last executing test programs: 2m36.867212554s ago: executing program 1 (id=880): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) 2m35.227448725s ago: executing program 1 (id=889): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) (async, rerun: 32) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000180)={r4, 0x38, "2578bac7061f3447a08504a2446c491a23182dafbb473aafa54eb3ed48ca035bdffd91df4210d2f7aa12cbbe0f09339f6cb8fbb3fba27bbc"}, &(0x7f00000011c0)=0x40) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="64000000020605000000000000000000000049001400078008000800000000000800064000000000050001001b00000005000500020000000500040000000000090002009c5b7a310000000015000300686173683a6970"], 0x64}}, 0x0) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000bc0)={r5}) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000004000ffffffff0200000008000300", @ANYRES32=r10, @ANYBLOB="08000200"], 0x24}, 0x1, 0x6c00, 0x0, 0x4d080}, 0x0) r11 = socket(0x2a, 0x2, 0x0) (async) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r11, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) (async, rerun: 32) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (rerun: 32) write$cgroup_subtree(r13, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r13, 0x0) setsockopt$inet6_tcp_buf(r13, 0x6, 0x1f, &(0x7f0000000dc0)="116fb0482e03e57a8b8f467c567833197a25e935ed2ffc277c9642744c36118533f942562d28c2f439759b0f5b1707a64fb5f332a32aa294626edab6395f0bf3b5ddb54cb1d052991dc21ee4b08df74deb4a372f4439016c02669c1d5ad81fb39d1391b0b4b97a7f4acf4945eff50fa76e4256341dc49043bc26e3cf42ee4a9332614b9de0bc17aa2d51eaa7d105d65962a7809b86a692a6bb8f69052d46be280361e749d0b5c0", 0xa7) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newtfilter={0x880, 0x2c, 0xd27, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, r12, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@TCA_RATE={0x6, 0x5, {0x7, 0xa}}, @filter_kind_options=@f_fw={{0x7}, {0x84c, 0x2, [@TCA_FW_POLICE={0x848, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0xfffffffd, 0xbea9, 0x8, 0x87, 0x9, 0xb, 0x0, 0x9, 0x0, 0x8001, 0x0, 0x80, 0x6, 0x0, 0xde, 0x7, 0xf6aa, 0x5, 0x9, 0x3ff, 0x7233, 0x8, 0xa26a, 0x6, 0xffff, 0x0, 0x4, 0x9, 0x8, 0x7fffffff, 0x8000, 0x0, 0x3, 0x0, 0x0, 0x3, 0x68f7, 0x400, 0x7fffffff, 0x9, 0x1ff, 0x624a, 0x5, 0xf9, 0x9, 0x5, 0x81, 0x400, 0x8, 0x800, 0x7ff, 0xffff, 0x5, 0xfffffff7, 0x8000, 0xb19, 0x6, 0xc7, 0x9, 0x0, 0x8, 0x0, 0x6, 0x0, 0x200, 0x5, 0x1, 0x3, 0x3, 0x101, 0x5, 0x80008001, 0x4719, 0x2, 0x1, 0x1d79, 0x6, 0x5, 0x8000, 0x3, 0x2, 0x9, 0x45dd, 0x0, 0x4, 0x1, 0xc, 0x6, 0x3, 0x1, 0x9, 0x81, 0xfffffffe, 0x6, 0x4647, 0xe0e5, 0x800, 0x5, 0x8, 0x2, 0x5, 0x2, 0x3, 0x1, 0xffff8001, 0x8, 0x1, 0x7fffffff, 0x83d8, 0x8000, 0x3, 0x101, 0x8000, 0x0, 0x3ff, 0x6e3, 0x52, 0x7fff, 0x4, 0x9, 0x7, 0xfffffff5, 0x4, 0x101, 0x5, 0x5, 0x80000000, 0x1, 0xffffffff, 0x1, 0x0, 0xfffffffc, 0xfffffffb, 0x2, 0x8, 0x8000000, 0x1, 0x4, 0x9, 0x7, 0x4, 0xd, 0x9, 0xfffffffa, 0x8, 0xfffffff2, 0x0, 0x2651, 0x800, 0xc319, 0x1, 0x0, 0x80000001, 0x6, 0x8, 0x6, 0x400, 0x4, 0x3ff, 0x501b5b55, 0x7fffffff, 0x2, 0x1, 0x3, 0x7ae, 0x2, 0x9, 0xb, 0xfff, 0x8, 0x101, 0x8000, 0x8, 0x2, 0x9, 0xe2cd, 0x1, 0x0, 0x1005, 0x0, 0x7, 0x2, 0x1f, 0x0, 0xf, 0xc, 0x1, 0x84f, 0x8, 0x94f7, 0x7, 0x5, 0xec38f52e, 0x7, 0x4, 0xc, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7fff, 0xff, 0x9, 0xfffffffc, 0x1ff, 0x3, 0x4, 0x6, 0x8, 0x100, 0x26e2, 0x800, 0x39, 0x3, 0x4, 0x3, 0x7, 0x8000, 0x800, 0x6, 0x0, 0x0, 0xc4, 0x8, 0x6, 0x3, 0x302, 0x1, 0x195, 0x543f, 0x7, 0x4, 0x1, 0x20007, 0x81, 0x7, 0x9, 0x40, 0x101, 0x7f, 0x2, 0x2, 0x81, 0xfffffff9, 0x4, 0x1f6, 0xe9a, 0x0, 0x0, 0xdf85, 0xf, 0x4, 0x23, 0x6c, 0x2]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0x6, 0xfffffff7, 0x0, 0xc7f5, {0xe, 0x0, 0xdfb, 0x7, 0xc, 0x7aefe6b8}, {0x1, 0x0, 0x3, 0xd, 0x1, 0x9}, 0x9, 0x4, 0x8}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x6, 0x4, 0xffffffff, 0x9, 0x4, 0x9, 0x2, 0x40, 0x308, 0x1, 0x1000000, 0xffffff74, 0x1, 0x80, 0xe, 0x3, 0x3, 0x1, 0x6, 0x7ff, 0x5, 0x380, 0x7, 0x9, 0xc, 0xa70, 0x3, 0x5c05, 0x1, 0x3, 0x0, 0x4, 0x1, 0x57, 0x39800000, 0x8, 0x0, 0x9, 0xff, 0x1ff, 0x7, 0x3, 0x9, 0x6, 0xa94, 0x8, 0x5, 0x80, 0x0, 0x100, 0xebf, 0x69, 0x1ff, 0xcda2, 0x401, 0xfffffffc, 0x5ed755fb, 0x318d, 0x101, 0x8, 0x6, 0x3d75, 0xe48e, 0x1, 0x80000001, 0x9b, 0xffffff07, 0xfffffffe, 0x5, 0x0, 0x7, 0x7, 0x8, 0x3, 0x8, 0x6, 0x1, 0x1000, 0x1, 0x1f, 0x9, 0x8000, 0x6, 0x1, 0xaef, 0x9, 0x7f, 0x3, 0x6, 0x5, 0x0, 0x0, 0xccdd, 0xe0b, 0x6, 0x3, 0x8, 0x2, 0x4, 0x3f7, 0x4, 0x101, 0x3, 0x2, 0x3, 0x6, 0x8, 0x0, 0x2dbb9dea, 0x6, 0x80000001, 0x0, 0x3ff, 0x0, 0x0, 0x9, 0x4, 0x9, 0x1, 0x4, 0xad71, 0x39, 0x8, 0x4, 0xb, 0xd, 0x9, 0x1, 0x10000, 0xf0, 0xfffffffb, 0x5, 0x2fc3, 0x5, 0xb, 0xc4, 0x1ff, 0x80000001, 0x0, 0x5, 0x70000, 0xd85, 0x1603, 0xfffffffc, 0x40, 0x3ff, 0x8000, 0xbae, 0x1, 0x2, 0x1ff, 0x7ac7, 0x8, 0xc8, 0x53, 0xfffffe00, 0x7fffffff, 0x1000, 0x0, 0x3, 0x3, 0x9, 0x0, 0x8, 0x1ff, 0x9, 0x23, 0x7, 0x7ff, 0x0, 0x0, 0x2, 0x5, 0x101, 0x2, 0x3, 0x5, 0xa2, 0x9, 0x0, 0x7, 0xc1, 0x5, 0x9, 0x4, 0x7, 0xfffffff2, 0x81, 0x3, 0x1, 0x2, 0x0, 0x1, 0x9, 0x2, 0x13e3, 0x180000, 0x9, 0x0, 0xfff, 0x1fb0, 0x4ae, 0x80, 0xc, 0xb1, 0x2, 0x3, 0x8, 0x2, 0x6, 0x1, 0x200, 0x98e0, 0x3, 0x2, 0x0, 0xfffffffe, 0x8de0, 0x5, 0xfffffffe, 0x1, 0x4, 0x4, 0xec, 0x9, 0x6, 0x6, 0x0, 0xb55, 0x9, 0x7e, 0x7, 0x5, 0x1, 0x9, 0xc2, 0x1, 0x5, 0xffff, 0x5, 0x8, 0x9, 0x1, 0x5, 0x4, 0x58, 0x7f, 0x223, 0x7, 0x8000, 0x5, 0x2, 0x1ff, 0x2, 0x7, 0x8]}]}]}}]}, 0x880}}, 0x24000000) (async) r14 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r14, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$kcm(0x2, 0xa, 0x2) 2m34.773920594s ago: executing program 1 (id=897): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b7020000b0ffffffbfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d64050000000000650404000100010104040000f1000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000fc0)={0xc, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000009200000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f00000003c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x20000}, 0x94) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r3) recvmmsg(r2, &(0x7f0000000940)=[{{&(0x7f0000000080)=@tipc=@id, 0x80, &(0x7f0000000740)}, 0x400}, {{&(0x7f0000000800)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000000900)=[{&(0x7f0000000880)=""/98, 0x62}], 0x1}, 0x1}], 0x2, 0x10, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r4, 0x32b, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24000800}, 0x8000) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@delneigh={0x30, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r6, 0x0, 0x96, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x8000) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r7, 0x890b, &(0x7f0000000000)={0x4000000, {}, {0x2, 0x4e22, @local}, {0x2, 0x0, @empty}, 0x0, 0x0, 0x0, 0x0, 0xfffc}) close(r1) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r8, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r8, 0x84, 0x19, &(0x7f0000000340), 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) close(r1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x702, 0xe, 0x0, &(0x7f0000000580)="e460334470d8d400eb00c15286dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2m34.138727582s ago: executing program 4 (id=905): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffd, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) shutdown(r1, 0x0) 2m34.127905076s ago: executing program 4 (id=907): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x9, &(0x7f0000000000)=0xff, 0x4) (async) getsockopt$inet_tcp_int(r3, 0x6, 0x9, 0x0, &(0x7f00000002c0)) (async) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@ipv4_deladdr={0x2c, 0x15, 0x1, 0xfffffffa, 0x20000000, {0x2, 0x18, 0x0, 0x0, r1}, [@IFA_LABEL={0x14, 0x3, 'veth0\x00'}]}, 0x2c}}, 0x4000850) 2m33.978540804s ago: executing program 4 (id=909): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000100)=@req3={0x1008000, 0x7fffffff, 0x8000, 0x6, 0x0, 0x1}, 0x1c) socket(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99900000000fedbdf25fc000000000000000000000000000000ac1414bb00000000000000000000000000000400000000000a0060", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'], 0xb8}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x9}, {0x0, 0x0, 0x1}}}, 0xb8}}, 0x4000) 2m33.975257899s ago: executing program 4 (id=910): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1303}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x0, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x3c}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f0000000000), 0x4) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x40800}, 0x80) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000101010100000000000000000200000018200480146e0380050047000200000005000200801f0a000000000000000000002c0000611dc6a8039a28b6603bf65e15fefe6cf5b6267c03a940ac16b06014c2eadc4b15485fa67c2bf5e2d01c4fa6f9498ea801a5aa5c2f5299b9368116166f3465780c4616a734309fdbdff2a81e857af93432943437039be618f8c8ab0e98013f2dcefba469303c52056fdfe9a55768e3b141b9c82efe10189ea531129a4463cd01b95a766c0b3a10729636fc579ef77572427be1b786d11b8225317325332bf942d66b2117a96d4560d8021bda56d2316aeaae60e99127fb84"], 0x38}}, 0x4000040) 2m33.678391676s ago: executing program 1 (id=914): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0xb1}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_INDEX={0x8}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x54}}, 0x0) 2m33.645447959s ago: executing program 4 (id=915): socket(0x400000000010, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x2}]}, @func_proto]}}, 0x0, 0x3e, 0x0, 0x0, 0x9}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e127a510800", @ANYRES16=r3], 0x44}}, 0x28081) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[], 0xa0}}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_int(r6, &(0x7f0000000080)='hugetlb.2MB.max_usage_in_bytes\x00', 0x2, 0x0) sendfile(r7, r7, 0x0, 0x1) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060200000800020011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000080)=@newtaction={0x48, 0x30, 0x9, 0x0, 0x0, {}, [{0x34, 0x1, [@m_skbedit={0x30, 0x1, 0x0, 0x0, {{0xc}, {0x4}, {0x4}, {0xc, 0xa}, {0xc, 0x9, {0x60}}}}]}]}, 0x48}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x90) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r11, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x9, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x9, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, 0x0, &(0x7f0000000240)) recvfrom(r11, 0x0, 0x0, 0x2000, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 2m33.595006279s ago: executing program 1 (id=916): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x34, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8}]}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @target={{0xb}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xa, 0x1, 'AUDIT\x00'}]}}}]}], {0x14, 0x10}}, 0xb4}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r4, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r3}, 0x20) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000340)=""/157, 0x9d}], 0x1}}], 0x1, 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f00000000c0)=0x14f) setsockopt$inet6_tcp_int(r3, 0x6, 0x19, &(0x7f0000000080), 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x40000, 0x35288}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x7}, @IFLA_GRE_IFLAGS={0x6, 0x2, 0x4}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x7}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4000080) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r5}, 0x10) r7 = socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x3, 0x300) r8 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r8, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0xfe6c) sendmmsg$inet6(r8, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x4004800) r9 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r9, &(0x7f0000000440)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}], 0x1, 0x48000) writev(r7, &(0x7f00000002c0)=[{&(0x7f00000001c0)="4800000014001d0d09074beafd0d8c560284606088ffe0064e204e20590000a2bc5603ca00000f7f8907000020008d42188fedc22e6ee11ac3439693b948e142ff0000000309ff5b", 0x48}], 0x1) poll(&(0x7f0000000200)=[{r0}], 0x1, 0x1) socket$kcm(0x10, 0x2, 0x0) 2m33.090015002s ago: executing program 4 (id=925): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000010700000000200000000a0000000c0002006e6c3830323131"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_emit_ethernet(0x1016, &(0x7f00000010c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa81004000001142027f62ef"], 0x0) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000011c0)=""/70, 0x46}, {&(0x7f00000000c0)=""/35, 0x23}, {&(0x7f0000003c80)=""/4106, 0x100a}, {&(0x7f00000015c0)=""/4096, 0x1000}], 0x4}, 0x21801}], 0x1, 0x10020, 0x0) 2m33.050071207s ago: executing program 1 (id=926): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newlink={0x88, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0x68, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0x2, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8}, {0x8}]}}, @AF_INET6={0x4}]}]}, 0x88}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x4, &(0x7f0000000340)=@framed={{}, [@func={0x85, 0x2, 0x1, 0x0, 0xfffffffffffffffd}]}, &(0x7f0000000200)='syzkaller\x00', 0x8}, 0x94) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async, rerun: 64) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="4600010002"], 0x8) 2m32.692790058s ago: executing program 32 (id=925): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000010700000000200000000a0000000c0002006e6c3830323131"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_emit_ethernet(0x1016, &(0x7f00000010c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa81004000001142027f62ef"], 0x0) recvmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000011c0)=""/70, 0x46}, {&(0x7f00000000c0)=""/35, 0x23}, {&(0x7f0000003c80)=""/4106, 0x100a}, {&(0x7f00000015c0)=""/4096, 0x1000}], 0x4}, 0x21801}], 0x1, 0x10020, 0x0) 2m32.674547365s ago: executing program 33 (id=926): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newlink={0x88, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0x68, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0x2, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8}, {0x8}]}}, @AF_INET6={0x4}]}]}, 0x88}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x4, &(0x7f0000000340)=@framed={{}, [@func={0x85, 0x2, 0x1, 0x0, 0xfffffffffffffffd}]}, &(0x7f0000000200)='syzkaller\x00', 0x8}, 0x94) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async, rerun: 64) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="4600010002"], 0x8) 12.95807375s ago: executing program 2 (id=2885): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x4, 0xa}, {}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x28, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x1, 0xb}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x3c, r1, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0102}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 12.180547398s ago: executing program 2 (id=2891): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000005600230d00000000e3ffffff06000000", @ANYRES32=0x0], 0x18}}, 0x4000) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000b00)={'veth1_virt_wifi\x00', 0x400}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}, @TCA_NETEM_REORDER={0xc, 0x3, {0x10, 0x6}}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40400}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000d00), r5) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r5, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x48004) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@remote, @remote, 0x0}, &(0x7f0000000100)=0xc) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0xb, 0xf9, 0x9fd2, 0x40, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x8000, 0x788, 0x7f, 0xfffffc2e}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="110000001000000001000000009b000000000000", @ANYRES32, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000002c0)={@rand_addr, @remote, 0x0}, &(0x7f0000000300)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x1e, &(0x7f0000000500)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x400ee, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000740)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r6, @ANYBLOB="00012abd7000fbdbdf25150000002800018014000200767863616e310000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="0800030000000000340001801400020069703667726530000000000000000000080003000300000014000200000000000000000000000000000000000c00018008000300040000002000018068ff020067656e6576653100000000000000000008000100", @ANYRES32=r8, @ANYBLOB="580001801400020070696d36726567300000000000000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="140002006d6163766c616e3000000000000000001400020076657468315f746f5f7465616d00000008000300020000000c00018008000100", @ANYRES32=r10, @ANYBLOB="60000180140002007663616e30000000000000000000000008000100", @ANYRES32=r11, @ANYBLOB="08000145d4eb0904000000b2e9cc40692c03d778000f41c9afdf9e2e589cbe8c24e1246a06a117d815f1c6c6ffe5578dc268eb09487407927b798cc8fccfd8ef9c9262a43794c22f1912e50eff49258db558cc9a2c0724a4b35d48572acfaadd930cf9fafe1da659de65330403000000000000007c15f31facb6db7f3a62b5fda34ead45c2da0a023b8e1a0df251fe397265cde7", @ANYRES32=r12, @ANYBLOB="080003000000000014000200766c616e31000000000000000000000008000300020000001400020076657468305f6d616376746170000000440001801400020076657468315f746f5f626f6e640000000800030000000000080003000000000014000200697036746e6c3000000000000000000008000100", @ANYRES32=r13, @ANYBLOB], 0x1a4}, 0x1, 0x0, 0x0, 0x800}, 0x40001) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00ed00", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, [{0x0, 0xa, "a78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000500000000de25000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f005"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d180610027628cf9ef083611c9f68e2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 10.72804366s ago: executing program 2 (id=2904): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020408032000000000000000000000001e0008003007007bb55900a9a5fb00636472ddfeb5975d12387696107b1b9c3a90d89d7a3ad624c9ff58bc310e25d1709bf5e8131cbd1e86b38b3d01f1f1768a7b3063a25a213e7ae880d9cb27e5388c3486e8bbcac9d5e8eeb89900d72b96b4380c5f334dd73399870debd9a8cadf8b366f9417216f5fe623eb9b95baf17e8d2fde41152ae5b0e50343c294a09673f273c154c198e180f1a49a1ead3818fa1e7bae87e5450623432dfdd6886438bb3be7b6e0c02133a6b4a24bedfedf141c1e153b5aa9ca8eeb4c59c36042123fb182c2c6f78a3a3cbfce7ed81e8229ed4336ba63369fff00"/263], 0x100}, 0x1, 0x7}, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="100000001b1401"], 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x800) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@remote, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=ANY=[@ANYBLOB="0c0100001a0007000000001000000000fe80000000000000000000000000001be0000002000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000b4000000000000020000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb08001f0004000000"], 0x10c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000280)="b106d8e6da1a56dbbc6559cba83ab4188b858542ce191eb1300fe05f2a4a515ea418214eed0c9edec2b8bee7f4", 0x2d}], 0x1}}], 0x1, 0xc044) r7 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r7, 0x0, 0x8, &(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x1) getsockopt$inet_pktinfo(r7, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000140)=0xc) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x2b, r8}) r10 = socket(0xa, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)={0x4fc0, 0x80, 0x6, 0x4, 0x8, 0x80}, 0xc) ioctl(r9, 0x8916, &(0x7f0000000000)) ioctl(r10, 0x6, &(0x7f0000000940)="df16e24889f154b5cdce281f14957ccf50a197a4d82556f0eb399a33357fd200f0e2348a4adf70baf18b067b05abb6b7259f8416ff8b844ed2ebf14182d83605903c4d40ebbd580dee0a0bdff1a9a0f9ef70c35d3d1492adb53c23d9def3bf1da5ffc04ab59d0872bf14261bb1ab604313d4fcb8b09541703d61d89e77537a1fc41d5ee8a2bef0d08f5e9ba8ff3a695441f2f821f9cbb9f79848547dfc36155c9f1917ad367e6e3f") bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 