last executing test programs: 5.498358807s ago: executing program 3 (id=9876): socket$key(0xf, 0x3, 0x2) r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x6) unshare(0x2c020400) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) write$cgroup_devices(0xffffffffffffffff, &(0x7f00000010c0)={'b', ' *:* ', 'm\x00'}, 0x8) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000000000)=""/4103, &(0x7f0000001080)=0x1007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x10, &(0x7f0000001280), 0x4) getpid() recvmsg(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000440)=""/180, 0xb4}], 0x1}, 0x40000100) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r4, &(0x7f0000000700)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000440)="aa", 0x1}], 0x1, &(0x7f0000000180)=[@cred={{0x1c, 0x1, 0x2, {r5, r6, r7}}}], 0x20, 0x40044}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)="114a", 0x2}], 0x1, 0x0, 0x0, 0x400e815}}], 0x2, 0x4) sendmsg$unix(r2, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000001040)='C', 0x1}], 0x1, &(0x7f0000000e00), 0x0, 0x8010}, 0x80) write$cgroup_pid(r2, &(0x7f0000000400), 0x12) sendmsg$key(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="464ef75b"], 0x10}}, 0x48c0) 4.804866408s ago: executing program 0 (id=9881): bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b0000000800000004000000ff030020010000", @ANYBLOB], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r0, r1, 0x25, 0x0, @val=@iter={0x0}}, 0x20) r2 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x29, 0x14, 0x0, 0x47) r3 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x600000a, 0x12, r4, 0x0) getsockopt$inet_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="620ac4ff0000000071100500000000003c9de2ce157510cebe95079bcd820d525f87c9aa8f48c1db878caf62cea5574dd367138db77312d7050f6a526a6a323db1b9ab439b89ea8ebb5cf7659781e205b64a892f4e7aa1bfda488eb4ef0c14fced51021d9b32f4f8b7ea4861f1de8388a7e4067f808a6bcd2e3fec797637b834e54e55fee0541bb4305e00"/151], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) 4.53191555s ago: executing program 3 (id=9882): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800030002000000080007006401010108000700ac1414bb0800020003"], 0x78}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) sendmsg$nl_generic(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="1c0000002e00010026bd4e00fbdbdf250400000008000c00"], 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r10, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x100000c, 0x11, r9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) sendmsg$NL80211_CMD_AUTHENTICATE(r5, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000225bd7000fcdbdf252500000008000300", @ANYRES32=r7, @ANYBLOB="080035000500000008003500030000000a0034000202020202020000080035000500000008002600e9160000"], 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x20001004) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000240)=ANY=[@ANYBLOB="80152a7f4b09ae57ee0cdb1a991de70000080211000000080211fcffffffffffffff00000000006400010000cf0e91696b1017430548714514eb4272e80102"], 0x36) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYRESHEX=r0, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e649c55d22a1d085a707576fd0c3a808e50d18e7d26f3853f83fa568ffce22db12e86c31f298946eae2e6f65a761669812ab15ebe76c5ba3df15add721961603843ad7c2350b12ad4f0099ad80d6e84ee58373c6d081e8be100000000000000"], 0x3c}}, 0x0) 3.536798641s ago: executing program 4 (id=9892): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32, @ANYBLOB="0000000000000000b7080000050000f8ff00000000bfa200000000000007020000f8ffefffb703000008000000b704000002"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='p\x00@\x00', @ANYRES16, @ANYBLOB="01002abd7000fedbdf250900000008000500be0000001400038005000800ff000000080001"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x5) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r2, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @dev={0xfe, 0x80, '\x00', 0x40}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x4000000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="180200000000000000000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000710000009500"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa5bc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x15, 0x3, 'lblc\x00', 0x20, 0x4, 0x8}, 0x2c) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e26, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000300)={r0, &(0x7f0000000180)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x200, &(0x7f0000000240)={@align=0x6, {0x4ad, 0x4, 0x6, 0x2}}, 0x4, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x4}) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000400)=@req3={0x8, 0x5, 0x7fff, 0x4, 0x1, 0x9}, 0x1c) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010027bd70000000000067db000008000334", @ANYRES32=0x0, @ANYBLOB='\f'], 0x34}}, 0x8080) 3.336859649s ago: executing program 3 (id=9894): unshare(0x68040200) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x7, 0x1, 0x7fffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x10, &(0x7f0000000c40)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000000a0000850000001b000000b700000000000000180100002120732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r2}, 0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@bloom_filter={0x1e, 0x4, 0x4, 0x4, 0x80, r0, 0x3, '\x00', r3, 0xffffffffffffffff, 0x2, 0x1, 0x0, 0x8}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r6 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r7, {0xb, 0x2}, {}, {0x10, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x6}, @TCA_FLOWER_KEY_PORT_SRC_MIN={0x6, 0x57, 0x4e22}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008000}, 0x24004000) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x6, 0x10, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004500000018110000", @ANYRES32=r4, @ANYRES16=r4], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r10, &(0x7f0000000f40)={{0x6, @rose}, [@default, @bcast, @netrom, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) sendto(r10, 0x0, 0x0, 0x80, &(0x7f0000001080)=@ll={0x11, 0x11, 0x0, 0x1, 0x8}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r9, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e86c0d85ff9782762f0800", 0x0, 0x1300, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) unshare(0x0) 3.300600179s ago: executing program 4 (id=9895): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x5, 0x5, 0x2, 0x7, 0x1, 0x1, 0xe92}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r0}, &(0x7f0000000040), &(0x7f0000000080)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1, r0}, 0xc) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400600142603600e1208000b0000000401a8001600a400014009000200036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1, 0x0, 0x37}, 0x800) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4000000010000304000020000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000420000002000128008000100677470001400028008000200", @ANYRES32=r4, @ANYBLOB="0f000100", @ANYRES32=r5, @ANYBLOB], 0x40}, 0x1, 0xba01}, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f00000002c0)={0xd, 0x7fff, 0x8208, 0x8c35, 0x2, 0x8, 0x81, 0x1, 0x0}, &(0x7f0000000300)=0x20) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r6, 0x84, 0x18, &(0x7f0000000340)={r7, 0xa}, 0x8) recvfrom$inet6(r4, &(0x7f0000000040)=""/17, 0x11, 0x40002042, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @mcast2, 0xe9}, 0x1c) clock_gettime(0x5, &(0x7f00000000c0)) clock_gettime(0x0, &(0x7f0000000180)) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000140)={0x77359400}, 0x10) 2.820225314s ago: executing program 4 (id=9896): r0 = socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000000)=0x2, 0x4) r1 = socket(0x8, 0x800, 0x0) ioctl$IMGETCOUNT(r1, 0x400261f3, &(0x7f0000000000)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x4) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0x3, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x301, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000004c0)={'bridge_slave_1\x00', 0x0}) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r11, r10, 0x25, 0x0, @void}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r11, r7, 0x25, 0x0, @void}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@setlink={0x28, 0x13, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, 0x41014, 0x54c1f}, [@IFLA_MASTER={0x8, 0xa, r7}]}, 0x28}}, 0x20040000) 1.949476907s ago: executing program 2 (id=9900): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x1, 0x803, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000011002901000000000000000007000000", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a800800068004000500080000003e"], 0x44}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0xfda3, &(0x7f0000000ac0)={0x0}}, 0x44880) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r7, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x48, r8, 0x300, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_DEVICE={0x24, 0x2e, 0x0, 0x1, [@NL802154_DEV_ATTR_KEY_MODE={0x8, 0x6, 0x1}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5, 0x5, 0x1}, @NL802154_DEV_ATTR_SECLEVEL_EXEMPT={0x5}, @NL802154_DEV_ATTR_FRAME_COUNTER={0x6, 0x1, 0x2}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}]}, 0x48}, 0x1, 0x0, 0x0, 0x200008c0}, 0x408c0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="620ac4ff0000000071101d000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newsa={0x184, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e25, 0x2, 0xa, 0x0, 0x0, 0x8}, {@in6=@private1, 0xfe, 0x6c}, @in6=@empty, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x7fffffff, 0x543}, {0x4, 0x7fffffffffffffff, 0xfffffffffffffffc, 0x4000ebe2}, {0x2}, 0x70bd2c, 0x0, 0x2, 0x1, 0x0, 0x50}, [@algo_comp={0x48, 0x3, {{'lzs\x00'}}}, @algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x60}}]}, 0x184}, 0x1, 0x0, 0x0, 0x2004c805}, 0x40880) r14 = socket(0x400000000010, 0x3, 0x0) r15 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r14, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newtfilter={0x78, 0x2c, 0xd2b, 0x0, 0x0, {0x0, 0x0, 0x0, r16, {0x2, 0x3}, {}, {0x1, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0x4c, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0x7, 0x6, 0x0, 0x9, 0x8001, 0x1000, 0x8a0, 0xd5b1}}, @TCA_U32_ACT={0x34, 0x7, [@m_skbmod={0x30, 0x23, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x81}, 0x800) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) preadv(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/22, 0x16}], 0x1, 0xfff, 0x2) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="85fcad88000000001c001280060002000200000008000d00", @ANYRES32=r17, @ANYBLOB], 0x44}}, 0x0) 1.575972228s ago: executing program 1 (id=9903): pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[], 0x47) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x3, 0x13, &(0x7f00000003c0)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x206f}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @map_fd={0x18, 0x9, 0x1, 0x0, r0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x3, 0x13, &(0x7f00000003c0)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x206f}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @map_fd={0x18, 0x9, 0x1, 0x0, r0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (async) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r9 = openat$cgroup_devices(r8, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0) splice(r0, 0x0, r9, 0x0, 0x9, 0x3) 1.450396979s ago: executing program 1 (id=9904): socket$nl_route(0x10, 0x3, 0x0) 1.411253247s ago: executing program 1 (id=9905): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan1\x00'}) (async, rerun: 32) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) (async) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800e00010069703665727370616e0000002c0002801400050000000000000000000000000000000002050016000200000004001200050017"], 0x60}}, 0x0) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="a530000063b75053e3e52164cdd282e322af87782cb02fdea8b6007c4eb8183e64b76a581307a761362d6c1f1ee0fa5dbdb24e1abf5f956f9aef2fe2b1c850e31fc11eb0cdf798901d9ae80e0568ccaf6f51c2c8c6f2b9d3ef36aec42d2ef2e6f0232c2c6eabbdc6c0c4964b06ff50fed6055fca11aa1c355455f8ba46564da2faf70c2214ca293d80dd40597d7c8f43b07200027c0118ed2918c567156e1c832c4e9bc83961", @ANYRES16=r2, @ANYBLOB="270e28bd70000000000004070200"], 0x14}, 0x1, 0x40030000000000}, 0x4000) (async) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a000000080000000200000fffffffff0e000000000000000380000007000000030000ca75ffffff00000000000000002e"], 0x0, 0x46, 0x0, 0x1}, 0x28) ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f00000001c0)={r5}) (async) syz_emit_ethernet(0xa4, &(0x7f00000004c0)={@link_local, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x6a, 0x3a, 0x1, @private0, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x500, {0x0, 0x6, "508359", 0x1, 0x0, 0x1, @private1, @mcast1={0xff, 0x0, '\x00', 0x0}, [@hopopts={0x33}, @srh={0x0, 0x4, 0x4, 0x2, 0x5, 0x60, 0x6, [@dev={0xfe, 0x80, '\x00', 0x42}, @loopback]}], "105b25a50ff4e5bcc2df"}}}}}}}, 0x0) (async) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x20, r1, 0x400, 0x70bd29, 0x4, {{}, {@void, @val={0xc, 0x99, {0x6, 0x6}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) (async) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r6, &(0x7f0000000140)='cgroup.clone_children\x00', 0x2, 0x0) (async) openat$cgroup_procs(r6, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) (async) r7 = openat$cgroup_ro(r6, &(0x7f0000000180)='memory.swap.events\x00', 0x275a, 0x0) (async, rerun: 32) r8 = socket$inet(0x2, 0x80001, 0x84) (rerun: 32) close(0x3) (async) r9 = socket(0x2, 0x80805, 0x0) (async) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r10, 0x84, 0x7a, &(0x7f0000000340)={r11, @in={{0x2, 0x4e21, @multicast2}}}, &(0x7f00000002c0)=0x84) getpeername(r9, 0x0, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) (async) r13 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r13, 0x84, 0x74, &(0x7f0000000200)={r12, 0xfffe, 0x20}, &(0x7f00000001c0)=0x18) ioctl$FIBMAP(r7, 0x1, 0x0) 1.409118875s ago: executing program 2 (id=9906): r0 = socket$kcm(0x23, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0, 0x0, 0x800000}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r2}, 0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f00000003c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x28}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$unix(0x1, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000480)={0x29e9c931, 0x3, 0xfffffffc, 0x4}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c0000800800", @ANYRES16=r4], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f00000001c0)={r1, &(0x7f0000000080)='syzkaller1\x00', 0x90200, &(0x7f00000000c0)={@_ha_fsid={[0x23, 0x7]}, {0x0, 0xf197, 0x2}}, 0x10001, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xe86}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e01, 0x5, @loopback, 0xa}}, 0x0, 0x0, 0x3d, 0x0, "bb02a3c364ca41d6357e544524474004000b42a21d7214bf92494925208a0e2f964e0000c534a6324d6193fcf19b2df3ee818afaa4ff1f56c54dc46d8b6d2ccd008aa0cc1dc2767bbe00"}, 0xd8) setsockopt$MRT_PIM(r5, 0x0, 0xcf, &(0x7f0000000280)=0x2, 0x4) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) 1.193498154s ago: executing program 1 (id=9907): r0 = socket$alg(0x26, 0x5, 0x0) readv(r0, &(0x7f0000000500)=[{&(0x7f0000000100)=""/253, 0xfd}, {&(0x7f0000000080)=""/14, 0xe}, {&(0x7f0000000200)=""/215, 0xd7}, {&(0x7f0000000300)=""/214, 0xd6}, {&(0x7f0000000400)=""/162, 0xa2}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f00000004c0)=""/62, 0x3e}], 0x7) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000680)="ad56b6c5820f47d8bd743292ea54c0e44987727ba6c7be92095134801eb724a4eda6e20c36260daec847a73787337af7ca6f43d5b09b8b119393bf3d39c53067076b2c00000000d34c0643d37ec744f12fa50ab357f20a2e3362a221f34b0d412a78f349027a78ad770801aa32572d494a1c7c8129da5208c00b22009e18f60e2349fc6f32ae503b60de6420494f11351c03e75d9c218bfe640d36dd405e2a945e58232e616c1b08842cc2d9e57c2b8c8773d692fa656c10690b909eed688fd6e872327155b1b029acfd269f31fee7c3fb355518107d634e9dc00fd31f794aa345ce89a8498538174bffa17ac3d2c5a23c56346b643223a4b43d2072809ac8b4a2513e625188d2c336c65fbe2e84dfd2c6e1554bf1ac0727b5accc4f46afc4a188d854309481c99c7cf690756f41ffff19cfc437cc0f03f6530c1b324d30772b8cbb33fe02f9133f04e09a4f3ee45b25ef5b086f7c5fa1ad00"/357, 0xffffffffffffffca) r1 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r1) 1.110451715s ago: executing program 0 (id=9908): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x8}, {0x1ffe1, 0x6}, {0xa, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x4008000) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000100), r1) sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r3, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008005}, 0x8000) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x1d, 0x2, 0x6) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x8}, {0x1ffe1, 0x6}, {0xa, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x4008000) (async) syz_genetlink_get_family_id$smc(&(0x7f0000000100), r1) (async) sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r3, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_bridge\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008005}, 0x8000) (async) 1.079043127s ago: executing program 2 (id=9909): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="02000000040000000800e00001"], 0x50) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000008c0)=0x400002) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x48, 0x7, 0xc0, 0xc}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x2, 0x4, 0x4, 0x3db7}, 0x48) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, 0x0, 0x0, 0x1}, 0x20) write$ppp(r1, &(0x7f00000006c0)="188f2afe5691a274f5da29", 0xb) r3 = socket$igmp6(0xa, 0x3, 0x2) r4 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r4, &(0x7f0000000ac0)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x7ffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000540)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x7}}], 0x18}}], 0x1, 0x4000084) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000180)=0x3a7c, 0x4) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{&(0x7f0000000000)={0xa, 0x1, 0x0, @empty}, 0x1c, 0x0}}], 0x1, 0x14) recvmmsg(r3, &(0x7f0000000040)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, 0x10000}], 0x1, 0x40000020, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000600)={&(0x7f0000000200), 0x0, 0x0, 0x0, 0x100, r0}, 0x38) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1e, 0x4, &(0x7f00000007c0)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x8, 0x1, 0x2}]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4b, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="02000000040000000800e00001"], 0x50) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) (async) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000008c0)=0x400002) (async) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x48, 0x7, 0xc0, 0xc}]}) (async) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x2, 0x4, 0x4, 0x3db7}, 0x48) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, 0x0, 0x0, 0x1}, 0x20) (async) write$ppp(r1, &(0x7f00000006c0)="188f2afe5691a274f5da29", 0xb) (async) socket$igmp6(0xa, 0x3, 0x2) (async) socket$inet6(0xa, 0x2, 0x3a) (async) sendmmsg$inet6(r4, &(0x7f0000000ac0)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x7ffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000540)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x7}}], 0x18}}], 0x1, 0x4000084) (async) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000180)=0x3a7c, 0x4) (async) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{&(0x7f0000000000)={0xa, 0x1, 0x0, @empty}, 0x1c, 0x0}}], 0x1, 0x14) (async) recvmmsg(r3, &(0x7f0000000040)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, 0x10000}], 0x1, 0x40000020, 0x0) (async) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000600)={&(0x7f0000000200), 0x0, 0x0, 0x0, 0x100, r0}, 0x38) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1e, 0x4, &(0x7f00000007c0)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x8, 0x1, 0x2}]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4b, '\x00', 0x0, 0x24}, 0x94) (async) 1.072426458s ago: executing program 1 (id=9910): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa000000000000007010000f8ffffffbfa400000000000007040000f5ffffffb70200000800000018230000", @ANYRES32=r1, @ANYRES32=r1], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040)={r2, 0x1}, 0xc) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) listen(r0, 0x1) 922.329566ms ago: executing program 3 (id=9911): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x40, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0xfc, 0x2e}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x177f}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x23}], @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}]]}, 