last executing test programs: 1m12.147394684s ago: executing program 4 (id=1896): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=ANY=[@ANYBLOB="50020000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001000000080001000000000004000480080002000100000010000c7d0c000b8008000a00b4ed000004000880c8000c802400e73608000900f36aad4208000a156878badf10076800d5441e0f080009002bd49f3b0c00008008000a0069710000"], 0x250}}, 0x0) 1m11.799495375s ago: executing program 4 (id=1899): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r0, 0xe27, 0x0, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000, 0x0, 0x4044}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ipvlan1\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = socket$inet6(0xa, 0x6, 0x20005) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x6, &(0x7f0000000140)={0x7d, {{0x29, 0x4e22, 0x37004000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x600005}}}, 0x88) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x8}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x2e}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x84}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x0, 0x4021}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x2ac1}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[], 0x150}, 0x1, 0x0, 0x0, 0x4001}, 0x8008090) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x6c}}, 0x40000) r9 = socket$packet(0x11, 0x3, 0x300) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r11, 0x8946, &(0x7f0000000140)="a6cc04e2d8f1c38afbf14b29b86e3a") setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000440)={{0xa, 0x4e21, 0x1, @local, 0x7}, {0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffc00}, 0xffffffffffffffff, {[0x401, 0xffffd7fb, 0xf, 0x1, 0x3, 0x200, 0x8001, 0x2]}}, 0x5c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffff80, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="6800000002060500000000000000000005000000100003006269746d61703a706f727400050004000000000000000400010000f8050005000500000015000300686173683a69702c706f72742c6e6574000000000d000300686173683a6d616300000000d5f00d2cae4115e6beaf50e961d095d5b7f72b668d1383ff3bb4803a547cc0ed2ab1749c998a9a477280aba1f922df863eaa4c4c04bc522e8ab301e2166d62c3a2597d930231457024441e46db976803f144b76ee2e49e54684a3f61e152513c968c963e42b0b85a253963ad5937508340"], 0x68}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCADDRT(r12, 0x890b, &(0x7f0000000580)={@rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2000000, 0x0, 0x3d, 0xa80, 0x0, 0x930210}) 1m0.834294602s ago: executing program 4 (id=1899): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r0, 0xe27, 0x0, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000, 0x0, 0x4044}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ipvlan1\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = socket$inet6(0xa, 0x6, 0x20005) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x6, &(0x7f0000000140)={0x7d, {{0x29, 0x4e22, 0x37004000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x600005}}}, 0x88) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x8}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x2e}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x84}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x0, 0x4021}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x2ac1}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[], 0x150}, 0x1, 0x0, 0x0, 0x4001}, 0x8008090) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x6c}}, 0x40000) r9 = socket$packet(0x11, 0x3, 0x300) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r11, 0x8946, &(0x7f0000000140)="a6cc04e2d8f1c38afbf14b29b86e3a") setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000440)={{0xa, 0x4e21, 0x1, @local, 0x7}, {0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffc00}, 0xffffffffffffffff, {[0x401, 0xffffd7fb, 0xf, 0x1, 0x3, 0x200, 0x8001, 0x2]}}, 0x5c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffff80, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="6800000002060500000000000000000005000000100003006269746d61703a706f727400050004000000000000000400010000f8050005000500000015000300686173683a69702c706f72742c6e6574000000000d000300686173683a6d616300000000d5f00d2cae4115e6beaf50e961d095d5b7f72b668d1383ff3bb4803a547cc0ed2ab1749c998a9a477280aba1f922df863eaa4c4c04bc522e8ab301e2166d62c3a2597d930231457024441e46db976803f144b76ee2e49e54684a3f61e152513c968c963e42b0b85a253963ad5937508340"], 0x68}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCADDRT(r12, 0x890b, &(0x7f0000000580)={@rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2000000, 0x0, 0x3d, 0xa80, 0x0, 0x930210}) 46.503368417s ago: executing program 4 (id=1899): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r0, 0xe27, 0x0, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000, 0x0, 0x4044}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ipvlan1\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = socket$inet6(0xa, 0x6, 0x20005) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x6, &(0x7f0000000140)={0x7d, {{0x29, 0x4e22, 0x37004000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x600005}}}, 0x88) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x8}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x2e}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x84}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x0, 0x4021}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x2ac1}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[], 0x150}, 0x1, 0x0, 0x0, 0x4001}, 0x8008090) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x6c}}, 0x40000) r9 = socket$packet(0x11, 0x3, 0x300) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r11, 0x8946, &(0x7f0000000140)="a6cc04e2d8f1c38afbf14b29b86e3a") setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000440)={{0xa, 0x4e21, 0x1, @local, 0x7}, {0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffc00}, 0xffffffffffffffff, {[0x401, 0xffffd7fb, 0xf, 0x1, 0x3, 0x200, 0x8001, 0x2]}}, 0x5c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffff80, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="6800000002060500000000000000000005000000100003006269746d61703a706f727400050004000000000000000400010000f8050005000500000015000300686173683a69702c706f72742c6e6574000000000d000300686173683a6d616300000000d5f00d2cae4115e6beaf50e961d095d5b7f72b668d1383ff3bb4803a547cc0ed2ab1749c998a9a477280aba1f922df863eaa4c4c04bc522e8ab301e2166d62c3a2597d930231457024441e46db976803f144b76ee2e49e54684a3f61e152513c968c963e42b0b85a253963ad5937508340"], 0x68}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCADDRT(r12, 0x890b, &(0x7f0000000580)={@rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2000000, 0x0, 0x3d, 0xa80, 0x0, 0x930210}) 31.30872844s ago: executing program 4 (id=1899): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r0, 0xe27, 0x0, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000, 0x0, 0x4044}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ipvlan1\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = socket$inet6(0xa, 0x6, 0x20005) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x6, &(0x7f0000000140)={0x7d, {{0x29, 0x4e22, 0x37004000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x600005}}}, 0x88) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x8}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x2e}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x84}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x0, 0x4021}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x2ac1}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[], 0x150}, 0x1, 0x0, 0x0, 0x4001}, 0x8008090) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x6c}}, 0x40000) r9 = socket$packet(0x11, 0x3, 0x300) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r11, 0x8946, &(0x7f0000000140)="a6cc04e2d8f1c38afbf14b29b86e3a") setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000440)={{0xa, 0x4e21, 0x1, @local, 0x7}, {0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffc00}, 0xffffffffffffffff, {[0x401, 0xffffd7fb, 0xf, 0x1, 0x3, 0x200, 0x8001, 0x2]}}, 0x5c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffff80, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="6800000002060500000000000000000005000000100003006269746d61703a706f727400050004000000000000000400010000f8050005000500000015000300686173683a69702c706f72742c6e6574000000000d000300686173683a6d616300000000d5f00d2cae4115e6beaf50e961d095d5b7f72b668d1383ff3bb4803a547cc0ed2ab1749c998a9a477280aba1f922df863eaa4c4c04bc522e8ab301e2166d62c3a2597d930231457024441e46db976803f144b76ee2e49e54684a3f61e152513c968c963e42b0b85a253963ad5937508340"], 0x68}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCADDRT(r12, 0x890b, &(0x7f0000000580)={@rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2000000, 0x0, 0x3d, 0xa80, 0x0, 0x930210}) 15.170407485s ago: executing program 4 (id=1899): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r0, 0xe27, 0x0, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000, 0x0, 0x4044}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'ipvlan1\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = socket$inet6(0xa, 0x6, 0x20005) setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x6, &(0x7f0000000140)={0x7d, {{0x29, 0x4e22, 0x37004000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x600005}}}, 0x88) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x8}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x2e}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x2}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x84}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x0, 0x4021}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x2ac1}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r8, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[], 0x150}, 0x1, 0x0, 0x0, 0x4001}, 0x8008090) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x6c}}, 0x40000) r9 = socket$packet(0x11, 0x3, 0x300) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r11, 0x8946, &(0x7f0000000140)="a6cc04e2d8f1c38afbf14b29b86e3a") setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000440)={{0xa, 0x4e21, 0x1, @local, 0x7}, {0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffc00}, 0xffffffffffffffff, {[0x401, 0xffffd7fb, 0xf, 0x1, 0x3, 0x200, 0x8001, 0x2]}}, 0x5c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffff80, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="6800000002060500000000000000000005000000100003006269746d61703a706f727400050004000000000000000400010000f8050005000500000015000300686173683a69702c706f72742c6e6574000000000d000300686173683a6d616300000000d5f00d2cae4115e6beaf50e961d095d5b7f72b668d1383ff3bb4803a547cc0ed2ab1749c998a9a477280aba1f922df863eaa4c4c04bc522e8ab301e2166d62c3a2597d930231457024441e46db976803f144b76ee2e49e54684a3f61e152513c968c963e42b0b85a253963ad5937508340"], 0x68}, 0x1, 0x0, 0x0, 0xc000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCADDRT(r12, 0x890b, &(0x7f0000000580)={@rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2000000, 0x0, 0x3d, 0xa80, 0x0, 0x930210}) 5.41547273s ago: executing program 0 (id=2297): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100)=@newqdisc={0x24}, 0x24}}, 0x20004000) recvmmsg(r5, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000580)=""/77, 0x4d}], 0x1}}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000003880)=""/4111, 0x100f}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000004c00)=""/4105, 0x1009}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000002040)=""/73, 0x49}], 0x1}}], 0x4, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000045c0)=@newqdisc={0x87c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x850, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x1fc0}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0xffff}, {0x0, 0x0, 0x0, 0x8, 0x2, 0x3}, 0xfffffffe, 0x81}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xcb59372f370e8465}, @TCA_TBF_PTAB={0x404, 0x3, [0x514, 0x2, 0x2, 0xf, 0x1, 0x2, 0x1c, 0x9, 0x4, 0x6, 0xbe, 0x7, 0x3, 0x6, 0x3, 0x3, 0x2ea6, 0x2, 0xff2, 0x2, 0x7, 0x1ff, 0x7fffffff, 0xfff, 0x5, 0x100, 0xfffffffc, 0x0, 0x6, 0xa9, 0xc3c, 0x8, 0x5, 0x80000000, 0x7, 0x1, 0x7fffffff, 0x40, 0x4, 0x4a3e, 0xe, 0xf181, 0x0, 0x4, 0x8, 0x0, 0x8, 0x2, 0x7fffffff, 0x2, 0x5, 0x1, 0xc, 0x4, 0x0, 0x80000001, 0x2, 0x7, 0x5, 0x100, 0x6, 0x2, 0x1, 0x0, 0x800, 0x7fffffff, 0x8, 0x4, 0x3, 0x9, 0x1ff, 0x2, 0x4, 0x2, 0x4, 0x1f1, 0x5, 0x4, 0xa564, 0xd3a4, 0xf, 0x4, 0x4, 0x9, 0x0, 0xc0, 0x3, 0x7, 0x80, 0x400, 0x200, 0x6, 0x9, 0x2, 0x0, 0x0, 0x5, 0x2, 0x5, 0x1, 0xffffffff, 0x9, 0x1, 0x401, 0xffffffff, 0x1, 0x0, 0x2, 0x1000, 0xdfc0, 0x8, 0x6, 0x3, 0xfffffff9, 0x6, 0x3cda, 0x5, 0xffffffff, 0x5, 0x8000, 0x80000001, 0xf61, 0x5, 0x9d59f5f, 0x0, 0xff, 0x10001, 0xfffffffe, 0x2, 0x4, 0x3, 0xfffffffb, 0x7ff, 0xc4a3, 0x0, 0x0, 0x93fa, 0x10000, 0x4, 0x8, 0x2, 0xfffffff9, 0x8, 0x5, 0x281, 0x6, 0x10000, 0x5, 0x1, 0x31db, 0x6, 0x4, 0x1, 0x8, 0x401, 0x9, 0xfffffff8, 0xfffff801, 0x0, 0x65b, 0x6, 0x6, 0xffff, 0x2d0a0f73, 0xc1000000, 0xa0, 0x4, 0x7179, 0x5, 0x0, 0x9, 0x9, 0x3f, 0x40000000, 0x4, 0x8db, 0x1000, 0x6, 0xd59, 0xffff, 0x7fffffff, 0x80, 0x0, 0x8000, 0xd7c9, 0xc, 0x10, 0x3, 0xe8, 0x5, 0x4, 0x1eecdbc0, 0x0, 0x2, 0x1000, 0x9, 0x53, 0x6, 0x4, 0xe, 0xffff, 0x933, 0x7, 0x1c66fe06, 0xdea, 0x5, 0x8, 0x80, 0x5, 0x4, 0x8, 0x101, 0x401, 0x6, 0x850, 0x171eaf8c, 0x7, 0x100, 0xd6d, 0x9, 0x1ff, 0xfffffffe, 0xfbb, 0x6, 0x81, 0x7, 0x10001, 0x4, 0x80000001, 0x10, 0xc, 0x9, 0x4, 0x6, 0x7, 0x5, 0x7, 0xfff, 0x7fff, 0x3, 0x1, 0x8, 0x1, 0x6, 0xd52, 0x7, 0xfe, 0x7, 0x2, 0x5342, 0x6, 0x6, 0x6, 0x1, 0x8, 0x6]}, @TCA_TBF_BURST={0x8, 0x6, 0x5}, @TCA_TBF_PTAB={0x404, 0x3, [0x7, 0xf038, 0x1, 0x1, 0x40, 0x54, 0x1ff, 0x40, 0xd1, 0x1, 0x9, 0x8, 0x7dc, 0x1, 0x1, 0x1, 0x8, 0x6, 0x5, 0x3, 0x5, 0x7fff, 0xfffffffc, 0x2, 0x3, 0xffff, 0x5, 0x5, 0x400, 0xfffffffe, 0x6, 0x8, 0x0, 0x1, 0x8001, 0x7, 0xfffffffb, 0x3, 0x6, 0x4f251e72, 0x401, 0x1, 0x0, 0x80000001, 0xc, 0x6b3, 0x3, 0xdff, 0x1, 0xe0000, 0x7fffffff, 0x0, 0x0, 0x76b, 0xfff7f9a4, 0x3b3a, 0xf, 0x1, 0x5, 0x2, 0x8001, 0xff, 0x80, 0xb3e8, 0x0, 0x3, 0x7fffffff, 0x8, 0x3, 0x5, 0xae0, 0x9, 0x3, 0x24ce, 0x2, 0x1969c21, 0x4, 0x1, 0x1, 0x3, 0xb17e, 0x1, 0x8, 0x6, 0x1ff, 0x0, 0xffff, 0x40, 0x1daf, 0xd, 0x80000001, 0x2, 0x2, 0x81, 0x4ee, 0x6, 0x3, 0xfffffff8, 0x7, 0x6bf8, 0x1, 0x200, 0x1d, 0x9, 0x67f4bd3d, 0xc, 0x800, 0x4, 0xb7, 0x823e, 0x100, 0x7, 0x439, 0x2, 0x4, 0xbb, 0x8, 0x4c, 0x6, 0x8, 0x3ff, 0x10, 0xfff, 0x9, 0xa01, 0x0, 0x50, 0x6, 0x5, 0x9, 0x0, 0x5, 0x684, 0xb, 0x4, 0xf, 0x8, 0x7, 0xe23, 0xfffffffc, 0xa, 0x1, 0x7, 0x6, 0x18b54000, 0xb, 0x5, 0x4, 0x1, 0x8, 0x7, 0xffff8001, 0x57, 0x2e7, 0x3, 0x400, 0xffffffff, 0x9, 0xb, 0x92, 0x80, 0xa, 0x9, 0x5, 0x40, 0x7ff, 0x1, 0x1, 0xff, 0x0, 0xd, 0x3, 0x4, 0x80000000, 0x8, 0x10, 0xffffffff, 0x7, 0x7443, 0xef86, 0x2, 0x7f, 0x7, 0xfffffffb, 0x0, 0xac8a, 0x100, 0xae, 0x48, 0x1, 0x1, 0x5, 0x5, 0x7, 0x9, 0xa, 0x1ff, 0x20000, 0xb, 0x8, 0xcc, 0x2, 0x5, 0x7, 0xea000000, 0x1, 0x0, 0x0, 0x4, 0x1fac0, 0x0, 0x58, 0x9, 0x1ff, 0x1ec0c3a9, 0x89bc, 0xfff, 0x9, 0x5c87, 0x5, 0x8, 0x4, 0x8, 0x2, 0xbd0, 0xe29, 0x6, 0x0, 0x3, 0x1, 0x9, 0x3, 0x1000, 0x9, 0xffffc58b, 0x7, 0x10000, 0x2, 0xb3, 0x221, 0x1, 0x9, 0x8001, 0x3, 0x1, 0x56, 0x2, 0xa9, 0x2e, 0x3, 0x1, 0x7, 0xff, 0xb, 0xb9f, 0xfffffff7]}]}}]}, 0x87c}}, 0x4000080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (async) accept4(r4, 0x0, 0x0, 0x0) (async) sendmsg$alg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) (async) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100)=@newqdisc={0x24}, 0x24}}, 0x20004000) (async) recvmmsg(r5, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000580)=""/77, 0x4d}], 0x1}}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000003880)=""/4111, 0x100f}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000004c00)=""/4105, 0x1009}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000002040)=""/73, 0x49}], 0x1}}], 0x4, 0x0, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000045c0)=@newqdisc={0x87c, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x850, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x1fc0}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0xffff}, {0x0, 0x0, 0x0, 0x8, 0x2, 0x3}, 0xfffffffe, 0x81}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xcb59372f370e8465}, @TCA_TBF_PTAB={0x404, 0x3, [0x514, 0x2, 0x2, 0xf, 0x1, 0x2, 0x1c, 0x9, 0x4, 0x6, 0xbe, 0x7, 0x3, 0x6, 0x3, 0x3, 0x2ea6, 0x2, 0xff2, 0x2, 0x7, 0x1ff, 0x7fffffff, 0xfff, 0x5, 0x100, 0xfffffffc, 0x0, 0x6, 0xa9, 0xc3c, 0x8, 0x5, 0x80000000, 0x7, 0x1, 0x7fffffff, 0x40, 0x4, 0x4a3e, 0xe, 0xf181, 0x0, 0x4, 0x8, 0x0, 0x8, 0x2, 0x7fffffff, 0x2, 0x5, 0x1, 0xc, 0x4, 0x0, 0x80000001, 0x2, 0x7, 0x5, 0x100, 0x6, 0x2, 0x1, 0x0, 0x800, 0x7fffffff, 0x8, 0x4, 0x3, 0x9, 0x1ff, 0x2, 0x4, 0x2, 0x4, 0x1f1, 0x5, 0x4, 0xa564, 0xd3a4, 0xf, 0x4, 0x4, 0x9, 0x0, 0xc0, 0x3, 0x7, 0x80, 0x400, 0x200, 0x6, 0x9, 0x2, 0x0, 0x0, 0x5, 0x2, 0x5, 0x1, 0xffffffff, 0x9, 0x1, 0x401, 0xffffffff, 0x1, 0x0, 0x2, 0x1000, 0xdfc0, 0x8, 0x6, 0x3, 0xfffffff9, 0x6, 0x3cda, 0x5, 0xffffffff, 0x5, 0x8000, 0x80000001, 0xf61, 0x5, 0x9d59f5f, 0x0, 0xff, 0x10001, 0xfffffffe, 0x2, 0x4, 0x3, 0xfffffffb, 0x7ff, 0xc4a3, 0x0, 0x0, 0x93fa, 0x10000, 0x4, 0x8, 0x2, 0xfffffff9, 0x8, 0x5, 0x281, 0x6, 0x10000, 0x5, 0x1, 0x31db, 0x6, 0x4, 0x1, 0x8, 0x401, 0x9, 0xfffffff8, 0xfffff801, 0x0, 0x65b, 0x6, 0x6, 0xffff, 0x2d0a0f73, 0xc1000000, 0xa0, 0x4, 0x7179, 0x5, 0x0, 0x9, 0x9, 0x3f, 0x40000000, 0x4, 0x8db, 0x1000, 0x6, 0xd59, 0xffff, 0x7fffffff, 0x80, 0x0, 0x8000, 0xd7c9, 0xc, 0x10, 0x3, 0xe8, 0x5, 0x4, 0x1eecdbc0, 0x0, 0x2, 0x1000, 0x9, 0x53, 0x6, 0x4, 0xe, 0xffff, 0x933, 0x7, 0x1c66fe06, 0xdea, 0x5, 0x8, 0x80, 0x5, 0x4, 0x8, 0x101, 0x401, 0x6, 0x850, 0x171eaf8c, 0x7, 0x100, 0xd6d, 0x9, 0x1ff, 0xfffffffe, 0xfbb, 0x6, 0x81, 0x7, 0x10001, 0x4, 0x80000001, 0x10, 0xc, 0x9, 0x4, 0x6, 0x7, 0x5, 0x7, 0xfff, 0x7fff, 0x3, 0x1, 0x8, 0x1, 0x6, 0xd52, 0x7, 0xfe, 0x7, 0x2, 0x5342, 0x6, 0x6, 0x6, 0x1, 0x8, 0x6]}, @TCA_TBF_BURST={0x8, 0x6, 0x5}, @TCA_TBF_PTAB={0x404, 0x3, [0x7, 0xf038, 0x1, 0x1, 0x40, 0x54, 0x1ff, 0x40, 0xd1, 0x1, 0x9, 0x8, 0x7dc, 0x1, 0x1, 0x1, 0x8, 0x6, 0x5, 0x3, 0x5, 0x7fff, 0xfffffffc, 0x2, 0x3, 0xffff, 0x5, 0x5, 0x400, 0xfffffffe, 0x6, 0x8, 0x0, 0x1, 0x8001, 0x7, 0xfffffffb, 0x3, 0x6, 0x4f251e72, 0x401, 0x1, 0x0, 0x80000001, 0xc, 0x6b3, 0x3, 0xdff, 0x1, 0xe0000, 0x7fffffff, 0x0, 0x0, 0x76b, 0xfff7f9a4, 0x3b3a, 0xf, 0x1, 0x5, 0x2, 0x8001, 0xff, 0x80, 0xb3e8, 0x0, 0x3, 0x7fffffff, 0x8, 0x3, 0x5, 0xae0, 0x9, 0x3, 0x24ce, 0x2, 0x1969c21, 0x4, 0x1, 0x1, 0x3, 0xb17e, 0x1, 0x8, 0x6, 0x1ff, 0x0, 0xffff, 0x40, 0x1daf, 0xd, 0x80000001, 0x2, 0x2, 0x81, 0x4ee, 0x6, 0x3, 0xfffffff8, 0x7, 0x6bf8, 0x1, 0x200, 0x1d, 0x9, 0x67f4bd3d, 0xc, 0x800, 0x4, 0xb7, 0x823e, 0x100, 0x7, 0x439, 0x2, 0x4, 0xbb, 0x8, 0x4c, 0x6, 0x8, 0x3ff, 0x10, 0xfff, 0x9, 0xa01, 0x0, 0x50, 0x6, 0x5, 0x9, 0x0, 0x5, 0x684, 0xb, 0x4, 0xf, 0x8, 0x7, 0xe23, 0xfffffffc, 0xa, 0x1, 0x7, 0x6, 0x18b54000, 0xb, 0x5, 0x4, 0x1, 0x8, 0x7, 0xffff8001, 0x57, 0x2e7, 0x3, 0x400, 0xffffffff, 0x9, 0xb, 0x92, 0x80, 0xa, 0x9, 0x5, 0x40, 0x7ff, 0x1, 0x1, 0xff, 0x0, 0xd, 0x3, 0x4, 0x80000000, 0x8, 0x10, 0xffffffff, 0x7, 0x7443, 0xef86, 0x2, 0x7f, 0x7, 0xfffffffb, 0x0, 0xac8a, 0x100, 0xae, 0x48, 0x1, 0x1, 0x5, 0x5, 0x7, 0x9, 0xa, 0x1ff, 0x20000, 0xb, 0x8, 0xcc, 0x2, 0x5, 0x7, 0xea000000, 0x1, 0x0, 0x0, 0x4, 0x1fac0, 0x0, 0x58, 0x9, 0x1ff, 0x1ec0c3a9, 0x89bc, 0xfff, 0x9, 0x5c87, 0x5, 0x8, 0x4, 0x8, 0x2, 0xbd0, 0xe29, 0x6, 0x0, 0x3, 0x1, 0x9, 0x3, 0x1000, 0x9, 0xffffc58b, 0x7, 0x10000, 0x2, 0xb3, 0x221, 0x1, 0x9, 0x8001, 0x3, 0x1, 0x56, 0x2, 0xa9, 0x2e, 0x3, 0x1, 0x7, 0xff, 0xb, 0xb9f, 0xfffffff7]}]}}]}, 0x87c}}, 0x4000080) (async) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) (async) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) (async) 5.039265184s ago: executing program 0 (id=2301): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg(r0, &(0x7f00000003c0), 0x0, 0x4004810) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000000a40)=""/4067, &(0x7f00000000c0)=0xfe3) r2 = socket(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'ip6erspan0\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r5) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="a137d7c27308b6352044297d64a6e4a1e0", @ANYBLOB="47f7ff6bd78ed3c2951269f6b10840a46a87c50ec4c7e368848e22c59aa0716cb295b3216ff0fe50205059b7b676512824ca8527a77f62d8d06dbfb7389a775dd8438cda02951ba1161c1b26bbb2be637109994724f83e29ca1f42f7dd7c43687d2321987f166318d6091dc91b513106f3cb498108ff191ce8eb349c0c168f841b9ec09ff8ebffc54d646ba57f55ccbf97dd157a5bded3530d774bb82cafdb2c6aa0b6ee931924174e0432dc03efbcb315f2ecbfd1df946fd0fa36677aedda96cbdba0f513ebbdbd01eb3d133961f15019dfe44e77bdd8195048f0b82bcb698594000000000000000000000000000040001e3f55cab9393e7a40d942338d5c1a327d1fdf403560b532a815cff847e5fa41f9707aca948c46b4dddc62fe3998e50d2c5b9c156b8ee2bd058e62f07c6e387eaf46dae66ed0cf104a5812a6f8432bc30864240cd8eb7cae14e9b1473015e6d47d7088ecc92b2a465a", @ANYBLOB="010027bd7000fcdbdf25212300000943001f007068793100000006", @ANYRES32=r0], 0x20}, 0x1, 0x0, 0x0, 0x20000010}, 0x2004c010) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x60b, 0xfffffffe, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xf}, {0x7, 0xffff}, {0x7, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x2400c484}, 0x40000d0) sendmmsg$inet6(r1, &(0x7f0000005e80), 0x0, 0x40000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0xffe0}, {0xfff3, 0x10}, {0xb, 0xe}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x40}]}, 0x2c}}, 0x4000) sendmsg$nl_route_sched(r8, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=@newtfilter={0x24, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x9}, {0x8, 0xfff1}, {0x7, 0xf}}}, 0x24}}, 