10.56642946s ago: executing program 2 (id=2908): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@newtaction={0x80, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_tunnel_key={0x68, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x0, 0x7, 0x57e00}, @TCA_TUNNEL_KEY_NO_CSUM={0x0, 0xa, 0x1}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x80}}, 0x400c0c4) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dfdbfb, "", [@nested={0x104, 0x117, 0x0, 0x1, [@typed={0xc, 0x16, 0x0, 0x0, @u64=0xfac06}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xeb}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 10.177629048s ago: executing program 2 (id=2914): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000005600230d00000000e3ffffff06000000", @ANYRES32=0x0], 0x18}}, 0x4000) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000b00)={'veth1_virt_wifi\x00', 0x400}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}, @TCA_NETEM_REORDER={0xc, 0x3, {0x10, 0x6}}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40400}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000d00), r5) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x14}}, 0x48004) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@remote, @remote, 0x0}, &(0x7f0000000100)=0xc) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0xb, 0xf9, 0x9fd2, 0x40, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x8000, 0x788, 0x7f, 0xfffffc2e}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="110000001000000001000000009b000000000000", @ANYRES32, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000002c0)={@rand_addr, @remote, 0x0}, &(0x7f0000000300)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x1e, &(0x7f0000000500)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x400ee, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000740)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r6, @ANYBLOB="00012abd7000fbdbdf25150000002800018014000200767863616e310000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="0800030000000000340001801400020069703667726530000000000000000000080003000300000014000200000000000000000000000000000000000c00018008000300040000002000018068ff020067656e6576653100000000000000000008000100", @ANYRES32=r8, @ANYBLOB="580001801400020070696d36726567300000000000000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="140002006d6163766c616e3000000000000000001400020076657468315f746f5f7465616d00000008000300020000000c00018008000100", @ANYRES32=r10, @ANYBLOB="60000180140002007663616e30000000000000000000000008000100", @ANYRES32=r11, @ANYBLOB="08000145d4eb0904000000b2e9cc40692c03d778000f41c9afdf9e2e589cbe8c24e1246a06a117d815f1c6c6ffe5578dc268eb09487407927b798cc8fccfd8ef9c9262a43794c22f1912e50eff49258db558cc9a2c0724a4b35d48572acfaadd930cf9fafe1da659de65330403000000000000007c15f31facb6db7f3a62b5fda34ead45c2da0a023b8e1a0df251fe397265cde7", @ANYRES32=r12, @ANYBLOB="080003000000000014000200766c616e31000000000000000000000008000300020000001400020076657468305f6d616376746170000000440001801400020076657468315f746f5f626f6e640000000800030000000000080003000000000014000200697036746e6c3000000000000000000008000100", @ANYRES32=r13, @ANYBLOB], 0x1a4}, 0x1, 0x0, 0x0, 0x800}, 0x40001) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00ed00", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, [{0x0, 0xa, "a78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000500000000de25000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f005"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d180610027628cf9ef083611c9f68e2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 9.718169529s ago: executing program 2 (id=2918): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020408032000000000000000000000001e0008003007007bb55900a9a5fb00636472ddfeb5975d12387696107b1b9c3a90d89d7a3ad624c9ff58bc310e25d1709bf5e8131cbd1e86b38b3d01f1f1768a7b3063a25a213e7ae880d9cb27e5388c3486e8bbcac9d5e8eeb89900d72b96b4380c5f334dd73399870debd9a8cadf8b366f9417216f5fe623eb9b95baf17e8d2fde41152ae5b0e50343c294a09673f273c154c198e180f1a49a1ead3818fa1e7bae87e5450623432dfdd6886438bb3be7b6e0c02133a6b4a24bedfedf141c1e153b5aa9ca8eeb4c59c36042123fb182c2c6f78a3a3cbfce7ed81e8229ed4336ba63369fff00"/263], 0x100}, 0x1, 0x7}, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="100000001b1401"], 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x800) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@remote, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=ANY=[@ANYBLOB="0c0100001a0007000000001000000000fe80000000000000000000000000001be0000002000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000b4000000000000020000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb08001f0004000000"], 0x10c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000280)="b106d8e6da1a56dbbc6559cba83ab4188b858542ce191eb1300fe05f2a4a515ea418214eed0c9edec2b8bee7f4", 0x2d}], 0x1}}], 0x1, 0xc044) r7 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r7, 0x0, 0x8, &(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x1) getsockopt$inet_pktinfo(r7, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000140)=0xc) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x2b, r8}) r10 = socket(0xa, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)={0x4fc0, 0x80, 0x6, 0x4, 0x8, 0x80}, 0xc) ioctl(r9, 0x8916, &(0x7f0000000000)) ioctl(r10, 0x6, &(0x7f0000000940)="df16e24889f154b5cdce281f14957ccf50a197a4d82556f0eb399a33357fd200f0e2348a4adf70baf18b067b05abb6b7259f8416ff8b844ed2ebf14182d83605903c4d40ebbd580dee0a0bdff1a9a0f9ef70c35d3d1492adb53c23d9def3bf1da5ffc04ab59d0872bf14261bb1ab604313d4fcb8b09541703d61d89e77537a1fc41d5ee8a2bef0d08f5e9ba8ff3a695441f2f821f9cbb9f79848547dfc36155c9f1917ad367e6e3f") bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 4.24217711s ago: executing program 0 (id=2964): r0 = socket(0x2a, 0x2, 0x0) r1 = epoll_create1(0x80000) r2 = socket(0x1, 0x80802, 0x0) epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x8}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x0, 0x2000000}) 4.209889912s ago: executing program 0 (id=2966): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) close(r1) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x3, 0x2d, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x300, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r3, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000ff70c0000000000000072dd0000"], 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x0) 4.109334679s ago: executing program 0 (id=2967): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) sendfile(r2, r2, 0x0, 0x3ffffffffffffe) (async) sendfile(r2, r2, 0x0, 0x3ffffffffffffe) socket$vsock_stream(0x28, 0x1, 0x0) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x1}, 0x10) (async) connect$vsock_stream(r3, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x1}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r3, 0x28, 0x1, &(0x7f0000000100)=0xfffffffffffffffe, 0x112) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x40, 0x1, 0x7, 0x7, {{0x11, 0x4, 0x1, 0x1, 0x44, 0x65, 0x0, 0x40, 0x4, 0x0, @rand_addr=0x64010102, @multicast1, {[@timestamp_prespec={0x44, 0x14, 0xf5, 0x3, 0xe, [{@private=0xa010100, 0x7}, {@multicast2, 0x6b}]}, @lsrr={0x83, 0x1b, 0xb6, [@remote, @broadcast, @private=0xa010101, @multicast2, @local, @rand_addr=0x64010101]}]}}}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x410000}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="5800000070000104254a4c01f7a34026bd7000fedbdf2507000000", @ANYRES32=r4, @ANYBLOB="0c00018008000100410003000c0001800500030001000000100001800c00048008000200110000000c00018008000100100004000c000180060002000b000000"], 0x58}, 0x1, 0x0, 0x0, 0x8041}, 0x4000000) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) (async) close(r5) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'dvmrp1\x00', @multicast}) socket(0x10, 0x3, 0x0) (async) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="200000bb41006977cac0d1ee4306ab3d005200010000000000000000001c0000f1e60006000000fe9100000000000071f2b67444fe6c040798910c8f6c6dd329fcde330c1c29af2a499590fbf5503a22ddcc147d330c96cf5d547a7953c256fbf7e9b2b1d0c8c7e26983c99a5d582cbf820c38e85beaf7140aaffa9da3d94fdc4438e0e1cc9a34b5e51736b0370d24c4071c5c93fff3740be628377b1082e2dc35a4fe294466647af4a952a5d43fb4266620ea347bf41505452e4853f9a5fa3618edfd127b20919306712f1c952aedbe959917962eb81c5341f46068628c8cd296fd22de3587a2cd8ec53e6af889ae434b029057e7e2b1726e40567c04c4"], 0x20}}, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r7, 0x0, 0x3, &(0x7f00000000c0)=""/82, &(0x7f0000000140)=0x52) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0x80000001, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {0x0, 0xd}, {0xffff, 0xb}, {0xd, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4008000) socket$packet(0x11, 0x2, 0x300) (async) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r7, &(0x7f00000001c0)={0x4}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'wg1\x00'}) r10 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r10, 0x29, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x4, 0x0, 0x10001}, 0xc) socket$packet(0x11, 0x3, 0x300) 3.706709503s ago: executing program 0 (id=2971): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$tipc(0x1e, 0x5, 0x0) socket$kcm(0x2, 0xa, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900010073797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001"], 0xc4}, 0x1, 0xffff0000}, 0x20050890) 3.677553639s ago: executing program 3 (id=2972): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) (async) r1 = socket$inet6(0xa, 0x2, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="28000000100001002abd70000000000000000000", @ANYRES32=r7, @ANYBLOB="802100000000000008000d"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) (async) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) (async) r12 = socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) setsockopt$inet_opts(r12, 0x0, 0x0, &(0x7f00000002c0)="6cdfa5395e55cbfc465a4e6052ede8e88511606d4a407938690bcfd9864ae8539a40f5beba63cb814e7f64cd4efb0d64dc39b632461d3062b114207cbe5049642a93b0f41960300890", 0x49) (async) sendmmsg$inet(r1, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010102}}}], 0x20}}], 0x1, 0x0) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0, 0xffffffffffffffff}, 0x4) (async) sendmsg$NFT_BATCH(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r3], 0xfc}, 0x1, 0x0, 0x0, 0x8008044}, 0x44050) (async) r14 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r14, 0x10e, 0xc, &(0x7f00000001c0)={0x80000006}, 0x10) sendmsg$kcm(r14, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1c0000004a008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f0000000100)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3264}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r13}, {}, {0x85, 0x0, 0x0, 0x76}}]}, &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 3.468639442s ago: executing program 0 (id=2974): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000040000701feffffff00000000017c0000040042800c00018006000600800a00000800028004"], 0x2c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) syz_genetlink_get_family_id$SEG6(&(0x7f0000000040), r0) 3.322739824s ago: executing program 0 (id=2977): r0 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000340)) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x41, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014) socket$inet_tcp(0x2, 0x1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000080)={0x0, 0x300, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x8000) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r7, &(0x7f0000000080)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0202}}}, 0x14) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, 0x0, 0x0) 3.243754383s ago: executing program 3 (id=2978): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000005600230d00000000e3ffffff06000000", @ANYRES32=0x0], 0x18}}, 0x4000) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000b00)={'veth1_virt_wifi\x00', 0x400}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}, @TCA_NETEM_REORDER={0xc, 0x3, {0x10, 0x6}}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40400}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000d00), r5) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000d80)=ANY=[], 0x14}}, 0x48004) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@remote, @remote, 0x0}, &(0x7f0000000100)=0xc) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0xb, 0xf9, 0x9fd2, 0x40, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x8000, 0x788, 0x7f, 0xfffffc2e}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="110000001000000001000000009b000000000000", @ANYRES32, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000002c0)={@rand_addr, @remote, 0x0}, &(0x7f0000000300)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x1e, &(0x7f0000000500)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x400ee, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000740)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r6, @ANYBLOB="00012abd7000fbdbdf25150000002800018014000200767863616e310000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="0800030000000000340001801400020069703667726530000000000000000000080003000300000014000200000000000000000000000000000000000c00018008000300040000002000018068ff020067656e6576653100000000000000000008000100", @ANYRES32=r8, @ANYBLOB="580001801400020070696d36726567300000000000000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="140002006d6163766c616e3000000000000000001400020076657468315f746f5f7465616d00000008000300020000000c00018008000100", @ANYRES32=r10, @ANYBLOB="60000180140002007663616e30000000000000000000000008000100", @ANYRES32=r11, @ANYBLOB="08000145d4eb0904000000b2e9cc40692c03d778000f41c9afdf9e2e589cbe8c24e1246a06a117d815f1c6c6ffe5578dc268eb09487407927b798cc8fccfd8ef9c9262a43794c22f1912e50eff49258db558cc9a2c0724a4b35d48572acfaadd930cf9fafe1da659de65330403000000000000007c15f31facb6db7f3a62b5fda34ead45c2da0a023b8e1a0df251fe397265cde7", @ANYRES32=r12, @ANYBLOB="080003000000000014000200766c616e31000000000000000000000008000300020000001400020076657468305f6d616376746170000000440001801400020076657468315f746f5f626f6e640000000800030000000000080003000000000014000200697036746e6c3000000000000000000008000100", @ANYRES32=r13, @ANYBLOB], 0x1a4}, 0x1, 0x0, 0x0, 0x800}, 0x40001) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00ed00", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, [{0x0, 0xa, "a78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000500000000de25000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f005"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d180610027628cf9ef083611c9f68e2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 2.925322831s ago: executing program 3 (id=2983): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000480)={'ip6_vti0\x00', &(0x7f00000003c0)={'ip6tnl0\x00', 0x0, 0x29, 0x77, 0x9, 0x2, 0x42, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x7800, 0x10, 0x68000, 0x620bca37}}) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000080010a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a90000000000000000000000000000000000000000000000f100000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000900000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000000003c"], 0xfc}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="84010000210001000000000000000000fc020000000000000000000000000000fe80000000000000000000000000003500000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000034011100ac14140c000000000000000000000000fc000000000000000000000000000001fc020000000000000000000000000000fe8000000000000000000000000000aa6c01a8000200000002000a00ac1414aa000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000000ff020000000000000000000000000001ff020000003500000a000800ac1414bb000000000000000000000000fc02000000000000000000000000000064010102000000000000000000000000fe8000000000000000000000000000323c"], 0x184}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x5, 0x14, 0x0, &(0x7f0000000100)="259a53f271a76d2608fff74588a80a3888a82f15", 0x0, 0x200, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="000129bd7000fbdb760567d956e2df253a"], 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0x24040000) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) r3 = accept4(0xffffffffffffffff, &(0x7f00000002c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000340)=0x80, 0x80000) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4ecff0000000002711048000000000016000000000000009500000000000000"], &(0x7f0000000640)='syzkaller\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmsg$IPVS_CMD_GET_DEST(r3, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x9c, r4, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x58, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x3}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x13}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x4}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x2e}], 0x1}, 0x40) 2.554340797s ago: executing program 3 (id=2984): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020408032000000000000000000000001e0008003007007bb55900a9a5fb00636472ddfeb5975d12387696107b1b9c3a90d89d7a3ad624c9ff58bc310e25d1709bf5e8131cbd1e86b38b3d01f1f1768a7b3063a25a213e7ae880d9cb27e5388c3486e8bbcac9d5e8eeb89900d72b96b4380c5f334dd73399870debd9a8cadf8b366f9417216f5fe623eb9b95baf17e8d2fde41152ae5b0e50343c294a09673f273c154c198e180f1a49a1ead3818fa1e7bae87e5450623432dfdd6886438bb3be7b6e0c02133a6b4a24bedfedf141c1e153b5aa9ca8eeb4c59c36042123fb182c2c6f78a3a3cbfce7ed81e8229ed4336ba63369fff00"/263], 0x100}, 0x1, 0x7}, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="100000001b1401"], 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x800) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@remote, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=ANY=[@ANYBLOB="0c0100001a0007000000001000000000fe80000000000000000000000000001be0000002000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000b4000000000000020000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb08001f0004000000"], 0x10c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000280)="b106d8e6da1a56dbbc6559cba83ab4188b858542ce191eb1300fe05f2a4a515ea418214eed0c9edec2b8bee7f4", 0x2d}], 0x1}}], 0x1, 0xc044) r7 = socket$inet(0x2, 0x3, 0x8d) recvfrom$rxrpc(r6, &(0x7f0000000a00)=""/203, 0x121, 0x20, &(0x7f0000000300)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e24, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}}, 0x24) getsockopt$inet_pktinfo(r7, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000140)=0xc) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x2b, r8}) r10 = socket(0xa, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)={0x4fc0, 0x80, 0x6, 0x4, 0x8, 0x80}, 0xc) ioctl(r9, 0x8916, &(0x7f0000000000)) ioctl(r10, 0x6, &(0x7f0000000940)="df16e24889f154b5cdce281f14957ccf50a197a4d82556f0eb399a33357fd200f0e2348a4adf70baf18b067b05abb6b7259f8416ff8b844ed2ebf14182d83605903c4d40ebbd580dee0a0bdff1a9a0f9ef70c35d3d1492adb53c23d9def3bf1da5ffc04ab59d0872bf14261bb1ab604313d4fcb8b09541703d61d89e77537a1fc41d5ee8a2bef0d08f5e9ba8ff3a695441f2f821f9cbb9f79848547dfc36155c9f1917ad367e6e3f") bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 1.658193491s ago: executing program 5 (id=2992): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000005600230d00000000e3ffffff06000000", @ANYRES32=0x0], 0x18}}, 0x4000) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000b00)={'veth1_virt_wifi\x00', 0x400}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}, @TCA_NETEM_REORDER={0xc, 0x3, {0x10, 0x6}}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40400}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000d00), r5) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000d80)=ANY=[@ANYRESHEX, @ANYRES16=r6], 0x14}}, 0x48004) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@remote, @remote, 0x0}, &(0x7f0000000100)=0xc) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0xb, 0xf9, 0x9fd2, 0x40, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x8000, 0x788, 0x7f, 0xfffffc2e}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="110000001000000001000000009b000000000000", @ANYRES32, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000002c0)={@rand_addr, @remote, 