0x40}, 0x1, 0x0, 0x0, 0xd37697ff280d3c0e}, 0x0) r5 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x10, 0x0, 0x1300) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="200000002e00090027bd70000000000004000000080018000bac0f0004001e"], 0x20}, 0x1, 0x0, 0x0, 0x46844}, 0x8000) 920.822775ms ago: executing program 1 (id=9912): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$netlink(0x10, 0x3, 0x9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x403, 0x70bd2d, 0x3d, {0x0, 0x0, 0x0, 0x0, 0x88adfdb5}}, 0x20}, 0x1, 0x0, 0x0, 0x4004}, 0x4804) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r7, 0x0, 0xf3a, 0x0) close(r6) write(r4, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x120, 0xffffffff, 0x1d0, 0xffffffff, 0xffffffff, 0x1d0, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private=0xa010102, 0x0, 0xffffffff, 'ip6_vti0\x00', 'caif0\x00', {}, {}, 0x2, 0x1, 0x4}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x8, 0x4000, 0x6, 0x2, 'pptp\x00', 'syz1\x00', {0x7fff}}}}, {{@ip={@multicast1, @broadcast, 0xffffffff, 0xffffffff, 'caif0\x00', 'veth0_virt_wifi\x00', {0xff}, {0xff}, 0x32, 0x1, 0x36}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "fb51f0f52069d37c378114554bc1e3e5a78752f61e0d49d5eddd143e2044"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_INITSTATE(r10, 0x113, 0x4, &(0x7f0000000000), &(0x7f0000000040)=0x4) r11 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r12, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x34, r11, 0x20d, 0x70bd2a, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x26]}]}, 0x34}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r11, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0xaf}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_SECRETLEN={0x5}]}, 0x2c}}, 0x24000806) 920.366137ms ago: executing program 0 (id=9913): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r3, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, &(0x7f0000000480)=[{&(0x7f0000000180)="f7", 0x6d47}], 0x1}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x48000009, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4c, 0x2, [@TCA_FQ_INITIAL_QUANTUM={0x8, 0x1e}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_FLOW_PLIMIT={0x1f, 0x8}, @TCA_FQ_TIMER_SLACK={0x8}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0xfffffe96}, @TCA_FQ_QUANTUM={0x5, 0xf}]}}]}, 0x78}}, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x14, 0x1, 0x0, 0x0, {0x1e, 0x88}}, 0x14}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x9, 0x100001, 0x9, 0x5, 0x41, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x104, 0x10, 0x1, 0xfff7fffe, 0x102, {{@in=@private=0xa010100, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x84}, {@in=@local, 0x4d4, 0x3c}, @in6=@empty, {0x0, 0x192, 0x6, 0x1, 0x82520, 0x2, 0xffbffffffffffff8, 0xe2e237c}, {0xffffffffffffffff, 0x0, 0x1f, 0xffffffffffffffde}, {0x2, 0xfffffffc, 0x40}, 0x70bd28, 0x3504, 0x2, 0x5}, [@coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x25}}]}, 0x104}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000002200000000000000f00000000000000ffff04000000000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0xd, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0xb7, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r7, 0x89f8, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000100)={'tunl0\x00', r9, 0x1, 0x40, 0xc3b5, 0x797, {{0x46, 0x4, 0x2, 0x3, 0x118, 0x64, 0x0, 0x6, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@ssrr={0x89, 0xf, 0x27, [@loopback, @multicast2, @private=0xa010101]}, @noop, @cipso={0x86, 0x5a, 0x2, [{0x0, 0xc, "a5f5fa22668c6ff0fa75"}, {0x7, 0x9, "2b2d9796989dab"}, {0x7, 0x2}, {0x5, 0x11, "7ea3dff3050109ce6ea10ce596646a"}, {0x1, 0x9, "2803633dfd1e26"}, {0x0, 0x4, "43b5"}, {0x2, 0xd, "17a6ec4cdb64170de9c9a9"}, {0x7, 0x12, "16acf943b73ec5b50df89f73ae79abed"}]}, @timestamp_prespec={0x44, 0x44, 0xc6, 0x3, 0xb, [{@private=0xa010102, 0xa}, {@broadcast, 0x6d7}, {@broadcast, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@rand_addr=0x64010100, 0x1}, {@empty, 0x5f}, {@remote}]}, @timestamp_addr={0x44, 0x24, 0xd9, 0x1, 0xa, [{@multicast2, 0x8}, {@empty, 0x2}, {@local, 0x1}, {@empty, 0x8}]}, @cipso={0x86, 0x14, 0x1, [{0x5, 0xe, "63e39bffd9d69657688ec94d"}]}, @timestamp_addr={0x44, 0x1c, 0x37, 0x1, 0x0, [{@multicast1, 0xd806}, {@broadcast, 0x48f}, {@rand_addr=0x64010102, 0x9}]}]}}}}}) 875.598852ms ago: executing program 4 (id=9914): r0 = socket$xdp(0x2c, 0x3, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x8, 0x3, 0x2d0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x200, 0xffffffff, 0xffffffff, 0x200, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xd0, 0x130, 0x60030000, {0x0, 0xff000000}, [@common=@unspec=@state={{0x28}, {0x800}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x18}, [0xff000000, 0xff000000, 0x0, 0xff000000], 0x4e23, 0x4e21, 0x4e24, 0x4e21, 0x6, 0x4, 0x2, 0x100000, 0x5}}}, {{@ipv6={@remote, @private1, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0xff, 0xff000000], 'vxcan1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x2, 0x5, 0x5}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x8, &(0x7f0000003140), &(0x7f0000000040)=0x30) 772.243569ms ago: executing program 4 (id=9915): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000002d000b00faffffffffffffff0200000008000300040001000c00018006"], 0x28}}, 0x8000) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000880)={{r0, &(0x7f0000000040)='{\x00', 0x40800, &(0x7f0000000080)={@align=0x5, {0xc, 0x86, 0xe3, 0x9}}, 0x2, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000140)=0x9}, 0x8, &(0x7f0000000780)=[{0x2, 0x0, &(0x7f0000000180)=')#-\x00', &(0x7f0000000200)="85b92138afa7d409bebb2bc41b08ae5769ee6ab3668567f2eeab826e8e58717106f338", 0x23, 0x20}, {0x1, 0x43, &(0x7f0000000240)='\x00', &(0x7f0000000280)="7c8119bda8cef7e832b341ee7181ade276603ae2041aa0073d04fca1374bfcd30465c8a1794846ef80c501cb9da9b5a7eaa21dd5b5ce80a29dddc156b7719d9d59f003edd41e018f925e585b9b6088927032932308aeda965988a966499fedbce50ca17bce23769e63b0355e21ccad70821cd5c08d8b95170f3f09cd055c57aecaad0eb447d19b2a5aca3bc05d681def76b6d99bc38a06f310f212424be603cf813d80368711b27249491c062d0f9105efe707e772c349433b85b2f6974343b93d42152638f15c3634817cb8f6a8ee9bd07813fda6f6d00cd2817264d31af1e885b943bb68d1d09f336f3cc3c1e769d6cd0ac73834f2124c", 0xf8, 0x28}, {0x1, 0xc9, &(0x7f0000000380)='\x00', &(0x7f00000003c0)="f2235a1e045958e0951574734bb860fa71051c8adba4d18959f5d8621c2bdf2bf0491fab3c3ee57f2059", 0x2a, 0x12}, {0x2, 0x4, &(0x7f0000000400)='/-)\\\x00', &(0x7f0000000440)="1715fe47764e18e5f52d102cd195914526564e5fee04f8e5356a1e46b6675bf34d31c3cfd4226c44d41979da780b05", 0x2f, 0x20}, {0x2, 0x2, &(0x7f0000000480)='+\\(%\x00', &(0x7f00000004c0), 0x0, 0x2}, {0x1, 0xffff, &(0x7f0000000500)='*]-\x00', &(0x7f0000000540)="fee591ef9ef4e70158f414f4d698597998cd7f8398e6ca0b46863ff608b11bd4d0d30285393ace97a23c670509fbcd946e67b87ad375fc70cf8d8f916a987b6c85d6e2fe5dc6a433ee7b916df7b58977198351e428ac67a3936e1ebc677c654e36", 0x61, 0x2}, {0x2, 0x4, &(0x7f00000005c0)='\x00', &(0x7f0000000600)="95af5785139212d167cffe134e35e3370cb409c34a0314f21d717c974cc2548ec7584e43923e57843cb9a5a6784fe04c91ef1f22fa2ab1641d", 0x39, 0x20}, {0x2, 0xfffffeff, &(0x7f0000000640)='\\-\x00', &(0x7f0000000680)="b1dad091eaa9a2001a352c7c802057baf8ad622c6676010547c0a98cedb4eca70e7893852c5ec14fad2f29b3384984f20b2c533b33279a12855e43aa2a9426b9016acceaee474cbe95100c3be68f01f224b5592ae8a0875d81e5e149c9fcfbc10de7131fe98909bc0b18d8c378b77c4417b17495c80cd865e477b7ff53daaed4001f7c6e25411603e74915b483c92ee90af3d279f9d2c47cdfb79015148d744fe6c19a803ee475ee7270ec4977b4f35c6284234eb00b699e246204c22ba8fc64eaa5c39f289f41b0de1247f4a0d93247c8600ea24d4863a0f16ac6ade7a7ee63b805", 0xe2, 0x2}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1801000000000000000000000000000085000000a200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) sendmsg$AUDIT_TTY_SET(r1, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x18, 0x3f9, 0x200, 0x70bd2d, 0x25dfdbfb, {0x1, 0x1}}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x24) 712.858177ms ago: executing program 3 (id=9916): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00 \x00'/28], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) (async, rerun: 32) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000ac0)={0x6, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000022bf0000000000000500000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000db003000a0000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x7, 0xc8, &(0x7f0000000040)=""/200}, 0x94) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f"], 0xfdef) (async) r6 = socket$rds(0x15, 0x5, 0x0) connect$rds(r6, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x15, 0x0, 0x0, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f00000003c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) (rerun: 64) 648.820424ms ago: executing program 4 (id=9917): r0 = socket$inet6(0xa, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket(0x2b, 0x1, 0x1) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000700)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r5}, &(0x7f0000000280), &(0x7f0000000140)=r3}, 0x22) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000000)={0x10000004}) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x6, @ipv4={'\x00', '\xff\xff', @local}, 0x401}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x2e, &(0x7f0000000380)=0xffffffffffffffff, 0x1bf7f6f55dc528ca) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x1, 0x100, "a8020b", 0xf, 0x1}) r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) accept4$packet(r6, 0x0, 0x0, 0x80000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r7 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r7, &(0x7f0000000440), 0x10) listen(r7, 0x5) r8 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r8, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) sendto$packet(r8, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847689e7fd3f3fe7bf05ddc63ff512d4074687760a5fbd1fc97777a6e55123f04cc8437b15f4b2c6f5027dcea15b6658d", 0xffffff3d, 0x0, 0x0, 0xffffffffffffff10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r9], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000400)=ANY=[@ANYRESOCT=r9, @ANYRESHEX=r3, @ANYRES16], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r10, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b00868d942007ac5421bcb986", 0x0, 0x86c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x50) 643.843415ms ago: executing program 0 (id=9918): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff000082009500"], &(0x7f0000000000)='GPL\x00', 0x4, 0xfa, &(0x7f0000000140)=""/250}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="0a00000006000000080000000800000040000000", @ANYRES32, @ANYBLOB="00000000000080000000000000000000000000002854b5", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000280)='%ps \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4000000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f0000000800)={0x0, r2}, 0x8) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000900)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x2}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20009}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x12, 0x5, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x4000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r5, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f0000000740)=r4}, 0x22) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000580)={r6, &(0x7f0000000480), 0x0}, 0x20) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000940), r7) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x20040084) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r12, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r13 = socket$netlink(0x10, 0x3, 0x0) r14 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r15, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0xd9, 0xfb}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r16 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xc, &(0x7f0000000940)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x5, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x56, &(0x7f00000002c0)={@random="f432974b13fd", @broadcast, @void, {@canfd={0xd, {{0x0, 0x0, 0x1}, 0x3c, 0x0, 0x0, 0x0, "6f7ee93c1d9864a05a17e69a7b400bb0717a508aea0d05b22b34ff7cce3f0b44e90218125e58c189a36b7b0f0c5b8720f231e67ab5739e195eca77a67c3c4d4e"}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYRESOCT=r7], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r16}, 0x94) 454.833708ms ago: executing program 0 (id=9919): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0x4}, {0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x8, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xb, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xd, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x4}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0x4}, {0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x8, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xb, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xd, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x4}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) (async) 390.185411ms ago: executing program 2 (id=9920): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f0000000000)={'veth0_to_batadv\x00', 0x7}) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x8001}, 0x8) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x7}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r2, &(0x7f0000000140)=0x4) r4 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0xc0800) sendmmsg$alg(r4, &(0x7f0000000300)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="06a0fc931d", 0x5}, {&(0x7f00000001c0)="aeb19c46a7a957baf4c636ee1883a5cb4637e8ff0737c9446db43ff2fd00759143630e", 0x23}], 0x2, &(0x7f0000000240)=[@iv={0x70, 0x117, 0x2, 0x5c, "6d6b5b822e5ae9384178f11f6489a7338d2853bdedf2bc02e29dc4f1a3229659f58bb66f6f94fc255324c4f95603c343c18d2d3c6f8da25206974811f634cc2b7d90b460f2bd16f3e669198033394aac10202d037088edc392f0dfac"}], 0x70, 0x4000010}, {0x0, 0x0, &(0x7f00000002c0)}], 0x2, 0x4040840) r5 = socket$inet6(0xa, 0x5, 0x1) ioctl$SIOCRSGCAUSE(0xffffffffffffffff, 0x89e0, &(0x7f0000000380)) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r5, 0x84, 0x16, &(0x7f00000003c0)={0x6, [0x7, 0x819f, 0x45, 0x3ff, 0x5c, 0x7]}, 0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000400)={r2, @in6={{0xa, 0x4e20, 0x8, @remote, 0x6}}}, &(0x7f00000004c0)=0x84) socketpair(0x1a, 0x6, 0x8, &(0x7f0000000500)={0xffffffffffffffff}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f0000000740)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000700)={&(0x7f00000005c0)={0x124, r7, 0x20, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@crypto_settings, @NL80211_ATTR_HE_OBSS_PD={0x4c, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "b58f079219564aef"}, @NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET={0x5, 0x3, 0x12}, @NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "08e9a8569338cffb"}, @NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET={0x5, 0x1, 0x10}, @NL80211_HE_OBSS_PD_ATTR_SR_CTRL={0x5, 0x6, 0x5}, @NL80211_HE_OBSS_PD_ATTR_SR_CTRL={0x5, 0x6, 0x2}]}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x4}, @NL80211_ATTR_SAE_PASSWORD={0x5f, 0x115, "639d4e49ba6bcf3f34bbf3c1e776d4c53a0838e47de92c621ec3af9aa4125ce9f38ebc7850868e5a30841a01e5b49349587c82e2676333923303639df60911e848131b8c1a2f73d5774e835e09f7214a9fc3fba356ca9ce99254e1"}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x16}, @NL80211_ATTR_AKM_SUITES={0x10, 0x4c, [0xfac02, 0xfac12, 0xfac13]}, @NL80211_ATTR_SAE_PASSWORD={0x13, 0x115, "17f7fac4e125fc04875e2934895383"}, @NL80211_ATTR_AKM_SUITES={0x28, 0x4c, [0xfac13, 0xfac0e, 0xfac04, 0xfac02, 0xfac11, 0x7, 0xfac03, 0xfac04, 0xfac0d]}]]}, 0x124}, 0x1, 0x0, 0x0, 0x4000001}, 0x1800) getsockopt$netrom_NETROM_T2(r6, 0x103, 0x2, &(0x7f0000000780)=0x1, &(0x7f00000007c0)=0x4) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000800)={0xffffffffffffffff}) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r8, 0x4058587a, &(0x7f0000000a00)={{r4, &(0x7f0000000840)='[{#-\xef\\\x00', 0x8200, &(0x7f0000000880)={@_ha_fsid={[0x9, 0xe7000000]}, {0x1, 0xa4f7, 0x5, 0x9}}, 0x7, &(0x7f00000008c0)={@_ha_fsid}, &(0x7f0000000900)=0x3}, {[0x3, 0xa0]}, 0x4, 0x81, &(0x7f0000000940)=""/129}) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r1, &(0x7f0000000a80)={0x20000000}) r10 = socket$inet(0x2, 0x800, 0x4) setsockopt$inet_msfilter(r10, 0x0, 0x29, &(0x7f0000000ac0)={@private=0xa010101, @multicast1, 0x1, 0x1, [@multicast2]}, 0x14) accept4$unix(r9, &(0x7f0000000b00)=@abs, &(0x7f0000000b80)=0x6e, 0x80800) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f0000000bc0)={r3, 0x2, 0x3, [0x6, 0x5, 0x39e]}, &(0x7f0000000c00)=0xe) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r9, 0x84, 0x17, &(0x7f0000000c40)={r11, 0xd, 0x2, "0cce"}, 0xa) socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000000c80)={r2, 0x5, 0xfff9}, &(0x7f0000000cc0)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r6, 0x84, 0x11, &(0x7f0000000d00)={r12, 0x6}, &(0x7f0000000d40)=0x8) r13 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001080)={0x6, 0x24, &(0x7f0000000d80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffff8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_val={0x18, 0x8, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x5}, @exit, @call={0x85, 0x0, 0x0, 0xcc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfbb}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x2}, @map_fd={0x18, 0x7, 0x1, 0x0, r9}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000ec0)='syzkaller\x00', 0x7, 0x4f, &(0x7f0000000f00)=""/79, 0x41100, 0xa, '\x00', 0x0, 0x25, r9, 0x8, &(0x7f0000000f80)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000fc0)={0x4, 0x4, 0x7ff, 0x1d77}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000001000)=[r9, r9, r9, r9, r9, r9, r9, r9, r9], &(0x7f0000001040)=[{0x2, 0x4, 0xe, 0x4}], 0x10, 0x8}, 0x94) ioctl$BTRFS_IOC_INO_LOOKUP(r13, 0xd0009412, &(0x7f0000001200)={0x0, 0x8}) 216.151636ms ago: executing program 3 (id=9921): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) sendto(r0, 0x0, 0x0, 0xd4682a11dec1e2c5, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0x13, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ffffff858500000071000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, 0xfffffffffffffffe) unshare(0x6a040000) writev(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000013c0)={{0x14, 0x453, 0x1f, 0x0, 0x0, {0x5}}, [], {0x14, 0x3e9}}, 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x40000) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000180), &(0x7f0000000000)=0xfffffffffffffe80) r4 = socket$netlink(0x10, 0x3, 0xb) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) 141.718273ms ago: executing program 0 (id=9922): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000a40)="2e9b3d0007e03dd65193dfb6c575963f886411", 0x13}, {&(0x7f0000000180)="0000ff000000", 0x6}], 0x2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x1000, @empty}}, 0x7fff, 0x0, 0xd78e, 0x40, 0x5a1, 0x0, 0x7}, 0x9c) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f00000003c0)={r5}, &(0x7f0000000340)=0x8) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={r0}) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r7, 0x84, 0x19, &(0x7f0000000400)={r6, 0x3ff}, 0x8) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000002200)=""/260, 0x104}, {&(0x7f0000000600)=""/245, 0xf5}, {&(0x7f0000000c00)=""/4070, 0xfe6}, {&(0x7f00000007c0)=""/231, 0xe7}, {&(0x7f0000000500)=""/245, 0xf5}, {&(0x7f00000009c0)=""/210, 0xd2}, {&(0x7f0000000240)=""/161, 0xa1}, {&(0x7f0000000300)=""/205, 0xcd}, {&(0x7f00000000c0)=""/19, 0x13}, {&(0x7f0000000700)=""/160, 0xa0}, {&(0x7f0000000ac0)=""/85, 0x55}, {&(0x7f0000000440)=""/53, 0x35}, {&(0x7f0000000b40)=""/135, 0x87}], 0xd}, 0x40002100) 26.219105ms ago: executing program 2 (id=9923): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.parent_freezing\x00', 0x275a, 0x0) mmap(&(0x7f000009e000/0x4000)=nil, 0x4000, 0x0, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x10, r2, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r2, 0x913e0000) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r3, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2800007, 0x8032, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=9924): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) socket(0x8, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x1a9580, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x3}, {0xc, 0xffff}, {0x9, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x804) socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000007c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x2, 0x5}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_ife={0x50, 