {@loopback, 0x4}, {@initdev={0xac, 0x1e, 0x7, 0x0}, 0x2}]}, @timestamp={0x44, 0x18, 0x40, 0x0, 0x2, [0xffffffaa, 0xfffffffa, 0xfffffff7, 0xb56, 0x40]}, @generic={0x89, 0xf, "3139d8499e1272603013a63aff"}, @timestamp={0x44, 0xc, 0xeb, 0x0, 0x7, [0x7, 0x4]}, @timestamp={0x44, 0x20, 0x90, 0x0, 0x3, [0x3, 0x10000, 0x8, 0x9, 0x7, 0xfffffffc, 0x4]}, @timestamp_prespec={0x44, 0x14, 0x90, 0x3, 0x8, [{@multicast2, 0x3}, {@local, 0x80000000}]}, @ra={0x94, 0x4}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2005420}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@ipv4_delroute={0x2c, 0x19, 0x2, 0x70bd27, 0x25dfdbfc, {0x2, 0x20, 0x10, 0x35, 0xfc, 0x1, 0x0, 0x1, 0xd00}, [@RTA_OIF={0x8, 0x4, r9}, @RTA_NH_ID={0x8, 0x1e, 0x81}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40040}, 0x2000c804) r10 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r10, &(0x7f0000000900)={&(0x7f00000006c0)=@id={0x1e, 0x3, 0x1, {0x4e20, 0x2}}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000700)="c2b41ab0092f5b62e67ee6b6152f7e206ececc0cf17dd5f093d981f97613608694b82b1ef21fc8808fe08e12558cdd21db325b4eeadb77311b852d90545d076c68ec0b9dd4cff24cab1789228479a2a5fb589b837790182d8451c1ad278086ed9567066ad066a84fea696ea9bcf55d94b9d8af384c3e60165b38d5f18f45948492cf1e3f5203a4b074926e2fc05e03b0075d5e46", 0x94}], 0x1, &(0x7f0000000800)="ba2f456ecb8cd500618a2715c7ecdb7568108af0550cdae8db16f4d28ac72c6579a6a4b487b7a02749d62e32372bca14af8c63e684c0f8e731eb3fe9a06cc40411bb884f1fdb01e7baccc31c8b443b734f52cd4d2056b88520f68ff02508362c17aa943734158e470ac490d05c68e1eda3679ccac311e34e00766836658f0f290dedd48bac100550e878b9adb42c7fbef4d8d2a216f79e4f2d48071ba05ec61ceea277ec1903992ed53d114a872d6d8007bc1c2b73a7d3b76933aadf5d1f1e17c66c32616438866afb6d539d9fbb", 0xce, 0x4000091}, 0x20000080) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000940)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x3, 0x0, 0x5, 0xfd73, 0x0, "3e4274f5445a916260b49698575a7ca28d1096f30ee8db69bd2cbf88aa57c20e7e50c440ba52c7b2113bb1687ffcbb56ac3ad649faceedaabc2b6cb8f00e7d14d9b45f0a5fd805ebfb782db4c9ed0da1e4a31b53fe9d06bf030e4d5212d2c096bbbafbb20df4ad458671c4cc0952864ef1596c7cf5f25afa78546b9332d32f08"}) setsockopt(r6, 0x7, 0x2, &(0x7f0000000a00)="7c6f820a3dcdb83a41fa839664f1e2082da27d3b966b83e4b30fb9820595ac224890e359f438c87a451b75abed36a973c5e91380b858df57879580cc8301191ac7c5ccc01a2b07533a932719bbed4c5e20853053541f8106a50e84d0e8948435295a32966d01868a3107a70d526ed26fbb14929b3920b11c0ea91d452fc3ff0b1ca9f42c11322bdbd94ff7096a21b05a4d72530d3d27e14dd15368f12ee535e1d19ab41886591a9c954b6f18b5fe33", 0xaf) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x20, 0x13, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000c80)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x28, 0x9, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d00), r0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000e00)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x24040}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d40)={0x70, r11, 0x2, 0x70bd29, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x1, 0x31}}}}, [@NL80211_ATTR_KEY_SEQ={0x10, 0xa, "22b538324f72b526d45a9d3e"}, @NL80211_ATTR_KEY_SEQ={0xe, 0xa, "eed81582e38bc1ef5f27"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY_TYPE={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000004}, 0x10) 1.778524014s ago: executing program 4 (id=1672): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) r1 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB="14000000f50301000000000000000000b833000000000000f603010000000000000000000000000a"], 0x28}}, 0x4010) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r3, 0x29, 0xce, 0x0, &(0x7f00000007c0)=0xffffff78) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r1) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00022bbd7000fcdbdd6afc8e30e9df250e00000008000500800000000c000180f700"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x20048040) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={0x0}, 0x18) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000005000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="05000000000000006b110800000000008510000002000000850000000000000095000000000000009500a50500000000389230606378b65aa92ac1ac2a77cdc867e41e3acbda96d4b848d263de77bf1e6d8b17e03ac18017c094eb881e"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000400500040000000000050005000a00000014000780050015000a00000008001240"], 0x60}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r6}, 0x10) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000180)) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000680), &(0x7f00000006c0)=0xc) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) gettid() socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)=@kern={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000480)=[{0x0}], 0x1, &(0x7f0000003180)=ANY=[@ANYBLOB="1c0000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000010000000000000000100000001000000d5437f47a8062181fe52bce4b930dfe94284119c999313fb75389b2db241c16fa3d17e97cceb21ae46ed8cc859235c1c4529beff20ad1af11ad7b1a17851e065dc08c8a4edbf9651e4cdae19417bc7dab6a41f575acd4cc59afc0df67189276b20c7027fa1ba3d77c4297847b8befd373bafc5cd8a73"], 0x30, 0x8885}, 0x40041) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000000906010800000001000000000200ffff0900020073797a310000000008000940000000390600010007000000100008800c00078008000940000000"], 0x40}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r10, 0x84, 0x2, &(0x7f0000000000)={0xfffc, 0xffff, 0x0, 0x7}, 0x8) sendto$inet6(r10, &(0x7f0000000580)="81", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x7e) 1.77810996s ago: executing program 0 (id=1673): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000280000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) 1.772117639s ago: executing program 2 (id=1674): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x6a040000) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="2f351b1800000000000000000000000000000061901800000000009500000000000046"], &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRES32=r4, @ANYRESOCT=r4, @ANYRESHEX=r3, @ANYRESOCT, @ANYRESOCT=r2, @ANYRESDEC=r4], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000850000008600000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r7 = socket$l2tp6(0xa, 0x2, 0x73) bind$alg(0xffffffffffffffff, &(0x7f0000002140)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(michael_mic-generic,xchacha20-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x7, &(0x7f00000000c0)="fbffffff", 0x4) bind$l2tp6(r7, &(0x7f0000000100)={0xa, 0x0, 0x110, @empty, 0x401, 0x4}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="270e000000000000000004070200a84695d96aca5a32291e8439552c36e248e502b6fcb107b4ecf130c1c8db66e440515583c299a6c365f8df7220ce8c525f585efc2adf"], 0x14}, 0x1, 0x40030000000000}, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$alg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x810}, 0x20044000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000000340)={0x48, &(0x7f0000000040)=[{0x20, 0x0, 0x1, 0xfffff01c}, {0x6, 0x1}]}, 0x10) r11 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r11, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="000186dd0610000800000000000000000000000000000000000000000001aaaaaaaaaaaafc010200000000000000000000000001"], 0x34) socket$netlink(0x10, 0x3, 0x0) 1.573019255s ago: executing program 1 (id=1675): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000980)={0x414, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x401, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}, @nested={0x311, 0x64, 0x0, 0x1, [@nested={0x145, 0x121, 0x0, 0x1, [@generic="d9b45c1c72ea0f6ec741f650e5d8f1c76e4d6e6f78dffc221296c2686a3b0e577e85e2", @generic="d42ec6795d0f76e5ed0f31909e6bed6e29fb89f169f2f3f03481b87cf2a83e3bc132072ed4ee7ab77002f80ddf0b8c819b047e1a70ad821d12b62ac2e3a2ccd666b54ee507ea702cd16bf1df7c22f67f542e5f0d71bc806d3888", @typed={0x8, 0xfa, 0x0, 0x0, @fd=r1}, @nested={0xb9, 0x1d, 0x0, 0x1, [@generic="395659cbee1ee6766c7549af751fbf2eb8788253b47d23023a32d9788c32998ee026024e276914d0aae70d786e120337fe9cbc0c9e9e9008c238dd702409482c45a977476e6638789f", @nested={0x6c, 0x1e, 0x0, 0x1, [@nested={0x59, 0xd4, 0x0, 0x1, [@generic="a4803e3fd1af764643b73de45d768de8db52619a63255c11ccef20dfffd887a99225e2f5ecae032cafb7216b237a1429eed88bc6f84aeb562009f34ab2a8894cd1d7697087420e5ab42922b7a9a487ed10c5c0e82b"]}, @typed={0xc, 0xf, 0x0, 0x0, @u64=0x100}]}]}]}, @generic="180187793ce4954a2d0c6394198efd86259a455b383d61a34aed593c5da530877c3102231ea96aa5cefb6c2d99b6fadffd0e3bd891225e8c0d45e6019a16c008707e0724a0a436faaabd146ae5a60224ca6e64f9e38c4349e259ac91811a57b5f522ff05f1", @nested={0x15d, 0xf, 0x0, 0x1, [@typed={0xc, 0x63, 0x0, 0x0, @u64}, @generic="796c3d3cc1f3db290ab3ff8af9998d01a9067f3cebdf5f818852b98b44e11fd441db5f6ccaf5833e192b4dca10fdf86450cae212660821bc12a1c14800e1893737f187022031f06b8d0f53b1090720f9f986853c93b418a7611f89d950d13b469a32796fe9d499cf7fd95151ff157e7e60ea88c4d6be9376ea4b50d5bd551481c915564cb2c452ed234ea4a800df8f95d198d2da935b789495ea7bb9ce6531ae7e6abf36751dba41809d5b16363323", @generic="9d22bafd4ac33962ab17d0d990f22e0ce4779bac24155d82f05498da6c9fa05cee888ef71b4755c9931b0200f564a52cdcc89114643ffd15fb495cd1bbb51ebd9f651e6ad3b3473949c0e79dcb948e0d4396e8c8a09ba50decb89def4523931fc20ba6e7ab5647f65f5ba45c278eec780cb651cd9c4ca1dc794060194b5f6e02947c12ad911895f1c0c5eee9b25581c2b4f2", @typed={0x8, 0x94, 0x0, 0x0, @fd=r1}, @nested={0x4, 0x30}]}]}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd"]}]}, 0x414}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000711210000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r0, &(0x7f0000000140)="7b55512d3725013cbb9f5f7205daf0cffb17320c41dd19aad9cbbeaebc5b977cc79ce3e3ea609ef1de57b0badd3c1b352e1eaf35b684a3c0f2fc713119c9a0bc8e61d3d057b730e1685372b14df19c183cb501f55d52121e147332df2e5a29d038e954b43adb352f12dc3e50f27090ae938938e46083bce85198f847622ff05ba65e9db1ab0b33725a35135df173b2bb80ef88cfb3e28244486e985846b27945fee426df9bdec314b086dff83839e75ba401a887c647244106dc2e7062a183e02372de219e485a8a", &(0x7f00000002c0)=""/142}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000380)=[@in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e22, @empty}, @in6={0xa, 0x4e24, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x97d}, @in6={0xa, 0x4e20, 0x9, @loopback, 0x2}, @in={0x2, 0x4e22, @private=0xa010102}, @in6={0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @remote}, 0x1000}, @in={0x2, 0x4e24, @loopback}], 0x94) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYRES16=r2], 0x24}, 0x1, 0x0, 0x0, 0x4000094}, 0x8001) 1.470552495s ago: executing program 0 (id=1676): socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x16) (async) unshare(0x2a020400) (async, rerun: 64) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000640)={&(0x7f0000000540), 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x4c, 0x0, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@CTA_TIMEOUT={0x8}, @CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x200}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x3}]}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20008001) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB='\a\x00', @ANYRES32, @ANYBLOB="08000400000000000c0003000000000000000100080005000000000008000100", @ANYRES32=0x0, @ANYBLOB="0800020000000000060006"], 0x50}}, 0x0) (async, rerun: 32) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="00010000", @ANYRES16=r5, @ANYBLOB="200028bd7000fbdbdf2502000000080009000400000008000500ac1414bb080008000100000008000100", @ANYRES32=r1, @ANYBLOB="0800090003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x1) (rerun: 32) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r3) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)=ANY=[@ANYBLOB="cf6a2da7608d197d5e0d6b58f72c44ec9a0b997e7be0acd7a9950904bc70685e59a666729ec2c73a7e6eddbd28655b8fe64ab7b1a7c9e4bd26c66a1bbfc3ba7773814d839e230cc3c1784bb9c266e00202069c4607290aef99bfe9b877c91c9956716d8359a06fb21781426db43401e45af5941ef9e4be924224444690d6fbc46a529d", @ANYRES16=r6, @ANYBLOB="010028bd7000fbdbdf250a0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40014}, 0x800) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000100)={0x2, 0x11, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) (async, rerun: 32) r8 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) setsockopt$packet_int(r8, 0x107, 0x9, &(0x7f0000000080)=0xf3b, 0x63) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) (rerun: 64) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r7, 0x84, 0x1b, &(0x7f00000001c0)={r9, 0xb5, "4741b6ddc3c1b377308289a224bb3a1266f2d1c7b4dc90c4fa52e29dfd426d4cfa54e914ebcba058ae276a43ebb131feffea70c8be31bb99c47ea54b9a7051b47dac1c02e2ce4fa8702c478229dae5e21ca235b406dbca0478c861b8d1533228afc46b8f090613b0e6bca142f25837b16a9f10aefdc620e3f995e16a7a4cb0acaa2940c9fa756c27518e7f76e98b0b7c0717f308952cb3042bd4b83af66d19062f0931007bfa31578a1466988c7faad33319479854"}, &(0x7f0000000140)=0xbd) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x30, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x5, 0x2, [{0x6, 0xa}]}]}]}]}, 0x30}}, 0x4000) (async, rerun: 32) r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r13, @ANYBLOB="0000000002000000b705000008000000850000006900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) (async, rerun: 64) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1f, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (rerun: 64) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000400)={r14, 0x0, 0x0}, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) 1.242862996s ago: executing program 1 (id=1677): pselect6(0x40, &(0x7f0000000000)={0x565a629, 0x1, 0x4, 0xd, 0x9, 0x5, 0x2, 0x7}, &(0x7f0000000040)={0x7, 0x7ff, 0x404, 0x200, 0x1, 0x5, 0x401, 0xc693}, &(0x7f0000000080)={0x7fffffff, 0x6, 0x3, 0x1, 0x1, 0x88f8, 0x0, 0x9}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={[0x2]}, 0x8}) (async) r0 = socket$can_bcm(0x1d, 0x2, 0x2) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000001c0)={@rand_addr, 0x0}, &(0x7f0000000200)=0x14) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000240)={'wg2\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xe4, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x5}, 0x4) r4 = socket$netlink(0x10, 0x3, 0xa) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r4) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r4, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x64, r5, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5}, @ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x2}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x7}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0xd}, @ETHTOOL_A_LINKINFO_PORT={0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x24000800) (async) shutdown(r0, 0x1) sendto(r0, &(0x7f0000000580)="6d9ec2423800d7cc186d7b0f980ae8f5c18add7aec84e77dc69d53f777d4133cae6416e977ba7a7150ba93505f5a9ab50c7bf3b526315775936beeffdf6885977243baa0c6fb4e2b8f1289bb20c3aa594153acb8dad0553b405fa269d97ead8a14d8f2ba51526ca4104c89649628fdbd32190fb393cf334ed65291b608e5a3e30cbbbf4f9f25750449a91543edcd574ef9d68771438eeac25a2d492acb605150b6bba5a146191cb2f8b9a02d6f95270926b20d137f1b7b1814f746c4243c5791a584ae3459b0ef4e593eef7e9381dbc256519d9501176d34d4fcc05a964293ead335e61009cac0137e8df8992c", 0xed, 0x8000, &(0x7f0000000680)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-generic\x00'}, 0x80) (async) sendmsg$netlink(r4, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000000700)={0x12c4, 0x33, 0x10, 0x70bd28, 0x25dfdbfc, "", [@generic="04263616d8", @typed={0x1004, 0x46, 0x0, 0x0, @binary="ec77920ce4156622f277f706da2d091f0f7aa3e08744440fbcb6880d4c46147a00cd4f9e3d95cc50663755af7576b2e186d97c794e7a5ea93ff8900f44ba1d70503ed6efb6490139c07a252707aaad4e79813b9269e985407adb033b584a3f337e6718e1e097ab30c4c92628ab3363480824d60e367477d9933038bf77d4d423bf73e5eb67994d52c627c4bab47a43f3154e695bf682f0caf4286f2c639fd112b4192986c0c01afa319d51c2f82e455c266b008d69920a1c9c420db92900392f3c2816df13776829243b8e9b5fd460150feccf9319a0413f9697328c2598e9bb94324f0cb621ff6db1b13e899b8743895e5e1bc4e970e543179aaaceda3f183b828bca6960fc32f69aa5c61f92280b7eb654420413ba45213078112420d55552bf622d3277b176317c5a78cb464c1ee1936e485f37487ec112f015d09cfa5e30a8242c73f0228d9a57a30e7a87ff358ec00bd1264f10e4b6453c6eda4e390223e1e56f3a71d26f1db2be95a30153996ac290f0d402a44204721876df027c889e8967c63fe7b52102ed6c22f211ca4078330cfc4a828f970a85df37774e84ae92c967df1f64dc25d4d7afe7bfcc8915d65c5e2f6c748e1869f30725c205861908b654b52a58cae45bd357e7aeff431dec28f6c9434ea99e724fd749a11b7a50792a073293b756f7d3e41b4666e6d5873815d321cd9f37fdc1c3024ed48ab2f5785d5b1e755b2c04cf174d80bbd7a4002bb90f846496fb237b1988228aec0643c69b58097df0c511ad114b6fc3657c3afc8c7f98c19cb177f421141f3be2a4e200d1f68e7d740509a51164619707d7646334cf5a434c7b11e1930212909d878e21055218b63bb633d62e3d4349085759119d85c6f77eb5e22bd33bcbe2ea16ce9937122e2d6acef5a93cc7c7eb56b55e0f7705e114b9455e60fa7d7c67ad2e3a91b609fcb39383c85885ab073f22fbd3271404f94908e91ca0afdaeb40090bbc933d74400f041fbedc331a2fd1f568cf212c8d62ec9ed0a3778c0b175f83d366dd5f0de130dd9bfc64991491fe1c5e6d65c793622815a821ebfb5447aa06b8e83c523e5ae28eba312e5f14c44603d00f1ce45de888086549a0112506a9bb11d33c54d0ee97dbff2448b7a723815f4d1b53b26bec221d3104a74443d8955c4e38cf2fdc8c4ee39b1f29a5609dbac2262e415eedba78ed5a492040bc323cd61f13e6efff39bb3f7f71ac865922a5b9a905457548572b7080d7634f3f62631e5da91973cab83da8f5e75e864c06112e08f7610780726575e98f0799519863e6b4e50634a479d23747e0b50409f70466e3bdfb9c88304bc3783a0e94f3865578241eb50c833f6b1b7706cf5e457eed94a2757f232d4942b4462330f5a9f9324e7e075889f2cc4aa1c0d291e4aefe2929c34c99e95c5763bf74a68144d18cdf82caf137cda6b3c7053b7df89be31313331b8e449a81aace70a624243585d7cacd1cd8c67099874052ecc11cf8f9d305ecd8fdfb321d133d407971741f00493efbafc6465be4fea4781404e9c28ba9be6be3874da250aa2c86e05de22cf434276db89f8b9c7d6215a4f229616dc0770ae0d64bccf67363cfb662fb8a34a8e30fabfc6fa19e7fc647f1812ee8afbf03c7df585a36980c8c54ef20e90872a587e9b61009c85795fde76b7e8ea16bfbe89f3b4a171ad68fe7c64d492874b81699958bf505c24eb43e6b02f64e694bd73c8facd235bb3bd27bbe21fea3da0b29276903623bac92525bb310a9ef60f8bd954fe7ac8e7f5d6b078690ff20cc0e6015ac57645502a3e60febe788cc2b2d4c10aeda55f1053cc7f0bbb122db2cd387231d1ef0afccb8da91aeed2e83573f6556cc339c3e0453d2862610f6644d280f5857d953b55d09144ef1d83cde0b88b0fe659d69148ddabd0d134d9900003d0a35af77531fd98bfc3238e7b80fbcf7f13b37f87cd483e984066b7bee923b86746a321bb413a09de40a3ecedbabb332572a435cc750220c8ba2e379f629722c87545f1618278912255b6ff00e498f6810604a10e45268b5120dea41b59fcf5d9d37bfbf4f3106190f4a2645bff5aecddbbc523e913b7b0ba5e0afecd95a9ea9ad3a5bed56eba986f31024b3085c2927123b5672fac4422c04b7d09ca0b089b190207b04cdb3c223d73d3fce70b524d506657c8f155ff28bd332d3632296611fb3a188d3f90bfe897c320c33b8f139725174b7bf9470d2fa021d45f5115f79003897a54b3af5c7f7201c27e6e38748fc2738821b25ec9fb961780e657fbe23dc158f812f8ea1e1348d85124fca929ce3501e69cb0597ba5a36caa3df0bdd4541cfbb0854d042451d70c559583c0b8a345a7a570b19b045beb1214bb83f4fcab47b9526f2220dab060b2f1bf87ddfecfdd646bf439d66cadabc52e1504df176839d37cd02b070eee51827b2dc6a160d8fd5a818950b1b277a7dde008941492957b1ea674fae33dafad1edd2311ac2095dac751ab3488c84b61248ff449d11cfceaefcf1677bc21cd82aeb234f2b411b84992f5cc51ce789510a9d8b89f7e46e3b6f9cf17295d7ada7ca3e34cab28be1395c424e5b08b446d1043a530ad792fc6399ba771afb41022455b52eeee471573695887f52d9b95233ffa7ac2707af96a912d390e670288f85c84d609632abeb6fecc36ad72194dda9244936342af66523076d3c597ad15095ebe5b8d163631caa989ceea592d59617a397d64fbc8a349a8db153aac076b95a0ca2fa87974bd87ab3e0329007afe869141f7cb5f97e1df63386bd136376f2c60df53999600ae867bed5304ad7335973ec84a3a06fa59c81fa07c3cca9abb90b84bbaddb34f47b8182f4462f9fd03f659db566c85b8def91b10c8b33dbd19fa91182380d8e2c7adf2ef90cd5b9e3782ee6142cd8effa9fb9bc59efabf62300999b31e24a7ea6b249f7c1db82ad10e352877a2b0d2450358f74b730a446b23a39e228ee5b6600b90f9eef2c71de3e6e06dc2652ce9e6e23e857118c4c059bdd29703e751ddd2b859c0f8e63a54563b362b79bb0822c94ca9e11759663e21f1e59db307dee266468b797bf2dd1c94dcc52b230daca30dc6454413ee7299a5accb634cb7db9d605865bd30fcc799760301bd21a077945bb27ed0a340fc131e8e375ee266e464796616d159c51c3aa1dd12991b0d54576a54cb722c72a008d1c51ca3845dce0acfadaf6fc5113dd7cef696a2dcf74ed2bffa8f716a8e6683d4bd74b95b8aee4a8478bc5d8714f299aa5ac5cfcf2d386ff04b01717fcfcbc45a7c9915698f196eefc8a7461d4eefac71e9d7d779cbb2494a8fd63335f1089b5880bb5405aab46d02daee1048f6b7831ca684d81e16d8b6d36cf680b8f56a834fb1798f200757d10b9f3bd17b3d7a9338fece7c7fbc86d024b67f4390000f87df20a7da1ec66630e0ece26e15fd09f1828f123942f3a548123c702720ed92912cc722107e01ebf3c8812f9ddc090c0e2ed8dcc5de1f284696caf982e63f53da126e6f96833b03a24302b14b1750c30560f9107be255b983dadb968db52f6cb95fbb3bd0e4a8239a89350e453116dbdd62334f5610e94996ae09567a850fcd4543649750c28570c38047a5bd74938ed1725b4eb6a126da762c53ebe4b9685b2a08c6cb951358c3390e76c6fed4747d3f09f1ab515f939613c8b7e847c25a197a5812a21392578f01810298058798eb05af5eea86aa62206d4bfbf5fed90c3464ad07479d0baeffcb7e716fe6118650f8bac29fdad1ed86578b072af16075fcecc33288819a9454613b4945fb61482ae08604591f7cdf98ab4449e42dd110417525362d34b828ba1543b3266f29e80b86880d34e475aafbd2e5f70690b6a0c965cbf17fe0ad3fecfb0ee09be2791093ba055899e9519b6ddcfefcf3c8947d9ee5074696d383b1381fda66451270923c019614d65ede914b3150ce892233b3a0717a3d968c0dfc86a9ef13b687775c9933484521c8f14a29cc85ff18490e60b69d6fb9aa311d858b53ec333535b9c5930d071b6fd6a277a03d9dc9f8f361748d4f0426953faf1d9e65c16817ad690021e870eeb57f1ae12a3efc00740283ee1ccfb31408360198aca4e5f8497d13db95decf62d706ca340ee0068fe2efa5dd5abb7553e80959eb5c7610224d484050127ec69b1a024d4cddaef1118c8bec69e3837131685eba313cab86225a3d2488a36e2bba0e3b5b90ef8d824a33ef64846b4b37f18c54fbdd7bf77211d881de213402649a7def9d340001b18e342be2889862eaad32b8afb7cc5ec9d15b19c5ae7f1174297fd9c729095a4c5a9d6600132358c8b8355460ca9513b2806c552b3fc1df4a56f3649b36431d74d896acc6db26aba1a7dba4f404ec7cdf374a2fa9c176278680259c86c719663f72c0ea55168ef2b832ec448ec60229629c1f3a0a3d41ff72537cb628e8a44c6f17e29cad2645654d084f78048bb4aa7691cde8a602cf9f1b01caa95cec1ec908c1ed02d56ef59ea58b07fa6f8d7d1d66cd7eb764131c64ad20a5379cf00f252df86a1f9259da6a8168bebc59cc4e6ea199170414d77f82d25bc812c0eaae78a77c21333958fd4065735719ea5b5c6dfee2205565b58d261dd7cc5e427224f6fead1338f7db0e0744fd1c1873f1953b5b077995741d692e7743ccbf8848531098adff3c3a07239447916e3802714e4d0d72b9b75e0ba9ab55fdacaaff5cad7b1ac92112f5f4958dd0ba47a094883141fe10cb1fbd5a853c044b812d3051e1db69d30fdead38a68d6e1d63a95dcee6f3dc7495417c811815179e81cae5da0762e7ebce42edbabecc2d18df8aa2af92935025af59e936698daa7ec140b22e583aa99eeacc596ca03f48c532e83ee84ffb0c3e0796d8787bfcba0561aa621fcb1ae76fb0d02bf162208b426054453b55d08d45a5d31fb4324b5946d7d99d840b3a7f15ab9af231a73296ea81c9ab6d9f8470e0f9351edf37bca34c7a114df94b62ede1d1d632b0710289f5d116499ef845294be553890a59c4a25eff69555190964ce783660f5790ea6fefa286e0c4e3d932f2db13c4dd754f4e55dcc9d8e1fec08741522e3bc946d1ace25298887b441f8ce34b0f3439f70a185ea9e4d4a499f2d0324cad9855cd6fe9370430e50cb0abacc4fcc58d1c4a2aa6edf72ad25719334e69ea9554afe9e0dd4ce2e2957aedb9f35440e982af8a0913108d7ac0e5bd177bf6c266351fe21b358613c555ae9b3761e3ce848dcf8436bf7e61b9bf585e7f6dcd185cbd577b242f9659e07074392db70699cb1d6de0d47407f8894cf977b4e87fe2430955198f43a8beec65522e81dc3cfe51adc1c0b2346183eeb5ba3698465df3cea4047ddd47ab36e9aecb16b2205c9935f95f151e332f2d7e1658c4163d936b77ad5374eb2d510b5935a3c0323f63fba84d7eda733627f263718f4d8b555436147cb21ddab2956fb725255ffdb2b7a6b7d3c8ff54b96940951abd7242bc901c42ea32313bf734671de679dff4fa49c7b0cb017444b3b5e69c79381d4949ac0126dca0b091bc152609ac10a426a608214890fe5b4fde79f7e24f32f5f883246746ee283d6ac36ab122030237bb3837067fc0ba5be666c6b35427378a051a61c26bbd345cf2541317bf78964c2af3f30e94edd57c82b2b1613fba77d7210975498775dc2a0dfd53929b28ef8cd7da97d9cb8972e2c3fe14e9710acd8cd810b6f947be5df109876749c2c6f5a532c64df4cc47100127d2a95598f969d5fe11e13cc5275b7fa060938"}, @typed={0xc, 