0x0}, &(0x7f0000000300)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x1e, &(0x7f0000000500)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x400ee, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000740)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r6, @ANYBLOB="00012abd7000fbdbdf25150000002800018014000200767863616e310000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="0800030000000000340001801400020069703667726530000000000000000000080003000300000014000200000000000000000000000000000000000c00018008000300040000002000018068ff020067656e6576653100000000000000000008000100", @ANYRES32=r8, @ANYBLOB="580001801400020070696d36726567300000000000000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="140002006d6163766c616e3000000000000000001400020076657468315f746f5f7465616d00000008000300020000000c00018008000100", @ANYRES32=r10, @ANYBLOB="60000180140002007663616e30000000000000000000000008000100", @ANYRES32=r11, @ANYBLOB="08000145d4eb0904000000b2e9cc40692c03d778000f41c9afdf9e2e589cbe8c24e1246a06a117d815f1c6c6ffe5578dc268eb09487407927b798cc8fccfd8ef9c9262a43794c22f1912e50eff49258db558cc9a2c0724a4b35d48572acfaadd930cf9fafe1da659de65330403000000000000007c15f31facb6db7f3a62b5fda34ead45c2da0a023b8e1a0df251fe397265cde7", @ANYRES32=r12, @ANYBLOB="080003000000000014000200766c616e31000000000000000000000008000300020000001400020076657468305f6d616376746170000000440001801400020076657468315f746f5f626f6e640000000800030000000000080003000000000014000200697036746e6c3000000000000000000008000100", @ANYRES32=r13, @ANYBLOB], 0x1a4}, 0x1, 0x0, 0x0, 0x800}, 0x40001) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00ed00", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, [{0x0, 0xa, "a78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000500000000de25000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f005"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d180610027628cf9ef083611c9f68e2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 943.72377ms ago: executing program 6 (id=2993): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r0, &(0x7f0000000780)}, 0x20) r1 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)) setsockopt$inet_int(r1, 0x0, 0x12, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_POLICY={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWSETELEM={0x9c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x74, 0x3, 0x0, 0x1, [{0x70, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x6c, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x68, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}]}]}]}], {0x14, 0x10}}, 0xec}}, 0x2000c020) 932.422164ms ago: executing program 5 (id=2994): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x2b, 0x53, 0xbb, 0xfffffabd, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xe0f7761995f6091f, 0x700, 0x3, 0x2}}) 903.124137ms ago: executing program 3 (id=2995): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="178d048604bf0bfb1945d7430008", 0x0, 0x501, 0x11, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 769.887947ms ago: executing program 6 (id=2996): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x0, 0xffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x9, 0x0, 0x3, 0xfffffffd}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000540)="18", 0x5dc}], 0x1}, 0x4) 753.159236ms ago: executing program 3 (id=2997): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x44}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000340)=@newlink={0x30, 0x10, 0x503, 0x4, 0xffffffff, {}, [@IFLA_TARGET_NETNSID={0x8}, @IFLA_NET_NS_FD={0x8}]}, 0x30}}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r2}, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x30, r4, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8003, @bearer=@udp='udp:syz2\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x8b, &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0x96, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500800a4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100000000000c0004400000000000000007140000001100010000000000000003000100000a"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000580)=0x0, &(0x7f00000005c0)=0x4) sendmsg$nl_route(r1, &(0x7f0000000800)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000600)={&(0x7f0000000700)=@mpls_newroute={0xd8, 0x18, 0x1, 0x70bd26, 0x25dfdbfd, {0x1c, 0x20, 0x80, 0x7c, 0xfc, 0x2, 0xff, 0xa, 0x200}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_VIA={0x14, 0x12, {0x15, "9d9d223d84305cca3b4d85c99517"}}, @RTA_MULTIPATH={0xc, 0x9, {0x7ff, 0xc, 0x7}}, @RTA_NEWDST={0x84, 0x13, [{0x8000, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x640}, {0x8, 0x0, 0x1}, {0x6, 0x0, 0x1}, {}, {0x8, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x1}, {0x7f}, {0x2}, {0x1}, {0x8}, {0x2}, {0xe}, {0x1, 0x0, 0x1}, {0x401, 0x0, 0x1}, {0x9}, {0x4}, {0x101}, {0x1ff}, {0x1, 0x0, 0x1}, {0x6, 0x0, 0x1}, {0x6}, {0x6, 0x0, 0x1}, {0x1000, 0x0, 0x1}, {0xe, 0x0, 0x1}, {0x401}, {0xff}, {0x3, 0x0, 0x1}, {0x6}]}, @RTA_DST={0x8, 0x1, {0x0, 0x0, 0x1}}, @RTA_OIF={0x8, 0x4, r10}]}, 0xd8}, 0x1, 0x0, 0x0, 0x2000c000}, 0x40000) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r11, 0x100) accept4(r11, 0x0, 0x0, 0x0) shutdown(r11, 0x1) 572.081839ms ago: executing program 5 (id=2998): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000070200000008000300", @ANYRES32=r3, @ANYBLOB="0c00990000000000000000000800a100ffff0000080026008d03000008009f"], 0x40}, 0x1, 0x0, 0x0, 0x44}, 0x0) 469.549487ms ago: executing program 6 (id=2999): socket(0x2a, 0x2, 0x0) r0 = epoll_create1(0x80000) r1 = socket(0x1, 0x80802, 0x0) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x1a000201d}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0x0, 0x2000000}) 424.164469ms ago: executing program 6 (id=3000): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x350, 0xffffffff, 0x1b0, 0x0, 0xe0, 0xfeffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xff, 0x0, 0xff000000, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'ip6erspan0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x23, 0x3, 0x2}, 0x2f2, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x4, 0x3}, {0xffffffffffffffff, 0x1, 0x1}, {0x3, 0x5, 0x6}, 0x10000}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}, {{@ipv6={@private0, @rand_addr=' \x01\x00', [0xff, 0x0, 0xff000000], [0x0, 0xffffffff, 0xff000000, 0xffffff00], 'macvtap0\x00', 'batadv_slave_0\x00', {0xff}, {0xff}, 0x2c, 0x79, 0x4, 0x44}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='cubic', 0xb) setsockopt$sock_int(r0, 0x1, 0x3e, &(0x7f00000000c0), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000900)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x44) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x350, 0xffffffff, 0x1b0, 0x0, 0xe0, 0xfeffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xff, 0x0, 0xff000000, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'ip6erspan0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x23, 0x3, 0x2}, 0x2f2, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x4, 0x3}, {0xffffffffffffffff, 0x1, 0x1}, {0x3, 0x5, 0x6}, 0x10000}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}, {{@ipv6={@private0, @rand_addr=' \x01\x00', [0xff, 0x0, 0xff000000], [0x0, 0xffffffff, 0xff000000, 0xffffff00], 'macvtap0\x00', 'batadv_slave_0\x00', {0xff}, {0xff}, 0x2c, 0x79, 0x4, 0x44}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) bind$inet(r0, 0x0, 0x0) (async) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='cubic', 0xb) (async) setsockopt$sock_int(r0, 0x1, 0x3e, &(0x7f00000000c0), 0x4) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) (async) socket$kcm(0x10, 0x2, 0x10) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) (async) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_ro(r2, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) (async) write$cgroup_subtree(r3, &(0x7f0000000900)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x44) (async) 406.114871ms ago: executing program 5 (id=3001): socket$nl_route(0x10, 0x3, 0x0) 269.92629ms ago: executing program 5 (id=3002): r0 = socket$netlink(0x10, 0x3, 0x9) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x7000000, 0x10, r0, 0x46640000) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000000)=0x6, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000080)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) bind$packet(r2, &(0x7f0000000100)={0x11, 0xf8, r4, 0x1, 0x8, 0x6, @multicast}, 0x14) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000140), 0x8) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) bind$xdp(r5, &(0x7f00000001c0)={0x2c, 0x4, r3, 0x2d, r6}, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000200), r6) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) sendmsg$NL80211_CMD_SET_KEY(r5, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x9c, r7, 0x4, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6c}}}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "6a5a06be8c"}, @NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_TYPE={0x8}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "3170813351"}]}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "7e5da4d7c3c50571d09828a28a"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fd6029a307"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "a766f8dd2d"}]}, 0x9c}, 0x1, 0x0, 0x0, 0x20000080}, 0x20040080) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000400)={0x0, "9895c5fd565ab54055e8cfd4da11a3cb"}) ioctl$BTRFS_IOC_DEV_INFO(r5, 0xd000941e, &(0x7f0000001400)={r8, "0bac665f321a857d503403cfe42879fc"}) setsockopt$inet_mtu(r6, 0x0, 0xa, &(0x7f0000002400)=0x5, 0x4) close(r5) sendmsg$TIPC_NL_NAME_TABLE_GET(r2, &(0x7f0000002540)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000002500)={&(0x7f0000002480)={0x48, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xb}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_BEARER={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000002580)=0x3a24, 0x4) getsockopt$MISDN_TIME_STAMP(r5, 0x0, 0x1, &(0x7f00000025c0), &(0x7f0000002600)=0x4) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000002640)=@base={0x12, 0x401, 0x8, 0x1d5f456a, 0x41239, r6, 0x6, '\x00', r4, r6, 0x0, 0x4, 0x5}, 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000002a00)={0x11, 0x35, &(0x7f00000026c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x200}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}}, @generic={0x5, 0x1, 0x7, 0x95, 0x476}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x113d5a1a}}, @map_fd={0x18, 0x6, 0x1, 0x0, r6}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r10}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffff80}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000002880)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, &(0x7f00000028c0)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000002900)={0x1, 0x0, 0x766fe5f4, 0x3}, 0x10, 0x0, r6, 0x6, &(0x7f0000002940)=[r6, r5, r5, r1, r6], &(0x7f0000002980)=[{0x1, 0x3, 0xe, 0x9}, {0x3, 0x5, 0x9, 0xb}, {0x0, 0x1, 0xd, 0x3}, {0x4, 0x2, 0x2}, {0x3, 0x4, 0xa}, {0x5, 0x3, 0x4, 0x5}], 0x10, 0x9}, 0x94) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000002b00), r6) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r11, &(0x7f0000002e80)={&(0x7f0000002ac0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002e40)={&(0x7f0000002b40)={0x2cc, r12, 0x4, 0x70bd29, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x2}, {0x6, 0x16, 0x4}, {0x5}, {0x6, 0x11, 0x6}, {0x8, 0xb, 0xfff}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}, {0x6, 0x16, 0x359}, {0x5}, {0x6, 0x11, 0x7}, {0x8, 0xb, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x101}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x831}, {0x8, 0xb, 0x4f}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x1000}, {0x6, 0x16, 0x1}, {0x5}, {0x6, 0x11, 0xffff}, {0x8, 0xb, 0x7}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x6e4b}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x7}, {0x8, 0xb, 0x2}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xca7cff5}, {0x6, 0x16, 0x3ff}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x3ff}, {0x8, 0xb, 0x9}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x1ba0}, {0x6, 0x16, 0x4e}, {0x5}, {0x6, 0x11, 0x2}, {0x8, 0xb, 0x81}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x16, 0x8c}, {0x5}, {0x6, 0x11, 0x9}, {0x8, 0xb, 0xfff}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x5}, {0x6, 0x16, 0x2}, {0x5}, {0x6, 0x11, 0x4}, {0x8}}]}, 0x2cc}, 0x1, 0x0, 0x0, 0x4008010}, 0x4000840) sendmsg$DEVLINK_CMD_SB_GET(0xffffffffffffffff, &(0x7f0000003080)={&(0x7f0000002ec0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000003040)={&(0x7f0000002f00)={0x128, r12, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x401}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xc}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x93}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x232}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xffffffff}}]}, 0x128}, 0x1, 0x0, 0x0, 0x40}, 0x4040000) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003100), r5) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000003140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r5, &(0x7f0000003240)={&(0x7f00000030c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000003200)={&(0x7f0000003180)={0x64, r13, 0x200, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r14}, @val={0xc, 0x99, {0xfffffffa, 0x13}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x3d}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x43}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x73}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x34}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x4e}]}, 0x64}, 0x1, 0x0, 0x0, 0x41}, 0x20040010) getsockopt$IPT_SO_GET_INFO(r5, 0x0, 0x40, &(0x7f0000003280)={'raw\x00', 0x0, [0x1000, 0x4, 0x4, 0x3]}, &(0x7f0000003300)=0x54) 223.872764ms ago: executing program 6 (id=3003): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000005600230d00000000e3ffffff06000000", @ANYRES32=0x0], 0x18}}, 0x4000) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000b00)={'veth1_virt_wifi\x00', 0x400}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}, @TCA_NETEM_REORDER={0xc, 0x3, {0x10, 0x6}}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40400}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000d00), r5) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000d80)=ANY=[@ANYRESHEX, @ANYRES16=r6], 0x14}}, 0x48004) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000000c0)={@remote, @remote, 0x0}, &(0x7f0000000100)=0xc) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0xb, 0xf9, 0x9fd2, 0x40, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x8000, 0x788, 0x7f, 0xfffffc2e}}) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="110000001000000001000000009b000000000000", @ANYRES32, @ANYBLOB="0500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000002c0)={@rand_addr, @remote, 0x0}, &(0x7f0000000300)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000480)=[0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x1e, &(0x7f0000000500)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x400ee, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000740)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r6, @ANYBLOB="00012abd7000fbdbdf25150000002800018014000200767863616e310000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="0800030000000000340001801400020069703667726530000000000000000000080003000300000014000200000000000000000000000000000000000c00018008000300040000002000018068ff020067656e6576653100000000000000000008000100", @ANYRES32=r8, @ANYBLOB="580001801400020070696d36726567300000000000000000080003000300000008000100", @ANYRES32=r9, @ANYBLOB="140002006d6163766c616e3000000000000000001400020076657468315f746f5f7465616d00000008000300020000000c00018008000100", @ANYRES32=r10, @ANYBLOB="60000180140002007663616e30000000000000000000000008000100", @ANYRES32=r11, @ANYBLOB="08000145d4eb0904000000b2e9cc40692c03d778000f41c9afdf9e2e589cbe8c24e1246a06a117d815f1c6c6ffe5578dc268eb09487407927b798cc8fccfd8ef9c9262a43794c22f1912e50eff49258db558cc9a2c0724a4b35d48572acfaadd930cf9fafe1da659de65330403000000000000007c15f31facb6db7f3a62b5fda34ead45c2da0a023b8e1a0df251fe397265cde7", @ANYRES32=r12, @ANYBLOB="080003000000000014000200766c616e31000000000000000000000008000300020000001400020076657468305f6d616376746170000000440001801400020076657468315f746f5f626f6e640000000800030000000000080003000000000014000200697036746e6c3000000000000000000008000100", @ANYRES32=r13, @ANYBLOB], 0x1a4}, 0x1, 0x0, 0x0, 0x800}, 0x40001) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00ed00", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, [{0x0, 0xa, "a78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000500000000de25000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f005"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d180610027628cf9ef083611c9f68e2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 74.189497ms ago: executing program 5 (id=3004): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020408032000000000000000000000001e0008003007007bb55900a9a5fb00636472ddfeb5975d12387696107b1b9c3a90d89d7a3ad624c9ff58bc310e25d1709bf5e8131cbd1e86b38b3d01f1f1768a7b3063a25a213e7ae880d9cb27e5388c3486e8bbcac9d5e8eeb89900d72b96b4380c5f334dd73399870debd9a8cadf8b366f9417216f5fe623eb9b95baf17e8d2fde41152ae5b0e50343c294a09673f273c154c198e180f1a49a1ead3818fa1e7bae87e5450623432dfdd6886438bb3be7b6e0c02133a6b4a24bedfedf141c1e153b5aa9ca8eeb4c59c36042123fb182c2c6f78a3a3cbfce7ed81e8229ed4336ba63369fff00"/263], 0x100}, 0x1, 0x7}, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="100000001b1401"], 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x800) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@remote, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=ANY=[@ANYBLOB="0c0100001a0007000000001000000000fe80000000000000000000000000001be0000002000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000b4000000000000020000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb08001f0004000000"], 0x10c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000280)="b106d8e6da1a56dbbc6559cba83ab4188b858542ce191eb1300fe05f2a4a515ea418214eed0c9edec2b8bee7f4", 0x2d}], 0x1}}], 0x1, 0xc044) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x1) recvfrom$rxrpc(r6, &(0x7f0000000a00)=""/203, 0x121, 0x20, &(0x7f0000000300)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e24, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}}, 0x24) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000140)=0xc) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x2b, r7}) r9 = socket(0xa, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)={0x4fc0, 0x80, 0x6, 0x4, 0x8, 0x80}, 0xc) ioctl(r8, 0x8916, &(0x7f0000000000)) ioctl(r9, 0x6, &(0x7f0000000940)="df16e24889f154b5cdce281f14957ccf50a197a4d82556f0eb399a33357fd200f0e2348a4adf70baf18b067b05abb6b7259f8416ff8b844ed2ebf14182d83605903c4d40ebbd580dee0a0bdff1a9a0f9ef70c35d3d1492adb53c23d9def3bf1da5ffc04ab59d0872bf14261bb1ab604313d4fcb8b09541703d61d89e77537a1fc41d5ee8a2bef0d08f5e9ba8ff3a695441f2f821f9cbb9f79848547dfc36155c9f1917ad367e6e3f") bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 0s ago: executing program 6 (id=3005): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="01000000000d00000000008000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x80}}, 0x40000) sendmsg$can_bcm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=ANY=[@ANYBLOB="020000"], 0x48}}, 0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000500)={0x0, @in={{0x2, 0x4e22, @local}}, 0xf, 0x3}, &(0x7f00000005c0)=0x90) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_ext={0x1c, 0x7, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x50}, [@exit, @alu={0x7, 0x1, 0x8, 0xb, 0x3, 0x6, 0xffffffffffffffff}, @initr0={0x18, 0x0, 0x0, 0x0, 0xb}]}, &(0x7f0000000080)='GPL\x00', 0x8, 0xf5, &(0x7f00000000c0)=""/245, 0x41100, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x3, 0x40, 0x2}, 0x10, 0x25187, 0xffffffffffffffff, 0x0, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff, r3], 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r4, 0x0, 0xd4, 