0x1, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4000048, 0x8, 0x5, 0xa, 0x3}, 0x1}}, @TCA_IFE_METALST={0x8, 0x6, [@IFE_META_SKBMARK={0x4, 0x1, @void}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4084080}, 0x24000850) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r8 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) r9 = socket(0x15, 0x5, 0x0) getsockopt(r9, 0x200000000114, 0x271e, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) unshare(0x50030900) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r11, &(0x7f00000bd000), 0x318, 0x0) connect$unix(r10, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) kernel console output (not intermixed with test programs): 1 speed is unknown, defaulting to 1000 [ 1000.323798][ T6419] bridge0: port 2(bridge_slave_1) entered blocking state [ 1000.330956][ T6419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1000.535951][ T7598] netlink: 'syz.4.8846': attribute type 13 has an invalid length. [ 1000.546121][ T7597] netlink: 'syz.4.8846': attribute type 13 has an invalid length. [ 1000.577632][ T7598] netlink: 'syz.4.8846': attribute type 17 has an invalid length. [ 1000.610155][ T7597] netlink: 'syz.4.8846': attribute type 17 has an invalid length. [ 1000.711468][ T51] Bluetooth: hci1: command tx timeout [ 1000.764633][ T7597] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1000.785000][ T7602] netlink: 'syz.3.8848': attribute type 4 has an invalid length. [ 1000.802914][ T7598] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1000.840605][ T7602] netlink: 'syz.3.8848': attribute type 4 has an invalid length. [ 1000.864998][ T7602] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1000.875281][ T7618] netlink: 'syz.2.8852': attribute type 1 has an invalid length. [ 1000.904700][ T7602] netlink: 165 bytes leftover after parsing attributes in process `syz.3.8848'. [ 1001.013997][ T7626] dummy0: entered promiscuous mode [ 1001.019160][ T7626] dummy0: entered allmulticast mode [ 1001.054218][ T7626] bond13: (slave dummy0): making interface the new active one [ 1001.063749][ T7626] bond13: (slave dummy0): Enslaving as an active interface with an up link [ 1001.075636][ T7633] netlink: 'syz.4.8853': attribute type 89 has an invalid length. [ 1001.087667][ T7633] netlink: 'syz.4.8853': attribute type 3 has an invalid length. [ 1001.095357][ T7428] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1001.155488][ T7428] veth0_vlan: entered promiscuous mode [ 1001.168271][ T7428] veth1_vlan: entered promiscuous mode [ 1001.220978][ T7428] veth0_macvtap: entered promiscuous mode [ 1001.242410][ T7428] veth1_macvtap: entered promiscuous mode [ 1001.296878][ T7645] netlink: 'syz.0.8858': attribute type 3 has an invalid length. [ 1001.301224][ T7428] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1001.322033][ T7645] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8858'. [ 1001.336480][ T7428] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1001.386711][ T2739] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1001.420713][ T2739] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1001.442554][ T2739] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1001.452035][ T2739] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1001.624739][ T7652] vlan0: left promiscuous mode [ 1001.632031][ T7652] vlan0: entered allmulticast mode [ 1001.637165][ T7652] veth0_vlan: entered allmulticast mode [ 1001.660855][ T6419] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1001.691287][ T6419] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1001.748584][T25252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1001.774412][T25252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1001.776467][ T7663] sctp: [Deprecated]: syz.2.8862 (pid 7663) Use of int in max_burst socket option. [ 1001.776467][ T7663] Use struct sctp_assoc_value instead [ 1002.045086][ T7682] ipvlan3: entered promiscuous mode [ 1002.063212][ T7682] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 1002.081307][ T7682] bond0: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1002.132159][ T7687] xt_hashlimit: size too large, truncated to 1048576 [ 1002.159966][ T7679] sctp: [Deprecated]: syz.1.8800 (pid 7679) Use of int in max_burst socket option. [ 1002.159966][ T7679] Use struct sctp_assoc_value instead [ 1002.171333][ T7687] xt_hashlimit: invalid interval [ 1002.643316][ T7714] x_tables: duplicate entry at hook 2 [ 1002.695376][ T7699] sctp: [Deprecated]: syz.2.8870 (pid 7699) Use of int in max_burst socket option. [ 1002.695376][ T7699] Use struct sctp_assoc_value instead [ 1002.717343][ T7664] lo speed is unknown, defaulting to 1000 [ 1002.770411][ T7664] wg1 speed is unknown, defaulting to 1000 [ 1002.801752][ T51] Bluetooth: hci1: command tx timeout [ 1003.757487][ T7770] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1003.818466][ T7770] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1003.850330][ T7770] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1003.983526][ T7783] C: renamed from team_slave_0 [ 1003.997755][ T7783] __nla_validate_parse: 41 callbacks suppressed [ 1003.997771][ T7783] netlink: 164 bytes leftover after parsing attributes in process `syz.2.8893'. [ 1004.063440][ T7785] tipc: Enabled bearer , priority 0 [ 1004.096220][ T7785] syzkaller0: entered promiscuous mode [ 1004.131474][ T7785] syzkaller0: entered allmulticast mode [ 1004.137859][ T7788] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8895'. [ 1004.179276][ T7784] tipc: Resetting bearer [ 1004.275351][ T7784] tipc: Disabling bearer [ 1004.561471][ T7792] syzkaller0: entered promiscuous mode [ 1004.569890][ T7792] syzkaller0: entered allmulticast mode [ 1004.870951][ T51] Bluetooth: hci1: command tx timeout [ 1004.968310][ T7823] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8902'. [ 1005.001722][ T7821] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8901'. [ 1005.295416][ T7833] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8903'. [ 1006.707086][ T7830] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 1006.717243][ T7833] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8903'. [ 1006.749085][ T7833] tipc: Enabling of bearer rejected, failed to enable media [ 1006.951648][ T51] Bluetooth: hci1: command tx timeout [ 1007.024120][ T7860] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8909'. [ 1007.062114][ T7858] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8910'. [ 1007.072253][ T7858] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8910'. [ 1007.252342][ T7808] lo speed is unknown, defaulting to 1000 [ 1007.260143][ T7808] wg1 speed is unknown, defaulting to 1000 [ 1007.436924][ T7865] tipc: Enabling of bearer rejected, failed to enable media [ 1007.495782][ T7871] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8913'. [ 1007.590731][ T7871] bridge0: entered promiscuous mode [ 1007.684303][ T7878] syzkaller1: entered promiscuous mode [ 1007.705268][ T7878] syzkaller1: entered allmulticast mode [ 1007.929565][ T7887] validate_nla: 2 callbacks suppressed [ 1007.929582][ T7887] netlink: 'syz.1.8916': attribute type 1 has an invalid length. [ 1008.700228][ T7943] netlink: 'syz.4.8926': attribute type 1 has an invalid length. [ 1009.193996][ T7932] lo speed is unknown, defaulting to 1000 [ 1009.215079][ T7932] wg1 speed is unknown, defaulting to 1000 [ 1009.250342][ T7968] tipc: Enabling of bearer rejected, failed to enable media [ 1009.429561][ T7974] __nla_validate_parse: 4 callbacks suppressed [ 1009.429579][ T7974] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8936'. [ 1009.669653][ T7981] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1009.768909][ T7986] netlink: 'syz.1.8940': attribute type 13 has an invalid length. [ 1009.779645][ T7986] netlink: 'syz.1.8940': attribute type 17 has an invalid length. [ 1009.852586][ T7986] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1009.955070][ T7993] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8942'. [ 1009.975124][ T7993] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8942'. [ 1010.006931][ T7997] bond1: Unable to set up delay as MII monitoring is disabled [ 1010.035482][ T7997] bond1 (unregistering): Released all slaves [ 1010.082882][ T8004] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8943'. [ 1010.097491][ T8003] tap0: tun_chr_ioctl cmd 2148553947 [ 1010.345902][ T8021] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8948'. [ 1010.368700][ T8024] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8949'. [ 1010.541585][ T8031] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.8951'. [ 1010.831814][ T8049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8954'. [ 1010.873306][ T8018] lo speed is unknown, defaulting to 1000 [ 1010.887468][ T8018] wg1 speed is unknown, defaulting to 1000 [ 1011.393308][ T8079] openvswitch: netlink: IP tunnel dst address not specified [ 1011.859285][ T8112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8975'. [ 1011.877619][ T8112] netlink: 224 bytes leftover after parsing attributes in process `syz.2.8975'. [ 1012.283403][ T8125] syzkaller0: entered promiscuous mode [ 1012.288911][ T8125] syzkaller0: entered allmulticast mode [ 1013.972558][ T8148] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1013.982712][ T8148] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1013.992568][ T8148] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1014.394052][ T8190] bond0: option resend_igmp: invalid value (18446744073709551612) [ 1014.410021][ T8190] bond0: option resend_igmp: allowed values 0 - 255 [ 1014.446826][ T8190] bond0 (unregistering): Released all slaves [ 1014.674313][ T8201] __nla_validate_parse: 4 callbacks suppressed [ 1014.674333][ T8201] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8997'. [ 1014.704458][ T8203] netlink: 41 bytes leftover after parsing attributes in process `syz.4.8998'. [ 1014.718057][ T8201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8997'. [ 1014.758079][ T8204] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8998'. [ 1014.845193][ T8203] netlink: 116 bytes leftover after parsing attributes in process `syz.4.8998'. [ 1014.910644][ T8203] netlink: 41 bytes leftover after parsing attributes in process `syz.4.8998'. [ 1014.928037][ T8204] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8998'. [ 1014.991953][ T8204] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8998'. [ 1015.268008][ T8224] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9003'. [ 1015.327253][ T8226] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.9004'. [ 1015.337671][ T8226] netlink: Unknown conntrack attr (0) [ 1015.679011][ T8211] lo speed is unknown, defaulting to 1000 [ 1015.697475][ T8211] wg1 speed is unknown, defaulting to 1000 [ 1016.381639][ T8241] lo speed is unknown, defaulting to 1000 [ 1016.440774][ T8241] wg1 speed is unknown, defaulting to 1000 [ 1017.328251][ T8285] bond1: entered promiscuous mode [ 1017.333872][ T8285] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1017.363221][ T8285] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1017.370527][ T8285] IPv6: NLM_F_CREATE should be set when creating new route [ 1017.377738][ T8285] IPv6: NLM_F_CREATE should be set when creating new route [ 1017.394884][ T8290] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1017.403613][ T8290] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1017.415838][ T8285] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1017.425049][ T8290] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 1017.465175][ T8301] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1017.507697][ T8285] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1017.532587][ T8285] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 1018.883207][ T8354] netlink: 'syz.3.9040': attribute type 1 has an invalid length. [ 1018.933275][ T8356] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1018.960626][ T8354] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1019.035877][ T8363] bond0: (slave veth13): Enslaving as an active interface with a down link [ 1019.155190][ T8374] netlink: 'syz.2.9047': attribute type 6 has an invalid length. [ 1019.181934][ T8374] netlink: 'syz.2.9047': attribute type 6 has an invalid length. [ 1019.241017][ T8382] openvswitch: netlink: Multiple metadata blocks provided [ 1019.326033][ T8387] mac80211_hwsim hwsim84 syzkaller0: entered promiscuous mode [ 1019.339422][ T8387] mac80211_hwsim hwsim84 syzkaller0: entered allmulticast mode [ 1019.455085][ T8391] bridge0: port 3(batadv0) entered blocking state [ 1019.472818][ T8391] bridge0: port 3(batadv0) entered disabled state [ 1019.479446][ T8391] batadv0: entered allmulticast mode [ 1019.518845][ T8391] batadv0: entered promiscuous mode [ 1019.583418][ T8399] pim6reg0: tun_chr_ioctl cmd 1074025677 [ 1019.589219][ T8399] pim6reg0: linktype set to 773 [ 1019.761776][ T8406] __nla_validate_parse: 15 callbacks suppressed [ 1019.761795][ T8406] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9056'. [ 1019.920066][ T8396] lo speed is unknown, defaulting to 1000 [ 1019.935364][ T8396] wg1 speed is unknown, defaulting to 1000 [ 1019.962259][ T7282] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1019.972163][ T7282] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1019.990671][ T8410] netlink: 'syz.2.9058': attribute type 29 has an invalid length. [ 1020.273843][ T8423] mac80211_hwsim hwsim85 wlan1 (unregistering): left promiscuous mode [ 1020.353448][ T8389] lo speed is unknown, defaulting to 1000 [ 1020.361538][ T8389] wg1 speed is unknown, defaulting to 1000 [ 1021.184549][ T8471] blkio.reset_stats is deprecated [ 1021.317022][ T8473] x_tables: duplicate underflow at hook 1 [ 1021.622580][ T8454] lo speed is unknown, defaulting to 1000 [ 1021.639436][ T8454] wg1 speed is unknown, defaulting to 1000 [ 1021.648086][ T8497] netlink: 'syz.2.9080': attribute type 13 has an invalid length. [ 1021.664888][ T8497] netlink: 'syz.2.9080': attribute type 17 has an invalid length. [ 1021.701431][ T8498] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9081'. [ 1021.727471][ T8497] sit0: left promiscuous mode [ 1021.769099][ T8497] dummy0: left promiscuous mode [ 1021.775152][ T8497] dummy0: left allmulticast mode [ 1021.784647][ T8497] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1022.143145][ T8492] lo speed is unknown, defaulting to 1000 [ 1022.172443][ T8492] wg1 speed is unknown, defaulting to 1000 [ 1022.367288][ T8519] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1022.431532][ T8526] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9090'. [ 1022.467968][ T8526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9090'. [ 1022.565285][ T8534] netlink: 'syz.2.9091': attribute type 4 has an invalid length. [ 1022.664989][ T8526] workqueue: Failed to create a rescuer kthread for wq "bond18": -EINTR [ 1022.749472][ T8547] syzkaller0: entered promiscuous mode [ 1022.768528][ T8545] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9094'. [ 1022.793477][ T8547] syzkaller0: entered allmulticast mode [ 1022.806826][ T8545] x_tables: duplicate underflow at hook 3 [ 1022.815602][ T8545] netlink: 'syz.4.9094': attribute type 3 has an invalid length. [ 1022.883806][ T8552] netlink: 'syz.2.9097': attribute type 1 has an invalid length. [ 1023.105143][ T8552] 8021q: adding VLAN 0 to HW filter on device bond14 [ 1023.143109][ T8552] netlink: 240 bytes leftover after parsing attributes in process `syz.2.9097'. [ 1023.221239][ T8552] bond14: (slave bridge12): making interface the new active one [ 1023.242228][ T8552] bond14: (slave bridge12): Enslaving as an active interface with an up link [ 1023.342790][ T8584] mac80211_hwsim hwsim79 wlan0: Caught tx_queue_len zero misconfig [ 1023.362001][ T8566] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9100'. [ 1023.379255][ T8583] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9103'. [ 1023.407160][ T8586] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9104'. [ 1023.422587][ T8588] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9105'. [ 1023.543563][ T6419] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1023.570097][ T6419] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1023.593423][ T6419] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1023.626393][ T6419] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1024.185114][ T8619] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1024.442185][ T8648] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1024.586745][ T8638] tipc: Resetting bearer [ 1024.596070][ T8638] syzkaller0: left promiscuous mode [ 1024.601756][ T8638] syzkaller0: left allmulticast mode [ 1024.613613][ T8638] hsr0: left allmulticast mode [ 1024.620585][ T8638] hsr_slave_0: left allmulticast mode [ 1024.626092][ T8638] hsr_slave_1: left allmulticast mode [ 1024.632981][ T8638] macvlan2: left allmulticast mode [ 1024.639511][ T8638] vlan2: left promiscuous mode [ 1024.645656][ T8638] geneve1: left promiscuous mode [ 1024.650992][ T8638] vlan2: left allmulticast mode [ 1024.655896][ T8638] geneve1: left allmulticast mode [ 1024.691500][ T8638] bond4: left allmulticast mode [ 1024.699465][ T8638] ip6gretap2: left allmulticast mode [ 1024.705122][ T8638] bond4: left promiscuous mode [ 1024.710773][ T8638] ip6gretap2: left promiscuous mode [ 1024.716229][ T8638] macvlan3: left promiscuous mode [ 1024.722195][ T8638] macvlan3: left allmulticast mode [ 1024.736712][ T8638] vti0: left promiscuous mode [ 1024.749436][ T8638] gtp0: left promiscuous mode [ 1024.757781][ T8638] gtp0: left allmulticast mode [ 1024.780572][ T8638] ip6gretap3: left promiscuous mode [ 1024.810061][ T8638] veth9: left promiscuous mode [ 1024.824776][ T8638] mac80211_hwsim hwsim87 wlan1: left promiscuous mode [ 1024.832194][ T8638] macvtap1: left promiscuous mode [ 1024.842122][ T8638] geneve3: left promiscuous mode [ 1024.854980][ T8638] vcan1: left promiscuous mode [ 1024.864277][ T8638] bridge5: left promiscuous mode [ 1024.869226][ T8638] bridge5: left allmulticast mode [ 1024.882629][ T8638] veth11: left promiscuous mode [ 1024.897699][ T8638] bond10: left promiscuous mode [ 1024.908951][ T8638] bridge8: left promiscuous mode [ 1024.932118][ T8638] bridge9: left allmulticast mode [ 1024.955288][ T8638] gtp1: left promiscuous mode [ 1024.965377][ T8638] gtp1: left allmulticast mode [ 1024.979623][ T8638] geneve4: left promiscuous mode [ 1024.990050][ T8638] geneve4: left allmulticast mode [ 1025.056043][ T8619] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.086786][ T2739] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.098450][ T8653] __nla_validate_parse: 10 callbacks suppressed [ 1025.098469][ T8653] netlink: 332 bytes leftover after parsing attributes in process `syz.2.9122'. [ 1025.125856][ T8653] netlink: 'syz.2.9122': attribute type 9 has an invalid length. [ 1025.134451][ T8653] netlink: 'syz.2.9122': attribute type 10 has an invalid length. [ 1025.136076][ T2739] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.155486][ T2739] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.170620][ T2739] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.232410][ T8619] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.380999][ T8619] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.486767][ T8678] netlink: 'syz.3.9128': attribute type 1 has an invalid length. [ 1025.495315][ T8679] netlink: 'syz.3.9128': attribute type 1 has an invalid length. [ 1025.511202][ T8678] netlink: 'syz.3.9128': attribute type 2 has an invalid length. [ 1025.515447][ T8679] netlink: 'syz.3.9128': attribute type 2 has an invalid length. [ 1025.519078][ T8678] netlink: 'syz.3.9128': attribute type 1 has an invalid length. [ 1025.556200][ T8678] netlink: 'syz.3.9128': attribute type 3 has an invalid length. [ 1025.573889][ T8679] netlink: 'syz.3.9128': attribute type 1 has an invalid length. [ 1025.610483][ T8679] netlink: 'syz.3.9128': attribute type 3 has an invalid length. [ 1025.618698][ T8679] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9128'. [ 1025.622125][ T8678] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9128'. [ 1025.682758][ T2739] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.724616][ T2739] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.783404][ T2739] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.832491][ T7282] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1026.000151][ T8696] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9132'. [ 1026.022367][ T8696] 8021q: VLANs not supported on nlmon0 [ 1026.053035][ T8712] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9140'. [ 1026.654632][ T8731] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9143'. [ 1027.132355][ T8745] lo speed is unknown, defaulting to 1000 [ 1027.139052][ T8745] wg1 speed is unknown, defaulting to 1000 [ 1027.564898][ T8755] lo speed is unknown, defaulting to 1000 [ 1027.571803][ T8755] wg1 speed is unknown, defaulting to 1000 [ 1027.913172][ T8760] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 