0x71, 0x0, 0x0, @str='pim6reg\x00'}, @nested={0x8f, 0x41, 0x0, 0x1, [@typed={0x8, 0x20, 0x0, 0x0, @pid=0xffffffffffffffff}, @generic="ddf848de97854db794a8a8f8a3402f29b8e91f3a55d3406d39ae69dcc7f87002cdc7dbfc7085bebd424564cc7516d11503c24cfc60441f00ee798defeebaad13b77f8266d01d7dff8223102706d834282dbce339b70e52255b96d4f85c69cf507ed74e49ed58e2a451d6af79860d7d336ca07375f88075ef3e05b4dfa1691c98a94de9"]}, @typed={0x8, 0x2f, 0x0, 0x0, @u32=0xa9}, @nested={0xfa, 0x76, 0x0, 0x1, [@typed={0x8, 0x11f, 0x0, 0x0, @u32=0x2b0f}, @nested={0x4, 0x114}, @generic="ab223c24420ce2c99c60d32878cf4bbbc5a33183ff3a8591cc06c212111b13e266fd0556ee276d0e19ffb0bb2ba6c462cacbf9aa6d5d2e1a6a747f7a95a2c701d4d496181b67c5e165578c722b89a78ba77389d730ea8780895e2f819203eea199108d21f3434a64fd3603fb93f80c815fd35e2cf11fc16b9be56aee876b462494c88222cb2a4474ff4144b9883e32ea00a25f12c996172d61d2ddfd60f22f8111dddb221199a108b25ff9681ef51a525afa049c2ddfb03f760d08e212cd2db3e040048990b191654fa0abac86f82b6272961a01794c3c797e329a090b4feec914cf4746a98b7df9cc16"]}, @nested={0xf1, 0x60, 0x0, 0x1, [@generic="61176a9bb1f508e4af8bb6434e8d39fa8999f574069160e838887a054f6d22f6c544de46390f24e3322266d162d474af435bff9090ba99b09afe2c3195d076051fc6d77d3d361559deb0ab0a42e3d1ca46dacfd2a7fa8113c646d4a99546fc1e71fbf5ec544a9c74de1c2a83dd3922beaa2020c49750395654570a7a041396f5f1d045e6f011a8fc5ffe1d7541cd9edb48acf6a7d64b54db73ce0f6e343ef5af50064ac7978086108285ef17a7723e10d0a10107b54a116ad6e51e485cc0037ed0aad0fb35e6d116c3e0b8c2df72437db58cdf1de6d5", @generic="255f0478093e8054094ebe63067b91328f141a", @nested={0x4, 0x18}]}, @typed={0x8, 0x146, 0x0, 0x0, @pid=0xffffffffffffffff}, @nested={0xc, 0xc9, 0x0, 0x1, [@typed={0x8, 0xb6, 0x0, 0x0, @u32=0x5}]}]}, 0x12c4}], 0x1, &(0x7f0000001a40)=[@rights={{0x14, 0x1, 0x1, [r4]}}], 0x18, 0x10}, 0x40040) (async, rerun: 32) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000001b00), r4) (rerun: 32) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f0000001ac0), 0xc, &(0x7f0000001bc0)={&(0x7f0000001b40)={0x68, r6, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffa}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1ff}]}, 0x68}, 0x1, 0x0, 0x0, 0xc990}, 0x4048010) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001c40)={0x1, 0xffffffffffffffff}, 0x4) (async, rerun: 32) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001d80)={&(0x7f0000001c80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x5, [@ptr, @restrict={0xd, 0x0, 0x0, 0xb, 0x3}, @struct={0xb, 0x6, 0x0, 0x4, 0x0, 0x80000000, [{0x6, 0x4}, {0x7, 0x1, 0x7ff}, {0x5, 0x0, 0x9}, {0x9, 0x4, 0x80000001}, {0x1, 0x1, 0x7f}, {0xb, 0x2, 0xe}]}, @int={0xc, 0x0, 0x0, 0x1, 0x0, 0x4f, 0x0, 0x24, 0x3}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x5, 0x3140}}]}, {0x0, [0x0, 0x30, 0x2e]}}, &(0x7f0000001d40)=""/29, 0xb1, 0x1d, 0x0, 0x4, 0x10000, @value}, 0x28) (rerun: 32) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0xc9, '\x00', r2, r8, 0x0, 0x3, 0x1, 0x0, @void, @value, @void, @value}, 0x50) (async, rerun: 64) sendmsg$AUDIT_DEL_RULE(r4, &(0x7f0000002300)={&(0x7f0000001e40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000022c0)={&(0x7f0000001e80)={0x434, 0x3f4, 0x20, 0x70bd2c, 0x25dfdbfb, {0x6, 0x0, 0x15, [0x8, 0xfffffffc, 0xfffffff8, 0x76f4, 0x3, 0x3ff, 0x400, 0x3, 0xf, 0x8, 0xfff, 0x1, 0x8001, 0xfda, 0xfff, 0x2, 0x7, 0x4, 0x2, 0xe5, 0xa37, 0x1, 0x1, 0x4, 0xa, 0x3, 0xffffffff, 0x8, 0x8, 0x9a, 0x1, 0x101, 0x0, 0x500000, 0xfffffffc, 0xd, 0x2, 0x3, 0xa4b, 0xfffffffd, 0xff2, 0xc00000, 0x926, 0xfffffff2, 0x2ac6, 0x5, 0x5, 0x3ff, 0x2, 0x10000, 0x9, 0x5, 0x6, 0x9, 0xfffffff0, 0x2b46, 0x2, 0x8, 0xe3f5, 0x6, 0xff, 0x401, 0x5, 0x9], [0x8, 0x4, 0x8000, 0xffff, 0x526, 0x9, 0x6, 0xb, 0x0, 0x8, 0x10001, 0x6185, 0x2, 0xff, 0x8001, 0x5, 0x5, 0x5, 0x10001, 0x5, 0x0, 0x8, 0x4, 0xa0000000, 0x0, 0x2, 0x3, 0xfffff800, 0x7f, 0x0, 0x571, 0x80, 0x6, 0x3, 0x8, 0x4082, 0x4, 0x200, 0x4, 0xdc4, 0x101, 0x871, 0x8000000, 0x401, 0x1, 0xa, 0x0, 0xb, 0x10, 0x103a, 0x10000, 0x6, 0x52e4, 0xd, 0xd, 0x7f, 0xd, 0x7fff, 0xfc55, 0x6527, 0x4, 0x0, 0xd, 0x3], [0x1, 0x6, 0x1, 0x2, 0x200, 0xac, 0x58, 0x3, 0x7fffffff, 0x4, 0xfff, 0x7ff, 0xaac, 0xffff, 0xf, 0x3, 0xffff0513, 0xfffffc01, 0x100, 0x8, 0xc, 0x7, 0x7, 0x10, 0xe, 0x200, 0xb826, 0xc0, 0x3, 0xffffffff, 0x6, 0x0, 0x5, 0x9, 0x4, 0x80000001, 0x4, 0x7fff, 0x8, 0x1, 0x1, 0xc, 0x7ff, 0x3, 0x7fffffff, 0x401, 0x3, 0x2, 0x4, 0x6, 0x3a, 0x8, 0x3ff, 0x2, 0x5, 0x5b4, 0x7, 0x6, 0x7, 0x6, 0xd3, 0x5, 0xffffffff, 0x200], [0x1, 0x8, 0x8, 0x80, 0x7, 0x80, 0xfffffff7, 0x4, 0xffff0000, 0x6, 0x3, 0x6, 0x80000001, 0x10001, 0x9, 0x7, 0x6, 0xff, 0xff, 0x1ff, 0xfffffe00, 0x3, 0x0, 0x2, 0xc5, 0x10, 0x8000, 0x9, 0x4, 0xb, 0xa, 0x8, 0xfff, 0xfffffffb, 0x8, 0x8, 0x2, 0xc, 0x9, 0x93, 0x9, 0x9, 0x4, 0x1, 0x1, 0x3, 0x5, 0x101, 0x6, 0x9, 0x0, 0x6cf, 0xfffffffd, 0x1, 0xfff, 0x400, 0x6, 0xc26, 0xa, 0x3ff, 0x7, 0x0, 0x7ff, 0x600000], 0x14, ['\\-\x00', '\'\x00', '\'$\x00', 'hsr0\x00', '}\x00', './%&\x00']}, ["", "", "", ""]}, 0x434}, 0x1, 0x0, 0x0, 0x40000}, 0x41) (async, rerun: 64) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r11 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002380), 0xffffffffffffffff) (rerun: 64) sendmsg$NLBL_MGMT_C_LISTALL(r10, &(0x7f0000002440)={&(0x7f0000002340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002400)={&(0x7f00000023c0)={0x14, r11, 0x200, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x488c0}, 0x20008000) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000024c0), r4) sendmsg$IPVS_CMD_SET_CONFIG(r4, &(0x7f0000002640)={&(0x7f0000002480)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002600)={&(0x7f0000002500)={0xc4, r12, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4a}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7e}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x84}, @IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xf088}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24008000) (async, rerun: 64) close(r9) (rerun: 64) r13 = socket$kcm(0x29, 0x7, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000026c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000002800)={&(0x7f0000002680)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000027c0)={&(0x7f0000002700)={0xbc, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r14}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0xe}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x2c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "590df156e8e6383b3df59ea7480422ab1a1a9de50934ac92"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}], @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_ID={0xa}]}, 0xbc}, 0x1, 0x0, 0x0, 0x48000}, 0x20040841) (async) r15 = syz_genetlink_get_family_id$team(&(0x7f0000002880), r1) ioctl$ifreq_SIOCGIFINDEX_team(r13, 0x8933, &(0x7f00000028c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000033c0)={&(0x7f0000002840)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003380)={&(0x7f0000002a00)={0x95c, r15, 0x100, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r16}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r2}, {0x120, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x400}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r2}, {0xfc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r3}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r2}, {0x218, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x2, 0x50, 0xb8, 0x1}, {0x9, 0x4, 0x0, 0x2bb8}]}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xe}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}]}}, {{0x8, 0x1, r2}, {0x160, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r3}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x1ff, 0x0, 0xf8, 0xe11e}]}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x1a}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x4}}, {{0x8, 0x1, r2}, {0x1f0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3a1}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}]}}]}, 0x95c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000081) 1.128928925s ago: executing program 0 (id=1678): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x0, 0x0, 0x0, {}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8}]}}]}, 0x3c}}, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f7000000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) r2 = syz_open_procfs$namespace(0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB='T*\x00\x00\x00\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088028000c8024000b8008000a0000000000080009000000000008000a000000000008000a0000000000"], 0x54}, 0x1, 0x0, 0x0, 0x4004010}, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="140100001f0001000000000000000000050100800c000100"], 0x114}], 0x1}, 0x0) unshare(0x62040200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) pselect6(0x40, &(0x7f00000001c0)={0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x5f8, 0x0, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) vmsplice(r7, &(0x7f00000005c0)=[{&(0x7f0000000180)="04", 0x1}], 0x1, 0x6) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r8, 0x0, 0x0) r9 = socket$kcm(0xa, 0x922000000003, 0x11) r10 = socket(0x2a, 0x2, 0x0) getsockname$packet(r10, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newqdisc={0x54, 0x24, 0xf0b, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x1, 0x29c5, 0x6, 0x1, 0x3574, 0xffffffff}}, {0x4}}]}]}, 0x54}}, 0x0) r12 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r12, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$kcm(r9, &(0x7f0000000100)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1={0xff, 0x2}}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000000), 0x4c00}], 0x1}, 0x0) 965.067653ms ago: executing program 1 (id=1679): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) socket$alg(0x26, 0x5, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40201, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="b9ff03316844268cb89e14f00800", 0x0, 0x9, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) close(0x3) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$inet6(0xa, 0x3, 0xff) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}], 0x1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r4, 0x400442c8, &(0x7f00000000c0)=ANY=[@ANYRES32=r3]) connect$vsock_stream(r3, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @host}, 0x10) 751.594466ms ago: executing program 4 (id=1680): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x41, 0x0, 0x10820, 0x400}, [@IFLA_IFNAME={0x14, 0x3, 'macvlan0\x00'}]}, 0x34}}, 0x4084) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000080)=0x100, 0x4) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000000c0)=0x5, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@func_proto={0x2, 0x1, 0x0, 0xf, 0x2, [{0xf, 0x5}]}, @var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x40, 0x0, 0x8, 0x0, 0x0, @void, @value}, 0x28) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmsg$NFT_BATCH(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a14000000030a010100000000000000000a00400214000000020a0103000000000000000000000006140000001100010000000000000000000300000a"], 0x50}, 0x1, 0x0, 0x0, 0xc080}, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007911300000000000c6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x20, 0x0, 0x309, 0x70bd27, 0x25dfdbfc, {0x1d}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008915}, 0x20040000) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000000)) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000)=0x25, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000340)=0x0, &(0x7f0000000400)=0x4) sendmsg$inet(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000200)="dc64424421f3818121f8465fafab73f4a5", 0x11}, {&(0x7f0000000240)="000ac7c35966ae1ce0ec60f730703a031482d38b31ff21a107ef47c2061fc1711cd2d90f06cb7e22fbe33372062c0a45ed01d4be2556a03d568265f872137617f0886f3d9a1c7c2345634678cfd5bbd4992db903d8c5b5adaf5f1a81", 0x5c}, {&(0x7f00000004c0)="53324d5287e335316f63efdbbe322ebd1895f5e763f9610eb5caebad66679b46ac949654a7cb554283d0760f4b9afd1178dd48100e5363d0552d076b1a6845bf4e55f8e5aa168b0e186f8f0b9fe1c69a7519b685d14e07b69488439633e083cc0d448487bee043f1e128aa91e0a334d4fd8e70e0799e325469e280446676a5b3c5ecfb13c44c9194c734cdfb90fe6ef2f55b7b3d9291e3891bc6d4874d57932f4d11bf425997563e18d247d1a174efb15a0907d3b4829b5043baed0f31fe74fb793e7829fe3ecad867252eb5223e31481a6a3bd4b17042b5289143d2ae51c4991475d64ba430a445faab7dbff03696c70b66c4", 0xf3}, {&(0x7f00000002c0)="71c8361ed4f90c70d4c1b343b1589799", 0x10}, {&(0x7f0000000640)="c174f73228b280d646d1e41fb4f7886fa8668740581c01ce9107eb78a8a80a6c79fd2312cac833a13df40d077fbeed8c5706aeb69b5aa5f84842f07c43a33a4b2495808a73c5e723887a00c61df8fcca7326aac9d753402f3af6994a3e0d52c889ea28ee375ca3e50c8963962047c9a31da63ef16d32a813d47b292504e1853848a22d4c9392f714e9eb3f37c0d8c7a7d943be423a169a17cf89d2d27f1e60ba25ef35745cefcf5db13b77521e8a892f51eab2f3ce3f33c984b0ac67901ae470889b5161229d4247d7e33b80b0c15d1b99d36d89ee7f84cb7c56e830ad918947dc9854ae139408bb07f6586c9d7603f4a51e7264c827f3c7162e88a703bf8da9237ecb2a7caad7d536163d8a96bbcdb6640836fd52ea249da820e1ebea33198353dcd88e6d6361eecf65c511cf48e560efdff5952541df242aac31a724fbe132ef9d7f7d8c572e3f260245c841f951eaab3f16669a66191a70da02e3fb4f685fb94fe5ddf8956cd524225992ac4cc21db43750908a7d09377c60312feb62cb9a1a2cf2d9ee7eaa865be48a7d88d436b340b4bd959152e14d0cce9656c3cef13636e5e39f08d58cb4cd555a21d935b3e9febb2215f728fc14e139fa58950f6cb2dae2ca5527a33dc139652a4b9ae583c7f1cc02c706d5632f42eba88811448892e995646bf7e174e047b9e87a1336ac4f1c64e6ab4242e11a7a4950efc3dc8ed53c77c0e6537981fcceeae30a425402489632b0ca9e7824164d5f157c546e23f2e51a2a752f9b048ed87dd1512da05babc6258a2a520678d7c51a0af6b5144291ddaed02c2cec4d46e978494118ec320007e9a9ef514d0b71f17e99dff4f06f125ea2713f191b3d60ec55fab6db84bf10c5418f3ef9f963fddc109b013ab6b93c1ad7491b59be1f462c8967b0edd8ef22a0c8e38e339377f2c94c60cd21c3205b49c03f305b787569c80d95b44ebf98645ce1afbaf34804c6aa67a0982e2cfe3cd327aa59729a0d089e45cf1aa05fb38a5919d33787d0b6113d638a2e2c1f1dcc6a1e189559feea4c1b82226861d9eb62d5a8d79e8292f844691a8c689874f1d13f51d8429b11a09355f19c6e7a4d0bdfbfee6a8e26874306ac7b51732427c48ae3e893d267e1bffcf989e0c53db18abcc652a419f4b46680e5c1ae7fe2b7e738431bd49dbe5ac17fce1d87a86cb909e8af4f1398531fb4637571204d01a695557fd313269a292342882e08309ac2a6d41b95a0c4293db8e580cd41e4e9f50813ec9dcffca25be83363a2216a4a2016a81b106d6e5c38e349f25d308caccf0bdec01f466fe662d39ef40f14a2c672adcb9b5f26d9967492e644caf09103b61e52b342bea750601d29e803f94ce5f149b27323b734d77bd28a68cf74bb7d6bf9cdb74cf2c1b6315712f6c7e0130263d35d8027b4a9e73a4bf71bb1d8e636520f2247b947e0740e46c69ac43b669d4b5def8d6167d06b972581cd4f4a327ee7ffe5c18a43923163497d6bd7c6eb59a8eeb557e5af99a7cb1102e7a111f209c64474512abe9bfa6995ad3acd3bc1b68f07049c2ac616e0a0743bc91e0d4a84fb8f455f6f366711d51c834d597c63a103ee2c882f9eb29ebf3f70a19dab5d9ebeb48cee450ad05f2ecb9163521f6f8445a0cf3877c822031a33ad4e6e98d77f8db1f456eb3c9a5ba97fccc23c9f4978decf13c7690f97bdf2d4c41d8dee099336850c6e0d9f3ff4d4d47f3b3e81cc15c3c7e4934380b8a1b35dfa3a830534029f2d648abc3e10f2f7c1fe13d08062946c8e9a969bda26552e24205e579502d622bf1c1dc0570f225da41404b06527a6ceb66c04f6743b2978d5f02e3a5d6a929c88301637bbda6b79a0c3c79d69ea91317258fe95c2cb63e87487e0f605f20b767458d46f7a099792172c840a0972cbf528191c29c9402ef3adffc7c635d436a7604656756d61278134ca2d668c88978fdb4e34cafe5cee55dbc9fe9fcda18a668ed1141c0106945ebb38fa8263e80f297a7bdf925ffe85c5afb05311d101266c7de4ea0d15877cc49a01cbd5160590887661446a8390ba0f0df53ee389a0ef0e344ee7db90aac1e0345cf326be89cb390aa0a10fd1c97cadba544c7c226ac11ed6b482633f221389e6c19d5bee4f5519474975f82b9b49d640b45c445c2c31a04b4fbadc0ac18928cc182f72f95c7483ee5a7c4499ee83b543e8def54169dec5216aaec29dc49b47a2bef42786435bdc4ffc54ce6c92553e0309923b58e7568bff29a4f15679fcbafa6b4ec1090755dfd4f58088196244e38932de5df13fc4da186fd2640a3d4f75ba47c3032cd3209497eea8bd46d8f94d02011977980b6f96759dd9785d30c037d247a0c48b2649791ce6b7c4b5a9d1a561a3da0b746dae539dcca59d2e5a681a73e97e8fd388912e70190fb123f627f1ff6420d91f9b011fced6d17ad19565d6925a4ebb462ba4dd3bbd7d858e2f690051d6fa9e835c4780c6f8e6abdf30f7483f1da76beba7b061ed0f2b4a85423c4637343036336ddd060d9e34b1938745c9a203f1fc8dd50b01b312b9c974c8b35dece9a61e7c8c92f9905c671c838ec257347f275fc1562da5a9b4ad2e7b3f77f941dc41f95c88e28940dab893de5f89173d17da129eed53e52695c57f18aba720db58c2e4c3e02a14fcf1b5d7973cbfe8f78de24385970e7b471c65469f33b62466e882216dbf70a8c5ae266397b1529a10ca9e83622a3ce2ef74329c43c01835beb23da5b7979cbed2f05631cd4d3be8d2e6ade37e3f63d66db9f66ede5d4e16193bb0b4630a2ff175c78f7c134b775bbc2ccaad61b72add6e02a0cfd7bfea41a091f91b5cd19233af4fd97f8b228e25394b585e879386c2fba58b45aa64f6a6f9922e796d12142d46d81c40d10207d748020a463cc3f553675108b8414d9652bee1e77b9c7de43f509aee497335a8e8badf0f64a748c69d9a316c39e5ff3c7cac81fb4aca827504592b18ed518ec85ebadf383049b1a129d2b5d2e42f2835cacc995b373fcf8d9e34e071cf41a1d373390acbbb413863186f79364fc51bf103d1d68323ad635c2fe6f5df030a3b7b58e35a100864c89bbfa41a7c93f6edf055a3a306f76bb8b53c0c946688153f7a12a00d7447ad0c7670b352796f941131c41bb0449f22431a7b46401d01ab2dd2085edd3edd88839ec7e01d85d5550c987a5cd6a462b8d14ea07a487afd0097f7bd8840558541a54bae1967148e285cc8efc91357cccc35e6238ea142ba9f137f6a8f77210201fe41854755894036f9f3073b68dc2ae13de3c32939cbda4ea72429ad0c9c2ea6415b1ffccd207c78dd36f9beb57e93c1efc98c9580dd4c6adc487b9953ede7f17ae4621385769d308ed5ff92ea156b9d26b8afc80767666b74f1d8cebd95e90c4ad140b1edaae597f5ffc05ce0294748d332f475d695b9dd88732682f836447ada0906e394245a428234bd3525536d914652dc995dad5bf280042d6c7eb6a4e4be9edcd1d1147f34bc60566b62f23727d7217362692a11ac54fa2952fdf4c93630be6198ac87bd35615239f1e0feab9cf92c637507811d87a7a6a944fb59068df5b33d15ade4bdbd18ccb670c6e60c1cde631e9f6f99e1dc63449ad576f6d50c2f0c54dd85102017ed2998a5402c850c31f0b64cd6d29d8cad55b03405163de10c1a52c6ca08a39939e8c5baa728f80038750a6fd54dab9f06036f441714052647b1c43121c588b16082410ec8cc5afa06a82b3b30c6489f37651e029d31512f927a1f00d1c0a9b302c7afb9b5383266f18a21dba0371e1b40ddbaa06c45d0900f70cc25e1107ab9190520a87e4200c7efde6232fb8176e90ae0ef9c6d559c1e327025926c42dc83284ad1c6c8b5f574715dd2bc43a1552108309a61361e33708bef90ec98b8f02c9e57cbffd621a12c9360a55777af92f8b0ba359402e8627438b8d17df19a770a77fd4a4c4af2c4bf4231bfd27b35fafd382b6dc4e40d9419924e177018df2df30e285f4b1a16191826aa5394fb87bc4eeaf68776e31db408aaf8d1d4d1ac27a92528b286d868ce0e2fad959a40c7083b91f67105102c699e4be78e718364750767f6cc839be4e03b0d6b406674db659b30cb12b830cbce593b8bef80c571fd41933fa087dec7138f1256a359ccab0e50d82c75bc56e3df73c11087effb1db0fc51399c6f1eff06bf599b064c032d7a5601959f749565347bac52f2e8a899b204be0a73dab1d9f2c3d6e1392dfad2ae517401198f5cb1c24045b20fc06729394a20c88d7a8a7e6707a27f656781529578a0c4dac3361a9c7b359a43397cd1f2142d6def5ae77079a9c614522f2b4c8df70fa46ac803eed6835d1e0290e6fb6ab65e8f96cfb61c356b3b06b1809b2a8b81ee377a5d3fe34c4ad78843ff1bb8bc1ea023e867748eb9ad350e6dd856ee33cf50cf6caddfdff6c3c26dc2427ffe852108476637ec1d4847026986fe0b6541d84c02cc437a71f00f486148c67694f252c5c97053e5b5d7ff49f2d7c65262feaa964373a69d1ca920a9651c6d616f4548399de71ce54fe318e8cc805d3ca7bcb7ffc17eb48424254e711dcd28128cdfdbd942a36741f05f3a24d78e22aef038ea69dc0d100c0308843df6e20aeda386b11924bbcec78f18b3ca668eaff785447927da69f9bf5b0e76776ea54677fb0baf7dc06c580637e28c5a98cc3fbbf2bafdf51d0a5db0848eac19eba7bf7208cfb542e06b327ef86347e130db45323b1c72e7f8f0cdeee98cc05bccf24a388b5729d9b937507fe010e0aa7cdfbaafadb16cd8d6b7ea50d702f166078c5e72cef9abcd9b1cb69fa49e38f481403e7879fcbe4c750b4b458037db9619da9fde38594f01ac4de659948917ba9bf6434d32e3dd484c3f53709abe82f71ac6a9737a0c24d349c94b0f6b2ad8ce3eff5d356aaad73eaaa3f7494eed2fff773e03c2b1ae23adcb441998645f32bab184410377270fa6ecfbd3320f499bc514585394ab32cc290a63ebd820921bdbe14faeb6fcf45edd8ee111b2a702dac451558acca88196b2c44a88f8c61a67127ebba874f2520d441c3402bd3ab28fdf4c8075d86df7790768f8bc36a248658e5218a191205a44b75b6fc7e44038a8faf0f1426f6b863c3b74737a4b55f02f3fc034739cce04f7eeb37d6d6b1b5c467aeeb65c8ba1c2dfdac8319f5ac980c906b936b8abffc5084f37641fa57628fc57f712263ae2305a4ee345c2687aec72e1489a75ca69b947877b098ccaa6de619ffd9a11fc0950840030b4b4e22a48f49164f31d98a6495df33ff6a92a052fed4691817f5bbb8cb21ea5e290159296ef9986764969038afb26790ebf8a8874a8940377fbd6f6c9edd8163fe1890a0e938d9ddaaab69256c9109cb0010781413c80f74eb11efc442dfcc5aac66095bfeba744af9231895f80573078cead1e158b85dfa6cd3453cd2c50e88475f21d74d7666d6f2e6611576056157904bf3e27855c705d064518d27369722a3756fdf3030f889fe8c8b3e4ae17a46d33d559cb689de507ac6fa87e82b75b0b83a54ea8b7de472e714f469eb7fce425e124e97699b5ae78a8c17bb508e9bb6ae21808be092c333c4462565417533eb033abf53a473fd392d30021939301bfcc896dda8689de7fb84abfad76295ab81b048be41baefb1ec365eb915116f80ff6964ec93e236f86d0f9f9587ad9282af127104c6d2d0973255482c2538ba77360675314a02f438a47c42dbad3123a186ab07b488c06ae54464e25c2b62912d9e7c06c325a0f7b8054841c", 0x1000}, {&(0x7f0000001640)="d89fbdf4154ec5bf63e5487143e0ad0c4b9c4a10330c50cf3d0921aa445c6373194cbcb7843bb939ebbec103da99de816aba005125515a0266ac1e13023a77af014a83dcdf59d7b75565126c9149499772622d66faf0c1dee7588d7c9ec1b5c29fec5dc9bd57dd87035fbc07de46bfa620f4a05b846c4f04ecce500ac91bbf6d645983", 0x83}], 0x6, &(0x7f0000001800)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @broadcast, @local}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7d}}, @ip_retopts={{0x50, 