0x24044094) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000580)={'syzkaller0\x00', @remote}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r11) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r11, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="0100"}) read(r6, &(0x7f0000000380)=""/1, 0x1) 4.660017339s ago: executing program 0 (id=2305): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xc3490000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) r1 = socket(0x10, 0xa, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000d80)=ANY=[@ANYRES64=r0], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000047c0)=r2, 0x4) write(r1, &(0x7f00000000c0)="240000005a001f021007f4f9002304000a04", 0x12) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c582", 0x5) r3 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f00000052c0)={'broute\x00', 0x0, 0x0, 0x0, [0x9573, 0x1, 0x3, 0x5, 0x54a, 0x1], 0x1, 0x0, 0x0, [{}]}, 0x88) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)="ca", 0x1) poll(0x0, 0x0, 0x2) syz_emit_ethernet(0x2a, &(0x7f00000001c0)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @multicast1}, @address_request}}}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x3e, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$inet6_int(r1, 0x29, 0x50, &(0x7f0000000180)=0x60, 0x4) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010028bd7000f6dbdf250900020073797a31001800000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x810) 2.568206777s ago: executing program 1 (id=2311): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="44010000100033060000000000000000e0000002000000000000000000000000fe8000000000000000000000000000ff00eb3e2ec5f494421500800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000001a000000ffff7f000001fffffffd32000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000002000000000000000a"], 0x144}}, 0x0) 2.348104796s ago: executing program 1 (id=2312): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140002"], 0x4c}}, 0x0) 2.183285323s ago: executing program 1 (id=2313): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) (async) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000180)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x6000000, 0x2000000000c0, 0x2000000000f0, 0x200000000120], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}]}, 0x108) r3 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000080)={r0}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001540)=ANY=[@ANYBLOB="4400000010003b15000800"/20, @ANYRES32=0x0, @ANYBLOB="0000000000b401001c00128009000100626f6e64000000000c000280050001000600000008000a00", @ANYRES32=r4], 0x44}}, 0x0) 1.750881696s ago: executing program 1 (id=2316): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty, 0x7}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='vegas\x00', 0x6) shutdown(r2, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRES32=r2], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001340)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0xfdfffff7}, @NFTA_HASH_OFFSET={0x8, 0x6, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc/1/\x00\x82q\xee\xe5\xa0\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000090a010100000000000000000000000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021080003400000014108000f"], 0x80}, 0x1, 0x0, 0x0, 0x4000}, 0x8000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000006a0083130000000000000000000000010000000008000e000000000008"], 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x40040c0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="5001000010001304000000000000000000000000000000000000ffffac141423e0000002000000000000000000000000fffd00004e0400000200002029000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb0000000000000000000000000000200032000000fc0000000000000000000000000000010000000000000000070000000000000002000000000000000400000000050000ffffffffffffffff040000000000000008000000000200000000000000000000010000000100000008000000000000007f000000000000000000000000000000f6000000000000000000000000000000000000000200000100000000000000005f001200726663343330392863636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000980000008000"], 0x150}, 0x1, 0x0, 0x0, 0x1}, 0x804) socket$key(0xf, 0x3, 0x2) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x20, 0x15, 0xa, 0x201, 0x0, 0x0, {0x3}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x24040808) 1.699671656s ago: executing program 3 (id=2318): r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x64, r2, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0x64}}, 0x54) (async) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4c20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) syz_80211_join_ibss(&(0x7f0000000380)='wlan1\x00', &(0x7f00000003c0)=@default_ap_ssid, 0x6, 0x1) (async) socket$netlink(0x10, 0x3, 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x3, 0x803, 0x2) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x2400c004}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x9f) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0x0, 0xa9, 0x8}, 0xc) (async) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r8, &(0x7f0000000000)=[{&(0x7f0000000140)='X\x00\x00', 0x3}], 0x1) r9 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1e000000acad0000080000000000000000820000", @ANYRES32=r6, @ANYBLOB="060000000000000000000000000000000000000073bd053157416a55b1f85fb3067e423fef1fea7c15b035902bbecc4dd3dff7b5d3bd912dd20fe6c3a845237a69852921409c3983f858c88d1d840ec6f61ca06206880e0607eccd3f5373090c765684ad46f7020fb57a106daaa9f9100aff48879ea95feaec71360e48935fd09809aa998bb0a3a43d61fee31c59130fa2a51eb9e83643fe9834e9ff52d9006e51e6ced45f859c860ce5735e178f8cb86927dd0a4ac844614e2063d0198c6a818b66933c4829097ae80c32ed580c2478750e833e4c2655438ae20a5883", @ANYRES32=r5, @ANYRES32, @ANYBLOB="0500000005000000030000000400000000000000", @ANYRES32=r9, @ANYBLOB='\x00\x00\x00\x00'], 0x50) syz_genetlink_get_family_id$tipc2(&(0x7f0000000500), r4) (async) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010067656e65766500000400028008000a00", @ANYRES32=r5, @ANYBLOB="6c39f36a2571add4659d407ed488a5a573a276b80f58c4b1fd015cf67a22721bd4783cd3f674e675df1f79e16fe198805e2ca1c752b7a8cf524e30a85a68614ed17a495e48065b85ae7d9fae"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) (async) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_RESVSP(r12, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x10000, 0x6}) (async) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) ioctl$FS_IOC_RESVSP(r13, 0x40305828, &(0x7f0000000180)={0x0, 0x2, 0x0, 0xd8e0}) (async) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x2c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r5, 0x500}, [@IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008004}, 0x8000) (async) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r8, 0x84, 0x20, &(0x7f0000000240), 0x4) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000540)={0x0, r4}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0xc}, {0x0, [0x51, 0x2e, 0x61, 0x61, 0x61, 0x61, 0x30, 0x5f, 0x30, 0x61]}}, &(0x7f00000005c0)=""/19, 0x24, 0x13, 0x0, 0x6fd, 0x0, @void, @value}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000640)={0x2, 0x4, 0x8, 0x1, 0x80, r10, 0xab0e, '\x00', r5, r7, 0x5, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) 1.547646525s ago: executing program 0 (id=2319): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000040)=""/94, &(0x7f00000000c0)=0x5e) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x34, 0x0, &(0x7f0000000240)="0840572d1f40cae31624c58f5054d11fce9f2bf563894788e75ae82ced7adb38315d08fcd1034bd15522d4088d397b96294b6747", 0x0, 0x9, 0x0, 0xffffffffffffff63, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffe}, 0x50) bind$bt_hci(r1, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f0000000080)) r2 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r2, &(0x7f0000000080)="800037bbfa9ba1ce", 0x8, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private}}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a0904000000000000810c0700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000031080008400000000114000000110001"], 0x8c}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'wg0\x00'}) write$tun(r3, 0x0, 0x10da) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x12, 0x4, 0x4, 0x92, 0x6804, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc, 0x3, 0x0, 0x0, @void, @value, @void, @value}, 0x50) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f0000000200)=0xfffffff9, 0x4) r5 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000480)=@ethtool_ringparam={0x10, 0x0, 0x7, 0x8201, 0x0, 0x0, 0x2, 0x2fe, 0x100000}}) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000001c0), 0x2, 0x0, 0x1, 0x0, 0x0, 0x4c041}, 0x240400d0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r6, 0x11c, 0x2, &(0x7f0000000040)=""/167, &(0x7f0000000100)=0xa7) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="70000000100003042abd70009da1d2b900000004", @ANYRES32=0x0, @ANYBLOB="0000000000000000500012800b0001006272696467650000400002800800050000000000050029000100000006002700040000000c00220006000000000000000c002100", @ANYRESDEC], 0x70}}, 0x0) 1.547373023s ago: executing program 2 (id=2320): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x18, 0x1409, 0x1, 0x10, 0xfcff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0) 1.545438314s ago: executing program 3 (id=2321): r0 = socket(0x9, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000006c0)={0x0, 0x10, &(0x7f0000000240)=[@in={0x2, 0x4e20, @private=0xa010100}]}, &(0x7f0000000700)=0x10) (async) r1 = socket(0x2, 0x80805, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000006, 0x4ca31, 0xffffffffffffffff, 0xd1d1d000) (async) sendmmsg$inet(r1, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x4, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000280)="9001", 0x2}], 0x1}}], 0x2, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000780)=ANY=[@ANYBLOB="200000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="050000ff0000"], 0x20}}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket(0x10, 0x80002, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r4, 0x400448ca, 0x0) (async) bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000001d00)) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000040)={0x2000003c, &(0x7f0000000280)}) (async) socket$packet(0x11, 0xa, 0x300) (async) socket$packet(0x11, 0x2, 0x300) (async) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00'}) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newtaction={0x7c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x68, 0x1, [@m_tunnel_key={0x64, 0x1, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) (async) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) (async) r10 = socket$packet(0x11, 0x3, 0x300) bind$packet(r10, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x10, 0x6, @link_local}, 0x14) (async) syz_emit_ethernet(0x3a, &(0x7f0000000440)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x3, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty, @multicast1}, {0x0, 0x0, 0x18, 0x0, @wg=@data}}}}}, 0x0) (async) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000005500)={'batadv_slave_0\x00'}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000054c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000055c0)={&(0x7f0000000340)=@ipv6_newrule={0x88, 0x20, 0x400, 0x70bd29, 0x25dfdbff, {0xa, 0x80, 0x10, 0x5, 0x0, 0x0, 0x0, 0x7, 0x18}, [@FIB_RULE_POLICY=@FRA_OIFNAME={0x14, 0x11, 'vlan1\x00'}, @FIB_RULE_POLICY=@FRA_OIFNAME={0x14, 0x11, 'pim6reg0\x00'}, @FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x4, 0x1}, @FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_SRC={0x14, 0x2, @private1}, @FIB_RULE_POLICY=@FRA_OIFNAME={0x14, 0x11, 'bridge_slave_1\x00'}]}, 0x88}, 0x1, 0x0, 0x0, 0x810}, 0x0) 1.370117071s ago: executing program 1 (id=2322): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ac0000001200010500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff0000", @ANYRES32=0x0, @ANYBLOB="00000000000000feffffff0000000000040002005c0001000058"], 0xac}}, 0x4000) 1.356812352s ago: executing program 2 (id=2323): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140002"], 0x4c}}, 0x0) 1.334938486s ago: executing program 0 (id=2324): bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x48) close(0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, 0x0, 0x40080) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000200), 0xffffffc1) 1.06066038s ago: executing program 2 (id=2325): sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x14, 0x0, 0x8, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x20008405) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="2c0000001900290029bd7000fbdbdf2102201000fd"], 0x2c}, 0x1, 0x0, 0x0, 0x2000c004}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="68020000210001000000000000000000ff0200000000000000000000000000017f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000a001000010000000000000008000b00000000002c001300e0000001007e00000000000000000000fc0000000000000000000000000000000000000000000000cc0111"], 0x268}}, 0x1400000000000000) 859.08412ms ago: executing program 2 (id=2326): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r1) r2 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'team_slave_0\x00', 0x100}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x1e, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000012000000007910000000000003"], 0x0, 0x93, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40, @void, @value}, 0x94) write$cgroup_subtree(r4, &(0x7f0000000380)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000340)=@security={'security\x00', 0x64, 0x4, 0x278, 0x100000c, 0xc0, 0xc0, 0xc0, 0xffffffff, 0xffffffff, 0x460, 0x460, 0x460, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @rand_addr=0x64010100, 0xff000000, 0x0, 'veth0_vlan\x00', 'syzkaller1\x00', {}, {}, 0xff, 0x3}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x1000000000000}}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'syz_tun\x00', 'lo\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x7f, 0x9, 0x4, 0x6, 0x1, 0x7f, 0x1, 0x40]}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000000408010100000000000000000e0000050600"/36], 0x24}}, 0x20000000) bpf$LINK_DETACH(0x22, &(0x7f00000000c0)=r4, 0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="5000000010000104000000000000000002000000", @ANYRES32=0x0, @ANYBLOB="5d580000000000001c001a8018000a8014000700000000000000000000000000000000011400030073697430"], 0x50}}, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000000bf0000000000000000008500000020000000850000000700000095"], &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000680)="e0b9547ed387dbe9abc89b6f5bff", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r1) (async) socket$phonet(0x23, 0x2, 0x1) (async) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'team_slave_0\x00', 0x100}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x1e, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000012000000007910000000000003"], 0x0, 0x93, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40, @void, @value}, 0x94) (async) write$cgroup_subtree(r4, &(0x7f0000000380)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000340)=@security={'security\x00', 0x64, 0x4, 0x278, 0x100000c, 0xc0, 0xc0, 0xc0, 0xffffffff, 0xffffffff, 0x460, 0x460, 0x460, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @rand_addr=0x64010100, 0xff000000, 0x0, 'veth0_vlan\x00', 'syzkaller1\x00', {}, {}, 0xff, 0x3}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x1000000000000}}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'syz_tun\x00', 'lo\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x7f, 0x9, 0x4, 0x6, 0x1, 0x7f, 0x1, 0x40]}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000000408010100000000000000000e0000050600"/36], 0x24}}, 0x20000000) (async) bpf$LINK_DETACH(0x22, &(0x7f00000000c0)=r4, 0x4) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="5000000010000104000000000000000002000000", @ANYRES32=0x0, @ANYBLOB="5d580000000000001c001a8018000a8014000700000000000000000000000000000000011400030073697430"], 0x50}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000000bf0000000000000000008500000020000000850000000700000095"], &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000680)="e0b9547ed387dbe9abc89b6f5bff", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) socket$alg(0x26, 0x5, 0x0) (async) 809.856893ms ago: executing program 1 (id=2327): r0 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000027c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000f000000850000005000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r1 = socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x3, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000040)={r5, 0x7ec8, 0x9, 0x9}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000180)={r5, 0xfff}, &(0x7f00000001c0)=0x8) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) clock_gettime(0x0, &(0x7f0000002880)={0x0, 0x0}) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000002ac0)=@gcm_128={{}, "9463141e84044cb1", "a1c1a334785abf3fc08d1e4bbc65600c", "e6fb3412", "e8f2cbb8b046862a"}, 0x28) recvmmsg(r6, &(0x7f0000002800)=[{{&(0x7f0000000340)=@pppol2tpin6, 0x80, &(0x7f0000000200)=[{&(0x7f00000003c0)=""/157, 0x9d}, {&(0x7f0000000480)=""/95, 0x5f}], 0x2, &(0x7f0000000500)=""/4096, 0x1000}, 0x5}, {{&(0x7f0000001500)=@ethernet={0x0, @local}, 0x80, &(0x7f0000002700)=[{&(0x7f0000001580)=""/69, 0x45}, {&(0x7f0000001600)=""/249, 0xf9}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x3, &(0x7f0000002740)=""/126, 0x7e}, 0x5}], 0x2, 0x10000, &(0x7f00000028c0)={r7, r8+10000000}) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002a80)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x7, [@int={0x4, 0x0, 0x0, 0x1, 0x0, 0x9, 0x0, 0x61, 0x2}]}, {0x0, [0x5f, 0x2e, 0x30, 0x0, 0x61]}}, &(0x7f0000002980)=""/208, 0x2f, 0xd0, 0x0, 0x1, 0x0, @void, @value}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000002900)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, r9, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r11, 0x110, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x4a, 0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xffffffffffffffb9, &(0x7f0000000080)}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14, r9, 0x8, 0x0, 0x2e, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r10, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 585.942016ms ago: executing program 0 (id=2328): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), r2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r2) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)={0x1c, r3, 0x8, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000d5}, 0xc044) r4 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0x1, 0x1}, 0x6) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf25000000ff", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r5, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r0], 0x68}}, 0x0) 516.667935ms ago: executing program 3 (id=2329): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000020000000a20000000000a03000000000000000000070000040900010073797a3000000000b4000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d24001280200001800e000100636f6e6e6c696d69740000000c00028008000140000000010c0009800800014000008fce4700"], 0xfc}}, 0x0) 289.358375ms ago: executing program 3 (id=2330): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000180)={r0, r1}) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x3, 0x0) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0xf1f, 0x3, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}, {0x9}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x93f}]}, 0x38}}, 0x4000800) (async) sendmsg$nl_route_sched(r3, &(0x7f0000002dc0)={0x0, 0xfffffffffffffd27, &(0x7f0000000240)={&(0x7f0000000900)=@delchain={0x24, 0x64, 0xf31, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xfff3, 0xffe0}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x44044) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000001340)={@private2}, &(0x7f00000013c0)=0x14) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x10000000}, @TCA_CAKE_FWMARK={0x8}]}}]}, 0x44}}, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000002a40)={0x0, @loopback, @loopback}, &(0x7f0000002a80)=0xc) sendmmsg$inet(r0, &(0x7f0000002c00)=[{{&(0x7f00000001c0)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000380)="25e83a637602dbdd2ab8610da87d2e562cd6bedd13ddaaa21bc887b85ea53d0a950eb895b62a614c4b105dfd577b26ee9d9884c6dd6e1183386ff70f59f7f47581d7d0a38f7a0e83dab2f8832ff4bb1b919bc688d21fc3e7ecc86a6ba68449b6470812ec76f65ca1aaeae2b232a119614a3aad8217aae162f62cff9491d84de3ec4824433dc12276e21b020a91f768771ede95e619504c433a45abaa56a96e86f9557fd374fbcf87a79af5", 0xab}, {&(0x7f0000000440)="6c2b3308780d705842496527f736cb18b94de44253bf51b7e6df739e4a42a65d3d231dea5de683e7dbe9543a3acd10672c1f2b718038895408fac5912be15aee544f698e76afaaf8bdf27cef0e31cc44f87ddac5a564a7cdf0c37c81a0032f0d0d1715d33c5cc3ee909e92e249007c8c7f2b401d1f228c0a335fff03dfbf", 0x7e}], 0x2, &(0x7f0000000300)=[@ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0x18}}, {{&(0x7f0000000500)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000540)="7ec55b5020ab6674ea93b6efc516fc", 0xf}, {&(0x7f0000000580)="e0f73bf1c7f9c427b91352a4161e1b15a3f83f6286c11c0f9e934d2f834eed51c0e51ae144909f96caf95f20105dc7ee72e14376e0ac34a9a198391ee880", 0x3e}, {&(0x7f0000000680)="ae1d02e19bd9314f738cf36a36de3850ee4a4bbfed39a991e3f633902c9eef56f1c3917a7d38a03a59d502a212d53e884f8587c8da55ded20b4b9606ba68985cc4f6a981c696f4dc45bc", 0x4a}, {&(0x7f0000000700)="d4b00c78dd2e60c3b577cfce52e6b824021637ad7136897bf190a510338c9d", 0x1f}], 