last executing test programs: 5m42.683590892s ago: executing program 0 (id=6168): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x2, 0x2000005}, 0x1c) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYRES8], 0x1c}, 0x1, 0x0, 0x0, 0x44014}, 0x20040810) write$tun(r0, &(0x7f0000000540)=ANY=[@ANYBLOB="034886dd0900300003003000001260ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff0200000000000000000000000000011200", @ANYRES16], 0xfdef) 5m41.973588081s ago: executing program 0 (id=6178): r0 = socket$key(0xf, 0x3, 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="0005020008"], 0xe) (async) r2 = socket$qrtr(0x2a, 0x2, 0x0) recvmsg$qrtr(r2, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000002740)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/255, 0xff}, {&(0x7f00000013c0)=""/229, 0xe5}, {&(0x7f00000014c0)=""/186, 0xba}, {&(0x7f0000001580)}, {&(0x7f00000015c0)=""/195, 0xc3}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/112, 0x70}], 0x8, &(0x7f00000027c0)=[{0xf0, 0x0, 0x0, ""/221}, {0xb8, 0x0, 0x0, ""/164}, {0x108, 0x0, 0x0, ""/241}], 0x2b0, 0x40000161}, 0x38, 0x80000003) (async, rerun: 32) sendmsg$key(r0, &(0x7f0000000000)={0x3, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x2, 0x4, 0x0, 0xfb165b60812efe9e, 0xe, 0x0, 0x1, 0x0, [@sadb_ident={0x2, 0xb, 0x5, 0x0, 0xced0}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d3}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e21, 0x364, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x3}, @in6={0xa, 0x4e22, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0) (rerun: 32) 5m41.823423557s ago: executing program 0 (id=6179): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000000008000"], 0x9) openat$cgroup_int(r0, &(0x7f0000000100)='cpu.weight\x00', 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f00000000c0)={0x10, 0xa5}, 0x2) socket$kcm(0x2, 0x3, 0x2) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r3, 0x29, 0xc8, 0x0, 0xc000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f00000003c0)=ANY=[@ANYBLOB="04000000ffffffffffffaaaaaaaaaaaa8100000086dd60b79a5600442900fe8000000000000000000000000000aaff03"], 0x82) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000444578ccab2879800100000000000500000a28000000020a010200000000000000000a000006090000000000000000080000f9ff0240000000018c000000020a010100000000000068000000000369000e00090007258a6d38caf4cb1d7a776a6a05e57912414e63207c5e61d47bb4016b21bd5593b033b0968722f2f0f4818a1a13fbb43e79d0ae674d071c0164df9d3701cc05211300766b6ebe3279da9e49cca5c2a07460e46e35eabfb48a2dd2cd83790d7e705b010000000900010073797a31000000001c00000009f467ee13000000000000000a00000208000c51040000"], 0xf8}, 0x1, 0x0, 0x0, 0x2000c014}, 0x4000) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000003580), r6) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r7, &(0x7f00000001c0)={0x27, 0x0, 0x0, 0x2, 0x0, 0x49, "c46e9fd1a84b7fa0bf2cca6beb9363a680b652a86bcf56a1b9ca5386103a5ccbe47b7b9aa6d8d701a3ba00000000b97800001022f987617c318500", 0x3a}, 0x60) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r7, 0x118, 0x1, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0x8}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0x7, 0x2}}]}, 0x2c}}, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000b00000000000500000014000500200100000000000000000100000000001c00090008"], 0x4c}}, 0x40000) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r9, 0x6, 0x1, &(0x7f0000000000)={0x101, 0x7, 0x4, 0xa, 0x7f, 0x3, 0xf7e}, 0xc) socket$nl_route(0x10, 0x3, 0x0) 5m41.244406427s ago: executing program 0 (id=6183): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x7fffffffff, 0x200008, 0x4000000000011, 0x2, 0xffffffffffffffff, 0x4000000000000004, 0x7, 0x2}, 0x0, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r1, 0xf503, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120012000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 5m40.960305676s ago: executing program 0 (id=6187): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x2, 0x2000005}, 0x1c) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYRES8], 0x1c}, 0x1, 0x0, 0x0, 0x44014}, 0x20040810) write$tun(r0, &(0x7f0000000540)=ANY=[@ANYBLOB="034886dd090030000300300003e860ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff0200000000000000000000000000011200", @ANYRES16], 0xfdef) 5m39.986558376s ago: executing program 0 (id=6191): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000480)=@l2tp6={0xa, 0x0, 0xa, @private0, 0x7f, 0x2}, 0x80, 0x0}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newneigh={0x24, 0x1c, 0x5, 0x70bd25, 0x25dfdbfb, {0x7, 0x0, 0x0, r2, 0x2, 0x8, 0x4}, [@NDA_VNI={0x8, 0x7, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000fcffffff00000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000a0850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f00000002c0)={r5}, 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) write$cgroup_int(r6, &(0x7f0000000000)=0x100000001, 0x12) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000008c0)={&(0x7f0000000300)='p', &(0x7f0000000540)=""/130, &(0x7f0000000740)="8abf75b197b4c21eddf137c0a1e57fc467e41a95ffa789cec11416e73c8314ee02ec184421074c56ead00f8c6afb759ed3a266ca763e9861fc28542c6ac9d7492b54aa5bb950dbf1522e8f8b0e8032002eae0101f6837597b916498293eb60b03ad4a9a206b1cd9052bdac29da4324433e74a067d40b986f4683695155d943ee221f1dd9d727defd5b0a344f3a5da6f7d02578759a2ed9c0a3e2af0a172d76df47edcf08f9be9444af3721ae969077cb97d87e9732579be0d1adf0d23575181bbf3450799f7bdab2d661bfb14cbf0d98a9a8bc3ac1a48cda7992a6bb4fa1140430b135da3ce6e9d8e442fdc6", &(0x7f0000000840)="f9d31f5eecac749819d00a20a3694aa74ae566c27bc91aca1f91566b90c0d68c704bb938e48ac3984800879dd4cb28e8387221759693e038d6dca4731fe2f69c5d6a9127551aa81ecb48b932efa160d70585d8a680906bda2747dec0444b94944039394b57a919", 0xffff, r5, 0x4}, 0x38) write$cgroup_subtree(r6, 0x0, 0xfdef) write$cgroup_devices(r6, &(0x7f0000000800)=ANY=[], 0xffdd) accept(r4, &(0x7f0000000040)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000140)=0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRES16=r2], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r10, &(0x7f00000004c0)}, 0x20) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r11, 0xf505, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r9, 0x0, 0x489, 0x0, 0x0) sendmsg$netlink(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x20, 0xf, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8fea, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x67a021c03d2005e9, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r13 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r7) sendmsg$NLBL_MGMT_C_ADD(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010025bd7000fcdbdf250100000a08000700ffffffff0e0001006e65742f6c32636170000000080002000500052400000800ac1414bb59ba2baa31deaf4d0657057a81e26e5f8b8f80acd619f1fb00"/89], 0x3c}, 0x1, 0x2000a00, 0x0, 0x20040090}, 0x10) 5m24.862857073s ago: executing program 32 (id=6191): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000480)=@l2tp6={0xa, 0x0, 0xa, @private0, 0x7f, 0x2}, 0x80, 0x0}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newneigh={0x24, 0x1c, 0x5, 0x70bd25, 0x25dfdbfb, {0x7, 0x0, 0x0, r2, 0x2, 0x8, 0x4}, [@NDA_VNI={0x8, 0x7, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000fcffffff00000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000a0850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f00000002c0)={r5}, 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) write$cgroup_int(r6, &(0x7f0000000000)=0x100000001, 0x12) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000008c0)={&(0x7f0000000300)='p', &(0x7f0000000540)=""/130, &(0x7f0000000740)="8abf75b197b4c21eddf137c0a1e57fc467e41a95ffa789cec11416e73c8314ee02ec184421074c56ead00f8c6afb759ed3a266ca763e9861fc28542c6ac9d7492b54aa5bb950dbf1522e8f8b0e8032002eae0101f6837597b916498293eb60b03ad4a9a206b1cd9052bdac29da4324433e74a067d40b986f4683695155d943ee221f1dd9d727defd5b0a344f3a5da6f7d02578759a2ed9c0a3e2af0a172d76df47edcf08f9be9444af3721ae969077cb97d87e9732579be0d1adf0d23575181bbf3450799f7bdab2d661bfb14cbf0d98a9a8bc3ac1a48cda7992a6bb4fa1140430b135da3ce6e9d8e442fdc6", &(0x7f0000000840)="f9d31f5eecac749819d00a20a3694aa74ae566c27bc91aca1f91566b90c0d68c704bb938e48ac3984800879dd4cb28e8387221759693e038d6dca4731fe2f69c5d6a9127551aa81ecb48b932efa160d70585d8a680906bda2747dec0444b94944039394b57a919", 0xffff, r5, 0x4}, 0x38) write$cgroup_subtree(r6, 0x0, 0xfdef) write$cgroup_devices(r6, &(0x7f0000000800)=ANY=[], 0xffdd) accept(r4, &(0x7f0000000040)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000140)=0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYRES16=r2], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r10, &(0x7f00000004c0)}, 0x20) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r11, 0xf505, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r9, 0x0, 0x489, 0x0, 0x0) sendmsg$netlink(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x20, 0xf, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8fea, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x67a021c03d2005e9, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r13 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r7) sendmsg$NLBL_MGMT_C_ADD(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010025bd7000fcdbdf250100000a08000700ffffffff0e0001006e65742f6c32636170000000080002000500052400000800ac1414bb59ba2baa31deaf4d0657057a81e26e5f8b8f80acd619f1fb00"/89], 0x3c}, 0x1, 0x2000a00, 0x0, 0x20040090}, 0x10) 2m35.237762857s ago: executing program 2 (id=8270): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081"], &(0x7f0000000140)='GPL\x00'}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x9) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000017c0)=r0, 0x4) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x20000003, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffff7e}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x27}, 0x94) (async, rerun: 64) syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x86dd}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) (rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge0\x00'}) (async, rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) (rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x18, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x41da}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffc}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x480}}, [@printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @jmp={0x5, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffff4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0xae}}}, &(0x7f0000000080)='GPL\x00', 0x9, 0xffe, &(0x7f0000000cc0)=""/4094, 0x41100, 0x44, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x400c095}, 0x44) (rerun: 64) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000050c0200000c0a01030000000000000000070000080900020073797a31000000000900010073797a3000000000e0010380dc010080080003400000000273000b802c0001800a0001006c696d69740000001c0002800c00014000000000000000030c000240000000000000000e14000180090001006c617374"], 0x290}}, 0x0) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) (rerun: 32) write$cgroup_subtree(r4, &(0x7f0000000500)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) (async) getpeername$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x700, 0x8, 0x3, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x11, 0x0}, @private=0xa010101}}}}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[], 0x68}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000ac0)=@newsa={0x144, 0x10, 0x1, 0x8000000, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x5680000000}, {0x10, 0x9, 0x2}, 0x0, 0x0, 0x2, 0x1}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}}}, @offload={0xc, 0x1c, {0x0, 0x1}}]}, 0x144}}, 0x0) (async, rerun: 32) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_SET_REG(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)={0x68, r7, 0x1, 0x70bd2c, 0x25dfdc00, {}, [@NL80211_ATTR_REG_RULES={0x4c, 0x22, 0x0, 0x1, [{0x4}, {0x4}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xff}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x101}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xffff2547}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x5}]}, {0x4}, {0x4}, {0x4}]}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040001}, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), 0xffffffffffffffff) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) (rerun: 64) sendmsg$NL802154_CMD_NEW_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x30, r9, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x800) 2m35.160160585s ago: executing program 2 (id=8271): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) r2 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) sendfile(r2, r3, &(0x7f0000000180)=0x7fffffff, 0x86) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_freezer_state(r4, &(0x7f0000000140), 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2400000019000100040000000000000080200009100400050000000008000300e9"], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendfile(r5, r5, 0x0, 0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0x2e}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}]}, 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r7, 0x4) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000000340)="14", 0x1}], 0x1}, 0x0) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r0) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="d358d475", @ANYRES16=r9, @ANYBLOB="010126bd700000ccdf25230000000a0001007770616e300000000800240005000000"], 0x28}, 0x1, 0x0, 0x0, 0x24040004}, 0x0) 2m35.072600365s ago: executing program 2 (id=8274): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x6, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f00000001c0)=[0x401], 0x0, 0x2000000026fe, 0x1, 0x1}}, 0x40) r1 = socket(0x2b, 0x1, 0x1) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, 0x0, 0x78) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x9c}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) 2m34.973177299s ago: executing program 2 (id=8278): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000001c0001fc28bd7000fcdbdf2507000000", @ANYRES32=r1, @ANYBLOB="8000260b0a0002000180c200000c00000c000e8005"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040010) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61123000000000006113830000000000bf2000000000000015000200071b1750bd030100000000009500000000000000bc26080000000000bf67000000000000070300000fff0700670200000300000016060a000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) 2m34.821448578s ago: executing program 2 (id=8281): socketpair$tipc(0x1e, 0x5, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x40, r3, 0x1, 0x70bd28, 0x40, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x4800}, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000001640), 0x0, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x3c, r5, 0x1, 0x70bd2b, 0x1000, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x122}, @NBD_ATTR_BACKEND_IDENTIFIER={0xd, 0xa, 'list:set\x00'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}]}, 0x3c}}, 0x400400c) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007119b700000000008510000002000000850000002a00000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x6}, 0x2b) 2m34.648439792s ago: executing program 2 (id=8284): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000400)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x1, 0x10}}, 0x12) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = socket$key(0xf, 0x3, 0x2) socket(0x28, 0x1, 0x1000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) ioctl$SIOCX25GSUBSCRIP(r0, 0x89e0, &(0x7f0000000280)={'ip6erspan0\x00', 0x5, 0x1}) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x3c, r4, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_MLSCATLST={0x10, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2196d664}]}]}]}, 0x3c}}, 0x24000000) (async) sendmsg$key(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x2, 0x1, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_spirange={0x2, 0x10, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x50}}, 0x0) (async) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x25dfdc00, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x8840) 2m19.590571152s ago: executing program 33 (id=8284): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000400)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x1, 0x10}}, 0x12) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = socket$key(0xf, 0x3, 0x2) socket(0x28, 0x1, 0x1000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) ioctl$SIOCX25GSUBSCRIP(r0, 0x89e0, &(0x7f0000000280)={'ip6erspan0\x00', 0x5, 0x1}) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x3c, r4, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_MLSCATLST={0x10, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2196d664}]}]}]}, 0x3c}}, 0x24000000) (async) sendmsg$key(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x2, 0x1, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_spirange={0x2, 0x10, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x50}}, 0x0) (async) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x25dfdc00, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x8840) 17.423520692s ago: executing program 3 (id=8950): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x85686d2a9e7d42de}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$inet6(0xa, 0x1, 0x100) close(0x3) close(r2) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) close(r0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r0, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r3 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r3, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="2300000004002305acfc532041bc000000000000333568", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000128000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b707000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000), 0x4) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0xc03, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001440)=ANY=[], 0x60}}, 0x4000) setsockopt$packet_int(r5, 0x107, 0xb, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r5, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) bind(r5, &(0x7f00000000c0)=@in6={0xa, 0x4e21, 0x9, @loopback, 0xa}, 0x80) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x3, &(0x7f00000001c0)=0x3, 0x4) 17.005947505s ago: executing program 3 (id=8962): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) socket$rds(0x15, 0x5, 0x0) (async) r1 = socket$rds(0x15, 0x5, 0x0) r2 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f0000000040)) (async) ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f0000000040)) getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000002d40)=""/4096, &(0x7f0000003d40)=0x1000) ppoll(&(0x7f0000000000)=[{r0, 0x400}], 0x1, 0x0, 0x0, 0x0) 16.823922823s ago: executing program 3 (id=8963): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f00000025c0)=@newlink={0x5c, 0x10, 0x40d, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x600b2, 0x41c15}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x8, 0xee9}}]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8840}, 0x0) 16.692194162s ago: executing program 3 (id=8965): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket(0x2b, 0x1, 0x1) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, 0x0, 0x0) (async, rerun: 64) unshare(0x22020600) (async, rerun: 64) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0x58) (async, rerun: 64) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)={0x4c, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) (async, rerun: 64) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x10, 0x32, 0x3, 0x0, 0x0, 0x0, 0x0, @in=@rand_addr=0x10006c00, @in6=@private2}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$sock_ifreq(r4, 0x8937, &(0x7f0000000080)={'dummy0\x00', @ifru_flags=0x800}) (async) unshare(0x4000000) 16.266878263s ago: executing program 3 (id=8969): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newsa={0x154, 0x10, 0x1, 0x800, 0x80008, {{@in6=@remote, @in6=@loopback}, {@in=@empty, 0x0, 0x32}, @in6=@loopback, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc78}, {}, {0x0, 0x7}, 0x3, 0x0, 0xa, 0x0, 0xfd, 0xad}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}]}, 0x154}, 0x1, 0x0, 0x0, 0x48001}, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b705000008000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r4, 0x18000000000002a0, 0x62, 0x62, &(0x7f0000000600)="b9ff03075fe9008cb89e08e088a8", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x28) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000019c0)={'batadv0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="090b00000000000000000500000008000300", @ANYRES32=r5], 0x1c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="03800000000000001c0012800b00010067726574617000000c00028008000100", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000001c0)=r4}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002ac0)=@bpf_ext={0x1c, 0x1c, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x44}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@ldst={0x0, 0x3, 0x0, 0xc1d8db0523f36498, 0x0, 0xfffffffffffffff0, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xffffffff}, @map_idx={0x18, 0x1, 0x5, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}, @alu={0x7, 0x1, 0x5, 0xb, 0xe, 0xffffffffffffffc0, 0xffffffffffffffff}, @tail_call={{0x18, 0x2, 0x1, 0x0, r9}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='syzkaller\x00', 0x0, 0x1000, &(0x7f0000001a00)=""/4096, 0x40f00, 0x0, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000002a00)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000002a40)={0x4, 0xf, 0x7, 0x3}, 0x10, 0x2aa72, r4, 0x1, 0x0, &(0x7f0000002a80)=[{0x2, 0x1, 0x3, 0x4}], 0x10, 0x8}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r0) 9.520177292s ago: executing program 4 (id=9028): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448c9, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r1, 0x1, 0x21, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000200)={'veth1_vlan\x00', &(0x7f0000000180)=@ethtool_wolinfo={0x6, 0x0, 0x1, "2a62d2fce2e6"}}) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="148000001f000501"], 