0x0, 0x7, {[@ssrr={0x89, 0x7, 0x63, [@remote]}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x8, 0xe7, 0x0, 0xf, [0x4]}, @timestamp_prespec={0x44, 0xc, 0x4e, 0x3, 0x7, [{@dev={0xac, 0x14, 0x14, 0xc}, 0xfffffffe}]}, @noop, @cipso={0x86, 0x1e, 0xffffffffffffffff, [{0x5, 0x7, "a0fc00b040"}, {0x1, 0x6, "86ac3d5e"}, {0x1, 0x7, "d3865a5bd4"}, {0x1, 0x4, "f8a1"}]}]}}}], 0x88}, 0x20000000) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0909000000000000000001"], 0x68}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_rdma(0x10, 0x3, 0x14) getsockopt$netrom_NETROM_T2(0xffffffffffffffff, 0x103, 0x2, 0x0, &(0x7f0000001c40)) 322.795495ms ago: executing program 4 (id=1681): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x290, 0x2e8, 0x2e8, 0x290, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @mcast1, [], [], 'vlan0\x00', 'geneve1\x00', {}, {}, 0x32}, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x2000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@remote}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2, [], [], 'wlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200)=0x5, 0xfffffe97) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) (async) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x705, 0xfd, 0xb1, 0x0, 0x5, @multicast}, 0x10) (async) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000880)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x100, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_emit_ethernet(0x7a, &(0x7f0000000100)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x3, 0x0, 0x0, {0x14, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x9, @dev, @remote, {[@timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{}, {@remote}, {}, {@multicast2}, {@loopback, 0x5}, {@local, 0x4}, {@multicast1, 0x6}]}]}}}}}}}, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r2, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) (async) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000b40)={'filter\x00', 0xb001, 0x4, 0x418, 0x110, 0x220, 0x0, 0x330, 0x330, 0x330, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x8, 0x1}}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @empty, @multicast1, 0x4, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @empty, @empty, @multicast2, 0xf, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) (async) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) (async) r6 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x2, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000400000000000000080003851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000182000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xe, &(0x7f0000000340)=""/222, 0x0, 0x1e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x18, 0x1412, 0x400, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}}, 0x20000000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='\a'], 0x10) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r9, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r7}, 0x20) (async) sendmmsg$inet6(r7, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0x0, @none}, &(0x7f0000000140)=0xe, 0x800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r10) 145.010622ms ago: executing program 4 (id=1682): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x80a, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48) close(0x3) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000240)=ANY=[@ANYRES32=r3, @ANYRES32, @ANYBLOB="2eed9f7d1f097de5ff3a", @ANYRES32=r3, @ANYBLOB, @ANYRES64=0x0], 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000007200000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r4}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c000280080007003b070000"], 0x4c}}, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$sock_bt_hci(r1, 0x800891ce, &(0x7f0000000140)="2a28358a55fa778eac40d2333f4e68c373e07b4d98ca87a3a5ca22e3dacb2ef5aed89596234372fd899908ab625101853012696a0109d1bf0cc49d97979b00bf134ce2f46e1af08a42e060f172c5437ffe06d04b80bbbea0de227473473042b868ab6b1ffb852a921f5ee232ecd1a5db526ab5593100ed205a81ac9dac26ce3e7deed2979e47532d75e1e2aa4712045372156719af23c50df78aa4a3e60135af1092f301d6d1afcde19624616a9ebea1363b68") setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e22, 0x977, @rand_addr=' \x01\x00', 0xf0}, @in6={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x3e}, 0xc}, @in6={0xa, 0x4e24, 0x7f, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}], 0x54) bpf$BPF_MAP_FREEZE(0x16, &(0x7f00000000c0)=r2, 0x4) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x100042, 0x1, 0x2}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r7, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 0s ago: executing program 4 (id=1683): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f00000006c0)=ANY=[@ANYBLOB="b40800000000000073114100000000008510000002000000b7000000000000009500c2000000000095000012000000000e09b9445761db3ed82f7be4b9f1628b9a5c40384cb45e62e827e611f21a01a76f66f616553959b478ad3c46bb20e558783b21dd5307760617deec8b1b75c00853ee69e33ba2c01c28950365dd46fcc9f2ac6d20197fd68292e8445824f49b6fba41a316e13e462e31ca00d2622d56318d78e271d364329e7ae732bf8dade587bb30d67e23f78662621b74aabfd8eaf399893bab50fed33101f5a1085f991877907bd6117db675155932860499977f7384a8d94e810492c284fc7cc784ed942bf11d72897a7896f5f8c957984312e9d39eaa478a3065afd52404cb058b"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='ext4_writepages_result\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) close(r3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_GET_PROG_INFO(0x1c, &(0x7f00000003c0)={r0, 0x0, 0x0}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f00000006c0)=ANY=[@ANYBLOB="b40800000000000073114100000000008510000002000000b7000000000000009500c2000000000095000012000000000e09b9445761db3ed82f7be4b9f1628b9a5c40384cb45e62e827e611f21a01a76f66f616553959b478ad3c46bb20e558783b21dd5307760617deec8b1b75c00853ee69e33ba2c01c28950365dd46fcc9f2ac6d20197fd68292e8445824f49b6fba41a316e13e462e31ca00d2622d56318d78e271d364329e7ae732bf8dade587bb30d67e23f78662621b74aabfd8eaf399893bab50fed33101f5a1085f991877907bd6117db675155932860499977f7384a8d94e810492c284fc7cc784ed942bf11d72897a7896f5f8c957984312e9d39eaa478a3065afd52404cb058b"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$BPF_GET_PROG_INFO(0x1c, &(0x7f00000003c0)={r4, 0x0, 0x0}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) socket$inet6(0xa, 0x3, 0x3a) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000000c0)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}) write$tun(r5, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) kernel console output (not intermixed with test programs): 08][ T7621] Cannot find set identified by id 1 to match [ 190.492985][ T7630] __nla_validate_parse: 3 callbacks suppressed [ 190.493006][ T7630] netlink: 8 bytes leftover after parsing attributes in process `syz.4.474'. [ 190.522356][ T7630] netlink: 8 bytes leftover after parsing attributes in process `syz.4.474'. [ 190.537108][ T7630] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 190.850337][ T7641] bond0: (slave syz_tun): Releasing backup interface [ 190.991599][ T9] vxcan1 speed is unknown, defaulting to 1000 [ 191.233937][ T7671] netlink: 28 bytes leftover after parsing attributes in process `syz.4.483'. [ 191.288260][ T7671] netlink: 8 bytes leftover after parsing attributes in process `syz.4.483'. [ 191.369660][ T7675] netlink: 8 bytes leftover after parsing attributes in process `syz.1.486'. [ 191.388578][ T7675] netlink: 8 bytes leftover after parsing attributes in process `syz.1.486'. [ 191.402433][ T7662] netlink: 4 bytes leftover after parsing attributes in process `syz.0.482'. [ 191.422791][ T7675] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 191.642948][ T7689] netlink: 12 bytes leftover after parsing attributes in process `syz.1.489'. [ 191.698711][ T7692] netlink: 28 bytes leftover after parsing attributes in process `syz.2.490'. [ 191.851146][ T7705] netlink: 44 bytes leftover after parsing attributes in process `syz.1.494'. [ 191.971162][ T7714] bridge_slave_0: left allmulticast mode [ 191.995316][ T7714] bridge_slave_0: left promiscuous mode [ 192.002260][ T7714] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.103792][ T7719] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 192.222048][ T7730] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 192.245867][ T7731] netlink: 'syz.1.504': attribute type 1 has an invalid length. [ 192.281861][ T7731] 8021q: adding VLAN 0 to HW filter on device bond1 [ 192.344176][ T7731] 8021q: adding VLAN 0 to HW filter on device bond1 [ 192.372722][ T7731] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 192.391846][ T7731] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 192.468682][ T7736] veth3: entered promiscuous mode [ 192.481428][ T7736] bond1: (slave veth3): Enslaving as an active interface with a down link [ 192.526302][ T7741] 8021q: adding VLAN 0 to HW filter on device bond1 [ 192.533804][ T7731] tipc: Invalid UDP bearer configuration [ 192.533862][ T7731] tipc: Enabling of bearer rejected, failed to enable media [ 192.600785][ T7747] xt_CT: You must specify a L4 protocol and not use inversions on it [ 192.805338][ T7758] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 193.194751][ T7786] hsr0: entered promiscuous mode [ 193.207342][ T7786] macvtap1: entered promiscuous mode [ 193.230384][ T7786] macvtap1: entered allmulticast mode [ 193.250473][ T7786] hsr0: entered allmulticast mode [ 193.276654][ T7786] hsr_slave_0: entered allmulticast mode [ 193.282526][ T7786] hsr_slave_1: entered allmulticast mode [ 193.297411][ T7786] hsr0: left allmulticast mode [ 193.302268][ T7786] hsr_slave_0: left allmulticast mode [ 193.311205][ T7786] hsr_slave_1: left allmulticast mode [ 193.399218][ T7802] atomic_op ffff888066a5a998 conn xmit_atomic 0000000000000000 [ 193.408110][ T7802] atomic_op ffff888066a5a198 conn xmit_atomic 0000000000000000 [ 193.416035][ T7802] atomic_op ffff888066a59998 conn xmit_atomic 0000000000000000 [ 193.424047][ T7802] atomic_op ffff888066a59198 conn xmit_atomic 0000000000000000 [ 193.431988][ T7802] atomic_op ffff888066a58998 conn xmit_atomic 0000000000000000 [ 193.461065][ T7802] atomic_op ffff888066a58198 conn xmit_atomic 0000000000000000 [ 193.470837][ T7802] atomic_op ffff8880662e9198 conn xmit_atomic 0000000000000000 [ 193.492202][ T7802] atomic_op ffff88801a705198 conn xmit_atomic 0000000000000000 [ 193.516225][ T7802] atomic_op ffff88801a703198 conn xmit_atomic 0000000000000000 [ 193.523984][ T7802] atomic_op ffff88801a704198 conn xmit_atomic 0000000000000000 [ 193.550207][ T7806] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 193.946841][ T7827] netlink: 'syz.2.535': attribute type 11 has an invalid length. [ 194.070889][ T7827] netlink: 'syz.2.535': attribute type 39 has an invalid length. [ 194.261980][ T7835] ip6gre1: entered allmulticast mode [ 194.269299][ T62] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 194.337986][ T7841] tipc: Started in network mode [ 194.342935][ T7841] tipc: Node identity 4, cluster identity 4711 [ 194.375735][ T7841] tipc: Node number set to 4 [ 194.419253][ T7845] netdevsim netdevsim2: Direct firmware load for ¸Q failed with error -2 [ 194.438452][ T7845] netdevsim netdevsim2: Falling back to sysfs fallback for: ¸Q [ 194.581044][ T7852] tipc: Started in network mode [ 194.586299][ T7852] tipc: Node identity 4, cluster identity 4711 [ 194.592503][ T7852] tipc: Node number set to 4 [ 194.829481][ T7859] netlink: 'syz.4.547': attribute type 10 has an invalid length. [ 194.838498][ T7859] syz_tun: left promiscuous mode [ 194.854804][ T7859] bond0: (slave syz_tun): Releasing backup interface [ 194.886578][ T7859] team0: Port device syz_tun added [ 195.550780][ T7876] __nla_validate_parse: 103 callbacks suppressed [ 195.550804][ T7876] netlink: 8 bytes leftover after parsing attributes in process `syz.1.552'. [ 195.585403][ T7876] netlink: 8 bytes leftover after parsing attributes in process `syz.1.552'. [ 195.737434][ T7881] tipc: Started in network mode [ 195.742460][ T7881] tipc: Node identity 4, cluster identity 4711 [ 195.765634][ T7881] tipc: Node number set to 4 [ 196.002538][ T7893] netlink: 'syz.3.558': attribute type 10 has an invalid length. [ 196.041291][ T7896] netlink: 8 bytes leftover after parsing attributes in process `syz.1.559'. [ 196.789525][ T7909] netlink: 8 bytes leftover after parsing attributes in process `syz.1.564'. [ 196.838563][ T7909] netlink: 8 bytes leftover after parsing attributes in process `syz.1.564'. [ 197.821592][ T7930] ksmbd: Unknown IPC event: 3, ignore. [ 197.971947][ T7939] netlink: 'syz.0.575': attribute type 8 has an invalid length. [ 197.988194][ T7939] netlink: 12 bytes leftover after parsing attributes in process `syz.0.575'. [ 198.073833][ T7935] syzkaller0: entered promiscuous mode [ 198.093967][ T7935] syzkaller0: entered allmulticast mode [ 198.101515][ T7941] IPVS: Unknown mcast interface: pim6reg1 [ 198.114310][ T7942] IPVS: Unknown mcast interface: pim6reg1 [ 198.515560][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 200.175779][ T7963] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 200.195539][ T7963] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 200.362700][ T7978] netlink: 76 bytes leftover after parsing attributes in process `syz.1.589'. [ 200.556602][ T7987] veth1_to_team: entered promiscuous mode [ 200.617935][ T7987] A link change request failed with some changes committed already. Interface veth1_to_team may have been left with an inconsistent configuration, please check. [ 200.959398][ T8019] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 200.985378][ T13] wlan0: Trigger new scan to find an IBSS to join [ 200.994232][ T8024] netlink: 12 bytes leftover after parsing attributes in process `syz.0.603'. [ 201.028669][ T8027] netlink: 8 bytes leftover after parsing attributes in process `syz.2.600'. [ 201.051753][ T8027] netlink: 4 bytes leftover after parsing attributes in process `syz.2.600'. [ 201.081934][ T8027] netlink: 'syz.2.600': attribute type 15 has an invalid length. [ 201.097194][ T8024] 8021q: adding VLAN 0 to HW filter on device bond2 [ 201.112490][ T8030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.604'. [ 201.152499][ T8034] unsupported nla_type 52263 [ 201.153648][ T8025] 8021q: adding VLAN 0 to HW filter on device bond2 [ 201.164806][ T8025] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 201.176837][ T8025] bond2: (slave wireguard0): Error -95 calling set_mac_address [ 201.347084][ T8041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.608'. [ 201.637654][ T8058] netlink: 216 bytes leftover after parsing attributes in process `syz.1.613'. [ 201.640091][ T8047] vxcan1 speed is unknown, defaulting to 1000 [ 202.540173][ T8092] netlink: 28 bytes leftover after parsing attributes in process `syz.1.620'. [ 202.565235][ T8092] netlink: 28 bytes leftover after parsing attributes in process `syz.1.620'. [ 202.765311][ T8106] tipc: Cannot configure node identity twice [ 203.103589][ T8123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.629'. [ 203.373476][ T8139] netlink: 28 bytes leftover after parsing attributes in process `syz.4.637'. [ 203.382707][ T8139] netlink: 'syz.4.637': attribute type 7 has an invalid length. [ 203.391123][ T8139] netlink: 'syz.4.637': attribute type 8 has an invalid length. [ 203.460632][ T8139] team0: entered promiscuous mode [ 203.476561][ T8139] team_slave_0: entered promiscuous mode [ 203.497085][ T8139] team_slave_1: entered promiscuous mode [ 203.521550][ T8139] syz_tun: entered promiscuous mode [ 203.587607][ T8139] team0: left promiscuous mode [ 203.619731][ T8139] team_slave_0: left promiscuous mode [ 203.651696][ T8139] team_slave_1: left promiscuous mode [ 203.680526][ T8139] syz_tun: left promiscuous mode [ 203.876194][ T5838] block nbd1: Receive control failed (result -104) [ 204.025827][ T36] wlan0: Trigger new scan to find an IBSS to join [ 204.674258][ T8204] tipc: Cannot configure node identity twice [ 204.946241][ T4175] wlan0: Creating new IBSS network, BSSID 12:b4:f3:64:33:db [ 205.137959][ T8225] bridge0: entered allmulticast mode [ 205.164723][ T8225] bridge_slave_1: left allmulticast mode [ 205.172834][ T8225] bridge_slave_1: left promiscuous mode [ 205.182046][ T8225] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.246828][ T8225] bridge_slave_0: left allmulticast mode [ 205.253691][ T8225] bridge_slave_0: left promiscuous mode [ 205.282505][ T8225] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.337959][ T8234] xt_hashlimit: size too large, truncated to 1048576 [ 205.392746][ T8236] batadv_slave_1: entered promiscuous mode [ 205.426229][ T8235] batadv_slave_1: left promiscuous mode [ 205.575812][ T8243] tipc: Cannot configure node identity twice [ 205.712152][ T8245] batadv0: entered promiscuous mode [ 205.729502][ T8245] macvtap1: entered promiscuous mode [ 205.750599][ T8245] macvtap1: entered allmulticast mode [ 205.774079][ T8245] batadv0: entered allmulticast mode [ 205.817410][ T8245] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 206.534273][ T8281] netlink: 'syz.1.681': attribute type 12 has an invalid length. [ 206.556862][ T8281] __nla_validate_parse: 7 callbacks suppressed [ 206.556881][ T8281] netlink: 132 bytes leftover after parsing attributes in process `syz.1.681'. [ 206.577308][ T8250] Cannot find add_set index 0 as target [ 206.790898][ T8291] sctp: [Deprecated]: syz.0.683 (pid 8291) Use of struct sctp_assoc_value in delayed_ack socket option. [ 206.790898][ T8291] Use struct sctp_sack_info instead [ 206.852125][ T8293] openvswitch: netlink: IP tunnel dst address not specified [ 207.099721][ T8308] netlink: 8 bytes leftover after parsing attributes in process `syz.0.687'. [ 207.127251][ T8313] netlink: 8 bytes leftover after parsing attributes in process `syz.3.685'. [ 207.155471][ T8313] netlink: 132 bytes leftover after parsing attributes in process `syz.3.685'. [ 207.225373][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 207.425862][ T8327] netlink: 20 bytes leftover after parsing attributes in process `syz.3.691'. [ 207.524170][ T8339] netlink: 56 bytes leftover after parsing attributes in process `syz.1.694'. [ 207.693861][ T8352] netlink: 8 bytes leftover after parsing attributes in process `syz.2.700'. [ 207.746372][ T8352] netlink: 'syz.2.700': attribute type 1 has an invalid length. [ 207.754482][ T8352] netlink: 'syz.2.700': attribute type 4 has an invalid length. [ 207.794035][ T8352] netlink: 188 bytes leftover after parsing attributes in process `syz.2.700'. [ 207.875943][ T8361] netlink: 16 bytes leftover after parsing attributes in process `syz.1.703'. [ 207.894569][ T8361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.703'. [ 207.922092][ T8361] geneve2: entered promiscuous mode [ 207.951781][ T8361] geneve2: entered allmulticast mode [ 208.107182][ T8374] nbd: device at index 64 is going down [ 208.464684][ T8389] bond1: (slave veth3): Releasing active interface [ 208.981901][ T8416] can: request_module (can-proto-0) failed. [ 209.716133][ T8461] batman_adv: batadv0: Adding interface: macvlan3 [ 209.754469][ T8461] batman_adv: batadv0: The MTU of interface macvlan3 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 209.814472][ T8461] batman_adv: batadv0: Interface activated: macvlan3 [ 209.908324][ T8469] vxcan1 speed is unknown, defaulting to 1000 [ 210.037855][ T5833] Bluetooth: hci4: command 0x0405 tx timeout [ 210.744395][ T8503] netlink: 'syz.1.745': attribute type 1 has an invalid length. [ 210.785244][ T8503] netlink: 'syz.1.745': attribute type 10 has an invalid length. [ 210.793043][ T8503] netlink: 'syz.1.745': attribute type 4 has an invalid length. [ 210.852302][ T8505] x_tables: ip_tables: IDLETIMER.0 target: invalid size 40 (kernel) != (user) 29 [ 211.044472][ T8472] vxcan1 speed is unknown, defaulting to 1000 [ 211.867160][ T5838] Bluetooth: hci3: command 0x0406 tx timeout [ 211.868021][ T5833] Bluetooth: hci1: command 0x0406 tx timeout [ 211.874809][ T5837] Bluetooth: hci2: command 0x0406 tx timeout [ 211.982155][ T8549] __nla_validate_parse: 14 callbacks suppressed [ 211.982175][ T8549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.759'. [ 212.281081][ T8560] Bluetooth: MGMT ver 1.23 [ 212.448391][ T8560] geneve2: entered promiscuous mode [ 213.068359][ T8603] FAULT_INJECTION: forcing a failure. [ 213.068359][ T8603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 213.109040][ T8603] CPU: 1 UID: 0 PID: 8603 Comm: syz.2.776 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 213.109071][ T8603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 213.109083][ T8603] Call Trace: [ 213.109091][ T8603] [ 213.109100][ T8603] dump_stack_lvl+0x189/0x250 [ 213.109132][ T8603] ? __lock_acquire+0xaac/0xd20 [ 213.109164][ T8603] ? __pfx_dump_stack_lvl+0x10/0x10 [ 213.109193][ T8603] ? __pfx__printk+0x10/0x10 [ 213.109213][ T8603] ? __might_fault+0xb0/0x130 [ 213.109251][ T8603] should_fail_ex+0x414/0x560 [ 213.109279][ T8603] _copy_from_user+0x2d/0xb0 [ 213.109308][ T8603] __sys_bpf+0x1ed/0x860 [ 213.109336][ T8603] ? __pfx___sys_bpf+0x10/0x10 [ 213.109376][ T8603] ? ksys_write+0x1f0/0x250 [ 213.109398][ T8603] ? rcu_is_watching+0x15/0xb0 [ 213.109428][ T8603] __x64_sys_bpf+0x7c/0x90 [ 213.109452][ T8603] do_syscall_64+0xf6/0x210 [ 213.109476][ T8603] ? clear_bhb_loop+0x60/0xb0 [ 213.109501][ T8603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.109519][ T8603] RIP: 0033:0x7f1427d8e969 [ 213.109536][ T8603] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 213.109552][ T8603] RSP: 002b:00007f1428b5b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 213.109573][ T8603] RAX: ffffffffffffffda RBX: 00007f1427fb5fa0 RCX: 00007f1427d8e969 [ 213.109587][ T8603] RDX: 000000000000004c RSI: 0000200000000040 RDI: 000000000000000a [ 213.109600][ T8603] RBP: 00007f1428b5b090 R08: 0000000000000000 R09: 0000000000000000 [ 213.109612][ T8603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.109623][ T8603] R13: 0000000000000000 R14: 00007f1427fb5fa0 R15: 00007ffff4929a38 [ 213.109652][ T8603] [ 213.236052][ T8599] syzkaller0: entered promiscuous mode [ 213.308366][ T8599] syzkaller0: entered allmulticast mode [ 214.142252][ T8627] FAULT_INJECTION: forcing a failure. [ 214.142252][ T8627] name failslab, interval 1, probability 0, space 0, times 0 [ 214.165681][ T8627] CPU: 0 UID: 0 PID: 8627 Comm: syz.1.782 