0x4}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000f80)="3b6d98ee4d55ccf0470111099fbd2b8816d812dc21af8b5f08cbff56bc082489b9679a438d34fc0e57671dd37d71a6dbbb8345af294b22e2d4d925d40972d971f7025288d2ed30f1277698fa672436d118fc2ce93be8937d219ba432e3ec738b9a8ce9a71435eba06036", 0x6a}], 0x1}}, {{0x0, 0x0, &(0x7f0000001300)}}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000014c0)="9833ffc319197cce5d1b5ea20f757372a4f918448c29e64b9965f89b591f598680397bde310e86f00a11425ea485391f014663d0284e1730d885d8e12ed69d8beb366cbb1f7d", 0x46}, {&(0x7f0000001540)="d960b20b3469eac26e2c0bcdd73a7e563520b97e3fe36a4fee56c2a9062f2dcf986a9f27181a18084a890f9578c9291b6b08e05c57b2b8f19e42ca9fd43509c8126ded12ef5f86df0c9327ef59374b26143906cf4eadeb12c2c15b62b4d1fb4aff87ae0a8d48298944e0e26a97ca16511b4363675f651f204a1d1cd99e900f326e4e71e169336260b46b08f609df2c213b4801fd67c8733ac34477166a61319ee3bdefc73b788af7f58565c605b1291813cedfb87702361ffaeb62eb9811faf60c44c9508855e17a64c7b57e7c58df87534a25e95de5a33b84d99be938d2c515458d1de531304da8122e1949388a071fcb4d917780f5d43a77b2", 0xfa}], 0x2, &(0x7f00000027c0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_retopts={{0x14, 0x0, 0x7, {[@lsrr={0x83, 0x3, 0xfa}, @end]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @rand_addr=0x64010100, @empty}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @dev={0xac, 0x14, 0x14, 0x3b}, @multicast2}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x6}}], 0x88}}, {{&(0x7f0000001980)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f00000019c0)=[{&(0x7f00000028c0)="907d370eb5d20be88e641757bbc5bb773177287be0e58e01ce60597833afaf1d9a1e9025bd27fe4f113222fdd8a2108b6024235798f426f2a68a894261d1bda7e7493a3ea74aee46b5f95ae693443b96fa55324e20de5d91bb8a1fac3fa843218ef623cf471de293a4006025b40a9bc5de9dcc7ef5e7f0e9cc903a68848d725db0211d790502afe9", 0x88}, {&(0x7f0000002980)="1664a685c370d4bc5fb9a7607f14785df0533ccf383ed97ca80a61ccfd9c2909bb0ed868df8b0088e0888d5cb193ab76271f40ec15c7a947f7f88448fc8700d9b6edd2d0ee82f785468c76042d0d3daef30553b14a1bdfa7908d590a3141902441e0f7a87f30cc78ff714efa53ccbe4e4e18e3be5f6ffc93a8b0736f49eb1d2636", 0x81}], 0x2, &(0x7f0000002ac0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r9, @dev={0xac, 0x14, 0x14, 0x25}, @broadcast}}}, @ip_tos_u8={{0x11}}, @ip_retopts={{0x78, 0x0, 0x7, {[@generic={0x44, 0xb, "48b6b07c1052a44fbd"}, @timestamp_addr={0x44, 0x2c, 0xb3, 0x1, 0x7, [{@dev={0xac, 0x14, 0x14, 0x2f}, 0x9}, {@broadcast, 0xff}, {@empty, 0x7}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x80000001}, {@private=0xa010101, 0x52}]}, @ssrr={0x89, 0x23, 0xfa, [@multicast2, @rand_addr=0x64010102, @remote, @local, @remote, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback]}, @timestamp_prespec={0x44, 0xc, 0xb3, 0x3, 0x9, [{@broadcast, 0x9}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfffffff5}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x92}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x5}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}], 0x128}}], 0x7, 0x40) (async) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000001380)) (async, rerun: 32) r10 = socket(0x2, 0x80805, 0x0) (rerun: 32) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x14, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000fcffffff1801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r12, 0x0, 0x10, 0x22, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60fe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) (async) socket(0x2, 0x80805, 0x0) (async, rerun: 32) r13 = socket$alg(0x26, 0x5, 0x0) (rerun: 32) bind$alg(r13, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r13, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r14 = accept4(r13, 0x0, 0x0, 0x80800) sendmmsg$alg(r14, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d", 0x4a}], 0x3}], 0x1, 0x40800) 211.8806ms ago: executing program 2 (id=2331): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, r1, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x20, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000791004000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 80.876752ms ago: executing program 3 (id=2332): r0 = socket$inet6(0xa, 0x3, 0x6) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x8, 0x6, 0x5f0, 0x3e0, 0x0, 0x3e0, 0x3e0, 0x2f0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@ipv6={@local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xff000000, 0x0, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff000000, 0xffffffff], 'ipvlan1\x00', 'ipvlan1\x00', {}, {}, 0x0, 0x9, 0x2, 0x2}, 0x0, 0x108, 0x130, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@unspec=@quota={{0x38}, {0x1, 0x0, 0x4, {0x3}}}]}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x5002}}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv4=@local, 0x0, 0x32, 0x5}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@dev, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 0xff}}}, {{@ipv6={@local, @dev={0xfe, 0x80, '\x00', 0x21}, [0xffffff00, 0xff, 0x0, 0xffffff00], [0xff000000, 0xff, 0xff, 0xffffffff], 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {0xff}, 0x21, 0x8, 0x0, 0x4e}, 0x0, 0x118, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@hbh={{0x48}, {0x101, 0x0, 0x1, [0x8, 0xc, 0x8001, 0x8, 0x2, 0x2, 0x9, 0x4, 0x579, 0xf7fd, 0x6, 0xfff8, 0x6, 0x1, 0x2, 0x9], 0x10}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff0204000000000000000000000000000000000000080000", 0x18) getsockopt$inet6_opts(r0, 0x29, 0x39, 0x0, &(0x7f00000000c0)) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x800452d3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) 15.976038ms ago: executing program 3 (id=2333): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x870bd2d, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xb}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x8, 0x0, 0x0, 0xfffffffd, 0x80008}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}]}, 0x70}}, 0x20040000) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3], 0x90}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040)={r5}, 0xc) unshare(0x2c060000) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="150000001000000002"], 0x48) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x6, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x30}, @map_fd={0x18, 0x2, 0x1, 0x0, r6}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000007c0)='ns/ipc\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00040000fcffff6b0e583f00000000ff917bdad592f071a04323151757fde21565a79fb99ed674eba84f641826f3003742efb0d6a02c7f0402b51f7efbaf29ad0d1943e97baf3b77dae9086c54e4e771c8449f70ce24de6b75b1be26deaa7719d4d5d88d8a05624a2b50c58640fcb5fb4e6a5da961076f3039e253abdc77c1315a03e228e71addc914ff701a959d2d7ab0402d59d5127c", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000040000850000008200000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r10, 0x6, 0x23, &(0x7f00000006c0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000580)=""/16, 0x10, 0x0, &(0x7f00000005c0)=""/215, 0xd7}, &(0x7f0000000700)=0x40) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="500000001000370400"/20, @ANYRES32=r11, @ANYBLOB="8b04040000000000300012800b00010065727370616e0000200002800400120006001800000040000500160002000000050017"], 0x50}, 0x1, 0x0, 0x0, 0x840}, 0x40000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) unshare(0x2c020400) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="200000000a1403090000000000000000080001"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) accept4(r13, &(0x7f0000000000)=@alg, &(0x7f00000000c0)=0x80, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @multicast1}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @multicast1}}}}}}, 0x0) 0s ago: executing program 2 (id=2334): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty, 0x7}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='vegas\x00', 0x6) shutdown(r2, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRES32=r2], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001340)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0xfdfffff7}, @NFTA_HASH_OFFSET={0x8, 0x6, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc/1/\x00\x82q\xee\xe5\xa0\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000019100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000090a010100000000000000000000000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021080003400000014108000f"], 0x80}, 0x1, 0x0, 0x0, 0x4000}, 0x8000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000006a0083130000000000000000000000010000000008000e000000000008"], 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x40040c0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="5001000010001304000000000000000000000000000000000000ffffac141423e0000002000000000000000000000000fffd00004e0400000200002029000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb0000000000000000000000000000200032000000fc0000000000000000000000000000010000000000000000070000000000000002000000000000000400000000070000ffffffffffffffff040000000000000008000000000200000000000000000000010000000100000008000000000000007f000000000000000000000000000000f6000000000000000000000000000000000000000200000100000000000000005f001200726663343330392863636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000980000008000"], 0x150}, 0x1, 0x0, 0x0, 0x1}, 0x804) socket$key(0xf, 0x3, 0x2) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x20, 0x15, 0xa, 0x201, 0x0, 0x0, {0x3}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x24040808) kernel console output (not intermixed with test programs): 172.172367][ T8421] lo speed is unknown, defaulting to 1000 [ 172.480261][ T8437] __nla_validate_parse: 32 callbacks suppressed [ 172.480280][ T8437] netlink: 208 bytes leftover after parsing attributes in process `syz.3.822'. [ 172.530949][ T8437] netlink: 208 bytes leftover after parsing attributes in process `syz.3.822'. [ 172.992739][ T8425] xt_CT: No such helper "snmp" [ 173.597066][ T8487] netlink: 12 bytes leftover after parsing attributes in process `syz.0.836'. [ 173.658042][ T8490] netlink: 4 bytes leftover after parsing attributes in process `syz.0.836'. [ 173.795820][ T8497] Set syz1 is full, maxelem 65536 reached [ 173.828221][ T8497] netlink: 'syz.4.838': attribute type 4 has an invalid length. [ 173.856478][ T8492] lo speed is unknown, defaulting to 1000 [ 174.054204][ T8511] netlink: 8 bytes leftover after parsing attributes in process `syz.1.843'. [ 174.059220][ T8510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.844'. [ 174.324469][ T8520] vlan2: entered promiscuous mode [ 174.521875][ T8524] netlink: 20 bytes leftover after parsing attributes in process `syz.0.848'. [ 174.701192][ T8532] netlink: 8 bytes leftover after parsing attributes in process `syz.1.850'. [ 174.787960][ T8524] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 174.835084][ T8534] netlink: 4 bytes leftover after parsing attributes in process `syz.0.848'. [ 174.849231][ T8532] lo speed is unknown, defaulting to 1000 [ 175.011574][ T8543] xt_bpf: check failed: parse error [ 175.546822][ T8564] netlink: 36 bytes leftover after parsing attributes in process `syz.2.859'. [ 175.734948][ T8566] vlan2: entered promiscuous mode [ 175.845721][ T8574] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 175.873878][ T8574] macsec1: entered allmulticast mode [ 175.880588][ T8574] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 175.897118][ T8574] batman_adv: batadv0: Adding interface: macsec1 [ 175.919747][ T8574] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.949303][ T8574] batman_adv: batadv0: Interface activated: macsec1 [ 176.623520][ T8620] vlan3: entered promiscuous mode [ 176.805750][ T8625] gretap0: entered promiscuous mode [ 176.844397][ T8625] batman_adv: batadv0: Adding interface: macvlan2 [ 176.869399][ T8625] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 176.942162][ T8625] batman_adv: batadv0: Interface activated: macvlan2 [ 177.659398][ T8673] batadv_slave_0: entered promiscuous mode [ 177.683056][ T8673] __nla_validate_parse: 8 callbacks suppressed [ 177.683075][ T8673] netlink: 32 bytes leftover after parsing attributes in process `syz.0.893'. [ 177.786959][ T8673] lo speed is unknown, defaulting to 1000 [ 178.433713][ T8694] netlink: 'syz.1.895': attribute type 2 has an invalid length. [ 178.619826][ T8698] netlink: 12 bytes leftover after parsing attributes in process `syz.0.896'. [ 178.646085][ T8694] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 178.936220][ T8701] netlink: 24 bytes leftover after parsing attributes in process `syz.4.897'. [ 179.097177][ T8708] netlink: 84 bytes leftover after parsing attributes in process `syz.0.900'. [ 179.350705][ T8718] netlink: 4 bytes leftover after parsing attributes in process `syz.4.902'. [ 179.351902][ T8719] netlink: 12 bytes leftover after parsing attributes in process `syz.1.904'. [ 179.379099][ T8718] netlink: 4 bytes leftover after parsing attributes in process `syz.4.902'. [ 179.421277][ T8719] netlink: 4 bytes leftover after parsing attributes in process `syz.1.904'. [ 179.569996][ T8724] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 179.916750][ T8738] netlink: 20 bytes leftover after parsing attributes in process `syz.4.911'. [ 179.993357][ T8741] netlink: 84 bytes leftover after parsing attributes in process `syz.2.913'. [ 180.308723][ T8747] netlink: 'syz.2.914': attribute type 8 has an invalid length. [ 180.564791][ T8755] xt_hashlimit: size too large, truncated to 1048576 [ 180.720198][ T8753] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 181.549236][ T8788] vlan2: entered promiscuous mode [ 181.640009][ T8790] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.703744][ T8790] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.797778][ T8790] tipc: Resetting bearer [ 181.808826][ T8790] tipc: Resetting bearer [ 181.868763][ T13] tipc: Resetting bearer [ 181.922462][ T8796] netlink: 'syz.0.932': attribute type 8 has an invalid length. [ 182.397654][ T8830] netlink: 'syz.0.942': attribute type 2 has an invalid length. [ 182.544454][ T8837] IPVS: sed: UDP 224.0.0.2:0 - no destination available [ 182.553018][ T8213] IPVS: starting estimator thread 0... [ 182.573492][ T8844] netlink: 'syz.1.941': attribute type 4 has an invalid length. [ 182.588984][ T8842] vlan2: entered promiscuous mode [ 182.641080][ T8828] netlink: 'syz.1.941': attribute type 4 has an invalid length. [ 182.676175][ T8845] IPVS: using max 27 ests per chain, 64800 per kthread [ 182.724642][ T8850] xt_bpf: check failed: parse error [ 183.804176][ T8887] __nla_validate_parse: 12 callbacks suppressed [ 183.804200][ T8887] netlink: 256 bytes leftover after parsing attributes in process `syz.0.959'. [ 183.914243][ T8890] netlink: 28 bytes leftover after parsing attributes in process `syz.0.959'. [ 183.933776][ T8890] netem: change failed [ 184.046195][ T8893] netlink: 4 bytes leftover after parsing attributes in process `syz.4.961'. [ 184.265029][ T8900] netlink: 8 bytes leftover after parsing attributes in process `syz.2.962'. [ 184.479225][ T8903] netlink: 'syz.3.963': attribute type 6 has an invalid length. [ 184.839787][ T8912] FAULT_INJECTION: forcing a failure. [ 184.839787][ T8912] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.876083][ T8912] CPU: 0 UID: 0 PID: 8912 Comm: syz.3.966 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 184.876113][ T8912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 184.876125][ T8912] Call Trace: [ 184.876134][ T8912] [ 184.876142][ T8912] dump_stack_lvl+0x189/0x250 [ 184.876176][ T8912] ? __pfx____ratelimit+0x10/0x10 [ 184.876197][ T8912] ? __pfx_dump_stack_lvl+0x10/0x10 [ 184.876226][ T8912] ? __pfx__printk+0x10/0x10 [ 184.876246][ T8912] ? __might_fault+0xb0/0x130 [ 184.876286][ T8912] should_fail_ex+0x414/0x560 [ 184.876316][ T8912] _copy_from_user+0x2d/0xb0 [ 184.876337][ T8912] ___sys_recvmsg+0x12e/0x510 [ 184.876372][ T8912] ? __pfx____sys_recvmsg+0x10/0x10 [ 184.876436][ T8912] ? __might_fault+0xb0/0x130 [ 184.876459][ T8912] do_recvmmsg+0x307/0x770 [ 184.876498][ T8912] ? __pfx_do_recvmmsg+0x10/0x10 [ 184.876540][ T8912] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 184.876581][ T8912] __x64_sys_recvmmsg+0x190/0x240 [ 184.876614][ T8912] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 184.876640][ T8912] ? rcu_is_watching+0x15/0xb0 [ 184.876674][ T8912] ? do_syscall_64+0xbe/0x3b0 [ 184.876700][ T8912] do_syscall_64+0xfa/0x3b0 [ 184.876718][ T8912] ? lockdep_hardirqs_on+0x9c/0x150 [ 184.876736][ T8912] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.876755][ T8912] ? clear_bhb_loop+0x60/0xb0 [ 184.876777][ T8912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.876796][ T8912] RIP: 0033:0x7f4de1f8e929 [ 184.876813][ T8912] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 184.876830][ T8912] RSP: 002b:00007f4de2e99038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 184.876851][ T8912] RAX: ffffffffffffffda RBX: 00007f4de21b5fa0 RCX: 00007f4de1f8e929 [ 184.876865][ T8912] RDX: 040000000000049e RSI: 0000200000000300 RDI: 0000000000000003 [ 184.876878][ T8912] RBP: 00007f4de2e99090 R08: 0000000000000000 R09: 0000000000000000 [ 184.876889][ T8912] R10: 00001000000000fe R11: 0000000000000246 R12: 0000000000000002 [ 184.876901][ T8912] R13: 0000000000000000 R14: 00007f4de21b5fa0 R15: 00007ffe32122748 [ 184.876933][ T8912] [ 185.313397][ T8919] netlink: 48 bytes leftover after parsing attributes in process `syz.3.970'. [ 185.531838][ T8928] netlink: 8 bytes leftover after parsing attributes in process `syz.3.970'. [ 185.637859][ T8934] xt_bpf: check failed: parse error [ 187.120080][ T8963] netlink: 84 bytes leftover after parsing attributes in process `syz.2.982'. [ 187.129408][ T8960] xt_CT: No such helper "snmp" [ 187.690230][ T8981] SET target dimension over the limit! [ 188.560507][ T9001] sch_tbf: peakrate 12 is lower than or equals to rate 6561010854487373889 ! [ 188.622745][ T9002] lo speed is unknown, defaulting to 1000 [ 188.957712][ T9011] netlink: 16 bytes leftover after parsing attributes in process `syz.0.998'. [ 188.993512][ T9011] netlink: 'syz.0.998': attribute type 4 has an invalid length. [ 189.053590][ T9015] netlink: 4 bytes leftover after parsing attributes in process `syz.4.999'. [ 189.089505][ T9015] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 189.259362][ T9021] netlink: 4 bytes leftover after parsing attributes in process `syz.4.999'. [ 189.302996][ T9023] sctp: [Deprecated]: syz.3.1002 (pid 9023) Use of int in max_burst socket option. [ 189.302996][ T9023] Use struct sctp_assoc_value instead [ 189.332949][ T9023] netlink: 'syz.3.1002': attribute type 10 has an invalid length. [ 189.358640][ T9023] team0: Port device wlan1 added [ 189.396239][ T9025] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1003'. [ 190.108026][ T9053] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1011'. [ 190.124204][ T9052] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1012'. [ 190.201444][ T9054] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1012'. [ 190.203634][ T9057] netlink: 'syz.4.1014': attribute type 30 has an invalid length. [ 190.596996][ T9062] lo speed is unknown, defaulting to 1000 [ 190.609175][ T9053] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1011'. [ 191.301175][ T9077] lo speed is unknown, defaulting to 1000 [ 191.517166][ T9080] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1017'. [ 191.528146][ T9086] vlan2: entered promiscuous mode [ 191.651464][ T9080] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 191.777134][ T9080] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 191.797311][ T9088] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1020'. [ 192.401409][ T9093] netlink: 'syz.3.1022': attribute type 83 has an invalid length. [ 192.426144][ T9093] wg2: left promiscuous mode [ 192.435963][ T9093] macvlan0: left allmulticast mode [ 192.449431][ T9093] bridge1: left allmulticast mode [ 192.757387][ T8882] Set syz1 is full, maxelem 65536 reached [ 193.024804][ T9112] xt_recent: hitcount (16777216) is larger than allowed maximum (65535) [ 193.720201][ T9151] bond2: entered promiscuous mode [ 193.726239][ T9151] 8021q: adding VLAN 0 to HW filter on device bond2 [ 194.078984][ T9169] __nla_validate_parse: 5 callbacks suppressed [ 194.079006][ T9169] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1044'. [ 194.138385][ T9172] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1045'. [ 194.276229][ T9180] xt_bpf: check failed: parse error [ 194.311012][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.320708][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.397012][ T9189] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 194.421121][ T9188] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1050'. [ 194.692242][ T9202] netlink: 'syz.1.1056': attribute type 1 has an invalid length. [ 194.813356][ T9209] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1059'. [ 194.827865][ T9204] lo speed is unknown, defaulting to 1000 [ 194.846903][ T9211] netlink: 'syz.1.1060': attribute type 2 has an invalid length. [ 194.963258][ T9211] : entered promiscuous mode [ 195.423981][ T9227] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1069'. [ 195.439236][ T9225] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1066'. [ 195.618014][ T9236] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1070'. [ 195.754936][ T9244] netlink: 'syz.2.1072': attribute type 11 has an invalid length. [ 195.770908][ T9244] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1072'. [ 196.109726][ T9253] vlan3: entered promiscuous mode [ 196.234268][ T9250] lo speed is unknown, defaulting to 1000 [ 196.546872][ T9270] netlink: 'syz.1.1080': attribute type 10 has an invalid length. [ 196.632422][ T9271] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1081'. [ 196.791974][ T9270] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 