0x14}}, 0x44014) recvmmsg(r6, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4082, 0xff2}], 0x1}, 0xfffffffc}], 0x1, 0x2, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="6c0100001000130700000000fcdbdf256401010100000000000000000000000020010000000000000000000000000001ffff00004e2100020a0000001d000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000fe320000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff080000000000000001000000000000000b00000000000000ffffff7f00000000430500000000000004000000000000000200000000000080000000000000000000000000000000000200000000000000000000002bbd7000003500000a00040050000000000000001c00040002004e244e200000fe80000000000000000000000000002d60001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000215a576db7a512529eb9a200000000c538c7cb7a"], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) socket$packet(0x11, 0x3, 0x300) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmsg(0xffffffffffffffff, 0x0, 0x1f00) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000001c0)=@o_path={&(0x7f0000000340)='./file0\x00'}, 0x18) bind$bt_hci(r8, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) close(r9) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r10, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x17, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2000000}, {}, {}, [@ringbuf_query={{}, {}, {0x85, 0x0, 0x0, 0x17}}, @ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newtfilter={0xd8, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0xac, 0x2, [@TCA_BPF_ACT={0x4c}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0xd8}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 8.591562078s ago: executing program 4 (id=9033): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2080, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x9, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x90}, 0x1, 0x0, 0x0, 0x24000144}, 0x2000) close(r7) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r8], 0x54}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000000c0)) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x20) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) sendmsg$nl_route_sched(r2, 0x0, 0xc890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r9) sendmsg$BATADV_CMD_GET_DAT_CACHE(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x1c, r10, 0x83625fc5352ba305, 0x70bd2b, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r11) sendmsg$TIPC_CMD_ENABLE_BEARER(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB, @ANYRES64=0x0], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x20018000) r12 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r12, 0x29, 0x21, &(0x7f0000000080)=0x8, 0x4) connect$inet6(r12, &(0x7f0000000280)={0xa, 0x4e21, 0x5, @empty, 0x817f}, 0x1c) 6.48339635s ago: executing program 4 (id=9037): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYRESDEC=r1], 0x48) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @sack_perm, @window={0x3, 0x9, 0x9}, @window={0x3, 0x6, 0xff81}, @window={0x3, 0x8, 0x6}, @timestamp, @sack_perm, @window={0x3, 0x1, 0x5}], 0x8) sendto$inet(r4, &(0x7f00000007c0)='%', 0x1, 0xe044, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r4, &(0x7f0000000380)='x', 0x1, 0x480c1, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r3}, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3, 0x10, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc00d100, 0x0, 0x0, 0x0, 0x100}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}, {}, {0x85, 0x0, 0x0, 0xb6}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r5, 0x0, 0xe, 0x0, &(0x7f00000000c0)="9dbaac999f69835fc48373a1ee57", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="3000000010000108000000000000000000004000", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004004400000008001b0000000000"], 0x30}}, 0x0) 6.180785448s ago: executing program 5 (id=9040): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="b60a0000000000006911b60000000000180000000000000000000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x3, 0xf}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_EMATCHES={0x60, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x54, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x5, 0x7, 0x4c2}, {{0x2}, {0xf0ffff, 0x1, 0x0, 0x1}}}}, @TCF_EM_CONTAINER={0x3c, 0x1, 0x0, 0x0, {{0x78a0, 0x0, 0x5}, "74ac2cc0e6713f350f10a631bc0256225bf04d5ffe09f254386530b440e819e362d4284893ea2508c56540422d70"}}]}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x24000045}, 0x2008c014) 5.882537062s ago: executing program 5 (id=9044): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x1, 0x7, 0x9, 0xfffffffc}, 0x32}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x2) close(0xffffffffffffffff) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f00000004c0)=@xdp={0x2c, 0x0, r2, 0x18}, 0x80, &(0x7f00000008c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005000024c1020000ff88125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) 5.513741773s ago: executing program 5 (id=9046): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x80) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000fcdbdf2512000000180001801400020076657468300000000000000008000000080009"], 0x3c}, 0x1, 0x0, 0x0, 0x400c000}, 0x2004c0a0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000140), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d40)={0x0, 0xe0, &(0x7f0000000d00)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c020000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843e40108804400208024000100000000000100000000000000fdffff01000000000000000000000000000000001400040003000000ac1414bb00000000000000000600050000000000000100802400020073e591ec06154031d3954ac0e16752e72640f08b5281a8461d17d26d12f2bbb6060005000021000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39228c00098028000080060001000a0000001400020020010000000000000000000000000001050003000000000088000080060001000a0000001400020020010000000000000000000000000002050003000000001003800080060001008c0e000008000200ac1414aa05000300000000001c000080060001000200000008000200ac1414bb0500030000000000200004000e00000000000000fe800000000000000000000000000000000000009c0000802400020073961633df6dc9cb418b15afd0bae7b90f1e6cfed8bb423cf9285c474163154908000a00010000002400010000000000000000000000000000000000000000000000000000000000000000004800098028000080060001000a00000014000200fe8000000000000000000000000000bb05000300000000001c000080060001000200000008000200000000000500030000000000080005000100000008000100", @ANYRES32=r3], 0x22c}}, 0x0) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}}, 0x0) sendto$inet6(r4, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000080), 0x4) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r5, &(0x7f0000000200)="e5fcda292879d0af3b5ce1e7a6177ac644c4fb76d5906ec34b864ab7b7b5290e76af3dbbcb20ade9fd31e71b01970056f0da0bc2394e0dea6cf6883191602dc8c6ba", &(0x7f0000000280)=""/241}, 0x20) sendmsg$inet(r6, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000140)="be", 0x1}], 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aaac14140000000b0014000000000000000000000007"], 0x38}, 0x0) sendmsg$NFT_MSG_GETGEN(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x10, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r7, 0x0, 0x0) ioctl$sock_SIOCBRADDBR(r5, 0x89a0, &(0x7f0000000180)='ip6erspan0\x00') setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000140)=0x7, 0x4) 5.195080339s ago: executing program 1 (id=9048): r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="e50002000000000071113d00000000008510000002000000850000007d00000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) 5.125569825s ago: executing program 5 (id=9050): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="40050102"], 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x123542, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETMIFCNT_IN6(r5, 0x89e0, &(0x7f0000000280)={0x1}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) r8 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f00000003c0)={0x2, 0x4e20, @multicast2}, 0x10) listen(r8, 0x8) r9 = accept4(r8, 0x0, 0x0, 0x0) write(r9, &(0x7f0000000000)="ea", 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r9, 0x84, 0x22, &(0x7f0000000580)={0x5, 0x201, 0xffffffff, 0x1}, 0x10) write(r9, &(0x7f00000002c0)="04", 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r9, 0x84, 0x22, &(0x7f0000000100)={0x3, 0x0, 0x2}, 0x10) writev(r9, &(0x7f0000000140)=[{&(0x7f0000000040)='w', 0x1}], 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r9, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r9, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x4}, 0x8) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}}, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00'}, 0x94) write$tun(r10, &(0x7f00000001c0)=ANY=[@ANYBLOB="70000000e9ffffffffffaaaaaaaaaabb08004500001400002000002f9078ac1e0001e00000010000655800189078040000000000000086dd"], 0xfdef) 5.04865968s ago: executing program 1 (id=9051): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x60, 0xc, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x4040000) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68a75f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681d068e055eb34e5f8fc7a524ffe5f4632a6c74ad0fe0b1542497d76a5a4416c47805e001c0005800800014000000008080002"], 0x1ec}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) 4.938848715s ago: executing program 1 (id=9053): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000f40)=ANY=[@ANYRES32=r0, @ANYRESOCT=r1, @ANYRES16=r1, @ANYRESHEX=r1, @ANYRES8=r0], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0xf, &(0x7f0000000800)=ANY=[@ANYBLOB="180000000b00000000000000840e000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005514fc00000000009500000000000d00bf91000000000000b7020000010000000200000084000000b70000000000000095000000000000003ad5e28a2c2d7697b07d4d0e3364d517b7727093b65b8da9128d606f1e8dcd8a19fdeb309fc22b332fac7fd89542994456f0"], &(0x7f0000000100)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, r1}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000700)="4ef2709ac43b1b79f45a31546467344e44172f54f721df76a1d0b4fabd734b66ba8682cd577d3ce95e5de35e24faddcbe77a9e4853b21b5c18912fa680ec5849e72cd887d072f4c9e8fc6e3bdd2edc45a7374f953017e73b35201389069fbcbf8fdc2f1b03792ab6a54ea4602de6bc50e668d6b8554026223c06bb5b3709b72ba1a0e938deda53cc6253bb4a", 0x8c}], 0x1, &(0x7f00000008c0)=[@mark={{0x14, 0x1, 0x24, 0x9}}], 0x18}, 0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB="120000000b00000604000000023428997c5978232abfb05c633fe4ae0d29f832565836d368ff87c0d0c161befcc25169e2a36c840fc2da8c61fdffacbe00a3a77809ad20e11985a756", @ANYBLOB="8b71f78ddcb6d9dfa7f2d2d8133889e75e8366c7b2386b58bde2d95f2d3ba730e3a6e7a8e10619c2309d3e328fe306f4849b27e59ea3c1c0b1e3a779d75cab0100000087c7e170856ec79cb157994c42ef3b20a0dab04d1f7fac99a2ba4f2db6d3cdfda28bff45fb66f7b9ea4f02f2b167f27156965511ba35fee95edc05df23a9ed727c29371341a4d2ba73d9a7a94348737d50fae6f2aa8e967a90a692d23a5b09000000000000000000002ac213fb78b117ae29ee91e371c6cb3ae53bac8967f4adb89099921426b377c3e1a4cb2754f4021c8543ab48db36bc0da4f8ced5c70c58cafeb7667af8aa80cd1e456f77f849fa7f48a9cdde1daafd563c1131d40ed8615bdc2656c34bbcf33c53107225e44d5501bab0db676c831525295792d6dfb3e867dfc190bfc7ee7c1d3596a5f4b0e12969cd228008000f0949317c05e0608af4a6c015291c", @ANYRES16=r3], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r6, &(0x7f0000000080), 0x0}, 0x20) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40800}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2, 0x3032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(r9, 0x1, 0x37, 0x0, &(0x7f00000000c0)) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500090000000000000002000000300003802c0100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a3000000000140000001100010000000000000000000300000af7dad60fd09cedf7e989fb8d43cf55b8fab9736d2bda8ab2240a9f75ab9d1f0810fa5a48f85561a42f368703375f762045d2d09e83bd3fc3bc99ad656d93900d974fb55a0008420d991e28f5710b19049248c31b983d3ee2cb6ccd0e930973f47825603bb3ee64b4e406c4df4fc4ea41ff485ce08208ce2d43a2b3013f734a44b7362a0000000000"], 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000c00)={&(0x7f0000000940)="d507a655e88dca0f26b0a98bf1a7a043dca5d045aaa23d5ba13f9f2f1394e56831dd3788127f6bb62b51e8825a269665a45edcc63c567d0ed42da397b43e5fec9646da48a6ae75544374d4bfca4b30df8f", &(0x7f0000000a00)=""/237, &(0x7f0000000b00)="d58254dfbb0a17b4dbdcbe4a133708de16b1f5201f73ad76d661777487d2b23c0bb392a2db7f27be17fdd928f939d16ef32c4d57515b3e21aab2f5", &(0x7f0000000b40)="0f418ad7fc5789897e2d00cf1b938ce18759cc57d866f1952a1b13a8704da416087c1bd480e92c725e0a1d93d3a3e68130870a42f1eebeb14143218d5a0f7fc76084a3498cc3c12f0a11c32ad1695e357eab8d16abe25ed4e5e85cb52ed439be0de151c452eb70f2a4e2c7b34eb16407d1bb3147698d5523fcc4e169843094e6cbff90db6096e5387a0f95f0943669d75b2383f1e7ebc085e6aef3374c9b98745500e6550f42f8616bd4", 0xfffffffe, r5, 0x4}, 0x38) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYBLOB="02c00cd6"], 0xc4}, 0x1, 0x0, 0x0, 0x40840}, 0x4004) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r11}, &(0x7f0000000240), &(0x7f0000000280)=r12}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r12, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000080)="b9ff05760a03076804268c989e14", 0x0, 0x10503, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000480)='reno', 0x4) write$tun(r7, &(0x7f00000006c0)=ANY=[@ANYBLOB="00000018030403000700c5001000"], 0xfb) 4.526115279s ago: executing program 5 (id=9055): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x1, 0x7, 0x9, 0xfffffffc}, 0x32}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x2) close(r0) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f00000004c0)=@xdp={0x2c, 0x0, r2, 0x18}, 0x80, &(0x7f00000008c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005000024c1020000ff88125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) 4.184980741s ago: executing program 5 (id=9057): close(0xffffffffffffffff) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x32, 0x16}, [@call={0x5c}]}, &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0xfe8e}, 0x3f) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x24, &(0x7f0000000840)=ANY=[@ANYBLOB="1800f30080000000010000004000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000181a0000", @ANYRES32=r0, @ANYBLOB="000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018350000050000000000000000000000001409000f00000042b9f4ff0400000018000000020000000000000007000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x3) ioctl$XFS_IOC_PATH_TO_HANDLE(r3, 0xc0385869, &(0x7f0000000380)={r3, &(0x7f00000001c0)='\xa0\\\xa8Ol\x9c\x8e8S\xe2\xfdzp\xae\x0f\xb2\x0f\xa1R`\f\xb0\bE\x17O\b\ao\x8dxC', 0x200000, &(0x7f00000002c0)={@align=0x7, {0x7661, 0x81, 0x602, 0xbbf}}, 0x400, &(0x7f0000000300), &(0x7f0000000340)}) r5 = socket$pptp(0x18, 0x1, 0x2) ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f00000003c0)={r5}) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) sendmsg$inet(r6, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r6, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x488c4}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r9, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r9, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) sendmsg$kcm(r9, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010", @ANYRESHEX=r2, @ANYRESOCT=r1, @ANYRESHEX=r7], 0x10b8}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="40010000", @ANYRES16=r11, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000e3ff00000000000000000000000000001400020077673100000000000000000000000000f4000880d04aad2254956908c8380981172567fe8007f6658b07251c2d94b11b429b4d4cb6278b45d20593643ca194554c5fb1e525fec8"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x4c, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40090}, 0x44000) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_INTERFACE(r10, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r12, 0x8, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}}, 0x840) unshare(0x66000080) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a31000000f908000540000000020900020073797a310c00000008000a40fffffffc0800034000000014140000001100010000000000000000000100000a"], 0x6c}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) 3.308146784s ago: executing program 4 (id=9059): r0 = socket(0x2b, 0x800, 0x1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x60) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x1, 0xffffff99}, 0x8) 3.173910228s ago: executing program 4 (id=9060): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000300200000000000fcffffff850000000e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000004000000850000008600000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000015c0)={&(0x7f0000001480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@union={0x2}]}, {0x0, [0x5f, 0x61, 0x5f]}}, 0x0, 0x29, 0x0, 0x1}, 0x28) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) 3.007681171s ago: executing program 4 (id=9061): r0 = socket(0x10, 0x3, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000280)={r0, &(0x7f0000000080)='\\\'#]@\x00', 0x210203, &(0x7f0000000100)={@_ha_fsid={[0xb]}, {0x9, 0xf2b, 0x723}}, 0x0, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x5}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1, 0x20, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4}, {}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x1}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000500)='GPL\x00', 0xfffff427, 0x0, &(0x7f0000000540), 0x41000, 0x14, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x8, &(0x7f0000000580)={0x4, 0x3}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f00000005c0)=[0x1, 0xffffffffffffffff, 0x1, 0x1], &(0x7f0000000600)=[{0x0, 0x3, 0x3, 0xc}], 0x10, 0x1}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@fallback=r0, 0x5, 0x0, 0x8, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0], &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000900)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000880), &(0x7f00000008c0)='%pK \x00'}, 0x20) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$int_out(r5, 0x5460, &(0x7f0000000080)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000840)={@map=r4, r1, 0x27, 0x10, r2, @void, @value=r5, @void, @void, r3}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x20, 0x1e, 0x21, 0x70bd2b, 0x0, {0x7}, [@typed={0x5, 0x12c, 0x0, 0x0, @str='\x00'}, @nested={0x4, 0xf}]}, 0x20}, 0x1, 0x0, 0x0, 0x2008800}, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r7, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r0], 0x40}}, 0x0) pselect6(0x40, &(0x7f00000003c0)={0x4, 0x8, 0x833, 0x1, 0x7, 0x2, 0xd, 0x1}, 0x0, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 3.00015757s ago: executing program 3 (id=8972): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000140)=ANY=[@ANYBLOB="1800ee0ad006180fb779e81aa1c10000", @ANYRES16=0x0, @ANYBLOB="00022dbd7000fedbdf251300000004000280"], 0x18}, 0x1, 0x0, 0x0, 0x840}, 0x40044) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="24000000380025082abd7000f9dbdf250f000000100007800c00038008005900", @ANYRES32=0x0, @ANYBLOB="aa2703a72661e7b1517bb7474c6d50f9008cb4b59d7a732786689d0cc21b016bbf3b8c0cfd4f12a0685a06b65b4f001cb793868e8fe1bf5398a372f39c19e8e588da01834eeb09333a1626a4d5c2f11b3ab247abf9ca8cd55a086d937f2b73e809004b5934e221e96c03191dcd306c4423fc3eb7295c326da4d7d28cf5758e6af542fe6bcc8f4a02da"], 0x24}, 0x1, 0x0, 0x0, 0x4050}, 0x804c050) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000280)=ANY=[@ANYRES16=r1, @ANYRES32=0x0, @ANYRES64=r5], 0x68}, 0x1, 0x0, 0x0, 0x95}, 0x4000004) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0xb4, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xfff1}, {0xfff3, 0xf}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x84, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x10001}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x30, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x6}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x7f}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x6}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5}]}]}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x81}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x2f}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x4}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x8000}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x6}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8001}, 0x20000c40) unshare(0x64000600) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000002000010027bd700000000040020000000000000d00000000080018004e224e23"], 0x24}, 0x1, 0x0, 0x0, 0x24040804}, 0x4008000) syz_emit_ethernet(0x2e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaa2aaaaaaaaaaaaabb810000000806000108000604000000000180c200000eac1414aa"], 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x40084) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, 0x0, 0x0) r9 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r9, &(0x7f0000000040)={0x18, 0x0, {0x1, @broadcast, 'ip6gre0\x00'}}, 0x1e) r10 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r10, &(0x7f0000000040)={0x18, 0x0, {0x1, @broadcast, 'ip6gre0\x00'}}, 0x1e) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r11) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r12 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newchain={0x0, 0x64, 0x100, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x1, 0xffff}, {0xa}, {0x7, 0xd}}, [@TCA_CHAIN, @TCA_CHAIN={0x0, 0xb, 0x200}, @TCA_RATE={0x0, 0x5, {0xa, 0x2}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x8080) socket$kcm(0x11, 0x3, 0x0) 2.708781365s ago: executing program 1 (id=9062): sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x488c1) r0 = socket(0x10, 0x3, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000000400)={{0x0}, 0x0, 0x70}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x100, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x20, 0x72, 0x7e3bfe4fa73db39f, 0x1, 0x0, {0x7, 0x0, 0x0, r3}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}}, 0x4000) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0xd, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x40001) 2.157881817s ago: executing program 1 (id=9064): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000980)={&(0x7f0000000680)={0x2cc, r1, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x4}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfe6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffff9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x80000001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xfff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9c}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x48, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x154, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xfffffffc}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xc7}, @TIPC_NLA_NODE_ID={0xaa, 0x3, "5e412d7b47b4e8774e131091bf2882c7ade996de233270307689f89a1bf6169bbdbb11e18250a58b65fd99da711312675d535fe749605ea20adcc8287ec9c373a010f6d976d7d2956aba772b4cb976e59fae9a1f76fa92bd9219eaecaaeae35ffe4e69534f22425091e501ec1b2c2aaf5f4ba24ce7bad904eff3a0295e067f24083280ca27b487cf1587cefe1dd69a8489b9d6626a5ff9030689ec10e4b1c0890b230c38ac75"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7f}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_ID={0x22, 0x3, "478111faeb5de6edb45e7cd507d1bdfe91bcabcfc361baf3355f50fb290f"}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "1eef3737280059c0db7b3a38c6b5fde55e53657c9ee708cc7b5c2d316fc076a82d"}}]}, @TIPC_NLA_BEARER={0x64, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'eth', 0x3a, 'dvmrp0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8}]}]}, 0x2cc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000004c0)={0x28, r2, 0x605, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x100}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x24) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x2, 0x3, &(0x7f0000000200)=@framed={{0x18, 0xa}}, &(0x7f0000000080)='syzkaller\x00', 0x4, 0x4, 0xffffffffffffffff, 0x0, 0x44}, 0x94) 1.921225657s ago: executing program 1 (id=9067): r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) setsockopt$llc_int(r0, 0x10c, 0x4, &(0x7f0000000140)=0x10, 0x4) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r3, &(0x7f00000004c0)}, 0x20) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) 1.303058827s ago: executing program 6 (id=9068): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) (async) recvmmsg(r0, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) (async) r2 = socket$pppl2tp(0x18, 0x1, 0x1) accept(r2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x14, 0x0, &(0x7f0000000080)="259a001471a76d2688a24e6588a8fb5e0af66395", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffff}, [@call={0x85, 0x0, 0x0, 0x27}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0xffffffff, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 883.831748ms ago: executing program 6 (id=9069): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000300)={&(0x7f0000000000)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000040)="b3", 0x1}], 0x1, &(0x7f0000000080)=[@init={0x18, 0x84, 0x0, {0x6, 0x101, 0x2a, 0x6}}], 0x18, 0x200008c0}, 0x6008045) 607.670966ms ago: executing program 6 (id=9070): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000180), r0) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NFC_CMD_DEACTIVATE_TARGET(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="824d90cd", @ANYRES16=r1, @ANYBLOB="010027bd7000fbdbdf251e000000"], 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x24004000) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newtaction={0xb4, 0x30, 0x871a15abc695fb3f, 0x70bd25, 0x1, {}, [{0xa0, 0x1, [@m_connmark={0x50, 0x1d, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0xffff, 0x10000000, 0x8000007, 0xfff}, 0x200}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_vlan={0x4c, 0x2, 0x0, 0x0, {{0x9}, {0xffffffffffffffed, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x88, 0xfffffff6, 0xffffffffeffffff7, 0x0, 0x8}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r3) (async) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="cc000000", @ANYRES64=r2, @ANYRES64=0x0], 0xcc}}, 0x200000c0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) ioctl$TUNSETSNDBUF(r4, 0x400454d4, &(0x7f00000000c0)=0x81) sendmmsg(r3, &(0x7f00000002c0), 0x0, 0x0) 409.867659ms ago: executing program 6 (id=9071): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) (async) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000e40)={0x30, 0x0, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) (async) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) (async) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) (async) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000200)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @val={0x10, 0x1, 0x21}}, 0x21) (async) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), r0) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x38, r1, 0x1, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7f}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) (async) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val, @void}, 0x20) (async) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x60c01, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x4, 0x1, 0x3, 0x1}, 0x8) (async) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000080)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) writev(r3, &(0x7f0000000000)=[{&(0x7f00000001c0)='X\x00\x00', 0x3}], 0x1) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) (async) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000440)=@ctrl_frame=@pspoll={{}, @random=0xe, @from_mac=@broadcast, @device_b}, 0x10) 282.788972ms ago: executing program 6 (id=9072): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) accept(r0, &(0x7f0000000100)=@un=@abs, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$F2FS_IOC_SEC_TRIM_FILE(r2, 0x4018f514, &(0x7f0000000300)={0x0, 0x9, 0x1}) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="380000001d14d9"], 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r3], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x8c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x100}}, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffff0100000003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x855}, 0x40) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a4c0000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d103"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 0s ago: executing program 6 (id=9073): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'vlan0\x00', &(0x7f00000003c0)=@ethtool_drvinfo={0x3, "53df0c5ec882c42fd909e29262d8207fb00ba14ff8087317ca4aff4e1eb458ee", "e8c6cabbacf981fdb0cc2100fe707ba1f625c077bb17222a8f893b85a7c52625", "8d5208e323896bc080d59878fad6c91cbaafab96f6df17f11fc23ed31b5b6146", "8b00c93a010605475f2ac35a98e5260600098fdff6eab4bfee2d937af5881f15", "2bf44512b4e4feaa61e959f3b8c6c2b68bbbc3299ac0f18a89a900eb1470ec0e", "6a74a3bda117982c6af1f6b2", 0x0, 0x5, 0x3ff, 0xa8, 0xfffffff1}}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007313000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff31a8fd3c0fd8b7ff831028e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a83469620c6e74e1f46132559c4f8700a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a920099c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3ba18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62c49d15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newqdisc={0x150, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffe, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x4}}, [@TCA_INGRESS_BLOCK={0x0, 0xd, 0x8001}]}, 0x150}}, 0x8000) unshare(0x2a020480) unshare(0x2040000) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000ec0)=@base={0x5, 0x7fff, 0x5, 0x7}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9, r5}, 0x38) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000080)=r1) r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) readv(r6, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/1, 0x1}], 0x1000000000000123) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$pppoe(0x18, 0x1, 0x0) r9 = accept4$inet(r0, 0x0, &(0x7f0000000280), 0x800) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f00000005c0)={'syztnl1\x00', &(0x7f00000004c0)={'syztnl1\x00', r4, 0x10, 0x80, 0x18, 0x0, {{0x29, 0x4, 0x2, 0x3, 0xa4, 0x68, 0x0, 0x4, 0x2f, 0x0, @broadcast, @empty, {[@generic={0x88, 0xb, "d726d79cfc44c17b38"}, @generic={0x88, 0x12, "5cac737fc8501d4a5744e5da3695ddab"}, @ssrr={0x89, 0xb, 0xac, [@dev={0xac, 0x14, 0x14, 0x32}, @multicast1]}, @timestamp={0x44, 0x14, 0x8, 0x0, 0x0, [0x6, 0x9, 0xff, 0x4996d86]}, @timestamp={0x44, 0xc, 0xd4, 0x0, 0x6, [0x98, 0x17]}, @timestamp_addr={0x44, 0x24, 0x9f, 0x1, 0x8, [{@private=0xa010102, 0x1}, {@rand_addr=0x64010102, 0x31}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}, {@dev={0xac, 0x14, 0x14, 0x3b}, 0xffffffff}]}, @lsrr={0x83, 0x7, 0x91, [@loopback]}, @timestamp_addr={0x44, 0x1c, 0x66, 0x1, 0x5, [{@multicast1, 0xac1}, {@remote, 0xffff}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}]}]}}}}}) connect$pppoe(r8, &(0x7f0000000000)={0x18, 0x0, {0x7, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, 'macvlan1\x00'}}, 0x1e) sendmmsg(r8, &(0x7f0000007d40)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000001c0)="0281", 0x5ea}], 0x1}}], 0x1, 0x8000) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newtaction={0x64, 0x30, 0xb, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x0, 0xfffffffd}}, @TCA_CT_ACTION={0x6, 0x7}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x4008010) close(r2) kernel console output (not intermixed with test programs): 262247][ T2815] lo speed is unknown, defaulting to 1000 [ 720.301211][ T2819] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 720.448899][ T2822] netlink: 'syz.2.7532': attribute type 1 has an invalid length. [ 720.485901][ T2822] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 720.493174][ T763] tipc: Node number set to 134353152 [ 721.041494][ T2844] netlink: 'syz.2.7536': attribute type 1 has an invalid length. [ 721.718863][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 721.926360][ T2905] syzkaller1: entered promiscuous mode [ 721.951494][ T2905] syzkaller1: entered allmulticast mode [ 722.071135][ T2901] netlink: 'syz.3.7543': attribute type 21 has an invalid length. [ 722.116784][ T2901] netlink: 'syz.3.7543': attribute type 6 has an invalid length. [ 722.185402][ T2901] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7543'. [ 722.469640][ T2925] syzkaller1: entered promiscuous mode [ 722.483757][ T2925] syzkaller1: entered allmulticast mode [ 722.949279][ T2950] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 722.981835][ T2950] bridge0: port 1(bridge_slave_0) entered disabled state [ 723.086755][ T2956] xt_ecn: cannot match TCP bits for non-tcp packets [ 723.412774][ T2969] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7562'. [ 723.574131][ T2979] syzkaller0: entered promiscuous mode [ 723.580681][ T2979] syzkaller0: entered allmulticast mode [ 723.602483][ T2979] simple: basic_1 [ 724.113815][ T2996] ipt_REJECT: TCP_RESET invalid for non-tcp [ 724.142425][ T2995] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7571'. [ 724.184322][ T2999] mac80211_hwsim hwsim85 syzkaller0: entered promiscuous mode [ 724.206023][ T2999] mac80211_hwsim hwsim85 syzkaller0: entered allmulticast mode [ 724.252621][ T2998] tipc: Enabled bearer , priority 0 [ 724.289517][ T3001] netlink: 56 bytes leftover after parsing attributes in process `syz.5.7574'. [ 724.686096][ T3016] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7578'. [ 724.733899][ T3010] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7577'. [ 724.756287][ T3010] ip6gretap0: entered promiscuous mode [ 724.800698][ T3013] veth13: entered allmulticast mode [ 724.832893][ T3016] netlink: 34 bytes leftover after parsing attributes in process `syz.4.7578'. [ 724.881376][ T3013] bond13: (slave veth13): Enslaving as an active interface with an up link [ 725.154617][ T3031] bond33: entered promiscuous mode [ 725.167906][ T3031] 8021q: adding VLAN 0 to HW filter on device bond33 [ 725.190414][ T3037] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7582'. [ 725.246698][ T3041] netlink: 'syz.4.7584': attribute type 1 has an invalid length. [ 725.281979][ T3041] 8021q: adding VLAN 0 to HW filter on device bond14 [ 725.351501][ T3041] 8021q: adding VLAN 0 to HW filter on device bond14 [ 725.362652][ T3041] bond14: (slave gre2): The slave device specified does not support setting the MAC address [ 725.381414][ T3041] bond14: (slave gre2): Error -95 calling set_mac_address [ 725.411669][ T5747] tipc: Node number set to 3012454762 [ 725.492056][ T3043] gretap1: entered promiscuous mode [ 725.816475][ T3059] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7590'. [ 726.276206][ T3082] syzkaller0: entered promiscuous mode [ 726.284051][ T3082] syzkaller0: entered allmulticast mode [ 726.297511][ T3082] batadv_slave_1: entered promiscuous mode [ 726.352650][ T3081] batadv_slave_1: left promiscuous mode [ 726.359666][ T3046] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 726.761323][ T3106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 726.869435][ T3112] x_tables: duplicate underflow at hook 1 [ 726.881214][ T3109] x_tables: duplicate underflow at hook 1 [ 726.963842][ T3119] netlink: 14 bytes leftover after parsing attributes in process `syz.1.7604'. [ 727.037114][ T3119] team0 (unregistering): Port device team_slave_0 removed [ 727.095262][ T3119] team0 (unregistering): Port device team_slave_1 removed [ 727.362108][ T3130] syzkaller0: entered allmulticast mode [ 727.424254][ T3141] netlink: 'syz.1.7613': attribute type 2 has an invalid length. [ 727.496068][ T3145] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7615'. [ 727.511781][ T3145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7615'. [ 727.520749][ T3145] netlink: 'syz.2.7615': attribute type 5 has an invalid length. [ 727.528824][ T3145] netlink: 'syz.2.7615': attribute type 8 has an invalid length. [ 727.536643][ T3145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7615'. [ 727.578380][T28158] Bluetooth: hci1: command 0x0406 tx timeout [ 727.690233][ T3156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7617'. [ 727.777855][ T3158] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7619'. [ 727.807249][ T3158] digital: digital_start_poll: Unknown protocol [ 728.130392][ T3184] netlink: 'syz.2.7624': attribute type 9 has an invalid length. [ 728.155416][ T3182] netlink: 'syz.2.7624': attribute type 9 has an invalid length. [ 728.495677][ T3219] syzkaller1: entered allmulticast mode [ 728.502816][ T3219] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7628'. [ 728.798969][ T3235] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7631'. [ 728.929388][T28158] Bluetooth: hci3: command 0x0406 tx timeout [ 729.101956][ T3255] vlan2: entered promiscuous mode [ 729.126396][ T3255] gretap0: entered promiscuous mode [ 730.559740][ T3334] netlink: 'syz.4.7658': attribute type 1 has an invalid length. [ 730.680821][ T3334] 8021q: adding VLAN 0 to HW filter on device bond15 [ 730.739449][ T3339] bond15: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 730.916354][ T3353] bridge0: port 1(bridge_slave_0) entered disabled state [ 730.929595][ T3353] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.299498][ T3367] batman_adv: batadv0: Interface deactivated: dummy0 [ 731.312740][ T3367] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 731.959197][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 732.073102][ T3371] __nla_validate_parse: 5 callbacks suppressed [ 732.073129][ T3371] netlink: 108 bytes leftover after parsing attributes in process `syz.4.7667'. [ 732.091340][ T3373] bridge0: Caught tx_queue_len zero misconfig [ 732.150155][ T3375] netlink: 'syz.4.7668': attribute type 4 has an invalid length. [ 732.161420][ T3375] syzkaller1: entered promiscuous mode [ 732.166962][ T3375] syzkaller1: entered allmulticast mode [ 732.314942][ T3377] lo speed is unknown, defaulting to 1000 [ 732.413313][ T3378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7669'. [ 732.428391][ T3378] bridge0: port 3(vlan3) entered blocking state [ 732.434830][ T3378] bridge0: port 3(vlan3) entered disabled state [ 732.442237][ T3378] vlan3: entered allmulticast mode [ 732.447423][ T3378] bridge0: entered allmulticast mode [ 732.454881][ T3378] vlan3: left allmulticast mode [ 732.461513][ T3378] bridge0: left allmulticast mode [ 732.719758][ T3382] gre2: entered allmulticast mode [ 732.893891][ T3301] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 733.177798][ T3401] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7676'. [ 733.232188][ T3403] xt_policy: neither incoming nor outgoing policy selected [ 733.280421][ T3401] 8021q: adding VLAN 0 to HW filter on device bond10 [ 733.441736][ T3405] bond10: (slave veth9): Enslaving as an active interface with an up link [ 733.475467][ T3411] lo: Caught tx_queue_len zero misconfig [ 733.530493][ T3418] netlink: 'syz.2.7681': attribute type 1 has an invalid length. [ 733.558724][ T3418] bond11: entered promiscuous mode [ 733.564368][ T3418] 8021q: adding VLAN 0 to HW filter on device bond11 [ 733.599986][ T3418] 8021q: adding VLAN 0 to HW filter on device bond11 [ 733.620695][ T3418] bond11: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 733.650943][ T3418] bond11: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 733.681165][ T3418] bond11: (slave ip6gre1): making interface the new active one [ 733.701444][ T3418] ip6gre1: entered promiscuous mode [ 733.714735][ T3418] bond11: (slave ip6gre1): Enslaving as an active interface with an up link [ 733.738014][ T3429] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 733.757179][ T3429] dvmrp1: linktype set to 0 [ 733.849623][ T3436] lo speed is unknown, defaulting to 1000 [ 733.872014][ T3442] IPVS: set_ctl: invalid protocol: 51 172.20.20.170:20002 [ 733.972561][ T3407] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 733.986454][ T3407] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 734.100580][ T3448] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7688'. [ 734.146818][ T3448] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7688'. [ 734.521339][ T3466] rdma_op ffff88809cae41f0 conn xmit_rdma 0000000000000000 [ 734.637313][ T3471] netlink: 'syz.1.7694': attribute type 39 has an invalid length. [ 734.722342][ T29] audit: type=1107 audit(1782292032.572:27): pid=3470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 734.907919][ T3482] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7698'. [ 735.185503][ T3499] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7703'. [ 735.397828][ T3499] 8021q: adding VLAN 0 to HW filter on device bond6 [ 735.448807][ T3507] 8021q: adding VLAN 0 to HW filter on device bond6 [ 735.456064][ T3507] bond6: (slave vti0): The slave device specified does not support setting the MAC address [ 735.474946][ T3507] bond6: (slave vti0): Error -95 calling set_mac_address [ 736.345736][ T3546] netlink: 912 bytes leftover after parsing attributes in process `syz.2.7718'. [ 736.751289][ T3575] netlink: 76 bytes leftover after parsing attributes in process `syz.3.7726'. [ 736.776640][ T3579] netlink: 'syz.4.7725': attribute type 1 has an invalid length. [ 737.295801][ T3601] netlink: 632 bytes leftover after parsing attributes in process `syz.5.7733'. [ 737.363498][ T3601] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 737.376479][ T3601] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 737.635010][ T3610] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7735'. [ 737.671561][ T3612] netlink: 'syz.4.7737': attribute type 12 has an invalid length. [ 737.735643][ T3614] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7736'. [ 737.846683][ T3615] bond16: option miimon: invalid value (18446744073709551607) [ 737.855043][ T3615] bond16: option miimon: allowed values 0 - 2147483647 [ 737.866515][ T3615] bond16 (unregistering): Released all slaves [ 737.958370][ T3614] bond7: option broadcast_neighbor: invalid value (30) [ 737.978009][ T3614] bond7 (unregistering): Released all slaves [ 737.995872][ T3624] mac80211_hwsim hwsim89 wlan0: entered promiscuous mode [ 738.008480][ T3624] mac80211_hwsim hwsim89 wlan0: entered allmulticast mode [ 738.382176][ T3654] netlink: 'syz.1.7750': attribute type 1 has an invalid length. [ 738.471936][ T3660] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7748'. [ 738.499641][ T3660] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7748'. [ 738.547007][ T3660] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7748'. [ 738.567822][ T3669] dvmrp0: entered allmulticast mode [ 738.592629][ T3660] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7748'. [ 738.606894][ T3660] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7748'. [ 738.622706][ T3675] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7753'. [ 738.633336][ T3660] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7748'. [ 738.698903][ T3664] lo speed is unknown, defaulting to 1000 [ 738.815257][T28158] Bluetooth: hci2: command 0x0405 tx timeout [ 738.821607][ T3679] sctp: [Deprecated]: syz.4.7755 (pid 3679) Use of struct sctp_assoc_value in delayed_ack socket option. [ 738.821607][ T3679] Use struct sctp_sack_info instead [ 739.947407][ T3730] bridge0: port 3(vlan3) entered blocking state [ 739.954529][ T3730] bridge0: port 3(vlan3) entered disabled state [ 739.965042][ T3730] vlan3: entered allmulticast mode [ 739.971040][ T3730] geneve0: entered allmulticast mode [ 739.978914][ T3730] vlan3: entered promiscuous mode [ 739.984021][ T3730] geneve0: entered promiscuous mode [ 740.244757][ T3747] ip6gre2: entered promiscuous mode [ 740.250882][ T3747] ip6gre2: entered allmulticast mode [ 740.605521][ T3754] lo speed is unknown, defaulting to 1000 [ 742.010793][ T3807] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 742.020072][ T3807] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 742.031613][ T3807] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 742.047207][ T3807] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 742.059823][ T3807] batman_adv: batadv0: Removing interface: dummy0 [ 742.139431][ T3812] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 742.146749][ T3812] IPv6: NLM_F_CREATE should be set when creating new route [ 742.154058][ T3812] IPv6: NLM_F_CREATE should be set when creating new route [ 742.186685][ T3812] ip6tnl0: Caught tx_queue_len zero misconfig [ 742.292373][ T3817] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.316341][ T3817] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 52847 - 0 [ 742.397899][ T3817] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.422370][ T3817] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 52847 - 0 [ 742.504049][ T3817] .