0x5b, &(0x7f0000000340)="7e2203ea3f4e3d515f57d82a01a2f05d550a99c3f4da56e179b60f4ff01f6d671613c97f9e95b4ef79817857c1e8ce620468bed812c035b43e4f7e9ed380746e40fe93bf6e01396a5b39fef99484f4dd25e6ccf0613c671837c9b39ec7cfc1ebcbfc2dbfd9b694363678c63414e31562d611849b145918bd5645792d8eba9e78837c1d40207eb68505855d7d20829a3ad5b3b943acadc6bba49fd628760aba4468824f2a1e404ea5b9d2f12f243b68f5d1f0ce33bed17e2149330ce204d029685184df12f0794c2141cb925b63ca165603acddb4", &(0x7f0000000440)=""/91, 0x6, 0x0, 0x52, 0x95, &(0x7f0000000600)="f43886cdda3dc8684a923560d7d55b8c19868e8c9b70967df65778b7214b517f2b5b5fa51c9922b08ba83236b2cafa07f07647eba34d90db978729f02dae5e43c1da389da282517914cfe31a25fd27a00ac9", &(0x7f0000000680)="640f24a131bdb25b43e2905ace5d5a209f25e4fa952073cb4c53f76aca8774b5f13022ccdbe10beb013eb375ddca99896ffcf6d6523fe7651b523522dcdb590dc217ae34c9e483d5651a5c53d830a9950c18167c2fc24e9b21518efe0833c42d30ee9a93f5359ff4e365dcca162f4d1bd9f780951c3adf459db41a471fac9b5a853a36a09078d3ce8bb14d3864b7e9ae3edcf757dd", 0x1, 0x0, 0xfff}, 0x50) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f0000000000)) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000c00)={{{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e24, 0x9, 0x4e23, 0x9, 0x2, 0x80, 0x80, 0x89}, {0x1, 0x98, 0x6, 0x9, 0x1, 0x8, 0x4, 0x5}, {0xffffffffffffff22, 0xe0, 0x2}, 0x68a4, 0x6e6bb9, 0x2, 0x1, 0x3, 0x1}, {{@in6=@loopback, 0x4d3, 0x3c}, 0x2, @in=@loopback, 0x3501, 0x3, 0x2, 0x1, 0xffff7fff, 0x5}}, 0xe8) kernel console output (not intermixed with test programs): 240.839005][T11329] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 240.839033][T11329] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 240.839058][T11329] vfs_write+0x27e/0xb30 [ 240.839088][T11329] ? __pfx_vfs_write+0x10/0x10 [ 240.839109][T11329] ? __fget_files+0x2a/0x420 [ 240.839139][T11329] ? __fget_files+0x3a0/0x420 [ 240.839162][T11329] ? __fget_files+0x2a/0x420 [ 240.839198][T11329] ksys_write+0x145/0x250 [ 240.839220][T11329] ? __pfx_ksys_write+0x10/0x10 [ 240.839252][T11329] do_syscall_64+0xec/0xf80 [ 240.839279][T11329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.839299][T11329] ? trace_irq_disable+0x37/0x100 [ 240.839323][T11329] ? clear_bhb_loop+0x60/0xb0 [ 240.839347][T11329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.839367][T11329] RIP: 0033:0x7ff09918e1ff [ 240.839387][T11329] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 240.839403][T11329] RSP: 002b:00007ff09a004030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 240.839426][T11329] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff09918e1ff [ 240.839440][T11329] RDX: 0000000000000001 RSI: 00007ff09a0040a0 RDI: 0000000000000009 [ 240.839452][T11329] RBP: 00007ff09a004090 R08: 0000000000000000 R09: 0000000000000000 [ 240.839464][T11329] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 240.839476][T11329] R13: 00007ff0993e6038 R14: 00007ff0993e5fa0 R15: 00007ffdd4c14238 [ 240.839511][T11329] [ 241.143567][ T52] Bluetooth: hci2: command 0x0401 tx timeout [ 241.150907][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 241.158994][ C0] lec:lec_tx_timeout: lec0 [ 241.164314][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 241.313034][T11349] netlink: 'syz.2.1494': attribute type 1 has an invalid length. [ 241.540681][T11362] dummy0: left allmulticast mode [ 241.559802][T11362] bridge0: port 3(dummy0) entered disabled state [ 241.613418][T11362] bridge_slave_0: left allmulticast mode [ 241.619217][T11362] bridge_slave_0: left promiscuous mode [ 241.641859][T11373] netlink: 'syz.2.1501': attribute type 1 has an invalid length. [ 241.659252][T11362] bridge0: port 1(bridge_slave_0) entered disabled state [ 241.673973][T11362] bridge_slave_1: left allmulticast mode [ 241.679753][T11362] bridge_slave_1: left promiscuous mode [ 241.686083][T11362] bridge0: port 2(bridge_slave_1) entered disabled state [ 241.701578][T11362] bond0: (slave bond_slave_0): Releasing backup interface [ 241.714087][T11362] bond0: (slave bond_slave_1): Releasing backup interface [ 241.727342][T11362] team0: Port device team_slave_0 removed [ 241.737554][T11362] team0: Port device team_slave_1 removed [ 241.746813][T11362] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 241.756122][T11362] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 241.765930][T11362] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 242.090764][T11398] netlink: 'syz.0.1508': attribute type 3 has an invalid length. [ 242.131236][T11400] delete_channel: no stack [ 242.403073][T11417] netlink: 'syz.3.1515': attribute type 2 has an invalid length. [ 242.760498][T11446] x_tables: duplicate entry at hook 1 [ 242.772620][T11445] x_tables: duplicate entry at hook 1 [ 242.973346][T11460] __nla_validate_parse: 8 callbacks suppressed [ 242.973369][T11460] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1528'. [ 242.998979][T11460] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1528'. [ 243.031042][T11460] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 243.127854][T11464] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1531'. [ 243.151462][T11466] IPv6: NLM_F_CREATE should be specified when creating new route [ 243.430466][T11485] openvswitch: netlink: VXLAN extension 307 out of range max 1 [ 243.432588][T11484] netlink: 148 bytes leftover after parsing attributes in process `syz.6.1538'. [ 243.660290][T11491] pimreg3: entered allmulticast mode [ 243.725496][T11504] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1545'. [ 243.772322][T11504] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1545'. [ 243.799880][T11504] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 244.112705][T11526] dummy0: left promiscuous mode [ 244.614241][T11554] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1561'. [ 244.624699][T11554] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1561'. [ 244.665746][T11554] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1561'. [ 245.001234][T11581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1571'. [ 245.058838][T11581] C: left promiscuous mode [ 245.076111][T11581] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 245.483332][T11611] netlink: 'syz.0.1581': attribute type 2 has an invalid length. [ 245.521268][T11611] netlink: 'syz.0.1581': attribute type 1 has an invalid length. [ 245.553454][T11611] netlink: 'syz.0.1581': attribute type 2 has an invalid length. [ 245.571465][T11611] netlink: 'syz.0.1581': attribute type 2 has an invalid length. [ 246.029792][T11643] netlink: 'syz.5.1592': attribute type 2 has an invalid length. [ 246.171055][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 246.179157][ C0] lec:lec_tx_timeout: lec0 [ 246.185860][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 246.476243][T11671] openvswitch: netlink: IPv4 tun info is not correct [ 246.527794][T11668] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.542696][T11668] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 246.585617][T11671] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 246.612150][T11680] lo: entered promiscuous mode [ 246.617759][T11680] tunl0: entered promiscuous mode [ 246.624359][T11680] gre0: entered promiscuous mode [ 246.630465][T11680] gretap0: entered promiscuous mode [ 246.637980][T11680] erspan0: entered promiscuous mode [ 246.644368][T11680] ip_vti0: entered promiscuous mode [ 247.778118][T11758] netlink: 'syz.2.1633': attribute type 1 has an invalid length. [ 247.858927][T11758] 8021q: adding VLAN 0 to HW filter on device bond7 [ 247.895197][T11758] veth17: entered promiscuous mode [ 247.961726][T11758] bond7: (slave veth17): Enslaving as an active interface with a down link [ 248.099005][T11773] vlan3: entered allmulticast mode [ 248.113376][T11773] bond7: entered allmulticast mode [ 248.133442][T11773] bond7: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 248.238395][T11789] __nla_validate_parse: 12 callbacks suppressed [ 248.238415][T11789] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1640'. [ 248.264813][T11790] sctp: [Deprecated]: syz.6.1639 (pid 11790) Use of struct sctp_assoc_value in delayed_ack socket option. [ 248.264813][T11790] Use struct sctp_sack_info instead [ 248.776296][T11817] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1646'. [ 248.787528][T11817] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 248.919591][T11824] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 249.200005][T11847] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1655'. [ 249.209601][T11847] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1655'. [ 249.219472][T11847] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 249.269544][T11850] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1653'. [ 249.483959][T11867] FAULT_INJECTION: forcing a failure. [ 249.483959][T11867] name failslab, interval 1, probability 0, space 0, times 0 [ 249.497981][T11867] CPU: 1 UID: 0 PID: 11867 Comm: syz.0.1661 Not tainted syzkaller #0 PREEMPT(full) [ 249.498011][T11867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 249.498022][T11867] Call Trace: [ 249.498030][T11867] [ 249.498038][T11867] dump_stack_lvl+0xe8/0x150 [ 249.498071][T11867] should_fail_ex+0x414/0x560 [ 249.498108][T11867] should_failslab+0xa8/0x100 [ 249.498133][T11867] __kmalloc_noprof+0xdf/0x800 [ 249.498153][T11867] ? bpf_test_init+0x9f/0x150 [ 249.498183][T11867] bpf_test_init+0x9f/0x150 [ 249.498210][T11867] bpf_prog_test_run_xdp+0x503/0x10e0 [ 249.498253][T11867] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 249.498285][T11867] ? __fget_files+0x2a/0x420 [ 249.498316][T11867] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 249.498342][T11867] bpf_prog_test_run+0x2c7/0x340 [ 249.498376][T11867] __sys_bpf+0x562/0x860 [ 249.498406][T11867] ? __pfx___sys_bpf+0x10/0x10 [ 249.498451][T11867] ? ksys_write+0x22a/0x250 [ 249.498473][T11867] ? __pfx_ksys_write+0x10/0x10 [ 249.498501][T11867] __x64_sys_bpf+0x7c/0x90 [ 249.498527][T11867] do_syscall_64+0xec/0xf80 [ 249.498547][T11867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.498566][T11867] ? trace_irq_disable+0x37/0x100 [ 249.498592][T11867] ? clear_bhb_loop+0x60/0xb0 [ 249.498616][T11867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.498635][T11867] RIP: 0033:0x7faa7d98f749 [ 249.498654][T11867] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 249.498671][T11867] RSP: 002b:00007faa7e763038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 249.498693][T11867] RAX: ffffffffffffffda RBX: 00007faa7dbe5fa0 RCX: 00007faa7d98f749 [ 249.498708][T11867] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 249.498720][T11867] RBP: 00007faa7e763090 R08: 0000000000000000 R09: 0000000000000000 [ 249.498733][T11867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 249.498745][T11867] R13: 00007faa7dbe6038 R14: 00007faa7dbe5fa0 R15: 00007ffcfebb69a8 [ 249.498780][T11867] [ 249.754141][T11870] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 250.236355][T11893] netlink: 256 bytes leftover after parsing attributes in process `syz.5.1671'. [ 250.392491][T11891] geneve2: left promiscuous mode [ 250.404316][T11913] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1674'. [ 250.411406][T11891] geneve2: left allmulticast mode [ 250.427648][T11905] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1672'. [ 250.437679][T11905] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 250.453874][T11891] veth17: left promiscuous mode [ 250.505090][ T3863] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 250.527068][ T3863] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.543372][ T3863] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 250.552307][ T3863] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 250.582722][T11914] ipvlan4: entered allmulticast mode [ 250.609357][T11914] batadv_slave_1: entered allmulticast mode [ 250.630713][T11914] batman_adv: batadv0: Adding interface: ipvlan4 [ 250.664811][T11914] batman_adv: batadv0: The MTU of interface ipvlan4 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 250.697242][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.719042][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.761284][T11914] batman_adv: batadv0: Interface activated: ipvlan4 [ 251.190183][T11894] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 251.201221][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 251.208523][T11894] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.209295][ C0] lec:lec_tx_timeout: lec0 [ 251.223831][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 251.240540][ T3863] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 251.260649][ T3863] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.545828][T11950] dvmrp6: entered allmulticast mode [ 251.708759][T11958] netlink: 'syz.3.1684': attribute type 33 has an invalid length. [ 251.760633][T11954] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1683'. [ 251.776196][T11957] veth11: entered promiscuous mode [ 251.959117][T11971] netlink: 'syz.6.1690': attribute type 10 has an invalid length. [ 252.110290][T11989] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1695'. [ 252.135898][ T9] IPVS: starting estimator thread 0... [ 252.231134][T11996] IPVS: using max 29 ests per chain, 69600 per kthread [ 252.550601][T12022] xt_hashlimit: size too large, truncated to 1048576 [ 252.628271][T12011] syz_tun: left allmulticast mode [ 252.634647][T12011] syz_tun: left promiscuous mode [ 252.640075][T12011] bridge0: port 3(syz_tun) entered disabled state [ 252.655574][T12011] bridge_slave_1: left allmulticast mode [ 252.669535][T12011] bridge_slave_1: left promiscuous mode [ 252.680354][T12011] bridge0: port 2(bridge_slave_1) entered disabled state [ 252.694591][T12011] bridge_slave_0: left allmulticast mode [ 252.700565][T12011] bridge_slave_0: left promiscuous mode [ 252.708114][T12011] bridge0: port 1(bridge_slave_0) entered disabled state [ 252.947161][T12039] Cannot find del_set index 1 as target [ 253.550138][T12065] __nla_validate_parse: 7 callbacks suppressed [ 253.550157][T12065] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1720'. [ 253.628422][T12071] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 253.922637][T12083] syzkaller0: entered promiscuous mode [ 253.928189][T12083] syzkaller0: entered allmulticast mode [ 254.293211][T12106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 254.376437][T12113] FAULT_INJECTION: forcing a failure. [ 254.376437][T12113] name failslab, interval 1, probability 0, space 0, times 0 [ 254.415841][T12113] CPU: 0 UID: 0 PID: 12113 Comm: syz.0.1732 Not tainted syzkaller #0 PREEMPT(full) [ 254.415871][T12113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 254.415883][T12113] Call Trace: [ 254.415891][T12113] [ 254.415900][T12113] dump_stack_lvl+0xe8/0x150 [ 254.415932][T12113] should_fail_ex+0x414/0x560 [ 254.415979][T12113] should_failslab+0xa8/0x100 [ 254.416006][T12113] __kmalloc_cache_node_noprof+0x88/0x700 [ 254.416028][T12113] ? page_pool_create_percpu+0x76/0xb80 [ 254.416065][T12113] page_pool_create_percpu+0x76/0xb80 [ 254.416095][T12113] ? bpf_test_run_xdp_live+0x1ba/0x1b20 [ 254.416128][T12113] bpf_test_run_xdp_live+0x1cf/0x1b20 [ 254.416154][T12113] ? bpf_dispatcher_change_prog+0xb35/0xc90 [ 254.416187][T12113] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 254.416222][T12113] ? 0xffffffffa0205540 [ 254.416243][T12113] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 254.416270][T12113] ? 0xffffffffa0205540 [ 254.416306][T12113] ? 0xffffffffa0201a08 [ 254.416322][T12113] ? 0xffffffffa02036c8 [ 254.416337][T12113] ? 0xffffffffa0203724 [ 254.416382][T12113] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 254.416421][T12113] ? _copy_from_user+0x94/0xb0 [ 254.416446][T12113] ? bpf_test_init+0x113/0x150 [ 254.416468][T12113] ? xdp_convert_md_to_buff+0x5b/0x330 [ 254.416496][T12113] bpf_prog_test_run_xdp+0x7c0/0x10e0 [ 254.416539][T12113] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 254.416570][T12113] ? __fget_files+0x2a/0x420 [ 254.416600][T12113] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 254.416627][T12113] bpf_prog_test_run+0x2c7/0x340 [ 254.416660][T12113] __sys_bpf+0x562/0x860 [ 254.416688][T12113] ? __pfx___sys_bpf+0x10/0x10 [ 254.416730][T12113] ? ksys_write+0x22a/0x250 [ 254.416751][T12113] ? __pfx_ksys_write+0x10/0x10 [ 254.416779][T12113] __x64_sys_bpf+0x7c/0x90 [ 254.416805][T12113] do_syscall_64+0xec/0xf80 [ 254.416831][T12113] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.416851][T12113] ? trace_irq_disable+0x37/0x100 [ 254.416876][T12113] ? clear_bhb_loop+0x60/0xb0 [ 254.416900][T12113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.416919][T12113] RIP: 0033:0x7faa7d98f749 [ 254.416938][T12113] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 254.416954][T12113] RSP: 002b:00007faa7e763038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 254.416986][T12113] RAX: ffffffffffffffda RBX: 00007faa7dbe5fa0 RCX: 00007faa7d98f749 [ 254.417001][T12113] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 254.417014][T12113] RBP: 00007faa7e763090 R08: 0000000000000000 R09: 0000000000000000 [ 254.417026][T12113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 254.417038][T12113] R13: 00007faa7dbe6038 R14: 00007faa7dbe5fa0 R15: 00007ffcfebb69a8 [ 254.417072][T12113] [ 254.712798][T12118] netlink: 'syz.3.1734': attribute type 24 has an invalid length. [ 254.858596][T12124] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1736'. [ 255.192875][T12137] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1741'. [ 255.210516][T12137] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1741'. [ 255.226199][T12137] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 255.272335][T12147] FAULT_INJECTION: forcing a failure. [ 255.272335][T12147] name failslab, interval 1, probability 0, space 0, times 0 [ 255.304354][T12147] CPU: 1 UID: 0 PID: 12147 Comm: syz.2.1745 Not tainted syzkaller #0 PREEMPT(full) [ 255.304383][T12147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 255.304395][T12147] Call Trace: [ 255.304403][T12147] [ 255.304412][T12147] dump_stack_lvl+0xe8/0x150 [ 255.304444][T12147] should_fail_ex+0x414/0x560 [ 255.304481][T12147] should_failslab+0xa8/0x100 [ 255.304507][T12147] __kvmalloc_node_noprof+0x175/0x920 [ 255.304531][T12147] ? page_pool_create_percpu+0x2dd/0xb80 [ 255.304559][T12147] ? page_pool_create_percpu+0xaf/0xb80 [ 255.304594][T12147] page_pool_create_percpu+0x2dd/0xb80 [ 255.304630][T12147] bpf_test_run_xdp_live+0x1cf/0x1b20 [ 255.304657][T12147] ? bpf_dispatcher_change_prog+0xb35/0xc90 [ 255.304690][T12147] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 255.304724][T12147] ? __pfx_autoremove_wake_function+0x10/0x10 [ 255.304775][T12147] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 255.304803][T12147] ? 0xffffffffa0205540 [ 255.304842][T12147] ? 0xffffffffa0201a08 [ 255.304857][T12147] ? 0xffffffffa02036c8 [ 255.304873][T12147] ? 