196.899797][ T9277] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1083'. [ 197.184551][ T9289] netlink: 'syz.0.1086': attribute type 5 has an invalid length. [ 198.122610][ T9312] syzkaller1: entered promiscuous mode [ 198.129268][ T9312] syzkaller1: entered allmulticast mode [ 198.193272][ T8012] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.238486][ T9322] netlink: 'syz.4.1098': attribute type 72 has an invalid length. [ 198.270534][ T8012] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.286870][ T8012] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 198.445716][ T9331] netlink: 'syz.0.1101': attribute type 7 has an invalid length. [ 198.482755][ T9331] netlink: 'syz.0.1101': attribute type 8 has an invalid length. [ 199.134868][ T9351] FAULT_INJECTION: forcing a failure. [ 199.134868][ T9351] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 199.185433][ T9351] CPU: 1 UID: 0 PID: 9351 Comm: syz.0.1109 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 199.185464][ T9351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 199.185476][ T9351] Call Trace: [ 199.185484][ T9351] [ 199.185492][ T9351] dump_stack_lvl+0x189/0x250 [ 199.185525][ T9351] ? __pfx____ratelimit+0x10/0x10 [ 199.185560][ T9351] ? __pfx_dump_stack_lvl+0x10/0x10 [ 199.185588][ T9351] ? __pfx__printk+0x10/0x10 [ 199.185609][ T9351] ? __might_fault+0xb0/0x130 [ 199.185642][ T9351] should_fail_ex+0x414/0x560 [ 199.185670][ T9351] _copy_from_user+0x2d/0xb0 [ 199.185697][ T9351] kstrtouint_from_user+0xc4/0x170 [ 199.185726][ T9351] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 199.185771][ T9351] proc_fail_nth_write+0x88/0x240 [ 199.185792][ T9351] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 199.185828][ T9351] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 199.185851][ T9351] vfs_write+0x27b/0xa90 [ 199.185890][ T9351] ? __pfx_vfs_write+0x10/0x10 [ 199.185918][ T9351] ? __fget_files+0x2a/0x420 [ 199.185942][ T9351] ? __fget_files+0x3a0/0x420 [ 199.185960][ T9351] ? __fget_files+0x2a/0x420 [ 199.185989][ T9351] ksys_write+0x145/0x250 [ 199.186011][ T9351] ? __pfx_ksys_write+0x10/0x10 [ 199.186026][ T9351] ? rcu_is_watching+0x15/0xb0 [ 199.186061][ T9351] ? do_syscall_64+0xbe/0x3b0 [ 199.186085][ T9351] do_syscall_64+0xfa/0x3b0 [ 199.186111][ T9351] ? lockdep_hardirqs_on+0x9c/0x150 [ 199.186129][ T9351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.186146][ T9351] ? clear_bhb_loop+0x60/0xb0 [ 199.186169][ T9351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.186187][ T9351] RIP: 0033:0x7fa433d8d3df [ 199.186205][ T9351] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 199.186221][ T9351] RSP: 002b:00007fa434c7c030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 199.186243][ T9351] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa433d8d3df [ 199.186264][ T9351] RDX: 0000000000000001 RSI: 00007fa434c7c0a0 RDI: 0000000000000005 [ 199.186275][ T9351] RBP: 00007fa434c7c090 R08: 0000000000000000 R09: 0000000000000000 [ 199.186286][ T9351] R10: 0000000004001c00 R11: 0000000000000293 R12: 0000000000000001 [ 199.186299][ T9351] R13: 0000000000000000 R14: 00007fa433fb5fa0 R15: 00007ffda33ad5d8 [ 199.186331][ T9351] [ 199.447759][ T9358] __nla_validate_parse: 8 callbacks suppressed [ 199.447781][ T9358] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1112'. [ 199.469003][ T9358] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1112'. [ 199.579988][ T9362] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1113'. [ 199.607632][ T9362] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1113'. [ 199.891317][ T9379] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1120'. [ 200.101016][ T9384] bridge_slave_1: left allmulticast mode [ 200.106737][ T9384] bridge_slave_1: left promiscuous mode [ 200.126874][ T9384] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.162912][ T9384] bridge_slave_0: left allmulticast mode [ 200.175203][ T9388] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1124'. [ 200.186455][ T9384] bridge_slave_0: left promiscuous mode [ 200.200976][ T9384] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.462095][ T9397] netlink: 3 bytes leftover after parsing attributes in process `syz.3.1125'. [ 200.480737][ T9397] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 201.024281][ T9410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1130'. [ 201.033686][ T9410] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1130'. [ 201.639401][ T9441] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 201.783288][ T9448] IPVS: Error connecting to the multicast addr [ 201.819302][ T9451] x_tables: duplicate underflow at hook 2 [ 201.858695][ T9454] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1146'. [ 203.427736][ T9519] xfrm1: entered promiscuous mode [ 203.438205][ T9526] netlink: 'syz.1.1172': attribute type 13 has an invalid length. [ 203.451246][ T9519] xfrm1: entered allmulticast mode [ 203.532336][ T9526] gretap0: refused to change device tx_queue_len [ 203.538742][ T9526] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 204.078594][ T9561] lo speed is unknown, defaulting to 1000 [ 204.446963][ T9575] netlink: 'syz.1.1186': attribute type 39 has an invalid length. [ 204.508670][ T9582] __nla_validate_parse: 7 callbacks suppressed [ 204.508689][ T9582] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1184'. [ 204.676524][ T9585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1184'. [ 204.846651][ T9585] lo speed is unknown, defaulting to 1000 [ 204.955187][ T9594] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 205.150891][ T9602] xt_bpf: check failed: parse error [ 205.205951][ T9598] lo speed is unknown, defaulting to 1000 [ 205.245321][ T9604] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1192'. [ 205.342855][ T9609] FAULT_INJECTION: forcing a failure. [ 205.342855][ T9609] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 205.370274][ T9609] CPU: 0 UID: 0 PID: 9609 Comm: syz.3.1197 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 205.370302][ T9609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 205.370314][ T9609] Call Trace: [ 205.370322][ T9609] [ 205.370330][ T9609] dump_stack_lvl+0x189/0x250 [ 205.370370][ T9609] ? __pfx____ratelimit+0x10/0x10 [ 205.370389][ T9609] ? __pfx_dump_stack_lvl+0x10/0x10 [ 205.370416][ T9609] ? __pfx__printk+0x10/0x10 [ 205.370451][ T9609] should_fail_ex+0x414/0x560 [ 205.370480][ T9609] _copy_to_user+0x31/0xb0 [ 205.370502][ T9609] simple_read_from_buffer+0xe1/0x170 [ 205.370527][ T9609] proc_fail_nth_read+0x1df/0x250 [ 205.370553][ T9609] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 205.370577][ T9609] ? rw_verify_area+0x258/0x650 [ 205.370603][ T9609] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 205.370626][ T9609] vfs_read+0x1fd/0x980 [ 205.370661][ T9609] ? __pfx___mutex_lock+0x10/0x10 [ 205.370681][ T9609] ? __pfx_vfs_read+0x10/0x10 [ 205.370711][ T9609] ? __fget_files+0x2a/0x420 [ 205.370737][ T9609] ? __fget_files+0x3a0/0x420 [ 205.370756][ T9609] ? __fget_files+0x2a/0x420 [ 205.370786][ T9609] ksys_read+0x145/0x250 [ 205.370802][ T9609] ? __fget_files+0x2a/0x420 [ 205.370825][ T9609] ? __pfx_ksys_read+0x10/0x10 [ 205.370860][ T9609] ? do_syscall_64+0xbe/0x3b0 [ 205.370885][ T9609] do_syscall_64+0xfa/0x3b0 [ 205.370903][ T9609] ? lockdep_hardirqs_on+0x9c/0x150 [ 205.370921][ T9609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.370940][ T9609] ? clear_bhb_loop+0x60/0xb0 [ 205.370964][ T9609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.370983][ T9609] RIP: 0033:0x7f4de1f8d33c [ 205.371001][ T9609] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 205.371018][ T9609] RSP: 002b:00007f4de2e99030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 205.371049][ T9609] RAX: ffffffffffffffda RBX: 00007f4de21b5fa0 RCX: 00007f4de1f8d33c [ 205.371063][ T9609] RDX: 000000000000000f RSI: 00007f4de2e990a0 RDI: 0000000000000003 [ 205.371075][ T9609] RBP: 00007f4de2e99090 R08: 0000000000000000 R09: 0000000000000000 [ 205.371086][ T9609] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 205.371097][ T9609] R13: 0000000000000000 R14: 00007f4de21b5fa0 R15: 00007ffe32122748 [ 205.371129][ T9609] [ 205.457737][ T9616] tipc: Can't bind to reserved service type 0 [ 205.688856][ T9624] 8021q: VLANs not supported on gre0 [ 205.788891][ T9629] vlan2: entered promiscuous mode [ 205.799365][ T9634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1196'. [ 206.042621][ T9643] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1202'. [ 206.547651][ T9657] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1209'. [ 206.617348][ T5838] Bluetooth: hci1: command 0x0406 tx timeout [ 206.617411][ T5157] Bluetooth: hci3: command 0x0406 tx timeout [ 206.623546][ T5838] Bluetooth: hci0: command 0x0406 tx timeout [ 206.630642][ T5157] Bluetooth: hci2: command 0x0406 tx timeout [ 206.910920][ T9672] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1213'. [ 207.274973][ T9695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1223'. [ 207.372313][ T9698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1225'. [ 207.382875][ T9698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1225'. [ 207.737314][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 208.305262][ T9728] vlan2: entered promiscuous mode [ 208.499566][ T9741] Cannot find del_set index 1 as target [ 208.556803][ T9741] lo: entered promiscuous mode [ 208.591301][ T9741] netlink: 'syz.2.1239': attribute type 1 has an invalid length. [ 208.626696][ T9741] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 208.828573][ T9761] netlink: 'syz.1.1245': attribute type 7 has an invalid length. [ 208.864749][ T9761] netlink: 'syz.1.1245': attribute type 8 has an invalid length. [ 208.920159][ T9751] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 208.946952][ T9761] gretap0: entered promiscuous mode [ 208.954597][ T9761] batadv_slave_1: entered promiscuous mode [ 208.983211][ T9761] hsr1: Slave A (gretap0) is not up; please bring it up to get a fully working HSR network [ 209.001382][ T9761] hsr1: Slave B (batadv_slave_1) is not up; please bring it up to get a fully working HSR network [ 209.014995][ T9757] lo speed is unknown, defaulting to 1000 [ 209.293154][ T9779] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 210.317896][ T9831] __nla_validate_parse: 5 callbacks suppressed [ 210.317919][ T9831] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1265'. [ 211.251511][ T9866] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1270'. [ 211.312545][ T9866] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1270'. [ 211.634790][ T9884] FAULT_INJECTION: forcing a failure. [ 211.634790][ T9884] name failslab, interval 1, probability 0, space 0, times 0 [ 211.652747][ T9887] vlan2: entered promiscuous mode [ 211.673692][ T9884] CPU: 1 UID: 0 PID: 9884 Comm: syz.4.1278 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 211.673721][ T9884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 211.673733][ T9884] Call Trace: [ 211.673741][ T9884] [ 211.673749][ T9884] dump_stack_lvl+0x189/0x250 [ 211.673781][ T9884] ? __pfx____ratelimit+0x10/0x10 [ 211.673812][ T9884] ? __pfx_dump_stack_lvl+0x10/0x10 [ 211.673838][ T9884] ? __pfx__printk+0x10/0x10 [ 211.673864][ T9884] ? ref_tracker_alloc+0x318/0x460 [ 211.673891][ T9884] should_fail_ex+0x414/0x560 [ 211.673920][ T9884] should_failslab+0xa8/0x100 [ 211.673941][ T9884] kmem_cache_alloc_noprof+0x73/0x3c0 [ 211.673966][ T9884] ? skb_clone+0x212/0x3a0 [ 211.673989][ T9884] skb_clone+0x212/0x3a0 [ 211.674012][ T9884] __netlink_deliver_tap+0x404/0x850 [ 211.674048][ T9884] ? netlink_deliver_tap+0x2e/0x1b0 [ 211.674072][ T9884] netlink_deliver_tap+0x19c/0x1b0 [ 211.674095][ T9884] netlink_unicast+0x72f/0x8d0 [ 211.674128][ T9884] netlink_sendmsg+0x805/0xb30 [ 211.674160][ T9884] ? __pfx_netlink_sendmsg+0x10/0x10 [ 211.674186][ T9884] ? aa_sock_msg_perm+0x94/0x160 [ 211.674213][ T9884] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 211.674235][ T9884] ? __pfx_netlink_sendmsg+0x10/0x10 [ 211.674259][ T9884] __sock_sendmsg+0x21c/0x270 [ 211.674284][ T9884] ____sys_sendmsg+0x505/0x830 [ 211.674318][ T9884] ? __pfx_____sys_sendmsg+0x10/0x10 [ 211.674356][ T9884] ? import_iovec+0x74/0xa0 [ 211.674380][ T9884] ___sys_sendmsg+0x21f/0x2a0 [ 211.674409][ T9884] ? __pfx____sys_sendmsg+0x10/0x10 [ 211.674478][ T9884] ? __fget_files+0x2a/0x420 [ 211.674499][ T9884] ? __fget_files+0x3a0/0x420 [ 211.674532][ T9884] __x64_sys_sendmsg+0x19b/0x260 [ 211.674562][ T9884] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 211.674600][ T9884] ? __pfx_ksys_write+0x10/0x10 [ 211.674625][ T9884] ? do_syscall_64+0xbe/0x3b0 [ 211.674649][ T9884] do_syscall_64+0xfa/0x3b0 [ 211.674665][ T9884] ? lockdep_hardirqs_on+0x9c/0x150 [ 211.674683][ T9884] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.674703][ T9884] ? clear_bhb_loop+0x60/0xb0 [ 211.674726][ T9884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.674744][ T9884] RIP: 0033:0x7f95dfd8e929 [ 211.674762][ T9884] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 211.674779][ T9884] RSP: 002b:00007f95e0b27038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 211.674809][ T9884] RAX: ffffffffffffffda RBX: 00007f95dffb5fa0 RCX: 00007f95dfd8e929 [ 211.674823][ T9884] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 211.674835][ T9884] RBP: 00007f95e0b27090 R08: 0000000000000000 R09: 0000000000000000 [ 211.674846][ T9884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 211.674856][ T9884] R13: 0000000000000000 R14: 00007f95dffb5fa0 R15: 00007ffdb42e0248 [ 211.674888][ T9884] [ 212.000024][ T9895] netlink: 332 bytes leftover after parsing attributes in process `syz.2.1282'. [ 212.009760][ T9895] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1282'. [ 212.054677][ T9895] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1282'. [ 212.151320][ T9894] pim6reg1: entered promiscuous mode [ 212.194192][ T9894] pim6reg1: entered allmulticast mode [ 212.299082][ T9906] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1284'. [ 212.502549][ T9910] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 212.647424][ T9916] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1288'. [ 212.671374][ T9918] netlink: 'syz.0.1289': attribute type 3 has an invalid length. [ 212.691222][ T9918] netlink: 'syz.0.1289': attribute type 3 has an invalid length. [ 212.920258][ T9928] pim6reg: entered allmulticast mode [ 213.010972][ T9928] pim6reg: left allmulticast mode [ 213.121032][ T9930] lo speed is unknown, defaulting to 1000 [ 213.151292][ T9944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.349545][ T9944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.396810][ T9944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 214.334634][ T9994] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1313'. [ 214.476544][T10000] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1314'. [ 214.623944][T10000] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 215.136333][T10019] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.174360][T10026] netlink: 'syz.3.1322': attribute type 15 has an invalid length. [ 215.291457][T10028] vlan2: entered promiscuous mode [ 215.387817][T10019] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.488680][T10019] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.582971][T10019] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.587305][T10039] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 215.621710][T10040] __nla_validate_parse: 3 callbacks suppressed [ 215.621731][T10040] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1326'. [ 215.782878][ T78] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 215.828460][ T78] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 215.901142][ T8018] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 215.926201][ T78] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 216.036513][T10056] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 216.351488][T10061] netlink: 332 bytes leftover after parsing attributes in process `syz.4.1334'. [ 216.398876][T10061] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1334'. [ 216.437817][T10061] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1334'. [ 216.720789][T10068] vlan2: entered promiscuous mode [ 217.380214][T10092] netlink: 'syz.3.1346': attribute type 16 has an invalid length. [ 217.388494][T10092] netlink: 'syz.3.1346': attribute type 17 has an invalid length. [ 217.424784][ T78] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.441584][ T78] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.454702][T10096] netlink: 332 bytes leftover after parsing attributes in process `syz.4.1348'. [ 217.461681][ T78] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 217.472586][T10096] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1348'. [ 217.480475][T10092] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1346'. [ 217.496946][T10098] IPv6: NLM_F_REPLACE set, but no existing node found! [ 217.509161][T10096] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1348'. [ 217.535469][T10097] netlink: 'syz.0.1349': attribute type 6 has an invalid length. [ 217.543531][T10097] netlink: 'syz.0.1349': attribute type 7 has an invalid length. [ 217.553665][T10097] netlink: 13182 bytes leftover after parsing attributes in process `syz.0.1349'. [ 217.633473][T10102] IPVS: set_ctl: invalid protocol: 209 172.20.20.187:20000 [ 217.686906][T10105] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1352'. [ 217.949498][T10111] vlan2: entered promiscuous mode [ 218.251627][T10119] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 218.516470][T10131] netlink: 'syz.2.1363': attribute type 1 has an invalid length. [ 218.587906][T10131] 8021q: adding VLAN 0 to HW filter on device bond3 [ 220.459538][T10181] lo speed is unknown, defaulting to 1000 [ 220.680220][T10190] lo speed is unknown, defaulting to 1000 [ 221.102028][T10181] __nla_validate_parse: 14 callbacks suppressed [ 221.102051][T10181] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1381'. [ 222.332386][T10235] netlink: 'syz.0.1396': attribute type 11 has an invalid length. [ 222.340265][T10235] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1396'. [ 222.427465][T10236] netlink: 'syz.0.1396': attribute type 1 has an invalid length. [ 222.461362][T10239] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1397'. [ 222.871168][T10249] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 223.883561][T10281] vlan2: entered promiscuous mode [ 223.999063][T10286] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1411'. [ 224.030929][T10285] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1411'. [ 224.050205][T10285] bridge_slave_1: left allmulticast mode [ 224.064610][T10285] bridge_slave_1: left promiscuous mode [ 224.093062][T10293] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1414'. [ 224.114070][T10285] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.141965][T10285] bridge_slave_0: left allmulticast mode [ 224.147710][T10285] bridge_slave_0: left promiscuous mode [ 224.159503][T10285] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.206817][T10293] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1414'. [ 224.391814][T10308] lo speed is unknown, defaulting to 1000 [ 224.415388][T10303] netlink: 'syz.2.1416': attribute type 1 has an invalid length. [ 224.681361][T10303] xt_CT: No such helper "snmp" [ 224.841600][T10330] vlan2: entered promiscuous mode [ 225.285063][T10353] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1431'. [ 225.285546][T10351] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1430'. [ 225.310931][T10353] unsupported nlmsg_type 40 [ 225.334705][T10351] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1430'. [ 225.734170][T10360] ip6gre1: entered promiscuous mode [ 226.227902][T10381] __nla_validate_parse: 1 callbacks suppressed [ 226.227923][T10381] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1442'. [ 226.277852][T10381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1442'. [ 226.538514][T10398] x_tables: duplicate underflow at hook 3 [ 226.610259][T10407] netlink: 'syz.0.1448': attribute type 21 has an invalid length. [ 226.618819][T10407] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1448'. [ 226.646943][T10407] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1448'. [ 226.661182][T10402] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1449'. [ 226.688089][T10406] netlink: 'syz.1.1450': attribute type 1 has an invalid length. [ 226.819497][T10406] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 227.116172][T10416] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1454'. [ 227.140708][T10416] tipc: Started in network mode [ 227.152312][T10416] tipc: Node identity fe800000000000000000000000000026, cluster identity 4711 [ 227.176276][T10416] tipc: Enabled bearer , priority 10 [ 227.315090][T10424] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1457'. [ 227.381843][T10424] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1457'. [ 227.559158][T10435] ieee802154 phy0 wpan0: encryption failed: -22 [ 228.040695][T10452] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1463'. [ 228.070080][T10452] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1463'. [ 228.205276][T10461] netlink: 'syz.3.1468': attribute type 10 has an invalid length. [ 228.293058][ T8228] tipc: Node number set to 4269801510 [ 228.298894][T10470] netlink: 'syz.3.1468': attribute type 10 has an invalid length. [ 228.356099][T10473] vlan2: entered promiscuous mode [ 228.726742][T10474] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 228.741463][T10474] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 228.895705][T10474] batman_adv: batadv0: Interface deactivated: macvlan2 [ 