`: (slave netdevsim1): Releasing backup interface [ 742.519776][ T3817] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.541127][ T3817] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 52847 - 0 [ 742.660604][ T3817] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.682323][ T3817] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 52847 - 0 [ 742.925584][T16067] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 742.953162][T16067] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 52847 - 0 [ 743.002590][T16067] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 743.010815][T16067] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 52847 - 0 [ 743.171508][T16067] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 743.199343][T16067] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 52847 - 0 [ 743.221580][T16067] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 743.239175][T16067] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 52847 - 0 [ 743.317104][ T3835] __nla_validate_parse: 35 callbacks suppressed [ 743.317125][ T3835] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7796'. [ 743.448013][ T3840] netlink: 'syz.5.7795': attribute type 8 has an invalid length. [ 743.458854][ T3840] netlink: 'syz.5.7795': attribute type 9 has an invalid length. [ 744.192884][ T3862] netdevsim netdevsim1: Firmware load for './file0/file0/../file0' refused, path contains '..' component [ 744.194044][ T3860] netlink: 'syz.4.7803': attribute type 1 has an invalid length. [ 744.235948][ T3860] netlink: 244 bytes leftover after parsing attributes in process `syz.4.7803'. [ 744.574110][ T3875] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7806'. [ 744.627983][ T3875] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7806'. [ 744.706828][ T3880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7808'. [ 744.726190][ T3880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7808'. [ 744.773834][ T3882] netlink: 'syz.4.7809': attribute type 1 has an invalid length. [ 744.805299][ T3882] netlink: 'syz.4.7809': attribute type 3 has an invalid length. [ 744.826599][ T3882] netlink: 132 bytes leftover after parsing attributes in process `syz.4.7809'. [ 745.046072][ T3891] netlink: 'syz.4.7811': attribute type 1 has an invalid length. [ 745.084808][ T3891] netlink: 96 bytes leftover after parsing attributes in process `syz.4.7811'. [ 745.105644][ T3891] netlink: 1 bytes leftover after parsing attributes in process `syz.4.7811'. [ 745.116065][ T3891] netlink: 'syz.4.7811': attribute type 1 has an invalid length. [ 745.129682][ T3891] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7811'. [ 745.891271][ T3935] netlink: 'syz.4.7818': attribute type 1 has an invalid length. [ 745.986376][ T3966] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 746.411316][ T3909] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 746.462195][ T4039] tunl0: entered allmulticast mode [ 746.487931][ T4040] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 749.276922][ T4015] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 749.471578][ T4081] __nla_validate_parse: 3 callbacks suppressed [ 749.471612][ T4081] netlink: 80 bytes leftover after parsing attributes in process `syz.3.7836'. [ 749.526925][ T4085] netlink: 44 bytes leftover after parsing attributes in process `syz.5.7838'. [ 749.979120][ T4107] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7846'. [ 749.999403][ T4107] netlink: 'syz.3.7846': attribute type 2 has an invalid length. [ 750.203371][ T4113] netlink: 'syz.3.7847': attribute type 8 has an invalid length. [ 750.267729][ T4113] netlink: 'syz.3.7847': attribute type 362 has an invalid length. [ 750.299937][ T4113] netlink: 'syz.3.7847': attribute type 10 has an invalid length. [ 750.518262][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 750.533191][ T4128] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7853'. [ 750.559925][ T808] IPVS: starting estimator thread 0... [ 750.663614][ T4133] IPVS: using max 40 ests per chain, 96000 per kthread [ 750.684976][ T4142] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7856'. [ 750.711197][ T4142] veth0: Caught tx_queue_len zero misconfig [ 751.013989][ T4157] netlink: 'syz.3.7861': attribute type 1 has an invalid length. [ 751.052964][ T4157] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7861'. [ 751.090647][ T4164] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7863'. [ 751.105535][ T4170] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7863'. [ 751.685961][ T4189] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7869'. [ 751.775270][ T4195] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7870'. [ 752.365926][ T4208] 8021q: adding VLAN 0 to HW filter on device bond16 [ 752.377136][ T4208] bridge0: port 4(bond16) entered blocking state [ 752.393149][ T4208] bridge0: port 4(bond16) entered disabled state [ 752.419676][ T4208] bond16: entered allmulticast mode [ 752.431050][ T4208] bond16: entered promiscuous mode [ 752.454160][ T4208] bridge0: port 4(bond16) entered blocking state [ 752.460694][ T4208] bridge0: port 4(bond16) entered listening state [ 752.616646][T19010] bridge0: port 4(bond16) entered disabled state [ 753.865981][ T4270] netlink: 'syz.4.7895': attribute type 1 has an invalid length. [ 753.907834][ T4270] netlink: 'syz.4.7895': attribute type 4 has an invalid length. [ 753.962990][ T4277] netlink: 'syz.4.7895': attribute type 4 has an invalid length. [ 753.992971][ T4274] bridge4: port 1(dummy0) entered blocking state [ 754.001337][ T4274] bridge4: port 1(dummy0) entered disabled state [ 754.009383][ T4274] dummy0: entered allmulticast mode [ 754.021095][ T4274] dummy0: left allmulticast mode [ 754.104887][ T4274] netlink: 'syz.1.7891': attribute type 4 has an invalid length. [ 754.808375][ T4328] __nla_validate_parse: 11 callbacks suppressed [ 754.808421][ T4328] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.7912'. [ 755.367590][ T4344] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 755.840825][ T4354] IPVS: persistence engine module ip_vs_pe_ not found [ 756.118005][ T4365] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7923'. [ 756.130424][ T4362] syzkaller0: entered promiscuous mode [ 756.139999][ T4362] syzkaller0: entered allmulticast mode [ 756.174046][ T4362] tipc: Enabled bearer , priority 0 [ 756.212327][ T4362] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7922'. [ 756.444194][ T4361] tipc: Resetting bearer [ 756.484462][ T4361] tipc: Disabling bearer [ 756.614813][ T4390] tipc: Enabling of bearer rejected, already enabled [ 756.874531][ T4399] tipc: Enabling of bearer rejected, already enabled [ 757.791099][ T4444] netlink: 252 bytes leftover after parsing attributes in process `syz.3.7942'. [ 759.002797][ T4471] tipc: Enabling of bearer rejected, failed to enable media [ 759.108948][ T4473] netlink: 56 bytes leftover after parsing attributes in process `syz.5.7950'. [ 759.135019][ T4473] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7950'. [ 759.154586][ T4473] netlink: 31 bytes leftover after parsing attributes in process `syz.5.7950'. [ 759.169026][ T4473] netlink: 'syz.5.7950': attribute type 2 has an invalid length. [ 759.176962][ T4473] netlink: 31 bytes leftover after parsing attributes in process `syz.5.7950'. [ 759.189339][ T4475] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7950'. [ 759.200462][ T4475] netlink: 'syz.5.7950': attribute type 5 has an invalid length. [ 759.209660][ T4475] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7950'. [ 759.224626][ T4475] geneve2: entered promiscuous mode [ 759.234557][ T4475] geneve2: entered allmulticast mode [ 759.246798][ T58] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 52331 - 0 [ 759.257002][ T58] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 52331 - 0 [ 759.277237][ T58] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 52331 - 0 [ 759.310468][ T58] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 52331 - 0 [ 759.924042][ T4505] __nla_validate_parse: 1 callbacks suppressed [ 759.924067][ T4505] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7960'. [ 760.345114][ T4522] netlink: 'syz.5.7968': attribute type 13 has an invalid length. [ 760.480853][ T4536] netlink: 68 bytes leftover after parsing attributes in process `syz.5.7968'. [ 760.525800][ T4537] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7973'. [ 760.633811][ T4524] tipc: Enabled bearer , priority 0 [ 760.643073][ T4535] veth1_to_hsr: Caught tx_queue_len zero misconfig [ 760.691478][ T4541] sch_tbf: burst 88 is lower than device veth15 mtu (1514) ! [ 760.721455][ T4543] syzkaller0: entered promiscuous mode [ 760.744692][ T4543] syzkaller0: entered allmulticast mode [ 760.771028][ T4547] tipc: Enabled bearer , priority 0 [ 760.778452][ T4547] syzkaller0: entered promiscuous mode [ 760.783966][ T4547] syzkaller0: entered allmulticast mode [ 760.815318][ T4547] tipc: Resetting bearer [ 760.854893][ T4523] tipc: Resetting bearer [ 760.874880][ T4523] tipc: Disabling bearer [ 760.901904][ T4546] tipc: Resetting bearer [ 760.925053][ T4546] tipc: Disabling bearer [ 761.307780][ T4571] syzkaller0: entered promiscuous mode [ 761.325812][ T4571] syzkaller0: entered allmulticast mode [ 761.373985][ T4577] nbd: illegal input index 131072 [ 761.625255][ T4587] lo speed is unknown, defaulting to 1000 [ 761.709827][ T4599] netlink: 'syz.2.7988': attribute type 1 has an invalid length. [ 761.727110][ T4599] netlink: 'syz.2.7988': attribute type 2 has an invalid length. [ 761.756028][ T4599] netlink: 'syz.2.7988': attribute type 1 has an invalid length. [ 761.797707][ T4599] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7988'. [ 761.926528][ T4607] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 761.992073][ T4607] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7991'. [ 762.113411][ T4617] syzkaller0: entered promiscuous mode [ 762.119344][ T4617] syzkaller0: entered allmulticast mode [ 762.289148][ T4629] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7996'. [ 762.345261][ T4633] tipc: Enabling of bearer rejected, already enabled [ 762.717180][ T4650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8004'. [ 762.751508][ T4650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8004'. [ 762.764412][ T4650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8004'. [ 762.776269][ T4650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8004'. [ 763.382526][ T4690] netlink: 'syz.5.8015': attribute type 13 has an invalid length. [ 763.393715][ T4690] lo: Caught tx_queue_len zero misconfig [ 763.407023][ T4693] netlink: 'syz.5.8015': attribute type 13 has an invalid length. [ 763.478010][ T4699] tipc: Enabling of bearer rejected, failed to enable media [ 763.495163][ T4700] batadv0: entered promiscuous mode [ 763.501013][ T4700] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 763.669663][ T4705] team0: No ports can be present during mode change [ 763.823573][ T4711] netlink: 'syz.4.8021': attribute type 13 has an invalid length. [ 763.846356][ T4711] netlink: 'syz.4.8021': attribute type 17 has an invalid length. [ 763.856035][ T4710] team_slave_0: left promiscuous mode [ 763.866251][ T4710] team_slave_1: left promiscuous mode [ 763.876285][ T4710] veth7: left promiscuous mode [ 764.356953][ T4710] veth1_to_team: left allmulticast mode [ 764.810001][ T4711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 764.833273][ T4711] 8021q: adding VLAN 0 to HW filter on device team0 [ 764.955711][ T4711] veth1_to_team: left promiscuous mode [ 765.006024][ T4711] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 765.027905][ T4711] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 765.049021][ T4711] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 765.069699][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 765.076947][ T58] bridge0: port 1(bridge_slave_0) entered listening state [ 765.087237][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.094402][ T58] bridge0: port 2(bridge_slave_1) entered listening state [ 765.115498][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.159781][T25354] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.173235][ T4737] __nla_validate_parse: 9 callbacks suppressed [ 765.173256][ T4737] netlink: 44 bytes leftover after parsing attributes in process `syz.5.8027'. [ 765.210695][ T4747] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8029'. [ 765.219633][ T4747] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8029'. [ 765.230136][T25354] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.238678][T25354] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.298226][T25354] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.358990][ T4757] netlink: 'syz.2.8033': attribute type 1 has an invalid length. [ 765.396408][ T4757] netlink: 228 bytes leftover after parsing attributes in process `syz.2.8033'. [ 765.421167][ T4757] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8033'. [ 765.637217][ T4777] netlink: 204 bytes leftover after parsing attributes in process `syz.3.8038'. [ 765.649620][ T4777] netlink: 84 bytes leftover after parsing attributes in process `syz.3.8038'. [ 765.902271][ T4793] netlink: 'syz.1.8047': attribute type 1 has an invalid length. [ 765.936907][ T4793] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 766.170675][ T4807] syzkaller0: entered promiscuous mode [ 766.200882][ T4807] syzkaller0: entered allmulticast mode [ 766.621198][ T4840] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8061'. [ 766.684927][ T4842] syzkaller0: entered promiscuous mode [ 766.693584][ T4842] syzkaller0: entered allmulticast mode [ 767.111577][ T4858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8067'. [ 767.132324][ T4858] IPVS: dh: FWM 3 0x00000003 - no destination available [ 767.150468][ T4861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8069'. [ 767.160857][ T4862] netlink: 'syz.4.8068': attribute type 1 has an invalid length. [ 767.170775][ T4861] netlink: 'syz.3.8069': attribute type 13 has an invalid length. [ 767.220860][ T4862] bond17: (slave veth17): Enslaving as an active interface with a down link [ 767.272704][ T4862] bond17: (slave veth19): Enslaving as an active interface with a down link [ 767.432886][ T4873] dummy0 (unregistering): left promiscuous mode [ 767.686759][ T4895] mac80211_hwsim hwsim98 syzkaller0: Caught tx_queue_len zero misconfig [ 767.727337][ T4896] tipc: Started in network mode [ 767.741301][ T4896] tipc: Node identity 2e5d31a598e1, cluster identity 4711 [ 767.760307][ T4896] tipc: Enabled bearer , priority 0 [ 767.862397][ T4904] netlink: 'syz.3.8078': attribute type 5 has an invalid length. [ 767.937527][ T4908] netlink: 'syz.4.8079': attribute type 4 has an invalid length. [ 768.011601][ T4900] 8021q: adding VLAN 0 to HW filter on device .` [ 768.083372][ T4900] 8021q: adding VLAN 0 to HW filter on device team0 [ 768.119222][ T4900] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 768.201408][ T4900] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 768.213605][ T4900] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 768.228817][ T4900] veth1_vlan: left promiscuous mode [ 768.235191][ T4900] veth0_vlan: left promiscuous mode [ 768.242034][ T4900] veth0_vlan: entered promiscuous mode [ 768.251439][ T4900] veth1_vlan: entered promiscuous mode [ 768.262203][ T4900] veth0_macvtap: left promiscuous mode [ 768.272321][ T4900] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 768.316148][ T82] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 768.328361][ T82] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 768.336600][ T82] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 768.362804][ T82] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 768.436638][ T4942] veth0_macvtap: Caught tx_queue_len zero misconfig [ 768.454080][ T4942] netlink: 'syz.4.8087': attribute type 4 has an invalid length. [ 768.829332][ T761] tipc: Node number set to 3065786789 [ 770.633966][ T5045] netlink: 'syz.1.8111': attribute type 1 has an invalid length. [ 770.716113][ T5045] 8021q: adding VLAN 0 to HW filter on device bond8 [ 770.730093][ T5054] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 770.743500][ T5047] bond8: down delay (1) is not a multiple of miimon (100), value rounded to 0 ms [ 770.772942][ T5047] bond8: option ad_user_port_key: mode dependency failed, not supported in mode balance-alb(6) [ 770.874419][ T5045] bond8: (slave ip6gretap1): making interface the new active one [ 770.892665][ T5045] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 771.211240][ T5076] __nla_validate_parse: 17 callbacks suppressed [ 771.211279][ T5076] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8124'. [ 771.595996][ T5092] netlink: 76 bytes leftover after parsing attributes in process `syz.4.8129'. [ 771.622981][ T5092] netlink: 108 bytes leftover after parsing attributes in process `syz.4.8129'. [ 771.916680][ T5107] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8134'. [ 771.952421][ T5106] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8134'. [ 771.963680][ T5115] netlink: 'syz.5.8135': attribute type 9 has an invalid length. [ 772.021404][ T5106] geneve4: entered promiscuous mode [ 772.034912][ T5106] geneve4: entered allmulticast mode [ 772.073025][ T5128] netlink: 'syz.2.8139': attribute type 11 has an invalid length. [ 772.112642][ T5129] Bluetooth: MGMT ver 1.23 [ 772.120183][ T5129] Bluetooth: hci1: too big key_count value 29096 [ 772.137525][ T5128] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 772.164587][ T5130] tipc: Resetting bearer [ 772.182937][ T5130] syzkaller0: entered promiscuous mode [ 772.209278][ T5130] syzkaller0: entered allmulticast mode [ 772.256167][ T5143] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8143'. [ 772.273313][ T5130] pim6reg1: entered promiscuous mode [ 772.281228][ T5130] pim6reg1: entered allmulticast mode [ 772.410532][ T5150] 8021q: adding VLAN 0 to HW filter on device bond7 [ 772.433497][ T5150] bond7: (slave vlan2): Enslaving as an active interface with an up link [ 772.453898][ T5136] tipc: Resetting bearer [ 772.519833][ T5127] tipc: Resetting bearer [ 772.582871][ T5158] (: renamed from bridge_slave_0 (while UP) [ 772.604738][ T5164] tunl0: Caught tx_queue_len zero misconfig [ 772.709573][ T5158] lo speed is unknown, defaulting to 1000 [ 773.014182][ T5172] netlink: 68 bytes leftover after parsing attributes in process `syz.1.8151'. [ 773.454515][ T5176] netlink: 'syz.1.8153': attribute type 1 has an invalid length. [ 773.582579][ T5188] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8153'. [ 775.516560][ T5182] tipc: New replicast peer: 255.255.255.255 [ 775.524287][ T5182] tipc: Enabled bearer , priority 26 [ 775.531403][ T5185] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8153'. [ 775.585928][ T5176] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 775.590284][T16067] tipc: Resetting bearer [ 775.821614][ T5199] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8159'. [ 776.475172][ T5236] xt_ipcomp: unknown flags 1D [ 776.677163][ T5240] mac80211_hwsim hwsim98 syzkaller0: left promiscuous mode [ 776.700079][ T5242] __nla_validate_parse: 1 callbacks suppressed [ 776.700101][ T5242] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8172'. [ 776.729678][ T5240] mac80211_hwsim hwsim98 syzkaller0: left allmulticast mode [ 776.764507][ T5242] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8172'. [ 776.796477][ T5242] netlink: 'syz.1.8172': attribute type 11 has an invalid length. [ 777.070666][ T5259] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8177'. [ 777.280378][ T5265] bond18: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 777.294217][ T5265] bond18 (unregistering): Released all slaves [ 777.401930][ T5266] workqueue: Failed to create a rescuer kthread for wq "bond18": -EINTR [ 777.402775][ T5261] lo speed is unknown, defaulting to 1000 [ 777.623263][ T5292] gre0: entered promiscuous mode [ 777.655597][ T5292] gre0: entered allmulticast mode [ 777.808927][ T5298] netlink: 'syz.5.8187': attribute type 1 has an invalid length. [ 777.916685][ T5306] netlink: 666 bytes leftover after parsing attributes in process `syz.4.8189'. [ 777.928382][ T5306] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8189'. [ 777.937790][ T5306] netlink: 'syz.4.8189': attribute type 10 has an invalid length. [ 777.985222][ T5306] team0: Port device dummy0 added [ 778.078336][ T5312] netlink: 'syz.5.8193': attribute type 3 has an invalid length. [ 778.157000][ T5320] netlink: 200 bytes leftover after parsing attributes in process `syz.3.8195'. [ 778.211551][ T5322] IPVS: set_ctl: invalid protocol: 194 127.0.0.1:20000 [ 778.220942][ T5322] IPVS: set_ctl: invalid protocol: 194 127.0.0.1:20000 [ 778.227888][ T5322] IPVS: set_ctl: invalid protocol: 194 127.0.0.1:20000 [ 778.246353][ T5322] IPVS: set_ctl: invalid protocol: 194 127.0.0.1:20000 [ 778.257981][ T5322] IPVS: set_ctl: invalid protocol: 194 127.0.0.1:20000 [ 778.668529][ T5318] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8194'. [ 778.776021][T16067] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.788939][T16067] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 52847 - 0 [ 778.798049][T16067] netdevsim netdevsim2 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 778.812523][T16067] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.822816][T16067] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 52847 - 0 [ 778.837538][T16067] netdevsim netdevsim2 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 778.850536][T16067] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.861168][T16067] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 52847 - 0 [ 778.871876][T16067] netdevsim netdevsim2 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 778.912382][T16067] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.944418][T16067] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 52847 - 0 [ 778.957100][T16067] netdevsim netdevsim2 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 779.209338][ T5341] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8199'. [ 779.225095][ T5348] netlink: 'syz.1.8201': attribute type 1 has an invalid length. [ 779.233777][ T5344] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8200'. [ 779.233811][ T5344] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8200'. [ 779.243462][ T5344] erspan0: entered promiscuous mode [ 779.272740][ T5341] netlink: 'syz.3.8199': attribute type 1 has an invalid length. [ 779.412393][ T5344] erspan0: left promiscuous mode [ 779.486626][ T5348] 8021q: adding VLAN 0 to HW filter on device bond9 [ 779.525649][ T5351] veth11: entered allmulticast mode [ 779.538652][ T5351] bond9: (slave veth11): Enslaving as an active interface with an up link [ 779.563579][ T5360] netlink: 'syz.5.8203': attribute type 1 has an invalid length. [ 779.686603][ T5360] 8021q: adding VLAN 0 to HW filter on device bond8 [ 779.712726][ T5360] macvlan2: entered promiscuous mode [ 779.719463][ T5360] macvlan2: entered allmulticast mode [ 779.726759][ T5360] bond8: entered promiscuous mode [ 779.733812][ T5360] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 779.744253][ T5360] bond8: left promiscuous mode [ 779.761524][ T5373] netlink: 'syz.1.8208': attribute type 10 has an invalid length. [ 779.776103][ T5355] bond8: entered promiscuous mode [ 779.781224][ T5355] bond8: entered allmulticast mode [ 779.788493][ T5373] netlink: 'syz.1.8208': attribute type 10 has an invalid length. [ 780.067093][ T5382] bond34: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 780.111219][ T5382] bond34 (unregistering): Released all slaves [ 780.470483][ T5400] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 780.562867][ T5402] xt_CT: No such helper "snmp_trap" [ 780.598218][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 780.682158][ T5415] bridge0: port 1(() entered blocking state [ 780.688680][ T5415] bridge0: port 1(() entered forwarding state [ 780.751792][ T5415] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 780.774824][T25352] bridge0: port 2(bridge_slave_1) entered blocking state [ 780.782023][T25352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 780.844228][ T5418] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 781.128943][ T5443] netlink: 'syz.3.8230': attribute type 10 has an invalid length. [ 781.137189][ T5443] dummy0: entered promiscuous mode [ 781.143419][ T5443] dummy0: entered allmulticast mode [ 781.151635][ T5443] bridge0: port 3(dummy0) entered blocking state [ 781.161507][ T5443] bridge0: port 3(dummy0) entered disabled state [ 781.777567][ T5452] __nla_validate_parse: 14 callbacks suppressed [ 781.777588][ T5452] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8233'. [ 782.396652][ T5495] x_tables: duplicate underflow at hook 1 [ 782.415029][ T5495] x_tables: duplicate underflow at hook 1 [ 782.433950][ T5495] x_tables: duplicate underflow at hook 1 [ 782.452486][ T5495] x_tables: duplicate underflow at hook 1 [ 782.468961][ T5495] x_tables: duplicate underflow at hook 1 [ 782.483968][ T5495] x_tables: duplicate underflow at hook 1 [ 782.493237][ T5498] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8247'. [ 782.516777][ T5501] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8248'. [ 782.545048][ T5498] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8247'. [ 782.589040][ T5495] x_tables: duplicate underflow at hook 1 [ 782.594958][ T5495] x_tables: duplicate underflow at hook 1 [ 782.601540][ T5495] x_tables: duplicate underflow at hook 1 [ 782.607461][ T5495] x_tables: duplicate underflow at hook 1 [ 782.833701][ T5508] tipc: Enabled bearer , priority 0 [ 782.962792][ T5508] syzkaller0: entered promiscuous mode [ 783.036448][ T5508] syzkaller0: entered allmulticast mode [ 783.080675][ T5508] tipc: Resetting bearer [ 783.090330][ T5521] syzkaller0: left promiscuous mode [ 783.130359][ T5521] syzkaller0: left allmulticast mode [ 783.140536][ T5521] tipc: Resetting bearer [ 785.000934][ T5507] tipc: Resetting bearer [ 785.232244][ T5507] tipc: Disabling bearer [ 785.260352][ T9826] tipc: Node number set to 1208789259 [ 785.365000][ T5552] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8261'. [ 785.394668][ T5555] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8262'. [ 785.397042][ T29] audit: type=1804 audit(1782292083.242:28): pid=5555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.8262" name="/newroot/376/cgroup.controllers" dev="tmpfs" ino=1932 res=1 errno=0 [ 785.492137][ T29] audit: type=1800 audit(1782292083.242:29): pid=5555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8262" name="cgroup.controllers" dev="tmpfs" ino=1932 res=0 errno=0 [ 785.513844][ T29] audit: type=1800 audit(1782292083.242:30): pid=5555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8262" name="cgroup.controllers" dev="tmpfs" ino=1932 res=0 errno=0 [ 785.561262][ T5565] tipc: Enabled bearer , priority 0 [ 785.574513][ T5565] syzkaller0: entered promiscuous mode [ 785.580042][ T5565] syzkaller0: entered allmulticast mode [ 785.596104][ T5565] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 785.617722][ T5568] netlink: 'syz.4.8266': attribute type 3 has an invalid length. [ 785.627563][ T5565] tipc: Resetting bearer [ 785.666737][ T5563] tipc: Resetting bearer [ 785.675940][ T5570] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8268'. [ 785.693845][ T5563] tipc: Disabling bearer [ 785.719371][ T5570] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8268'. [ 786.170972][ T5605] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8279'. [ 786.239152][ T5608] netlink: 'syz.3.8280': attribute type 32 has an invalid length. [ 786.331533][ T5621] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 786.363140][ T5613] nbd: must specify at least one socket [ 787.064713][ T5668] netlink: 'syz.4.8293': attribute type 1 has an invalid length. [ 787.095796][ T5668] bond18: entered promiscuous mode [ 787.102302][ T5668] 8021q: adding VLAN 0 to HW filter on device bond18 [ 787.112047][ T5671] mac80211_hwsim hwsim98 syzkaller0: entered promiscuous mode [ 787.120354][ T5671] mac80211_hwsim hwsim98 syzkaller0: entered allmulticast mode [ 787.176552][ T5677] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 787.191895][ T5678] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 787.284665][ T5685] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8298'. [ 787.296174][ T5688] netlink: 27 bytes leftover after parsing attributes in process `syz.3.8297'. [ 787.405983][ T5695] tipc: Enabled bearer , priority 0 [ 787.413223][ T5693] syzkaller0: entered promiscuous mode [ 787.418713][ T5693] syzkaller0: entered allmulticast mode [ 787.427649][ T5693] tipc: Resetting bearer [ 787.490977][ T5692] tipc: Resetting bearer [ 787.534205][ T5692] tipc: Disabling bearer [ 787.573083][ T5698] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8301'. [ 787.594423][ T5698] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8301'. [ 787.780993][ T5722] netlink: 'syz.5.8306': attribute type 1 has an invalid length. [ 787.796871][ T5722] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8306'. [ 787.825601][ T5728] netlink: 'syz.5.8306': attribute type 1 has an invalid length. [ 787.964962][ T5731] lo speed is unknown, defaulting to 1000 [ 788.138548][ T5748] ip6tnl2: entered allmulticast mode [ 788.149883][ T5759] gre0: entered promiscuous mode [ 788.154885][ T5759] gre0: entered allmulticast mode [ 788.160291][ T5759] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 788.179003][ T5759] mac80211_hwsim hwsim85 wlan0: Caught tx_queue_len zero misconfig [ 788.491958][ T5770] hmac(sha224: entered promiscuous mode [ 788.957649][ T5790] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8320'. [ 789.152654][ T5802] netlink: 'syz.1.8324': attribute type 3 has an invalid length. [ 789.167938][ T5803] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8323'. [ 789.361023][ T5806] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8325'. [ 789.497982][ T5808] netlink: 240 bytes leftover after parsing attributes in process `syz.4.8326'. [ 789.544968][ T5810] bond19: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 789.560628][ T5810] bond19 (unregistering): Released all slaves [ 790.054768][ T5833] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.8335'. [ 790.179843][ T5840] tipc: Enabling of bearer rejected, media not registered [ 790.515383][ T5864] bond34: entered allmulticast mode [ 790.666981][ T5872] openvswitch: netlink: Missing valid actions attribute. [ 790.699191][ T5872] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 790.767286][ T5883] netlink: 'syz.4.8350': attribute type 1 has an invalid length. [ 790.806841][ T5883] bond20: (slave geneve4): making interface the new active one [ 790.816064][ T5883] bond20: (slave geneve4): Enslaving as an active interface with an up link [ 790.826287][T19010] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 790.837066][T19010] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 790.849824][T19010] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 790.860549][T19010] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 791.037601][ T5907] netlink: 'syz.4.8356': attribute type 4 has an invalid length. [ 791.055321][ T5907] netlink: 'syz.4.8356': attribute type 4 has an invalid length. [ 791.472763][ T5927] lo speed is unknown, defaulting to 1000 [ 791.691628][ T5946] batadv_slave_1: entered promiscuous mode [ 791.704275][ T5940] batadv_slave_1: left promiscuous mode [ 791.751916][ T5931] lo: entered allmulticast mode [ 791.804907][ T5950] sctp: [Deprecated]: syz.5.8370 (pid 5950) Use of int in maxseg socket option. [ 791.804907][ T5950] Use struct sctp_assoc_value instead [ 791.860979][T25327] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.872503][T25327] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.890693][T25327] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.911474][T25327] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 792.370655][T16067] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 792.414810][T16067] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 792.501546][ T5989] netlink: 'syz.3.8380': attribute type 16 has an invalid length. [ 792.510912][ T5989] __nla_validate_parse: 11 callbacks suppressed [ 792.511039][ T5989] netlink: 156 bytes leftover after parsing attributes in process `syz.3.8380'. [ 792.557894][T16067] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 792.577931][ T29] audit: type=1107 audit(1782292090.422:31): pid=5990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Y;f= [ 792.577931][ T29] CwFzItj%b]K?"1"Owhhp H*Tǒ2f @&x7Io3$ bY?7:ikpPp{X KïXQo.xYRR [ 792.577931][ T29] O,~G)8͉4k\;l6R]y#9V#_ Nk8ω5Ljߝ8cvMn' [ 792.620465][T16067] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 792.621575][ T5993] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8380'. [ 792.943874][ T6009] netlink: 228 bytes leftover after parsing attributes in process `syz.3.8385'. [ 793.109387][ T6015] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 793.132982][ T6018] xt_check_table_hooks: 55 callbacks suppressed [ 793.133096][ T6018] x_tables: duplicate underflow at hook 2 [ 793.149045][ T6017] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8388'. [ 793.164161][ T6017] netlink: 'syz.5.8388': attribute type 1 has an invalid length. [ 793.484454][ T6036] tipc: Resetting bearer [ 793.709377][ T6048] tipc: Resetting bearer [ 793.725409][T19008] tipc: Resetting bearer [ 794.134295][ T6073] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8404'. [ 794.174384][ T6073] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8404'. [ 794.189442][ T58] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 794.220796][ T58] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 794.230009][ T58] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 794.238263][ T58] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 794.261405][ T6071] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.8403'. [ 794.805406][ T6088] netlink: 'syz.4.8407': attribute type 1 has an invalid length. [ 794.997438][ T6088] bond21: entered promiscuous mode [ 795.003815][ T6088] 8021q: adding VLAN 0 to HW filter on device bond21 [ 795.958328][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 795.965590][ C1] bridge0: topology change detected, propagating [ 796.521964][ T6094] 8021q: adding VLAN 0 to HW filter on device bond21 [ 796.531866][ T6094] bond21: (slave ipip2): The slave device specified does not support setting the MAC address [ 796.556026][ T6094] bond21: (slave ipip2): Setting fail_over_mac to active for active-backup mode [ 796.595701][ T6094] bond21: (slave ipip2): making interface the new active one [ 796.605405][ T6094] ipip2: entered promiscuous mode [ 796.615487][ T6094] bond21: (slave ipip2): Enslaving as an active interface with an up link [ 796.626014][ T6087] IPVS: Unknown mcast interface: nr0 [ 796.670309][ T6100] syzkaller1: entered promiscuous mode [ 796.677747][ T6100] syzkaller1: entered allmulticast mode [ 798.315052][ T6170] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8430'. [ 798.441444][ T6170] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8430'. [ 798.450959][ T6170] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8430'. [ 798.472769][ T6170] netlink: 'syz.1.8430': attribute type 18 has an invalid length. [ 798.486905][ T6177] lo speed is unknown, defaulting to 1000 [ 798.610173][ T6187] erspan0: entered promiscuous mode [ 798.643222][ T6187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8436'. [ 798.671666][ T6187] erspan0: left promiscuous mode [ 798.689973][ T6187] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8436'. [ 798.901146][ T6198] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 799.043708][ T6182] lo speed is unknown, defaulting to 1000 [ 799.136212][ T6212] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8443'. [ 799.374935][ T6220] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8446'. [ 799.704082][ T6229] bond10: option all_slaves_active: invalid value (127) [ 799.749581][ T6229] bond10 (unregistering): Released all slaves [ 799.875512][ T6250] netlink: 'syz.3.8451': attribute type 1 has an invalid length. [ 799.892580][ T6250] netlink: 'syz.3.8451': attribute type 1 has an invalid length. [ 800.021659][ T6250] 8021q: adding VLAN 0 to HW filter on device bond35 [ 800.038954][ T6260] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:0 [ 800.121683][ T6250] macvlan2: entered promiscuous mode [ 800.127042][ T6250] macvlan2: entered allmulticast mode [ 800.133809][ T6250] bond35: entered promiscuous mode [ 800.139605][ T6250] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 800.148069][ T6250] bond35: left promiscuous mode [ 800.245509][ T29] audit: type=1804 audit(1782292098.092:32): pid=6264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.8455" name="/newroot/427/cgroup.controllers" dev="tmpfs" ino=2193 res=1 errno=0 [ 800.312038][ T29] audit: type=1800 audit(1782292098.092:33): pid=6264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8455" name="cgroup.controllers" dev="tmpfs" ino=2193 res=0 errno=0 [ 800.353285][ T29] audit: type=1800 audit(1782292098.132:34): pid=6264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8455" name="cgroup.controllers" dev="tmpfs" ino=2193 res=0 errno=0 [ 800.420900][ T6266] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8456'. [ 800.846242][ T6272] xfrm1: entered allmulticast mode [ 801.041104][ T6288] netlink: 'syz.5.8464': attribute type 8 has an invalid length. [ 801.173202][ T6290] syzkaller1: entered promiscuous mode [ 801.189590][ T6290] syzkaller1: entered allmulticast mode [ 801.429747][ T6298] netlink: 68 bytes leftover after parsing attributes in process `syz.5.8468'. [ 801.543160][ T6297] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8467'. [ 801.571304][ T6297] veth1_to_batadv: entered allmulticast mode [ 801.820592][T28158] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 801.839356][T28158] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 801.856535][T28158] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 801.870462][T28158] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 801.880787][T28158] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 802.260568][ T6320] xt_TPROXY: Can be used only with -p tcp or -p udp [ 802.307954][ T6328] tap0: tun_chr_ioctl cmd 1074025677 [ 802.344513][ T6328] tap0: linktype set to 768 [ 802.382591][ T6303] lo speed is unknown, defaulting to 1000 [ 802.599783][ T6340] netlink: 'syz.1.8477': attribute type 2 has an invalid length. [ 802.619350][ T6340] tipc: Enabling of bearer rejected, already enabled [ 802.636975][ T6340] tipc: Disabling bearer [ 803.390482][ T6379] __nla_validate_parse: 9 callbacks suppressed [ 803.390506][ T6379] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.8487'. [ 803.412662][ T6377] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8486'. [ 803.445470][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.454348][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.462397][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.473552][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.481741][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.489783][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.497087][ T6381] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 803.817346][ T6303] bridge0: port 1(bridge_slave_0) entered blocking state [ 803.824661][ T6303] bridge0: port 1(bridge_slave_0) entered disabled state [ 803.831999][ T6303] bridge_slave_0: entered allmulticast mode [ 803.839390][ T6303] bridge_slave_0: entered promiscuous mode [ 803.847368][ T6407] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8493'. [ 803.848356][ T6303] bridge0: port 2(bridge_slave_1) entered blocking state [ 803.863652][ T6303] bridge0: port 2(bridge_slave_1) entered disabled state [ 803.871015][ T6303] bridge_slave_1: entered allmulticast mode [ 803.881870][ T6303] bridge_slave_1: entered promiscuous mode [ 803.893780][ T6410] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8494'. [ 803.932197][ T6407] bond9: entered promiscuous mode [ 803.937741][ T6407] 8021q: adding VLAN 0 to HW filter on device bond9 [ 803.954958][ T6409] veth0_macvtap: Caught tx_queue_len zero misconfig [ 803.962074][T20918] Bluetooth: hci6: command tx timeout [ 803.978434][ T6410] tipc: Resetting bearer [ 803.987487][ T6303] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 804.040942][ T6303] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 804.079162][ T6408] tipc: Resetting bearer [ 804.106776][ T6303] team0: Port device team_slave_0 added [ 804.113659][ T6417] netlink: 'syz.4.8496': attribute type 1 has an invalid length. [ 804.126659][ T6303] team0: Port device team_slave_1 added [ 804.168435][ T6417] 8021q: adding VLAN 0 to HW filter on device bond22 [ 804.187554][ T6421] team0: Port device dummy0 removed [ 804.196864][ T6421] bond22: (slave dummy0): Enslaving as a backup interface with an up link [ 804.206780][ T6303] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 804.213893][ T6303] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 804.254596][ T6417] netlink: 'syz.4.8496': attribute type 10 has an invalid length. [ 804.262473][ T6417] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8496'. [ 804.270221][ T6303] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 804.285634][ T6303] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 804.293559][ T6303] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 804.328183][ T6303] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 804.356599][T25336] bond22: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 804.369926][ T58] tipc: Resetting bearer [ 804.377663][ T6417] dummy0: entered promiscuous mode [ 804.385596][ T6417] bond22: (slave dummy0): Removing an active aggregator [ 804.397098][ T6417] bond22: (slave dummy0): Releasing backup interface [ 804.472990][ T6303] hsr_slave_0: entered promiscuous mode [ 804.481296][ T6303] hsr_slave_1: entered promiscuous mode [ 804.491980][ T6303] debugfs: 'hsr0' already exists in 'hsr' [ 804.546089][ T6303] Cannot create hsr debugfs directory [ 804.564656][ T6431] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 804.771005][ T6440] tipc: Enabling of bearer rejected, already enabled [ 805.223090][ T6303] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 805.251132][ T6303] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 805.274706][ T6303] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 805.311213][ T6303] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 805.343023][ T6303] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 805.369038][ T6303] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 805.389817][ T6303] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 805.452896][ T6303] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 805.477367][ T6474] netlink: 164 bytes leftover after parsing attributes in process `syz.4.8514'. [ 805.504121][ T6474] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8514'. [ 805.652855][ T6303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 805.701965][ T6303] 8021q: adding VLAN 0 to HW filter on device team0 [ 805.716469][T19008] bridge0: port 1(bridge_slave_0) entered blocking state [ 805.723698][T19008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 805.778858][T19008] bridge0: port 2(bridge_slave_1) entered blocking state [ 805.786005][T19008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 805.856566][ T6303] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 805.948939][ T6494] lo speed is unknown, defaulting to 1000 [ 806.039580][T20918] Bluetooth: hci6: command tx timeout [ 806.422831][ T6518] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8526'. [ 806.491668][ T6518] netlink: 32 bytes leftover after parsing attributes in process `syz.5.8526'. [ 806.531774][ T6518] syzkaller1: entered promiscuous mode [ 806.553804][ T6518] syzkaller1: entered allmulticast mode [ 806.596796][ T6521] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8527'. [ 806.970295][ T6532] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input9 [ 807.068245][ T6531] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input10 [ 807.165856][ T6303] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 807.481196][ T6548] bond23: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 807.506889][ T6548] bond23 (unregistering): Released all slaves [ 807.997729][ T6303] veth0_vlan: entered promiscuous mode [ 808.032393][ T6303] veth1_vlan: entered promiscuous mode [ 808.098811][ T6303] veth0_macvtap: entered promiscuous mode [ 808.121382][T20918] Bluetooth: hci6: command tx timeout [ 808.136262][ T6303] veth1_macvtap: entered promiscuous mode [ 808.245901][ T6303] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 808.287736][ T6303] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 808.332434][ T58] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.357446][ T58] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.400655][ T58] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.433856][ T58] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.459570][ T6572] netlink: 'syz.5.8538': attribute type 12 has an invalid length. [ 808.609136][ T6574] bond36: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 808.631941][ T6574] bond36 (unregistering): Released all slaves [ 808.793324][ T6581] __nla_validate_parse: 3 callbacks suppressed [ 808.793345][ T6581] netlink: 36 bytes leftover after parsing attributes in process `syz.5.8540'. [ 808.899093][T25336] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 808.915720][T25336] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 808.997254][T19008] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 809.017633][T19008] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 809.127337][ T6600] syzkaller1: entered promiscuous mode [ 809.155423][ T6600] syzkaller1: entered allmulticast mode [ 809.189484][ T6605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8546'. [ 809.202227][ T6605] bridge0: port 2(bridge_slave_1) entered disabled state [ 809.209493][ T6605] bridge0: port 1(bridge_slave_0) entered disabled state [ 809.477645][ T6618] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8549'. [ 809.565900][ T6621] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8470'. [ 809.633165][ T6624] netlink: 76 bytes leftover after parsing attributes in process `syz.6.8470'. [ 810.180451][ T6649] netlink: 'syz.1.8556': attribute type 1 has an invalid length. [ 810.199642][T20918] Bluetooth: hci6: command tx timeout [ 810.516485][ T6662] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8561'. [ 810.532600][ T6662] netlink: 212 bytes leftover after parsing attributes in process `syz.1.8561'. [ 810.553533][ T6662] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8561'. [ 810.617052][ T6662] netlink: 76 bytes leftover after parsing attributes in process `syz.1.8561'. [ 810.651789][ T6662] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8561'. [ 810.861819][ T6670] macvlan2: entered promiscuous mode [ 810.886131][ T6670] macvlan2: entered allmulticast mode [ 811.127632][ T6679] vcan0: tx drop: invalid da for name 0x00000000000000eb [ 811.727151][ T6709] bridge_slave_1: Caught tx_queue_len zero misconfig [ 811.839518][ T6712] ipip0: entered promiscuous mode [ 811.846545][ T6712] ipip0: entered allmulticast mode [ 811.856075][ T6712] IPv6: NLM_F_CREATE should be specified when creating new route [ 813.223408][ T6768] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input11 [ 824.122335][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 849.721980][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 850.049732][T19010] bond10 (unregistering): (slave ip6gretap2): Releasing active interface [ 850.216928][T19010] bond8 (unregistering): (slave gretap1): Releasing backup interface [ 850.413241][T19010] bond0 (unregistering): (slave wlan0): Releasing backup interface [ 850.423680][T19010] mac80211_hwsim hwsim49 wlan0: left promiscuous mode [ 850.431493][T19010] bond0 (unregistering): Released all slaves [ 850.445165][T19010] bond1 (unregistering): Released all slaves [ 850.457109][T19010] bond2 (unregistering): Released all slaves [ 850.469110][T19010] bond3 (unregistering): Released all slaves [ 850.480869][T19010] bond4 (unregistering): Released all slaves [ 850.493426][T19010] bond5 (unregistering): Released all slaves [ 850.506599][T19010] bond6 (unregistering): Released all slaves [ 850.527035][T19010] bond7 (unregistering): Released all slaves [ 850.540972][T19010] bond8 (unregistering): (slave bond9): Releasing backup interface [ 850.550180][T19010] bond8 (unregistering): Released all slaves [ 850.563538][T19010] bond9 (unregistering): Released all slaves [ 850.576888][T19010] bond10 (unregistering): Released all slaves [ 850.591475][T19010] bond11 (unregistering): Released all slaves [ 850.605142][T19010] bond12 (unregistering): Released all slaves [ 850.618202][T19010] bond13 (unregistering): Released all slaves [ 850.697226][T19010] tipc: Disabling bearer [ 850.703543][T19010] tipc: Left network mode [ 850.856779][T19010] IPVS: stopping master sync thread 25172 ... [ 851.754937][T19010] veth1_macvtap: left promiscuous mode [ 851.762656][T19010] veth0_macvtap: left allmulticast mode [ 851.776584][T19010] veth0_macvtap: left promiscuous mode [ 851.783646][T19010] veth1_vlan: left promiscuous mode [ 851.790414][T19010] veth0_vlan: left promiscuous mode [ 852.570075][T19010] IPVS: stop unused estimator thread 0... [ 859.960036][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 876.438667][ T6806] __nla_validate_parse: 11 callbacks suppressed [ 876.438703][ T6806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8600'. [ 876.526525][ T6812] IPv6: NLM_F_CREATE should be specified when creating new route [ 876.582883][ T6812] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8599'. [ 876.644526][ T6804] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8599'. [ 876.996188][ T6836] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8607'. [ 877.182944][ T6844] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 877.246784][ T6855] netlink: 2980 bytes leftover after parsing attributes in process `syz.4.8612'. [ 877.262822][ T6850] netlink: 24 bytes leftover after parsing attributes in process `syz.6.8610'. [ 877.355681][ T6860] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8613'. [ 877.440810][ T6860] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8613'. [ 877.474820][ T6860] netlink: 'syz.5.8613': attribute type 1 has an invalid length. [ 877.493667][ T6860] netlink: 'syz.5.8613': attribute type 1 has an invalid length. [ 877.503599][ T6860] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8613'. [ 877.811551][ T6898] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 877.823182][ T6898] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 878.022251][ T6904] erspan1: entered allmulticast mode [ 878.028177][ T6903] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8625'. [ 879.284232][ T5795] IPVS: starting estimator thread 0... [ 879.436666][ T6963] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 879.507312][ T6967] team0: Port device team_slave_0 removed [ 879.535806][ T6978] netlink: 'syz.5.8645': attribute type 4 has an invalid length. [ 879.569168][ T6956] IPVS: using max 40 ests per chain, 96000 per kthread [ 879.610540][ T6982] xt_hashlimit: size too large, truncated to 1048576 [ 879.815449][ T6985] netlink: 'syz.1.8643': attribute type 4 has an invalid length. [ 880.263532][ T6996] netlink: 'syz.3.8649': attribute type 11 has an invalid length. [ 880.285426][ T6999] netlink: 'syz.5.8650': attribute type 1 has an invalid length. [ 880.318941][ T7000] hsr0: entered promiscuous mode [ 880.652505][ T6998] hsr0: left promiscuous mode [ 881.365306][ T7033] openvswitch: netlink: Key type 16375 is out of range max 32 [ 881.397186][ T7033] netlink: 'syz.4.8662': attribute type 1 has an invalid length. [ 881.502388][ T7038] __nla_validate_parse: 42 callbacks suppressed [ 881.502429][ T7038] netlink: 24 bytes leftover after parsing attributes in process `syz.6.8664'. [ 881.547029][ T7035] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 881.562781][ T7039] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8665'. [ 881.770135][ T7045] netlink: 24 bytes leftover after parsing attributes in process `syz.6.8664'. [ 881.905601][ T7038] bridge0: port 2(bridge_slave_1) entered disabled state [ 881.913910][ T7038] bridge0: port 1(bridge_slave_0) entered disabled state [ 882.081433][ T7038] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 882.103843][ T7038] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 882.276253][ T7038] macvlan2: left promiscuous mode [ 882.283559][ T7038] macvlan2: left allmulticast mode [ 882.372272][ T7048] geneve2: entered promiscuous mode [ 882.392193][ T58] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.415079][ T58] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.427270][ T58] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.444863][ T58] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.461852][ T7058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 882.477966][ T58] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 48300 - 0 [ 882.493466][T19008] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 48300 - 0 [ 882.505034][T19008] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 48300 - 0 [ 882.516273][T19008] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 48300 - 0 [ 882.806225][ T7077] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8673'. [ 882.821884][ T7077] bridge0: port 3(dummy0) entered disabled state [ 882.839720][ T7077] bridge_slave_0: left allmulticast mode [ 882.851610][ T7077] bridge_slave_0: left promiscuous mode [ 882.876811][ T7077] bridge0: port 1(bridge_slave_0) entered disabled state [ 882.899198][ T7077] bridge_slave_1: left allmulticast mode [ 882.905425][ T7077] bridge_slave_1: left promiscuous mode [ 882.912399][ T7077] bridge0: port 2(bridge_slave_1) entered disabled state [ 882.929125][ T7077] bond0: (slave bond_slave_0): Releasing backup interface [ 882.941120][ T7077] bond0: (slave bond_slave_1): Releasing backup interface [ 882.950787][ T7077] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 882.959569][ T7077] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 882.968019][ T7077] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 882.986287][ T7081] netlink: 280 bytes leftover after parsing attributes in process `syz.1.8675'. [ 883.004326][ T7083] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8675'. [ 883.090899][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.097885][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.104964][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.111948][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.118923][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.125960][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.133079][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.140095][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.147038][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.153988][ T7082] tc action pedit 'at' offset -4096 out of bounds [ 883.160957][ T7082] TC_ACT_REPEAT abuse ? [ 883.230185][ T7097] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8678'. [ 883.458693][ T7106] pim6reg: left allmulticast mode [ 883.516741][ T7112] sysfs: cannot create duplicate filename '/class/ieee80211/1^!Y [ 883.516741][ T7112] 3UH5rBn\' [ 883.529136][ T7112] CPU: 0 UID: 0 PID: 7112 Comm: syz.1.8682 Not tainted syzkaller #0 PREEMPT(full) [ 883.529227][ T7112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 883.529244][ T7112] Call Trace: [ 883.529253][ T7112] [ 883.529263][ T7112] dump_stack_lvl+0xe8/0x150 [ 883.529298][ T7112] sysfs_warn_dup+0x8e/0xa0 [ 883.529373][ T7112] sysfs_do_create_link_sd+0xc0/0x110 [ 883.529403][ T7112] device_add_class_symlinks+0x1cf/0x240 [ 883.529540][ T7112] device_add+0x467/0xb80 [ 883.529564][ T7112] wiphy_register+0x1fc8/0x2ff0 [ 883.529773][ T7112] ? __pfx_wiphy_register+0x10/0x10 [ 883.529804][ T7112] ? __pfx_netdev_run_todo+0x10/0x10 [ 883.529828][ T7112] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 883.529926][ T7112] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 883.530014][ T7112] ieee80211_register_hw+0x3d3d/0x4a50 [ 883.530097][ T7112] ? ieee80211_register_hw+0x1931/0x4a50 [ 883.530141][ T7112] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 883.530172][ T7112] ? __asan_memset+0x22/0x50 [ 883.530199][ T7112] ? __hrtimer_setup+0x1b7/0x260 [ 883.530227][ T7112] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 883.530335][ T7112] mac80211_hwsim_new_radio+0x3238/0x5680 [ 883.530382][ T7112] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 883.530411][ T7112] ? kstrndup+0xbd/0x160 [ 883.530444][ T7112] ? kstrndup+0xbd/0x160 [ 883.530465][ T7112] hwsim_new_radio_nl+0xd8b/0xf90 [ 883.530502][ T7112] genl_family_rcv_msg_doit+0x233/0x340 [ 883.530536][ T7112] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 883.530569][ T7112] ? bpf_lsm_capable+0x9/0x20 [ 883.530590][ T7112] ? security_capable+0x7e/0x2c0 [ 883.530709][ T7112] genl_rcv_msg+0x614/0x7a0 [ 883.530740][ T7112] ? __pfx_genl_rcv_msg+0x10/0x10 [ 883.530764][ T7112] ? ref_tracker_free+0x689/0x830 [ 883.530792][ T7112] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 883.530829][ T7112] ? __pfx_ref_tracker_free+0x10/0x10 [ 883.530861][ T7112] netlink_rcv_skb+0x226/0x4a0 [ 883.530895][ T7112] ? __pfx_genl_rcv_msg+0x10/0x10 [ 883.530922][ T7112] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 883.530962][ T7112] ? down_read+0x2be/0x330 [ 883.531032][ T7112] genl_rcv+0x28/0x40 [ 883.531056][ T7112] netlink_unicast+0x7bb/0x940 [ 883.531091][ T7112] netlink_sendmsg+0x813/0xb40 [ 883.531130][ T7112] ? __pfx_netlink_sendmsg+0x10/0x10 [ 883.531163][ T7112] ? futex_unqueue+0x22/0x240 [ 883.531191][ T7112] ? aa_sock_msg_perm+0xf1/0x1b0 [ 883.531215][ T7112] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 883.531243][ T7112] ? __pfx_netlink_sendmsg+0x10/0x10 [ 883.531277][ T7112] ____sys_sendmsg+0x9b9/0xa20 [ 883.531313][ T7112] ? __pfx_____sys_sendmsg+0x10/0x10 [ 883.531345][ T7112] ? lock_release+0x4b/0x3c0 [ 883.531377][ T7112] ? import_iovec+0x73/0xa0 [ 883.531407][ T7112] ___sys_sendmsg+0x2a5/0x360 [ 883.531441][ T7112] ? __pfx____sys_sendmsg+0x10/0x10 [ 883.531475][ T7112] ? futex_wait+0x2a2/0x390 [ 883.531518][ T7112] ? __fget_files+0x2a/0x420 [ 883.531543][ T7112] ? __fget_files+0x3a2/0x420 [ 883.531573][ T7112] __x64_sys_sendmsg+0x1b1/0x290 [ 883.531605][ T7112] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 883.531645][ T7112] ? rcu_is_watching+0x15/0xb0 [ 883.531668][ T7112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 883.531713][ T7112] do_syscall_64+0x174/0x580 [ 883.531743][ T7112] ? trace_irq_disable+0x3b/0x140 [ 883.531788][ T7112] ? clear_bhb_loop+0x40/0x90 [ 883.531815][ T7112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 883.531836][ T7112] RIP: 0033:0x7fcfbe19ce59 [ 883.531858][ T7112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 883.531876][ T7112] RSP: 002b:00007fcfbf0a3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 883.531902][ T7112] RAX: ffffffffffffffda RBX: 00007fcfbe415fa0 RCX: 00007fcfbe19ce59 [ 883.531918][ T7112] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 883.531932][ T7112] RBP: 00007fcfbe232e6f R08: 0000000000000000 R09: 0000000000000000 [ 883.531946][ T7112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 883.531959][ T7112] R13: 00007fcfbe416038 R14: 00007fcfbe415fa0 R15: 00007fff986002e8 [ 883.531986][ T7112] [ 884.050415][ T7116] netlink: 136 bytes leftover after parsing attributes in process `syz.3.8680'. [ 884.089403][ T7116] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 884.413918][ T7135] lo speed is unknown, defaulting to 1000 [ 884.982718][ T7138] IPVS: Scheduler module ip_vs_sip not found [ 885.116388][ T7159] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8688'. [ 885.861887][ T7184] netlink: 84 bytes leftover after parsing attributes in process `syz.1.8696'. [ 885.910228][ T7184] netlink: 'syz.1.8696': attribute type 1 has an invalid length. [ 886.142685][ T7195] hsr0: entered promiscuous mode [ 886.865632][ T7219] netlink: 'syz.3.8708': attribute type 4 has an invalid length. [ 886.877781][ T7219] netlink: 'syz.3.8708': attribute type 8 has an invalid length. [ 886.909728][ T7219] netlink: 212 bytes leftover after parsing attributes in process `syz.3.8708'. [ 886.943535][ T7218] netlink: 'syz.5.8706': attribute type 13 has an invalid length. [ 886.968660][ T7215] netlink: 'syz.5.8706': attribute type 13 has an invalid length. [ 886.977678][ T7218] netlink: 'syz.5.8706': attribute type 17 has an invalid length. [ 887.029735][ T7215] netlink: 'syz.5.8706': attribute type 17 has an invalid length. [ 887.098392][ T7234] netlink: 36 bytes leftover after parsing attributes in process `syz.6.8712'. [ 887.166813][ T7214] bridge0: port 2(bridge_slave_1) entered disabled state [ 887.174385][ T7214] bridge0: port 1(() entered disabled state [ 887.186792][ T7239] xt_CT: You must specify a L4 protocol and not use inversions on it [ 887.281485][ T7214] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 887.303362][ T7214] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 887.647585][ T7218] ip6gretap0: left promiscuous mode [ 887.726685][ T7255] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8717'. [ 887.747357][ T7218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 887.755931][ T7218] 8021q: adding VLAN 0 to HW filter on device team0 [ 887.765646][ T7218] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 887.782941][ T7218] bridge0: port 1(() entered blocking state [ 887.789020][ T7218] bridge0: port 1(() entered forwarding state [ 887.798515][ T7218] bridge0: port 2(bridge_slave_1) entered blocking state [ 887.805660][ T7218] bridge0: port 2(bridge_slave_1) entered forwarding state [ 887.819119][ T7218] veth0_to_team: left promiscuous mode [ 887.824725][ T7218] veth0_to_team: left allmulticast mode [ 887.846890][ T7251] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8717'. [ 887.869905][ T7218] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 887.885457][ T7218] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 887.911040][ T7257] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8717'. [ 887.957265][ T7218] veth1_vlan: left promiscuous mode [ 887.970806][ T7218] veth0_vlan: left promiscuous mode [ 887.985347][ T7218] veth0_vlan: entered promiscuous mode [ 888.007574][ T7218] veth1_vlan: entered promiscuous mode [ 888.025685][ T7218] veth1_macvtap: left promiscuous mode [ 888.036338][ T7218] veth0_macvtap: left promiscuous mode [ 888.067475][ T7218] veth0_macvtap: entered promiscuous mode [ 888.097700][ T7218] veth1_macvtap: entered promiscuous mode [ 888.119601][ T7218] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 888.128016][ T7218] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 888.150107][ T7218] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 888.169310][ T7218] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 888.187193][ T7218] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 888.203819][ T7218] 8021q: adding VLAN 0 to HW filter on device bond1 [ 888.212918][ T7218] 8021q: adding VLAN 0 to HW filter on device bond2 [ 888.254237][ T7218] 8021q: adding VLAN 0 to HW filter on device bond3 [ 888.270032][ T7218] bond4: left allmulticast mode [ 888.275487][ T7218] 8021q: adding VLAN 0 to HW filter on device bond4 [ 888.284964][ T7218] mac80211_hwsim hwsim98 syzkaller0: left promiscuous mode [ 888.303620][ T7218] mac80211_hwsim hwsim98 syzkaller0: left allmulticast mode [ 888.311617][ T7218] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 888.349675][ T7215] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 888.393248][T25327] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 52331 - 0 [ 888.420452][T25327] netdevsim netdevsim5 netdevsim1: unset [1, 1] type 2 family 0 port 52331 - 0 [ 888.441307][T25327] netdevsim netdevsim5 netdevsim2: unset [1, 1] type 2 family 0 port 52331 - 0 [ 888.480578][ T7251] 8021q: adding VLAN 0 to HW filter on device bond36 [ 888.526158][T25327] netdevsim netdevsim5 netdevsim3: unset [1, 1] type 2 family 0 port 52331 - 0 [ 888.590163][ T7260] lo speed is unknown, defaulting to 1000 [ 888.822247][ T7271] tipc: Failed to remove unknown binding: 66,0,0/963044419:1502775587/1502775589 [ 888.870056][ T7271] tipc: Failed to remove unknown binding: 66,0,0/963044419:1502775587/1502775588 [ 888.946782][ T7275] netlink: 'syz.1.8723': attribute type 64 has an invalid length. [ 889.038648][ T7275] nbd: socks must be embedded in a SOCK_ITEM attr [ 889.056890][ T7275] block nbd3: shutting down sockets [ 889.173620][ T7282] netlink: 'syz.3.8725': attribute type 12 has an invalid length. [ 889.817092][ T7300] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 890.604058][ T7323] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8733'. [ 890.930794][ T7334] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8736'. [ 891.157337][ T7343] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8736'. [ 891.230036][ T7342] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8738'. [ 891.697755][ T7357] netlink: 104 bytes leftover after parsing attributes in process `syz.4.8741'. [ 891.807820][ T7358] x_tables: ip_tables: ah match: only valid for protocol 51 [ 892.222056][ T7369] bond37 (unregistering): Released all slaves [ 892.327475][ T7374] bond1: (slave tunl0): Device is not bonding slave [ 892.336572][ T7374] bond1: option active_slave: invalid value (tunl0) [ 892.351381][ T7374] bond1 (unregistering): Released all slaves [ 892.430246][ T7365] lo speed is unknown, defaulting to 1000 [ 892.585923][ T7383] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8750'. [ 892.846749][ T7391] netlink: 20 bytes leftover after parsing attributes in process `syz.6.8752'. [ 892.939497][ T7391] ip6gre1: entered promiscuous mode [ 892.993978][ T7391] ip6gre1: entered allmulticast mode [ 893.025075][ T7397] netlink: 'syz.6.8752': attribute type 6 has an invalid length. [ 893.056895][ T7397] netlink: 72 bytes leftover after parsing attributes in process `syz.6.8752'. [ 893.204139][ T7366] lo speed is unknown, defaulting to 1000 [ 893.722642][ T7411] syzkaller0: entered promiscuous mode [ 893.759245][ T7411] syzkaller0: entered allmulticast mode [ 895.087742][ T7428] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 