0xffffffffa020373c [ 255.304918][T12147] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 255.304961][T12147] ? _copy_from_user+0x94/0xb0 [ 255.304987][T12147] ? bpf_test_init+0x113/0x150 [ 255.305010][T12147] ? xdp_convert_md_to_buff+0x5b/0x330 [ 255.305038][T12147] bpf_prog_test_run_xdp+0x7c0/0x10e0 [ 255.305082][T12147] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 255.305113][T12147] ? __fget_files+0x2a/0x420 [ 255.305144][T12147] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 255.305170][T12147] bpf_prog_test_run+0x2c7/0x340 [ 255.305213][T12147] __sys_bpf+0x562/0x860 [ 255.305242][T12147] ? __pfx___sys_bpf+0x10/0x10 [ 255.305287][T12147] ? ksys_write+0x22a/0x250 [ 255.305309][T12147] ? __pfx_ksys_write+0x10/0x10 [ 255.305337][T12147] __x64_sys_bpf+0x7c/0x90 [ 255.305362][T12147] do_syscall_64+0xec/0xf80 [ 255.305381][T12147] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.305400][T12147] ? trace_irq_disable+0x37/0x100 [ 255.305426][T12147] ? clear_bhb_loop+0x60/0xb0 [ 255.305449][T12147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.305469][T12147] RIP: 0033:0x7fe55f18f749 [ 255.305487][T12147] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 255.305504][T12147] RSP: 002b:00007fe560038038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 255.305528][T12147] RAX: ffffffffffffffda RBX: 00007fe55f3e5fa0 RCX: 00007fe55f18f749 [ 255.305542][T12147] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 255.305555][T12147] RBP: 00007fe560038090 R08: 0000000000000000 R09: 0000000000000000 [ 255.305568][T12147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 255.305580][T12147] R13: 00007fe55f3e6038 R14: 00007fe55f3e5fa0 R15: 00007ffe86c35518 [ 255.305615][T12147] [ 255.305699][T12147] page_pool_create_percpu() gave up with errno -12 [ 255.681886][T12142] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1744'. [ 255.696888][T12142] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 255.715866][T12158] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1748'. [ 255.727830][T12158] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1748'. [ 255.827340][T12163] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1751'. [ 255.846877][T12163] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1751'. [ 255.876818][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.158235][T12170] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.165964][T12170] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.175344][T12170] bridge0: left allmulticast mode [ 256.231918][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 256.240024][ C0] lec:lec_tx_timeout: lec0 [ 256.244729][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 256.316855][T12170] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 256.333226][T12170] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 256.432524][T12170] ipvlan2: left promiscuous mode [ 256.439596][T12170] ipvlan3: left promiscuous mode [ 256.450779][T12170] bond1: left promiscuous mode [ 256.455704][T12170] bridge1: left promiscuous mode [ 256.475408][T12170] batman_adv: batadv0: Interface deactivated: ipvlan4 [ 256.482753][T12170] ipvlan4: left allmulticast mode [ 256.487816][T12170] batadv_slave_1: left allmulticast mode [ 256.513741][ T7443] netdevsim netdevsim6 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.545391][ T7443] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.625381][T12174] netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.638100][T12174] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.662027][ T7443] netdevsim netdevsim6 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.671825][ T7443] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.686245][ T7443] netdevsim netdevsim6 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.703867][ T7443] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.748612][T12198] netlink: 'syz.5.1761': attribute type 1 has an invalid length. [ 256.788581][T12204] tipc: Started in network mode [ 256.802071][T12204] tipc: Node identity 6e5cd36e2fac, cluster identity 4711 [ 256.829470][T12204] tipc: Enabled bearer , priority 0 [ 256.852355][T12204] syzkaller0: entered promiscuous mode [ 256.866514][T12204] syzkaller0: entered allmulticast mode [ 256.876277][T12208] tipc: Enabling of bearer rejected, already enabled [ 256.919897][T12208] tipc: Resetting bearer [ 256.944231][T12208] tipc: Disabling bearer [ 257.244730][T12237] netlink: 'syz.5.1772': attribute type 1 has an invalid length. [ 257.268404][T12237] netlink: 'syz.5.1772': attribute type 11 has an invalid length. [ 257.280488][T12237] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1772'. [ 257.355565][T12243] netlink: 'syz.3.1774': attribute type 1 has an invalid length. [ 257.497028][T12251] netlink: 'syz.3.1775': attribute type 8 has an invalid length. [ 257.709064][T12259] tipc: Enabled bearer , priority 2 [ 257.909849][T12272] block nbd0: not configured, cannot reconfigure [ 257.937142][T12272] tc_dump_action: action bad kind [ 258.446622][T12313] openvswitch: netlink: IP tunnel dst address not specified [ 258.467924][T12314] openvswitch: netlink: IP tunnel dst address not specified [ 258.673865][T12318] syzkaller0: entered promiscuous mode [ 258.680136][T12318] syzkaller0: entered allmulticast mode [ 259.275548][T12344] __nla_validate_parse: 3 callbacks suppressed [ 259.275569][T12344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1801'. [ 259.291323][T12344] netlink: 'syz.3.1801': attribute type 25 has an invalid length. [ 259.299177][T12344] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1801'. [ 260.348037][T12323] netlink: 666 bytes leftover after parsing attributes in process `syz.2.1799'. [ 260.358476][ T9] tipc: Node number set to 3718699293 [ 260.397254][T12344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1801'. [ 260.410947][T12344] netlink: 'syz.3.1801': attribute type 25 has an invalid length. [ 260.418798][T12344] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1801'. [ 260.426178][ T76] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.464997][ T76] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.493427][ T76] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.520155][ T76] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.643601][T12353] netlink: 'syz.0.1804': attribute type 11 has an invalid length. [ 260.822005][T12364] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 261.126355][T12401] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 261.363011][T12408] bridge4: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 261.559045][T12413] netlink: 196 bytes leftover after parsing attributes in process `syz.6.1820'. [ 261.604766][T12418] Cannot find add_set index 0 as target [ 261.807977][T12423] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1823'. [ 262.074815][T12445] netlink: 'syz.3.1829': attribute type 1 has an invalid length. [ 262.104027][T12444] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 262.120424][T12445] 8021q: adding VLAN 0 to HW filter on device bond8 [ 262.156344][T12451] bond8: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 262.260901][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6020 ms [ 262.269068][ C0] lec:lec_tx_timeout: lec0 [ 262.274725][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 262.315174][T12445] bond8: entered promiscuous mode [ 262.320331][T12445] bond8: entered allmulticast mode [ 262.333834][T12460] netlink: 'syz.5.1832': attribute type 4 has an invalid length. [ 262.363813][T12460] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1832'. [ 262.408411][T12460] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1832'. [ 262.417558][T12460] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1832'. [ 262.432716][T12460] netlink: 'syz.5.1832': attribute type 6 has an invalid length. [ 262.492575][ T3434] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.510722][ T3434] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.530823][ T3434] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.579570][ T3434] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.894254][T12497] netlink: 'syz.0.1841': attribute type 1 has an invalid length. [ 262.955182][T12500] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 262.978821][T12501] delete_channel: no stack [ 263.039063][T12503] netlink: 'syz.2.1843': attribute type 1 has an invalid length. [ 263.118833][T12503] 8021q: adding VLAN 0 to HW filter on device bond8 [ 263.175430][T12503] bond8: (slave ip6gretap1): making interface the new active one [ 263.185254][T12503] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 263.602430][T12532] netem: incorrect ge model size [ 263.607896][T12532] netem: change failed [ 263.893432][T12551] netlink: 'syz.2.1856': attribute type 1 has an invalid length. [ 264.039943][T12558] bond9: (slave geneve3): making interface the new active one [ 264.048890][T12558] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 264.058729][ T3434] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 264.095324][ T3434] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 264.114486][T12564] mac80211_hwsim hwsim22 syzkaller0: entered promiscuous mode [ 264.133370][T12564] mac80211_hwsim hwsim22 syzkaller0: entered allmulticast mode [ 264.145336][ T3434] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 264.168823][ T3434] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 264.338340][T12575] __nla_validate_parse: 5 callbacks suppressed [ 264.338361][T12575] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1864'. [ 264.462315][T12584] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1868'. [ 264.640779][T12591] netlink: 'syz.3.1871': attribute type 8 has an invalid length. [ 264.905575][T12611] netlink: 'syz.6.1878': attribute type 12 has an invalid length. [ 264.925315][T12611] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1878'. [ 264.936961][T12610] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 264.949378][T12611] netlink: 'syz.6.1878': attribute type 12 has an invalid length. [ 264.957622][T12611] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1878'. [ 265.270629][T12631] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 265.725097][T12610] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 266.237030][T12659] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 266.362440][T12670] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1893'. [ 266.927807][T12711] netlink: 'syz.5.1901': attribute type 10 has an invalid length. [ 266.976777][T12712] netlink: 'syz.5.1901': attribute type 10 has an invalid length. [ 267.071123][T12715] netlink: 'syz.3.1902': attribute type 1 has an invalid length. [ 267.156417][T12715] 8021q: adding VLAN 0 to HW filter on device bond9 [ 267.236351][T12719] veth21: entered promiscuous mode [ 267.271371][T12719] bond9: (slave veth21): Enslaving as an active interface with a down link [ 267.336546][T12715] vlan2: entered allmulticast mode [ 267.363720][T12715] bond9: entered allmulticast mode [ 267.395974][T12715] bond9: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 268.020892][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 268.028981][ C0] lec:lec_tx_timeout: lec0 [ 268.034041][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 268.181293][ T5836] Bluetooth: hci4: command 0x0405 tx timeout [ 268.304138][T12783] syzkaller0: entered promiscuous mode [ 268.309769][T12783] syzkaller0: entered allmulticast mode [ 268.394376][T12793] netlink: 'syz.0.1921': attribute type 1 has an invalid length. [ 268.612752][T12793] 8021q: adding VLAN 0 to HW filter on device bond2 [ 268.722556][T12815] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1926'. [ 268.752582][T12799] veth11: entered promiscuous mode [ 268.764039][T12799] bond2: (slave veth11): Enslaving as an active interface with a down link [ 268.847831][T12806] vlan2: entered allmulticast mode [ 268.853722][T12806] bond2: entered allmulticast mode [ 268.876508][T12806] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 269.088271][T12828] veth17: left promiscuous mode [ 269.136286][T12828] bond7: left promiscuous mode [ 269.152619][T12828] bond8: left promiscuous mode [ 269.172974][T12828] veth21: left promiscuous mode [ 269.176398][T12834] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1929'. [ 269.207438][T12837] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1930'. [ 269.217895][T12838] netlink: 132 bytes leftover after parsing attributes in process `syz.6.1931'. [ 269.227927][T12837] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1930'. [ 269.238584][T12837] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 269.409972][T12844] __nla_validate_parse: 2 callbacks suppressed [ 269.409993][T12844] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1934'. [ 269.453577][T12846] nbd: must specify at least one socket [ 269.669879][T12863] Bluetooth: MGMT ver 1.23 [ 269.674742][T12863] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 269.709992][T12863] gtp0: entered promiscuous mode [ 269.764121][T12863] gtp0: entered allmulticast mode [ 269.822938][T12871] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1944'. [ 269.842794][T12871] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1944'. [ 269.852910][T12871] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 270.074762][T12889] openvswitch: netlink: Key 9 has unexpected len 2 expected 4 [ 270.169486][T12897] netlink: 212356 bytes leftover after parsing attributes in process `syz.6.1953'. [ 270.353288][T12907] netlink: 'syz.5.1956': attribute type 2 has an invalid length. [ 270.369869][T12909] xt_limit: Overflow, try lower: 271964/0 [ 270.379902][T12911] netlink: 'syz.5.1956': attribute type 2 has an invalid length. [ 270.448631][T12914] wireguard0: entered promiscuous mode [ 270.475735][T12914] wireguard0: entered allmulticast mode [ 270.509027][T12914] team0: Device wireguard0 is of different type [ 270.564242][T12917] wireguard0: entered promiscuous mode [ 270.569758][T12917] wireguard0: entered allmulticast mode [ 270.601532][T12930] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1960'. [ 270.631270][T12917] team0: Device wireguard0 is of different type [ 270.768307][T12940] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1963'. [ 270.787608][T12916] tap0: tun_chr_ioctl cmd 1074025672 [ 270.823996][T12916] tap0: ignored: set checksum disabled [ 270.863730][T12945] sock: sock_timestamping_bind_phc: sock not bind to device [ 270.892772][T12942] syzkaller1: entered promiscuous mode [ 270.898657][T12942] syzkaller1: entered allmulticast mode [ 271.018891][T12950] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1966'. [ 271.020154][T12940] 8021q: adding VLAN 0 to HW filter on device bond2 [ 271.080591][T12953] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1966'. [ 271.653864][T12984] netlink: 'syz.3.1973': attribute type 11 has an invalid length. [ 271.675325][T12984] netlink: 199828 bytes leftover after parsing attributes in process `syz.3.1973'. [ 271.748168][T12990] netlink: 'syz.2.1975': attribute type 1 has an invalid length. [ 271.774948][T12990] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1975'. [ 271.794931][T12990] netlink: 'syz.2.1975': attribute type 7 has an invalid length. [ 271.832438][T12990] netlink: 'syz.2.1975': attribute type 8 has an invalid length. [ 271.965497][T13004] netlink: 'syz.3.1978': attribute type 1 has an invalid length. [ 272.134307][T13004] bond12 (unregistering): Released all slaves [ 273.061088][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 273.069160][ C0] lec:lec_tx_timeout: lec0 [ 273.074211][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 273.885504][T13121] ip6tnl1: entered promiscuous mode [ 274.109239][T13129] netdevsim netdevsim5 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 274.395596][T13129] netdevsim netdevsim5 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 274.503567][T13129] netdevsim netdevsim5 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 274.589764][T13129] netdevsim netdevsim5 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 274.725302][T13166] __nla_validate_parse: 15 callbacks suppressed [ 274.725326][T13166] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2024'. [ 274.763584][T13166] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2024'. [ 274.852349][T13175] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2027'. [ 274.861650][T13175] netlink: 2 bytes leftover after parsing attributes in process `syz.3.2027'. [ 274.878295][ T7443] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 274.955002][ T7443] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 274.971841][T13177] syzkaller1: entered promiscuous mode [ 274.993513][T13177] syzkaller1: entered allmulticast mode [ 275.018440][T13177] xt_hashlimit: size too large, truncated to 1048576 [ 275.030269][ T7443] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 275.044135][T13183] netlink: 'syz.2.2032': attribute type 1 has an invalid length. [ 275.053221][T13184] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2030'. [ 275.066254][T13184] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2030'. [ 275.076397][T13184] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 275.131923][T13183] 8021q: adding VLAN 0 to HW filter on device bond10 [ 275.169265][ T61] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 275.357895][T13201] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2034'. [ 275.530725][T13191] veth19: entered promiscuous mode [ 275.539597][T13191] bond10: (slave veth19): Enslaving as an active interface with a down link [ 275.557295][T13205] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2034'. [ 275.584378][T13183] vlan3: entered allmulticast mode [ 275.589745][T13183] bond10: entered allmulticast mode [ 275.597842][T13183] bond10: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 275.706391][ T5836] Bluetooth: hci3: command 0x0405 tx timeout [ 275.849850][T13214] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2039'. [ 275.988129][T13224] syzkaller0: entered promiscuous mode [ 276.006837][T13224] syzkaller0: entered allmulticast mode [ 276.073655][T13224] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2044'. [ 276.198500][T13237] syzkaller1: entered promiscuous mode [ 276.200103][T13240] netlink: 'syz.2.2049': attribute type 1 has an invalid length. [ 276.220157][T13237] syzkaller1: entered allmulticast mode [ 276.267722][T13240] 8021q: adding VLAN 0 to HW filter on device bond11 [ 276.317006][T13246] veth21: entered promiscuous mode [ 276.333904][T13246] bond11: (slave veth21): Enslaving as an active interface with a down link [ 276.344964][T13248] netlink: 'syz.3.2053': attribute type 1 has an invalid length. [ 276.356187][T13248] netlink: 'syz.3.2053': attribute type 2 has an invalid length. [ 276.411263][T13240] vlan3: entered allmulticast mode [ 276.419328][T13240] bond11: entered allmulticast mode [ 276.442669][T13240] bond11: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 277.082488][T13297] netlink: 'syz.5.2069': attribute type 1 has an invalid length. [ 277.174226][T13297] 8021q: adding VLAN 0 to HW filter on device bond3 [ 277.213907][T13302] veth9: entered promiscuous mode [ 277.229990][T13302] bond3: (slave veth9): Enslaving as an active interface with a down link [ 277.305048][T13310] netlink: 'syz.2.2073': attribute type 1 has an invalid length. [ 277.427224][T13301] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 277.451832][T13301] bond_slave_0: left promiscuous mode [ 277.457476][T13301] bond_slave_0: left allmulticast mode [ 277.474625][T13301] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 277.484709][T13301] bond_slave_1: left promiscuous mode [ 277.490305][T13301] bond_slave_1: left allmulticast mode [ 277.510313][T13301] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 277.520751][T13301] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 277.528078][T13301] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 277.546051][T13301] bond0 (unregistering): Released all slaves [ 277.587666][T13297] vlan0: entered allmulticast mode [ 277.593466][T13297] bond3: entered allmulticast mode [ 277.602197][T13297] bond3: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 277.788588][T13331] xt_ipcomp: unknown flags 1D [ 277.805001][T13331] IPVS: Error connecting to the multicast addr [ 277.901159][T13340] netlink: 'syz.5.2082': attribute type 1 has an invalid length. [ 278.044553][T13350] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 278.081171][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 278.089269][ C0] lec:lec_tx_timeout: lec0 [ 278.093899][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 278.222309][T13356] netlink: 'syz.2.2088': attribute type 1 has an invalid length. [ 278.299189][T13356] 8021q: adding VLAN 0 to HW filter on device bond12 [ 278.327699][T13367] netlink: 'syz.5.2090': attribute type 1 has an invalid length. [ 278.346152][T13367] netlink: 'syz.5.2090': attribute type 2 has an invalid length. [ 278.347161][T13366] veth23: entered promiscuous mode [ 278.367507][T13366] bond12: (slave veth23): Enslaving as an active interface with a down link [ 278.388716][T13356] vlan3: entered allmulticast mode [ 278.394204][T13356] bond12: entered allmulticast mode [ 278.401767][T13356] bond12: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 279.247616][T13425] netlink: 'syz.3.2107': attribute type 1 has an invalid length. [ 279.251652][T13420] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 279.263678][T13420] team0: Device macvtap1 is already an upper device of the team interface [ 279.337476][T13425] 8021q: adding VLAN 0 to HW filter on device bond12 [ 279.379597][T13428] veth23: entered promiscuous mode [ 279.406205][T13428] bond12: (slave veth23): Enslaving as an active interface with a