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 214.165710][ T8627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 214.165721][ T8627] Call Trace: [ 214.165729][ T8627] [ 214.165738][ T8627] dump_stack_lvl+0x189/0x250 [ 214.165774][ T8627] ? __pfx_dump_stack_lvl+0x10/0x10 [ 214.165801][ T8627] ? __pfx__printk+0x10/0x10 [ 214.165823][ T8627] ? __pfx___might_resched+0x10/0x10 [ 214.165842][ T8627] ? fs_reclaim_acquire+0x7d/0x100 [ 214.165875][ T8627] should_fail_ex+0x414/0x560 [ 214.165902][ T8627] should_failslab+0xa8/0x100 [ 214.165929][ T8627] __kmalloc_noprof+0xcb/0x4f0 [ 214.165953][ T8627] ? sock_kmalloc+0xd6/0x160 [ 214.165975][ T8627] sock_kmalloc+0xd6/0x160 [ 214.165995][ T8627] skcipher_recvmsg+0x55c/0x11c0 [ 214.166039][ T8627] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 214.166065][ T8627] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 214.166086][ T8627] ? security_socket_recvmsg+0x7e/0x2e0 [ 214.166112][ T8627] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 214.166135][ T8627] sock_recvmsg+0x229/0x270 [ 214.166161][ T8627] ____sys_recvmsg+0x1c9/0x460 [ 214.166200][ T8627] ? __pfx_____sys_recvmsg+0x10/0x10 [ 214.166245][ T8627] ? import_iovec+0x74/0xa0 [ 214.166277][ T8627] ___sys_recvmsg+0x1b5/0x510 [ 214.166311][ T8627] ? __pfx____sys_recvmsg+0x10/0x10 [ 214.166367][ T8627] ? __fget_files+0x3a0/0x420 [ 214.166405][ T8627] do_recvmmsg+0x307/0x760 [ 214.166434][ T8627] ? __pfx_do_recvmmsg+0x10/0x10 [ 214.166464][ T8627] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 214.166505][ T8627] __x64_sys_recvmmsg+0x190/0x240 [ 214.166522][ T8627] ? rcu_is_watching+0x15/0xb0 [ 214.166541][ T8627] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 214.166563][ T8627] ? do_syscall_64+0xba/0x210 [ 214.166590][ T8627] do_syscall_64+0xf6/0x210 [ 214.166612][ T8627] ? clear_bhb_loop+0x60/0xb0 [ 214.166635][ T8627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.166653][ T8627] RIP: 0033:0x7fbb8638e969 [ 214.166680][ T8627] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 214.166695][ T8627] RSP: 002b:00007fbb87273038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 214.166715][ T8627] RAX: ffffffffffffffda RBX: 00007fbb865b5fa0 RCX: 00007fbb8638e969 [ 214.166728][ T8627] RDX: 0000000000000001 RSI: 0000200000003000 RDI: 0000000000000004 [ 214.166740][ T8627] RBP: 00007fbb87273090 R08: 0000000000000000 R09: 0000000000000000 [ 214.166751][ T8627] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 214.166761][ T8627] R13: 0000000000000000 R14: 00007fbb865b5fa0 R15: 00007ffc689047a8 [ 214.166792][ T8627] [ 215.699847][ T8647] netlink: 'syz.4.785': attribute type 1 has an invalid length. [ 215.765650][ T8651] netlink: 20 bytes leftover after parsing attributes in process `syz.4.785'. [ 215.958342][ T8657] netlink: 12 bytes leftover after parsing attributes in process `syz.0.789'. [ 216.282095][ T8672] FAULT_INJECTION: forcing a failure. [ 216.282095][ T8672] name failslab, interval 1, probability 0, space 0, times 0 [ 216.297050][ T8672] CPU: 1 UID: 0 PID: 8672 Comm: syz.3.793 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 216.297071][ T8672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 216.297080][ T8672] Call Trace: [ 216.297086][ T8672] [ 216.297093][ T8672] dump_stack_lvl+0x189/0x250 [ 216.297121][ T8672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 216.297142][ T8672] ? __pfx__printk+0x10/0x10 [ 216.297162][ T8672] ? __pfx___might_resched+0x10/0x10 [ 216.297176][ T8672] ? fs_reclaim_acquire+0x7d/0x100 [ 216.297202][ T8672] should_fail_ex+0x414/0x560 [ 216.297223][ T8672] should_failslab+0xa8/0x100 [ 216.297244][ T8672] __kmalloc_noprof+0xcb/0x4f0 [ 216.297263][ T8672] ? skcipher_next_slow+0xee/0x230 [ 216.297289][ T8672] skcipher_next_slow+0xee/0x230 [ 216.297309][ T8672] ecb_decrypt+0x1f0/0x270 [ 216.297327][ T8672] ? kfree+0x193/0x440 [ 216.297345][ T8672] ? __pfx_ecb_decrypt+0x10/0x10 [ 216.297372][ T8672] ? simd_skcipher_decrypt+0x51/0x130 [ 216.297389][ T8672] ? irq_fpu_usable+0x8d/0xc0 [ 216.297409][ T8672] ? cryptd_skcipher_child+0xd/0x40 [ 216.297432][ T8672] skcipher_recvmsg+0xb11/0x11c0 [ 216.297464][ T8672] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 216.297484][ T8672] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 216.297500][ T8672] ? security_socket_recvmsg+0x7e/0x2e0 [ 216.297522][ T8672] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 216.297541][ T8672] sock_recvmsg+0x229/0x270 [ 216.297563][ T8672] ____sys_recvmsg+0x1c9/0x460 [ 216.297603][ T8672] ? __pfx_____sys_recvmsg+0x10/0x10 [ 216.297652][ T8672] ? import_iovec+0x74/0xa0 [ 216.297686][ T8672] ___sys_recvmsg+0x1b5/0x510 [ 216.297719][ T8672] ? __pfx____sys_recvmsg+0x10/0x10 [ 216.297761][ T8672] ? __fget_files+0x3a0/0x420 [ 216.297790][ T8672] do_recvmmsg+0x307/0x760 [ 216.297810][ T8672] ? __pfx_do_recvmmsg+0x10/0x10 [ 216.297833][ T8672] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 216.297864][ T8672] __x64_sys_recvmmsg+0x190/0x240 [ 216.297880][ T8672] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 216.297897][ T8672] ? do_syscall_64+0xba/0x210 [ 216.297917][ T8672] do_syscall_64+0xf6/0x210 [ 216.297934][ T8672] ? clear_bhb_loop+0x60/0xb0 [ 216.297952][ T8672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.297966][ T8672] RIP: 0033:0x7f450418e969 [ 216.297984][ T8672] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.297995][ T8672] RSP: 002b:00007f4501ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 216.298011][ T8672] RAX: ffffffffffffffda RBX: 00007f45043b5fa0 RCX: 00007f450418e969 [ 216.298021][ T8672] RDX: 0000000000000001 RSI: 0000200000003000 RDI: 0000000000000004 [ 216.298029][ T8672] RBP: 00007f4501ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 216.298038][ T8672] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 216.298046][ T8672] R13: 0000000000000000 R14: 00007f45043b5fa0 R15: 00007ffcbde6ff48 [ 216.298069][ T8672] [ 216.659703][ T8674] FAULT_INJECTION: forcing a failure. [ 216.659703][ T8674] name failslab, interval 1, probability 0, space 0, times 0 [ 216.680371][ T8674] CPU: 0 UID: 0 PID: 8674 Comm: syz.3.794 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 216.680401][ T8674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 216.680414][ T8674] Call Trace: [ 216.680422][ T8674] [ 216.680431][ T8674] dump_stack_lvl+0x189/0x250 [ 216.680469][ T8674] ? __pfx_dump_stack_lvl+0x10/0x10 [ 216.680498][ T8674] ? __pfx__printk+0x10/0x10 [ 216.680522][ T8674] ? __pfx___might_resched+0x10/0x10 [ 216.680543][ T8674] ? fs_reclaim_acquire+0x7d/0x100 [ 216.680579][ T8674] should_fail_ex+0x414/0x560 [ 216.680607][ T8674] should_failslab+0xa8/0x100 [ 216.680637][ T8674] __kmalloc_noprof+0xcb/0x4f0 [ 216.680662][ T8674] ? sock_kmalloc+0xd6/0x160 [ 216.680687][ T8674] sock_kmalloc+0xd6/0x160 [ 216.680710][ T8674] skcipher_recvmsg+0x55c/0x11c0 [ 216.680756][ T8674] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 216.680785][ T8674] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 216.680808][ T8674] ? security_socket_recvmsg+0x7e/0x2e0 [ 216.680838][ T8674] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 216.680861][ T8674] sock_recvmsg+0x229/0x270 [ 216.680890][ T8674] ____sys_recvmsg+0x1c9/0x460 [ 216.680931][ T8674] ? __pfx_____sys_recvmsg+0x10/0x10 [ 216.680980][ T8674] ? import_iovec+0x74/0xa0 [ 216.681014][ T8674] ___sys_recvmsg+0x1b5/0x510 [ 216.681052][ T8674] ? __pfx____sys_recvmsg+0x10/0x10 [ 216.681111][ T8674] ? __fget_files+0x3a0/0x420 [ 216.681151][ T8674] __x64_sys_recvmsg+0x198/0x260 [ 216.681186][ T8674] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 216.681245][ T8674] ? do_syscall_64+0xba/0x210 [ 216.681273][ T8674] do_syscall_64+0xf6/0x210 [ 216.681297][ T8674] ? clear_bhb_loop+0x60/0xb0 [ 216.681322][ T8674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.681341][ T8674] RIP: 0033:0x7f450418e969 [ 216.681358][ T8674] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.681374][ T8674] RSP: 002b:00007f4501ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 216.681396][ T8674] RAX: ffffffffffffffda RBX: 00007f45043b5fa0 RCX: 00007f450418e969 [ 216.681411][ T8674] RDX: 0000000000000002 RSI: 0000200000000100 RDI: 0000000000000004 [ 216.681423][ T8674] RBP: 00007f4501ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 216.681436][ T8674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 216.681447][ T8674] R13: 0000000000000000 R14: 00007f45043b5fa0 R15: 00007ffcbde6ff48 [ 216.681479][ T8674] [ 217.326073][ T8709] FAULT_INJECTION: forcing a failure. [ 217.326073][ T8709] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 217.371481][ T8709] CPU: 0 UID: 0 PID: 8709 Comm: syz.2.804 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 217.371519][ T8709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 217.371532][ T8709] Call Trace: [ 217.371540][ T8709] [ 217.371548][ T8709] dump_stack_lvl+0x189/0x250 [ 217.371586][ T8709] ? __pfx_dump_stack_lvl+0x10/0x10 [ 217.371615][ T8709] ? __pfx__printk+0x10/0x10 [ 217.371650][ T8709] should_fail_ex+0x414/0x560 [ 217.371678][ T8709] _copy_to_user+0x31/0xb0 [ 217.371711][ T8709] simple_read_from_buffer+0xe1/0x170 [ 217.371743][ T8709] proc_fail_nth_read+0x1df/0x250 [ 217.371777][ T8709] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 217.371811][ T8709] ? rw_verify_area+0x258/0x650 [ 217.371834][ T8709] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 217.371865][ T8709] vfs_read+0x1fd/0x980 [ 217.371894][ T8709] ? __pfx___mutex_lock+0x10/0x10 [ 217.371918][ T8709] ? __pfx_vfs_read+0x10/0x10 [ 217.371942][ T8709] ? __fget_files+0x2a/0x420 [ 217.371974][ T8709] ? __fget_files+0x3a0/0x420 [ 217.372000][ T8709] ? __fget_files+0x2a/0x420 [ 217.372037][ T8709] ksys_read+0x145/0x250 [ 217.372059][ T8709] ? rcu_is_watching+0x15/0xb0 [ 217.372080][ T8709] ? __pfx_ksys_read+0x10/0x10 [ 217.372108][ T8709] ? do_syscall_64+0xba/0x210 [ 217.372136][ T8709] do_syscall_64+0xf6/0x210 [ 217.372160][ T8709] ? clear_bhb_loop+0x60/0xb0 [ 217.372184][ T8709] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.372204][ T8709] RIP: 0033:0x7f1427d8d37c [ 217.372220][ T8709] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 217.372237][ T8709] RSP: 002b:00007f1428b5b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 217.372258][ T8709] RAX: ffffffffffffffda RBX: 00007f1427fb5fa0 RCX: 00007f1427d8d37c [ 217.372272][ T8709] RDX: 000000000000000f RSI: 00007f1428b5b0a0 RDI: 0000000000000005 [ 217.372285][ T8709] RBP: 00007f1428b5b090 R08: 0000000000000000 R09: 0000000000000000 [ 217.372297][ T8709] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 217.372308][ T8709] R13: 0000000000000000 R14: 00007f1427fb5fa0 R15: 00007ffff4929a38 [ 217.372340][ T8709] [ 217.681817][ T8718] netlink: 'syz.0.807': attribute type 39 has an invalid length. [ 218.085439][ T8738] netlink: 'syz.0.815': attribute type 1 has an invalid length. [ 218.319583][ T8749] netlink: 40 bytes leftover after parsing attributes in process `syz.1.818'. [ 218.342154][ T8743] netlink: 4 bytes leftover after parsing attributes in process `syz.0.816'. [ 218.362566][ T8749] netlink: 112 bytes leftover after parsing attributes in process `syz.1.818'. [ 218.518636][ T8753] netlink: 16 bytes leftover after parsing attributes in process `syz.1.820'. [ 218.892532][ T8777] !: renamed from dummy0 [ 219.611138][ T8811] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 219.813606][ T8823] netlink: 'syz.2.839': attribute type 29 has an invalid length. [ 219.842790][ T8825] FAULT_INJECTION: forcing a failure. [ 219.842790][ T8825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 219.865949][ T8825] CPU: 0 UID: 0 PID: 8825 Comm: syz.0.840 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 219.865979][ T8825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 219.865991][ T8825] Call Trace: [ 219.865999][ T8825] [ 219.866008][ T8825] dump_stack_lvl+0x189/0x250 [ 219.866057][ T8825] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.866087][ T8825] ? __pfx__printk+0x10/0x10 [ 219.866121][ T8825] should_fail_ex+0x414/0x560 [ 219.866148][ T8825] _copy_to_user+0x31/0xb0 [ 219.866180][ T8825] bpf_test_finish+0x4d1/0x660 [ 219.866214][ T8825] ? __pfx_bpf_test_finish+0x10/0x10 [ 219.866249][ T8825] ? bpf_test_init+0x133/0x170 [ 219.866278][ T8825] bpf_prog_test_run_xdp+0x79a/0xf90 [ 219.866324][ T8825] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 219.866357][ T8825] ? __fget_files+0x2a/0x420 [ 219.866390][ T8825] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 219.866420][ T8825] bpf_prog_test_run+0x2ac/0x340 [ 219.866452][ T8825] __sys_bpf+0x4a4/0x860 [ 219.866480][ T8825] ? __pfx___sys_bpf+0x10/0x10 [ 219.866520][ T8825] ? ksys_write+0x1f0/0x250 [ 219.866542][ T8825] ? rcu_is_watching+0x15/0xb0 [ 219.866572][ T8825] __x64_sys_bpf+0x7c/0x90 [ 219.866595][ T8825] do_syscall_64+0xf6/0x210 [ 219.866620][ T8825] ? clear_bhb_loop+0x60/0xb0 [ 219.866644][ T8825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.866663][ T8825] RIP: 0033:0x7f83d718e969 [ 219.866681][ T8825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.866697][ T8825] RSP: 002b:00007f83d808d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 219.866718][ T8825] RAX: ffffffffffffffda RBX: 00007f83d73b5fa0 RCX: 00007f83d718e969 [ 219.866732][ T8825] RDX: 000000000000004c RSI: 0000200000000040 RDI: 000000000000000a [ 219.866745][ T8825] RBP: 00007f83d808d090 R08: 0000000000000000 R09: 0000000000000000 [ 219.866757][ T8825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 219.866768][ T8825] R13: 0000000000000000 R14: 00007f83d73b5fa0 R15: 00007ffc8d6da2e8 [ 219.866799][ T8825] [ 220.138758][ T8829] Cannot find add_set index 4 as target [ 220.364328][ T8843] Cannot find add_set index 0 as target [ 220.397366][ T8845] netlink: 88 bytes leftover after parsing attributes in process `syz.4.847'. [ 220.462650][ T8848] netlink: 'syz.2.846': attribute type 1 has an invalid length. [ 220.473068][ T8849] netlink: 8 bytes leftover after parsing attributes in process `syz.2.846'. [ 220.521138][ T8848] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 220.535520][ T8849] netlink: 3 bytes leftover after parsing attributes in process `syz.2.846'. [ 220.578409][ T8849] batadv1: entered promiscuous mode [ 220.583763][ T8849] batadv1: entered allmulticast mode [ 220.641228][ T8858] netlink: 44 bytes leftover after parsing attributes in process `syz.0.850'. [ 220.653340][ T8858] netlink: 43 bytes leftover after parsing attributes in process `syz.0.850'. [ 220.681184][ T8858] netlink: 'syz.0.850': attribute type 6 has an invalid length. [ 220.705386][ T8858] netlink: 'syz.0.850': attribute type 5 has an invalid length. [ 220.719086][ T8865] FAULT_INJECTION: forcing a failure. [ 220.719086][ T8865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 220.735377][ T8858] netlink: 43 bytes leftover after parsing attributes in process `syz.0.850'. [ 220.755478][ T8865] CPU: 1 UID: 0 PID: 8865 Comm: syz.3.853 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 220.755511][ T8865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 220.755524][ T8865] Call Trace: [ 220.755532][ T8865] [ 220.755541][ T8865] dump_stack_lvl+0x189/0x250 [ 220.755579][ T8865] ? __pfx_dump_stack_lvl+0x10/0x10 [ 220.755608][ T8865] ? __pfx__printk+0x10/0x10 [ 220.755642][ T8865] should_fail_ex+0x414/0x560 [ 220.755670][ T8865] _copy_to_user+0x31/0xb0 [ 220.755703][ T8865] bpf_test_finish+0x500/0x660 [ 220.755738][ T8865] ? __pfx_bpf_test_finish+0x10/0x10 [ 220.755773][ T8865] ? bpf_test_init+0x133/0x170 [ 220.755802][ T8865] bpf_prog_test_run_xdp+0x79a/0xf90 [ 220.755848][ T8865] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 220.755881][ T8865] ? __fget_files+0x2a/0x420 [ 220.755914][ T8865] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 220.755943][ T8865] bpf_prog_test_run+0x2ac/0x340 [ 220.755976][ T8865] __sys_bpf+0x4a4/0x860 [ 220.756005][ T8865] ? __pfx___sys_bpf+0x10/0x10 [ 220.756043][ T8865] ? ksys_write+0x1f0/0x250 [ 220.756065][ T8865] ? rcu_is_watching+0x15/0xb0 [ 220.756095][ T8865] __x64_sys_bpf+0x7c/0x90 [ 220.756120][ T8865] do_syscall_64+0xf6/0x210 [ 220.756145][ T8865] ? clear_bhb_loop+0x60/0xb0 [ 220.756170][ T8865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.756198][ T8865] RIP: 0033:0x7f450418e969 [ 220.756222][ T8865] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 220.756246][ T8865] RSP: 002b:00007f4501ff6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 220.756274][ T8865] RAX: ffffffffffffffda RBX: 00007f45043b5fa0 RCX: 00007f450418e969 [ 220.756294][ T8865] RDX: 000000000000004c RSI: 0000200000000040 RDI: 000000000000000a [ 220.756313][ T8865] RBP: 00007f4501ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 220.756325][ T8865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 220.756353][ T8865] R13: 0000000000000000 R14: 00007f45043b5fa0 R15: 00007ffcbde6ff48 [ 220.756384][ T8865] [ 220.993227][ T8868] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:2000:0000 with DS=0x1 [ 221.131483][ T8879] vxcan1 speed is unknown, defaulting to 1000 [ 221.570678][ T8912] netlink: 'syz.1.864': attribute type 11 has an invalid length. [ 221.612366][ T8912] netlink: 'syz.1.864': attribute type 4 has an invalid length. [ 222.726097][ T8946] netlink: 'syz.1.874': attribute type 1 has an invalid length. [ 222.780764][ T8943] vxcan1 speed is unknown, defaulting to 1000 [ 223.162285][ T8947] vxcan1 speed is unknown, defaulting to 1000 [ 223.233500][ T8954] ipvlan2: entered promiscuous mode [ 223.255192][ T8954] ipvlan2: entered allmulticast mode [ 223.260563][ T8954] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 223.865304][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 223.900270][ T8965] vxcan1 speed is unknown, defaulting to 1000 [ 225.139596][ T8990] netlink: 'syz.1.886': attribute type 1 has an invalid length. [ 225.163717][ T8990] netlink: 'syz.1.886': attribute type 2 has an invalid length. [ 225.361041][ T9001] __nla_validate_parse: 4 callbacks suppressed [ 225.361062][ T9001] netlink: 8 bytes leftover after parsing attributes in process `syz.3.889'. [ 225.401564][ T9000] netlink: 'syz.3.889': attribute type 1 has an invalid length. [ 225.840842][ T9012] veth1_to_peam: renamed from gre0 (while UP) [ 225.938638][ T9012] veth1_to_peam: entered promiscuous mode [ 225.989528][ T9012] A link change request failed with some changes committed already. Interface veth1_to_peam may have been left with an inconsistent configuration, please check. [ 226.168387][ T9021] vxcan1 speed is unknown, defaulting to 1000 [ 226.323818][ T9027] netlink: 12 bytes leftover after parsing attributes in process `syz.1.898'. [ 226.417212][ T9027] netlink: 8 bytes leftover after parsing attributes in process `syz.1.898'. [ 226.637414][ T9034] No such timeout policy "syz0" [ 226.781955][ T9036] vxcan1 speed is unknown, defaulting to 1000 [ 226.878724][ T9044] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 226.895404][ T9044] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 226.970026][ T975] IPVS: starting estimator thread 0... [ 227.035448][ T9046] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 227.075945][ T9047] IPVS: using max 27 ests per chain, 64800 per kthread [ 227.188341][ T9054] netlink: 20 bytes leftover after parsing attributes in process `syz.1.908'. [ 227.199473][ T9054] netlink: 20 bytes leftover after parsing attributes in process `syz.1.908'. [ 227.214809][ T9054] netlink: 48 bytes leftover after parsing attributes in process `syz.1.908'. [ 227.298125][ T9058] veth1_macvtap: left promiscuous mode [ 228.613747][ T9097] netlink: 'syz.1.923': attribute type 3 has an invalid length. [ 228.752105][ T9094] vxcan1 speed is unknown, defaulting to 1000 [ 229.034982][ T9110] veth1_to_team: entered promiscuous mode [ 229.186479][ T9121] netlink: 12 bytes leftover after parsing attributes in process `syz.4.932'. [ 229.207990][ T9122] netlink: 744 bytes leftover after parsing attributes in process `syz.3.931'. [ 229.401531][ T9132] Bluetooth: MGMT ver 1.23 [ 229.440719][ T9132] netlink: 4 bytes leftover after parsing attributes in process `syz.3.936'. [ 229.566903][ T9140] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 229.693944][ T9146] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 229.904049][ T9153] netlink: 12 bytes leftover after parsing attributes in process `syz.3.942'. [ 230.094618][ T9160] netlink: 'syz.3.944': attribute type 42 has an invalid length. [ 230.156910][ T9157] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 230.408564][ T9180] __nla_validate_parse: 1 callbacks suppressed [ 230.408584][ T9180] netlink: 12 bytes leftover after parsing attributes in process `syz.3.950'. [ 230.690537][ T9194] netlink: 36 bytes leftover after parsing attributes in process `syz.2.958'. [ 230.690537][ T9195] netlink: 36 bytes leftover after parsing attributes in process `syz.2.958'. [ 230.692114][ T9195] netlink: 256 bytes leftover after parsing attributes in process `syz.2.958'. [ 231.385785][ T9232] bond0: entered promiscuous mode [ 231.390995][ T9232] bond_slave_0: entered promiscuous mode [ 231.399395][ T9232] bond_slave_1: entered promiscuous mode [ 231.423178][ T9232] batadv0: entered promiscuous mode [ 231.467417][ T9232] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 231.494099][ T9232] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 231.513807][ T9232] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 231.524770][ T9232] bond0: left promiscuous mode [ 231.530179][ T9232] bond_slave_0: left promiscuous mode [ 231.538204][ T9232] bond_slave_1: left promiscuous mode [ 231.548847][ T9232] batadv0: left promiscuous mode [ 231.636419][ T9247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.978'. [ 231.690272][ T9251] netlink: 40 bytes leftover after parsing attributes in process `syz.4.979'. [ 231.811705][ T9263] netlink: 80 bytes leftover after parsing attributes in process `syz.4.979'. [ 232.051141][ T9279] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 232.695439][ T9305] netlink: 'syz.4.993': attribute type 1 has an invalid length. [ 232.704421][ T9305] netlink: 224 bytes leftover after parsing attributes in process `syz.4.993'. [ 233.027904][ T9335] netlink: 'syz.2.1002': attribute type 33 has an invalid length. [ 233.036038][ T9335] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1002'. [ 233.128201][ T30] audit: type=1800 audit(1748314962.454:3): pid=9340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1003" name="memory.events" dev="tmpfs" ino=958 