228.990079][ T8018] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.013117][ T8018] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.037222][ T8018] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.056085][ T8018] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.106041][T10497] netlink: 'syz.1.1477': attribute type 1 has an invalid length. [ 229.236332][T10497] 8021q: adding VLAN 0 to HW filter on device bond3 [ 229.602944][T10513] netlink: 'syz.0.1480': attribute type 1 has an invalid length. [ 229.610834][T10513] netlink: 'syz.0.1480': attribute type 3 has an invalid length. [ 229.769226][T10502] bond3 (unregistering): Released all slaves [ 230.285884][T10547] netlink: 'syz.0.1493': attribute type 1 has an invalid length. [ 230.618032][T10572] netlink: 'syz.4.1502': attribute type 4 has an invalid length. [ 230.633398][T10572] netlink: 'syz.4.1502': attribute type 4 has an invalid length. [ 230.973829][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 230.988200][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 231.005472][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 231.432126][T10593] xt_hashlimit: invalid interval [ 231.450089][T10594] xt_hashlimit: invalid interval [ 231.602219][ T8219] vxcan1 speed is unknown, defaulting to 1000 [ 231.613940][T10581] infiniband syz2: set active [ 231.625699][T10581] infiniband syz2: added vxcan1 [ 231.632817][T10581] syz2: rxe_create_cq: returned err = -12 [ 231.670813][T10581] infiniband syz2: Couldn't create ib_mad CQ [ 231.677047][T10581] infiniband syz2: Couldn't open port 1 [ 231.718204][T10603] lo speed is unknown, defaulting to 1000 [ 231.755561][T10599] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 231.757651][T10603] vxcan1 speed is unknown, defaulting to 1000 [ 231.809991][T10581] RDS/IB: syz2: added [ 231.811572][T10599] netlink: 'syz.4.1511': attribute type 13 has an invalid length. [ 231.845700][T10581] smc: adding ib device syz2 with port count 1 [ 231.845929][T10599] netlink: 'syz.4.1511': attribute type 17 has an invalid length. [ 231.874775][T10581] smc: ib device syz2 port 1 has pnetid [ 231.889511][ T8219] vxcan1 speed is unknown, defaulting to 1000 [ 231.934264][T10599] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 232.231879][T10638] x_tables: duplicate underflow at hook 1 [ 232.276104][T10638] __nla_validate_parse: 14 callbacks suppressed [ 232.276127][T10638] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1519'. [ 232.340745][T10638] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1519'. [ 232.651281][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 232.715275][T10653] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1523'. [ 232.767848][T10653] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1523'. [ 233.006107][T10657] vlan2: entered promiscuous mode [ 233.217774][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 233.456084][T10670] xt_hashlimit: size too large, truncated to 1048576 [ 233.784994][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 234.069507][T10690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1534'. [ 234.078764][T10690] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1534'. [ 234.095156][T10690] validate_nla: 2 callbacks suppressed [ 234.095173][T10690] netlink: 'syz.0.1534': attribute type 7 has an invalid length. [ 234.125010][T10691] netlink: 'syz.0.1534': attribute type 3 has an invalid length. [ 234.153748][T10691] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1534'. [ 234.179988][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 234.514980][T10581] vxcan1 speed is unknown, defaulting to 1000 [ 234.734919][T10706] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1538'. [ 234.777005][T10706] netlink: 'syz.0.1538': attribute type 1 has an invalid length. [ 234.795386][T10706] netlink: 5624 bytes leftover after parsing attributes in process `syz.0.1538'. [ 234.835933][T10706] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1538'. [ 235.488085][T10717] netlink: 'syz.2.1540': attribute type 10 has an invalid length. [ 235.690145][T10713] bond0: (slave batadv0): Releasing backup interface [ 235.728872][T10713] bridge_slave_0: left allmulticast mode [ 235.742552][T10713] bridge_slave_0: left promiscuous mode [ 235.748677][T10713] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.773571][T10713] bridge_slave_1: left allmulticast mode [ 235.779391][T10713] bridge_slave_1: left promiscuous mode [ 235.789765][T10713] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.826034][T10713] bond0: (slave bond_slave_0): Releasing backup interface [ 235.881798][T10713] bond0: (slave bond_slave_1): Releasing backup interface [ 235.980802][T10713] team0: Port device team_slave_0 removed [ 236.013539][T10713] team0: Port device team_slave_1 removed [ 236.033305][T10713] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 236.044276][T10713] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 236.070132][T10713] batman_adv: batadv0: Interface deactivated: vlan1 [ 236.077869][T10713] batman_adv: batadv0: Removing interface: vlan1 [ 236.106284][T10713] batman_adv: batadv0: Interface deactivated: macsec1 [ 236.130636][T10713] batman_adv: batadv0: Removing interface: macsec1 [ 236.195589][T10717] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 236.334369][T10721] bond0: entered promiscuous mode [ 236.339565][T10721] bond_slave_0: entered promiscuous mode [ 236.346986][T10721] bond_slave_1: entered promiscuous mode [ 236.368953][T10721] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 236.382606][T10721] bond0: entered allmulticast mode [ 236.388450][T10721] bond_slave_0: entered allmulticast mode [ 236.396702][T10721] bond_slave_1: entered allmulticast mode [ 236.403717][T10721] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode [ 236.414432][ T8228] vxcan1 speed is unknown, defaulting to 1000 [ 236.429608][T10729] ip_vti0: entered promiscuous mode [ 236.472205][T10740] xt_TPROXY: Can be used only with -p tcp or -p udp [ 237.141503][T10766] vlan2: entered promiscuous mode [ 237.654823][T10776] sit0: left promiscuous mode [ 237.706166][T10779] netlink: 'syz.0.1559': attribute type 1 has an invalid length. [ 237.753251][T10779] __nla_validate_parse: 5 callbacks suppressed [ 237.753273][T10779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1559'. [ 237.927268][T10788] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 237.944637][T10787] C: renamed from lo [ 237.974368][T10787] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 238.122676][T10794] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1565'. [ 238.141670][T10794] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1565'. [ 238.164001][T10798] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1568'. [ 238.325059][T10805] veth0_to_batadv: entered promiscuous mode [ 238.332976][T10805] veth0_to_batadv: entered allmulticast mode [ 238.371266][T10806] vlan2: entered promiscuous mode [ 238.615709][T10825] gtp0: entered promiscuous mode [ 238.621666][T10825] gtp0: entered allmulticast mode [ 238.655959][T10826] C speed is unknown, defaulting to 1000 [ 238.664988][T10826] vxcan1 speed is unknown, defaulting to 1000 [ 238.730119][T10830] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 239.270984][T10847] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1584'. [ 239.478292][T10851] netlink: 'syz.1.1586': attribute type 1 has an invalid length. [ 239.493418][T10851] netlink: 208 bytes leftover after parsing attributes in process `syz.1.1586'. [ 239.520248][T10851] netlink: 'syz.1.1586': attribute type 1 has an invalid length. [ 239.533879][T10851] netlink: 'syz.1.1586': attribute type 2 has an invalid length. [ 239.560610][T10851] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1586'. [ 239.701940][T10851] sit1: entered promiscuous mode [ 239.742876][T10856] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1587'. [ 239.757588][T10856] xt_hashlimit: max too large, truncated to 1048576 [ 239.770649][T10856] netlink: 'syz.3.1587': attribute type 10 has an invalid length. [ 239.789276][T10856] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 239.917136][T10861] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1589'. [ 239.975556][T10863] netlink: 'syz.0.1590': attribute type 1 has an invalid length. [ 240.042390][T10863] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1590'. [ 240.909648][T10900] netlink: 'syz.1.1604': attribute type 1 has an invalid length. [ 240.964697][T10900] 8021q: adding VLAN 0 to HW filter on device bond3 [ 240.999800][T10900] gretap1: entered promiscuous mode [ 241.011186][T10900] bond3: (slave gretap1): making interface the new active one [ 241.021275][T10900] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 241.208985][T10906] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 241.246704][T10909] netlink: 'syz.0.1608': attribute type 1 has an invalid length. [ 241.485410][T10911] bond4: (slave gretap1): making interface the new active one [ 241.519070][T10911] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 241.755319][T10933] netlink: 'syz.0.1618': attribute type 1 has an invalid length. [ 241.936790][T10943] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 242.006272][T10926] team0: Port device macvlan0 removed [ 242.257846][T10956] C speed is unknown, defaulting to 1000 [ 242.266534][T10956] vxcan1 speed is unknown, defaulting to 1000 [ 242.923169][T10969] __nla_validate_parse: 8 callbacks suppressed [ 242.923191][T10969] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1628'. [ 242.942987][T10969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1628'. [ 242.961048][T10969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1628'. [ 243.162235][T10976] FAULT_INJECTION: forcing a failure. [ 243.162235][T10976] name failslab, interval 1, probability 0, space 0, times 0 [ 243.207353][T10976] CPU: 1 UID: 0 PID: 10976 Comm: syz.3.1630 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 243.207383][T10976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 243.207394][T10976] Call Trace: [ 243.207402][T10976] [ 243.207411][T10976] dump_stack_lvl+0x189/0x250 [ 243.207452][T10976] ? __pfx____ratelimit+0x10/0x10 [ 243.207473][T10976] ? __pfx_dump_stack_lvl+0x10/0x10 [ 243.207499][T10976] ? __pfx__printk+0x10/0x10 [ 243.207525][T10976] ? __pfx___might_resched+0x10/0x10 [ 243.207558][T10976] should_fail_ex+0x414/0x560 [ 243.207587][T10976] ? alloc_netdev_mqs+0xa3/0x1170 [ 243.207604][T10976] should_failslab+0xa8/0x100 [ 243.207626][T10976] __kvmalloc_node_noprof+0x161/0x5f0 [ 243.207646][T10976] ? alloc_netdev_mqs+0xa3/0x1170 [ 243.207663][T10976] ? aa_get_newest_label+0xf7/0x5d0 [ 243.207689][T10976] alloc_netdev_mqs+0xa3/0x1170 [ 243.207706][T10976] ? __pfx_ipgre_tunnel_setup+0x10/0x10 [ 243.207741][T10976] __ip_tunnel_create+0x349/0x560 [ 243.207766][T10976] ? __pfx___ip_tunnel_create+0x10/0x10 [ 243.207787][T10976] ? bpf_lsm_capable+0x9/0x20 [ 243.207803][T10976] ? security_capable+0x7e/0x2e0 [ 243.207834][T10976] ip_tunnel_ctl+0x4dd/0xc30 [ 243.207860][T10976] ipgre_tunnel_ctl+0x2ef/0x5c0 [ 243.207883][T10976] ip_tunnel_siocdevprivate+0xf2/0x180 [ 243.207898][T10976] ? __mutex_lock+0x51b/0xe80 [ 243.207916][T10976] ? __pfx_ip_tunnel_siocdevprivate+0x10/0x10 [ 243.207941][T10976] ? netdev_name_node_lookup+0xdf/0x120 [ 243.207961][T10976] dev_ifsioc+0xb54/0xf00 [ 243.207988][T10976] dev_ioctl+0x84c/0x1150 [ 243.208010][T10976] sock_ioctl+0x719/0x790 [ 243.208029][T10976] ? __pfx_sock_ioctl+0x10/0x10 [ 243.208051][T10976] ? __fget_files+0x3a0/0x420 [ 243.208068][T10976] ? __fget_files+0x2a/0x420 [ 243.208090][T10976] ? bpf_lsm_file_ioctl+0x9/0x20 [ 243.208115][T10976] ? __pfx_sock_ioctl+0x10/0x10 [ 243.208133][T10976] __se_sys_ioctl+0xfc/0x170 [ 243.208164][T10976] do_syscall_64+0xfa/0x3b0 [ 243.208183][T10976] ? lockdep_hardirqs_on+0x9c/0x150 [ 243.208200][T10976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.208217][T10976] ? clear_bhb_loop+0x60/0xb0 [ 243.208240][T10976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.208257][T10976] RIP: 0033:0x7f4de1f8e929 [ 243.208275][T10976] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 243.208290][T10976] RSP: 002b:00007f4de2e99038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 243.208310][T10976] RAX: ffffffffffffffda RBX: 00007f4de21b5fa0 RCX: 00007f4de1f8e929 [ 243.208324][T10976] RDX: 0000200000001040 RSI: 00000000000089f1 RDI: 0000000000000003 [ 243.208336][T10976] RBP: 00007f4de2e99090 R08: 0000000000000000 R09: 0000000000000000 [ 243.208347][T10976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 243.208356][T10976] R13: 0000000000000000 R14: 00007f4de21b5fa0 R15: 00007ffe32122748 [ 243.208392][T10976] [ 243.628708][T10988] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1633'. [ 244.027456][T11002] netlink: 160 bytes leftover after parsing attributes in process `syz.2.1638'. [ 244.064639][T11002] openvswitch: netlink: Flow key attr not present in new flow. [ 244.257068][T11010] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1639'. [ 244.292513][T11010] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1639'. [ 244.351161][T11017] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1641'. [ 245.671303][T11077] netlink: 'syz.2.1659': attribute type 1 has an invalid length. [ 245.679095][T11077] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.1659'. [ 245.701264][T11077] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1659'. [ 246.129246][T11099] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 246.339217][T11108] FAULT_INJECTION: forcing a failure. [ 246.339217][T11108] name failslab, interval 1, probability 0, space 0, times 0 [ 246.353770][T11108] CPU: 0 UID: 0 PID: 11108 Comm: syz.3.1668 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 246.353799][T11108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 246.353810][T11108] Call Trace: [ 246.353817][T11108] [ 246.353824][T11108] dump_stack_lvl+0x189/0x250 [ 246.353857][T11108] ? __pfx____ratelimit+0x10/0x10 [ 246.353876][T11108] ? __pfx_dump_stack_lvl+0x10/0x10 [ 246.353903][T11108] ? __pfx__printk+0x10/0x10 [ 246.353931][T11108] ? __pfx___might_resched+0x10/0x10 [ 246.353964][T11108] should_fail_ex+0x414/0x560 [ 246.353992][T11108] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 246.354010][T11108] should_failslab+0xa8/0x100 [ 246.354032][T11108] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 246.354049][T11108] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 246.354068][T11108] ? alloc_inode+0x67/0x1b0 [ 246.354092][T11108] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 246.354110][T11108] alloc_inode+0x67/0x1b0 [ 246.354132][T11108] new_inode+0x22/0x170 [ 246.354159][T11108] __debugfs_create_file+0x14d/0x4f0 [ 246.354194][T11108] debugfs_create_file_full+0x3f/0x60 [ 246.354226][T11108] ref_tracker_dir_debugfs+0x14e/0x270 [ 246.354251][T11108] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 246.354306][T11108] ? rcu_is_watching+0x15/0xb0 [ 246.354332][T11108] ? alloc_netdev_mqs+0xa3/0x1170 [ 246.354356][T11108] ? __raw_spin_lock_init+0x45/0x100 [ 246.354381][T11108] alloc_netdev_mqs+0x26f/0x1170 [ 246.354398][T11108] ? __pfx_ipgre_tunnel_setup+0x10/0x10 [ 246.354433][T11108] __ip_tunnel_create+0x349/0x560 [ 246.354455][T11108] ? __pfx___ip_tunnel_create+0x10/0x10 [ 246.354474][T11108] ? bpf_lsm_capable+0x9/0x20 [ 246.354491][T11108] ? security_capable+0x7e/0x2e0 [ 246.354523][T11108] ip_tunnel_ctl+0x4dd/0xc30 [ 246.354549][T11108] ipgre_tunnel_ctl+0x2ef/0x5c0 [ 246.354576][T11108] ip_tunnel_siocdevprivate+0xf2/0x180 [ 246.354594][T11108] ? __mutex_lock+0x51b/0xe80 [ 246.354617][T11108] ? __pfx_ip_tunnel_siocdevprivate+0x10/0x10 [ 246.354650][T11108] ? netdev_name_node_lookup+0xdf/0x120 [ 246.354682][T11108] dev_ifsioc+0xb54/0xf00 [ 246.354717][T11108] dev_ioctl+0x84c/0x1150 [ 246.354746][T11108] sock_ioctl+0x719/0x790 [ 246.354770][T11108] ? __pfx_sock_ioctl+0x10/0x10 [ 246.354792][T11108] ? __fget_files+0x3a0/0x420 [ 246.354812][T11108] ? __fget_files+0x2a/0x420 [ 246.354836][T11108] ? bpf_lsm_file_ioctl+0x9/0x20 [ 246.354860][T11108] ? __pfx_sock_ioctl+0x10/0x10 [ 246.354880][T11108] __se_sys_ioctl+0xfc/0x170 [ 246.354911][T11108] do_syscall_64+0xfa/0x3b0 [ 246.354929][T11108] ? lockdep_hardirqs_on+0x9c/0x150 [ 246.354945][T11108] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.354962][T11108] ? clear_bhb_loop+0x60/0xb0 [ 246.354984][T11108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.355001][T11108] RIP: 0033:0x7f4de1f8e929 [ 246.355020][T11108] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 246.355036][T11108] RSP: 002b:00007f4de2e99038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 246.355056][T11108] RAX: ffffffffffffffda RBX: 00007f4de21b5fa0 RCX: 00007f4de1f8e929 [ 246.355069][T11108] RDX: 0000200000001040 RSI: 00000000000089f1 RDI: 0000000000000003 [ 246.355080][T11108] RBP: 00007f4de2e99090 R08: 0000000000000000 R09: 0000000000000000 [ 246.355092][T11108] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 246.355103][T11108] R13: 0000000000000000 R14: 00007f4de21b5fa0 R15: 00007ffe32122748 [ 246.355137][T11108] [ 246.356280][T11108] debugfs: out of free dentries, can not create file 'netdev@ffff8880782fe610' [ 246.590705][T11112] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 247.064912][T11135] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 247.543333][T11155] FAULT_INJECTION: forcing a failure. [ 247.543333][T11155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.579253][T11154] C speed is unknown, defaulting to 1000 [ 247.664156][T11154] vxcan1 speed is unknown, defaulting to 1000 [ 247.678895][T11155] CPU: 1 UID: 0 PID: 11155 Comm: syz.3.1687 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 247.678926][T11155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 247.678937][T11155] Call Trace: [ 247.678944][T11155] [ 247.678953][T11155] dump_stack_lvl+0x189/0x250 [ 247.678987][T11155] ? __pfx____ratelimit+0x10/0x10 [ 247.679007][T11155] ? __pfx_dump_stack_lvl+0x10/0x10 [ 247.679035][T11155] ? __pfx__printk+0x10/0x10 [ 247.679056][T11155] ? __might_fault+0xb0/0x130 [ 247.679088][T11155] should_fail_ex+0x414/0x560 [ 247.679117][T11155] _copy_from_iter+0x1db/0x16f0 [ 247.679149][T11155] ? rcu_is_watching+0x15/0xb0 [ 247.679178][T11155] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 247.679199][T11155] ? __pfx__copy_from_iter+0x10/0x10 [ 247.679228][T11155] ? __build_skb_around+0x257/0x3e0 [ 247.679257][T11155] ? netlink_sendmsg+0x642/0xb30 [ 247.679279][T11155] ? skb_put+0x11b/0x210 [ 247.679309][T11155] netlink_sendmsg+0x6b2/0xb30 [ 247.679344][T11155] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.679371][T11155] ? aa_sock_msg_perm+0x94/0x160 [ 247.679398][T11155] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 247.679431][T11155] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.679456][T11155] __sock_sendmsg+0x21c/0x270 [ 247.679482][T11155] ____sys_sendmsg+0x505/0x830 [ 247.679516][T11155] ? __pfx_____sys_sendmsg+0x10/0x10 [ 247.679553][T11155] ? import_iovec+0x74/0xa0 [ 247.679576][T11155] ___sys_sendmsg+0x21f/0x2a0 [ 247.679606][T11155] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.679675][T11155] ? __fget_files+0x2a/0x420 [ 247.679695][T11155] ? __fget_files+0x3a0/0x420 [ 247.679727][T11155] __x64_sys_sendmsg+0x19b/0x260 [ 247.679758][T11155] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 247.679797][T11155] ? rcu_is_watching+0x15/0xb0 [ 247.679829][T11155] ? do_syscall_64+0xbe/0x3b0 [ 247.679853][T11155] do_syscall_64+0xfa/0x3b0 [ 247.679871][T11155] ? lockdep_hardirqs_on+0x9c/0x150 [ 247.679889][T11155] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.679907][T11155] ? clear_bhb_loop+0x60/0xb0 [ 247.679930][T11155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.679948][T11155] RIP: 0033:0x7f4de1f8e929 [ 247.679966][T11155] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 247.679982][T11155] RSP: 002b:00007f4de2e99038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 247.680004][T11155] RAX: ffffffffffffffda RBX: 00007f4de21b5fa0 RCX: 00007f4de1f8e929 [ 247.680018][T11155] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 247.680030][T11155] RBP: 00007f4de2e99090 R08: 0000000000000000 R09: 0000000000000000 [ 247.680041][T11155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.680052][T11155] R13: 0000000000000000 R14: 00007f4de21b5fa0 R15: 00007ffe32122748 [ 247.680085][T11155] [ 247.987320][T11160] delete_channel: no stack [ 248.280306][T11166] netlink: 'syz.4.1691': attribute type 21 has an invalid length. [ 248.357566][T11166] netlink: 'syz.4.1691': attribute type 6 has an invalid length. [ 248.378098][T11168] __nla_validate_parse: 5 callbacks suppressed [ 248.378120][T11168] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1692'. [ 248.386622][T11166] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1691'. [ 248.440041][T11166] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1691'. [ 248.450983][T11162] C speed is unknown, defaulting to 1000 [ 248.458092][T11168] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1692'. [ 248.514954][T11171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1691'. [ 248.570182][T11171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1691'. [ 248.724327][T11174] vlan2: entered promiscuous mode [ 248.915165][T11186] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1696'. [ 248.933121][ T8009] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.955077][ T8009] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.991646][ T8009] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.037677][ T8009] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.123978][T11196] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1698'. [ 249.208687][T11162] vxcan1 speed is unknown, defaulting to 1000 [ 249.556256][T11208] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1701'. [ 249.567374][T11208] openvswitch: netlink: nsh attr 12 is out of range max 3 [ 249.584854][T11208] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 249.753245][T11221] IPVS: set_ctl: invalid protocol: 47 10.1.1.0:20000 [ 249.915018][T11233] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1709'. [ 249.955565][T11225] C speed is unknown, defaulting to 1000 [ 250.052091][T11225] vxcan1 speed is unknown, defaulting to 1000 [ 250.087494][ T1110] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 250.122764][ T8213] hid (null): unknown global tag 0xc [ 250.224575][ T1110] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 250.230857][ T8213] hid-generic 0005:046D:0005.0001: unknown main item tag 0x3 [ 250.244769][ T8213] hid-generic 0005:046D:0005.0001: reserved main item tag 0xe [ 250.246731][T11240] IPVS: Unknown mcast interface: vlan0 [ 250.252748][ T8213] hid-generic 0005:046D:0005.0001: unknown main item tag 0x7 [ 250.265904][ T8213] hid-generic 0005:046D:0005.0001: unknown main item tag 0x7 [ 250.274068][ T1110] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 250.292120][ T1110] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 250.321998][ T8213] hid-generic 0005:046D:0005.0001: unknown global tag 0xc [ 250.329287][ T8213] hid-generic 0005:046D:0005.0001: item 0 0 1 12 parsing failed [ 250.338376][ T8213] hid-generic 0005:046D:0005.0001: probe with driver hid-generic failed with error -22 [ 250.725907][T11245] netlink: 'syz.3.1713': attribute type 1 has an invalid length. [ 251.291498][T11267] dvmrp3: entered allmulticast mode [ 251.725982][T11277] C speed is unknown, defaulting to 1000 [ 251.785690][T11277] vxcan1 speed is unknown, defaulting to 1000 [ 252.768284][T11315] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 253.085815][T11328] ip6t_srh: unknown srh match flags 4000 [ 253.533874][T11347] netlink: 'syz.1.1740': attribute type 10 has an invalid length. [ 253.547471][T11353] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 253.554436][T11347] openvswitch: netlink: Flow key attr not present in new flow. [ 253.682454][T11351] C speed is unknown, defaulting to 1000 [ 253.709258][T11351] vxcan1 speed is unknown, defaulting to 1000 [ 253.853044][T11362] __nla_validate_parse: 13 callbacks suppressed [ 253.853066][T11362] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1745'. [ 253.928910][T11362] netlink: 13 bytes leftover after parsing attributes in process `syz.2.1745'. [ 254.400902][T11388] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 254.564547][T11392] Cannot find set identified by id 3 to match [ 255.290623][T11419] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1764'. [ 255.734800][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.047960][T11442] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1773'. [ 256.098649][T11440] C speed is unknown, defaulting to 1000 [ 256.144107][T11440] vxcan1 speed is unknown, defaulting to 1000 [ 256.921570][T11452] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1776'. [ 256.963637][T11452] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 257.150136][T11459] tipc: Started in network mode [ 257.159641][T11459] tipc: Node identity , cluster identity 4711 [ 257.181832][T11459] tipc: Failed to obtain node identity [ 257.188565][T11459] tipc: Enabling of bearer rejected, failed to enable media [ 257.329954][T11464] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1780'. [ 257.673030][T11478] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1783'. [ 258.623910][T11499] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 259.071246][T11520] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1795'. [ 259.160955][T11525] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 259.312937][T11524] C speed is unknown, defaulting to 1000 [ 259.356075][T11524] vxcan1 speed is unknown, defaulting to 1000 [ 259.383237][T11535] netlink: 332 bytes leftover after parsing attributes in process `syz.4.1800'. [ 259.411751][T11535] netlink: 196 bytes leftover after parsing attributes in process `syz.4.1800'. [ 259.435222][T11536] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1799'. [ 259.673585][T11546] netlink: del zone limit has 4 unknown bytes [ 260.541122][T11567] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 260.785539][T11579] netlink: 332 bytes leftover after parsing attributes in process `syz.1.1812'. [ 260.798373][T11579] netlink: 196 bytes leftover after parsing attributes in process `syz.1.1812'. [ 261.518663][T11599] C speed is unknown, defaulting to 1000 [ 261.602470][T11599] vxcan1 speed is unknown, defaulting to 1000 [ 261.927333][T11616] netlink: 'syz.4.1825': attribute type 58 has an invalid length. [ 261.949523][T11616] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1825'. [ 262.294357][T11629] netlink: 332 bytes leftover after parsing attributes in process `syz.4.1827'. [ 262.325934][T11629] netlink: 196 bytes leftover after parsing attributes in process `syz.4.1827'. [ 262.808379][T11650] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1833'. [ 263.518908][T11669] C speed is unknown, defaulting to 1000 [ 263.866748][T11684] C speed is unknown, defaulting to 1000 [ 264.030644][T11669] vxcan1 speed is unknown, defaulting to 1000 [ 264.346154][T11672] __nla_validate_parse: 4 callbacks suppressed [ 264.346175][T11672] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1838'. [ 264.439940][T11701] (unnamed net_device) (uninitialized): option downdelay: invalid value (18446744073709551615) [ 264.467780][T11701] (unnamed net_device) (uninitialized): option downdelay: allowed values 0 - 2147483647 [ 264.904305][T11684] vxcan1 speed is unknown, defaulting to 1000 [ 264.940272][T11710] netlink: 332 bytes leftover after parsing attributes in process `syz.1.1850'. [ 264.970318][T11710] netlink: 160 bytes leftover after parsing attributes in process `syz.1.1850'. [ 265.139873][T11714] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1852'. [ 265.398340][T11724] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1855'. [ 265.430227][T11724] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1855'. [ 265.632946][T11729] netlink: 'syz.4.1857': attribute type 10 has an invalid length. [ 265.651414][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 265.854043][T11733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1859'. [ 265.889701][T11735] x_tables: duplicate underflow at hook 2 [ 265.905267][T11733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1859'. [ 265.930978][T11733] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1859'. [ 266.879386][T11753] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1866'. [ 267.481570][T11771] netlink: 'syz.3.1872': attribute type 32 has an invalid length. [ 267.723517][T11777] C speed is unknown, defaulting to 1000 [ 267.751838][T11777] vxcan1 speed is unknown, defaulting to 1000 [ 267.830898][T11787] netlink: 'syz.0.1875': attribute type 31 has an invalid length. [ 268.385944][T11794] netlink: 'syz.0.1877': attribute type 8 has an invalid length. [ 269.725491][T11837] C speed is unknown, defaulting to 1000 [ 269.756344][T11837] vxcan1 speed is unknown, defaulting to 1000 [ 270.174648][T11848] __nla_validate_parse: 5 callbacks suppressed [ 270.174670][T11848] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1891'. [ 270.645667][T11857] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 270.665278][T11857] macsec2: entered allmulticast mode [ 270.686131][T11857] bond0: entered allmulticast mode [ 270.705081][T11857] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 270.739620][T11857] bond0: left allmulticast mode [ 270.765416][T11857] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 270.776370][T11857] mac80211_hwsim hwsim7 wlan1: left promiscuous mode [ 271.191392][T11860] netlink: 'syz.3.1888': attribute type 6 has an invalid length. [ 272.920734][T11898] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1908'. [ 272.951526][T11899] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1908'. [ 273.058641][T11902] C: renamed from team_slave_0 [ 273.084216][ T5845] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 273.096127][T11902] netlink: 'syz.2.1909': attribute type 8 has an invalid length. [ 273.105241][T11910] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1911'. [ 273.107557][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 273.130211][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 273.131930][T11902] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 273.165875][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 273.173954][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 273.392867][T11917] netlink: 'syz.0.1914': attribute type 21 has an invalid length. [ 273.410540][T11917] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1914'. [ 273.435116][T11908] C speed is unknown, defaulting to 1000 [ 273.440164][T11917] netlink: 'syz.0.1914': attribute type 5 has an invalid length. [ 273.484013][T11917] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1914'. [ 273.508833][T11908] vxcan1 speed is unknown, defaulting to 1000 [ 273.782707][T11937] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1918'. [ 274.155584][T11943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1920'. [ 274.209643][T11943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1920'. [ 274.939182][T11952] bond5: entered allmulticast mode [ 275.031473][T11967] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1925'. [ 275.118806][T11966] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 275.146792][T11908] chnl_net:caif_netlink_parms(): no params data found [ 275.199282][T11958] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1925'. [ 275.250511][ T5846] Bluetooth: hci3: command tx timeout [ 275.481231][T11908] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.494321][T11908] bridge0: port 1(bridge_slave_0) entered disabled state [ 275.505828][T11908] bridge_slave_0: entered allmulticast mode [ 275.516333][T11908] bridge_slave_0: entered promiscuous mode [ 275.536118][T11908] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.548011][T11908] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.566298][T11908] bridge_slave_1: entered allmulticast mode [ 275.578582][T11908] bridge_slave_1: entered promiscuous mode [ 275.731245][T11908] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 275.782302][T11908] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 275.940034][T11993] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1936'. [ 275.958212][T11997] netlink: 'syz.0.1935': attribute type 1 has an invalid length. [ 275.991438][T11908] team0: Port device team_slave_0 added [ 276.000911][T11992] macvtap0: entered promiscuous mode [ 276.006233][T11992] macvtap0: entered allmulticast mode [ 276.035173][T11908] team0: Port device team_slave_1 added [ 276.229531][T11908] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 276.247275][T11908] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 276.330743][T11908] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 276.367091][T11908] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 276.397160][T11908] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 276.397859][T12010] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1939'. [ 276.460572][T11908] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 276.632838][T11908] hsr_slave_0: entered promiscuous mode [ 276.639989][T11908] hsr_slave_1: entered promiscuous mode [ 276.642537][T12013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1939'. [ 276.671738][T11908] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 276.679347][T11908] Cannot create hsr debugfs directory [ 277.169684][T12026] xt_bpf: check failed: parse error [ 277.269236][T11908] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 277.330612][ T5846] Bluetooth: hci3: command tx timeout [ 277.402688][T11908] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 277.578352][T11908] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 277.712225][T11908] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 277.756320][T12054] xt_hashlimit: size too large, truncated to 1048576 [ 277.827725][T12057] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1954'. [ 278.213046][T12066] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 278.242564][T11908] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 278.275251][T11908] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 278.311100][T11908] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 278.346915][T11908] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 278.554861][T11908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 278.625389][T11908] 8021q: adding VLAN 0 to HW filter on device team0 [ 278.672035][ T8018] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.679235][ T8018] bridge0: port 1(bridge_slave_0) entered forwarding state [ 278.762921][ T8018] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.770148][ T8018] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.115864][T12095] C speed is unknown, defaulting to 1000 [ 279.163555][T12095] vxcan1 speed is unknown, defaulting to 1000 [ 279.413116][ T5846] Bluetooth: hci3: command tx timeout [ 279.995995][T12114] netlink: 'syz.1.1969': attribute type 10 has an invalid length. [ 279.998883][T11908] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.275378][T12093] infiniband syz0: set down [ 280.287241][T12093] infiniband syz0: added bond_slave_1 [ 280.322126][T12093] syz0: rxe_create_cq: returned err = -12 [ 280.327978][T12093] infiniband syz0: Couldn't create ib_mad CQ [ 280.360640][T12118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1970'. [ 280.366242][T12093] infiniband syz0: Couldn't open port 1 [ 280.515391][T12093] RDS/IB: syz0: added [ 280.550794][T12093] smc: adding ib device syz0 with port count 1 [ 280.557042][T12093] smc: ib device syz0 port 1 has pnetid [ 280.994266][T11908] veth0_vlan: entered promiscuous mode [ 281.001334][T12133] tap0: tun_chr_ioctl cmd 1074025677 [ 281.006837][T12133] tap0: linktype set to 825 [ 281.015206][T12135] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1974'. [ 281.020429][T11908] veth1_vlan: entered promiscuous mode [ 281.054094][T12133] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 281.126103][T11908] veth0_macvtap: entered promiscuous mode [ 281.144612][T11908] veth1_macvtap: entered promiscuous mode [ 281.176367][T11908] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 281.199435][T11908] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 281.235366][ T78] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.265833][ T78] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.291575][ T78] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.333403][T12140] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1976'. [ 281.337762][ T78] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.352318][T12140] openvswitch: netlink: nsh attribute has 13 unknown bytes. [ 281.360054][T12140] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 281.412272][T12140] ip6tnl1: entered promiscuous mode [ 281.417646][T12140] ip6tnl1: entered allmulticast mode [ 281.426829][T12140] team0: Device ip6tnl1 is of different type [ 281.490740][ T5846] Bluetooth: hci3: command tx timeout [ 281.574107][ T8009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.603096][ T8009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.682594][ T8009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.701332][ T8009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.914737][T12151] netlink: 292 bytes leftover after parsing attributes in process `syz.1.1978'. [ 282.094835][T12155] netlink: 'syz.2.1979': attribute type 9 has an invalid length. [ 282.228836][T12159] delete_channel: no stack [ 282.370047][ T8012] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.572533][ T8012] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.605206][T12155] C speed is unknown, defaulting to 1000 [ 282.614200][T12155] vxcan1 speed is unknown, defaulting to 1000 [ 282.773320][ T8012] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.956913][ T8012] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.023690][T12168] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1981'. [ 283.327777][T12175] C speed is unknown, defaulting to 1000 [ 283.334395][T12179] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1984'. [ 283.358422][ T8012] bridge_slave_1: left allmulticast mode [ 283.370924][ T8012] bridge_slave_1: left promiscuous mode [ 283.377826][ T8012] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.426061][ T8012] bridge_slave_0: left allmulticast mode [ 283.449493][ T8012] bridge_slave_0: left promiscuous mode [ 283.459782][ T8012] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.614051][ T5845] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 283.630103][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 283.648032][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 283.657555][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 283.671476][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 283.926068][ T8012] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 283.938508][ T8012] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 283.949187][ T8012] bond0 (unregistering): Released all slaves [ 283.965615][T12175] vxcan1 speed is unknown, defaulting to 1000 [ 284.026951][T12181] C speed is unknown, defaulting to 1000 [ 284.601816][T12181] vxcan1 speed is unknown, defaulting to 1000 [ 285.635378][T12202] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1993'. [ 285.730926][ T5846] Bluetooth: hci3: command tx timeout [ 287.107688][T12228] netlink: 'syz.1.2001': attribute type 1 has an invalid length. [ 287.493604][T12228] bond4: entered promiscuous mode [ 287.498672][T12228] bond4: entered allmulticast mode [ 287.533386][T12231] bond4: (slave ip6gretap1): making interface the new active one [ 287.542158][T12231] ip6gretap1: entered promiscuous mode [ 287.547834][T12231] ip6gretap1: entered allmulticast mode [ 287.554776][T12231] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 287.584368][ T8012] hsr_slave_0: left promiscuous mode [ 287.596612][ T8012] hsr_slave_1: left promiscuous mode [ 287.608196][ T8012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 287.620096][ T8012] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 287.630201][ T8012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 287.641166][ T8012] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 287.668217][ T8012] veth1_macvtap: left promiscuous mode [ 287.675032][ T8012] veth0_macvtap: left promiscuous mode [ 287.682301][ T8012] veth1_vlan: left promiscuous mode [ 287.687698][ T8012] veth0_vlan: left promiscuous mode [ 287.810739][ T5846] Bluetooth: hci3: command tx timeout [ 288.185099][ T8012] team0 (unregistering): Port device team_slave_1 removed [ 288.238892][ T8012] team0 (unregistering): Port device team_slave_0 removed [ 288.775232][T12181] chnl_net:caif_netlink_parms(): no params data found [ 289.164924][T12181] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.179579][T12181] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.187443][T12181] bridge_slave_0: entered allmulticast mode [ 289.206577][T12181] bridge_slave_0: entered promiscuous mode [ 289.236759][T12181] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.275138][T12181] bridge0: port 2(bridge_slave_1) entered disabled state [ 289.299532][T12181] bridge_slave_1: entered allmulticast mode [ 289.315014][T12181] bridge_slave_1: entered promiscuous mode [ 289.496630][T12181] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 289.513551][T12268] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2012'. [ 289.546949][T12268] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2012'. [ 289.578717][T12267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2012'. [ 289.583973][T12181] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 289.739370][T12274] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2015'. [ 289.767284][T12181] team0: Port device team_slave_0 added [ 289.813239][T12181] team0: Port device team_slave_1 added [ 289.890908][ T5846] Bluetooth: hci3: command tx timeout [ 290.007568][T12282] C: renamed from team_slave_0 (while UP) [ 290.025264][T12282] netlink: 'syz.1.2017': attribute type 3 has an invalid length. [ 290.035119][T12282] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2017'. [ 290.056372][T12181] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 290.069166][T12181] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 290.083460][T12277] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 290.107605][T12287] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2019'. [ 290.119113][T12181] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 290.147001][T12181] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 290.167656][T12181] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 290.189751][T12280] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 290.201154][T12181] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 290.215576][T12277] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 290.229425][T12279] C speed is unknown, defaulting to 1000 [ 290.249896][T12279] vxcan1 speed is unknown, defaulting to 1000 [ 290.413327][T12181] hsr_slave_0: entered promiscuous mode [ 290.433458][T12181] hsr_slave_1: entered promiscuous mode [ 290.448704][T12181] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 290.464676][T12181] Cannot create hsr debugfs directory [ 290.478037][T12275] C speed is unknown, defaulting to 1000 [ 290.657083][T12295] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2022'. [ 