1027.932908][T30522] wg1 speed is unknown, defaulting to 1000 [ 1027.932943][ T24] lo speed is unknown, defaulting to 1000 [ 1027.938728][T30522] sy+: Port: 1 Link ACTIVE [ 1027.949523][ T24] syz2: Port: 1 Link ACTIVE [ 1028.014906][ T24] lo speed is unknown, defaulting to 1000 [ 1028.014924][T30522] wg1 speed is unknown, defaulting to 1000 [ 1028.014941][T30522] sy+: Port: 1 Link DOWN [ 1028.021311][ T2739] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1028.041352][ T24] syz2: Port: 1 Link DOWN [ 1028.045773][ T2739] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1028.055360][ T2739] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1028.064857][ T2739] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1028.251003][ T8766] team_slave_0: mtu less than device minimum [ 1028.986472][ T8704] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1029.163939][ T8778] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9154'. [ 1029.267465][ T8791] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9161'. [ 1029.296329][ T8793] netlink: 2 bytes leftover after parsing attributes in process `syz.1.9159'. [ 1029.371648][ T8793] sctp: [Deprecated]: syz.1.9159 (pid 8793) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1029.371648][ T8793] Use struct sctp_sack_info instead [ 1029.463310][ T8802] IPv6: NLM_F_CREATE should be specified when creating new route [ 1029.479584][ T8802] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1029.486872][ T8802] IPv6: NLM_F_CREATE should be set when creating new route [ 1029.494141][ T8802] IPv6: NLM_F_CREATE should be set when creating new route [ 1029.501377][ T8802] IPv6: NLM_F_CREATE should be set when creating new route [ 1029.782658][ T8820] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9169'. [ 1030.197803][ T8835] __nla_validate_parse: 1 callbacks suppressed [ 1030.197820][ T8835] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9174'. [ 1030.240701][ T8807] lo speed is unknown, defaulting to 1000 [ 1030.252125][ T8807] wg1 speed is unknown, defaulting to 1000 [ 1030.482800][ T8837] bond18: (slave bridge9): making interface the new active one [ 1030.506381][ T8837] bond18: (slave bridge9): Enslaving as an active interface with an up link [ 1030.573512][ T8835] bond18: (slave bridge10): Enslaving as an active interface with a down link [ 1030.591441][T18583] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1030.601595][T18583] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1030.610145][T18583] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1030.630136][T18583] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1030.632221][ T8841] macvlan3: entered promiscuous mode [ 1030.643879][ T8841] macvlan3: entered allmulticast mode [ 1030.649619][T18583] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1030.657744][ T8841] bond18: entered promiscuous mode [ 1030.663620][ T8841] bridge9: entered promiscuous mode [ 1030.670126][ T8841] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1030.678230][ T8841] bond18: (slave macvlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1030.717691][ T8841] bond18: left promiscuous mode [ 1030.723611][ T8841] bridge9: left promiscuous mode [ 1030.927946][T30051] bond0: (slave syz_tun): Releasing backup interface [ 1030.939362][ T8846] validate_nla: 4 callbacks suppressed [ 1030.939378][ T8846] netlink: 'syz.3.9177': attribute type 1 has an invalid length. [ 1031.590723][ T8858] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9181'. [ 1031.764324][ T8842] lo speed is unknown, defaulting to 1000 [ 1031.805477][ T8842] wg1 speed is unknown, defaulting to 1000 [ 1032.327201][ T8892] syzkaller0: entered promiscuous mode [ 1032.340193][ T8892] syzkaller0: entered allmulticast mode [ 1032.396174][ T8842] chnl_net:caif_netlink_parms(): no params data found [ 1032.555945][ T8887] lo speed is unknown, defaulting to 1000 [ 1032.594862][ T8887] wg1 speed is unknown, defaulting to 1000 [ 1032.710503][T18583] Bluetooth: hci2: command tx timeout [ 1032.808583][ T8842] bridge0: port 1(bridge_slave_0) entered blocking state [ 1032.826353][ T8842] bridge0: port 1(bridge_slave_0) entered disabled state [ 1032.846713][ T8842] bridge_slave_0: entered allmulticast mode [ 1032.858441][ T8842] bridge_slave_0: entered promiscuous mode [ 1032.891173][ T8911] mac80211_hwsim hwsim84 syzkaller0: left promiscuous mode [ 1032.898676][ T8911] mac80211_hwsim hwsim84 syzkaller0: left allmulticast mode [ 1032.906810][ T8842] bridge0: port 2(bridge_slave_1) entered blocking state [ 1032.915286][ T8842] bridge0: port 2(bridge_slave_1) entered disabled state [ 1032.925666][ T8842] bridge_slave_1: entered allmulticast mode [ 1032.936806][ T8842] bridge_slave_1: entered promiscuous mode [ 1033.201997][ T8842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1033.248548][ T8922] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1033.260208][ T8922] syzkaller1: linktype set to 778 [ 1033.278267][ T8842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1033.394077][ T8842] team0: Port device team_slave_0 added [ 1033.414412][ T8842] team0: Port device team_slave_1 added [ 1033.621593][ T8842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1033.628569][ T8842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1033.655642][ T8842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1033.688779][ T8842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1033.696382][ T8842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1033.728576][ T8842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1033.828293][ T8842] hsr_slave_0: entered promiscuous mode [ 1033.836054][ T8842] hsr_slave_1: entered promiscuous mode [ 1033.843793][ T8842] debugfs: 'hsr0' already exists in 'hsr' [ 1033.856364][ T8842] Cannot create hsr debugfs directory [ 1033.958846][ T8949] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9206'. [ 1034.033495][ T8954] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9207'. [ 1034.089270][ T8829] Set syz1 is full, maxelem 65536 reached [ 1034.152993][ T8842] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.226477][ T8965] Timeout policy `syz0' can only be used by L3 protocol number 35085 [ 1034.250368][ T8842] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.304000][ T8968] syzkaller0: entered promiscuous mode [ 1034.309626][ T8968] syzkaller0: entered allmulticast mode [ 1034.377383][ T8842] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.442251][ T8842] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.678194][ T8994] netlink: 71 bytes leftover after parsing attributes in process `syz.3.9220'. [ 1034.786629][ T8842] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1034.800041][T18583] Bluetooth: hci2: command tx timeout [ 1034.812203][ T8842] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1034.824127][ T8842] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1034.857304][ T8842] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1035.223572][ T9017] Cannot find map_set index 135 as target [ 1035.473900][ T8842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1035.591874][ T8842] 8021q: adding VLAN 0 to HW filter on device team0 [ 1035.625038][ T9028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9229'. [ 1035.634471][ T9025] syzkaller0: entered promiscuous mode [ 1035.643320][ T9025] syzkaller0: entered allmulticast mode [ 1035.666709][ T7282] bridge0: port 1(bridge_slave_0) entered blocking state [ 1035.673896][ T7282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1035.684549][ T9028] FAULT_INJECTION: forcing a failure. [ 1035.684549][ T9028] name failslab, interval 1, probability 0, space 0, times 0 [ 1035.698014][ T9028] CPU: 1 UID: 0 PID: 9028 Comm: syz.3.9229 Not tainted syzkaller #0 PREEMPT(full) [ 1035.698037][ T9028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1035.698048][ T9028] Call Trace: [ 1035.698055][ T9028] [ 1035.698063][ T9028] dump_stack_lvl+0xe8/0x150 [ 1035.698091][ T9028] should_fail_ex+0x412/0x560 [ 1035.698118][ T9028] should_failslab+0xa8/0x100 [ 1035.698138][ T9028] ? security_inode_alloc+0x39/0x310 [ 1035.698161][ T9028] kmem_cache_alloc_noprof+0x87/0x650 [ 1035.698191][ T9028] security_inode_alloc+0x39/0x310 [ 1035.698215][ T9028] inode_init_always_gfp+0x9ed/0xdc0 [ 1035.698243][ T9028] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 1035.698262][ T9028] alloc_inode+0x82/0x1b0 [ 1035.698286][ T9028] new_inode+0x22/0x170 [ 1035.698307][ T9028] __debugfs_create_file+0xb8/0x400 [ 1035.698330][ T9028] debugfs_create_file_full+0x3f/0x60 [ 1035.698351][ T9028] ref_tracker_dir_debugfs+0x197/0x360 [ 1035.698385][ T9028] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 1035.698431][ T9028] ? trace_kmalloc+0x1f/0xb0 [ 1035.698450][ T9028] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 1035.698471][ T9028] ? alloc_netdev_mqs+0xa6/0x11b0 [ 1035.698496][ T9028] ? __raw_spin_lock_init+0x45/0x100 [ 1035.698522][ T9028] alloc_netdev_mqs+0x272/0x11b0 [ 1035.698542][ T9028] ? __pfx_ipgre_tunnel_setup+0x10/0x10 [ 1035.698569][ T9028] rtnl_create_link+0x31f/0xd70 [ 1035.698597][ T9028] rtnl_newlink_create+0x277/0xb70 [ 1035.698622][ T9028] ? __mutex_lock+0x5ac/0x1300 [ 1035.698647][ T9028] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1035.698669][ T9028] ? __pfx___mutex_lock+0x10/0x10 [ 1035.698698][ T9028] ? ns_capable+0x89/0xe0 [ 1035.698720][ T9028] rtnl_newlink+0x1666/0x1be0 [ 1035.698753][ T9028] ? __pfx_rtnl_newlink+0x10/0x10 [ 1035.698769][ T9028] ? do_syscall_64+0x14d/0xf80 [ 1035.698786][ T9028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.698835][ T9028] ? kasan_quarantine_put+0xbb/0x1f0 [ 1035.698856][ T9028] ? lockdep_hardirqs_on+0x7a/0x110 [ 1035.698880][ T9028] ? nlmon_xmit+0xb0/0x100 [ 1035.698901][ T9028] ? kmem_cache_free+0x180/0x610 [ 1035.698932][ T9028] ? __lock_acquire+0x6b5/0x2cf0 [ 1035.698960][ T9028] ? __local_bh_enable_ip+0xd0/0x130 [ 1035.698979][ T9028] ? lockdep_hardirqs_on+0x7a/0x110 [ 1035.698996][ T9028] ? __dev_queue_xmit+0x274/0x3850 [ 1035.699016][ T9028] ? __local_bh_enable_ip+0xd0/0x130 [ 1035.699030][ T9028] ? __dev_queue_xmit+0x274/0x3850 [ 1035.699053][ T9028] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1035.699079][ T9028] ? __pfx_rtnl_newlink+0x10/0x10 [ 1035.699095][ T9028] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1035.699116][ T9028] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1035.699132][ T9028] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1035.699148][ T9028] ? ref_tracker_free+0x693/0x840 [ 1035.699168][ T9028] ? __copy_skb_header+0xa3/0x4a0 [ 1035.699189][ T9028] ? __pfx_ref_tracker_free+0x10/0x10 [ 1035.699222][ T9028] netlink_rcv_skb+0x232/0x4b0 [ 1035.699240][ T9028] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1035.699261][ T9028] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1035.699287][ T9028] ? netlink_deliver_tap+0x2e/0x1b0 [ 1035.699310][ T9028] netlink_unicast+0x80f/0x9b0 [ 1035.699340][ T9028] ? __pfx_netlink_unicast+0x10/0x10 [ 1035.699364][ T9028] ? netlink_sendmsg+0x650/0xb40 [ 1035.699390][ T9028] ? skb_put+0x11b/0x210 [ 1035.699411][ T9028] netlink_sendmsg+0x813/0xb40 [ 1035.699438][ T9028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1035.699459][ T9028] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1035.699484][ T9028] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1035.699507][ T9028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1035.699524][ T9028] ____sys_sendmsg+0xa68/0xad0 [ 1035.699545][ T9028] ? __might_fault+0xaf/0x130 [ 1035.699571][ T9028] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1035.699600][ T9028] ? import_iovec+0x73/0xa0 [ 1035.699621][ T9028] ___sys_sendmsg+0x2a5/0x360 [ 1035.699639][ T9028] ? __lock_acquire+0x6b5/0x2cf0 [ 1035.699663][ T9028] ? __pfx____sys_sendmsg+0x10/0x10 [ 1035.699687][ T9028] ? kstrtouint+0x6e/0xe0 [ 1035.699731][ T9028] ? __fget_files+0x2a/0x420 [ 1035.699747][ T9028] ? __fget_files+0x3a0/0x420 [ 1035.699772][ T9028] __sys_sendmmsg+0x27c/0x4e0 [ 1035.699796][ T9028] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1035.699814][ T9028] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1035.699861][ T9028] ? ksys_write+0x242/0x270 [ 1035.699883][ T9028] ? __pfx_ksys_write+0x10/0x10 [ 1035.699910][ T9028] __x64_sys_sendmmsg+0xa0/0xc0 [ 1035.699932][ T9028] do_syscall_64+0x14d/0xf80 [ 1035.699953][ T9028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.699969][ T9028] ? trace_irq_disable+0x37/0x100 [ 1035.699987][ T9028] ? clear_bhb_loop+0x40/0x90 [ 1035.700008][ T9028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.700025][ T9028] RIP: 0033:0x7f9a7139c629 [ 1035.700041][ T9028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1035.700055][ T9028] RSP: 002b:00007f9a72338028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1035.700074][ T9028] RAX: ffffffffffffffda RBX: 00007f9a71615fa0 RCX: 00007f9a7139c629 [ 1035.700087][ T9028] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1035.700100][ T9028] RBP: 00007f9a72338090 R08: 0000000000000000 R09: 0000000000000000 [ 1035.700111][ T9028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1035.700121][ T9028] R13: 00007f9a71616038 R14: 00007f9a71615fa0 R15: 00007fff2b712f08 [ 1035.700152][ T9028] [ 1036.214920][ T9028] debugfs: out of free dentries, can not create file 'netdev@ffff888033380620' [ 1036.225424][ T9026] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9227'. [ 1036.262335][ T7282] bridge0: port 2(bridge_slave_1) entered blocking state [ 1036.269499][ T7282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1036.527876][ T9050] mac80211_hwsim hwsim84 syzkaller0: entered promiscuous mode [ 1036.535888][ T9050] mac80211_hwsim hwsim84 syzkaller0: entered allmulticast mode [ 1036.596385][ T9050] tipc: Enabling of bearer rejected, failed to enable media [ 1036.692208][ T8842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1036.838563][ T9075] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9242'. [ 1036.870473][T18583] Bluetooth: hci2: command tx timeout [ 1036.979055][ T9083] syzkaller0: entered promiscuous mode [ 1036.990716][ T9083] syzkaller0: entered allmulticast mode [ 1037.016967][ T9083] tipc: Started in network mode [ 1037.030150][ T9083] tipc: Node identity b2588f9426d9, cluster identity 4711 [ 1037.037669][ T9083] tipc: Enabled bearer , priority 0 [ 1037.074403][ T9081] tipc: Resetting bearer [ 1037.132427][ T9081] tipc: Disabling bearer [ 1037.217403][ T8842] veth0_vlan: entered promiscuous mode [ 1037.235305][ T8842] veth1_vlan: entered promiscuous mode [ 1037.314596][ T8842] veth0_macvtap: entered promiscuous mode [ 1037.337265][ T8842] veth1_macvtap: entered promiscuous mode [ 1037.380677][ T8842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1037.421219][ T8842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1037.466239][ T2735] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.530646][ T2735] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.549441][ T2735] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.572837][ T2735] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.633936][ T9121] tipc: Enabled bearer , priority 0 [ 1037.806875][ T6419] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1037.827058][ T6419] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1037.887285][ T9132] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9257'. [ 1037.944784][ T9139] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9258'. [ 1037.949751][ T2739] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1037.966640][ T9139] tipc: Enabling of bearer rejected, already enabled [ 1037.976958][ T2739] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.162634][ T9157] netlink: 'syz.0.9261': attribute type 13 has an invalid length. [ 1038.230143][ T9152] delete_channel: no stack [ 1038.243156][ T9164] sctp: [Deprecated]: syz.4.9175 (pid 9164) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1038.243156][ T9164] Use struct sctp_sack_info instead [ 1038.332450][ T9164] sctp: [Deprecated]: syz.4.9175 (pid 9164) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1038.332450][ T9164] Use struct sctp_sack_info instead [ 1038.385366][ T9165] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9175'. [ 1038.396830][ T9164] IPVS: Error connecting to the multicast addr [ 1038.524289][ T9159] lo speed is unknown, defaulting to 1000 [ 1038.533525][ T9159] wg1 speed is unknown, defaulting to 1000 [ 1038.738926][ T9178] netlink: 'syz.1.9269': attribute type 2 has an invalid length. [ 1038.747749][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1038.788298][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1038.802949][ T9178] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9269'. [ 1038.817295][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1038.833146][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1038.851543][ T1769] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1038.880472][ T9185] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9271'. [ 1038.941220][ T9185] FAULT_INJECTION: forcing a failure. [ 1038.941220][ T9185] name failslab, interval 1, probability 0, space 0, times 0 [ 1038.954119][ T1769] Bluetooth: hci2: command tx timeout [ 1038.960154][ T9185] CPU: 1 UID: 0 PID: 9185 Comm: syz.0.9271 Not tainted syzkaller #0 PREEMPT(full) [ 1038.960178][ T9185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1038.960189][ T9185] Call Trace: [ 1038.960197][ T9185] [ 1038.960204][ T9185] dump_stack_lvl+0xe8/0x150 [ 1038.960232][ T9185] should_fail_ex+0x412/0x560 [ 1038.960259][ T9185] should_failslab+0xa8/0x100 [ 1038.960283][ T9185] __kvmalloc_node_noprof+0x178/0x8a0 [ 1038.960305][ T9185] ? alloc_netdev_mqs+0x8a6/0x11b0 [ 1038.960336][ T9185] alloc_netdev_mqs+0x8a6/0x11b0 [ 1038.960366][ T9185] rtnl_create_link+0x31f/0xd70 [ 1038.960394][ T9185] rtnl_newlink_create+0x277/0xb70 [ 1038.960415][ T9185] ? __pfx___nla_validate_parse+0x10/0x10 [ 1038.960442][ T9185] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1038.960463][ T9185] ? __pfx___mutex_lock+0x10/0x10 [ 1038.960492][ T9185] ? ns_capable+0x89/0xe0 [ 1038.960512][ T9185] rtnl_newlink+0x1666/0x1be0 [ 1038.960543][ T9185] ? __pfx_rtnl_newlink+0x10/0x10 [ 1038.960564][ T9185] ? __lock_acquire+0x6b5/0x2cf0 [ 1038.960588][ T9185] ? __lock_acquire+0x6b5/0x2cf0 [ 1038.960609][ T9185] ? __lock_acquire+0x6b5/0x2cf0 [ 1038.960637][ T9185] ? unwind_next_frame+0xa5/0x23c0 [ 1038.960665][ T9185] ? unwind_next_frame+0xa5/0x23c0 [ 1038.960686][ T9185] ? is_bpf_text_address+0x26/0x2b0 [ 1038.960715][ T9185] ? __lock_acquire+0x6b5/0x2cf0 [ 1038.960737][ T9185] ? is_bpf_text_address+0x292/0x2b0 [ 1038.960755][ T9185] ? is_bpf_text_address+0x26/0x2b0 [ 1038.960776][ T9185] ? kernel_text_address+0xa5/0xe0 [ 1038.960807][ T9185] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1038.960837][ T9185] ? __pfx_rtnl_newlink+0x10/0x10 [ 1038.960854][ T9185] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1038.960874][ T9185] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1038.960889][ T9185] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1038.960903][ T9185] ? __lock_acquire+0x6b5/0x2cf0 [ 1038.960923][ T9185] netlink_rcv_skb+0x232/0x4b0 [ 1038.960934][ T9185] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1038.960945][ T9185] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1038.960961][ T9185] ? netlink_deliver_tap+0x2e/0x1b0 [ 1038.960975][ T9185] netlink_unicast+0x80f/0x9b0 [ 1038.960995][ T9185] ? __pfx_netlink_unicast+0x10/0x10 [ 1038.961017][ T9185] ? netlink_sendmsg+0x650/0xb40 [ 1038.961026][ T9185] ? skb_put+0x11b/0x210 [ 1038.961039][ T9185] netlink_sendmsg+0x813/0xb40 [ 1038.961055][ T9185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1038.961067][ T9185] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1038.961082][ T9185] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1038.961097][ T9185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1038.961106][ T9185] ____sys_sendmsg+0xa68/0xad0 [ 1038.961120][ T9185] ? __might_fault+0xaf/0x130 [ 1038.961135][ T9185] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1038.961153][ T9185] ? import_iovec+0x73/0xa0 [ 1038.961165][ T9185] ___sys_sendmsg+0x2a5/0x360 [ 1038.961177][ T9185] ? __lock_acquire+0x6b5/0x2cf0 [ 1038.961189][ T9185] ? __pfx____sys_sendmsg+0x10/0x10 [ 1038.961205][ T9185] ? kstrtouint+0x6e/0xe0 [ 1038.961232][ T9185] ? __fget_files+0x2a/0x420 [ 1038.961242][ T9185] ? __fget_files+0x3a0/0x420 [ 1038.961257][ T9185] __sys_sendmmsg+0x27c/0x4e0 [ 1038.961272][ T9185] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1038.961284][ T9185] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1038.961311][ T9185] ? ksys_write+0x242/0x270 [ 1038.961324][ T9185] ? __pfx_ksys_write+0x10/0x10 [ 1038.961339][ T9185] __x64_sys_sendmmsg+0xa0/0xc0 [ 1038.961353][ T9185] do_syscall_64+0x14d/0xf80 [ 1038.961366][ T9185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.961376][ T9185] ? trace_irq_disable+0x37/0x100 [ 1038.961387][ T9185] ? clear_bhb_loop+0x40/0x90 [ 1038.961399][ T9185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1038.961408][ T9185] RIP: 0033:0x7fe0bb59c629 [ 1038.961419][ T9185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1038.961428][ T9185] RSP: 002b:00007fe0bc4c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1038.961439][ T9185] RAX: ffffffffffffffda RBX: 00007fe0bb815fa0 RCX: 00007fe0bb59c629 [ 1038.961446][ T9185] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1038.961453][ T9185] RBP: 00007fe0bc4c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1038.961459][ T9185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1038.961465][ T9185] R13: 00007fe0bb816038 R14: 00007fe0bb815fa0 R15: 00007ffea4bdec98 [ 1038.961481][ T9185] [ 1040.009175][ T9210] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1040.036830][ T9210] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9278'. [ 1040.236420][ T9175] lo speed is unknown, defaulting to 1000 [ 1040.243938][ T9175] wg1 speed is unknown, defaulting to 1000 [ 1040.389285][ T9222] syzkaller0: entered promiscuous mode [ 1040.396043][ T9222] syzkaller0: entered allmulticast mode [ 1040.619547][ T9227] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9283'. [ 1040.695074][ T9227] FAULT_INJECTION: forcing a failure. [ 1040.695074][ T9227] name failslab, interval 1, probability 0, space 0, times 0 [ 1040.724853][ T9227] CPU: 0 UID: 0 PID: 9227 Comm: syz.0.9283 Not tainted syzkaller #0 PREEMPT(full) [ 1040.724877][ T9227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1040.724887][ T9227] Call Trace: [ 1040.724894][ T9227] [ 1040.724902][ T9227] dump_stack_lvl+0xe8/0x150 [ 1040.724929][ T9227] should_fail_ex+0x412/0x560 [ 1040.724956][ T9227] should_failslab+0xa8/0x100 [ 1040.724980][ T9227] __kvmalloc_node_noprof+0x178/0x8a0 [ 1040.725002][ T9227] ? alloc_netdev_mqs+0x8a6/0x11b0 [ 1040.725036][ T9227] alloc_netdev_mqs+0x8a6/0x11b0 [ 1040.725065][ T9227] rtnl_create_link+0x31f/0xd70 [ 1040.725101][ T9227] rtnl_newlink_create+0x277/0xb70 [ 1040.725127][ T9227] ? __mutex_lock+0x5ac/0x1300 [ 1040.725154][ T9227] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1040.725178][ T9227] ? __pfx___mutex_lock+0x10/0x10 [ 1040.725210][ T9227] ? ns_capable+0x89/0xe0 [ 1040.725234][ T9227] rtnl_newlink+0x1666/0x1be0 [ 1040.725268][ T9227] ? __pfx_rtnl_newlink+0x10/0x10 [ 1040.725293][ T9227] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.725319][ T9227] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.725340][ T9227] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.725368][ T9227] ? unwind_next_frame+0xa5/0x23c0 [ 1040.725397][ T9227] ? unwind_next_frame+0xa5/0x23c0 [ 1040.725421][ T9227] ? is_bpf_text_address+0x26/0x2b0 [ 1040.725453][ T9227] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.725476][ T9227] ? is_bpf_text_address+0x292/0x2b0 [ 1040.725497][ T9227] ? is_bpf_text_address+0x26/0x2b0 [ 1040.725520][ T9227] ? kernel_text_address+0xa5/0xe0 [ 1040.725553][ T9227] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1040.725587][ T9227] ? __pfx_rtnl_newlink+0x10/0x10 [ 1040.725604][ T9227] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1040.725627][ T9227] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1040.725645][ T9227] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1040.725663][ T9227] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.725696][ T9227] netlink_rcv_skb+0x232/0x4b0 [ 1040.725715][ T9227] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1040.725736][ T9227] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1040.725765][ T9227] ? netlink_deliver_tap+0x2e/0x1b0 [ 1040.725791][ T9227] netlink_unicast+0x80f/0x9b0 [ 1040.725823][ T9227] ? __pfx_netlink_unicast+0x10/0x10 [ 1040.725849][ T9227] ? netlink_sendmsg+0x650/0xb40 [ 1040.725864][ T9227] ? skb_put+0x11b/0x210 [ 1040.725888][ T9227] netlink_sendmsg+0x813/0xb40 [ 1040.725916][ T9227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1040.725938][ T9227] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1040.725962][ T9227] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1040.725986][ T9227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1040.726002][ T9227] ____sys_sendmsg+0xa68/0xad0 [ 1040.726023][ T9227] ? __might_fault+0xaf/0x130 [ 1040.726050][ T9227] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1040.726086][ T9227] ? import_iovec+0x73/0xa0 [ 1040.726109][ T9227] ___sys_sendmsg+0x2a5/0x360 [ 1040.726128][ T9227] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.726151][ T9227] ? __pfx____sys_sendmsg+0x10/0x10 [ 1040.726178][ T9227] ? kstrtouint+0x6e/0xe0 [ 1040.726226][ T9227] ? __fget_files+0x2a/0x420 [ 1040.726243][ T9227] ? __fget_files+0x3a0/0x420 [ 1040.726271][ T9227] __sys_sendmmsg+0x27c/0x4e0 [ 1040.726298][ T9227] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1040.726317][ T9227] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1040.726364][ T9227] ? ksys_write+0x242/0x270 [ 1040.726387][ T9227] ? __pfx_ksys_write+0x10/0x10 [ 1040.726414][ T9227] __x64_sys_sendmmsg+0xa0/0xc0 [ 1040.726438][ T9227] do_syscall_64+0x14d/0xf80 [ 1040.726459][ T9227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.726476][ T9227] ? trace_irq_disable+0x37/0x100 [ 1040.726494][ T9227] ? clear_bhb_loop+0x40/0x90 [ 1040.726515][ T9227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.726532][ T9227] RIP: 0033:0x7fe0bb59c629 [ 1040.726548][ T9227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1040.726563][ T9227] RSP: 002b:00007fe0bc4c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1040.726583][ T9227] RAX: ffffffffffffffda RBX: 00007fe0bb815fa0 RCX: 00007fe0bb59c629 [ 1040.726596][ T9227] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1040.726609][ T9227] RBP: 00007fe0bc4c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1040.726620][ T9227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1040.726631][ T9227] R13: 00007fe0bb816038 R14: 00007fe0bb815fa0 R15: 00007ffea4bdec98 [ 1040.726662][ T9227] [ 1041.161738][ T1769] Bluetooth: hci0: command tx timeout [ 1041.323434][ T9204] lo speed is unknown, defaulting to 1000 [ 1041.383314][ T9204] wg1 speed is unknown, defaulting to 1000 [ 1041.561522][ T9175] chnl_net:caif_netlink_parms(): no params data found [ 1041.935399][ T9253] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9289'. [ 1042.051125][ T9257] netlink: 7 bytes leftover after parsing attributes in process `syz.0.9291'. [ 1042.077978][ T9175] bridge0: port 1(bridge_slave_0) entered blocking state [ 1042.087879][ T9175] bridge0: port 1(bridge_slave_0) entered disabled state [ 1042.121778][ T9175] bridge_slave_0: entered allmulticast mode [ 1042.151336][ T9175] bridge_slave_0: entered promiscuous mode [ 1042.264969][ T9175] bridge0: port 2(bridge_slave_1) entered blocking state [ 1042.272638][ T9175] bridge0: port 2(bridge_slave_1) entered disabled state [ 1042.280345][ T9175] bridge_slave_1: entered allmulticast mode [ 1042.287635][ T9175] bridge_slave_1: entered promiscuous mode [ 1042.371238][ T9260] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9292'. [ 1042.385360][ T9175] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1042.406844][ T9175] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1042.496799][ T9264] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9293'. [ 1042.523368][ T9175] team0: Port device team_slave_0 added [ 1042.543037][ T9175] team0: Port device team_slave_1 added [ 1042.618187][ T9264] syz_tun: left allmulticast mode [ 1042.628662][ T9267] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9294'. [ 1042.657077][ T9264] syz_tun: left promiscuous mode [ 1042.670143][ T9264] bridge0: port 2(syz_tun) entered disabled state [ 1042.708740][ T9264] bridge_slave_0: left allmulticast mode [ 1042.726076][ T9264] bridge_slave_0: left promiscuous mode [ 1042.741446][ T9264] bridge0: port 1(bridge_slave_0) entered disabled state [ 1042.768798][ T9276] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9297'. [ 1042.815838][ T9175] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1042.823517][ T9175] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1042.850581][ T9175] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1042.872071][ T9278] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9298'. [ 1042.900061][ T9281] x9: renamed from bridge_slave_0 (while UP) [ 1042.937328][ T9175] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1042.960105][ T9175] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1042.997357][ T9286] netlink: 'syz.3.9299': attribute type 1 has an invalid length. [ 1043.005797][ T9175] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1043.034819][ T9274] syzkaller0: entered allmulticast mode [ 1043.073694][ T9286] bond9: entered promiscuous mode [ 1043.079110][ T9286] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1043.105482][ T9290] bond9: (slave bridge11): making interface the new active one [ 1043.120277][ T9290] bridge11: entered promiscuous mode [ 1043.130489][ T9290] bond9: (slave bridge11): Enslaving as an active interface with an up link [ 1043.190859][ T1769] Bluetooth: hci0: command tx timeout [ 1043.226288][ T9286] bond9: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1043.239325][ T9286] bond9: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1043.289477][ T9175] hsr_slave_0: entered promiscuous mode [ 1043.296901][ T9175] hsr_slave_1: entered promiscuous mode [ 1043.315244][ T9300] netlink: 'syz.1.9302': attribute type 1 has an invalid length. [ 1043.336288][ T9175] debugfs: 'hsr0' already exists in 'hsr' [ 1043.354497][ T9175] Cannot create hsr debugfs directory [ 1043.377958][ T9301] netlink: 'syz.1.9302': attribute type 37 has an invalid length. [ 1043.494012][ T9300] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1043.717829][ T9288] lo speed is unknown, defaulting to 1000 [ 1043.742136][ T9288] wg1 speed is unknown, defaulting to 1000 [ 1043.854602][ T9312] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9307'. [ 1043.894262][ T9323] pim6reg1: entered promiscuous mode [ 1043.899592][ T9323] pim6reg1: entered allmulticast mode [ 1044.022295][ T9310] lo speed is unknown, defaulting to 1000 [ 1044.029033][ T9310] wg1 speed is unknown, defaulting to 1000 [ 1044.945422][ T9175] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1045.133461][ T9175] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1045.192994][ T9175] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1045.274810][ T1769] Bluetooth: hci0: command tx timeout [ 1045.421332][ T9376] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9323'. [ 1045.574282][ T9376] bond1: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 1045.635314][ T9376] bond1 (unregistering): Released all slaves [ 1045.642193][ T9383] netlink: 'syz.0.9325': attribute type 1 has an invalid length. [ 1045.681120][ T9175] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1045.792564][ T9394] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9327'. [ 1045.828052][ T9394] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 1045.892783][ T9394] ip6tnl0: Caught tx_queue_len zero misconfig [ 1045.907340][ T9175] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1045.943624][ T9396] pimreg: tun_chr_ioctl cmd 2147767506 [ 1046.046369][ T9175] 8021q: adding VLAN 0 to HW filter on device team0 [ 1046.061818][ T2737] bridge0: port 1(bridge_slave_0) entered blocking state [ 1046.068933][ T2737] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1046.084548][ T6419] bridge0: port 2(bridge_slave_1) entered blocking state [ 1046.091703][ T6419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1046.809496][ T9401] lo speed is unknown, defaulting to 1000 [ 1046.825067][ T9401] wg1 speed is unknown, defaulting to 1000 [ 1047.036575][ T9175] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1047.309002][ T9175] veth0_vlan: entered promiscuous mode [ 1047.330031][ T9175] veth1_vlan: entered promiscuous mode [ 1047.350768][ T1769] Bluetooth: hci0: command tx timeout [ 1047.417594][ T9175] veth0_macvtap: entered promiscuous mode [ 1047.439011][ T9445] IPVS: set_ctl: invalid protocol: 24 0.0.0.0:256 [ 1047.458532][ T9175] veth1_macvtap: entered promiscuous mode [ 1047.492765][ T9175] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1047.520781][ T9175] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1047.573996][ T2735] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.609885][ T2735] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.634771][ T9413] lo speed is unknown, defaulting to 1000 [ 1047.644731][ T2735] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.655858][ T2735] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.696270][ T9413] wg1 speed is unknown, defaulting to 1000 [ 1047.923669][ T2737] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1047.932379][ T2737] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1048.083905][ T6419] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1048.104813][ T6419] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1048.370291][ T9473] nftables ruleset with unbound set [ 1048.573289][ T9473] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1048.587863][ T9473] __nla_validate_parse: 1 callbacks suppressed [ 1048.587877][ T9473] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9344'. [ 1048.626105][T18583] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1048.636864][T18583] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1048.646808][T18583] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1048.655956][T18583] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1048.664082][T18583] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1049.296518][ T9502] netlink: 68 bytes leftover after parsing attributes in process `syz.4.9351'. [ 1049.347532][ T9487] lo speed is unknown, defaulting to 1000 [ 1049.371498][ T9487] wg1 speed is unknown, defaulting to 1000 [ 1049.534420][ T9507] vlan2: entered promiscuous mode [ 1049.539652][ T9507] bridge0: entered promiscuous mode [ 1049.562569][ T9507] vlan2: entered allmulticast mode [ 1049.567884][ T9507] bridge0: entered allmulticast mode [ 1049.618362][ T9492] lo speed is unknown, defaulting to 1000 [ 1049.678565][ T9492] wg1 speed is unknown, defaulting to 1000 [ 1049.843245][ T9523] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1049.936670][ T9514] lo speed is unknown, defaulting to 1000 [ 1049.936694][ T9523] syzkaller0: entered allmulticast mode [ 1049.955041][ T9514] wg1 speed is unknown, defaulting to 1000 [ 1050.029510][ T9528] syzkaller0: entered promiscuous mode [ 1050.039492][ T9528] syzkaller0 (unregistering): left allmulticast mode [ 1050.046741][ T9528] syzkaller0 (unregistering): left promiscuous mode [ 1050.290704][ T9533] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9361'. [ 1050.382349][ T9487] chnl_net:caif_netlink_parms(): no params data found [ 1050.568535][ T9546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9364'. [ 1050.584989][ T9546] FAULT_INJECTION: forcing a failure. [ 1050.584989][ T9546] name failslab, interval 1, probability 0, space 0, times 0 [ 1050.607829][ T9546] CPU: 1 UID: 0 PID: 9546 Comm: syz.4.9364 Not tainted syzkaller #0 PREEMPT(full) [ 1050.607854][ T9546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1050.607865][ T9546] Call Trace: [ 1050.607873][ T9546] [ 1050.607881][ T9546] dump_stack_lvl+0xe8/0x150 [ 1050.607905][ T9546] should_fail_ex+0x412/0x560 [ 1050.607928][ T9546] should_failslab+0xa8/0x100 [ 1050.607949][ T9546] __kmalloc_cache_noprof+0x88/0x660 [ 1050.607968][ T9546] ? register_netdevice+0x582/0x1cf0 [ 1050.607991][ T9546] register_netdevice+0x582/0x1cf0 [ 1050.608009][ T9546] ? rtnl_create_link+0x31f/0xd70 [ 1050.608027][ T9546] ? rtnl_newlink_create+0x277/0xb70 [ 1050.608045][ T9546] ? rtnl_newlink+0x1666/0x1be0 [ 1050.608062][ T9546] ? netlink_unicast+0x80f/0x9b0 [ 1050.608082][ T9546] ? ____sys_sendmsg+0xa68/0xad0 [ 1050.608109][ T9546] ? __pfx_register_netdevice+0x10/0x10 [ 1050.608126][ T9546] ? ip_tunnel_find+0x441/0x520 [ 1050.608148][ T9546] ? __pfx_ip_tunnel_find+0x10/0x10 [ 1050.608167][ T9546] ? net_generic+0x1e/0x240 [ 1050.608190][ T9546] ? ip_tunnel_newlink+0x237/0x8f0 [ 1050.608214][ T9546] ip_tunnel_newlink+0x261/0x8f0 [ 1050.608240][ T9546] ? __pfx_ip_tunnel_newlink+0x10/0x10 [ 1050.608262][ T9546] ? __asan_memset+0x22/0x50 [ 1050.608278][ T9546] ? ipgre_netlink_parms+0x666/0x9c0 [ 1050.608301][ T9546] ipgre_newlink+0x386/0x480 [ 1050.608322][ T9546] ? __pfx_ipgre_newlink+0x10/0x10 [ 1050.608352][ T9546] ? __pfx_ipgre_newlink+0x10/0x10 [ 1050.608376][ T9546] rtnl_newlink_create+0x329/0xb70 [ 1050.608400][ T9546] ? __mutex_lock+0x5ac/0x1300 [ 1050.608425][ T9546] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1050.608449][ T9546] ? __pfx___mutex_lock+0x10/0x10 [ 1050.608478][ T9546] ? ns_capable+0x89/0xe0 [ 1050.608495][ T9546] rtnl_newlink+0x1666/0x1be0 [ 1050.608514][ T9546] ? __pfx_rtnl_newlink+0x10/0x10 [ 1050.608523][ T9546] ? do_syscall_64+0x14d/0xf80 [ 1050.608535][ T9546] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.608564][ T9546] ? kasan_quarantine_put+0xbb/0x1f0 [ 1050.608576][ T9546] ? lockdep_hardirqs_on+0x7a/0x110 [ 1050.608591][ T9546] ? nlmon_xmit+0xb0/0x100 [ 1050.608605][ T9546] ? kmem_cache_free+0x180/0x610 [ 1050.608624][ T9546] ? __lock_acquire+0x6b5/0x2cf0 [ 1050.608640][ T9546] ? __local_bh_enable_ip+0xd0/0x130 [ 1050.608651][ T9546] ? lockdep_hardirqs_on+0x7a/0x110 [ 1050.608663][ T9546] ? __dev_queue_xmit+0x274/0x3850 [ 1050.608676][ T9546] ? __local_bh_enable_ip+0xd0/0x130 [ 1050.608686][ T9546] ? __dev_queue_xmit+0x274/0x3850 [ 1050.608709][ T9546] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1050.608728][ T9546] ? __pfx_rtnl_newlink+0x10/0x10 [ 1050.608738][ T9546] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1050.608756][ T9546] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1050.608766][ T9546] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1050.608775][ T9546] ? ref_tracker_free+0x693/0x840 [ 1050.608789][ T9546] ? __copy_skb_header+0xa3/0x4a0 [ 1050.608803][ T9546] ? __pfx_ref_tracker_free+0x10/0x10 [ 1050.608826][ T9546] netlink_rcv_skb+0x232/0x4b0 [ 1050.608837][ T9546] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1050.608848][ T9546] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1050.608864][ T9546] ? netlink_deliver_tap+0x2e/0x1b0 [ 1050.608878][ T9546] netlink_unicast+0x80f/0x9b0 [ 1050.608898][ T9546] ? __pfx_netlink_unicast+0x10/0x10 [ 1050.608913][ T9546] ? netlink_sendmsg+0x650/0xb40 [ 1050.608922][ T9546] ? skb_put+0x11b/0x210 [ 1050.608935][ T9546] netlink_sendmsg+0x813/0xb40 [ 1050.608950][ T9546] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1050.608962][ T9546] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1050.608977][ T9546] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1050.608994][ T9546] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1050.609004][ T9546] ____sys_sendmsg+0xa68/0xad0 [ 1050.609016][ T9546] ? __might_fault+0xaf/0x130 [ 1050.609032][ T9546] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1050.609049][ T9546] ? import_iovec+0x73/0xa0 [ 1050.609062][ T9546] ___sys_sendmsg+0x2a5/0x360 [ 1050.609073][ T9546] ? __lock_acquire+0x6b5/0x2cf0 [ 1050.609086][ T9546] ? __pfx____sys_sendmsg+0x10/0x10 [ 1050.609101][ T9546] ? kstrtouint+0x6e/0xe0 [ 1050.609129][ T9546] ? __fget_files+0x2a/0x420 [ 1050.609139][ T9546] ? __fget_files+0x3a0/0x420 [ 1050.609154][ T9546] __sys_sendmmsg+0x27c/0x4e0 [ 1050.609170][ T9546] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1050.609181][ T9546] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1050.609207][ T9546] ? ksys_write+0x242/0x270 [ 1050.609221][ T9546] ? __pfx_ksys_write+0x10/0x10 [ 1050.609236][ T9546] __x64_sys_sendmmsg+0xa0/0xc0 [ 1050.609250][ T9546] do_syscall_64+0x14d/0xf80 [ 1050.609263][ T9546] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.609272][ T9546] ? trace_irq_disable+0x37/0x100 [ 1050.609283][ T9546] ? clear_bhb_loop+0x40/0x90 [ 1050.609295][ T9546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.609304][ T9546] RIP: 0033:0x7f9a7fd9c629 [ 1050.609315][ T9546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1050.609323][ T9546] RSP: 002b:00007f9a80c71028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1050.609335][ T9546] RAX: ffffffffffffffda RBX: 00007f9a80015fa0 RCX: 00007f9a7fd9c629 [ 1050.609342][ T9546] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1050.609349][ T9546] RBP: 00007f9a80c71090 R08: 0000000000000000 R09: 0000000000000000 [ 1050.609355][ T9546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1050.609361][ T9546] R13: 00007f9a80016038 R14: 00007f9a80015fa0 R15: 00007fff45e931f8 [ 1050.609377][ T9546] [ 1051.142444][ T1769] Bluetooth: hci3: command tx timeout [ 1051.222406][ T9487] bridge0: port 1(bridge_slave_0) entered blocking state [ 1051.229560][ T9487] bridge0: port 1(bridge_slave_0) entered disabled state [ 1051.237301][ T9487] bridge_slave_0: entered allmulticast