res=0 errno=0 [ 233.383136][ T9352] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1006'. [ 233.676634][ T9372] vxcan1 speed is unknown, defaulting to 1000 [ 234.148755][ T9402] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.206247][ T9404] netlink: 'syz.3.1014': attribute type 25 has an invalid length. [ 234.289579][ T9402] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.514161][ T9402] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.605976][ T9402] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 234.802215][ T9402] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.914183][ T9402] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 234.961653][ T9374] openvswitch: netlink: Multiple metadata blocks provided [ 234.979173][ T9402] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.038759][ T9402] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 235.348002][ T9457] netlink: 'syz.1.1027': attribute type 13 has an invalid length. [ 235.571337][ T9466] __nla_validate_parse: 1 callbacks suppressed [ 235.571357][ T9466] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1030'. [ 235.722023][ T9468] netlink: 'syz.3.1031': attribute type 1 has an invalid length. [ 235.735133][ T9468] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1031'. [ 236.013844][ T9457] batadv0: left allmulticast mode [ 236.053162][ T9457] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.062813][ T9457] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.072641][ T9457] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.084125][ T9457] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.149642][ T5829] vxcan1 speed is unknown, defaulting to 1000 [ 236.176474][ T5829] syz2: Port: 1 Link DOWN [ 236.187169][ T5829] vxcan1 speed is unknown, defaulting to 1000 [ 237.316507][ T8900] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 257.785351][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 257.945304][ T5834] Bluetooth: hci4: command 0x0405 tx timeout [ 281.029527][ T9488] SET target dimension over the limit! [ 281.093577][ T9496] tap0: tun_chr_ioctl cmd 1074025677 [ 281.108934][ T9496] tap0: linktype set to 778 [ 281.354943][ T9510] netlink: 16162 bytes leftover after parsing attributes in process `syz.4.1042'. [ 281.547122][ T9516] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1044'. [ 281.924299][ T9540] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1053'. [ 282.121797][ T9547] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1055'. [ 282.304260][ T9559] vxcan1 speed is unknown, defaulting to 1000 [ 282.359248][ T9562] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1057'. [ 282.384527][ T9562] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1057'. [ 282.406004][ T9565] sctp: [Deprecated]: syz.3.1062 (pid 9565) Use of int in maxseg socket option. [ 282.406004][ T9565] Use struct sctp_assoc_value instead [ 282.434438][ T9568] x_tables: ip_tables: IDLETIMER.0 target: invalid size 40 (kernel) != (user) 29 [ 282.690279][ T9584] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1065'. [ 283.048355][ T9586] vxcan1 speed is unknown, defaulting to 1000 [ 283.233464][ T9593] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1067'. [ 283.890929][ T9635] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1079'. [ 283.942447][ T9635] bond0: (slave macvlan3): Opening slave failed [ 284.183885][ T9640] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1078'. [ 284.723856][ T9655] vxcan1 speed is unknown, defaulting to 1000 [ 284.986088][ T9673] bridge0: entered promiscuous mode [ 284.991909][ T9673] macvtap1: entered allmulticast mode [ 285.026347][ T9673] bridge0: entered allmulticast mode [ 285.048702][ T9673] bridge0: port 1(macvtap1) entered blocking state [ 285.073588][ T9673] bridge0: port 1(macvtap1) entered disabled state [ 285.095421][ T9673] bridge0: left allmulticast mode [ 285.100933][ T9673] bridge0: left promiscuous mode [ 285.421642][ T9686] syzkaller0: entered promiscuous mode [ 285.428759][ T9686] syzkaller0: entered allmulticast mode [ 285.906020][ T9707] block nbd2: server does not support multiple connections per device. [ 285.918987][ T9707] block nbd2: shutting down sockets [ 286.376016][ T9727] __nla_validate_parse: 8 callbacks suppressed [ 286.376038][ T9727] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1107'. [ 287.048498][ T9764] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 287.075646][ T9764] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1121'. [ 287.093244][ T9772] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1123'. [ 287.094949][ T9764] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1121'. [ 287.113367][ T9772] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1123'. [ 287.127766][ T9769] netlink: 'syz.2.1124': attribute type 21 has an invalid length. [ 287.145935][ T9769] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1124'. [ 287.159810][ T9770] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1123'. [ 287.184310][ T9770] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1123'. [ 287.521030][ T9799] netlink: 'syz.3.1132': attribute type 12 has an invalid length. [ 287.552697][ T9799] netlink: 'syz.3.1132': attribute type 15 has an invalid length. [ 287.757687][ T9810] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1136'. [ 288.575954][ T9823] vxcan1 speed is unknown, defaulting to 1000 [ 289.065288][ T5844] Bluetooth: hci0: command tx timeout [ 290.014594][ T9878] lo speed is unknown, defaulting to 1000 [ 290.023831][ T9878] lo speed is unknown, defaulting to 1000 [ 290.031087][ T9878] lo speed is unknown, defaulting to 1000 [ 290.041815][ T9878] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 290.103528][ T9878] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 290.188799][ T9878] lo speed is unknown, defaulting to 1000 [ 290.199311][ T9878] lo speed is unknown, defaulting to 1000 [ 290.228811][ T9878] lo speed is unknown, defaulting to 1000 [ 290.236682][ T9878] lo speed is unknown, defaulting to 1000 [ 290.244896][ T9878] lo speed is unknown, defaulting to 1000 [ 290.299198][ T9890] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1162'. [ 290.788858][ T9903] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 290.887014][ T9908] tipc: New replicast peer: 255.255.255.255 [ 290.897222][ T9908] tipc: Enabled bearer , priority 10 [ 291.518897][ T9933] ip6gre1: entered allmulticast mode [ 291.538187][ T9937] __nla_validate_parse: 2 callbacks suppressed [ 291.538209][ T9937] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1174'. [ 291.583429][ T9939] netlink: 'syz.2.1175': attribute type 1 has an invalid length. [ 291.592380][ T9935] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1173'. [ 291.614315][ T9934] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1173'. [ 291.626699][ T9939] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1175'. [ 291.903353][ T9948] netlink: 'syz.2.1177': attribute type 39 has an invalid length. [ 292.260605][ T8900] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.502977][ T8900] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.617451][ T8900] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.703388][ T8900] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.000899][ T9971] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1188'. [ 293.599726][ T5834] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 293.612091][ T5834] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 293.621726][ T5834] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 293.632045][ T5834] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 293.647644][ T5834] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 293.962072][ T8900] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 294.003490][ T8900] bond0 (unregistering): Released all slaves [ 294.031128][ T8900] bond1 (unregistering): Released all slaves [ 294.061463][ T8900] bond2 (unregistering): Released all slaves [ 294.298299][ T8900] tipc: Disabling bearer [ 294.315019][ T8900] tipc: Left network mode [ 294.323354][ T9987] vxcan1 speed is unknown, defaulting to 1000 [ 294.482749][T10004] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1196'. [ 294.648453][T10011] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1199'. [ 294.699070][T10012] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1199'. [ 294.751459][T10014] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1200'. [ 294.899119][ T9987] lo speed is unknown, defaulting to 1000 [ 294.946228][T10020] netlink: 'syz.4.1202': attribute type 10 has an invalid length. [ 294.957615][T10018] openvswitch: netlink: Actions may not be safe on all matching packets [ 295.014044][T10020] veth0_vlan: left promiscuous mode [ 295.056538][T10020] veth0_vlan: entered promiscuous mode [ 295.084568][T10020] team0: Device veth0_vlan failed to register rx_handler [ 295.136355][T10026] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1203'. [ 295.715604][ T5844] Bluetooth: hci3: command tx timeout [ 295.808673][ T8900] hsr_slave_0: left promiscuous mode [ 295.817747][ T8900] hsr_slave_1: left promiscuous mode [ 295.848358][ T8900] veth1_macvtap: left promiscuous mode [ 295.854533][ T8900] veth0_macvtap: left promiscuous mode [ 295.860843][ T8900] veth1_vlan: left promiscuous mode [ 295.868657][ T8900] veth0_vlan: left promiscuous mode [ 296.689620][T10050] __nla_validate_parse: 2 callbacks suppressed [ 296.689667][T10050] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1208'. [ 297.510769][T10061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1212'. [ 297.569938][T10059] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1211'. [ 297.625299][T10059] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1211'. [ 297.715522][T10067] netlink: 'syz.0.1213': attribute type 4 has an invalid length. [ 297.784570][ T9987] chnl_net:caif_netlink_parms(): no params data found [ 297.792245][ T5844] Bluetooth: hci3: command tx timeout [ 297.969843][T10074] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1215'. [ 298.052266][ T9987] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.094136][ T9987] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.105126][ T8903] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 298.116128][ T9987] bridge_slave_0: entered allmulticast mode [ 298.131990][ T9987] bridge_slave_0: entered promiscuous mode [ 298.180480][ T9987] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.210251][ T9987] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.235593][ T9987] bridge_slave_1: entered allmulticast mode [ 298.247317][ T9987] bridge_slave_1: entered promiscuous mode [ 298.572398][ T9987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 298.631641][T10095] vxcan1 speed is unknown, defaulting to 1000 [ 298.643869][ T9987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 298.762924][ T9987] team0: Port device team_slave_0 added [ 298.830872][ T9987] team0: Port device team_slave_1 added [ 298.937032][T10105] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1224'. [ 299.032655][T10108] openvswitch: netlink: Key type 5136 is out of range max 32 [ 299.209846][ T9987] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 299.229930][ T9987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 299.306577][ T9987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 299.332430][T10113] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1227'. [ 299.362075][ T9987] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 299.383301][ T9987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 299.445288][ T9987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 299.510800][T10095] lo speed is unknown, defaulting to 1000 [ 299.623994][ T9987] hsr_slave_0: entered promiscuous mode [ 299.639984][ T9987] hsr_slave_1: entered promiscuous mode [ 299.660786][ T9987] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 299.687008][ T9987] Cannot create hsr debugfs directory [ 299.867904][ T5844] Bluetooth: hci3: command tx timeout [ 299.895629][T10125] netlink: 'syz.1.1231': attribute type 1 has an invalid length. [ 299.915953][T10125] netlink: 'syz.1.1231': attribute type 2 has an invalid length. [ 300.166196][T10129] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1233'. [ 300.902539][T10147] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1237'. [ 300.945438][T10146] veth0_to_bridge: entered promiscuous mode [ 301.121346][T10156] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1241'. [ 301.435397][T10155] vxcan1 speed is unknown, defaulting to 1000 [ 301.464544][T10167] netlink: 'syz.4.1244': attribute type 13 has an invalid length. [ 301.473029][T10167] macvtap0: entered promiscuous mode [ 301.496589][T10167] macvtap0: refused to change device tx_queue_len [ 301.509927][T10167] netlink: 'syz.4.1244': attribute type 10 has an invalid length. [ 301.647523][T10167] team0: Port device geneve0 added [ 301.891074][T10177] netlink: 'syz.2.1249': attribute type 9 has an invalid length. [ 301.913139][T10177] __nla_validate_parse: 4 callbacks suppressed [ 301.913161][T10177] netlink: 211988 bytes leftover after parsing attributes in process `syz.2.1249'. [ 301.945980][ T5844] Bluetooth: hci3: command tx timeout [ 302.038517][T10179] openvswitch: netlink: Flow actions attr not present in new flow. [ 302.150414][ T9987] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 302.197245][ T9987] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 302.219841][ T9987] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 302.245494][ T9987] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 302.369083][T10155] lo speed is unknown, defaulting to 1000 [ 302.411233][T10188] workqueue: name exceeds WQ_NAME_LEN. Truncating to: žÀì]–>º>ùMv^µâ侦¸ÑKc'A¥»O [ 302.650709][T10192] bridge3: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 302.693731][ T9987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 302.753613][ T9987] 8021q: adding VLAN 0 to HW filter on device team0 [ 302.807693][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.814932][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 302.832244][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.839533][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 302.856635][T10194] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1255'. [ 302.913972][T10198] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1255'. [ 302.950553][T10198] vlan0: entered promiscuous mode [ 302.964445][T10198] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1255'. [ 303.539780][T10222] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1265'. [ 303.578685][ T9987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 303.629664][T10228] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 303.693544][ T9987] veth0_vlan: entered promiscuous mode [ 303.716204][T10231] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1267'. [ 303.734667][ T9987] veth1_vlan: entered promiscuous mode [ 303.741550][T10231] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1267'. [ 303.782955][T10233] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1265'. [ 303.816446][T10233] vxcan1 speed is unknown, defaulting to 1000 [ 303.839629][ T9987] veth0_macvtap: entered promiscuous mode [ 303.852337][ T9987] veth1_macvtap: entered promiscuous mode [ 303.881136][ T9987] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 303.900998][ T9987] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 303.916824][ T9987] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 303.927520][ T9987] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 303.938046][ T9987] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 303.947366][ T9987] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 304.025955][ T5844] Bluetooth: hci3: command tx timeout [ 304.042560][ T8882] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 304.053845][ T8882] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 304.100221][ T8900] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 304.113890][ T8900] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 304.766276][T10253] xt_CT: No such helper "pptp" [ 304.926174][T10260] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1274'. [ 304.970934][T10265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1276'. [ 305.094267][ T62] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.294228][T10278] ipvlan1: entered promiscuous mode [ 305.313650][T10278] ipvlan1: left promiscuous mode [ 305.366347][T10286] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 305.378340][T10282] macvlan3: entered promiscuous mode [ 305.384028][T10282] macvlan3: entered allmulticast mode [ 305.399555][T10282] batadv0: entered allmulticast mode [ 305.408650][T10282] batadv0: entered promiscuous mode [ 305.414922][T10282] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 305.430174][T10282] bond0: (slave macvlan3): Enslaving as an active interface with an up link [ 305.774359][ T62] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 305.864897][ T5834] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 305.875921][ T5834] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 305.904206][ T5834] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 305.920714][ T5834] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 305.939983][ T5834] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 306.124211][T10310] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 306.183424][ T62] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.362355][ T62] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.388889][T10302] vxcan1 speed is unknown, defaulting to 1000 [ 306.445573][T10316] block nbd2: server does not support multiple connections per device. [ 306.454301][T10316] block nbd2: shutting down sockets [ 306.693132][ T62] bridge_slave_1: left allmulticast mode [ 306.708801][ T62] bridge_slave_1: left promiscuous mode [ 306.720588][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 306.748258][ T62] bridge_slave_0: left allmulticast mode [ 306.754549][ T62] bridge_slave_0: left promiscuous mode [ 306.764431][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.153279][T10344] __nla_validate_parse: 2 callbacks suppressed [ 307.153299][T10344] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1296'. [ 307.170061][T10344] netlink: 'syz.2.1296': attribute type 1 has an invalid length. [ 307.178129][T10344] netlink: 'syz.2.1296': attribute type 2 has an invalid length. [ 307.186320][T10344] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1296'. [ 307.371121][ T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 307.389737][ T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 307.405626][ T62] bond0 (unregistering): Released all slaves [ 307.434161][T10310] vxcan1 speed is unknown, defaulting to 1000 [ 307.441201][T10302] lo speed is unknown, defaulting to 1000 [ 307.573606][T10355] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1298'. [ 307.746195][T10350] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1298'. [ 308.031477][ T5834] Bluetooth: hci3: command tx timeout [ 308.032162][T10367] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1300'. [ 308.111038][T10310] lo speed is unknown, defaulting to 1000 [ 308.308233][T10362] vxcan1 speed is unknown, defaulting to 1000 [ 308.471015][ T5834] block nbd2: Receive control failed (result -104) [ 308.694267][T10362] lo speed is unknown, defaulting to 1000 [ 309.027323][T10302] chnl_net:caif_netlink_parms(): no params data found [ 309.355543][ T62] hsr_slave_0: left promiscuous mode [ 309.374016][ T62] hsr_slave_1: left promiscuous mode [ 309.384122][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 309.392603][ T62] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 309.401497][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 309.409152][ T62] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 309.437010][ T62] veth1_macvtap: left promiscuous mode [ 309.442743][ T62] veth0_macvtap: left promiscuous mode [ 309.448702][ T62] veth1_vlan: left promiscuous mode [ 309.454518][ T62] veth0_vlan: left promiscuous mode [ 309.621090][T10407] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 309.648333][T10409] x_tables: duplicate underflow at hook 1 [ 310.070714][ T62] team0 (unregistering): Port device team_slave_1 removed [ 310.107008][ T5834] Bluetooth: hci3: command 0x041b tx timeout [ 310.129692][ T62] team0 (unregistering): Port device team_slave_0 removed [ 310.638319][T10420] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 310.663194][T10420] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 310.699058][T10420] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 310.965405][T10302] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.985488][T10302] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.998450][T10302] bridge_slave_0: entered allmulticast mode [ 311.012123][T10302] bridge_slave_0: entered promiscuous mode [ 311.050695][T10302] bridge0: port 2(bridge_slave_1) entered blocking state [ 311.085389][T10302] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.092828][T10302] bridge_slave_1: entered allmulticast mode [ 311.100975][T10302] bridge_slave_1: entered promiscuous mode [ 311.273849][T10302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 311.321519][T10302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 311.500877][T10302] team0: Port device team_slave_0 added [ 311.538270][T10302] team0: Port device team_slave_1 added [ 311.753175][T10302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 311.763852][T10302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 311.801631][T10302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 311.840517][T10302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 311.860474][T10302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 311.899494][T10302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 311.997302][T10475] mac80211_hwsim hwsim2 syzkaller1: entered promiscuous mode [ 312.004850][T10475] mac80211_hwsim hwsim2 syzkaller1: entered allmulticast mode [ 312.088424][T10302] hsr_slave_0: entered promiscuous mode [ 312.116346][T10302] hsr_slave_1: entered promiscuous mode [ 312.122870][T10302] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 312.166101][T10302] Cannot create hsr debugfs directory [ 312.203330][ T5844] Bluetooth: hci3: command 0x041b tx timeout [ 312.317984][T10482] netlink: 'syz.1.1326': attribute type 