895.224326][ T7433] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 896.006389][ T7458] netlink: 165 bytes leftover after parsing attributes in process `syz.3.8770'. [ 897.103654][ T7472] netlink: 'syz.1.8774': attribute type 1 has an invalid length. [ 897.112309][ T7473] netlink: 'syz.1.8774': attribute type 1 has an invalid length. [ 897.147428][ T7472] bond10: entered promiscuous mode [ 897.165917][ T7472] 8021q: adding VLAN 0 to HW filter on device bond10 [ 897.211289][ T7472] vlan5: entered allmulticast mode [ 897.217061][ T7472] bond10: entered allmulticast mode [ 897.252587][ T7472] bond10: (slave bridge6): making interface the new active one [ 897.261481][ T7472] bridge6: entered promiscuous mode [ 897.267389][ T7472] bridge6: entered allmulticast mode [ 897.293343][ T7472] bond10: (slave bridge6): Enslaving as an active interface with an up link [ 897.560882][ T7484] netlink: 140 bytes leftover after parsing attributes in process `syz.6.8778'. [ 897.631377][ T7485] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8776'. [ 897.653429][ T7485] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8776'. [ 897.797114][ T7494] netlink: 52 bytes leftover after parsing attributes in process `syz.1.8780'. [ 897.982707][ T7496] netlink: 'syz.1.8781': attribute type 1 has an invalid length. [ 897.991502][ T7496] netlink: 'syz.1.8781': attribute type 2 has an invalid length. [ 898.004778][ T7496] netlink: 'syz.1.8781': attribute type 1 has an invalid length. [ 898.026604][ T7496] netlink: 'syz.1.8781': attribute type 2 has an invalid length. [ 898.204291][ T7503] xt_HMARK: proto mask must be zero with L3 mode [ 898.217299][ T7502] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8782'. [ 898.633477][ T7524] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8783'. [ 898.669777][ T7525] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.8784'. [ 898.791088][ T7527] vlan3: entered promiscuous mode [ 898.880813][ T7530] tipc: Invalid UDP bearer configuration [ 898.880885][ T7530] tipc: Enabling of bearer rejected, failed to enable media [ 898.959173][ T7530] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8786'. [ 898.997960][ T7531] lo speed is unknown, defaulting to 1000 [ 899.013160][ T7537] netlink: 'syz.1.8787': attribute type 1 has an invalid length. [ 899.219673][ T7530] bridge1: port 1(erspan0) entered blocking state [ 899.245350][ T7530] bridge1: port 1(erspan0) entered disabled state [ 899.275834][ T7530] erspan0: entered allmulticast mode [ 899.307447][ T7530] erspan0: entered promiscuous mode [ 899.677620][ T7558] syzkaller0: entered promiscuous mode [ 899.723341][ T7558] syzkaller0: entered allmulticast mode [ 899.759490][ T7561] tipc: Enabled bearer , priority 0 [ 899.795427][ T7558] tipc: Resetting bearer [ 899.822392][ T7563] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8794'. [ 899.846122][ T7556] tipc: Resetting bearer [ 899.869653][ T7556] tipc: Disabling bearer [ 900.114761][ T7559] lo speed is unknown, defaulting to 1000 [ 900.566230][ T7590] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8801'. [ 900.673928][ T7593] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8803'. [ 901.299944][T20918] block nbd3: Receive control failed (result -1) [ 901.317137][ T7607] can: request_module (can-proto-0) failed. [ 902.254243][ T7642] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 903.980123][ T7679] vlan3: entered allmulticast mode [ 903.997275][ T7679] bond0: entered allmulticast mode [ 904.017590][ T7679] bond_slave_0: entered allmulticast mode [ 904.033606][ T7679] bond_slave_1: entered allmulticast mode [ 904.104908][ T7684] __nla_validate_parse: 4 callbacks suppressed [ 904.104946][ T7684] netlink: 185140 bytes leftover after parsing attributes in process `syz.4.8826'. [ 904.333515][ T7702] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 904.381417][ T7704] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8827'. [ 904.425755][ T7702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8829'. [ 904.451018][ T7707] netlink: 'syz.4.8830': attribute type 23 has an invalid length. [ 904.458901][ T7707] netlink: 'syz.4.8830': attribute type 21 has an invalid length. [ 904.466740][ T7707] IPv6: NLM_F_CREATE should be specified when creating new route [ 904.686486][ T7717] veth1_vlan: left promiscuous mode [ 904.693069][ T7717] veth0_vlan: left promiscuous mode [ 904.699511][ T7717] veth0_vlan: entered promiscuous mode [ 904.707711][ T7717] veth1_vlan: entered promiscuous mode [ 904.716099][ T7717] veth1_macvtap: left promiscuous mode [ 904.722730][ T7717] veth0_macvtap: left promiscuous mode [ 904.729356][ T7717] veth0_macvtap: entered promiscuous mode [ 904.736313][ T7717] veth1_macvtap: entered promiscuous mode [ 904.811303][ T7717] 8021q: adding VLAN 0 to HW filter on device bond1 [ 904.822744][ T7717] 8021q: adding VLAN 0 to HW filter on device bond2 [ 904.834437][ T7717] 8021q: adding VLAN 0 to HW filter on device bond3 [ 904.855793][ T7724] netlink: 104 bytes leftover after parsing attributes in process `syz.6.8835'. [ 904.870540][ T7717] 8021q: adding VLAN 0 to HW filter on device bond4 [ 904.896068][ T7724] netlink: 20 bytes leftover after parsing attributes in process `syz.6.8835'. [ 904.987590][ T7717] 8021q: adding VLAN 0 to HW filter on device bond5 [ 905.035599][ T7717] 8021q: adding VLAN 0 to HW filter on device bond6 [ 905.071973][ T7717] 8021q: adding VLAN 0 to HW filter on device bond7 [ 905.094140][ T7717] 8021q: adding VLAN 0 to HW filter on device bond8 [ 905.119887][ T7717] veth1_to_team: entered promiscuous mode [ 905.133944][ T7717] veth1_to_team: entered allmulticast mode [ 905.145388][ T7724] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8835'. [ 905.164384][ T7717] 8021q: adding VLAN 0 to HW filter on device bond9 [ 905.174075][ T7717] 8021q: adding VLAN 0 to HW filter on device bond10 [ 905.191024][ T7717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 905.201970][ T7717] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 905.224115][ T7729] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8835'. [ 905.242871][T25336] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.250595][T25336] bridge0: port 2(bridge_slave_1) entered listening state [ 905.993889][T19010] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 906.179029][T19010] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 906.214663][T19010] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 906.224862][T19010] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 906.367046][ T7751] tipc: Enabling of bearer rejected, already enabled [ 906.402863][ T7751] syzkaller0: mtu less than device minimum [ 906.442205][ T7756] netlink: 104 bytes leftover after parsing attributes in process `syz.1.8844'. [ 906.669091][ T7766] sctp: [Deprecated]: syz.4.8846 (pid 7766) Use of struct sctp_assoc_value in delayed_ack socket option. [ 906.669091][ T7766] Use struct sctp_sack_info instead [ 906.713567][ T7771] netlink: 'syz.5.8847': attribute type 11 has an invalid length. [ 906.894581][ T7783] netlink: 320 bytes leftover after parsing attributes in process `syz.5.8851'. [ 906.959040][ T7783] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8851'. [ 907.176299][ T7791] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 907.406720][ T7798] netlink: 'syz.4.8855': attribute type 1 has an invalid length. [ 907.816730][ T7820] netlink: 'syz.4.8860': attribute type 18 has an invalid length. [ 908.045031][ T7815] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 908.066578][ T7830] ipt_REJECT: TCP_RESET invalid for non-tcp [ 908.080908][ T8652] team_slave_0: entered promiscuous mode [ 908.087100][ T8652] team_slave_1: entered promiscuous mode [ 908.093228][ T8652] veth7: entered promiscuous mode [ 908.118876][ T7740] Bluetooth: hci2: command 0x0405 tx timeout [ 908.183719][ T7823] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 908.256402][ T7835] netlink: 'syz.5.8865': attribute type 1 has an invalid length. [ 908.283706][ T7835] 8021q: adding VLAN 0 to HW filter on device bond10 [ 908.321622][ T7835] netlink: 'syz.5.8865': attribute type 10 has an invalid length. [ 908.345896][ T7835] veth7: entered allmulticast mode [ 908.354602][ T7835] bond10: (slave veth7): Enslaving as an active interface with an up link [ 909.091493][ T7869] bridge8: entered promiscuous mode [ 909.107437][ T7869] bridge8: entered allmulticast mode [ 909.277451][ T7871] netlink: 'syz.6.8877': attribute type 12 has an invalid length. [ 909.296078][ T7871] __nla_validate_parse: 9 callbacks suppressed [ 909.296122][ T7871] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8877'. [ 909.344262][ T7871] bond0: option primary_reselect: invalid value (8) [ 909.390415][ T7876] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8876'. [ 909.416306][ T7876] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8876'. [ 909.440947][ T7876] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8876'. [ 909.475523][ T7882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8876'. [ 909.513693][ T7885] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8878'. [ 909.560513][ T7884] bond7: (slave syz_tun): Removing an active aggregator [ 909.569047][ T7884] bond7: (slave syz_tun): Releasing backup interface [ 909.583152][ T7884] bridge_slave_0: left allmulticast mode [ 909.588986][ T7884] bridge_slave_0: left promiscuous mode [ 909.594767][ T7884] bridge0: port 1(bridge_slave_0) entered disabled state [ 909.604480][ T7884] bridge_slave_1: left promiscuous mode [ 909.610244][ T7884] bridge0: port 2(bridge_slave_1) entered disabled state [ 909.621453][ T7884] bond15: (slave veth0_to_bond): Releasing backup interface [ 909.659703][ T7884] bond0: (slave bond_slave_0): Releasing backup interface [ 909.670979][ T7884] bond_slave_0: left allmulticast mode [ 909.696494][ T7884] bond0: (slave bond_slave_1): Releasing backup interface [ 909.706992][ T7884] bond_slave_1: left allmulticast mode [ 909.715660][ T7884] team_slave_0: left promiscuous mode [ 909.724181][ T7884] team0: Port device team_slave_0 removed [ 909.731577][ T7884] team_slave_1: left promiscuous mode [ 909.740582][ T7892] xt_l2tp: invalid flags combination: 8 [ 909.755628][ T7884] team0: Port device team_slave_1 removed [ 909.763342][ T7884] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 909.891425][ T7895] FAULT_INJECTION: forcing a failure. [ 909.891425][ T7895] name failslab, interval 1, probability 0, space 0, times 0 [ 909.919953][ T7895] CPU: 0 UID: 0 PID: 7895 Comm: syz.1.8882 Not tainted syzkaller #0 PREEMPT(full) [ 909.919983][ T7895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 909.919997][ T7895] Call Trace: [ 909.920006][ T7895] [ 909.920020][ T7895] dump_stack_lvl+0xe8/0x150 [ 909.920049][ T7895] should_fail_ex+0x40c/0x560 [ 909.920075][ T7895] should_failslab+0xa8/0x100 [ 909.920124][ T7895] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 909.920164][ T7895] ? rcu_is_watching+0x15/0xb0 [ 909.920187][ T7895] ? __alloc_skb+0x1d7/0x7a0 [ 909.920212][ T7895] ? trace_irq_enable+0x3b/0x140 [ 909.920243][ T7895] __alloc_skb+0x1d7/0x7a0 [ 909.920276][ T7895] netlink_sendmsg+0x5d4/0xb40 [ 909.920316][ T7895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 909.920355][ T7895] ? aa_sock_msg_perm+0xf1/0x1b0 [ 909.920377][ T7895] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 909.920403][ T7895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 909.920433][ T7895] ____sys_sendmsg+0x9b9/0xa20 [ 909.920469][ T7895] ? __pfx_____sys_sendmsg+0x10/0x10 [ 909.920505][ T7895] ? lock_release+0x4b/0x3c0 [ 909.920538][ T7895] ? import_iovec+0x73/0xa0 [ 909.920567][ T7895] ___sys_sendmsg+0x2a5/0x360 [ 909.920596][ T7895] ? rcu_is_watching+0x15/0xb0 [ 909.920616][ T7895] ? get_pid_task+0x20/0x1f0 [ 909.920638][ T7895] ? __pfx____sys_sendmsg+0x10/0x10 [ 909.920683][ T7895] ? rcu_is_watching+0x15/0xb0 [ 909.920719][ T7895] ? __fget_files+0x2a/0x420 [ 909.920743][ T7895] ? __fget_files+0x3a2/0x420 [ 909.920771][ T7895] __x64_sys_sendmsg+0x1b1/0x290 [ 909.920803][ T7895] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 909.920842][ T7895] ? rcu_is_watching+0x15/0xb0 [ 909.920864][ T7895] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 909.920886][ T7895] do_syscall_64+0x174/0x580 [ 909.920915][ T7895] ? clear_bhb_loop+0x40/0x90 [ 909.920939][ T7895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 909.920959][ T7895] RIP: 0033:0x7fcfbe19ce59 [ 909.920979][ T7895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 909.920997][ T7895] RSP: 002b:00007fcfbf0a3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 909.921019][ T7895] RAX: ffffffffffffffda RBX: 00007fcfbe415fa0 RCX: 00007fcfbe19ce59 [ 909.921034][ T7895] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 909.921048][ T7895] RBP: 00007fcfbf0a3090 R08: 0000000000000000 R09: 0000000000000000 [ 909.921061][ T7895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 909.921073][ T7895] R13: 00007fcfbe416038 R14: 00007fcfbe415fa0 R15: 00007fff986002e8 [ 909.921098][ T7895] [ 910.248271][ T7898] lo speed is unknown, defaulting to 1000 [ 910.434924][ T7902] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8884'. [ 911.590822][ T7931] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8892'. [ 911.680394][ T7899] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8883'. [ 911.916846][ T7934] netlink: 'syz.5.8893': attribute type 1 has an invalid length. [ 911.962651][ T7934] netlink: 64851 bytes leftover after parsing attributes in process `syz.5.8893'. [ 912.620680][ T7949] netlink: 'syz.5.8899': attribute type 1 has an invalid length. [ 912.891764][ T7740] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 912.904644][ T7740] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 912.915398][ T7740] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 912.924595][ T7740] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 912.933912][ T7740] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 913.845750][ T7968] mac80211_hwsim hwsim98 syzkaller0: entered allmulticast mode [ 913.914201][ T7968] mac80211_hwsim hwsim98 syzkaller0: entered promiscuous mode [ 914.427215][ T7951] lo speed is unknown, defaulting to 1000 [ 914.469824][ T7979] __nla_validate_parse: 2 callbacks suppressed [ 914.469860][ T7979] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8906'. [ 914.517271][ T7979] openvswitch: netlink: EtherType 50a is less than min 600 [ 914.742084][ T7983] netlink: 92 bytes leftover after parsing attributes in process `syz.4.8908'. [ 914.904077][ T7987] pimreg: entered allmulticast mode [ 914.970091][ T7986] lo speed is unknown, defaulting to 1000 [ 914.982426][ T7987] netlink: 'syz.3.8909': attribute type 4 has an invalid length. [ 915.025741][ T7990] tipc: Enabling of bearer rejected, already enabled [ 915.078645][ T7740] Bluetooth: hci7: command tx timeout [ 915.862350][ T8005] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 915.973958][ T8011] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.8915'. [ 917.158288][ T7740] Bluetooth: hci7: command tx timeout [ 917.170315][ T8029] netlink: 'syz.6.8919': attribute type 1 has an invalid length. [ 917.261530][ T8029] bond1: entered promiscuous mode [ 917.267752][ T8029] 8021q: adding VLAN 0 to HW filter on device bond1 [ 917.453686][ T8029] bond1: (slave bridge2): making interface the new active one [ 917.466513][ T8029] bridge2: entered promiscuous mode [ 917.475431][ T8029] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 917.707174][ T7951] bridge0: port 1(bridge_slave_0) entered blocking state [ 917.741262][ T7951] bridge0: port 1(bridge_slave_0) entered disabled state [ 917.761523][ T7951] bridge_slave_0: entered allmulticast mode [ 917.829385][ T7951] bridge_slave_0: entered promiscuous mode [ 917.874410][ T7951] bridge0: port 2(bridge_slave_1) entered blocking state [ 917.887379][ T7951] bridge0: port 2(bridge_slave_1) entered disabled state [ 917.901348][ T7951] bridge_slave_1: entered allmulticast mode [ 917.921243][ T7951] bridge_slave_1: entered promiscuous mode [ 917.955940][ T8046] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8922'. [ 918.131160][ T7951] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 918.147211][ T7951] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 918.346546][ T7951] team0: Port device team_slave_0 added [ 918.360010][ T7951] team0: Port device team_slave_1 added [ 918.451012][ T7951] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 918.479058][ T7951] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 918.575558][ T7951] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 918.665020][ T7951] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 918.676217][ T8068] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8926'. [ 918.714368][ T7951] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 918.836213][ T7951] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 919.053201][ T8074] netlink: 'syz.3.8927': attribute type 29 has an invalid length. [ 919.197258][ T7951] hsr_slave_0: entered promiscuous mode [ 919.231792][ T7951] hsr_slave_1: entered promiscuous mode [ 919.238495][ T7740] Bluetooth: hci7: command tx timeout [ 919.276299][ T7951] debugfs: 'hsr0' already exists in 'hsr' [ 919.323490][ T7951] Cannot create hsr debugfs directory [ 919.586968][ T8093] : renamed from bond_slave_0 [ 919.683244][ T8093] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8931'. [ 920.065867][ T7951] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 920.096768][ T7951] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 920.292532][ T7951] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 920.355185][ T7951] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 920.512238][ T7951] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 920.573202][ T7951] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 920.801214][ T7951] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 920.813465][ T7951] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.080801][ T7951] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 921.097165][ T7951] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 921.114718][ T7951] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 921.137665][ T7951] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 921.154790][ T8138] sctp: [Deprecated]: syz.6.8940 (pid 8138) Use of int in max_burst socket option deprecated. [ 921.154790][ T8138] Use struct sctp_assoc_value instead [ 921.172964][ T7951] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 921.193429][ T7951] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 921.210270][ T7951] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 921.251314][ T7951] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 921.319297][ T7740] Bluetooth: hci7: command tx timeout [ 921.412201][ T8143] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.699974][ T8143] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.787971][ T8138] syzkaller1: entered promiscuous mode [ 921.795874][ T8138] syzkaller1: entered allmulticast mode [ 921.839858][ T7951] 8021q: adding VLAN 0 to HW filter on device bond0 [ 921.933622][ T8154] syzkaller0: entered promiscuous mode [ 921.942438][ T8154] syzkaller0: entered allmulticast mode [ 921.993988][ T8143] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.302744][ T8143] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.377385][ T7951] 8021q: adding VLAN 0 to HW filter on device team0 [ 922.457391][T19008] bridge0: port 1(bridge_slave_0) entered blocking state [ 922.465156][T19008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 922.511877][ T8167] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 922.536238][T19008] bridge0: port 2(bridge_slave_1) entered blocking state [ 922.543972][T19008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 922.591125][T19008] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 922.647626][T19010] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 922.751436][T19010] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 922.774443][T19010] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 923.051639][ T8191] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8955'. [ 923.616818][ T7951] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 923.682308][ T8212] netlink: 'syz.5.8958': attribute type 89 has an invalid length. [ 923.741033][ T7951] veth0_vlan: entered promiscuous mode [ 923.762033][ T7951] veth1_vlan: entered promiscuous mode [ 923.957588][ T7951] veth0_macvtap: entered promiscuous mode [ 924.007304][ T7951] veth1_macvtap: entered promiscuous mode [ 924.131124][ T8224] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 924.171648][ T7951] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 924.196249][ T7951] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 924.232974][ T8232] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 924.289447][T19010] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.323076][T19010] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.337721][ T8233] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8964'. [ 924.346659][ T8233] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 924.392807][T19010] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.429803][T19010] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.596436][T25327] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 924.604313][T25327] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 924.687753][ T8245] hsr0: entered promiscuous mode [ 924.715702][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 924.739694][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 924.833631][ T8250] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 924.861912][ T8250] batman_adv: batadv0: Adding interface: gretap3 [ 924.868517][ T8250] batman_adv: batadv0: Interface activated: gretap3 [ 924.970123][ T8247] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8968'. [ 925.015187][ T8260] netlink: 140 bytes leftover after parsing attributes in process `syz.1.8898'. [ 925.247911][ T8267] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8974'. [ 925.277320][ T8272] netlink: 'syz.4.8973': attribute type 1 has an invalid length. [ 925.314158][ T8253] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8970'. [ 925.362346][ T8272] 8021q: adding VLAN 0 to HW filter on device bond23 [ 925.374971][T20918] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 