mode [ 1051.245650][ T9487] bridge_slave_0: entered promiscuous mode [ 1051.256772][ T9487] bridge0: port 2(bridge_slave_1) entered blocking state [ 1051.264883][ T9487] bridge0: port 2(bridge_slave_1) entered disabled state [ 1051.275336][ T9487] bridge_slave_1: entered allmulticast mode [ 1051.283128][ T9487] bridge_slave_1: entered promiscuous mode [ 1052.995809][ T9487] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1053.011271][ T9487] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1053.105398][ T9487] team0: Port device team_slave_0 added [ 1053.122910][ T9487] team0: Port device team_slave_1 added [ 1053.141705][ T9573] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9371'. [ 1053.154338][ T9576] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1053.171666][ T9487] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1053.178620][ T9487] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1053.219950][T18583] Bluetooth: hci3: command tx timeout [ 1053.232079][ T9487] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1053.246183][ T9487] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1053.253457][ T9487] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1053.280325][ T9487] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1053.339166][ T9487] hsr_slave_0: entered promiscuous mode [ 1053.346194][ T9487] hsr_slave_1: entered promiscuous mode [ 1053.353762][ T9487] debugfs: 'hsr0' already exists in 'hsr' [ 1053.359578][ T9487] Cannot create hsr debugfs directory [ 1053.611869][ T9573] lo: entered allmulticast mode [ 1053.617145][ T9573] lo: left allmulticast mode [ 1053.708027][ T9583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9374'. [ 1054.386758][ T9561] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1054.419609][ T9487] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1054.455894][ T9487] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1054.471941][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1054.504138][ T9487] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1054.524941][ T9487] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1054.747788][ T9487] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1054.784325][ T9487] 8021q: adding VLAN 0 to HW filter on device team0 [ 1054.807351][ T2735] bridge0: port 1(bridge_slave_0) entered blocking state [ 1054.814550][ T2735] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1054.861849][ T2735] bridge0: port 2(bridge_slave_1) entered blocking state [ 1054.869016][ T2735] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1054.912523][ T9625] netlink: 'syz.2.9383': attribute type 9 has an invalid length. [ 1054.953948][ T9630] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9384'. [ 1054.963479][ T9624] netlink: 84 bytes leftover after parsing attributes in process `syz.2.9383'. [ 1055.115056][ T9487] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1055.253552][ T9639] nlmon0: Caught tx_queue_len zero misconfig [ 1055.270775][T18583] Bluetooth: hci3: command tx timeout [ 1055.404011][ T9647] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9389'. [ 1055.431508][ T9487] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1055.502033][ T9657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9390'. [ 1055.507643][ T9653] bond1: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 1055.533343][ T9653] bond1 (unregistering): Released all slaves [ 1055.540973][ T9659] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9392'. [ 1055.576565][ T9659] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9392'. [ 1055.608170][ T9487] veth0_vlan: entered promiscuous mode [ 1055.636251][ T9659] netlink: 36 bytes leftover after parsing attributes in process `syz.1.9392'. [ 1055.668685][ T9487] veth1_vlan: entered promiscuous mode [ 1055.735145][ T9487] veth0_macvtap: entered promiscuous mode [ 1055.746200][ T9487] veth1_macvtap: entered promiscuous mode [ 1055.803581][ T9487] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1055.823755][ T9487] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1055.881448][ T9676] netlink: 'syz.1.9395': attribute type 21 has an invalid length. [ 1055.894204][ T2739] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1055.906040][ T9678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1055.907062][ T9680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9397'. [ 1055.927686][ T2739] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1055.930135][ T9676] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1055.964389][ T9680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9397'. [ 1055.981632][ T2737] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1055.994305][ T2737] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1056.134960][ T2737] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1056.154891][ T2737] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1056.278790][ T9694] netlink: 'syz.3.9400': attribute type 3 has an invalid length. [ 1056.329539][ T2739] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1056.339948][ T9694] netlink: 'syz.3.9400': attribute type 2 has an invalid length. [ 1056.347696][ T9694] netlink: 'syz.3.9400': attribute type 2 has an invalid length. [ 1056.358862][ T2739] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1056.748287][ T9704] netlink: 'syz.0.9402': attribute type 1 has an invalid length. [ 1056.838647][ T1769] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1056.854333][ T1769] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1056.862625][ T1769] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1056.871261][ T1769] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1056.880533][ T1769] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1057.020640][ T9712] netlink: 'syz.2.9404': attribute type 10 has an invalid length. [ 1057.051720][ T9712] team0: Device veth1_macvtap failed to register rx_handler [ 1057.233148][ T9705] lo speed is unknown, defaulting to 1000 [ 1057.252719][ T9705] wg1 speed is unknown, defaulting to 1000 [ 1057.261701][ T9715] FAULT_INJECTION: forcing a failure. [ 1057.261701][ T9715] name failslab, interval 1, probability 0, space 0, times 0 [ 1057.278830][ T9715] CPU: 0 UID: 0 PID: 9715 Comm: syz.0.9406 Not tainted syzkaller #0 PREEMPT(full) [ 1057.278854][ T9715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1057.278865][ T9715] Call Trace: [ 1057.278872][ T9715] [ 1057.278880][ T9715] dump_stack_lvl+0xe8/0x150 [ 1057.278908][ T9715] should_fail_ex+0x412/0x560 [ 1057.278936][ T9715] should_failslab+0xa8/0x100 [ 1057.278961][ T9715] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 1057.278984][ T9715] ? kobject_set_name_vargs+0x61/0x110 [ 1057.279013][ T9715] kstrdup+0x42/0x100 [ 1057.279037][ T9715] kobject_set_name_vargs+0x61/0x110 [ 1057.279069][ T9715] dev_set_name+0xe2/0x140 [ 1057.279098][ T9715] ? __pfx_dev_set_name+0x10/0x10 [ 1057.279128][ T9715] ? device_initialize+0x24b/0x440 [ 1057.279149][ T9715] netdev_register_kobject+0xb7/0x310 [ 1057.279177][ T9715] register_netdevice+0x12c0/0x1cf0 [ 1057.279197][ T9715] ? rtnl_create_link+0x31f/0xd70 [ 1057.279218][ T9715] ? rtnl_newlink_create+0x277/0xb70 [ 1057.279236][ T9715] ? rtnl_newlink+0x1666/0x1be0 [ 1057.279267][ T9715] ? __pfx_register_netdevice+0x10/0x10 [ 1057.279287][ T9715] ? ip_tunnel_find+0x441/0x520 [ 1057.279311][ T9715] ? __pfx_ip_tunnel_find+0x10/0x10 [ 1057.279333][ T9715] ? net_generic+0x1e/0x240 [ 1057.279352][ T9715] ? ip_tunnel_newlink+0x237/0x8f0 [ 1057.279378][ T9715] ip_tunnel_newlink+0x261/0x8f0 [ 1057.279406][ T9715] ? __pfx_ip_tunnel_newlink+0x10/0x10 [ 1057.279428][ T9715] ? __asan_memset+0x22/0x50 [ 1057.279448][ T9715] ? ipgre_netlink_parms+0x666/0x9c0 [ 1057.279473][ T9715] ipgre_newlink+0x386/0x480 [ 1057.279494][ T9715] ? __pfx_ipgre_newlink+0x10/0x10 [ 1057.279528][ T9715] ? __pfx_ipgre_newlink+0x10/0x10 [ 1057.279548][ T9715] rtnl_newlink_create+0x329/0xb70 [ 1057.279569][ T9715] ? __pfx___nla_validate_parse+0x10/0x10 [ 1057.279597][ T9715] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1057.279620][ T9715] ? __pfx___mutex_lock+0x10/0x10 [ 1057.279653][ T9715] ? ns_capable+0x89/0xe0 [ 1057.279678][ T9715] rtnl_newlink+0x1666/0x1be0 [ 1057.279708][ T9715] ? __pfx_rtnl_newlink+0x10/0x10 [ 1057.279724][ T9715] ? do_syscall_64+0x14d/0xf80 [ 1057.279743][ T9715] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.279797][ T9715] ? kasan_quarantine_put+0xbb/0x1f0 [ 1057.279817][ T9715] ? lockdep_hardirqs_on+0x7a/0x110 [ 1057.279841][ T9715] ? nlmon_xmit+0xb0/0x100 [ 1057.279862][ T9715] ? kmem_cache_free+0x180/0x610 [ 1057.279895][ T9715] ? __lock_acquire+0x6b5/0x2cf0 [ 1057.279924][ T9715] ? __local_bh_enable_ip+0xd0/0x130 [ 1057.279943][ T9715] ? lockdep_hardirqs_on+0x7a/0x110 [ 1057.279962][ T9715] ? __dev_queue_xmit+0x274/0x3850 [ 1057.279982][ T9715] ? __local_bh_enable_ip+0xd0/0x130 [ 1057.279999][ T9715] ? __dev_queue_xmit+0x274/0x3850 [ 1057.280027][ T9715] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1057.280065][ T9715] ? __pfx_rtnl_newlink+0x10/0x10 [ 1057.280083][ T9715] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1057.280106][ T9715] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1057.280124][ T9715] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1057.280140][ T9715] ? ref_tracker_free+0x693/0x840 [ 1057.280162][ T9715] ? __copy_skb_header+0xa3/0x4a0 [ 1057.280184][ T9715] ? __pfx_ref_tracker_free+0x10/0x10 [ 1057.280218][ T9715] netlink_rcv_skb+0x232/0x4b0 [ 1057.280235][ T9715] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1057.280259][ T9715] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1057.280289][ T9715] ? netlink_deliver_tap+0x2e/0x1b0 [ 1057.280315][ T9715] netlink_unicast+0x80f/0x9b0 [ 1057.280347][ T9715] ? __pfx_netlink_unicast+0x10/0x10 [ 1057.280372][ T9715] ? netlink_sendmsg+0x650/0xb40 [ 1057.280388][ T9715] ? skb_put+0x11b/0x210 [ 1057.280410][ T9715] netlink_sendmsg+0x813/0xb40 [ 1057.280438][ T9715] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1057.280460][ T9715] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1057.280484][ T9715] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1057.280508][ T9715] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1057.280523][ T9715] ____sys_sendmsg+0xa68/0xad0 [ 1057.280543][ T9715] ? __might_fault+0xaf/0x130 [ 1057.280566][ T9715] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1057.280593][ T9715] ? import_iovec+0x73/0xa0 [ 1057.280615][ T9715] ___sys_sendmsg+0x2a5/0x360 [ 1057.280634][ T9715] ? __lock_acquire+0x6b5/0x2cf0 [ 1057.280656][ T9715] ? __pfx____sys_sendmsg+0x10/0x10 [ 1057.280682][ T9715] ? kstrtouint+0x6e/0xe0 [ 1057.280731][ T9715] ? __fget_files+0x2a/0x420 [ 1057.280748][ T9715] ? __fget_files+0x3a0/0x420 [ 1057.280775][ T9715] __sys_sendmmsg+0x27c/0x4e0 [ 1057.280802][ T9715] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1057.280820][ T9715] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1057.280869][ T9715] ? ksys_write+0x242/0x270 [ 1057.280891][ T9715] ? __pfx_ksys_write+0x10/0x10 [ 1057.280919][ T9715] __x64_sys_sendmmsg+0xa0/0xc0 [ 1057.280942][ T9715] do_syscall_64+0x14d/0xf80 [ 1057.280962][ T9715] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.280978][ T9715] ? trace_irq_disable+0x37/0x100 [ 1057.280996][ T9715] ? clear_bhb_loop+0x40/0x90 [ 1057.281018][ T9715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.281035][ T9715] RIP: 0033:0x7f74f619c629 [ 1057.281058][ T9715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1057.281073][ T9715] RSP: 002b:00007f74f70c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1057.281092][ T9715] RAX: ffffffffffffffda RBX: 00007f74f6415fa0 RCX: 00007f74f619c629 [ 1057.281105][ T9715] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1057.281118][ T9715] RBP: 00007f74f70c3090 R08: 0000000000000000 R09: 0000000000000000 [ 1057.281129][ T9715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1057.281140][ T9715] R13: 00007f74f6416038 R14: 00007f74f6415fa0 R15: 00007ffddd9d4838 [ 1057.281171][ T9715] [ 1057.834013][ T1769] Bluetooth: hci3: command tx timeout [ 1058.054135][ T9727] netlink: 'syz.1.9409': attribute type 2 has an invalid length. [ 1058.262106][ T9705] chnl_net:caif_netlink_parms(): no params data found [ 1058.373328][ T9705] bridge0: port 1(bridge_slave_0) entered blocking state [ 1058.381154][ T9705] bridge0: port 1(bridge_slave_0) entered disabled state [ 1058.388627][ T9705] bridge_slave_0: entered allmulticast mode [ 1058.396289][ T9705] bridge_slave_0: entered promiscuous mode [ 1058.405073][ T9705] bridge0: port 2(bridge_slave_1) entered blocking state [ 1058.412763][ T9705] bridge0: port 2(bridge_slave_1) entered disabled state [ 1058.420954][ T9705] bridge_slave_1: entered allmulticast mode [ 1058.428762][ T9705] bridge_slave_1: entered promiscuous mode [ 1058.478639][ T9705] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1058.515179][ T9705] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1058.580604][ T9705] team0: Port device team_slave_0 added [ 1058.591511][ T9705] team0: Port device team_slave_1 added [ 1058.630554][ T9705] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1058.637701][ T9705] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1058.665115][ T9705] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1058.686011][ T9705] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1058.693861][ T9705] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1058.721346][ T9705] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1058.784851][ T9705] hsr_slave_0: entered promiscuous mode [ 1058.792925][ T9705] hsr_slave_1: entered promiscuous mode [ 1058.809439][ T9705] debugfs: 'hsr0' already exists in 'hsr' [ 1058.817243][ T9705] Cannot create hsr debugfs directory [ 1058.951449][ T1769] Bluetooth: hci5: command tx timeout [ 1058.991814][ T9705] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1059.003120][ T9705] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1059.023074][ T9756] __nla_validate_parse: 4 callbacks suppressed [ 1059.023092][ T9756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9416'. [ 1059.063185][ T9705] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1059.073060][ T9705] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1059.121622][ T9758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9417'. [ 1059.143596][ T9705] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1059.154673][ T9705] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1059.205383][ T9705] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1059.215250][ T9705] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1059.353806][ T9767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9421'. [ 1059.400347][ T9767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9421'. [ 1059.414319][ T9767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9421'. [ 1059.431314][ T9705] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1059.456941][ T9768] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1059.476827][ T9775] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9422'. [ 1059.484217][ T9768] bond1: (slave lo): Enslaving as an active interface with an up link [ 1059.495012][ T9775] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9422'. [ 1059.497181][ T9768] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1059.522446][ T9705] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1059.536944][ T9705] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1059.563091][ T9705] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1059.747501][ T9705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1059.776161][ T9705] 8021q: adding VLAN 0 to HW filter on device team0 [ 1059.797484][ T2739] bridge0: port 1(bridge_slave_0) entered blocking state [ 1059.804622][ T2739] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1059.824940][ T9797] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9427'. [ 1059.836820][ T2739] bridge0: port 2(bridge_slave_1) entered blocking state [ 1059.844001][ T2739] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1059.854891][ T9797] FAULT_INJECTION: forcing a failure. [ 1059.854891][ T9797] name failslab, interval 1, probability 0, space 0, times 0 [ 1059.869644][ T9797] CPU: 0 UID: 0 PID: 9797 Comm: syz.0.9427 Not tainted syzkaller #0 PREEMPT(full) [ 1059.869663][ T9797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1059.869673][ T9797] Call Trace: [ 1059.869680][ T9797] [ 1059.869688][ T9797] dump_stack_lvl+0xe8/0x150 [ 1059.869715][ T9797] should_fail_ex+0x412/0x560 [ 1059.869757][ T9797] should_failslab+0xa8/0x100 [ 1059.869782][ T9797] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 1059.869805][ T9797] ? kobject_set_name_vargs+0x61/0x110 [ 1059.869834][ T9797] kstrdup+0x42/0x100 [ 1059.869859][ T9797] kobject_set_name_vargs+0x61/0x110 [ 1059.869885][ T9797] dev_set_name+0xe2/0x140 [ 1059.869913][ T9797] ? __pfx_dev_set_name+0x10/0x10 [ 1059.869943][ T9797] ? device_initialize+0x24b/0x440 [ 1059.869965][ T9797] netdev_register_kobject+0xb7/0x310 [ 1059.869993][ T9797] register_netdevice+0x12c0/0x1cf0 [ 1059.870014][ T9797] ? rtnl_create_link+0x31f/0xd70 [ 1059.870034][ T9797] ? rtnl_newlink_create+0x277/0xb70 [ 1059.870053][ T9797] ? rtnl_newlink+0x1666/0x1be0 [ 1059.870090][ T9797] ? __pfx_register_netdevice+0x10/0x10 [ 1059.870110][ T9797] ? ip_tunnel_find+0x441/0x520 [ 1059.870134][ T9797] ? __pfx_ip_tunnel_find+0x10/0x10 [ 1059.870156][ T9797] ? net_generic+0x1e/0x240 [ 1059.870174][ T9797] ? ip_tunnel_newlink+0x237/0x8f0 [ 1059.870202][ T9797] ip_tunnel_newlink+0x261/0x8f0 [ 1059.870230][ T9797] ? __pfx_ip_tunnel_newlink+0x10/0x10 [ 1059.870249][ T9797] ? __asan_memset+0x22/0x50 [ 1059.870267][ T9797] ? ipgre_netlink_parms+0x666/0x9c0 [ 1059.870289][ T9797] ipgre_newlink+0x386/0x480 [ 1059.870310][ T9797] ? __pfx_ipgre_newlink+0x10/0x10 [ 1059.870342][ T9797] ? __pfx_ipgre_newlink+0x10/0x10 [ 1059.870362][ T9797] rtnl_newlink_create+0x329/0xb70 [ 1059.870386][ T9797] ? __mutex_lock+0x5ac/0x1300 [ 1059.870413][ T9797] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1059.870436][ T9797] ? __pfx___mutex_lock+0x10/0x10 [ 1059.870466][ T9797] ? ns_capable+0x89/0xe0 [ 1059.870487][ T9797] rtnl_newlink+0x1666/0x1be0 [ 1059.870520][ T9797] ? __pfx_rtnl_newlink+0x10/0x10 [ 1059.870536][ T9797] ? do_syscall_64+0x14d/0xf80 [ 1059.870555][ T9797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.870603][ T9797] ? kasan_quarantine_put+0xbb/0x1f0 [ 1059.870622][ T9797] ? lockdep_hardirqs_on+0x7a/0x110 [ 1059.870645][ T9797] ? nlmon_xmit+0xb0/0x100 [ 1059.870661][ T9797] ? kmem_cache_free+0x180/0x610 [ 1059.870681][ T9797] ? __lock_acquire+0x6b5/0x2cf0 [ 1059.870697][ T9797] ? __local_bh_enable_ip+0xd0/0x130 [ 1059.870708][ T9797] ? lockdep_hardirqs_on+0x7a/0x110 [ 1059.870720][ T9797] ? __dev_queue_xmit+0x274/0x3850 [ 1059.870733][ T9797] ? __local_bh_enable_ip+0xd0/0x130 [ 1059.870743][ T9797] ? __dev_queue_xmit+0x274/0x3850 [ 1059.870759][ T9797] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1059.870777][ T9797] ? __pfx_rtnl_newlink+0x10/0x10 [ 1059.870787][ T9797] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1059.870800][ T9797] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1059.870810][ T9797] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1059.870819][ T9797] ? ref_tracker_free+0x693/0x840 [ 1059.870834][ T9797] ? __copy_skb_header+0xa3/0x4a0 [ 1059.870849][ T9797] ? __pfx_ref_tracker_free+0x10/0x10 [ 1059.870869][ T9797] netlink_rcv_skb+0x232/0x4b0 [ 1059.870880][ T9797] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1059.870891][ T9797] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1059.870907][ T9797] ? netlink_deliver_tap+0x2e/0x1b0 [ 1059.870921][ T9797] netlink_unicast+0x80f/0x9b0 [ 1059.870940][ T9797] ? __pfx_netlink_unicast+0x10/0x10 [ 1059.870955][ T9797] ? netlink_sendmsg+0x650/0xb40 [ 1059.870964][ T9797] ? skb_put+0x11b/0x210 [ 1059.870977][ T9797] netlink_sendmsg+0x813/0xb40 [ 1059.870992][ T9797] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1059.871004][ T9797] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1059.871020][ T9797] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1059.871034][ T9797] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1059.871044][ T9797] ____sys_sendmsg+0xa68/0xad0 [ 1059.871056][ T9797] ? __might_fault+0xaf/0x130 [ 1059.871071][ T9797] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1059.871094][ T9797] ? import_iovec+0x73/0xa0 [ 1059.871106][ T9797] ___sys_sendmsg+0x2a5/0x360 [ 1059.871118][ T9797] ? __lock_acquire+0x6b5/0x2cf0 [ 1059.871130][ T9797] ? __pfx____sys_sendmsg+0x10/0x10 [ 1059.871145][ T9797] ? kstrtouint+0x6e/0xe0 [ 1059.871172][ T9797] ? __fget_files+0x2a/0x420 [ 1059.871182][ T9797] ? __fget_files+0x3a0/0x420 [ 1059.871197][ T9797] __sys_sendmmsg+0x27c/0x4e0 [ 1059.871213][ T9797] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1059.871224][ T9797] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1059.871250][ T9797] ? ksys_write+0x242/0x270 [ 1059.871264][ T9797] ? __pfx_ksys_write+0x10/0x10 [ 1059.871279][ T9797] __x64_sys_sendmmsg+0xa0/0xc0 [ 1059.871293][ T9797] do_syscall_64+0x14d/0xf80 [ 1059.871306][ T9797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.871315][ T9797] ? clear_bhb_loop+0x40/0x90 [ 1059.871327][ T9797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.871337][ T9797] RIP: 0033:0x7f74f619c629 [ 1059.871347][ T9797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1059.871356][ T9797] RSP: 002b:00007f74f70c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1059.871368][ T9797] RAX: ffffffffffffffda RBX: 00007f74f6415fa0 RCX: 00007f74f619c629 [ 1059.871375][ T9797] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 1059.871382][ T9797] RBP: 00007f74f70c3090 R08: 0000000000000000 R09: 0000000000000000 [ 1059.871388][ T9797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1059.871394][ T9797] R13: 00007f74f6416038 R14: 00007f74f6415fa0 R15: 00007ffddd9d4838 [ 1059.871410][ T9797] [ 1060.467834][ T9705] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1060.480769][ T9705] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1060.645816][ T9809] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9429'. [ 1060.811059][ T9815] syzkaller1: entered promiscuous mode [ 1060.817177][ T9813] delete_channel: no stack [ 1060.823301][ T9815] syzkaller1: entered allmulticast mode [ 1060.945638][ T9705] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1061.030805][ T1769] Bluetooth: hci5: command tx timeout [ 1061.082718][ T9705] veth0_vlan: entered promiscuous mode [ 1061.088791][ T9808] lo speed is unknown, defaulting to 1000 [ 1061.097180][ T9705] veth1_vlan: entered promiscuous mode [ 1061.123543][ T9808] wg1 speed is unknown, defaulting to 1000 [ 1061.148218][ T9705] veth0_macvtap: entered promiscuous mode [ 1061.188966][ T9705] veth1_macvtap: entered promiscuous mode [ 1061.239336][ T9705] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1061.263082][ T9705] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1061.293395][ T2739] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.302543][ T2739] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.546446][ T2739] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.590911][ T2739] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1061.692443][ T9838] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9437'. [ 1061.954886][ T7282] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1061.955753][ T9819] lo speed is unknown, defaulting to 1000 [ 1061.971042][ T7282] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1062.050308][ T9819] wg1 speed is unknown, defaulting to 1000 [ 1062.335182][ T7282] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1062.344137][ T7282] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1062.446200][ T9855] bond3: option min_links: invalid value (18446744073709551612) [ 1062.454364][ T9855] bond3: option min_links: allowed values 0 - 2147483647 [ 1062.492417][ T9855] bond3 (unregistering): Released all slaves [ 1062.665276][ T9866] netlink: 'syz.4.9445': attribute type 1 has an invalid length. [ 1062.899537][ T9876] netlink: 'syz.2.9447': attribute type 5 has an invalid length. [ 1062.908772][ T9876] netlink: 'syz.2.9447': attribute type 5 has an invalid length. [ 1063.009595][ T9876] netlink: 'syz.2.9447': attribute type 9 has an invalid length. [ 1063.041760][ T9876] netlink: 'syz.2.9447': attribute type 11 has an invalid length. [ 1063.059940][ T9876] netlink: 'syz.2.9447': attribute type 12 has an invalid length. [ 1063.111095][ T1769] Bluetooth: hci5: command tx timeout [ 1063.128845][ T9882] pim6reg1: entered promiscuous mode [ 1063.135002][ T9882] pim6reg1: entered allmulticast mode [ 1063.176247][ T9880] netlink: 'syz.3.9448': attribute type 13 has an invalid length. [ 1063.426220][ T9883] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1063.624720][ T9892] netlink: 'syz.2.9452': attribute type 1 has an invalid length. [ 1063.693738][ T9894] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1063.972278][ T9883] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1064.205372][ T9883] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1064.300465][ T9882] lo speed is unknown, defaulting to 1000 [ 1064.307878][ T9882] wg1 speed is unknown, defaulting to 1000 [ 1064.475187][ T9883] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1064.852877][ T9915] lo speed is unknown, defaulting to 1000 [ 1064.868486][ T9915] wg1 speed is unknown, defaulting to 1000 [ 1065.017946][ T2739] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.189990][ T1769] Bluetooth: hci5: command tx timeout [ 1065.239574][ T7282] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.252393][ T7282] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.354778][ T7282] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.498899][ T9934] __nla_validate_parse: 11 callbacks suppressed [ 1065.498918][ T9934] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9461'. [ 1065.963399][ T9948] x_tables: duplicate underflow at hook 1 [ 1065.971800][ T9948] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9465'. [ 1065.981025][ T9948] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9465'. [ 1066.877109][ T9961] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9469'. [ 1066.923879][ T9963] syzkaller0: entered promiscuous mode [ 1066.929424][ T9963] syzkaller0: entered allmulticast mode [ 1067.024911][ T9966] netlink: 'syz.1.9471': attribute type 1 has an invalid length. [ 1067.047485][ T9966] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1067.085285][ T9910] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1067.269548][ T9969] syzkaller1: entered promiscuous mode [ 1067.278759][ T9969] syzkaller1: entered allmulticast mode [ 1067.378265][ T9983] tipc: Started in network mode [ 1067.383339][ T9983] tipc: Node identity d63942fbe2e8, cluster identity 4711 [ 1067.409964][ T9983] tipc: Enabled bearer , priority 0 [ 1067.432920][ T9990] syzkaller0: entered promiscuous mode [ 1067.438759][ T9990] syzkaller0: entered allmulticast mode [ 1067.453658][ T9986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1067.503184][ T9986] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1067.628114][ T9999] netlink: 'syz.1.9480': attribute type 11 has an invalid length. [ 1067.634830][ T9990] tipc: Resetting bearer [ 1067.815629][T10000] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9479'. [ 1067.846626][ T9980] tipc: Resetting bearer [ 1067.898448][ T9980] tipc: Disabling bearer [ 1068.026228][T10000] bond1: Invalid ad_actor_system MAC address. [ 1068.033827][T10000] bond1: option ad_actor_system: invalid value (7) [ 1068.077338][T10000] bond1 (unregistering): Released all slaves [ 1068.112326][T10012] "syz.2.9483" (10012) uses obsolete ecb(arc4) skcipher [ 1068.342482][ T9993] lo speed is unknown, defaulting to 1000 [ 1068.349118][T10035] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9489'. [ 1068.362042][ T9993] wg1 speed is unknown, defaulting to 1000 [ 1068.378614][T10035] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9489'. [ 1068.612234][T10060] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9492'. [ 1069.458330][T10100] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9508'. [ 1069.500807][T10100] netlink: 52 bytes leftover after parsing attributes in process `syz.2.9508'. [ 1069.526684][T10113] team0 (unregistering): Port device team_slave_0 removed [ 1069.530513][T10117] netlink: 'syz.4.9513': attribute type 10 has an invalid length. [ 1069.558291][T10119] netlink: 'syz.2.9508': attribute type 1 has an invalid length. [ 1069.571468][T10113] team0 (unregistering): Port device team_slave_1 removed [ 1069.623747][T10117] team0: Port device dummy0 added [ 1069.811714][T10119] bond1: entered promiscuous mode [ 1069.852754][T10119] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1070.023833][T10108] lo speed is unknown, defaulting to 1000 [ 1070.052123][T10108] wg1 speed is unknown, defaulting to 1000 [ 1070.059208][T10152] netlink: 'syz.3.9521': attribute type 4 has an invalid length. [ 1070.268062][T10167] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1071.115192][T10184] __nla_validate_parse: 2 callbacks suppressed [ 1071.115212][T10184] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9530'. [ 1071.187595][T10184] netlink: 23 bytes leftover after parsing attributes in process `syz.3.9530'. [ 1071.442181][T10195] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9531'. [ 1071.511892][T10198] netlink: 'syz.1.9534': attribute type 1 has an invalid length. [ 1071.972505][T10191] lo speed is unknown, defaulting to 1000 [ 1071.980469][T10191] wg1 speed is unknown, defaulting to 1000 [ 1072.021624][T10216] pimreg: entered allmulticast mode [ 1072.115523][T10218] netlink: 27 bytes leftover after parsing attributes in process `syz.1.9540'. [ 1072.178338][T10226] netlink: 90 bytes leftover after parsing attributes in process `syz.0.9543'. [ 1072.189629][T10222] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9541'. [ 1072.365925][T10232] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9545'. [ 1072.427659][T10232] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9545'. [ 1072.884576][T10262] syzkaller0: entered promiscuous mode [ 1072.890374][T10262] syzkaller0: entered allmulticast mode [ 1074.612880][T10248] lo speed is unknown, defaulting to 1000 [ 1074.620979][T10248] wg1 speed is unknown, defaulting to 1000 [ 1075.206406][T10312] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1075.213684][T10312] IPv6: NLM_F_CREATE should be set when creating new route [ 1075.691704][T10318] netlink: 36 bytes leftover after parsing attributes in process `syz.1.9563'. [ 1075.742885][T10256] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1075.770385][T10307] netlink: 504 bytes leftover after parsing attributes in process `syz.3.9559'. [ 1075.948737][T10324] netlink: 'syz.0.9565': attribute type 3 has an invalid length. [ 1075.958203][T10323] netlink: 'syz.0.9565': attribute type 3 has an invalid length. [ 1076.126378][T10337] netlink: 'syz.1.9569': attribute type 1 has an invalid length. [ 1076.170719][T10339] IPVS: Unknown mcast interface: pim6reg0 [ 1076.211919][T10346] __nla_validate_parse: 2 callbacks suppressed [ 1076.211937][T10346] netlink: 180 bytes leftover after parsing attributes in process `syz.0.9572'. [ 1076.237715][T10346] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9572'. [ 1076.272953][T10337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9569'. [ 1076.331153][T10346] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9572'. [ 1076.383735][T10351] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9572'. [ 1076.750408][T10367] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9578'. [ 1076.988185][T10376] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1077.036663][T10376] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1077.377893][T10399] delete_channel: no stack [ 1077.695883][T10371] lo speed is unknown, defaulting to 1000 [ 1077.758093][T10427] sctp: [Deprecated]: syz.3.9594 (pid 10427) Use of int in max_burst socket option. [ 1077.758093][T10427] Use struct sctp_assoc_value instead [ 1077.803857][T10371] wg1 speed is unknown, defaulting to 1000 [ 1078.248154][T10450] netlink: 'syz.2.9601': attribute type 1 has an invalid length. [ 1078.376330][T10454] macvlan2: entered promiscuous mode [ 1078.382233][T10454] macvlan2: entered allmulticast mode [ 1078.389604][T10457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9602'. [ 1078.401537][T10451] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1078.542791][T10465] netlink: 64 bytes leftover after parsing attributes in process `syz.3.9600'. [ 1079.161312][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9606'. [ 1079.201654][T10486] ip6tnl1: entered allmulticast mode [ 1079.208746][T10486] netlink: 220 bytes leftover after parsing attributes in process `syz.4.9606'. [ 1079.238068][T10455] lo speed is unknown, defaulting to 1000 [ 1079.246322][T10455] wg1 speed is unknown, defaulting to 1000 [ 1079.290429][T10492] bond0: (slave gre0): Error: Device type is different from other slaves [ 1079.505098][T10503] netlink: 'syz.3.9613': attribute type 15 has an invalid length. [ 1079.743737][T10513] netlink: 'syz.4.9616': attribute type 3 has an invalid length. [ 1079.774459][T10513] netlink: 'syz.4.9616': attribute type 3 has an invalid length. [ 1079.848608][T10513] 8021q: VLANs not supported on caif0 [ 1080.004998][T10534] geneve2: entered promiscuous mode [ 1080.107082][T10535] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.208240][T10541] mac80211_hwsim hwsim114 wlan1: entered promiscuous mode [ 1080.219969][T10541] macvtap1: entered promiscuous mode [ 1080.255964][T10506] lo speed is unknown, defaulting to 1000 [ 1080.322638][T10535] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.372252][T10506] wg1 speed is unknown, defaulting to 1000 [ 1080.504891][T10564] netlink: 'syz.3.9627': attribute type 2 has an invalid length. [ 1080.523444][T10535] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.611150][T10564] !9: entered promiscuous mode [ 1080.706634][T10535] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.924739][ T6419] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.016556][ T7282] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.120513][ T7282] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.139318][ T7282] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.276415][T10585] netlink: 'syz.4.9634': attribute type 13 has an invalid length. [ 1081.291039][T10585] __nla_validate_parse: 35 callbacks suppressed [ 1081.291056][T10585] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9634'. [ 1081.297317][T10590] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9635'. [ 1081.297348][T10590] openvswitch: netlink: Unknown nsh attribute 0 [ 1081.407865][T10592] tipc: Enabled bearer , priority 0 [ 1081.416702][T10600] sctp: [Deprecated]: syz.3.9639 (pid 10600) Use of int in maxseg socket option. [ 1081.416702][T10600] Use struct sctp_assoc_value instead [ 1081.434788][T10592] syzkaller0: entered promiscuous mode [ 1081.440400][T10592] syzkaller0: entered allmulticast mode [ 1081.487951][T10592] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9636'. [ 1081.512853][T10592] tipc: Resetting bearer [ 1081.538131][T10606] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9640'. [ 1081.548273][T10606] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9640'. [ 1081.561702][T10591] tipc: Resetting bearer [ 1081.562049][T10606] netlink: 'syz.1.9640': attribute type 15 has an invalid length. [ 1081.650663][T10591] tipc: Disabling bearer [ 1081.679989][T10604] tc_dump_action: action bad kind [ 1081.694914][T10616] 8021q: VLANs not supported on ip_vti0 [ 1081.720895][T10617] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9643'. [ 1081.752241][T10617] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9643'. [ 1081.808933][ T6431] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.824966][ T6431] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.872074][ T6431] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.889246][ T6431] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1082.161630][T10636] IPv6: addrconf: prefix option has invalid lifetime [ 1082.179148][T10633] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1082.354619][T10647] netlink: 64 bytes leftover after parsing attributes in process `syz.0.9649'. [ 1082.387841][T10644] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9648'. [ 1082.425354][T10631] netlink: 148 bytes leftover after parsing attributes in process `syz.3.9646'. [ 1082.491112][T10631] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1082.557308][T10622] lo speed is unknown, defaulting to 1000 [ 1082.637899][T10622] wg1 speed is unknown, defaulting to 1000 [ 1083.169159][T10679] bridge0: port 2(bridge_slave_1) entered disabled state [ 1083.176870][T10679] bridge0: port 1(bridge_slave_0) entered disabled state [ 1083.385587][T10679] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1083.627087][ T69] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.646395][ T69] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.674328][ T69] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.705346][ T69] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1084.065626][T10701] lo speed is unknown, defaulting to 1000 [ 1084.094997][T10701] wg1 speed is unknown, defaulting to 1000 [ 1084.148421][ T29] audit: type=1804 audit(1771500418.524:19): pid=10719 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.9670" name="/newroot/82/cgroup.controllers" dev="tmpfs" ino=438 res=1 errno=0 [ 1084.273537][ T29] audit: type=1800 audit(1771500418.524:20): pid=10719 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.9670" name="cgroup.controllers" dev="tmpfs" ino=438 res=0 errno=0 [ 1084.362339][T10705] lo speed is unknown, defaulting to 1000 [ 1084.371876][T10705] wg1 speed is unknown, defaulting to 1000 [ 1084.614372][T10739] netlink: 'syz.2.9675': attribute type 8 has an invalid length. [ 1084.736711][T10739] bond0: entered promiscuous mode [ 1084.741831][T10739] bond_slave_0: entered promiscuous mode [ 1084.747647][T10739] bond_slave_1: entered promiscuous mode [ 1084.755906][T10739] gretap0: entered promiscuous mode [ 1084.762619][T10739] ip6gretap0: entered promiscuous mode [ 1084.769153][T10739] debugfs: 'hsr1' already exists in 'hsr' [ 1084.775581][T10739] Cannot create hsr debugfs directory [ 1084.783332][T10739] hsr1: entered promiscuous mode [ 1084.961086][T10755] netlink: 'syz.4.9680': attribute type 3 has an invalid length. [ 1084.970394][T10754] netlink: 'syz.0.9678': attribute type 1 has an invalid length. [ 1084.993241][T10754] netlink: 'syz.0.9678': attribute type 3 has an invalid length. [ 1085.027540][T10754] NCSI netlink: No device for ifindex 813332851 [ 1085.282584][T10769] netlink: 'syz.4.9682': attribute type 1 has an invalid length. [ 1085.287733][T10764] IPv6: sit1: Disabled Multicast RS [ 1085.308161][T10769] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1085.458176][T10779] ICMPv6: NA: aa:aa:aa:aa:aa:00 advertised our address fe80::aa on syz_tun! [ 1085.465144][T10777] syzkaller0: entered promiscuous mode [ 1085.480925][T10777] syzkaller0: entered allmulticast mode [ 1085.664469][ T6419] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.684527][ T6419] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.714426][ T6419] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.756514][ T6419] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.802375][T10794] syzkaller0: entered promiscuous mode [ 1085.807872][T10794] syzkaller0: entered allmulticast mode [ 1086.156049][T10807] tipc: Enabling of bearer rejected, failed to enable media [ 1086.226850][T10820] tipc: Started in network mode [ 1086.245470][T10820] tipc: Node identity 0000000000002e000000000000000001, cluster identity 4711 [ 1086.351575][T10820] tipc: Enabling of bearer rejected, failed to enable media [ 1086.365080][T10807] veth0_virt_wif_: renamed from dummy0 [ 1086.381725][T10835] netlink: 'syz.4.9701': attribute type 1 has an invalid length. [ 1086.402627][T10840] netlink: 'syz.4.9701': attribute type 1 has an invalid length. [ 1086.516644][T10797] lo speed is unknown, defaulting to 1000 [ 1086.523027][T10838] syzkaller0: entered promiscuous mode [ 1086.528624][T10838] syzkaller0: entered allmulticast mode [ 1086.560380][T10797] wg1 speed is unknown, defaulting to 1000 [ 1087.169429][T10875] __nla_validate_parse: 12 callbacks suppressed [ 1087.169450][T10875] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9708'. [ 1087.207806][T10875] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9708'. [ 1087.622037][T10888] netlink: 'syz.3.9709': attribute type 2 has an invalid length. [ 1087.844234][T10896] netlink: 1 bytes leftover after parsing attributes in process `syz.1.9710'. [ 1088.046818][T10906] netlink: 'syz.4.9712': attribute type 10 has an invalid length. [ 1088.073624][T10906] netlink: 228 bytes leftover after parsing attributes in process `syz.4.9712'. [ 1088.831020][T10963] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9723'. [ 1088.862536][T10964] netlink: 'syz.0.9724': attribute type 1 has an invalid length. [ 1088.957083][T10964] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1088.968890][T10964] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 1088.990993][T10970] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9724'. [ 1089.019551][T10947] lo speed is unknown, defaulting to 1000 [ 1089.068977][T10970] bond2: (slave bridge1): Enslaving as an active interface with a down link [ 1089.079261][T10947] wg1 speed is unknown, defaulting to 1000 [ 1089.127654][T10964] bond2: (slave bridge2): Enslaving as an active interface with a down link [ 1089.154493][T10970] macvlan2: entered promiscuous mode [ 1089.160097][T10970] macvlan2: entered allmulticast mode [ 1089.166519][T10970] bond2: entered promiscuous mode [ 1089.174645][T10970] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1089.182922][T10970] bond2: left promiscuous mode [ 1089.964564][T11010] netlink: 'syz.3.9735': attribute type 1 has an invalid length. [ 1090.274801][T11034] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1090.324789][T11038] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1090.418694][T11022] lo speed is unknown, defaulting to 1000 [ 1090.427033][T11022] wg1 speed is unknown, defaulting to 1000 [ 1090.545259][T11052] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9744'. [ 1090.567678][T11052] netlink: 39 bytes leftover after parsing attributes in process `syz.2.9744'. [ 1090.724391][T11065] xt_policy: output policy not valid in PREROUTING and INPUT [ 1091.168089][T11090] netlink: 6 bytes leftover after parsing attributes in process `syz.4.9754'. [ 1091.202543][T11090] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1091.348512][T11099] netlink: 128 bytes leftover after parsing attributes in process `syz.2.9757'. [ 1091.806738][T11132] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1091.926101][T11137] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1091.946152][T11132] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1092.174519][T11154] __nla_validate_parse: 5 callbacks suppressed [ 1092.174537][T11154] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.9772'. [ 1092.359022][T11152] lo speed is unknown, defaulting to 1000 [ 1092.367563][T11152] wg1 speed is unknown, defaulting to 1000 [ 1092.402595][T11173] tipc: Started in network mode [ 1092.407593][T11173] tipc: Node identity f659992f3332, cluster identity 4711 [ 1092.415336][T11173] tipc: Enabled bearer , priority 0 [ 1092.429269][T11173] syzkaller0: entered promiscuous mode [ 1092.435020][T11173] syzkaller0: entered allmulticast mode [ 1092.455970][T11173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9775'. [ 1092.479379][T11173] netlink: 7 bytes leftover after parsing attributes in process `syz.2.9775'. [ 1092.534983][T11173] tipc: Resetting bearer [ 1092.568969][T11172] tipc: Resetting bearer [ 1092.641646][T11172] tipc: Disabling bearer [ 1092.734001][T11190] Bluetooth: MGMT ver 1.23 [ 1092.819373][T11194] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1092.983456][T11202] netlink: 160 bytes leftover after parsing attributes in process `syz.2.9786'. [ 1093.024443][T11202] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1093.096997][T11205] netlink: 'syz.4.9787': attribute type 1 has an invalid length. [ 1093.448918][T11223] netlink: 'syz.0.9791': attribute type 1 has an invalid length. [ 1093.648167][T11225] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1093.663527][T11225] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 1093.715221][T11234] bridge0: port 2(bridge_slave_1) entered disabled state [ 1093.723799][T11234] bridge0: port 1(bridge_slave_0) entered disabled state [ 1093.801531][T11226] syzkaller0: entered promiscuous mode [ 1093.814792][T11226] syzkaller0: entered allmulticast mode [ 1093.845227][T11223] bond3: (slave bridge3): Enslaving as an active interface with a down link [ 1096.386964][T11269] vlan3: entered promiscuous mode [ 1096.397106][T11269] hsr0: entered promiscuous mode [ 1096.428806][T11262] netlink: 'syz.2.9799': attribute type 9 has an invalid length. [ 1096.441569][T11273] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9804'. [ 1096.521632][T11275] netlink: 'syz.3.9805': attribute type 1 has an invalid length. [ 1096.544239][T11275] team_slave_1: Caught tx_queue_len zero misconfig [ 1096.667484][T11280] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9807'. [ 1096.682196][T11283] netlink: 'syz.2.9810': attribute type 13 has an invalid length. [ 1096.814182][T11283] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1096.825143][T11283] syzkaller0: entered promiscuous mode [ 1096.831358][T11283] syzkaller0: entered allmulticast mode [ 1096.857381][T11302] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9814'. [ 1097.206850][T11326] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9821'. [ 1097.217856][T11326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9821'. [ 1097.230041][T11326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9821'. [ 1097.260521][T11326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9821'. [ 1097.283061][T11323] netlink: 'syz.2.9819': attribute type 1 has an invalid length. [ 1097.293309][T11323] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9819'. [ 1097.304858][T11326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9821'. [ 1097.314401][T11326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9821'. [ 1097.429458][T11307] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1098.163434][T11381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9835'. [ 1098.524497][T11400] netlink: 'syz.1.9842': attribute type 4 has an invalid length. [ 1098.532544][T11400] netlink: 17 bytes leftover after parsing attributes in process `syz.1.9842'. [ 1098.579540][T11411] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9844'. [ 1098.632640][T11418] IPv6: addrconf: prefix option has invalid lifetime [ 1098.675984][T11419] IPv6: addrconf: prefix option has invalid lifetime [ 1098.990361][T11430] xt_hashlimit: size too large, truncated to 1048576 [ 1099.029244][ C0] Unknown status report in ack skb [ 1099.038560][T11434] netlink: 'syz.1.9852': attribute type 1 has an invalid length. [ 1099.051061][T11435] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.068209][T11435] bridge_slave_0 (unregistering): left allmulticast mode [ 1099.107045][T11435] bridge_slave_0 (unregistering): left promiscuous mode [ 1099.130171][T11435] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.241860][T11445] tunl0: Caught tx_queue_len zero misconfig [ 1099.482042][T11461] openvswitch: netlink: Key type 61 is out of range max 32 [ 1099.692702][T11476] syzkaller0: entered promiscuous mode [ 1099.708404][T11476] syzkaller0: entered allmulticast mode [ 1099.715897][T11479] bridge_slave_1: left allmulticast mode [ 1099.730234][T11479] bridge_slave_1: left promiscuous mode [ 1099.746411][T11479] bridge0: port 2(bridge_slave_1) entered disabled state [ 1099.794152][T11479] bridge_slave_0: left allmulticast mode [ 1099.810421][T11479] bridge_slave_0: left promiscuous mode [ 1099.821520][T11479] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.927057][T11489] netlink: 'syz.2.9865': attribute type 13 has an invalid length. [ 1100.086688][T11473] lec:lec_atm_close: lec0: Shut down! [ 1100.372902][T11496] lo speed is unknown, defaulting to 1000 [ 1100.380958][T11496] wg1 speed is unknown, defaulting to 1000 [ 1100.946774][T11528] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1100.967448][T11538] macvlan2: entered allmulticast mode [ 1101.270418][T11562] netlink: 'syz.4.9878': attribute type 1 has an invalid length. [ 1101.439325][T11565] geneve3: entered promiscuous mode [ 1101.596103][T11522] lo speed is unknown, defaulting to 1000 [ 1101.658042][T11522] wg1 speed is unknown, defaulting to 1000 [ 1101.970276][T30522] lec:lec_start_xmit: lec0:No lecd attached [ 1102.269310][T11597] __nla_validate_parse: 13 callbacks suppressed [ 1102.269328][T11597] netlink: 244 bytes leftover after parsing attributes in process `syz.4.9886'. [ 1102.685745][T11613] Bluetooth: MGMT ver 1.23 [ 1102.708587][T11614] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1103.107975][T11634] netlink: 'syz.4.9892': attribute type 3 has an invalid length. [ 1103.116857][T11634] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9892'. [ 1103.234470][T11574] lo speed is unknown, defaulting to 1000 [ 1103.284868][T11645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9895'. [ 1103.315084][T11574] wg1 speed is unknown, defaulting to 1000 [ 1103.924444][T11638] sysfs: cannot create duplicate filename '/class/ieee80211/π,xb)% ]3DL̥!!b.>' [ 1103.940160][T11638] CPU: 0 UID: 0 PID: 11638 Comm: syz.2.9893 Not tainted syzkaller #0 PREEMPT(full) [ 1103.940207][T11638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1103.940228][T11638] Call Trace: [ 1103.940236][T11638] [ 1103.940246][T11638] dump_stack_lvl+0xe8/0x150 [ 1103.940277][T11638] sysfs_warn_dup+0x8e/0xa0 [ 1103.940301][T11638] sysfs_do_create_link_sd+0xc0/0x110 [ 1103.940328][T11638] device_add_class_symlinks+0x1cf/0x240 [ 1103.940355][T11638] device_add+0x475/0xb70 [ 1103.940380][T11638] wiphy_register+0x1d73/0x2d50 [ 1103.940408][T11638] ? __pfx_wiphy_register+0x10/0x10 [ 1103.940420][T11638] ? __pfx_netdev_run_todo+0x10/0x10 [ 1103.940436][T11638] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 1103.940455][T11638] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 1103.940473][T11638] ieee80211_register_hw+0x3571/0x4220 [ 1103.940488][T11638] ? __lock_acquire+0x6b5/0x2cf0 [ 1103.940507][T11638] ? ieee80211_register_hw+0x13e1/0x4220 [ 1103.940527][T11638] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 1103.940550][T11638] ? __hrtimer_setup+0x181/0x200 [ 1103.940562][T11638] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 1103.940576][T11638] mac80211_hwsim_new_radio+0x2f97/0x5330 [ 1103.940604][T11638] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 1103.940614][T11638] ? kstrndup+0xbf/0x160 [ 1103.940630][T11638] hwsim_new_radio_nl+0xf35/0x1bd0 [ 1103.940653][T11638] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 1103.940673][T11638] ? rcu_is_watching+0x15/0xb0 [ 1103.940688][T11638] ? __nla_parse+0x40/0x60 [ 1103.940700][T11638] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 1103.940719][T11638] genl_family_rcv_msg_doit+0x22a/0x330 [ 1103.940736][T11638] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1103.940756][T11638] ? bpf_lsm_capable+0x9/0x20 [ 1103.940767][T11638] ? security_capable+0x7e/0x2c0 [ 1103.940784][T11638] genl_rcv_msg+0x61c/0x7a0 [ 1103.940801][T11638] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1103.940813][T11638] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 1103.940832][T11638] netlink_rcv_skb+0x232/0x4b0 [ 1103.940843][T11638] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1103.940857][T11638] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1103.940866][T11638] ? genl_rcv+0x19/0x40 [ 1103.940889][T11638] ? down_read+0x272/0x2e0 [ 1103.940902][T11638] ? genl_rcv+0xd/0x40 [ 1103.940915][T11638] genl_rcv+0x28/0x40 [ 1103.940926][T11638] netlink_unicast+0x80f/0x9b0 [ 1103.940946][T11638] ? __pfx_netlink_unicast+0x10/0x10 [ 1103.940961][T11638] ? netlink_sendmsg+0x650/0xb40 [ 1103.940973][T11638] ? skb_put+0x11b/0x210 [ 1103.940987][T11638] netlink_sendmsg+0x813/0xb40 [ 1103.941003][T11638] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1103.941015][T11638] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1103.941031][T11638] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1103.941046][T11638] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1103.941056][T11638] ____sys_sendmsg+0xa68/0xad0 [ 1103.941068][T11638] ? __might_fault+0xaf/0x130 [ 1103.941084][T11638] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1103.941102][T11638] ? import_iovec+0x73/0xa0 [ 1103.941115][T11638] ___sys_sendmsg+0x2a5/0x360 [ 1103.941127][T11638] ? __lock_acquire+0x6b5/0x2cf0 [ 1103.941140][T11638] ? __pfx____sys_sendmsg+0x10/0x10 [ 1103.941157][T11638] ? futex_wait+0x29a/0x380 [ 1103.941184][T11638] ? __fget_files+0x2a/0x420 [ 1103.941194][T11638] ? __fget_files+0x3a0/0x420 [ 1103.941210][T11638] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1103.941233][T11638] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1103.941252][T11638] ? rcu_is_watching+0x15/0xb0 [ 1103.941270][T11638] do_syscall_64+0x14d/0xf80 [ 1103.941285][T11638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1103.941295][T11638] ? trace_irq_disable+0x37/0x100 [ 1103.941306][T11638] ? clear_bhb_loop+0x40/0x90 [ 1103.941319][T11638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1103.941329][T11638] RIP: 0033:0x7fefe3d9c629 [ 1103.941340][T11638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1103.941353][T11638] RSP: 002b:00007fefe4cc8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1103.941373][T11638] RAX: ffffffffffffffda RBX: 00007fefe4015fa0 RCX: 00007fefe3d9c629 [ 1103.941387][T11638] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000011 [ 1103.941399][T11638] RBP: 00007fefe3e32b39 R08: 0000000000000000 R09: 0000000000000000 [ 1103.941411][T11638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1103.941423][T11638] R13: 00007fefe4016038 R14: 00007fefe4015fa0 R15: 00007ffe8dc8a0d8 [ 1103.941456][T11638] [ 1103.983043][T11637] lec:lec_atm_close: lec0: Shut down! [ 1104.030200][T11643] lo speed is unknown, defaulting to 1000 [ 1104.487780][T11655] lo speed is unknown, defaulting to 1000 [ 1104.497532][T11643] wg1 speed is unknown, defaulting to 1000 [ 1104.538816][T11655] wg1 speed is unknown, defaulting to 1000 [ 1104.573197][T11666] netlink: 'syz.1.9899': attribute type 4 has an invalid length. [ 1104.582036][T11666] netlink: 152 bytes leftover after parsing attributes in process `syz.1.9899'. [ 1104.622527][T11666] .`: renamed from bond0 (while UP) [ 1104.778364][T11667] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9900'. [ 1104.822564][T11667] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1104.853608][T11667] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9900'. [ 1105.123222][T11686] netlink: 'syz.2.9906': attribute type 11 has an invalid length. [ 1105.133613][T11688] netlink: 'syz.1.9905': attribute type 5 has an invalid length. [ 1105.376527][T11694] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9908'. [ 1105.461386][T11699] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9908'. [ 1105.653205][T11711] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1105.670103][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1105.686249][T11708] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1105.740948][T11712] netlink: 'syz.0.9913': attribute type 8 has an invalid length. [ 1105.758950][T11712] sch_fq: defrate 0 ignored. [ 1105.802052][T11708] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1106.051549][T11708] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1106.234667][T11741] netlink: 'syz.0.9919': attribute type 1 has an invalid length. [ 1106.261065][T11708] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1106.293804][T11741] netlink: 'syz.0.9919': attribute type 1 has an invalid length. [ 1106.424498][ T29] audit: type=1107 audit(1771500440.894:21): pid=11752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 1106.467575][T11759] netlink: 'syz.0.9922': attribute type 29 has an invalid length. [ 1106.493006][ T7287] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1106.504836][T11759] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] SMP KASAN PTI [ 1106.516867][T11759] KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] [ 1106.525383][T11759] CPU: 0 UID: 0 PID: 11759 Comm: syz.0.9922 Not tainted syzkaller #0 PREEMPT(full) [ 1106.534771][T11759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1106.544833][T11759] RIP: 0010:ip_route_output_key_hash_rcu+0x12ba/0x25d0 [ 1106.551700][T11759] Code: c3 31 ff 89 c6 e8 b6 9b c7 f7 85 db 74 5b e8 6d 97 c7 f7 eb 05 e8 66 97 c7 f7 4d 85 ff 74 36 49 8d 5f 3a 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 ff 10 00 00 0f b7 1b bf ff ff 00 00 89 [ 1106.571315][T11759] RSP: 0018:ffffc9000b76f5e0 EFLAGS: 00010202 [ 1106.577388][T11759] RAX: 0000000000000007 RBX: 0000000000000039 RCX: 0000000000080000 [ 1106.585358][T11759] RDX: ffffc9000ba91000 RSI: 0000000000000a0b RDI: 0000000000000a0c [ 1106.593331][T11759] RBP: 0000000080000000 R08: ffff888069d51e40 R09: 0000000000000003 [ 1106.601309][T11759] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 1106.609289][T11759] R13: 0000000000000000 R14: ffff888064e84b58 R15: ffffffffffffffff [ 1106.616730][ T7283] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1106.617257][T11759] FS: 00007f74f70c36c0(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000 [ 1106.627358][ T7283] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1106.634295][T11759] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1106.634312][T11759] CR2: 0000200000034000 CR3: 0000000075ddc000 CR4: 00000000003526f0 [ 1106.634330][T11759] Call Trace: [ 1106.634338][T11759] [ 1106.634351][T11759] ? ip_route_output_key_hash+0xd8/0x2a0 [ 1106.634380][T11759] ip_route_output_key_hash+0x18d/0x2a0 [ 1106.634406][T11759] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 1106.634432][T11759] ? crng_fast_key_erasure+0x196/0x270 [ 1106.634457][T11759] ? __pfx_crng_fast_key_erasure+0x10/0x10 [ 1106.634482][T11759] ip_route_output_flow+0x2a/0x150 [ 1106.634505][T11759] sctp_v4_get_dst+0x3f8/0x12b0 [ 1106.634527][T11759] ? crng_make_state+0x2c5/0x600 [ 1106.634548][T11759] ? lockdep_hardirqs_on+0x7a/0x110 [ 1106.634573][T11759] ? crng_make_state+0x36a/0x600 [ 1106.634597][T11759] ? __pfx_sctp_v4_get_dst+0x10/0x10 [ 1106.634617][T11759] ? _get_random_bytes+0x1e7/0x260 [ 1106.634645][T11759] ? dst_release+0x72/0x1b0 [ 1106.634672][T11759] sctp_transport_route+0x118/0x2f0 [ 1106.634693][T11759] sctp_assoc_add_peer+0x650/0x13b0 [ 1106.634723][T11759] sctp_connect_new_asoc+0x329/0x6b0 [ 1106.634750][T11759] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1106.634776][T11759] ? sctp_get_af_specific+0x29/0x80 [ 1106.634796][T11759] ? sctp_inet6_send_verify+0x80/0x300 [ 1106.634817][T11759] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 1106.634844][T11759] __sctp_connect+0x5cb/0xdc0 [ 1106.634873][T11759] ? __pfx___sctp_connect+0x10/0x10 [ 1106.634894][T11759] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1106.634918][T11759] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 1106.634939][T11759] sctp_getsockopt_connectx3+0x227/0x360 [ 1106.634969][T11759] ? lock_sock_nested+0x6a/0x100 [ 1106.634988][T11759] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 1106.635014][T11759] ? __local_bh_enable_ip+0xd0/0x130 [ 1106.635039][T11759] sctp_getsockopt+0x984/0xb90 [ 1106.635061][T11759] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1106.635082][T11759] do_sock_getsockopt+0x2d3/0x3f0 [ 1106.635107][T11759] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1106.635130][T11759] ? __fget_files+0x3a0/0x420 [ 1106.635149][T11759] ? __fget_files+0x2a/0x420 [ 1106.635169][T11759] __x64_sys_getsockopt+0x1a4/0x240 [ 1106.848348][T11759] do_syscall_64+0x14d/0xf80 [ 1106.852941][T11759] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.858993][T11759] ? trace_irq_disable+0x37/0x100 [ 1106.864006][T11759] ? clear_bhb_loop+0x40/0x90 [ 1106.868671][T11759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.874549][T11759] RIP: 0033:0x7f74f619c629 [ 1106.878952][T11759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1106.898549][T11759] RSP: 002b:00007f74f70c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1106.906953][T11759] RAX: ffffffffffffffda RBX: 00007f74f6415fa0 RCX: 00007f74f619c629 [ 1106.914911][T11759] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000007 [ 1106.922874][T11759] RBP: 00007f74f6232b39 R08: 0000200000000180 R09: 0000000000000000 [ 1106.930837][T11759] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000000 [ 1106.938793][T11759] R13: 00007f74f6416038 R14: 00007f74f6415fa0 R15: 00007ffddd9d4838 [ 1106.946755][T11759] [ 1106.949773][T11759] Modules linked in: [ 1106.955122][T11759] ---[ end trace 0000000000000000 ]--- [ 1107.003412][T11759] RIP: 0010:ip_route_output_key_hash_rcu+0x12ba/0x25d0 [ 1107.019828][T11759] Code: c3 31 ff 89 c6 e8 b6 9b c7 f7 85 db 74 5b e8 6d 97 c7 f7 eb 05 e8 66 97 c7 f7 4d 85 ff 74 36 49 8d 5f 3a 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 ff 10 00 00 0f b7 1b bf ff ff 00 00 89 [ 1107.023087][ T69] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1107.057244][T11759] RSP: 0018:ffffc9000b76f5e0 EFLAGS: 00010202 [ 1107.064445][T11759] RAX: 0000000000000007 RBX: 0000000000000039 RCX: 0000000000080000 [ 1107.070670][T11757] lo speed is unknown, defaulting to 1000 [ 1107.073174][T11759] RDX: ffffc9000ba91000 RSI: 0000000000000a0b RDI: 0000000000000a0c [ 1107.078202][T11769] netlink: 'syz.0.9922': attribute type 29 has an invalid length. [ 1107.095733][T11757] wg1 speed is unknown, defaulting to 1000 [ 1107.131478][T11759] RBP: 0000000080000000 R08: ffff888069d51e40 R09: 0000000000000003 [ 1107.140468][T11759] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 1107.149878][T11759] R13: 0000000000000000 R14: ffff888064e84b58 R15: ffffffffffffffff [ 1107.157996][T11759] FS: 00007f74f70c36c0(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000 [ 1107.167143][T11759] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1107.174811][T11759] CR2: 0000001b31a20ff8 CR3: 0000000075ddc000 CR4: 00000000003526f0 [ 1107.183442][T11759] Kernel panic - not syncing: Fatal exception [ 1107.189881][T11759] Kernel Offset: disabled [ 1107.194192][T11759] Rebooting in 86400 seconds..