10 has an invalid length. [ 312.432075][ T30] audit: type=1800 audit(1748315041.754:4): pid=10472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1323" name="cgroup.controllers" dev="tmpfs" ino=1562 res=0 errno=0 [ 312.516326][T10489] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1328'. [ 313.081285][T10511] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1335'. [ 313.103639][T10511] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1335'. [ 313.149652][T10511] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1335'. [ 313.185591][T10302] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 313.220612][T10302] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 313.269666][T10302] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 313.309142][T10302] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 313.310261][T10522] ip6t_srh: unknown srh match flags 4000 [ 313.423702][T10526] netlink: 'syz.1.1341': attribute type 1 has an invalid length. [ 313.450830][T10526] netlink: 184 bytes leftover after parsing attributes in process `syz.1.1341'. [ 313.460222][T10526] netlink: 'syz.1.1341': attribute type 1 has an invalid length. [ 313.641283][T10302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 313.727446][T10302] 8021q: adding VLAN 0 to HW filter on device team0 [ 313.758744][ T8906] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.766004][ T8906] bridge0: port 1(bridge_slave_0) entered forwarding state [ 313.780072][T10550] siw: device registration error -23 [ 313.801337][T10551] netlink: 'syz.0.1347': attribute type 23 has an invalid length. [ 313.909734][ T8903] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.916973][ T8903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 313.939856][T10553] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1346'. [ 314.265563][ T5834] Bluetooth: hci3: command 0x041b tx timeout [ 314.281340][T10574] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1353'. [ 314.330003][T10574] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1353'. [ 314.472610][T10302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.572762][T10302] veth0_vlan: entered promiscuous mode [ 314.597984][T10302] veth1_vlan: entered promiscuous mode [ 314.622607][T10589] syz.0.1359: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 314.662498][T10589] CPU: 1 UID: 0 PID: 10589 Comm: syz.0.1359 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 314.662533][T10589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 314.662559][T10589] Call Trace: [ 314.662570][T10589] [ 314.662581][T10589] dump_stack_lvl+0x189/0x250 [ 314.662622][T10589] ? __pfx_dump_stack_lvl+0x10/0x10 [ 314.662653][T10589] ? __pfx__printk+0x10/0x10 [ 314.662675][T10589] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 314.662699][T10589] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 314.662723][T10589] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 314.662749][T10589] warn_alloc+0x214/0x310 [ 314.662781][T10589] ? __pfx___schedule+0x10/0x10 [ 314.662805][T10589] ? __pfx_warn_alloc+0x10/0x10 [ 314.662835][T10589] ? kasan_save_track+0x4f/0x80 [ 314.662860][T10589] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 314.662886][T10589] ? xskq_create+0x56/0x170 [ 314.662908][T10589] ? __x64_sys_setsockopt+0x18b/0x220 [ 314.662937][T10589] ? do_syscall_64+0xf6/0x210 [ 314.662959][T10589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.662993][T10589] __vmalloc_node_range_noprof+0x125/0x12c0 [ 314.663063][T10589] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 314.663098][T10589] ? __kasan_kmalloc+0x93/0xb0 [ 314.663131][T10589] vmalloc_user_noprof+0x74/0x80 [ 314.663162][T10589] ? xskq_create+0xbf/0x170 [ 314.663182][T10589] xskq_create+0xbf/0x170 [ 314.663208][T10589] xsk_init_queue+0xb0/0x110 [ 314.663232][T10589] xsk_setsockopt+0x43f/0x710 [ 314.663255][T10589] ? __pfx_xsk_setsockopt+0x10/0x10 [ 314.663288][T10589] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 314.663312][T10589] ? __pfx_xsk_setsockopt+0x10/0x10 [ 314.663333][T10589] do_sock_setsockopt+0x257/0x3e0 [ 314.663367][T10589] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 314.663395][T10589] ? __fget_files+0x2a/0x420 [ 314.663442][T10589] ? __fget_files+0x3a0/0x420 [ 314.663470][T10589] ? __fget_files+0x2a/0x420 [ 314.663506][T10589] __x64_sys_setsockopt+0x18b/0x220 [ 314.663542][T10589] do_syscall_64+0xf6/0x210 [ 314.663567][T10589] ? clear_bhb_loop+0x60/0xb0 [ 314.663592][T10589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.663610][T10589] RIP: 0033:0x7f83d718e969 [ 314.663628][T10589] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 314.663646][T10589] RSP: 002b:00007f83d806c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 314.663668][T10589] RAX: ffffffffffffffda RBX: 00007f83d73b6080 RCX: 00007f83d718e969 [ 314.663684][T10589] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000b [ 314.663697][T10589] RBP: 00007f83d7210ab1 R08: 0000000000000004 R09: 0000000000000000 [ 314.663710][T10589] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 314.663723][T10589] R13: 0000000000000000 R14: 00007f83d73b6080 R15: 00007ffc8d6da2e8 [ 314.663755][T10589] [ 314.664000][T10589] Mem-Info: [ 314.669276][T10302] veth0_macvtap: entered promiscuous mode [ 314.700735][T10589] active_anon:3626 inactive_anon:0 isolated_anon:0 [ 314.700735][T10589] active_file:1597 inactive_file:39912 isolated_file:0 [ 314.700735][T10589] unevictable:768 dirty:141 writeback:0 [ 314.700735][T10589] slab_reclaimable:11315 slab_unreclaimable:128098 [ 314.700735][T10589] mapped:29090 shmem:1365 pagetables:609 [ 314.700735][T10589] sec_pagetables:0 bounce:0 [ 314.700735][T10589] kernel_misc_reclaimable:0 [ 314.700735][T10589] free:1317338 free_pcp:601 free_cma:0 [ 314.792826][T10591] vxcan1 speed is unknown, defaulting to 1000 [ 314.813550][T10589] Node 0 active_anon:14504kB inactive_anon:0kB active_file:6388kB inactive_file:159448kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116460kB dirty:560kB writeback:0kB shmem:3924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11428kB pagetables:2436kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 314.829783][T10302] veth1_macvtap: entered promiscuous mode [ 314.847259][T10589] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 314.899947][T10302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 315.099704][T10589] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 315.137949][T10589] lowmem_reserve[]: 0 2503 2503 2503 2503 [ 315.143815][T10589] Node 0 DMA32 free:1345020kB boost:0kB min:34304kB low:42880kB high:51456kB reserved_highatomic:0KB active_anon:14540kB inactive_anon:0kB active_file:6388kB inactive_file:159356kB unevictable:1536kB writepending:556kB present:3129332kB managed:2563940kB mlocked:0kB bounce:0kB free_pcp:1968kB local_pcp:1068kB free_cma:0kB [ 315.181919][T10589] lowmem_reserve[]: 0 0 0 0 0 [ 315.187325][T10589] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:8kB inactive_anon:0kB active_file:0kB inactive_file:92kB unevictable:0kB writepending:4kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 315.227807][T10589] lowmem_reserve[]: 0 0 0 0 0 [ 315.247196][T10302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 315.265561][T10589] Node 1 Normal free:3907340kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 315.311848][T10302] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.331053][T10302] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.345798][T10302] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.360782][T10589] lowmem_reserve[]: 0 0 0 0 0 [ 315.384577][T10589] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 315.397040][T10302] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.413023][T10589] Node 0 DMA32: 453*4kB (UME) 413*8kB (UME) 262*16kB (UME) 1050*32kB (UME) 1038*64kB (UME) 675*128kB (UME) [ 315.429694][T10591] lo speed is unknown, defaulting to 1000 [ 315.444372][T10598] netlink: 'syz.1.1362': attribute type 21 has an invalid length. [ 315.447865][T10589] 481*256kB (UM) 246*512kB (UME) 103*1024kB (UME) 8*2048kB (UME) 190*4096kB (M) = 1344924kB [ 315.473001][T10589] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 315.487444][T10589] Node 1 Normal: 247*4kB (UME) 68*8kB (UME) 47*16kB (UME) 217*32kB (UME) 106*64kB (UME) 39*128kB (UME) 17*256kB (UM) 8*512kB (UME) 5*1024kB (UME) 3*2048kB (UE) 944*4096kB (M) = 3907340kB [ 315.508350][T10589] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 315.519647][T10589] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 315.529062][T10589] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 315.539041][T10589] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 315.549272][T10589] 42872 total pagecache pages [ 315.553966][T10589] 0 pages in swap cache [ 315.558663][T10589] Free swap = 124996kB [ 315.563034][T10589] Total swap = 124996kB [ 315.567362][T10589] 2097051 pages RAM [ 315.571202][T10589] 0 pages HighMem/MovableOnly [ 315.576582][T10589] 424408 pages reserved [ 315.580751][T10589] 0 pages cma reserved [ 315.599720][T10598] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1362'. [ 315.799469][ T8900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 315.810144][ T8900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 315.972948][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 315.990883][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 316.356201][T10621] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1368'. [ 316.512271][T10625] netlink: 'syz.2.1370': attribute type 10 has an invalid length. [ 316.520671][T10625] bond0: (slave 0!): no link monitoring support [ 316.534549][T10625] bond0: (slave 0!): Enslaving as an active interface with a down link [ 316.683088][T10634] syzkaller0: entered allmulticast mode [ 316.694349][T10634] syzkaller0: entered promiscuous mode [ 316.706990][T10634] syzkaller0 (unregistering): left promiscuous mode [ 316.714897][T10634] syzkaller0 (unregistering): left allmulticast mode [ 316.886197][T10644] syzkaller1: entered promiscuous mode [ 316.891890][T10644] syzkaller1: entered allmulticast mode [ 317.482781][ T62] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.527738][T10661] __nla_validate_parse: 3 callbacks suppressed [ 317.527757][T10661] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1385'. [ 317.732615][T10683] nftables ruleset with unbound chain [ 317.769521][ T62] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.799695][T10680] netem: change failed [ 317.822976][T10684] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1390'. [ 317.927321][ T62] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.081094][ T62] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.207721][T10694] netlink: 'syz.2.1393': attribute type 10 has an invalid length. [ 318.238647][T10694] team0: Device veth1_macvtap failed to register rx_handler [ 318.388940][ T55] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 318.400394][ T55] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 318.416720][ T55] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 318.446178][ T55] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 318.455668][ T55] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 318.458232][ T62] bridge_slave_1: left allmulticast mode [ 318.505250][ T55] Bluetooth: hci4: command 0x0405 tx timeout [ 318.515472][ T62] bridge_slave_1: left promiscuous mode [ 318.521311][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 318.556682][ T62] bridge_slave_0: left allmulticast mode [ 318.574345][ T62] bridge_slave_0: left promiscuous mode [ 318.592641][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 318.673585][T10713] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1396'. [ 319.071169][ T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 319.083351][ T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 319.120467][ T62] bond0 (unregistering): Released all slaves [ 319.171374][T10713] bridge_slave_1 (unregistering): left allmulticast mode [ 319.178755][T10713] bridge_slave_1 (unregistering): left promiscuous mode [ 319.187372][T10713] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.441477][T10702] vxcan1 speed is unknown, defaulting to 1000 [ 319.617752][T10728] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1403'. [ 319.622545][T10729] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1402'. [ 319.637401][T10729] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1402'. [ 319.781530][T10733] Bluetooth: MGMT ver 1.23 [ 319.838430][T10735] xt_TPROXY: Can be used only with -p tcp or -p udp [ 319.863023][T10702] lo speed is unknown, defaulting to 1000 [ 320.249397][ T62] hsr_slave_0: left promiscuous mode [ 320.264713][ T62] hsr_slave_1: left promiscuous mode [ 320.272571][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 320.279084][T10755] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1412'. [ 320.282007][ T62] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 320.298705][ T62] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 320.306255][ T62] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 320.314500][T10752] netlink: 'syz.2.1413': attribute type 8 has an invalid length. [ 320.340270][ T62] veth1_macvtap: left promiscuous mode [ 320.346745][ T62] veth0_macvtap: left promiscuous mode [ 320.352388][ T62] veth1_vlan: left promiscuous mode [ 320.357932][ T62] veth0_vlan: left promiscuous mode [ 320.585468][ T55] Bluetooth: hci3: command tx timeout [ 320.878624][ T62] team0 (unregistering): Port device team_slave_1 removed [ 320.927236][ T62] team0 (unregistering): Port device team_slave_0 removed [ 321.376022][T10754] netlink: 'syz.2.1413': attribute type 1 has an invalid length. [ 321.405327][T10754] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1413'. [ 321.453077][T10766] mac80211_hwsim hwsim2 syzkaller1: left promiscuous mode [ 321.462148][T10766] mac80211_hwsim hwsim2 syzkaller1: left allmulticast mode [ 321.679639][T10778] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1418'. [ 321.717340][T10778] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1418'. [ 321.723211][T10702] chnl_net:caif_netlink_parms(): no params data found [ 321.728350][T10779] netlink: 'syz.1.1419': attribute type 30 has an invalid length. [ 321.770497][T10778] netlink: 'syz.4.1418': attribute type 10 has an invalid length. [ 322.009150][T10797] netlink: 'syz.2.1424': attribute type 9 has an invalid length. [ 322.089195][T10702] bridge0: port 1(bridge_slave_0) entered blocking state [ 322.099796][T10702] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.107308][T10702] bridge_slave_0: entered allmulticast mode [ 322.118712][T10702] bridge_slave_0: entered promiscuous mode [ 322.146383][T10702] bridge0: port 2(bridge_slave_1) entered blocking state [ 322.153514][T10702] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.160995][T10702] bridge_slave_1: entered allmulticast mode [ 322.170193][T10702] bridge_slave_1: entered promiscuous mode [ 322.303716][T10702] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 322.328746][T10815] bond0: (slave 0!): Releasing backup interface [ 322.357420][T10815] bridge_slave_0: left allmulticast mode [ 322.372869][T10815] bridge_slave_0: left promiscuous mode [ 322.380681][T10815] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.410844][T10815] bond0: (slave bond_slave_0): Releasing backup interface [ 322.461482][T10815] bond0: (slave bond_slave_1): Releasing backup interface [ 322.488821][T10815] team0: Port device team_slave_0 removed [ 322.504485][T10815] team0: Port device team_slave_1 removed [ 322.529023][T10815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 322.542928][T10815] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 322.558276][T10815] bond1: (slave gretap1): Releasing active interface [ 322.580475][T10815] bond0: (slave macvlan3): Releasing backup interface [ 322.591187][T10815] batadv0: left allmulticast mode [ 322.597638][T10815] batadv0: left promiscuous mode [ 322.620120][T10702] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 322.649907][T10821] __nla_validate_parse: 3 callbacks suppressed [ 322.649927][T10821] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1426'. [ 322.670618][T10831] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1431'. [ 322.677103][ T55] Bluetooth: hci3: command tx timeout [ 322.701222][T10826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1429'. [ 322.753683][T10832] tun0: tun_chr_ioctl cmd 1074025675 [ 322.761449][T10832] tun0: persist disabled [ 322.901122][T10702] team0: Port device team_slave_0 added [ 322.953029][T10702] team0: Port device team_slave_1 added [ 322.970208][T10847] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1434'. [ 323.028354][T10857] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1437'. [ 323.250291][T10862] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1438'. [ 323.357614][T10702] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 323.373428][T10702] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 323.391195][T10867] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1440'. [ 323.420696][T10702] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 323.458150][T10702] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 323.475442][T10702] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 323.507877][T10702] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 323.580219][T10879] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1444'. [ 323.660024][T10702] hsr_slave_0: entered promiscuous mode [ 323.680143][T10702] hsr_slave_1: entered promiscuous mode [ 323.687798][T10702] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 323.695583][T10702] Cannot create hsr debugfs directory [ 323.980712][T10897] IPv6: NLM_F_CREATE should be specified when creating new route [ 324.401598][T10917] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1456'. [ 324.510907][T10921] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1458'. [ 324.530311][T10702] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 324.560618][T10702] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 324.589778][T10702] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 324.630268][T10921] sit0: entered promiscuous mode [ 324.639458][T10921] netlink: 'syz.1.1458': attribute type 1 has an invalid length. [ 324.685508][T10702] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 324.756158][ T55] Bluetooth: hci3: command tx timeout [ 324.864584][T10702] 8021q: adding VLAN 0 to HW filter on device bond0 [ 324.923898][T10702] 8021q: adding VLAN 0 to HW filter on device team0 [ 324.952081][ T8898] bridge0: port 1(bridge_slave_0) entered blocking state [ 324.959339][ T8898] bridge0: port 1(bridge_slave_0) entered forwarding state [ 324.993593][ T8900] bridge0: port 2(bridge_slave_1) entered blocking state [ 325.000883][ T8900] bridge0: port 2(bridge_slave_1) entered forwarding state [ 325.128817][T10702] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 325.622595][T10960] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 325.877359][T10970] vxcan1 speed is unknown, defaulting to 1000 [ 325.907853][T10702] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 326.061920][T10702] veth0_vlan: entered promiscuous mode [ 326.083084][T10978] netlink: 'syz.1.1473': attribute type 1 has an invalid length. [ 326.098959][T10702] veth1_vlan: entered promiscuous mode [ 326.240751][T10702] veth0_macvtap: entered promiscuous mode [ 326.291677][T10702] veth1_macvtap: entered promiscuous mode [ 326.422151][T10981] syzkaller0: entered promiscuous mode [ 326.445458][T10981] syzkaller0: entered allmulticast mode [ 326.465001][T10988] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 326.498519][T10970] lo speed is unknown, defaulting to 1000 [ 326.623692][T10702] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 326.836916][ T5837] Bluetooth: hci3: command tx timeout [ 327.550071][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 328.314720][T11006] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (2878) [ 328.324177][T11006] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 328.346808][T10702] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 328.463282][T10702] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.513819][T10702] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.553349][T10702] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.582633][T10702] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.859035][T11035] __nla_validate_parse: 6 callbacks suppressed [ 328.859057][T11035] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1488'. [ 328.905511][ T5837] Bluetooth: hci3: command 0x0405 tx timeout [ 329.144232][T11050] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1492'. [ 329.172020][ T8903] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.187390][ T8903] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.269572][ T8906] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.284901][ T8906] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.353645][T11039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1487'. [ 329.466058][ T8900] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 329.654323][T11071] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1496'. [ 329.664835][T11071] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.1496'. [ 329.675636][T11071] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1496'. [ 329.847923][ T8898] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.022138][ T8898] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.102630][ T8898] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.153258][ T8898] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.254084][ T8898] bridge_slave_1: left allmulticast mode [ 330.260312][ T8898] bridge_slave_1: left promiscuous mode [ 330.266375][ T8898] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.277279][ T8898] bridge_slave_0: left allmulticast mode [ 330.283063][ T8898] bridge_slave_0: left promiscuous mode [ 330.289791][ T8898] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.521364][T11081] netlink: 'syz.2.1500': attribute type 1 has an invalid length. [ 330.691826][T11093] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1503'. [ 330.877387][ T8898] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 330.896226][ T8898] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 330.912716][ T8898] bond0 (unregistering): Released all slaves [ 