925.382252][T20918] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 925.390564][T20918] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 925.425014][T20918] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 925.432487][T20918] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 925.607188][ T8272] gretap1: entered promiscuous mode [ 925.623907][ T8272] bond23: (slave gretap1): making interface the new active one [ 925.633682][ T8272] bond23: (slave gretap1): Enslaving as an active interface with an up link [ 925.698662][ T8272] macvlan7: entered promiscuous mode [ 925.704014][ T8272] macvlan7: entered allmulticast mode [ 925.710213][ T8272] bond23: entered promiscuous mode [ 925.717429][ T8272] 8021q: adding VLAN 0 to HW filter on device macvlan7 [ 925.760912][ T8272] bond23: (slave macvlan7): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 925.777218][ T8272] bond23: left promiscuous mode [ 925.824984][ T8290] pim6reg: entered allmulticast mode [ 926.007248][ T8290] pim6reg: left allmulticast mode [ 926.561789][ T8278] lo speed is unknown, defaulting to 1000 [ 926.743761][ T8326] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8984'. [ 927.250310][ T8341] netlink: 'syz.6.8988': attribute type 4 has an invalid length. [ 927.264746][ T8341] netlink: 'syz.6.8988': attribute type 4 has an invalid length. [ 927.378487][ T8345] netlink: 'syz.4.8990': attribute type 1 has an invalid length. [ 927.431474][ T8345] 8021q: adding VLAN 0 to HW filter on device bond24 [ 927.480931][ T7740] Bluetooth: hci4: command tx timeout [ 927.521918][ T8345] macvlan7: entered promiscuous mode [ 927.554602][ T8345] macvlan7: entered allmulticast mode [ 927.586410][ T8345] bond24: entered allmulticast mode [ 927.604019][ T8345] bond24: entered promiscuous mode [ 927.623280][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan7 [ 927.665184][ T8345] team0: Port device macvlan7 added [ 927.716757][ T8345] macvlan8: entered promiscuous mode [ 927.726512][ T8345] macvlan8: entered allmulticast mode [ 927.732907][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan8 [ 927.741762][ T8345] team0: Port device macvlan8 added [ 927.755921][ T8356] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8994'. [ 927.791528][ T8345] macvlan9: entered promiscuous mode [ 927.796880][ T8345] macvlan9: entered allmulticast mode [ 927.817576][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan9 [ 927.826239][ T8345] team0: Port device macvlan9 added [ 927.907344][ T8345] macvlan10: entered promiscuous mode [ 927.912787][ T8345] macvlan10: entered allmulticast mode [ 927.931820][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan10 [ 927.958828][ T8345] team0: Port device macvlan10 added [ 927.969397][ T8364] netlink: 292 bytes leftover after parsing attributes in process `syz.6.8998'. [ 928.009552][ T8345] macvlan11: entered promiscuous mode [ 928.014988][ T8345] macvlan11: entered allmulticast mode [ 928.032814][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan11 [ 928.048838][ T8345] team0: Port device macvlan11 added [ 928.054285][ T8362] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 928.110265][ T8345] macvlan12: entered promiscuous mode [ 928.115819][ T8345] macvlan12: entered allmulticast mode [ 928.122273][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan12 [ 928.131140][ T8345] team0: Port device macvlan12 added [ 928.143080][ T8371] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 928.168815][ T8345] macvlan13: entered promiscuous mode [ 928.174249][ T8345] macvlan13: entered allmulticast mode [ 928.180694][ T8345] 8021q: adding VLAN 0 to HW filter on device macvlan13 [ 928.189381][ T8345] team0: Port device macvlan13 added [ 929.040197][ T8405] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9005'. [ 929.077385][ T8405] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9005'. [ 929.091616][ T8404] netlink: 72 bytes leftover after parsing attributes in process `syz.6.9006'. [ 929.272753][ T8412] r: entered promiscuous mode [ 929.447155][ T8278] bridge0: port 1(bridge_slave_0) entered blocking state [ 929.473331][ T8278] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.497198][ T8278] bridge_slave_0: entered allmulticast mode [ 929.519995][ T8278] bridge_slave_0: entered promiscuous mode [ 929.531206][ T8278] bridge0: port 2(bridge_slave_1) entered blocking state [ 929.549352][ T8278] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.557747][ T8278] bridge_slave_1: entered allmulticast mode [ 929.568489][ T7740] Bluetooth: hci4: command tx timeout [ 929.586652][ T8278] bridge_slave_1: entered promiscuous mode [ 929.687670][ T8278] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 929.726612][ T8278] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 929.849258][ T8404] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 929.920200][ T8427] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 929.978764][ T8278] team0: Port device team_slave_0 added [ 930.043552][ T8278] team0: Port device team_slave_1 added [ 930.058728][ T8425] __nla_validate_parse: 1 callbacks suppressed [ 930.058778][ T8425] netlink: 52 bytes leftover after parsing attributes in process `syz.5.9013'. [ 930.113961][ T8425] netlink: 44 bytes leftover after parsing attributes in process `syz.5.9013'. [ 930.356260][ T8446] netlink: 12 bytes leftover after parsing attributes in process `syz.5.9016'. [ 930.387560][ T8447] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 930.411110][ T8278] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 930.426545][ T8278] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 930.456645][ T8278] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 930.489530][ T8278] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 930.500842][ T8278] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 930.532340][ T8278] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 930.661627][ T8447] tipc: Resetting bearer [ 930.751623][ T8278] hsr_slave_0: entered promiscuous mode [ 930.758245][ T8278] hsr_slave_1: entered promiscuous mode [ 930.764519][ T8278] debugfs: 'hsr0' already exists in 'hsr' [ 930.770278][ T8278] Cannot create hsr debugfs directory [ 930.821103][ T8461] netlink: 100 bytes leftover after parsing attributes in process `syz.1.9019'. [ 930.833133][ T8457] syzkaller0: entered promiscuous mode [ 930.838659][ T8457] syzkaller0: entered allmulticast mode [ 931.357023][ T8278] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 48300 - 0 [ 931.595778][ T8278] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 48300 - 0 [ 931.641608][ T7740] Bluetooth: hci4: command tx timeout [ 931.662426][ T8494] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9028'. [ 931.723890][ T8278] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 48300 - 0 [ 931.752678][ T8494] netlink: 92 bytes leftover after parsing attributes in process `syz.4.9028'. [ 931.850086][ T8498] lo speed is unknown, defaulting to 1000 [ 931.872336][ T8278] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 48300 - 0 [ 932.128868][ T8504] netlink: 'syz.5.9031': attribute type 8 has an invalid length. [ 932.362447][ T8491] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 932.410258][ T8508] netlink: 28 bytes leftover after parsing attributes in process `syz.5.9032'. [ 933.719618][ T7740] Bluetooth: hci4: command tx timeout [ 934.425532][ T8482] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 934.437429][ T8278] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 934.464268][ T8278] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 934.492445][ T8278] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 934.535837][ T8278] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 934.567129][ T8278] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 934.615336][ T8278] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 934.632605][ T8524] netlink: 12 bytes leftover after parsing attributes in process `syz.5.9036'. [ 934.645571][ T8278] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 934.674121][ T8278] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 934.692504][ T8527] netlink: 24 bytes leftover after parsing attributes in process `syz.5.9036'. [ 934.751626][ T8524] 8021q: adding VLAN 0 to HW filter on device bond11 [ 934.761182][ T8527] bond11: entered allmulticast mode [ 935.081304][ T8551] xt_policy: output policy not valid in PREROUTING and INPUT [ 935.114205][ T8278] 8021q: adding VLAN 0 to HW filter on device bond0 [ 935.221161][ T8278] 8021q: adding VLAN 0 to HW filter on device team0 [ 935.266112][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 935.273829][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 935.346187][ T8559] bridge4: entered promiscuous mode [ 935.355559][ T8559] bridge4: entered allmulticast mode [ 935.376351][T19010] bridge0: port 2(bridge_slave_1) entered blocking state [ 935.384112][T19010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 935.595290][ T8561] tipc: Started in network mode [ 935.603143][ T8561] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 935.619046][ T8561] tipc: Enabled bearer , priority 16 [ 935.669108][ T8561] netlink: 15672 bytes leftover after parsing attributes in process `syz.6.9045'. [ 935.682945][ T8564] netlink: 27 bytes leftover after parsing attributes in process `syz.5.9046'. [ 935.710178][ T8561] netlink: 28 bytes leftover after parsing attributes in process `syz.6.9045'. [ 935.766857][ T8561] netlink: 28 bytes leftover after parsing attributes in process `syz.6.9045'. [ 935.954888][ T8586] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9049'. [ 935.971818][ T8590] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9051'. [ 936.000353][ T8590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9051'. [ 936.182298][ T8278] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 936.465718][ T8278] veth0_vlan: entered promiscuous mode [ 936.545119][ T8278] veth1_vlan: entered promiscuous mode [ 936.660908][ T5719] tipc: Node number set to 10005162 [ 936.693878][ T8278] veth0_macvtap: entered promiscuous mode [ 936.720525][ T8278] veth1_macvtap: entered promiscuous mode [ 936.797951][ T8278] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 936.851674][ T8278] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 936.890880][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.927084][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.954710][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 937.002752][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 937.192174][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 937.216108][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 937.237332][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 937.263482][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 937.304110][ T8613] lo speed is unknown, defaulting to 1000 [ 937.320561][ T8611] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9053'. [ 938.096313][ T8628] netlink: 'syz.4.9061': attribute type 15 has an invalid length. [ 938.433349][ T8630] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8972'. [ 938.580468][ T8634] lo speed is unknown, defaulting to 1000 [ 938.807976][ T8630] syzkaller0: entered promiscuous mode [ 938.814830][ T8630] syzkaller0: entered allmulticast mode [ 938.960328][ T8664] tipc: Started in network mode [ 938.965878][ T8664] tipc: Node identity 400, cluster identity 256 [ 938.973927][ T8664] tipc: Node number set to 1024 [ 939.196001][ T8669] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9065'. [ 939.601748][T20918] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 939.614675][T20918] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 939.624980][T20918] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 939.635275][T20918] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 939.645539][T20918] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 940.574457][ T8674] lo speed is unknown, defaulting to 1000 [ 940.690275][ T8700] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 940.827356][ T8704] __nla_validate_parse: 1 callbacks suppressed [ 940.827377][ T8704] netlink: 64 bytes leftover after parsing attributes in process `syz.6.9072'. [ 940.852408][ T8704] netlink: 16 bytes leftover after parsing attributes in process `syz.6.9072'. [ 940.873270][ T8704] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9072'. [ 940.883142][ T8704] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9072'. [ 941.097413][ T8708] netlink: 300 bytes leftover after parsing attributes in process `syz.6.9073'. [ 941.239955][ T30] INFO: task syz.2.8284:5629 blocked for more than 143 seconds. [ 941.261487][ T30] Not tainted syzkaller #0 [ 941.272238][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 941.280962][ T30] task:syz.2.8284 state:D stack:26648 pid:5629 tgid:5626 ppid:30163 task_flags:0x400040 flags:0x00080002 [ 941.292936][ T30] Call Trace: [ 941.296243][ T30] [ 941.299203][ T30] __schedule+0x17d9/0x56c0 [ 941.303759][ T30] ? stack_trace_save+0xa9/0x100 [ 941.308757][ T30] ? __kmalloc_node_track_caller_noprof+0x4d7/0x7b0 [ 941.315408][ T30] ? netlink_rcv_skb+0x226/0x4a0 [ 941.320689][ T30] ? genl_rcv+0x28/0x40 [ 941.324899][ T30] ? __pfx___schedule+0x10/0x10 [ 941.329782][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.344843][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.349664][ T30] ? lock_release+0x4b/0x3c0 [ 941.354330][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.359124][ T30] schedule+0x164/0x360 [ 941.363313][ T30] schedule_preempt_disabled+0x13/0x30 [ 941.368811][ T30] __mutex_lock+0x7bf/0x1550 [ 941.373437][ T30] ? __mutex_lock+0x5d4/0x1550 [ 941.378234][ T30] ? nfsd_nl_version_get_doit+0x17c/0xd20 [ 941.384040][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 941.389100][ T30] ? __nlmsg_put+0xef/0x1b0 [ 941.393637][ T30] ? genlmsg_put+0x137/0x2e0 [ 941.398484][ T30] nfsd_nl_version_get_doit+0x17c/0xd20 [ 941.404084][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.408887][ T30] ? __nla_parse+0x40/0x60 [ 941.413344][ T30] ? __pfx_nfsd_nl_version_get_doit+0x10/0x10 [ 941.419452][ T30] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 941.425812][ T30] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 941.432172][ T30] genl_family_rcv_msg_doit+0x233/0x340 [ 941.437750][ T30] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 941.462278][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 941.467732][ T30] genl_rcv_msg+0x614/0x7a0 [ 941.472280][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 941.477352][ T30] ? __pfx_nfsd_nl_version_get_doit+0x10/0x10 [ 941.483524][ T30] ? __netlink_lookup+0xc6/0x8b0 [ 941.488574][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.493473][ T30] netlink_rcv_skb+0x226/0x4a0 [ 941.498280][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 941.503341][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 941.508676][ T30] ? down_read+0x2be/0x330 [ 941.513147][ T30] genl_rcv+0x28/0x40 [ 941.517162][ T30] netlink_unicast+0x7bb/0x940 [ 941.521978][ T30] netlink_sendmsg+0x813/0xb40 [ 941.526790][ T30] ? __folio_batch_add_and_move+0x11a/0xc50 [ 941.532738][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 941.538076][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 941.543053][ T30] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 941.548379][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 941.568337][ T30] ____sys_sendmsg+0x9b9/0xa20 [ 941.573181][ T30] ? __pfx_____sys_sendmsg+0x10/0x10 [ 941.578516][ T30] ? lock_release+0x4b/0x3c0 [ 941.583241][ T30] ? import_iovec+0x73/0xa0 [ 941.587785][ T30] ___sys_sendmsg+0x2a5/0x360 [ 941.592501][ T30] ? count_memcg_event_mm+0x21/0x260 [ 941.597821][ T30] ? __pfx____sys_sendmsg+0x10/0x10 [ 941.603228][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.608370][ T30] ? __fget_files+0x2a/0x420 [ 941.613008][ T30] ? __fget_files+0x3a2/0x420 [ 941.617729][ T30] __x64_sys_sendmsg+0x1b1/0x290 [ 941.622770][ T30] ? _raw_spin_unlock_irq+0x2e/0x50 [ 941.628046][ T30] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 941.633558][ T30] ? do_user_addr_fault+0xc4a/0x1340 [ 941.638899][ T30] ? rcu_is_watching+0x15/0xb0 [ 941.643700][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 941.649793][ T30] do_syscall_64+0x174/0x580 [ 941.654429][ T30] ? trace_irq_disable+0x3b/0x140 [ 941.659627][ T30] ? clear_bhb_loop+0x40/0x90 [ 941.679182][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 941.685157][ T30] RIP: 0033:0x7fb4a679ce59 [ 941.689609][ T30] RSP: 002b:00007fb4a75f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 941.698059][ T30] RAX: ffffffffffffffda RBX: 00007fb4a6a16180 RCX: 00007fb4a679ce59 [ 941.706150][ T30] RDX: 0000000000008840 RSI: 0000200000000100 RDI: 0000000000000003 [ 941.714238][ T30] RBP: 00007fb4a6832e6f R08: 0000000000000000 R09: 0000000000000000 [ 941.722255][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 941.730259][ T30] R13: 00007fb4a6a16218 R14: 00007fb4a6a16180 R15: 00007fffc8e8c5f8 [ 941.738304][ T30] [ 941.742124][ T30] INFO: lockdep is turned off. [ 941.750563][ T30] NMI backtrace for cpu 0 [ 941.750584][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 941.750607][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 941.750621][ T30] Call Trace: [ 941.750630][ T30] [ 941.750639][ T30] dump_stack_lvl+0xe8/0x150 [ 941.750675][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 941.750760][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 941.750805][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 941.750830][ T30] sys_info+0x135/0x170 [ 941.750849][ T30] watchdog+0xfd7/0x1030 [ 941.750887][ T30] ? watchdog+0x1c7/0x1030 [ 941.750918][ T30] kthread+0x388/0x470 [ 941.750938][ T30] ? __pfx_watchdog+0x10/0x10 [ 941.750962][ T30] ? __pfx_kthread+0x10/0x10 [ 941.750982][ T30] ret_from_fork+0x514/0xb70 [ 941.751017][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 941.751037][ T30] ? __switch_to+0xc89/0x1420 [ 941.751067][ T30] ? __pfx_kthread+0x10/0x10 [ 941.751087][ T30] ret_from_fork_asm+0x1a/0x30 [ 941.751120][ T30] [ 941.751129][ T30] Sending NMI from CPU 0 to CPUs 1: [ 941.869576][ C1] NMI backtrace for cpu 1 [ 941.869595][ C1] CPU: 1 UID: 0 PID: 9824 Comm: kworker/1:15 Not tainted syzkaller #0 PREEMPT(full) [ 941.869616][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 941.869628][ C1] Workqueue: events_long br_fdb_cleanup [ 941.869732][ C1] RIP: 0010:check_preemption_disabled+0x1d/0xe0 [ 941.869763][ C1] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 65 8b 05 07 5e 92 07 65 8b 0d fc 5d 92 07 f7 c1 ff ff ff 7f 74 0c 5b <41> 5e 41 5f 5d e9 59 e2 02 00 cc 9c 59 f7 c1 00 02 00 00 74 ea 65 [ 941.869778][ C1] RSP: 0018:ffffc90004baf880 EFLAGS: 00000006 [ 941.869793][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000080000003 [ 941.869805][ C1] RDX: 0000000000000000 RSI: ffffffff8c291100 RDI: ffffffff8c2910c0 [ 941.869818][ C1] RBP: ffffffff84bc8b37 R08: 0000000000000001 R09: 0000000000000000 [ 941.869829][ C1] R10: dffffc0000000000 R11: fffffbfff34f42c0 R12: 0000000000000000 [ 941.869842][ C1] R13: ffffffff9a671ef8 R14: 0000000000000000 R15: 0000000000000001 [ 941.869854][ C1] FS: 0000000000000000(0000) GS:ffff88812537c000(0000) knlGS:0000000000000000 [ 941.869868][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 941.869881][ C1] CR2: 000000110c391daa CR3: 0000000075d38000 CR4: 00000000003526f0 [ 941.869897][ C1] Call Trace: [ 941.869904][ C1] [ 941.869913][ C1] ? debug_object_activate+0xb7/0x410 [ 941.869963][ C1] rcu_is_watching+0x15/0xb0 [ 941.869983][ C1] lock_acquire+0x5f/0x350 [ 941.870010][ C1] ? debug_object_activate+0x355/0x410 [ 941.870027][ C1] ? rcu_is_watching+0x15/0xb0 [ 941.870044][ C1] ? debug_object_activate+0x355/0x410 [ 941.870060][ C1] ? lock_release+0x4b/0x3c0 [ 941.870087][ C1] ? debug_object_activate+0x355/0x410 [ 941.870104][ C1] _raw_spin_lock_irqsave+0x40/0x60 [ 941.870124][ C1] ? debug_object_activate+0xb7/0x410 [ 941.870147][ C1] debug_object_activate+0xb7/0x410 [ 941.870169][ C1] __mod_timer+0xa5a/0xed0 [ 941.870196][ C1] ? rcu_is_watching+0x15/0xb0 [ 941.870217][ C1] mod_delayed_work_on+0xaf/0x190 [ 941.870244][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 941.870266][ C1] process_scheduled_works+0xa8e/0x14e0 [ 941.870302][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 941.870322][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 941.870347][ C1] ? assign_work+0x3cf/0x5d0 [ 941.870370][ C1] worker_thread+0xa47/0xfb0 [ 941.870399][ C1] ? __kthread_parkme+0x71/0x1f0 [ 941.870428][ C1] kthread+0x388/0x470 [ 941.870444][ C1] ? __pfx_worker_thread+0x10/0x10 [ 941.870465][ C1] ? __pfx_kthread+0x10/0x10 [ 941.870482][ C1] ret_from_fork+0x514/0xb70 [ 941.870501][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 941.870517][ C1] ? __switch_to+0xc89/0x1420 [ 941.870543][ C1] ? __pfx_kthread+0x10/0x10 [ 941.870559][ C1] ret_from_fork_asm+0x1a/0x30 [ 941.870588][ C1] [ 941.949004][T20918] Bluetooth: hci1: command tx timeout [ 942.200285][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 942.207191][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 942.216336][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 942.226607][ T30] Call Trace: [ 942.229917][ T30] [ 942.232882][ T30] vpanic+0x56c/0xa60 [ 942.236928][ T30] ? __pfx___schedule+0x10/0x10 [ 942.241812][ T30] ? __pfx_vpanic+0x10/0x10 [ 942.246356][ T30] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 942.252560][ T30] panic+0xc5/0xd0 [ 942.256324][ T30] ? __pfx_panic+0x10/0x10 [ 942.260778][ T30] ? preempt_schedule_common+0x82/0xd0 [ 942.266279][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 942.271696][ T30] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 942.277880][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 942.284074][ T30] watchdog+0x1030/0x1030 [ 942.288449][ T30] ? watchdog+0x1c7/0x1030 [ 942.292899][ T30] kthread+0x388/0x470 [ 942.296982][ T30] ? __pfx_watchdog+0x10/0x10 [ 942.301685][ T30] ? __pfx_kthread+0x10/0x10 [ 942.306307][ T30] ret_from_fork+0x514/0xb70 [ 942.310926][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 942.316066][ T30] ? __switch_to+0xc89/0x1420 [ 942.320775][ T30] ? __pfx_kthread+0x10/0x10 [ 942.325384][ T30] ret_from_fork_asm+0x1a/0x30 [ 942.330178][ T30] [ 942.333813][ T30] Kernel Offset: disabled [ 942.338147][ T30] Rebooting in 86400 seconds..