290.880298][T12299] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 291.005249][T12275] vxcan1 speed is unknown, defaulting to 1000 [ 291.456565][T12310] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2029'. [ 291.718890][T12316] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2030'. [ 291.970843][ T5846] Bluetooth: hci3: command tx timeout [ 292.034994][T12181] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 292.038541][T12323] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2035'. [ 292.111740][T12181] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 292.149704][T12181] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 292.263299][T12181] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 292.517114][T12339] C speed is unknown, defaulting to 1000 [ 292.590079][T12181] 8021q: adding VLAN 0 to HW filter on device bond0 [ 292.632457][T12339] vxcan1 speed is unknown, defaulting to 1000 [ 292.766809][T12345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2038'. [ 292.817044][T12181] 8021q: adding VLAN 0 to HW filter on device team0 [ 292.854115][ T8009] bridge0: port 1(bridge_slave_0) entered blocking state [ 292.861448][ T8009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 292.952465][ T8009] bridge0: port 2(bridge_slave_1) entered blocking state [ 292.960658][ T8009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 293.685503][T12181] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 294.546598][T12181] veth0_vlan: entered promiscuous mode [ 294.573129][T12181] veth1_vlan: entered promiscuous mode [ 294.584983][T12384] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.2046'. [ 294.620822][T12384] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 294.629122][T12384] openvswitch: netlink: Key 0 has unexpected len 7 expected 0 [ 294.644334][T12181] veth0_macvtap: entered promiscuous mode [ 294.667037][T12181] veth1_macvtap: entered promiscuous mode [ 295.087903][T12181] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 295.189647][T12181] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 295.377013][T12388] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2048'. [ 295.380496][ T8002] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.445859][T12388] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2048'. [ 295.472007][T12388] A link change request failed with some changes committed already. Interface macvlan1 may have been left with an inconsistent configuration, please check. [ 295.508749][ T8002] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.530662][ T8002] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.639219][ T8002] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.674161][ T8002] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 295.698259][ T8002] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 295.726014][T12391] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 295.749149][T12392] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 295.881211][ T8012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 295.889346][ T8012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 295.897168][ T8008] wlan0: Trigger new scan to find an IBSS to join [ 296.100635][ T8012] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 296.109489][ T8012] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 296.195028][ T8002] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 296.229778][ T8002] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 296.405937][T12411] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2056'. [ 296.905182][ T8009] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.121082][ T8009] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.375344][T12433] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2060'. [ 297.493639][ T8009] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.618640][T12435] xfrm1: entered promiscuous mode [ 297.644452][T12435] xfrm1: entered allmulticast mode [ 297.679129][T12435] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2063'. [ 297.745650][ T8009] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.844120][T12441] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2064'. [ 297.853591][T12441] netlink: 43 bytes leftover after parsing attributes in process `syz.0.2064'. [ 297.870412][T12441] netlink: 'syz.0.2064': attribute type 6 has an invalid length. [ 297.920791][T12441] netlink: 'syz.0.2064': attribute type 5 has an invalid length. [ 297.928572][T12441] netlink: 43 bytes leftover after parsing attributes in process `syz.0.2064'. [ 298.211108][ T5845] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 298.221162][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 298.229037][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 298.238516][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 298.248315][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 298.259795][ T8009] bridge_slave_1: left allmulticast mode [ 298.270898][ T8009] bridge_slave_1: left promiscuous mode [ 298.276990][ T8009] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.292637][ T8009] bridge_slave_0: left allmulticast mode [ 298.300584][ T8009] bridge_slave_0: left promiscuous mode [ 298.306385][ T8009] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.869469][ T8009] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 298.881217][ T8009] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 298.892304][ T8009] bond0 (unregistering): Released all slaves [ 299.035641][T12446] C speed is unknown, defaulting to 1000 [ 299.074554][T12446] vxcan1 speed is unknown, defaulting to 1000 [ 299.282553][T12477] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2072'. [ 299.590749][T12489] 8021q: VLANs not supported on xfrm0 [ 299.620267][T12495] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 299.709706][T12491] bond0: (slave wlan1): Releasing backup interface [ 299.801430][T12494] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2077'. [ 300.302002][ T5845] Bluetooth: hci3: command tx timeout [ 300.583775][T12507] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2081'. [ 300.867007][ T78] wlan0: Trigger new scan to find an IBSS to join [ 301.384886][T12527] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2086'. [ 301.424433][ T8009] hsr_slave_0: left promiscuous mode [ 301.442816][T12531] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 301.468010][ T8009] hsr_slave_1: left promiscuous mode [ 301.478199][ T8009] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 301.482440][T12532] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2088'. [ 301.497281][ T8009] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 301.512065][ T8009] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 301.519633][ T8009] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 301.560277][ T8009] veth1_macvtap: left promiscuous mode [ 301.573370][T12537] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2088'. [ 301.575725][ T8009] veth0_macvtap: left promiscuous mode [ 301.588300][ T8009] veth1_vlan: left promiscuous mode [ 301.602831][ T8009] veth0_vlan: left promiscuous mode [ 301.650816][ T5845] Bluetooth: hci0: command tx timeout [ 301.842542][ T8012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.052380][T12545] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 302.064488][T12545] netlink: 'syz.0.2091': attribute type 13 has an invalid length. [ 302.072763][T12545] netlink: 'syz.0.2091': attribute type 17 has an invalid length. [ 302.371849][ T5845] Bluetooth: hci3: command tx timeout [ 302.432265][ T8009] team0 (unregistering): Port device team_slave_1 removed [ 302.484972][ T8009] team0 (unregistering): Port device team_slave_0 removed [ 302.920167][T12533] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 303.007729][T12545] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 303.102643][T12547] C speed is unknown, defaulting to 1000 [ 303.116644][T12446] chnl_net:caif_netlink_parms(): no params data found [ 303.136784][T12547] vxcan1 speed is unknown, defaulting to 1000 [ 303.202497][T12556] netlink: 47 bytes leftover after parsing attributes in process `syz.2.2092'. [ 303.348225][T12565] netlink: 'syz.3.2095': attribute type 1 has an invalid length. [ 303.405417][T12565] netlink: 228 bytes leftover after parsing attributes in process `syz.3.2095'. [ 303.642519][T12446] bridge0: port 1(bridge_slave_0) entered blocking state [ 303.671088][T12446] bridge0: port 1(bridge_slave_0) entered disabled state [ 303.710644][T12446] bridge_slave_0: entered allmulticast mode [ 303.718804][T12446] bridge_slave_0: entered promiscuous mode [ 303.753278][T12446] bridge0: port 2(bridge_slave_1) entered blocking state [ 303.778953][T12446] bridge0: port 2(bridge_slave_1) entered disabled state [ 303.789352][T12446] bridge_slave_1: entered allmulticast mode [ 303.856700][T12446] bridge_slave_1: entered promiscuous mode [ 303.963080][T12577] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2097'. [ 303.991529][T12446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 303.992352][T12577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2097'. [ 304.034054][T12446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 304.293998][T12446] team0: Port device team_slave_0 added [ 304.333331][T12446] team0: Port device team_slave_1 added [ 304.450915][ T5845] Bluetooth: hci3: command tx timeout [ 304.494051][T12446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 304.524565][T12585] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 304.530757][T12446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 304.605359][T12446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 304.648854][T12587] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2100'. [ 304.667355][T12446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 304.688432][T12446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 304.730117][T12446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 304.743051][T12592] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2102'. [ 304.761138][T12592] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2102'. [ 305.064047][T12604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2103'. [ 305.130689][T12598] veth0: entered promiscuous mode [ 305.166434][T12446] hsr_slave_0: entered promiscuous mode [ 305.181518][T12446] hsr_slave_1: entered promiscuous mode [ 305.194617][T12446] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 305.202925][T12446] Cannot create hsr debugfs directory [ 305.842024][T12624] xt_hashlimit: size too large, truncated to 1048576 [ 306.530433][ T5845] Bluetooth: hci3: command tx timeout [ 306.845144][T12446] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 306.888770][T12446] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 307.014933][T12446] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 307.066666][T12446] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 307.165330][T12647] netlink: 'syz.1.2116': attribute type 9 has an invalid length. [ 307.239035][T12650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2115'. [ 307.476924][T12657] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2118'. [ 307.567436][T12446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 307.627972][T12446] 8021q: adding VLAN 0 to HW filter on device team0 [ 307.671314][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.678533][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 307.716357][T12662] pim6reg1: entered promiscuous mode [ 307.721748][T12662] pim6reg1: entered allmulticast mode [ 307.738247][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.745481][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 308.105180][T12675] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2122'. [ 308.163577][T12677] IPVS: set_ctl: invalid protocol: 92 224.0.0.2:0 [ 308.502594][T12446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 308.592381][T12685] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2124'. [ 308.823547][T12692] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2126'. [ 308.946543][T12696] lo: left promiscuous mode [ 309.114578][T12706] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2131'. [ 309.302883][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805876c800: rx timeout, send abort [ 309.303354][T12707] Bluetooth: MGMT ver 1.23 [ 309.427017][T12696] veth0_to_batadv: left promiscuous mode [ 309.437415][T12696] veth0_to_batadv: left allmulticast mode [ 309.569508][T12696] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 309.579399][T12696] mac80211_hwsim hwsim6 wlan0: left allmulticast mode [ 309.587213][T12696] macsec1: left allmulticast mode [ 309.596206][T12696] bond2: left promiscuous mode [ 309.633793][T12696] bond5: left allmulticast mode [ 309.709001][T12706] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 309.748147][T12706] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 309.777736][T12706] bond0 (unregistering): Released all slaves [ 309.830866][ T5891] vxcan1 speed is unknown, defaulting to 1000 [ 309.845425][ T1005] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.852303][ T5891] syz2: Port: 1 Link DOWN [ 309.886427][ T1005] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.932388][ T5891] vxcan1 speed is unknown, defaulting to 1000 [ 309.959614][ T1005] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.975749][ T1005] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.005880][ T1005] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.033434][ T1005] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.049107][ T1005] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.080148][ T1005] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.233446][T12729] C speed is unknown, defaulting to 1000 [ 310.246466][T12446] veth0_vlan: entered promiscuous mode [ 310.267942][T12735] C speed is unknown, defaulting to 1000 [ 310.275418][T12446] veth1_vlan: entered promiscuous mode [ 310.295287][T12729] vxcan1 speed is unknown, defaulting to 1000 [ 310.408209][T12446] veth0_macvtap: entered promiscuous mode [ 310.462650][T12446] veth1_macvtap: entered promiscuous mode [ 310.528025][T12744] : entered promiscuous mode [ 310.586567][T12446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 310.636468][T12446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 310.693433][ T8002] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.724885][ T8002] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.764794][ T8002] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.797449][ T8002] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.818091][T12746] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 311.034628][ T1005] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.050735][ T1005] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.114937][T12735] vxcan1 speed is unknown, defaulting to 1000 [ 311.124546][ T1005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.142664][ T1005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.884822][ T8002] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.054838][ T8002] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.282854][ T8002] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.435404][ T8002] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.664502][ T8002] bridge_slave_1: left allmulticast mode [ 312.670275][ T8002] bridge_slave_1: left promiscuous mode [ 312.680709][ T8002] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.781956][ T8002] bridge_slave_0: left allmulticast mode [ 312.789434][ T8002] bridge_slave_0: left promiscuous mode [ 312.800810][ T8002] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.494855][ T5846] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 313.504032][ T5846] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 313.514500][ T5846] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 313.534907][ T5846] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 313.543025][ T5846] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 313.677382][ T8002] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 313.692862][ T8002] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 313.703126][ T8002] bond0 (unregistering): Released all slaves [ 313.882480][T12784] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2150'. [ 314.000499][T12779] C speed is unknown, defaulting to 1000 [ 314.039550][T12779] vxcan1 speed is unknown, defaulting to 1000 [ 314.241561][T12791] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 315.350699][T12810] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2157'. [ 315.590607][ T5846] Bluetooth: hci3: command tx timeout [ 315.761207][T12822] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2159'. [ 315.817176][T12822] netlink: 'syz.0.2159': attribute type 10 has an invalid length. [ 316.321120][T12822] team0: Port device geneve1 added [ 316.567776][T12842] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2168'. [ 316.598438][T12840] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2166'. [ 316.634540][ T8002] hsr_slave_0: left promiscuous mode [ 316.641448][ T8002] hsr_slave_1: left promiscuous mode [ 316.648265][ T8002] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 316.656903][ T8002] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 316.666929][ T8002] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 316.676528][ T8002] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 316.747476][ T8002] veth1_macvtap: left promiscuous mode [ 316.766505][ T8002] veth0_macvtap: left promiscuous mode [ 316.776509][ T8002] veth1_vlan: left promiscuous mode [ 316.786544][ T8002] veth0_vlan: left promiscuous mode [ 317.175679][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.569014][T12854] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2172'. [ 317.607045][ T8002] team0 (unregistering): Port device team_slave_1 removed [ 317.625955][T12856] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2170'. [ 317.647551][T12857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2172'. [ 317.656808][ T5845] Bluetooth: hci3: command tx timeout [ 317.703305][ T8002] team0 (unregistering): Port device team_slave_0 removed [ 318.380132][T12779] chnl_net:caif_netlink_parms(): no params data found [ 318.974466][T12779] bridge0: port 1(bridge_slave_0) entered blocking state [ 319.000559][T12779] bridge0: port 1(bridge_slave_0) entered disabled state [ 319.033086][T12779] bridge_slave_0: entered allmulticast mode [ 319.057577][T12779] bridge_slave_0: entered promiscuous mode [ 319.163416][T12779] bridge0: port 2(bridge_slave_1) entered blocking state [ 319.181876][T12779] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.189600][T12779] bridge_slave_1: entered allmulticast mode [ 319.208223][T12779] bridge_slave_1: entered promiscuous mode [ 319.406501][T12779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 319.485470][T12779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 319.620057][T12914] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2183'. [ 319.712824][T12779] team0: Port device team_slave_0 added [ 319.731096][ T5845] Bluetooth: hci3: command 0x040f tx timeout [ 319.744557][T12779] team0: Port device team_slave_1 added [ 319.898019][T12779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 319.923613][T12779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.975924][T12779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 320.050281][T12927] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2186'. [ 320.147440][T12779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 320.156338][T12931] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2186'. [ 320.183332][T12779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 320.227343][T12779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 320.466299][T12939] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2190'. [ 320.592606][T12779] hsr_slave_0: entered promiscuous mode [ 320.622551][T12779] hsr_slave_1: entered promiscuous mode [ 320.649057][T12779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 320.671404][T12779] Cannot create hsr debugfs directory [ 320.920213][T12956] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.015973][T12956] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.068686][T12940] C speed is unknown, defaulting to 1000 [ 321.101253][T12944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.149759][T12944] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2189'. [ 321.183348][T12965] netlink: 10 bytes leftover after parsing attributes in process `syz.0.2195'. [ 321.210707][T12940] vxcan1 speed is unknown, defaulting to 1000 [ 321.233592][T12969] netlink: 'syz.3.2196': attribute type 33 has an invalid length. [ 321.251851][T12969] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2196'. [ 321.810768][ T5845] Bluetooth: hci3: command 0x040f tx timeout [ 322.327597][T13000] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2203'. [ 322.668336][T13006] tipc: Started in network mode [ 322.673430][T13006] tipc: Node identity , cluster identity 4711 [ 322.679522][T13006] tipc: Failed to set node id, please configure manually [ 322.718409][T13006] tipc: Enabling of bearer rejected, failed to enable media [ 322.788560][T13008] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2204'. [ 323.071939][T12779] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 323.104638][T12779] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 323.134905][T12779] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 323.155525][T12779] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 323.513731][T12779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 323.591347][T12779] 8021q: adding VLAN 0 to HW filter on device team0 [ 323.617093][ T8008] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.624344][ T8008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 323.676586][ T1005] bridge0: port 2(bridge_slave_1) entered blocking state [ 323.683850][ T1005] bridge0: port 2(bridge_slave_1) entered forwarding state [ 323.902392][ T5845] Bluetooth: hci3: command 0x040f tx timeout [ 324.899241][T13055] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2215'. [ 324.934691][T13057] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2216'. [ 325.167307][T12779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 325.593536][T13080] xt_bpf: check failed: parse error [ 325.770299][T13089] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2225'. [ 325.988949][T13098] xt_CT: You must specify a L4 protocol and not use inversions on it [ 325.994545][T12779] veth0_vlan: entered promiscuous mode [ 326.044778][T13100] netlink: 'syz.0.2229': attribute type 1 has an invalid length. [ 326.072285][T13100] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2229'. [ 326.086115][T12779] veth1_vlan: entered promiscuous mode [ 326.151666][T13100] macvtap1: entered promiscuous mode [ 326.164831][T13100] vlan0: entered promiscuous mode [ 326.174659][T13100] macvtap1: entered allmulticast mode [ 326.184963][T13100] vlan0: entered allmulticast mode [ 326.190714][T13100] veth0_vlan: entered allmulticast mode [ 326.206373][T13100] vlan0: left allmulticast mode [ 326.211734][T13100] veth0_vlan: left allmulticast mode [ 326.217138][T13100] vlan0: left promiscuous mode [ 326.302902][T13111] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2232'. [ 326.403676][T12779] veth0_macvtap: entered promiscuous mode [ 326.436998][T12779] veth1_macvtap: entered promiscuous mode [ 326.519401][T12779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 326.532886][T12779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 326.567482][ T78] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.595235][ T78] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.638869][T13116] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.686066][ T78] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.720810][T13116] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.767415][ T78] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.800202][T13127] xt_bpf: check failed: parse error [ 326.841782][T13116] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.914877][T13116] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.985992][T13123] C speed is unknown, defaulting to 1000 [ 327.059111][T13123] vxcan1 speed is unknown, defaulting to 1000 [ 327.114453][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 327.123442][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 327.167581][ T8012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 327.183097][ T8012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 327.360083][ T8008] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.394932][T13137] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2240'. [ 327.425056][ T8008] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.430107][T13137] netlink: 'syz.3.2240': attribute type 7 has an invalid length. [ 327.443821][T13137] netlink: 'syz.3.2240': attribute type 8 has an invalid length. [ 327.452036][T13137] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2240'. [ 327.460710][ T8008] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.542306][ T8012] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.642116][T13137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2240'. [ 327.904457][ T8008] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.034629][ T8008] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.169067][ T8008] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.402979][ T8008] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.853603][ T8008] bridge_slave_1: left allmulticast mode [ 328.859339][ T8008] bridge_slave_1: left promiscuous mode [ 328.884559][ T8008] bridge0: port 2(bridge_slave_1) entered disabled state [ 328.982126][T13154] netlink: 'syz.1.2244': attribute type 1 has an invalid length. [ 329.027924][ T8008] bridge_slave_0: left allmulticast mode [ 329.034016][ T8008] bridge_slave_0: left promiscuous mode [ 329.040065][ T8008] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.229618][T13164] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 329.324998][T13166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2248'. [ 329.720069][ T5846] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 329.738986][ T5846] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 329.751234][ T5846] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 329.766006][ T5846] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 329.774417][ T5846] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 329.956324][ T8008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 329.985196][ T8008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 330.009586][ T8008] bond0 (unregistering): Released all slaves [ 330.134209][T13176] C speed is unknown, defaulting to 1000 [ 330.174028][T13176] vxcan1 speed is unknown, defaulting to 1000 [ 330.175141][T13173] C speed is unknown, defaulting to 1000 [ 330.909320][T13201] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2256'. [ 330.947937][T13201] netlink: 'syz.2.2256': attribute type 7 has an invalid length. [ 330.967503][T13201] netlink: 'syz.2.2256': attribute type 8 has an invalid length. [ 330.968392][T13173] vxcan1 speed is unknown, defaulting to 1000 [ 331.007057][T13201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2256'. [ 331.048867][T13204] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2256'. [ 331.460561][T13213] block nbd0: server does not support multiple connections per device. [ 331.473903][T13213] block nbd0: shutting down sockets [ 331.509155][T13216] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2262'. [ 331.644875][ T8018] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 331.662065][ T8018] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 331.757560][T13212] C speed is unknown, defaulting to 1000 [ 331.784600][T13212] vxcan1 speed is unknown, defaulting to 1000 [ 331.822502][ T5846] Bluetooth: hci3: command tx timeout [ 332.366861][T13237] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 332.450447][ T5846] Bluetooth: hci2: command 0x0406 tx timeout [ 332.519631][T13173] chnl_net:caif_netlink_parms(): no params data found [ 332.992799][T13247] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2271'. [ 333.543479][T13173] bridge0: port 1(bridge_slave_0) entered blocking state [ 333.580092][T13173] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.600658][T13173] bridge_slave_0: entered allmulticast mode [ 333.621696][T13173] bridge_slave_0: entered promiscuous mode [ 333.692524][T13267] pim6reg: entered allmulticast mode [ 333.698172][T13268] pim6reg: left allmulticast mode [ 333.784632][T13173] bridge0: port 2(bridge_slave_1) entered blocking state [ 333.820636][T13173] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.838785][T13173] bridge_slave_1: entered allmulticast mode [ 333.895361][ T5846] Bluetooth: hci3: command tx timeout [ 333.923960][T13173] bridge_slave_1: entered promiscuous mode [ 334.027594][T13270] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2276'. [ 334.384823][ T8008] hsr_slave_0: left promiscuous mode [ 334.410755][ T8008] hsr_slave_1: left promiscuous mode [ 334.418239][ T8008] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 334.449417][ T8008] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 334.468170][ T8012] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 334.469397][ T8008] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 334.496708][ T8008] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.524333][ T8008] veth1_macvtap: left promiscuous mode [ 334.529925][ T8008] veth0_macvtap: left promiscuous mode [ 334.535752][ T8008] veth1_vlan: left promiscuous mode [ 334.545805][ T8008] veth0_vlan: left promiscuous mode [ 335.001136][ T8008] team0 (unregistering): Port device team_slave_1 removed [ 335.049102][ T8008] team0 (unregistering): Port device team_slave_0 removed [ 335.582935][T13173] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 335.677047][T13173] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 335.980874][ T5846] Bluetooth: hci3: command tx timeout [ 336.125719][T13173] team0: Port device team_slave_0 added [ 336.174339][T13173] team0: Port device team_slave_1 added [ 336.213244][T13294] netlink: 84 bytes leftover after parsing attributes in process `syz.3.2283'. [ 336.551231][T13173] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 336.575788][T13173] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 336.615317][T13173] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 336.636393][T13173] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 336.648564][T13173] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 336.700122][T13173] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 336.780910][T13306] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2288'. [ 336.871123][T13310] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2288'. [ 336.965779][T13313] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2290'. [ 337.047544][T13173] hsr_slave_0: entered promiscuous mode [ 337.079277][T13173] hsr_slave_1: entered promiscuous mode [ 337.090791][T13173] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 337.098389][T13173] Cannot create hsr debugfs directory [ 337.668987][T13335] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2297'. [ 337.677952][T13338] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2298'. [ 337.749849][T13341] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2299'. [ 337.771478][T13341] netlink: 'syz.2.2299': attribute type 7 has an invalid length. [ 337.793391][T13341] netlink: 'syz.2.2299': attribute type 8 has an invalid length. [ 337.799417][T13335] sch_tbf: burst 5 is lower than device bridge4 mtu (1514) ! [ 337.825310][T13341] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2299'. [ 337.918434][T13341] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2299'. [ 338.051469][ T5846] Bluetooth: hci3: command tx timeout [ 338.083275][T13349] syzkaller0: entered allmulticast mode [ 338.163304][T13351] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2302'. [ 338.311632][T13173] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 338.370772][T13173] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 338.398670][T13173] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 338.646510][T13173] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 338.919982][T13357] C speed is unknown, defaulting to 1000 [ 338.985135][T13357] vxcan1 speed is unknown, defaulting to 1000 [ 339.162727][T13173] 8021q: adding VLAN 0 to HW filter on device bond0 [ 339.209478][T13173] 8021q: adding VLAN 0 to HW filter on device team0 [ 339.268748][ T8009] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.275987][ T8009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 339.333254][ T8009] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.340531][ T8009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 339.655570][T13382] sctp: [Deprecated]: syz.2.2310 (pid 13382) Use of struct sctp_assoc_value in delayed_ack socket option. [ 339.655570][T13382] Use struct sctp_sack_info instead [ 340.155879][T13173] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 341.032567][T13396] 8021q: adding VLAN 0 to HW filter on device bond7 [ 341.077708][T13396] team0: Port device bond7 added [ 341.126916][T13406] netlink: 'syz.2.2315': attribute type 3 has an invalid length. [ 341.363631][T13409] __nla_validate_parse: 6 callbacks suppressed [ 341.363652][T13409] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2316'. [ 341.455576][T13409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2316'. [ 341.469739][T13419] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2319'. [ 341.580986][T13173] veth0_vlan: entered promiscuous mode [ 341.644264][T13173] veth1_vlan: entered promiscuous mode [ 341.789145][T13173] veth0_macvtap: entered promiscuous mode [ 341.847298][T13173] veth1_macvtap: entered promiscuous mode [ 341.919420][T13173] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 341.979235][T13173] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 342.000445][T13434] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2325'. [ 342.184715][ T1005] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.197950][ T1005] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.315566][ T1005] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.339400][ T1005] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.657929][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.699181][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.878532][ T8002] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.888930][ T8002] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.922271][T13459] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 343.013345][T13462] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2333'. [ 343.024789][T13463] xt_hashlimit: size too large, truncated to 1048576 [ 343.035047][T13462] netlink: 'syz.3.2333': attribute type 7 has an invalid length. [ 343.058122][T13191] ------------[ cut here ]------------ [ 343.064071][T13191] refcount_t: underflow; use-after-free. [ 343.069921][T13191] WARNING: CPU: 1 PID: 13191 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 [ 343.079502][T13191] Modules linked in: [ 343.083612][T13191] CPU: 1 UID: 0 PID: 13191 Comm: kbnepd bnep0 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 343.096243][T13191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 343.106654][T13191] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 343.112860][T13191] Code: 00 41 e2 8b e8 f7 92 c2 fc 90 0f 0b 90 90 eb d7 e8 3b e8 fe fc c6 05 95 a9 c9 0a 01 90 48 c7 c7 60 41 e2 8b e8 d7 92 c2 fc 90 <0f> 0b 90 90 eb b7 e8 1b e8 fe fc c6 05 72 a9 c9 0a 01 90 48 c7 c7 [ 343.132532][T13191] RSP: 0018:ffffc9000bbcf6a0 EFLAGS: 00010246 [ 343.138592][T13191] RAX: d37f932acb0efe00 RBX: 0000000000000003 RCX: ffff88802e103c00 [ 343.146825][T13191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 343.154819][T13191] RBP: 0000000000000000 R08: ffff8880b8724293 R09: 1ffff110170e4852 [ 343.162864][T13191] R10: dffffc0000000000 R11: ffffed10170e4853 R12: dffffc0000000000 [ 343.170900][T13191] R13: ffff8880343d8060 R14: ffff8880343d8078 R15: ffffffff85f66530 [ 343.178883][T13191] FS: 0000000000000000(0000) GS:ffff888125d4f000(0000) knlGS:0000000000000000 [ 343.187826][T13191] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 343.194641][T13191] CR2: 00007fa434c39f98 CR3: 0000000029a9a000 CR4: 00000000003526f0 [ 343.202987][T13191] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 343.211275][T13191] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 343.219242][T13191] Call Trace: [ 343.222583][T13191] [ 343.225511][T13191] klist_dec_and_del+0x3c7/0x3d0 [ 343.230483][T13191] ? __pfx_klist_children_put+0x10/0x10 [ 343.236025][T13191] klist_del+0xa6/0x110 [ 343.240186][T13191] device_del+0x280/0x8e0 [ 343.244573][T13191] ? _raw_spin_unlock_irq+0x2e/0x50 [ 343.249765][T13191] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 343.255881][T13191] ? __pfx_device_del+0x10/0x10 [ 343.260751][T13191] ? netdev_unregister_kobject+0x344/0x450 [ 343.266561][T13191] unregister_netdevice_many_notify+0x1d52/0x2320 [ 343.273004][T13191] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 343.279760][T13191] ? rcu_is_watching+0x15/0xb0 [ 343.284550][T13191] ? trace_contention_end+0x39/0x120 [ 343.289832][T13191] ? __mutex_lock+0x330/0xe80 [ 343.294553][T13191] ? __lock_acquire+0xab9/0xd20 [ 343.299404][T13191] ? __lock_acquire+0xab9/0xd20 [ 343.304587][T13191] unregister_netdevice_queue+0x33c/0x380 [ 343.310605][T13191] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 343.316840][T13191] ? rtnl_net_dev_lock+0x36/0x2f0 [ 343.321893][T13191] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 343.326999][T13191] unregister_netdev+0x1f/0x60 [ 343.331954][T13191] bnep_session+0x294d/0x2b40 [ 343.336631][T13191] ? trace_sched_exit_tp+0x38/0x120 [ 343.341888][T13191] ? __lock_acquire+0xab9/0xd20 [ 343.346749][T13191] ? __pfx_bnep_session+0x10/0x10 [ 343.351800][T13191] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 343.357703][T13191] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 343.364062][T13191] ? __pfx_woken_wake_function+0x10/0x10 [ 343.369688][T13191] ? __kthread_parkme+0x7b/0x200 [ 343.374662][T13191] ? __kthread_parkme+0x1a1/0x200 [ 343.379679][T13191] kthread+0x70e/0x8a0 [ 343.383769][T13191] ? __pfx_bnep_session+0x10/0x10 [ 343.388791][T13191] ? __pfx_kthread+0x10/0x10 [ 343.393404][T13191] ? _raw_spin_unlock_irq+0x23/0x50 [ 343.398597][T13191] ? lockdep_hardirqs_on+0x9c/0x150 [ 343.404109][T13191] ? __pfx_kthread+0x10/0x10 [ 343.408710][T13191] ret_from_fork+0x3f9/0x770 [ 343.413853][T13191] ? __pfx_ret_from_fork+0x10/0x10 [ 343.418996][T13191] ? __switch_to_asm+0x39/0x70 [ 343.423822][T13191] ? __switch_to_asm+0x33/0x70 [ 343.428585][T13191] ? __pfx_kthread+0x10/0x10 [ 343.433215][T13191] ret_from_fork_asm+0x1a/0x30 [ 343.437988][T13191] [ 343.441057][T13191] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 343.448331][T13191] CPU: 1 UID: 0 PID: 13191 Comm: kbnepd bnep0 Not tainted 6.16.0-rc2-syzkaller-00591-g4f4040ea5d3e #0 PREEMPT(full) [ 343.460557][T13191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 343.470776][T13191] Call Trace: [ 343.474047][T13191] [ 343.476967][T13191] dump_stack_lvl+0x99/0x250 [ 343.481550][T13191] ? __asan_memcpy+0x40/0x70 [ 343.486133][T13191] ? __pfx_dump_stack_lvl+0x10/0x10 [ 343.491323][T13191] ? __pfx__printk+0x10/0x10 [ 343.495908][T13191] panic+0x2db/0x790 [ 343.499813][T13191] ? __pfx_panic+0x10/0x10 [ 343.504219][T13191] ? show_trace_log_lvl+0x4fb/0x550 [ 343.509415][T13191] ? ret_from_fork_asm+0x1a/0x30 [ 343.514343][T13191] __warn+0x31b/0x4b0 [ 343.518317][T13191] ? refcount_warn_saturate+0x11a/0x1d0 [ 343.523851][T13191] ? refcount_warn_saturate+0x11a/0x1d0 [ 343.529384][T13191] report_bug+0x2be/0x4f0 [ 343.533703][T13191] ? refcount_warn_saturate+0x11a/0x1d0 [ 343.539235][T13191] ? refcount_warn_saturate+0x11a/0x1d0 [ 343.544769][T13191] ? refcount_warn_saturate+0x11c/0x1d0 [ 343.550300][T13191] handle_bug+0x84/0x160 [ 343.554531][T13191] exc_invalid_op+0x1a/0x50 [ 343.559022][T13191] asm_exc_invalid_op+0x1a/0x20 [ 343.563858][T13191] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 343.569999][T13191] Code: 00 41 e2 8b e8 f7 92 c2 fc 90 0f 0b 90 90 eb d7 e8 3b e8 fe fc c6 05 95 a9 c9 0a 01 90 48 c7 c7 60 41 e2 8b e8 d7 92 c2 fc 90 <0f> 0b 90 90 eb b7 e8 1b e8 fe fc c6 05 72 a9 c9 0a 01 90 48 c7 c7 [ 343.589593][T13191] RSP: 0018:ffffc9000bbcf6a0 EFLAGS: 00010246 [ 343.595675][T13191] RAX: d37f932acb0efe00 RBX: 0000000000000003 RCX: ffff88802e103c00 [ 343.603636][T13191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 343.611594][T13191] RBP: 0000000000000000 R08: ffff8880b8724293 R09: 1ffff110170e4852 [ 343.619555][T13191] R10: dffffc0000000000 R11: ffffed10170e4853 R12: dffffc0000000000 [ 343.627517][T13191] R13: ffff8880343d8060 R14: ffff8880343d8078 R15: ffffffff85f66530 [ 343.635480][T13191] ? __pfx_klist_children_put+0x10/0x10 [ 343.641045][T13191] klist_dec_and_del+0x3c7/0x3d0 [ 343.645974][T13191] ? __pfx_klist_children_put+0x10/0x10 [ 343.651530][T13191] klist_del+0xa6/0x110 [ 343.655678][T13191] device_del+0x280/0x8e0 [ 343.660005][T13191] ? _raw_spin_unlock_irq+0x2e/0x50 [ 343.665196][T13191] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 343.671254][T13191] ? __pfx_device_del+0x10/0x10 [ 343.676093][T13191] ? netdev_unregister_kobject+0x344/0x450 [ 343.681895][T13191] unregister_netdevice_many_notify+0x1d52/0x2320 [ 343.688305][T13191] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 343.695053][T13191] ? rcu_is_watching+0x15/0xb0 [ 343.699812][T13191] ? trace_contention_end+0x39/0x120 [ 343.705087][T13191] ? __mutex_lock+0x330/0xe80 [ 343.709749][T13191] ? __lock_acquire+0xab9/0xd20 [ 343.714593][T13191] ? __lock_acquire+0xab9/0xd20 [ 343.719534][T13191] unregister_netdevice_queue+0x33c/0x380 [ 343.725245][T13191] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 343.731479][T13191] ? rtnl_net_dev_lock+0x36/0x2f0 [ 343.736495][T13191] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 343.741609][T13191] unregister_netdev+0x1f/0x60 [ 343.746535][T13191] bnep_session+0x294d/0x2b40 [ 343.751385][T13191] ? trace_sched_exit_tp+0x38/0x120 [ 343.756587][T13191] ? __lock_acquire+0xab9/0xd20 [ 343.761441][T13191] ? __pfx_bnep_session+0x10/0x10 [ 343.766457][T13191] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 343.772344][T13191] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 343.778667][T13191] ? __pfx_woken_wake_function+0x10/0x10 [ 343.784291][T13191] ? __kthread_parkme+0x7b/0x200 [ 343.789304][T13191] ? __kthread_parkme+0x1a1/0x200 [ 343.794316][T13191] kthread+0x70e/0x8a0 [ 343.798461][T13191] ? __pfx_bnep_session+0x10/0x10 [ 343.803477][T13191] ? __pfx_kthread+0x10/0x10 [ 343.808060][T13191] ? _raw_spin_unlock_irq+0x23/0x50 [ 343.813248][T13191] ? lockdep_hardirqs_on+0x9c/0x150 [ 343.818435][T13191] ? __pfx_kthread+0x10/0x10 [ 343.823013][T13191] ret_from_fork+0x3f9/0x770 [ 343.827595][T13191] ? __pfx_ret_from_fork+0x10/0x10 [ 343.832701][T13191] ? __switch_to_asm+0x39/0x70 [ 343.837450][T13191] ? __switch_to_asm+0x33/0x70 [ 343.842200][T13191] ? __pfx_kthread+0x10/0x10 [ 343.846782][T13191] ret_from_fork_asm+0x1a/0x30 [ 343.851542][T13191] [ 344.997762][T13191] Shutting down cpus with NMI [ 345.002756][T13191] Kernel Offset: disabled [ 345.007080][T13191] Rebooting in 86400 seconds..