330.942200][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 330.952935][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 330.961757][ T5837] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 330.982127][ T5837] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 330.991636][ T5837] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 331.026870][T11081] 8021q: adding VLAN 0 to HW filter on device bond2 [ 331.072289][T11087] 8021q: adding VLAN 0 to HW filter on device bond2 [ 331.079554][T11087] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 331.091495][T11087] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 331.133340][T11091] veth3: entered promiscuous mode [ 331.162538][T11094] erspan0: entered allmulticast mode [ 331.258546][T11103] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1504'. [ 331.330141][T11098] vxcan1 speed is unknown, defaulting to 1000 [ 331.440948][T11109] macsec1: entered promiscuous mode [ 331.449174][T11109] gretap0: entered promiscuous mode [ 331.466484][T11109] gretap0: left promiscuous mode [ 331.775970][T11098] lo speed is unknown, defaulting to 1000 [ 331.974956][T11127] sctp: [Deprecated]: syz.4.1514 (pid 11127) Use of struct sctp_assoc_value in delayed_ack socket option. [ 331.974956][T11127] Use struct sctp_sack_info instead [ 332.152688][T11135] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1515'. [ 332.377269][ T8898] hsr_slave_0: left promiscuous mode [ 332.397311][ T8898] hsr_slave_1: left promiscuous mode [ 332.404784][ T8898] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 332.419390][ T8898] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 332.436926][ T8898] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 332.453901][ T8898] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 332.486652][ T8898] veth1_macvtap: left promiscuous mode [ 332.492488][ T8898] veth0_macvtap: left promiscuous mode [ 332.498274][ T8898] veth1_vlan: left promiscuous mode [ 332.503593][ T8898] veth0_vlan: left promiscuous mode [ 333.065414][ T5837] Bluetooth: hci3: command tx timeout [ 333.158986][ T8898] team0 (unregistering): Port device team_slave_1 removed [ 333.207176][ T8898] team0 (unregistering): Port device team_slave_0 removed [ 333.644671][T11141] sch_tbf: burst 0 is lower than device ip6gre0 mtu (39785) ! [ 333.839967][T11098] chnl_net:caif_netlink_parms(): no params data found [ 333.900676][T11161] gtp0: entered promiscuous mode [ 333.910114][T11161] gtp0: entered allmulticast mode [ 334.019799][ T30] audit: type=1107 audit(1748315063.334:5): pid=11164 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='1' [ 334.087384][T11173] netlink: 292 bytes leftover after parsing attributes in process `syz.4.1526'. [ 334.121951][T11173] af_packet: tpacket_rcv: packet too big, clamped from 202 to 4294967286. macoff=82 [ 334.231569][T11098] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.240634][T11098] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.251199][T11181] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1528'. [ 334.268180][T11179] netlink: 'syz.1.1527': attribute type 7 has an invalid length. [ 334.277465][T11098] bridge_slave_0: entered allmulticast mode [ 334.287810][T11098] bridge_slave_0: entered promiscuous mode [ 334.306480][T11181] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1528'. [ 334.353994][T11186] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1529'. [ 334.380673][T11175] vxcan1 speed is unknown, defaulting to 1000 [ 334.389499][T11098] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.430956][T11098] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.456126][T11098] bridge_slave_1: entered allmulticast mode [ 334.464224][T11098] bridge_slave_1: entered promiscuous mode [ 334.584783][T11196] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 334.623119][T11196] batman_adv: batadv0: Adding interface: ip6gretap1 [ 334.655276][T11196] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1560. [ 334.696071][T11196] batman_adv: batadv0: Interface activated: ip6gretap1 [ 334.823379][T11098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 334.871240][T11098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 334.883824][T11175] lo speed is unknown, defaulting to 1000 [ 335.028838][T11098] team0: Port device team_slave_0 added [ 335.039472][T11098] team0: Port device team_slave_1 added [ 335.165479][ T5837] Bluetooth: hci3: command tx timeout [ 335.273861][T11223] erspan0: left allmulticast mode [ 335.290721][T11226] netlink: 15 bytes leftover after parsing attributes in process `syz.0.1540'. [ 335.337854][T11223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.349436][T11223] 8021q: adding VLAN 0 to HW filter on device team0 [ 335.375517][T11223] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 335.403306][T11098] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 335.420766][T11098] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 335.467324][T11098] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 335.487754][T11098] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 335.494907][T11098] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 335.532473][T11098] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 335.557310][T11230] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1542'. [ 335.771529][T11242] IPVS: set_ctl: invalid protocol: 4 127.0.0.1:21 [ 335.825129][T11098] hsr_slave_0: entered promiscuous mode [ 335.842507][T11098] hsr_slave_1: entered promiscuous mode [ 335.880190][T11098] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 335.897440][T11098] Cannot create hsr debugfs directory [ 336.146269][T11253] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1551'. [ 336.328689][T11260] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1554'. [ 336.347759][T11264] ipt_REJECT: ECHOREPLY no longer supported. [ 336.356599][T11263] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1555'. [ 336.429450][T11260] vxcan1 speed is unknown, defaulting to 1000 [ 336.522529][T11269] macsec1: entered promiscuous mode [ 336.539116][T11269] macsec1: entered allmulticast mode [ 336.549269][T11269] syz_tun: entered allmulticast mode [ 336.602338][T11269] syz_tun: left allmulticast mode [ 336.822278][T11279] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1563'. [ 336.953727][T11260] lo speed is unknown, defaulting to 1000 [ 337.161442][T11288] batadv_slave_1: entered promiscuous mode [ 337.225846][ T5837] Bluetooth: hci3: command tx timeout [ 337.404179][T11098] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 337.442137][T11098] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 337.470248][T11098] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 337.508714][T11098] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 337.829666][T11098] 8021q: adding VLAN 0 to HW filter on device bond0 [ 337.930045][T11098] 8021q: adding VLAN 0 to HW filter on device team0 [ 338.140359][ T8900] bridge0: port 1(bridge_slave_0) entered blocking state [ 338.147640][ T8900] bridge0: port 1(bridge_slave_0) entered forwarding state [ 338.272164][ T8882] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.279392][ T8882] bridge0: port 2(bridge_slave_1) entered forwarding state [ 338.402553][T11316] syzkaller0: entered promiscuous mode [ 338.429719][T11316] syzkaller0: entered allmulticast mode [ 338.700168][T11330] siw: device registration error -23 [ 338.725289][T11332] IPv6: NLM_F_CREATE should be specified when creating new route [ 339.316885][ T5837] Bluetooth: hci3: command tx timeout [ 340.158474][T11329] IPVS: Unknown mcast interface: vcan0 [ 340.262285][T11337] syzkaller0: entered promiscuous mode [ 340.268381][T11337] syzkaller0: entered allmulticast mode [ 340.431839][T11352] xt_CT: You must specify a L4 protocol and not use inversions on it [ 340.515545][T11345] block nbd3: server does not support multiple connections per device. [ 340.540560][T11345] block nbd3: shutting down sockets [ 342.009525][T11350] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 342.024578][T11356] geneve1: left promiscuous mode [ 342.032045][T11354] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 342.083040][T11098] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 342.171558][T11361] vxcan1 speed is unknown, defaulting to 1000 [ 342.179274][T11364] __nla_validate_parse: 7 callbacks suppressed [ 342.179295][T11364] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.1586'. [ 342.245138][T11364] netlink: zone id is out of range [ 342.253602][T11373] xt_l2tp: missing protocol rule (udp|l2tpip) [ 342.258892][T11364] netlink: get zone limit has 8 unknown bytes [ 342.580316][T11383] FAULT_INJECTION: forcing a failure. [ 342.580316][T11383] name failslab, interval 1, probability 0, space 0, times 0 [ 342.623617][T11383] CPU: 0 UID: 0 PID: 11383 Comm: syz.0.1589 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 342.623650][T11383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 342.623662][T11383] Call Trace: [ 342.623670][T11383] [ 342.623680][T11383] dump_stack_lvl+0x189/0x250 [ 342.623717][T11383] ? __pfx_dump_stack_lvl+0x10/0x10 [ 342.623754][T11383] ? __pfx__printk+0x10/0x10 [ 342.623781][T11383] ? __pfx___might_resched+0x10/0x10 [ 342.623806][T11383] should_fail_ex+0x414/0x560 [ 342.623835][T11383] should_failslab+0xa8/0x100 [ 342.623865][T11383] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 342.623893][T11383] ? __alloc_skb+0x112/0x2d0 [ 342.623925][T11383] __alloc_skb+0x112/0x2d0 [ 342.623958][T11383] netlink_sendmsg+0x5c6/0xb30 [ 342.623998][T11383] ? __pfx_netlink_sendmsg+0x10/0x10 [ 342.624029][T11383] ? aa_sock_msg_perm+0x94/0x160 [ 342.624054][T11383] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 342.624084][T11383] ? __pfx_netlink_sendmsg+0x10/0x10 [ 342.624112][T11383] __sock_sendmsg+0x219/0x270 [ 342.624139][T11383] ____sys_sendmsg+0x505/0x830 [ 342.624176][T11383] ? __pfx_____sys_sendmsg+0x10/0x10 [ 342.624238][T11383] ? import_iovec+0x74/0xa0 [ 342.624272][T11383] ___sys_sendmsg+0x21f/0x2a0 [ 342.624318][T11383] ? __pfx____sys_sendmsg+0x10/0x10 [ 342.624393][T11383] ? __fget_files+0x2a/0x420 [ 342.624420][T11383] ? __fget_files+0x3a0/0x420 [ 342.624463][T11383] __x64_sys_sendmsg+0x19b/0x260 [ 342.624496][T11383] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 342.624547][T11383] ? do_syscall_64+0xba/0x210 [ 342.624574][T11383] do_syscall_64+0xf6/0x210 [ 342.624599][T11383] ? clear_bhb_loop+0x60/0xb0 [ 342.624632][T11383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.624652][T11383] RIP: 0033:0x7f83d718e969 [ 342.624671][T11383] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 342.624688][T11383] RSP: 002b:00007f83d808d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 342.624708][T11383] RAX: ffffffffffffffda RBX: 00007f83d73b5fa0 RCX: 00007f83d718e969 [ 342.624722][T11383] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 342.624741][T11383] RBP: 00007f83d808d090 R08: 0000000000000000 R09: 0000000000000000 [ 342.624752][T11383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.624763][T11383] R13: 0000000000000000 R14: 00007f83d73b5fa0 R15: 00007ffc8d6da2e8 [ 342.624795][T11383] [ 342.883697][T11098] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 342.894293][ T55] Bluetooth: hci3: command 0x0405 tx timeout [ 342.983289][T11361] lo speed is unknown, defaulting to 1000 [ 343.008305][T11098] veth0_vlan: entered promiscuous mode [ 343.025241][T11098] veth1_vlan: entered promiscuous mode [ 343.123810][T11098] veth0_macvtap: entered promiscuous mode [ 343.149487][T11098] veth1_macvtap: entered promiscuous mode [ 343.190659][T11098] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 343.229452][T11098] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 343.249975][T11098] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.269993][T11098] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.285171][T11098] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.293914][T11098] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.255422][ T9610] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.293849][ T9610] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.383516][ T9610] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.408498][ T9610] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.491001][T11416] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1595'. [ 346.029400][T11446] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1605'. [ 346.231491][ T9610] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.388522][T11458] vlan2: entered promiscuous mode [ 346.422968][T11458] ip6gretap0: entered promiscuous mode [ 346.491669][ T9610] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.660477][ T9610] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.113759][T11466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1611'. [ 347.129121][ T9610] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.196674][T11470] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1608'. [ 347.217223][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.217545][T11466] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1611'. [ 347.244451][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.269412][T11473] FAULT_INJECTION: forcing a failure. [ 347.269412][T11473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 347.298009][T11473] CPU: 1 UID: 0 PID: 11473 Comm: syz.2.1612 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 347.298043][T11473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 347.298056][T11473] Call Trace: [ 347.298064][T11473] [ 347.298073][T11473] dump_stack_lvl+0x189/0x250 [ 347.298106][T11473] ? __lock_acquire+0xaac/0xd20 [ 347.298138][T11473] ? __pfx_dump_stack_lvl+0x10/0x10 [ 347.298167][T11473] ? __pfx__printk+0x10/0x10 [ 347.298188][T11473] ? __might_fault+0xb0/0x130 [ 347.298228][T11473] should_fail_ex+0x414/0x560 [ 347.298256][T11473] _copy_from_iter+0x1db/0x15a0 [ 347.298290][T11473] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 347.298313][T11473] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 347.298341][T11473] ? __pfx__copy_from_iter+0x10/0x10 [ 347.298369][T11473] ? __build_skb_around+0x257/0x3e0 [ 347.298407][T11473] ? netlink_sendmsg+0x642/0xb30 [ 347.298433][T11473] ? skb_put+0x11b/0x210 [ 347.298465][T11473] netlink_sendmsg+0x6b2/0xb30 [ 347.298505][T11473] ? __pfx_netlink_sendmsg+0x10/0x10 [ 347.298538][T11473] ? aa_sock_msg_perm+0x94/0x160 [ 347.298564][T11473] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 347.298587][T11473] ? __pfx_netlink_sendmsg+0x10/0x10 [ 347.298616][T11473] __sock_sendmsg+0x219/0x270 [ 347.298644][T11473] ____sys_sendmsg+0x505/0x830 [ 347.298680][T11473] ? __pfx_____sys_sendmsg+0x10/0x10 [ 347.298721][T11473] ? import_iovec+0x74/0xa0 [ 347.298755][T11473] ___sys_sendmsg+0x21f/0x2a0 [ 347.298788][T11473] ? __pfx____sys_sendmsg+0x10/0x10 [ 347.298846][T11473] ? __fget_files+0x2a/0x420 [ 347.298866][T11473] ? __fget_files+0x3a0/0x420 [ 347.298896][T11473] __x64_sys_sendmsg+0x19b/0x260 [ 347.298923][T11473] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 347.298962][T11473] ? do_syscall_64+0xba/0x210 [ 347.298984][T11473] do_syscall_64+0xf6/0x210 [ 347.299004][T11473] ? clear_bhb_loop+0x60/0xb0 [ 347.299024][T11473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.299039][T11473] RIP: 0033:0x7f1427d8e969 [ 347.299055][T11473] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 347.299069][T11473] RSP: 002b:00007f1428b5b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 347.299087][T11473] RAX: ffffffffffffffda RBX: 00007f1427fb5fa0 RCX: 00007f1427d8e969 [ 347.299099][T11473] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 347.299109][T11473] RBP: 00007f1428b5b090 R08: 0000000000000000 R09: 0000000000000000 [ 347.299119][T11473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.299128][T11473] R13: 0000000000000000 R14: 00007f1427fb5fa0 R15: 00007ffff4929a38 [ 347.299156][T11473] [ 347.670574][ T9610] bridge_slave_1: left allmulticast mode [ 347.676517][ T9610] bridge_slave_1: left promiscuous mode [ 347.683357][ T9610] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.702735][ T9610] bridge_slave_0: left allmulticast mode [ 347.709715][ T9610] bridge_slave_0: left promiscuous mode [ 347.718157][ T9610] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.847259][T11479] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1613'. [ 347.912335][ T55] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 347.938760][ T55] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 347.947846][ T55] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 347.962988][ T55] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 347.973530][ T55] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 348.304186][ T9610] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 348.324583][ T9610] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 348.337858][ T9610] bond0 (unregistering): Released all slaves [ 348.351930][T11477] netlink: 'syz.1.1613': attribute type 29 has an invalid length. [ 348.364524][T11485] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1613'. [ 348.450467][T11490] netlink: 'syz.1.1613': attribute type 29 has an invalid length. [ 348.670682][T11482] vxcan1 speed is unknown, defaulting to 1000 [ 348.856955][T11507] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1619'. [ 348.884626][T11507] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1619'. [ 349.103070][T11482] lo speed is unknown, defaulting to 1000 [ 349.239212][T11518] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1621'. [ 349.554985][T11527] FAULT_INJECTION: forcing a failure. [ 349.554985][T11527] name failslab, interval 1, probability 0, space 0, times 0 [ 349.569738][T11527] CPU: 1 UID: 0 PID: 11527 Comm: syz.4.1624 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 349.569768][T11527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 349.569781][T11527] Call Trace: [ 349.569789][T11527] [ 349.569798][T11527] dump_stack_lvl+0x189/0x250 [ 349.569836][T11527] ? __pfx_dump_stack_lvl+0x10/0x10 [ 349.569866][T11527] ? __pfx__printk+0x10/0x10 [ 349.569894][T11527] ? ref_tracker_alloc+0x318/0x460 [ 349.569922][T11527] should_fail_ex+0x414/0x560 [ 349.569951][T11527] should_failslab+0xa8/0x100 [ 349.569981][T11527] kmem_cache_alloc_noprof+0x73/0x3c0 [ 349.570007][T11527] ? skb_clone+0x212/0x3a0 [ 349.570032][T11527] skb_clone+0x212/0x3a0 [ 349.570055][T11527] __netlink_deliver_tap+0x404/0x850 [ 349.570100][T11527] ? netlink_deliver_tap+0x2e/0x1b0 [ 349.570130][T11527] netlink_deliver_tap+0x19c/0x1b0 [ 349.570160][T11527] netlink_unicast+0x72f/0x8d0 [ 349.570205][T11527] netlink_sendmsg+0x805/0xb30 [ 349.570244][T11527] ? __pfx_netlink_sendmsg+0x10/0x10 [ 349.570277][T11527] ? aa_sock_msg_perm+0x94/0x160 [ 349.570303][T11527] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 349.570327][T11527] ? __pfx_netlink_sendmsg+0x10/0x10 [ 349.570357][T11527] __sock_sendmsg+0x219/0x270 [ 349.570384][T11527] ____sys_sendmsg+0x505/0x830 [ 349.570421][T11527] ? __pfx_____sys_sendmsg+0x10/0x10 [ 349.570463][T11527] ? import_iovec+0x74/0xa0 [ 349.570496][T11527] ___sys_sendmsg+0x21f/0x2a0 [ 349.570530][T11527] ? __pfx____sys_sendmsg+0x10/0x10 [ 349.570607][T11527] ? __fget_files+0x2a/0x420 [ 349.570634][T11527] ? __fget_files+0x3a0/0x420 [ 349.570674][T11527] __x64_sys_sendmsg+0x19b/0x260 [ 349.570708][T11527] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 349.570758][T11527] ? do_syscall_64+0xba/0x210 [ 349.570786][T11527] do_syscall_64+0xf6/0x210 [ 349.570811][T11527] ? clear_bhb_loop+0x60/0xb0 [ 349.570837][T11527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.570857][T11527] RIP: 0033:0x7f5a55b8e969 [ 349.570875][T11527] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 349.570893][T11527] RSP: 002b:00007f5a56999038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 349.570914][T11527] RAX: ffffffffffffffda RBX: 00007f5a55db5fa0 RCX: 00007f5a55b8e969 [ 349.570929][T11527] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 349.570941][T11527] RBP: 00007f5a56999090 R08: 0000000000000000 R09: 0000000000000000 [ 349.570953][T11527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.570965][T11527] R13: 0000000000000000 R14: 00007f5a55db5fa0 R15: 00007ffee6507028 [ 349.570998][T11527] [ 349.571309][T11527] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1624'. [ 349.664638][T11532] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1626'. [ 349.862068][ T9610] hsr_slave_0: left promiscuous mode [ 349.873435][ T9610] hsr_slave_1: left promiscuous mode [ 349.895955][ T9610] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 349.912282][ T9610] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 349.943201][ T9610] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 349.952635][T11540] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1627'. [ 349.962028][ T9610] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 349.964233][T11542] netlink: 'syz.0.1628': attribute type 10 has an invalid length. [ 350.011948][ T9610] veth1_macvtap: left promiscuous mode [ 350.018482][ T9610] veth0_macvtap: left promiscuous mode [ 350.024357][ T9610] veth1_vlan: left promiscuous mode [ 350.025649][ T5837] Bluetooth: hci3: command tx timeout [ 350.034154][ T9610] veth0_vlan: left promiscuous mode [ 350.523882][ T9610] team0 (unregistering): Port device team_slave_1 removed [ 350.568560][ T9610] team0 (unregistering): Port device team_slave_0 removed [ 351.053582][T11542] bond0: (slave wlan1): Enslaving as an active interface with a down link [ 351.172965][T11482] chnl_net:caif_netlink_parms(): no params data found [ 352.109397][ T5837] Bluetooth: hci3: command tx timeout [ 352.484269][T11482] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.516948][T11482] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.560782][T11482] bridge_slave_0: entered allmulticast mode [ 352.579902][T11482] bridge_slave_0: entered promiscuous mode [ 352.612614][T11578] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 352.627738][T11482] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.644225][T11578] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 352.645369][T11482] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.661070][T11578] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 352.696630][T11599] FAULT_INJECTION: forcing a failure. [ 352.696630][T11599] name failslab, interval 1, probability 0, space 0, times 0 [ 352.707460][T11600] __nla_validate_parse: 3 callbacks suppressed [ 352.707484][T11600] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1642'. [ 352.710173][T11599] CPU: 1 UID: 0 PID: 11599 Comm: syz.0.1643 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 352.710204][T11599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 352.710217][T11599] Call Trace: [ 352.710226][T11599] [ 352.710235][T11599] dump_stack_lvl+0x189/0x250 [ 352.710279][T11599] ? __pfx_dump_stack_lvl+0x10/0x10 [ 352.710311][T11599] ? __pfx__printk+0x10/0x10 [ 352.710341][T11599] ? __pfx___might_resched+0x10/0x10 [ 352.710370][T11599] should_fail_ex+0x414/0x560 [ 352.710400][T11599] should_failslab+0xa8/0x100 [ 352.710432][T11599] kmem_cache_alloc_noprof+0x73/0x3c0 [ 352.710460][T11599] ? ptlock_alloc+0x20/0x70 [ 352.710495][T11599] ptlock_alloc+0x20/0x70 [ 352.710522][T11599] pte_alloc_one+0x6d/0x160 [ 352.710551][T11599] __pte_alloc+0x25/0x160 [ 352.710589][T11599] __handle_mm_fault+0x49e9/0x5380 [ 352.710640][T11599] ? __pfx___handle_mm_fault+0x10/0x10 [ 352.710690][T11599] ? __pfx___might_resched+0x10/0x10 [ 352.710717][T11599] handle_mm_fault+0x40a/0x8e0 [ 352.710756][T11599] __get_user_pages+0x16f0/0x2a40 [ 352.710821][T11599] ? __pfx___get_user_pages+0x10/0x10 [ 352.710846][T11599] ? __gup_longterm_locked+0xbf7/0x15b0 [ 352.710874][T11599] ? down_read_killable+0x1d1/0x350 [ 352.710908][T11599] __gup_longterm_locked+0xd66/0x15b0 [ 352.710951][T11599] ? sanity_check_pinned_pages+0x11a2/0x1290 [ 352.710980][T11599] ? gup_fast_fallback+0x1672/0x1d60 [ 352.711019][T11599] gup_fast_fallback+0x1843/0x1d60 [ 352.711045][T11599] ? register_lock_class+0x51/0x320 [ 352.711114][T11599] ? __pfx_gup_fast_fallback+0x10/0x10 [ 352.711146][T11599] ? __pfx_sha256_transform_blocks+0x10/0x10 [ 352.711189][T11599] ? pin_user_pages_fast+0x4d/0xb0 [ 352.711224][T11599] iov_iter_extract_pages+0x35a/0x5e0 [ 352.711268][T11599] extract_iter_to_sg+0xdeb/0x2480 [ 352.711306][T11599] ? sanity_check_pinned_pages+0x119b/0x1290 [ 352.711337][T11599] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 352.711365][T11599] ? unpin_user_page+0xc9/0x1d0 [ 352.711389][T11599] ? __pfx_unpin_user_page+0x10/0x10 [ 352.711427][T11599] ? __asan_memset+0x22/0x50 [ 352.711452][T11599] hash_sendmsg+0x4f4/0x11d0 [ 352.711505][T11599] ? __pfx_hash_sendmsg+0x10/0x10 [ 352.711530][T11599] __sock_sendmsg+0x219/0x270 [ 352.711560][T11599] ____sys_sendmsg+0x52d/0x830 [ 352.711599][T11599] ? __pfx_____sys_sendmsg+0x10/0x10 [ 352.711642][T11599] ? import_iovec+0x74/0xa0 [ 352.711679][T11599] ___sys_sendmsg+0x21f/0x2a0 [ 352.711714][T11599] ? __pfx____sys_sendmsg+0x10/0x10 [ 352.711790][T11599] ? __fget_files+0x2a/0x420 [ 352.711818][T11599] ? __fget_files+0x3a0/0x420 [ 352.711860][T11599] __sys_sendmmsg+0x227/0x430 [ 352.711899][T11599] ? __pfx___sys_sendmmsg+0x10/0x10 [ 352.711944][T11599] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 352.711990][T11599] ? ksys_write+0x1f0/0x250 [ 352.712036][T11599] __x64_sys_sendmmsg+0xa0/0xc0 [ 352.712089][T11599] do_syscall_64+0xf6/0x210 [ 352.712115][T11599] ? clear_bhb_loop+0x60/0xb0 [ 352.712142][T11599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.712164][T11599] RIP: 0033:0x7f83d718e969 [ 352.712183][T11599] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 352.712201][T11599] RSP: 002b:00007f83d808d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 352.712225][T11599] RAX: ffffffffffffffda RBX: 00007f83d73b5fa0 RCX: 00007f83d718e969 [ 352.712241][T11599] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 352.712254][T11599] RBP: 00007f83d808d090 R08: 0000000000000000 R09: 0000000000000000 [ 352.712268][T11599] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000001 [ 352.712282][T11599] R13: 0000000000000000 R14: 00007f83d73b5fa0 R15: 00007ffc8d6da2e8 [ 352.712318][T11599] [ 352.712972][T11482] bridge_slave_1: entered allmulticast mode [ 352.917716][T11605] IPVS: set_ctl: invalid protocol: 1 224.0.0.1:20002 [ 352.926102][T11482] bridge_slave_1: entered promiscuous mode [ 353.292478][T11482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 353.361133][T11482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 353.395190][T11622] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1649'. [ 353.502446][T11622] 8021q: VLANs not supported on vcan0 [ 353.531954][T11482] team0: Port device team_slave_0 added [ 353.556733][T11482] team0: Port device team_slave_1 added [ 353.670996][T11482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 353.678496][T11482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 353.704159][T11634] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1652'. [ 353.706217][T11482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 353.727998][T11482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 353.737271][T11482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 353.742433][T11634] netlink: get zone limit has 8 unknown bytes [ 353.763639][T11482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.881011][T11482] hsr_slave_0: entered promiscuous mode [ 353.890266][T11482] hsr_slave_1: entered promiscuous mode [ 353.896838][T11482] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 353.904719][T11482] Cannot create hsr debugfs directory [ 353.925236][T11645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1655'. [ 354.091613][T11653] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1657'. [ 354.186953][ T5837] Bluetooth: hci3: command tx timeout [ 354.403869][T11661] vxcan1 speed is unknown, defaulting to 1000 [ 354.448023][T11665] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1659'. [ 354.499422][T11658] xt_hashlimit: overflow, try lower: 18446744073709551615/7 [ 354.969106][T11681] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 354.980263][T11482] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 354.980664][T11683] netlink: 'syz.2.1665': attribute type 21 has an invalid length. [ 355.007202][T11482] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 355.032953][T11683] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1665'. [ 355.042826][T11680] vxcan1 speed is unknown, defaulting to 1000 [ 355.043865][T11482] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 355.077598][T11661] lo speed is unknown, defaulting to 1000 [ 355.085400][T11482] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 355.327812][T11680] lo speed is unknown, defaulting to 1000 [ 355.601991][T11482] 8021q: adding VLAN 0 to HW filter on device bond0 [ 355.651809][T11482] 8021q: adding VLAN 0 to HW filter on device team0 [ 355.752394][ T8906] bridge0: port 1(bridge_slave_0) entered blocking state [ 355.759694][ T8906] bridge0: port 1(bridge_slave_0) entered forwarding state [ 355.804208][ T8906] bridge0: port 2(bridge_slave_1) entered blocking state [ 355.811479][ T8906] bridge0: port 2(bridge_slave_1) entered forwarding state [ 356.269522][ T5837] Bluetooth: hci3: command tx timeout [ 356.313618][T11710] netlink: 'syz.4.1672': attribute type 1 has an invalid length. [ 356.388859][T11712] netlink: 'syz.1.1675': attribute type 1 has an invalid length. [ 356.418116][T11712] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1675'. [ 356.570648][T11707] vxcan1 speed is unknown, defaulting to 1000 [ 356.585760][T11717] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 356.749562][T11482] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 356.840024][T11726] netlink: 'syz.0.1678': attribute type 1 has an invalid length. [ 356.867179][T11726] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1678'. [ 356.911111][T11482] veth0_vlan: entered promiscuous mode [ 356.953167][T11482] veth1_vlan: entered promiscuous mode [ 357.028086][T11482] veth0_macvtap: entered promiscuous mode [ 357.040038][T11482] veth1_macvtap: entered promiscuous mode [ 357.066735][T11482] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 357.079268][T11482] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 357.137809][T11482] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.155382][T11482] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.171958][T11482] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.195279][T11482] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.502997][T11726] vxcan1 speed is unknown, defaulting to 1000 [ 357.512108][ T8900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.527131][ T8900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.627030][T11707] lo speed is unknown, defaulting to 1000 [ 357.764545][ T8882] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.788437][T11734] netlink: 'syz.1.1679': attribute type 4 has an invalid length. [ 357.796848][ T8882] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.838235][ T10] lo speed is unknown, defaulting to 1000 [ 357.844422][ T10] syz1: Port: 1 Link ACTIVE [ 358.077823][T11745] ================================================================== [ 358.086046][T11745] BUG: KASAN: slab-use-after-free in cfusbl_device_notify+0x150/0x6a0 [ 358.094342][T11745] Read of size 8 at addr ffff88807af80c50 by task syz.1.1679/11745 [ 358.102248][T11745] [ 358.104586][T11745] CPU: 0 UID: 0 PID: 11745 Comm: syz.1.1679 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 358.104616][T11745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 358.104628][T11745] Call Trace: [ 358.104636][T11745] [ 358.104645][T11745] dump_stack_lvl+0x189/0x250 [ 358.104673][T11745] ? __virt_addr_valid+0x18c/0x540 [ 358.104696][T11745] ? rcu_is_watching+0x15/0xb0 [ 358.104711][T11745] ? __kasan_check_byte+0x12/0x40 [ 358.104733][T11745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 358.104755][T11745] ? rcu_is_watching+0x15/0xb0 [ 358.104769][T11745] ? lock_release+0x4b/0x3e0 [ 358.104794][T11745] ? __virt_addr_valid+0x18c/0x540 [ 358.104815][T11745] ? __virt_addr_valid+0x469/0x540 [ 358.104837][T11745] print_report+0xb4/0x290 [ 358.104856][T11745] ? cfusbl_device_notify+0x150/0x6a0 [ 358.104879][T11745] kasan_report+0x118/0x150 [ 358.104900][T11745] ? cfusbl_device_notify+0x150/0x6a0 [ 358.104926][T11745] cfusbl_device_notify+0x150/0x6a0 [ 358.104948][T11745] ? net_generic+0x1e/0x240 [ 358.104968][T11745] ? __pfx_cfusbl_device_notify+0x10/0x10 [ 358.104991][T11745] ? caif_device_notify+0x250/0xfc0 [ 358.105018][T11745] ? smc_pnet_netdev_event+0x3b5/0x6c0 [ 358.105052][T11745] notifier_call_chain+0x1b3/0x3e0 [ 358.105077][T11745] register_netdevice+0x121c/0x1ae0 [ 358.105093][T11745] ? __mutex_lock+0x51b/0xe80 [ 358.105119][T11745] ? __pfx_register_netdevice+0x10/0x10 [ 358.105138][T11745] ? __asan_memset+0x22/0x50 [ 358.105155][T11745] ? dev_addr_mod+0x2ce/0x3d0 [ 358.105180][T11745] register_netdev+0x40/0x60 [ 358.105195][T11745] bnep_add_connection+0x6bf/0xbf0 [ 358.105217][T11745] ? __pfx_bnep_add_connection+0x10/0x10 [ 358.105232][T11745] ? __fget_files+0x3a0/0x420 [ 358.105259][T11745] do_bnep_sock_ioctl+0x40e/0x640 [ 358.105278][T11745] ? __pfx_do_bnep_sock_ioctl+0x10/0x10 [ 358.105298][T11745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 358.105316][T11745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 358.105358][T11745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 358.105378][T11745] ? call_rcu+0x6dd/0x990 [ 358.105396][T11745] sock_do_ioctl+0xdc/0x300 [ 358.105416][T11745] ? __pfx_sock_do_ioctl+0x10/0x10 [ 358.105434][T11745] ? __lock_acquire+0xaac/0xd20 [ 358.105463][T11745] sock_ioctl+0x576/0x790 [ 358.105481][T11745] ? __pfx_sock_ioctl+0x10/0x10 [ 358.105498][T11745] ? __fget_files+0x3a0/0x420 [ 358.105519][T11745] ? __fget_files+0x2a/0x420 [ 358.105541][T11745] ? bpf_lsm_file_ioctl+0x9/0x20 [ 358.105563][T11745] ? __pfx_sock_ioctl+0x10/0x10 [ 358.105579][T11745] __se_sys_ioctl+0xf9/0x170 [ 358.105597][T11745] do_syscall_64+0xf6/0x210 [ 358.105622][T11745] ? clear_bhb_loop+0x60/0xb0 [ 358.105641][T11745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.105658][T11745] RIP: 0033:0x7fbb8638e969 [ 358.105673][T11745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 358.105687][T11745] RSP: 002b:00007fbb87231038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 358.105705][T11745] RAX: ffffffffffffffda RBX: 00007fbb865b6160 RCX: 00007fbb8638e969 [ 358.105717][T11745] RDX: 00002000000000c0 RSI: 00000000400442c8 RDI: 000000000000000a [ 358.105727][T11745] RBP: 00007fbb86410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 358.105738][T11745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 358.105747][T11745] R13: 0000000000000000 R14: 00007fbb865b6160 R15: 00007ffc689047a8 [ 358.105767][T11745] [ 358.105773][T11745] [ 358.445535][T11745] Allocated by task 5837: [ 358.449867][T11745] kasan_save_track+0x3e/0x80 [ 358.454557][T11745] __kasan_kmalloc+0x93/0xb0 [ 358.459153][T11745] __kmalloc_cache_noprof+0x230/0x3d0 [ 358.464553][T11745] __hci_conn_add+0x233/0x1b30 [ 358.469331][T11745] hci_conn_request_evt+0x53e/0xb60 [ 358.474541][T11745] hci_event_packet+0x7e0/0x1200 [ 358.479486][T11745] hci_rx_work+0x46a/0xe80 [ 358.483906][T11745] process_scheduled_works+0xade/0x17a0 [ 358.489483][T11745] worker_thread+0x8a0/0xda0 [ 358.494080][T11745] kthread+0x70e/0x8a0 [ 358.498156][T11745] ret_from_fork+0x4b/0x80 [ 358.502581][T11745] ret_from_fork_asm+0x1a/0x30 [ 358.507348][T11745] [ 358.509686][T11745] Freed by task 11482: [ 358.513762][T11745] kasan_save_track+0x3e/0x80 [ 358.518447][T11745] kasan_save_free_info+0x46/0x50 [ 358.523477][T11745] __kasan_slab_free+0x62/0x70 [ 358.528251][T11745] kfree+0x193/0x440 [ 358.532156][T11745] device_release+0x99/0x1c0 [ 358.536759][T11745] kobject_put+0x22b/0x480 [ 358.541187][T11745] hci_conn_del+0x8ff/0xcb0 [ 358.545705][T11745] hci_conn_hash_flush+0x191/0x230 [ 358.550855][T11745] hci_dev_close_sync+0xaef/0x1330 [ 358.555978][T11745] hci_unregister_dev+0x206/0x500 [ 358.561012][T11745] vhci_release+0x80/0xd0 [ 358.565352][T11745] __fput+0x449/0xa70 [ 358.569338][T11745] task_work_run+0x1d1/0x260 [ 358.573947][T11745] do_exit+0x8d6/0x2550 [ 358.578122][T11745] do_group_exit+0x21c/0x2d0 [ 358.582722][T11745] __x64_sys_exit_group+0x3f/0x40 [ 358.587772][T11745] x64_sys_call+0x21ba/0x21c0 [ 358.592512][T11745] do_syscall_64+0xf6/0x210 [ 358.597037][T11745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.602941][T11745] [ 358.605273][T11745] Last potentially related work creation: [ 358.611007][T11745] kasan_save_stack+0x3e/0x60 [ 358.615696][T11745] kasan_record_aux_stack+0xbc/0xd0 [ 358.620901][T11745] insert_work+0x3d/0x330 [ 358.625248][T11745] __queue_work+0xcfc/0xfe0 [ 358.629789][T11745] queue_delayed_work_on+0x18b/0x280 [ 358.635087][T11745] l2cap_chan_del+0x285/0x5e0 [ 358.639775][T11745] l2cap_conn_del+0x388/0x680 [ 358.644468][T11745] hci_conn_hash_flush+0x10d/0x230 [ 358.649584][T11745] hci_dev_close_sync+0xaef/0x1330 [ 358.654706][T11745] hci_unregister_dev+0x206/0x500 [ 358.659734][T11745] vhci_release+0x80/0xd0 [ 358.664068][T11745] __fput+0x449/0xa70 [ 358.668051][T11745] task_work_run+0x1d1/0x260 [ 358.672648][T11745] do_exit+0x8d6/0x2550 [ 358.676810][T11745] do_group_exit+0x21c/0x2d0 [ 358.681413][T11745] __x64_sys_exit_group+0x3f/0x40 [ 358.686444][T11745] x64_sys_call+0x21ba/0x21c0 [ 358.691127][T11745] do_syscall_64+0xf6/0x210 [ 358.695642][T11745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.701535][T11745] [ 358.703859][T11745] The buggy address belongs to the object at ffff88807af80000 [ 358.703859][T11745] which belongs to the cache kmalloc-8k of size 8192 [ 358.717915][T11745] The buggy address is located 3152 bytes inside of [ 358.717915][T11745] freed 8192-byte region [ffff88807af80000, ffff88807af82000) [ 358.731903][T11745] [ 358.734234][T11745] The buggy address belongs to the physical page: [ 358.740641][T11745] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7af80 [ 358.749409][T11745] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 358.757914][T11745] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 358.765472][T11745] page_type: f5(slab) [ 358.769461][T11745] raw: 00fff00000000040 ffff88801a042280 dead000000000122 0000000000000000 [ 358.778052][T11745] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 358.786643][T11745] head: 00fff00000000040 ffff88801a042280 dead000000000122 0000000000000000 [ 358.795314][T11745] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 358.803989][T11745] head: 00fff00000000003 ffffea0001ebe001 00000000ffffffff 00000000ffffffff [ 358.812665][T11745] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 358.821331][T11745] page dumped because: kasan: bad access detected [ 358.827761][T11745] page_owner tracks the page as allocated [ 358.833476][T11745] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5837, tgid 5837 (kworker/u9:4), ts 348007430713, free_ts 346489373563 [ 358.855029][T11745] post_alloc_hook+0x1d8/0x230 [ 358.859818][T11745] get_page_from_freelist+0x21e0/0x22c0 [ 358.865379][T11745] __alloc_frozen_pages_noprof+0x181/0x370 [ 358.871189][T11745] alloc_pages_mpol+0x232/0x4a0 [ 358.876051][T11745] allocate_slab+0x8a/0x3b0 [ 358.880557][T11745] ___slab_alloc+0xbfc/0x1480 [ 358.885245][T11745] __kmalloc_cache_noprof+0x296/0x3d0 [ 358.890639][T11745] __hci_conn_add+0x233/0x1b30 [ 358.895411][T11745] hci_conn_request_evt+0x53e/0xb60 [ 358.900627][T11745] hci_event_packet+0x7e0/0x1200 [ 358.905566][T11745] hci_rx_work+0x46a/0xe80 [ 358.910006][T11745] process_scheduled_works+0xade/0x17a0 [ 358.915574][T11745] worker_thread+0x8a0/0xda0 [ 358.920281][T11745] kthread+0x70e/0x8a0 [ 358.924394][T11745] ret_from_fork+0x4b/0x80 [ 358.928825][T11745] ret_from_fork_asm+0x1a/0x30 [ 358.933593][T11745] page last free pid 11077 tgid 11077 stack trace: [ 358.940095][T11745] __free_frozen_pages+0xb14/0xce0 [ 358.945224][T11745] vfree+0x1a6/0x330 [ 358.949142][T11745] kcov_close+0x28/0x50 [ 358.953308][T11745] __fput+0x449/0xa70 [ 358.957300][T11745] task_work_run+0x1d1/0x260 [ 358.961905][T11745] do_exit+0x8d6/0x2550 [ 358.966084][T11745] do_group_exit+0x21c/0x2d0 [ 358.970697][T11745] __x64_sys_exit_group+0x3f/0x40 [ 358.975738][T11745] x64_sys_call+0x21ba/0x21c0 [ 358.980426][T11745] do_syscall_64+0xf6/0x210 [ 358.984937][T11745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.990845][T11745] [ 358.993175][T11745] Memory state around the buggy address: [ 358.998817][T11745] ffff88807af80b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 359.006882][T11745] ffff88807af80b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 359.014943][T11745] >ffff88807af80c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 359.023019][T11745] ^ [ 359.029719][T11745] ffff88807af80c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 359.037796][T11745] ffff88807af80d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 359.045865][T11745] ================================================================== [ 359.077768][T11745] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 359.085026][T11745] CPU: 1 UID: 0 PID: 11745 Comm: syz.1.1679 Not tainted 6.15.0-rc7-syzkaller-01759-gf5b60d6a575a #0 PREEMPT(full) [ 359.097127][T11745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 359.107220][T11745] Call Trace: [ 359.110530][T11745] [ 359.113485][T11745] dump_stack_lvl+0x99/0x250 [ 359.118133][T11745] ? __asan_memcpy+0x40/0x70 [ 359.122764][T11745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 359.128011][T11745] ? __pfx__printk+0x10/0x10 [ 359.132639][T11745] panic+0x2db/0x790 [ 359.136580][T11745] ? __pfx_panic+0x10/0x10 [ 359.141035][T11745] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 359.146961][T11745] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 359.153343][T11745] ? print_memory_metadata+0x314/0x400 [ 359.158854][T11745] ? cfusbl_device_notify+0x150/0x6a0 [ 359.164275][T11745] check_panic_on_warn+0x89/0xb0 [ 359.169265][T11745] ? cfusbl_device_notify+0x150/0x6a0 [ 359.174695][T11745] end_report+0x78/0x160 [ 359.178985][T11745] kasan_report+0x129/0x150 [ 359.183547][T11745] ? cfusbl_device_notify+0x150/0x6a0 [ 359.188974][T11745] cfusbl_device_notify+0x150/0x6a0 [ 359.194223][T11745] ? net_generic+0x1e/0x240 [ 359.198777][T11745] ? __pfx_cfusbl_device_notify+0x10/0x10 [ 359.204545][T11745] ? caif_device_notify+0x250/0xfc0 [ 359.209792][T11745] ? smc_pnet_netdev_event+0x3b5/0x6c0 [ 359.215319][T11745] notifier_call_chain+0x1b3/0x3e0 [ 359.220468][T11745] register_netdevice+0x121c/0x1ae0 [ 359.225690][T11745] ? __mutex_lock+0x51b/0xe80 [ 359.230406][T11745] ? __pfx_register_netdevice+0x10/0x10 [ 359.235972][T11745] ? __asan_memset+0x22/0x50 [ 359.240581][T11745] ? dev_addr_mod+0x2ce/0x3d0 [ 359.245327][T11745] register_netdev+0x40/0x60 [ 359.249950][T11745] bnep_add_connection+0x6bf/0xbf0 [ 359.255101][T11745] ? __pfx_bnep_add_connection+0x10/0x10 [ 359.260754][T11745] ? __fget_files+0x3a0/0x420 [ 359.265467][T11745] do_bnep_sock_ioctl+0x40e/0x640 [ 359.270517][T11745] ? __pfx_do_bnep_sock_ioctl+0x10/0x10 [ 359.276073][T11745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 359.281707][T11745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 359.287361][T11745] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 359.293020][T11745] ? call_rcu+0x6dd/0x990 [ 359.297360][T11745] sock_do_ioctl+0xdc/0x300 [ 359.301871][T11745] ? __pfx_sock_do_ioctl+0x10/0x10 [ 359.307000][T11745] ? __lock_acquire+0xaac/0xd20 [ 359.311885][T11745] sock_ioctl+0x576/0x790 [ 359.316223][T11745] ? __pfx_sock_ioctl+0x10/0x10 [ 359.321079][T11745] ? __fget_files+0x3a0/0x420 [ 359.325775][T11745] ? __fget_files+0x2a/0x420 [ 359.330398][T11745] ? bpf_lsm_file_ioctl+0x9/0x20 [ 359.335346][T11745] ? __pfx_sock_ioctl+0x10/0x10 [ 359.340198][T11745] __se_sys_ioctl+0xf9/0x170 [ 359.344805][T11745] do_syscall_64+0xf6/0x210 [ 359.349340][T11745] ? clear_bhb_loop+0x60/0xb0 [ 359.354042][T11745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.359948][T11745] RIP: 0033:0x7fbb8638e969 [ 359.364385][T11745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 359.384015][T11745] RSP: 002b:00007fbb87231038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 359.392448][T11745] RAX: ffffffffffffffda RBX: 00007fbb865b6160 RCX: 00007fbb8638e969 [ 359.400518][T11745] RDX: 00002000000000c0 RSI: 00000000400442c8 RDI: 000000000000000a [ 359.408523][T11745] RBP: 00007fbb86410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 359.416526][T11745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 359.424542][T11745] R13: 0000000000000000 R14: 00007fbb865b6160 R15: 00007ffc689047a8 [ 359.432535][T11745] [ 359.435846][T11745] Kernel Offset: disabled [ 359.440181][T11745] Rebooting in 86400 seconds..