down link [ 279.465371][T13425] vlan2: entered allmulticast mode [ 279.472757][T13425] bond12: entered allmulticast mode [ 279.482547][T13425] bond12: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 279.816558][T13446] netlink: 'syz.2.2114': attribute type 33 has an invalid length. [ 279.818274][T13451] __nla_validate_parse: 13 callbacks suppressed [ 279.818291][T13451] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2115'. [ 279.877829][T13446] bond13: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 279.891918][T13446] bond13 (unregistering): Released all slaves [ 280.151215][T13481] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2123'. [ 280.239092][T13486] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2123'. [ 280.697434][T13514] xt_TPROXY: Can be used only with -p tcp or -p udp [ 280.911894][T13526] netlink: 'syz.3.2136': attribute type 23 has an invalid length. [ 281.111181][T13545] netlink: 'syz.2.2142': attribute type 10 has an invalid length. [ 281.122844][T13547] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2141'. [ 281.131471][T13545] team0: Port device dummy0 added [ 281.143558][T13545] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2142'. [ 281.218906][T13554] netlink: 59 bytes leftover after parsing attributes in process `syz.2.2142'. [ 281.562981][T13578] xt_hashlimit: size too large, truncated to 1048576 [ 281.586549][T13570] syzkaller0: entered promiscuous mode [ 281.602407][T13570] syzkaller0: entered allmulticast mode [ 281.789430][T13593] netlink: 132 bytes leftover after parsing attributes in process `syz.6.2152'. [ 281.813783][T13596] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2153'. [ 282.174334][T13611] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2156'. [ 282.471364][ T61] team0: left allmulticast mode [ 282.494651][ T61] team_slave_1: left allmulticast mode [ 282.523493][ T61] team0: left promiscuous mode [ 282.530641][ T61] team_slave_1: left promiscuous mode [ 282.542511][ T61] bridge0: port 3(team0) entered disabled state [ 282.556577][ T61] bridge_slave_1: left allmulticast mode [ 282.570068][ T61] bridge_slave_1: left promiscuous mode [ 282.581813][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.601807][ T61] bridge_slave_0: left allmulticast mode [ 282.607504][ T61] bridge_slave_0: left promiscuous mode [ 282.620899][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.933539][T13647] validate_nla: 2 callbacks suppressed [ 282.933559][T13647] netlink: 'syz.2.2164': attribute type 1 has an invalid length. [ 283.100905][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 283.109039][ C0] lec:lec_tx_timeout: lec0 [ 283.114461][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 283.177461][ T61] bond8 (unregistering): (slave bridge1): Releasing backup interface [ 283.196423][ T61] bridge1 (unregistering): left promiscuous mode [ 283.285818][ T61] team0: Port device bridge2 removed [ 283.454906][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 283.468890][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 283.479683][ T61] bond0 (unregistering): Released all slaves [ 283.494459][ T61] bond1 (unregistering): Released all slaves [ 283.598180][ T61] bond2 (unregistering): (slave veth3): Releasing active interface [ 283.606973][ T61] bond2 (unregistering): Released all slaves [ 283.705801][ T61] bond3 (unregistering): (slave veth5): Releasing active interface [ 283.715072][ T61] bond3 (unregistering): Released all slaves [ 283.817604][ T61] bond4 (unregistering): (slave veth7): Releasing active interface [ 283.827036][ T61] bond4 (unregistering): Released all slaves [ 283.929609][ T61] bond5 (unregistering): (slave veth9): Releasing active interface [ 283.938441][ T61] bond5 (unregistering): Released all slaves [ 283.953379][ T61] bond6 (unregistering): Released all slaves [ 284.057924][ T61] bond7 (unregistering): (slave veth15): Releasing active interface [ 284.068710][ T61] bond7 (unregistering): Released all slaves [ 284.169037][ T61] bond8 (unregistering): Released all slaves [ 284.269377][ T61] bond9 (unregistering): (slave veth17): Releasing active interface [ 284.279230][ T61] bond9 (unregistering): Released all slaves [ 284.351779][T13647] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 284.437626][T13650] veth25: entered promiscuous mode [ 284.486547][T13658] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2166'. [ 284.507304][T13658] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 284.630306][T13675] FAULT_INJECTION: forcing a failure. [ 284.630306][T13675] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 284.661042][ T61] tipc: Left network mode [ 284.667997][T13675] CPU: 0 UID: 0 PID: 13675 Comm: syz.6.2170 Not tainted syzkaller #0 PREEMPT(full) [ 284.668025][T13675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 284.668038][T13675] Call Trace: [ 284.668046][T13675] [ 284.668054][T13675] dump_stack_lvl+0xe8/0x150 [ 284.668086][T13675] should_fail_ex+0x414/0x560 [ 284.668120][T13675] _copy_from_user+0x2d/0xb0 [ 284.668146][T13675] ___sys_recvmsg+0x12e/0x510 [ 284.668171][T13675] ? get_pid_task+0x20/0x1f0 [ 284.668194][T13675] ? get_pid_task+0x20/0x1f0 [ 284.668222][T13675] ? __pfx____sys_recvmsg+0x10/0x10 [ 284.668251][T13675] ? __fget_files+0x2a/0x420 [ 284.668295][T13675] ? __fget_files+0x3a0/0x420 [ 284.668331][T13675] __x64_sys_recvmsg+0x198/0x260 [ 284.668359][T13675] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 284.668395][T13675] ? __pfx_ksys_write+0x10/0x10 [ 284.668429][T13675] do_syscall_64+0xec/0xf80 [ 284.668450][T13675] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.668468][T13675] ? trace_irq_disable+0x37/0x100 [ 284.668494][T13675] ? clear_bhb_loop+0x60/0xb0 [ 284.668515][T13675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.668531][T13675] RIP: 0033:0x7fbe5758f749 [ 284.668547][T13675] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 284.668563][T13675] RSP: 002b:00007fbe583e0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 284.668583][T13675] RAX: ffffffffffffffda RBX: 00007fbe577e5fa0 RCX: 00007fbe5758f749 [ 284.668596][T13675] RDX: 0000000040002100 RSI: 00002000000008c0 RDI: 0000000000000003 [ 284.668607][T13675] RBP: 00007fbe583e0090 R08: 0000000000000000 R09: 0000000000000000 [ 284.668617][T13675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 284.668628][T13675] R13: 00007fbe577e6038 R14: 00007fbe577e5fa0 R15: 00007ffffd9e3f28 [ 284.668657][T13675] [ 284.930626][T13682] __nla_validate_parse: 1 callbacks suppressed [ 284.930647][T13682] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2172'. [ 285.109089][T13690] netlink: 'syz.6.2175': attribute type 10 has an invalid length. [ 285.138955][T13690] netlink: 2 bytes leftover after parsing attributes in process `syz.6.2175'. [ 285.142110][T13693] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2176'. [ 285.160970][T13693] netlink: 'syz.0.2176': attribute type 7 has an invalid length. [ 285.181288][T13693] netlink: 'syz.0.2176': attribute type 8 has an invalid length. [ 285.189074][T13693] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2176'. [ 285.206615][T13690] team0: entered promiscuous mode [ 285.217148][T13690] team_slave_0: entered promiscuous mode [ 285.255788][T13690] team_slave_1: entered promiscuous mode [ 285.273044][T13690] 8021q: adding VLAN 0 to HW filter on device team0 [ 285.296152][T13690] bridge0: port 3(team0) entered blocking state [ 285.312012][T13690] bridge0: port 3(team0) entered disabled state [ 285.329664][T13690] team0: entered allmulticast mode [ 285.353201][T13690] team_slave_0: entered allmulticast mode [ 285.375246][T13690] team_slave_1: entered allmulticast mode [ 285.411665][T13709] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2177'. [ 285.468364][T13708] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2178'. [ 285.721153][T13719] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2178'. [ 286.020539][T13739] openvswitch: netlink: IP tunnel dst address not specified [ 286.078513][T13622] udevd[13622]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 286.158615][T13751] netlink: 'syz.5.2185': attribute type 9 has an invalid length. [ 286.435317][T13757] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 286.550199][T13765] netlink: 'syz.5.2189': attribute type 10 has an invalid length. [ 286.584149][T13765] netlink: 2 bytes leftover after parsing attributes in process `syz.5.2189'. [ 286.722350][ T61] hsr_slave_0: left promiscuous mode [ 286.748888][ T61] hsr_slave_1: left promiscuous mode [ 286.768124][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 286.800129][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 287.398517][T13782] netlink: 120 bytes leftover after parsing attributes in process `syz.3.2192'. [ 287.424073][T13782] netlink: 'syz.3.2192': attribute type 1 has an invalid length. [ 287.432068][T13782] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2192'. [ 287.527402][ T61] team0 (unregistering): Port device team_slave_1 removed [ 287.889498][T13768] vcan0: entered allmulticast mode [ 287.899495][T13757] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 288.019696][T13757] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 288.121034][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 288.129439][ C0] lec:lec_tx_timeout: lec0 [ 288.134515][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 288.252648][T13757] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 288.504735][T13808] rdma_op ffff88807a2e49f0 conn xmit_rdma 0000000000000000 [ 288.598710][ T1041] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 288.771940][ T1041] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 288.848165][ T1041] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 288.885158][ T1041] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 288.955550][T13831] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 289.088267][T13826] netlink: 'syz.5.2201': attribute type 83 has an invalid length. [ 289.198948][T13848] syzkaller0: entered promiscuous mode [ 289.206520][T13848] syzkaller0: entered allmulticast mode [ 289.257991][T13853] !: renamed from dummy0 [ 290.245219][T13902] tipc: Started in network mode [ 290.250163][T13902] tipc: Node identity 3ae2e5401823, cluster identity 4711 [ 290.321078][T13902] tipc: Enabled bearer , priority 0 [ 290.350002][T13912] __nla_validate_parse: 6 callbacks suppressed [ 290.350023][T13912] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2222'. [ 290.350265][T13910] syzkaller0: entered promiscuous mode [ 290.379602][T13910] syzkaller0: entered allmulticast mode [ 290.422331][T13902] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 290.496721][T13902] tipc: Resetting bearer [ 290.610048][T13932] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2224'. [ 290.634840][T13899] tipc: Resetting bearer [ 290.690469][T13899] tipc: Disabling bearer [ 290.837880][T13946] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2229'. [ 290.887122][T13931] caif0 speed is unknown, defaulting to 1000 [ 290.917547][T13937] netlink: 'syz.2.2227': attribute type 15 has an invalid length. [ 292.160953][T13979] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2236'. [ 292.185638][T13980] netlink: 'syz.0.2235': attribute type 1 has an invalid length. [ 292.331295][T13987] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2235'. [ 292.529642][T14002] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2241'. [ 292.670200][T14008] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 292.706366][T14008] mac80211_hwsim hwsim22 syzkaller0: left promiscuous mode [ 292.734162][T14008] mac80211_hwsim hwsim22 syzkaller0: left allmulticast mode [ 293.107714][T14033] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2252'. [ 293.113530][T14032] netlink: 'syz.0.2251': attribute type 1 has an invalid length. [ 293.140972][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 293.146516][T14035] netlink: 84 bytes leftover after parsing attributes in process `syz.6.2253'. [ 293.149057][ C0] lec:lec_tx_timeout: lec0 [ 293.163241][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 293.276197][T14032] 8021q: adding VLAN 0 to HW filter on device bond0 [ 293.293368][ T24] hid (null): global environment stack underflow [ 293.417377][T14039] veth13: entered promiscuous mode [ 293.454867][T14039] bond0: (slave veth13): Enslaving as an active interface with a down link [ 293.518353][T14045] vlan2: entered allmulticast mode [ 293.524303][T14045] bond0: entered allmulticast mode [ 293.527100][T14054] netlink: 'syz.2.2257': attribute type 11 has an invalid length. [ 293.531824][T14045] bond0: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 293.556164][T14054] netlink: 'syz.2.2257': attribute type 11 has an invalid length. [ 293.586453][T14054] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2257'. [ 293.768475][T14052] caif0 speed is unknown, defaulting to 1000 [ 293.808325][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.842926][T14056] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2259'. [ 293.851150][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.859451][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.877205][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.911002][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.918466][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.951035][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.958680][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 293.987910][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 294.021181][ T24] hid-generic 0005:07C0:0401.0001: unknown main item tag 0x0 [ 294.062936][ T24] hid-generic 0005:07C0:0401.0001: unexpected long global item [ 294.091702][ T24] hid-generic 0005:07C0:0401.0001: probe with driver hid-generic failed with error -22 [ 294.305594][T14080] mac80211_hwsim hwsim22 syzkaller0: entered promiscuous mode [ 294.335931][T14080] mac80211_hwsim hwsim22 syzkaller0: entered allmulticast mode [ 294.414530][T14087] xt_socket: unknown flags 0x50 [ 294.667853][T14103] openvswitch: netlink: IP tunnel TTL not specified. [ 294.680316][T14098] syzkaller1: entered promiscuous mode [ 294.705300][T14098] syzkaller1: entered allmulticast mode [ 294.823593][T14109] netlink: 'syz.5.2276': attribute type 16 has an invalid length. [ 295.131597][T14116] geneve2: entered promiscuous mode [ 295.136969][T14116] geneve2: entered allmulticast mode [ 295.159750][ T7460] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.216075][ T7460] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.252864][ T7460] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.278974][ T7460] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.596396][T14151] netlink: 'syz.3.2288': attribute type 1 has an invalid length. [ 295.778039][T14151] 8021q: adding VLAN 0 to HW filter on device bond13 [ 295.828361][T14159] veth25: entered promiscuous mode [ 295.847391][T14159] bond13: (slave veth25): Enslaving as an active interface with a down link [ 295.874848][T14169] netlink: 'syz.0.2292': attribute type 1 has an invalid length. [ 295.881156][T14161] vlan2: entered allmulticast mode [ 295.888840][T14161] bond13: entered allmulticast mode [ 295.892650][T14170] __nla_validate_parse: 8 callbacks suppressed [ 295.892666][T14170] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2293'. [ 295.896394][T14161] bond13: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 295.928313][T14172] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2292'. [ 295.938177][T14172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2292'. [ 295.971078][T14165] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2291'. [ 295.980103][T14165] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2291'. [ 295.990701][T14165] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 296.287357][T14180] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2296'. [ 296.459196][T14194] netlink: 'syz.6.2299': attribute type 13 has an invalid length. [ 296.468397][T14194] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2299'. [ 296.478737][T14195] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2301'. [ 296.624394][T14202] netlink: 'syz.3.2304': attribute type 1 has an invalid length. [ 296.626905][T14206] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2303'. [ 296.650738][T14205] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2305'. [ 296.660663][T14205] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 296.747622][T14202] 8021q: adding VLAN 0 to HW filter on device bond14 [ 296.805555][T14209] veth27: entered promiscuous mode [ 296.823149][T14209] bond14: (slave veth27): Enslaving as an active interface with a down link [ 296.863305][T14214] vlan2: entered allmulticast mode [ 296.868578][T14214] bond14: entered allmulticast mode [ 296.876304][T14214] bond14: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 297.101311][T14237] SET target dimension over the limit! [ 297.249787][T14242] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 297.356855][T14242] bond3: (slave lo): Enslaving as a backup interface with an up link [ 297.404560][T14242] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 297.789775][T14275] openvswitch: netlink: IP tunnel dst address not specified [ 297.855847][T14275] netlink: 'syz.0.2322': attribute type 1 has an invalid length. [ 297.882151][T14275] netlink: 'syz.0.2322': attribute type 4 has an invalid length. [ 297.888864][T14284] netlink: 'syz.2.2324': attribute type 2 has an invalid length. [ 297.942955][T14284] : entered promiscuous mode [ 298.011768][T14287] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 298.075110][T14287] syzkaller1: entered promiscuous mode [ 298.095975][T14287] syzkaller1: entered allmulticast mode [ 298.171053][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 298.179225][ C0] lec:lec_tx_timeout: lec0 [ 298.184745][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 298.492794][T14329] netlink: 'syz.0.2337': attribute type 7 has an invalid length. [ 298.600627][T14339] IPVS: set_ctl: invalid protocol: 41 224.0.0.2:20004 [ 298.709934][T14342] netlink: 'syz.0.2341': attribute type 1 has an invalid length. [ 299.013252][T14364] x_tables: duplicate underflow at hook 2 [ 299.287697][T14384] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 299.339916][T14384] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 299.349021][T14384] gretap3: entered promiscuous mode [ 299.355510][T14384] gretap3: entered allmulticast mode [ 299.847139][T14403] team0: Port device dummy0 removed [ 299.911842][T14403] bridge_slave_0: left allmulticast mode [ 299.951200][T14403] bridge_slave_0: left promiscuous mode [ 299.957114][T14403] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.989447][T14405] netlink: 'syz.5.2364': attribute type 1 has an invalid length. [ 300.046084][T14403] bridge_slave_1: left allmulticast mode [ 300.062625][T14403] bridge_slave_1: left promiscuous mode [ 300.078758][T14403] bridge0: port 2(bridge_slave_1) entered disabled state [ 300.125178][T14403] bond0: (slave 1!): Releasing backup interface [ 300.223990][T14403] bond0: (slave bond_slave_1): Releasing backup interface [ 300.243432][T14403] team0: Port device team_slave_0 removed [ 300.276917][T14403] team0: Port device team_slave_1 removed [ 300.299699][T14403] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 300.315264][T14403] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 300.325118][T14403] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 300.399240][T14405] 8021q: adding VLAN 0 to HW filter on device bond4 [ 300.443476][T14410] veth11: entered promiscuous mode [ 300.457241][T14410] bond4: (slave veth11): Enslaving as an active interface with a down link [ 300.479388][T14414] vlan0: entered allmulticast mode [ 300.485514][T14414] bond4: entered allmulticast mode [ 300.493820][T14414] bond4: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 301.102528][T14462] __nla_validate_parse: 19 callbacks suppressed [ 301.102551][T14462] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2377'. [ 301.146028][T14462] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2377'. [ 301.157401][T14462] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 301.193758][T14468] xt_l2tp: v2 tid > 0xffff: 1114244 [ 301.199716][T14465] syzkaller0: entered promiscuous mode [ 301.208850][T14465] syzkaller0: entered allmulticast mode [ 301.218952][T14466] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2378'. [ 301.599573][T14487] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2386'. [ 303.196669][T14501] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2390'. [ 303.210885][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 303.219058][ C0] lec:lec_tx_timeout: lec0 [ 303.221788][T14501] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2390'. [ 303.225524][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 303.352325][T14507] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2392'. [ 303.500299][T14515] syzkaller1: entered promiscuous mode [ 303.521338][T14515] syzkaller1: entered allmulticast mode [ 304.040610][T14539] netlink: 'syz.6.2404': attribute type 1 has an invalid length. [ 304.050744][T14541] netlink: 'syz.0.2403': attribute type 2 has an invalid length. [ 304.069704][T14539] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2404'. [ 304.088589][T14541] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2403'. [ 304.113664][T14541] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2403'. [ 304.262128][T14552] xt_TPROXY: Can be used only with -p tcp or -p udp [ 304.421193][T14567] delete_channel: no stack [ 304.544789][T14573] netlink: 'syz.5.2413': attribute type 1 has an invalid length. [ 304.908022][T14608] netlink: 'syz.0.2425': attribute type 3 has an invalid length. [ 305.051144][T14616] netlink: 'syz.0.2428': attribute type 16 has an invalid length. [ 305.246069][T14633] netlink: 'syz.2.2430': attribute type 10 has an invalid length. [ 305.296516][T14633] team0: Port device dummy0 added [ 305.316652][T14634] syzkaller1: entered promiscuous mode [ 305.323365][T14634] syzkaller1: entered allmulticast mode [ 305.636039][T14656] netlink: 'syz.0.2437': attribute type 1 has an invalid length. [ 305.669337][T14656] bond3: entered promiscuous mode [ 305.679205][T14656] 8021q: adding VLAN 0 to HW filter on device bond3 [ 305.712208][T14648] bond3: (slave bridge7): making interface the new active one [ 305.719741][T14648] bridge7: entered promiscuous mode [ 305.754080][T14648] bond3: (slave bridge7): Enslaving as an active interface with an up link [ 305.850819][T14663] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 305.953351][T14667] 0{X: left allmulticast mode [ 306.029562][T14667] bond7: left allmulticast mode [ 306.042842][T14667] bond8: left allmulticast mode [ 306.050774][T14667] ip6tnl1: left promiscuous mode [ 306.058561][T14667] veth23: left promiscuous mode [ 306.066613][T14667] veth25: left promiscuous mode [ 306.074271][T14667] veth27: left promiscuous mode [ 306.081093][T14669] veth0: entered promiscuous mode [ 306.102132][ T61] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.137844][ T61] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.160948][T14674] veth0: left promiscuous mode [ 306.181876][ T61] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.229278][ T61] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.263328][T14679] __nla_validate_parse: 23 callbacks suppressed [ 306.263350][T14679] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2448'. [ 306.319249][T14680] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2447'. [ 306.351352][T14680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2447'. [ 306.434249][T14684] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2450'. [ 306.553829][T14695] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2453'. [ 306.568784][T14695] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2453'. [ 306.592126][T14695] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2453'. [ 306.603411][T14697] tipc: Enabled bearer , priority 10 [ 306.615036][T14697] netlink: 'syz.0.2454': attribute type 2 has an invalid length. [ 306.644896][T14697] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2454'. [ 306.686423][T14700] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2455'. [ 306.726844][T14702] netlink: 'syz.2.2456': attribute type 1 has an invalid length. [ 306.819507][T14707] netlink: 'syz.3.2458': attribute type 1 has an invalid length. [ 306.861837][T14706] veth25: entered promiscuous mode [ 306.910045][T14719] netlink: 'syz.6.2461': attribute type 1 has an invalid length. [ 306.936558][T14719] netlink: 'syz.6.2461': attribute type 1 has an invalid length. [ 306.942245][T14702] 8021q: adding VLAN 0 to HW filter on device bond13 [ 306.957567][T14719] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2461'. [ 306.968275][T14711] vlan3: entered allmulticast mode [ 306.973697][T14711] bond13: entered allmulticast mode [ 307.007701][T14707] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 307.025215][T14721] lo: left promiscuous mode [ 307.065085][T14721] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.095686][T14722] netlink: 'syz.0.2462': attribute type 1 has an invalid length. [ 307.103836][T14727] netlink: 'syz.3.2463': attribute type 1 has an invalid length. [ 307.132641][T14727] ip6t_srh: unknown srh match flags 4000 [ 307.255353][T14733] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 307.262764][T14733] IPv6: NLM_F_CREATE should be set when creating new route [ 307.270157][T14733] IPv6: NLM_F_CREATE should be set when creating new route [ 307.322719][T14733] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 307.344640][T14733] batadv1: entered allmulticast mode [ 307.485691][T14745] lo: entered allmulticast mode [ 307.724103][T14757] xt_hashlimit: max too large, truncated to 1048576 [ 307.748737][T14757] xt_hashlimit: max too large, truncated to 1048576 [ 307.751978][ T9] tipc: Node number set to 583132480 [ 308.346688][T14804] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20003 [ 308.594659][T14821] dvmrp6: entered allmulticast mode [ 308.913257][T14836] bond5: option resend_igmp: invalid value (32767) [ 308.919917][T14836] bond5: option resend_igmp: allowed values 0 - 255 [ 308.943337][T14836] bond5 (unregistering): Released all slaves [ 309.060932][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5830 ms [ 309.069010][ C0] lec:lec_tx_timeout: lec0 [ 309.073662][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 309.550632][T14889] xt_NFQUEUE: number of queues (27568) out of range (got 68779) [ 309.911951][T14906] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 310.359005][T14942] validate_nla: 4 callbacks suppressed [ 310.359028][T14942] netlink: 'syz.0.2535': attribute type 1 has an invalid length. [ 310.404371][T14942] 8021q: adding VLAN 0 to HW filter on device bond4 [ 310.436644][T14942] veth15: entered promiscuous mode [ 310.446260][T14942] bond4: (slave veth15): Enslaving as an active interface with a down link [ 310.467518][T14942] vlan2: entered allmulticast mode [ 310.474362][T14942] bond4: entered allmulticast mode [ 310.482071][T14942] bond4: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 310.550622][T14948] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 310.925600][T14973] xt_l2tp: missing protocol rule (udp|l2tpip) [ 311.074358][T14984] netlink: 'syz.3.2552': attribute type 1 has an invalid length. [ 311.179894][T14984] 8021q: adding VLAN 0 to HW filter on device bond15 [ 311.228186][T14996] veth31: entered promiscuous mode [ 311.238807][T14996] bond15: (slave veth31): Enslaving as an active interface with a down link [ 311.260296][T15000] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 311.285262][T14984] vlan2: entered allmulticast mode [ 311.290660][T14984] bond15: entered allmulticast mode [ 311.298217][T14984] bond15: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 311.559473][T15017] __nla_validate_parse: 23 callbacks suppressed [ 311.559495][T15017] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2562'. [ 311.577684][T15017] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2562'. [ 311.696193][T15027] tipc: Enabled bearer , priority 2 [ 311.810321][T15031] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2566'. [ 311.851223][T15031] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2566'. [ 311.944191][T15034] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2566'. [ 312.133491][T15050] netlink: 'syz.6.2571': attribute type 1 has an invalid length. [ 312.195520][T15050] 8021q: adding VLAN 0 to HW filter on device bond4 [ 312.271510][T15050] veth5: entered promiscuous mode [ 312.290182][T15050] bond4: (slave veth5): Enslaving as an active interface with a down link [ 312.309096][T15056] vlan2: entered allmulticast mode [ 312.315068][T15056] bond4: entered allmulticast mode [ 312.322427][T15056] bond4: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 312.458429][T15066] xt_CT: You must specify a L4 protocol and not use inversions on it [ 312.510015][T15068] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2577'. [ 312.549238][T15071] netlink: 'syz.5.2579': attribute type 21 has an invalid length. [ 312.557645][T15071] netlink: 152 bytes leftover after parsing attributes in process `syz.5.2579'. [ 312.692241][T15076] veth33: entered allmulticast mode [ 312.712745][ T9] tipc: Node number set to 1106301806 [ 312.778458][T15084] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2583'. [ 312.836354][T15089] netlink: 'syz.5.2583': attribute type 3 has an invalid length. [ 312.878995][T15089] veth0: entered promiscuous mode [ 312.913211][T15084] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2583'. [ 312.945774][T15084] veth0 (unregistering): left promiscuous mode [ 313.129175][T15095] netlink: 'syz.2.2587': attribute type 2 has an invalid length. [ 313.139766][T15098] netlink: 'syz.5.2588': attribute type 1 has an invalid length. [ 313.149979][T15092] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2585'. [ 313.239473][T15098] 8021q: adding VLAN 0 to HW filter on device bond5 [ 313.309937][T15102] veth1: entered promiscuous mode [ 313.321899][T15102] bond5: (slave veth1): Enslaving as an active interface with a down link [ 313.340510][T15108] vlan0: entered allmulticast mode [ 313.361026][T15108] bond5: entered allmulticast mode [ 313.377958][T15108] bond5: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 313.441431][T15109] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 313.516823][T15104] caif0 speed is unknown, defaulting to 1000 [ 313.605203][T15114] netlink: 'syz.3.2591': attribute type 58 has an invalid length. [ 313.950458][T15119] netlink: 'syz.2.2593': attribute type 9 has an invalid length. [ 313.959168][T15119] netlink: 'syz.2.2593': attribute type 11 has an invalid length. [ 313.988938][T15125] veth35: entered promiscuous mode [ 314.090870][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 314.099037][ C0] lec:lec_tx_timeout: lec0 [ 314.104276][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 314.139110][T15134] veth1_to_bond: entered allmulticast mode [ 314.244520][T15136] veth1_to_bond (unregistering): left allmulticast mode [ 314.720471][T15152] 8021q: adding VLAN 0 to HW filter on device bond6 [ 314.753438][T15157] veth13: entered promiscuous mode [ 314.764051][T15157] bond6: (slave veth13): Enslaving as an active interface with a down link [ 314.784231][T15163] batadv1: entered allmulticast mode [ 314.806313][T15152] vlan0: entered allmulticast mode [ 314.811648][T15152] bond6: entered allmulticast mode [ 314.842289][T15152] bond6: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 315.202141][T15187] tc_dump_action: action bad kind [ 315.228862][T15192] tc_dump_action: action bad kind [ 315.340112][T15198] syzkaller0: entered promiscuous mode [ 315.346726][T15198] syzkaller0: entered allmulticast mode [ 315.415639][T15205] tipc: Started in network mode [ 315.422351][T15205] tipc: Node identity 1e48fc2e5c52, cluster identity 4711 [ 315.429946][T15205] tipc: Enabled bearer , priority 0 [ 315.494270][T15209] validate_nla: 3 callbacks suppressed [ 315.494289][T15209] netlink: 'syz.0.2623': attribute type 10 has an invalid length. [ 315.777390][T15223] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 315.873240][T15230] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 316.177915][T15245] netlink: 'syz.2.2637': attribute type 1 has an invalid length. [ 316.189164][T15245] netlink: 'syz.2.2637': attribute type 1 has an invalid length. [ 316.201323][T15197] tipc: Resetting bearer [ 316.245486][T15197] tipc: Disabling bearer [ 316.289788][T15245] bond14: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 316.313856][T15245] bond14 (unregistering): Released all slaves [ 316.403670][T15261] lo speed is unknown, defaulting to 1000 [ 316.441714][T15261] lo speed is unknown, defaulting to 1000 [ 316.466832][T15267] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 316.509961][T15261] lo speed is unknown, defaulting to 1000 [ 316.912580][T15261] infiniband syz2: set down [ 316.917254][ T131] lo speed is unknown, defaulting to 1000 [ 316.923265][T15261] infiniband syz2: added lo [ 316.994354][T15261] RDS/IB: syz2: added [ 316.999932][T15261] smc: adding ib device syz2 with port count 1 [ 317.007476][T15261] smc: ib device syz2 port 1 has no pnetid [ 317.016064][T15261] lo speed is unknown, defaulting to 1000 [ 317.024287][ T9] lo speed is unknown, defaulting to 1000 [ 317.309696][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.377084][T15261] lo speed is unknown, defaulting to 1000 [ 317.445291][T15302] netlink: 'syz.0.2654': attribute type 33 has an invalid length. [ 317.471439][T15302] __nla_validate_parse: 35 callbacks suppressed [ 317.471462][T15302] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2654'. [ 317.714962][T15312] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2656'. [ 317.728684][T15312] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2656'. [ 317.739846][T15312] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 317.827193][T15261] lo speed is unknown, defaulting to 1000 [ 317.891060][T15316] sch_tbf: burst 512 is lower than device syzkaller0 mtu (1514) ! [ 317.957537][T15322] netlink: 'syz.0.2659': attribute type 1 has an invalid length. [ 318.046279][T15322] 8021q: adding VLAN 0 to HW filter on device bond5 [ 318.231970][T15327] veth17: entered promiscuous mode [ 318.242541][T15327] veth17: entered allmulticast mode [ 318.267887][T15339] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2661'. [ 318.283378][T15327] bond5: (slave veth17): Enslaving as an active interface with an up link [ 318.544173][T15261] lo speed is unknown, defaulting to 1000 [ 318.701457][T15364] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2669'. [ 318.713085][T15364] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2669'. [ 318.725838][T15364] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 318.812756][T15367] netlink: 212328 bytes leftover after parsing attributes in process `syz.6.2670'. [ 318.831287][T15367] netlink: ct family unspecified [ 318.890050][T15371] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2672'. [ 318.966710][T15372] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2672'. [ 319.002245][T15375] nbd: must specify at least one socket [ 319.053546][T15261] lo speed is unknown, defaulting to 1000 [ 319.110895][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 319.118991][ C0] lec:lec_tx_timeout: lec0 [ 319.124136][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 319.155820][T15385] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2677'. [ 319.288292][T15391] netlink: 'syz.6.2679': attribute type 1 has an invalid length. [ 319.346710][T15391] 8021q: adding VLAN 0 to HW filter on device bond5 [ 319.415287][T15396] veth7: entered promiscuous mode [ 319.454814][T15396] bond5: (slave veth7): Enslaving as an active interface with a down link [ 319.484466][T15391] vlan2: entered allmulticast mode [ 319.495048][T15391] bond5: entered allmulticast mode [ 319.518829][T15391] bond5: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 319.572190][T15400] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 319.915167][T15419] netlink: 'syz.6.2688': attribute type 21 has an invalid length. [ 320.111201][T15436] netlink: 'syz.0.2694': attribute type 1 has an invalid length. [ 320.185842][T15436] 8021q: adding VLAN 0 to HW filter on device bond6 [ 320.235747][T15442] veth19: entered promiscuous mode [ 320.245631][T15442] bond6: (slave veth19): Enslaving as an active interface with a down link [ 320.272194][T15436] vlan2: entered allmulticast mode [ 320.277475][T15436] bond6: entered allmulticast mode [ 320.284506][T15436] bond6: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 320.319964][T15446] tap0: tun_chr_ioctl cmd 1074025672 [ 320.331155][T15446] tap0: ignored: set checksum disabled [ 320.539044][ T7455] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xf0 [ 320.908877][ T131] IPVS: starting estimator thread 0... [ 321.011236][T15471] IPVS: using max 50 ests per chain, 120000 per kthread [ 322.658204][T15548] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 322.690564][T15548] __nla_validate_parse: 13 callbacks suppressed [ 322.690584][T15548] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2735'. [ 322.734333][T15547] syzkaller0: entered promiscuous mode [ 322.739910][T15547] syzkaller0: entered allmulticast mode [ 323.407843][T15564] netlink: 'syz.0.2740': attribute type 4 has an invalid length. [ 324.130911][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 324.139044][ C0] lec:lec_tx_timeout: lec0 [ 324.143721][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 324.414193][T15558] netlink: 'syz.2.2739': attribute type 12 has an invalid length. [ 324.424518][T15559] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2739'. [ 324.507977][ T52] Bluetooth: hci2: command 0x0401 tx timeout [ 324.770112][T15580] netlink: 'syz.3.2746': attribute type 1 has an invalid length. [ 324.890346][T15580] 8021q: adding VLAN 0 to HW filter on device bond16 [ 325.010312][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 325.020118][T15583] veth35: entered promiscuous mode [ 325.021659][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 325.034295][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 325.043326][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 325.051287][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 325.099377][T15583] bond16: (slave veth35): Enslaving as an active interface with a down link [ 325.145705][T15596] netlink: 'syz.5.2752': attribute type 1 has an invalid length. [ 325.147527][T15588] vlan2: entered allmulticast mode [ 325.171280][T15588] bond16: entered allmulticast mode [ 325.177861][T15588] bond16: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 325.250935][T15600] xt_TCPMSS: Only works on TCP SYN packets [ 325.297851][T15596] 8021q: adding VLAN 0 to HW filter on device bond7 [ 325.329577][T15596] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2752'. [ 325.348646][T15598] veth15: entered promiscuous mode [ 325.405413][T15598] bond7: (slave veth15): Enslaving as an active interface with an up link [ 325.488815][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2753'. [ 325.506902][T15605] bridge3: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 325.526480][T15604] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2753'. [ 325.579907][T15604] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2753'. [ 325.624867][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2753'. [ 325.633977][T15589] caif0 speed is unknown, defaulting to 1000 [ 325.640117][ T3461] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.646342][T15604] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2753'. [ 325.653971][ T3461] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.666818][T15604] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2753'. [ 325.703372][ T3461] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.724863][ T3461] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.864890][T15619] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2758'. [ 325.879445][T15619] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 326.068206][T15589] lo speed is unknown, defaulting to 1000 [ 326.822096][T15652] netlink: 'syz.3.2771': attribute type 1 has an invalid length. [ 327.141485][ T5836] Bluetooth: hci5: command tx timeout [ 327.204369][T15606] bond3 (unregistering): (slave bridge7): Releasing backup interface [ 327.212769][T15606] bridge7 (unregistering): left promiscuous mode [ 327.295178][T15606] bond1 (unregistering): Released all slaves [ 327.409692][T15606] bond2 (unregistering): (slave veth11): Releasing active interface [ 327.419287][T15606] bond2 (unregistering): Released all slaves [ 327.532113][T15606] bond0 (unregistering): (slave veth13): Releasing active interface [ 327.543076][T15606] bond0 (unregistering): Released all slaves [ 327.651195][T15606] bond3 (unregistering): Released all slaves [ 327.762734][T15606] bond4 (unregistering): (slave veth15): Releasing active interface [ 327.773116][T15606] bond4 (unregistering): Released all slaves [ 327.894127][T15606] bond5 (unregistering): (slave veth17): Releasing backup interface [ 327.903760][T15606] bond5 (unregistering): Released all slaves [ 328.014794][T15606] bond6 (unregistering): (slave veth19): Releasing active interface [ 328.024838][T15606] bond6 (unregistering): Released all slaves [ 328.039346][T15645] __nla_validate_parse: 5 callbacks suppressed [ 328.039369][T15645] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2770'. [ 328.055249][T15645] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2770'. [ 328.064451][T15645] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 328.198476][T15661] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2776'. [ 328.208689][T15661] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2776'. [ 328.224802][T15661] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2776'. [ 328.234415][T15661] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2776'. [ 328.283826][T15666] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2774'. [ 328.298314][T15606] tipc: Disabling bearer [ 328.321139][T15606] tipc: Left network mode [ 328.524032][T15677] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 328.745940][T15686] netlink: 160 bytes leftover after parsing attributes in process `syz.2.2783'. [ 328.758770][T15686] openvswitch: netlink: Flow actions attr not present in new flow. [ 328.897226][T15697] block nbd0: Unsupported socket: should be TCP or UNIX. [ 328.973811][T15589] chnl_net:caif_netlink_parms(): no params data found [ 329.150921][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 329.159013][ C0] lec:lec_tx_timeout: lec0 [ 329.165268][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 329.221576][ T5836] Bluetooth: hci5: command tx timeout [ 329.407787][T15718] netlink: 120 bytes leftover after parsing attributes in process `syz.2.2796'. [ 329.418679][T15718] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2796'. [ 329.608763][T15589] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.627020][T15589] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.641104][T15589] bridge_slave_0: entered allmulticast mode [ 329.685579][T15589] bridge_slave_0: entered promiscuous mode [ 329.825905][T15735] veth9: left promiscuous mode [ 329.871140][T15735] geneve2: left promiscuous mode [ 329.876688][T15735] geneve2: left allmulticast mode [ 329.991182][T15735] veth11: left promiscuous mode [ 330.062134][T15735] veth1: left promiscuous mode [ 330.089776][T15735] veth13: left promiscuous mode [ 330.132039][T15735] veth15: left promiscuous mode [ 330.141630][T15589] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.162634][T15589] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.170019][T15589] bridge_slave_1: entered allmulticast mode [ 330.178933][T15589] bridge_slave_1: entered promiscuous mode [ 330.186788][ T3500] netdevsim netdevsim5 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 330.203912][ T3500] netdevsim netdevsim5 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.213376][T15606] batadv0: left promiscuous mode [ 330.227622][T15606] hsr_slave_0: left promiscuous mode [ 330.236152][T15606] hsr_slave_1: left promiscuous mode [ 330.243285][T15606] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 330.440284][T15606] pimreg3 (unregistering): left allmulticast mode [ 330.474392][T15606] pim6reg (unregistering): left allmulticast mode [ 331.099844][ T7450] smc: removing ib device syz1 [ 331.172469][T15737] netdevsim netdevsim5 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 331.203849][T15737] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.305047][ T5836] Bluetooth: hci5: command tx timeout [ 331.399161][ T3500] netdevsim netdevsim5 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 331.417593][ T3500] netdevsim netdevsim5 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.466863][T15589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 331.509902][ T3500] netdevsim netdevsim5 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 331.539390][ T3500] netdevsim netdevsim5 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.592903][T15589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 331.807413][T15589] team0: Port device team_slave_0 added [ 331.825620][T15589] team0: Port device team_slave_1 added [ 332.040734][T15785] can: request_module (can-proto-0) failed. [ 332.477711][T15589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 332.506877][T15589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 332.539427][T15799] delete_channel: no stack [ 332.578576][T15589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 332.624884][T15589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 332.649910][T15589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 332.724332][T15589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 332.748807][T15801] netlink: 'syz.2.2821': attribute type 1 has an invalid length. [ 333.043209][T15801] 8021q: adding VLAN 0 to HW filter on device bond14 [ 333.063036][T15813] __nla_validate_parse: 6 callbacks suppressed [ 333.063056][T15813] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2820'. [ 333.105314][T15804] veth25: entered promiscuous mode [ 333.115548][T15804] bond14: (slave veth25): Enslaving as an active interface with a down link [ 333.137031][T15806] vlan3: entered allmulticast mode [ 333.142897][T15806] bond14: entered allmulticast mode [ 333.150209][T15806] bond14: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 333.213317][T15589] hsr_slave_0: entered promiscuous mode [ 333.220503][T15589] hsr_slave_1: entered promiscuous mode [ 333.248541][T15589] debugfs: 'hsr0' already exists in 'hsr' [ 333.255270][T15589] Cannot create hsr debugfs directory [ 333.334512][T15815] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2823'. [ 333.360770][T15606] IPVS: stop unused estimator thread 0... [ 333.381727][ T5836] Bluetooth: hci5: command tx timeout [ 333.439182][T15818] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2824'. [ 333.781650][T15831] workqueue: name exceeds WQ_NAME_LEN. Truncating to: &%Q0@æjʫ} [ 333.828311][T15829] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 333.842425][T15829] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 334.055955][T15838] netlink: 'syz.3.2832': attribute type 2 has an invalid length. [ 334.076716][T15838] netlink: 'syz.3.2832': attribute type 8 has an invalid length. [ 334.093301][T15838] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2832'. [ 334.181536][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 334.189758][ C0] lec:lec_tx_timeout: lec0 [ 334.194694][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 334.238208][T15852] xt_time: unknown flags 0xf4 [ 334.253337][T15852] x_tables: duplicate underflow at hook 1 [ 334.556675][T15589] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 334.653157][T15589] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 334.680572][T15871] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2844'. [ 334.690665][T15589] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 334.713390][T15589] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 334.723339][T15873] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2845'. [ 334.751571][T15873] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2845'. [ 334.760716][T15873] netlink: 'syz.5.2845': attribute type 12 has an invalid length. [ 334.779062][T15873] netlink: 'syz.5.2845': attribute type 11 has an invalid length. [ 334.949520][T15886] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2848'. [ 335.076631][T15589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.104343][T15589] 8021q: adding VLAN 0 to HW filter on device team0 [ 335.119191][T15606] bridge0: port 1(bridge_slave_0) entered blocking state [ 335.126438][T15606] bridge0: port 1(bridge_slave_0) entered forwarding state [ 335.183523][ T1155] bridge0: port 2(bridge_slave_1) entered blocking state [ 335.191027][ T1155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 335.479525][T15907] team0: Port device dummy0 removed [ 335.543340][T15915] netlink: 'syz.3.2858': attribute type 25 has an invalid length. [ 335.551654][T15915] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2858'. [ 335.591463][T15915] netlink: 'syz.3.2858': attribute type 25 has an invalid length. [ 335.610328][T15915] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2858'. [ 335.696703][T15915] netlink: 'syz.3.2858': attribute type 25 has an invalid length. [ 335.706372][T15915] netlink: 'syz.3.2858': attribute type 25 has an invalid length. [ 335.893079][T15589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 335.987920][T15589] veth0_vlan: entered promiscuous mode [ 336.012450][T15589] veth1_vlan: entered promiscuous mode [ 336.082899][T15589] veth0_macvtap: entered promiscuous mode [ 336.115214][T15589] veth1_macvtap: entered promiscuous mode [ 336.217771][T15953] netlink: 'syz.2.2868': attribute type 1 has an invalid length. [ 336.222442][T15589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 336.257621][T15589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 336.309687][ T1155] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.334666][ T1155] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.367901][ T1155] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.432265][ T1155] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.613448][ T7448] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.626065][ T7448] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.641355][T15972] xt_l2tp: invalid flags combination: 8 [ 336.703774][ T7455] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.728898][ T7455] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.586299][T16021] FAULT_INJECTION: forcing a failure. [ 337.586299][T16021] name failslab, interval 1, probability 0, space 0, times 0 [ 337.603839][T16021] CPU: 0 UID: 0 PID: 16021 Comm: syz.5.2888 Not tainted syzkaller #0 PREEMPT(full) [ 337.603867][T16021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 337.603879][T16021] Call Trace: [ 337.603887][T16021] [ 337.603896][T16021] dump_stack_lvl+0xe8/0x150 [ 337.603929][T16021] should_fail_ex+0x414/0x560 [ 337.603967][T16021] should_failslab+0xa8/0x100 [ 337.603994][T16021] __kmalloc_noprof+0xdf/0x800 [ 337.604015][T16021] ? nla_strdup+0x9d/0x140 [ 337.604043][T16021] nla_strdup+0x9d/0x140 [ 337.604068][T16021] nf_tables_dump_rules_start+0x68/0x140 [ 337.604097][T16021] __netlink_dump_start+0x469/0x7e0 [ 337.604128][T16021] ? nft_netlink_dump_start_rcu+0xb6/0x1a0 [ 337.604152][T16021] nft_netlink_dump_start_rcu+0xdb/0x1a0 [ 337.604178][T16021] nf_tables_getrule+0x18d/0x260 [ 337.604201][T16021] ? __pfx_nf_tables_getrule+0x10/0x10 [ 337.604237][T16021] ? __pfx_nf_tables_dump_rules_start+0x10/0x10 [ 337.604260][T16021] ? __pfx_nf_tables_dump_rules+0x10/0x10 [ 337.604282][T16021] ? __pfx_nf_tables_dump_rules_done+0x10/0x10 [ 337.604314][T16021] ? __nla_parse+0x40/0x60 [ 337.604336][T16021] ? __pfx_nf_tables_getrule+0x10/0x10 [ 337.604358][T16021] nfnetlink_rcv_msg+0x80e/0x1130 [ 337.604379][T16021] ? __lock_acquire+0x6b6/0x2cf0 [ 337.604398][T16021] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 337.604442][T16021] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 337.604503][T16021] ? __lock_acquire+0x6b6/0x2cf0 [ 337.604547][T16021] netlink_rcv_skb+0x208/0x470 [ 337.604573][T16021] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 337.604599][T16021] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 337.604644][T16021] ? bpf_lsm_capable+0x9/0x20 [ 337.604665][T16021] ? security_capable+0x7e/0x2e0 [ 337.604696][T16021] nfnetlink_rcv+0x282/0x2590 [ 337.604723][T16021] ? is_bpf_text_address+0x26/0x2b0 [ 337.604758][T16021] ? __kernel_text_address+0xd/0x40 [ 337.604782][T16021] ? unwind_get_return_address+0x4d/0x90 [ 337.604804][T16021] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 337.604834][T16021] ? arch_stack_walk+0xfc/0x150 [ 337.604867][T16021] ? __lock_acquire+0x6b6/0x2cf0 [ 337.604890][T16021] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 337.604914][T16021] ? stack_depot_save_flags+0x33/0x810 [ 337.604946][T16021] ? __lock_acquire+0x6b6/0x2cf0 [ 337.604974][T16021] ? __lock_acquire+0x6b6/0x2cf0 [ 337.605005][T16021] ? __netlink_lookup+0xbd/0x8a0 [ 337.605040][T16021] ? netlink_deliver_tap+0x2e/0x1b0 [ 337.605065][T16021] ? netlink_deliver_tap+0x2e/0x1b0 [ 337.605095][T16021] ? netlink_deliver_tap+0x2e/0x1b0 [ 337.605127][T16021] netlink_unicast+0x82f/0x9e0 [ 337.605158][T16021] ? __pfx_netlink_unicast+0x10/0x10 [ 337.605178][T16021] ? __alloc_skb+0x198/0x3a0 [ 337.605198][T16021] ? netlink_sendmsg+0x642/0xb30 [ 337.605220][T16021] ? skb_put+0x11b/0x210 [ 337.605245][T16021] netlink_sendmsg+0x805/0xb30 [ 337.605279][T16021] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.605307][T16021] ? aa_sock_msg_perm+0xf1/0x1b0 [ 337.605333][T16021] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 337.605350][T16021] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.605374][T16021] __sock_sendmsg+0x21c/0x270 [ 337.605401][T16021] ____sys_sendmsg+0x505/0x820 [ 337.605426][T16021] ? __pfx_____sys_sendmsg+0x10/0x10 [ 337.605454][T16021] ? import_iovec+0x74/0xa0 [ 337.605476][T16021] ___sys_sendmsg+0x21f/0x2a0 [ 337.605500][T16021] ? __pfx____sys_sendmsg+0x10/0x10 [ 337.605570][T16021] ? __fget_files+0x2a/0x420 [ 337.605593][T16021] ? __fget_files+0x3a0/0x420 [ 337.605636][T16021] __x64_sys_sendmsg+0x19b/0x260 [ 337.605662][T16021] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 337.605695][T16021] ? __pfx_ksys_write+0x10/0x10 [ 337.605726][T16021] do_syscall_64+0xec/0xf80 [ 337.605745][T16021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.605763][T16021] ? trace_irq_disable+0x37/0x100 [ 337.605788][T16021] ? clear_bhb_loop+0x60/0xb0 [ 337.605811][T16021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.605829][T16021] RIP: 0033:0x7ff09918f749 [ 337.605848][T16021] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 337.605865][T16021] RSP: 002b:00007ff09a004038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.605885][T16021] RAX: ffffffffffffffda RBX: 00007ff0993e5fa0 RCX: 00007ff09918f749 [ 337.605899][T16021] RDX: 0000000000004000 RSI: 0000200000000100 RDI: 0000000000000004 [ 337.605912][T16021] RBP: 00007ff09a004090 R08: 0000000000000000 R09: 0000000000000000 [ 337.605923][T16021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.605934][T16021] R13: 00007ff0993e6038 R14: 00007ff0993e5fa0 R15: 00007ffdd4c14238 [ 337.605967][T16021] [ 338.435564][T16042] netlink: 'syz.5.2895': attribute type 58 has an invalid length. [ 338.462649][T16042] __nla_validate_parse: 13 callbacks suppressed [ 338.462669][T16042] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2895'. [ 338.484524][T16046] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2894'. [ 338.576329][T16051] netlink: 84 bytes leftover after parsing attributes in process `syz.5.2895'. [ 338.759828][T16053] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.767976][T16053] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.811038][T16065] FAULT_INJECTION: forcing a failure. [ 338.811038][T16065] name failslab, interval 1, probability 0, space 0, times 0 [ 338.855439][T16065] CPU: 0 UID: 0 PID: 16065 Comm: syz.3.2900 Not tainted syzkaller #0 PREEMPT(full) [ 338.855469][T16065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 338.855481][T16065] Call Trace: [ 338.855489][T16065] [ 338.855497][T16065] dump_stack_lvl+0xe8/0x150 [ 338.855530][T16065] should_fail_ex+0x414/0x560 [ 338.855564][T16065] should_failslab+0xa8/0x100 [ 338.855588][T16065] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 338.855618][T16065] ? __alloc_skb+0x1dc/0x3a0 [ 338.855637][T16065] ? __local_bh_enable_ip+0xd0/0x130 [ 338.855659][T16065] ? __alloc_skb+0x198/0x3a0 [ 338.855701][T16065] __alloc_skb+0x1dc/0x3a0 [ 338.855726][T16065] netlink_dump+0x1b7/0xe90 [ 338.855766][T16065] ? __pfx_netlink_dump+0x10/0x10 [ 338.855807][T16065] ? nla_strdup+0xb8/0x140 [ 338.855837][T16065] __netlink_dump_start+0x5cb/0x7e0 [ 338.855868][T16065] ? nft_netlink_dump_start_rcu+0xb6/0x1a0 [ 338.855892][T16065] nft_netlink_dump_start_rcu+0xdb/0x1a0 [ 338.855918][T16065] nf_tables_getrule+0x18d/0x260 [ 338.855940][T16065] ? __pfx_nf_tables_getrule+0x10/0x10 [ 338.855957][T16065] ? __pfx_nf_tables_dump_rules_start+0x10/0x10 [ 338.855980][T16065] ? __pfx_nf_tables_dump_rules+0x10/0x10 [ 338.856001][T16065] ? __pfx_nf_tables_dump_rules_done+0x10/0x10 [ 338.856034][T16065] ? __nla_parse+0x40/0x60 [ 338.856055][T16065] ? __pfx_nf_tables_getrule+0x10/0x10 [ 338.856076][T16065] nfnetlink_rcv_msg+0x80e/0x1130 [ 338.856099][T16065] ? finish_task_switch+0x162/0x940 [ 338.856124][T16065] ? lock_acquire+0x107/0x340 [ 338.856143][T16065] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 338.856187][T16065] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 338.856237][T16065] ? __lock_acquire+0x6b6/0x2cf0 [ 338.856281][T16065] netlink_rcv_skb+0x208/0x470 [ 338.856308][T16065] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 338.856333][T16065] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 338.856372][T16065] ? bpf_lsm_capable+0x9/0x20 [ 338.856395][T16065] ? security_capable+0x7e/0x2e0 [ 338.856433][T16065] nfnetlink_rcv+0x282/0x2590 [ 338.856469][T16065] ? is_bpf_text_address+0x26/0x2b0 [ 338.856505][T16065] ? __kernel_text_address+0xd/0x40 [ 338.856531][T16065] ? unwind_get_return_address+0x4d/0x90 [ 338.856553][T16065] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 338.856582][T16065] ? arch_stack_walk+0xfc/0x150 [ 338.856616][T16065] ? __lock_acquire+0x6b6/0x2cf0 [ 338.856640][T16065] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 338.856673][T16065] ? stack_depot_save_flags+0x33/0x810 [ 338.856708][T16065] ? __lock_acquire+0x6b6/0x2cf0 [ 338.856737][T16065] ? __lock_acquire+0x6b6/0x2cf0 [ 338.856770][T16065] ? __netlink_lookup+0xbd/0x8a0 [ 338.856815][T16065] ? netlink_deliver_tap+0x2e/0x1b0 [ 338.856842][T16065] ? netlink_deliver_tap+0x2e/0x1b0 [ 338.856874][T16065] ? netlink_deliver_tap+0x2e/0x1b0 [ 338.856909][T16065] netlink_unicast+0x82f/0x9e0 [ 338.856942][T16065] ? __pfx_netlink_unicast+0x10/0x10 [ 338.856962][T16065] ? __alloc_skb+0x198/0x3a0 [ 338.856982][T16065] ? netlink_sendmsg+0x642/0xb30 [ 338.857005][T16065] ? skb_put+0x11b/0x210 [ 338.857031][T16065] netlink_sendmsg+0x805/0xb30 [ 338.857067][T16065] ? __pfx_netlink_sendmsg+0x10/0x10 [ 338.857098][T16065] ? aa_sock_msg_perm+0xf1/0x1b0 [ 338.857124][T16065] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 338.857143][T16065] ? __pfx_netlink_sendmsg+0x10/0x10 [ 338.857169][T16065] __sock_sendmsg+0x21c/0x270 [ 338.857202][T16065] ____sys_sendmsg+0x505/0x820 [ 338.857234][T16065] ? __pfx_____sys_sendmsg+0x10/0x10 [ 338.857269][T16065] ? import_iovec+0x74/0xa0 [ 338.857297][T16065] ___sys_sendmsg+0x21f/0x2a0 [ 338.857324][T16065] ? __pfx____sys_sendmsg+0x10/0x10 [ 338.857391][T16065] ? __fget_files+0x2a/0x420 [ 338.857413][T16065] ? __fget_files+0x3a0/0x420 [ 338.857448][T16065] __x64_sys_sendmsg+0x19b/0x260 [ 338.857476][T16065] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 338.857512][T16065] ? __pfx_ksys_write+0x10/0x10 [ 338.857547][T16065] do_syscall_64+0xec/0xf80 [ 338.857568][T16065] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.857586][T16065] ? trace_irq_disable+0x37/0x100 [ 338.857610][T16065] ? clear_bhb_loop+0x60/0xb0 [ 338.857634][T16065] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.857653][T16065] RIP: 0033:0x7fa93058f749 [ 338.857823][T16065] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 338.857840][T16065] RSP: 002b:00007fa9314c4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 338.857862][T16065] RAX: ffffffffffffffda RBX: 00007fa9307e5fa0 RCX: 00007fa93058f749 [ 338.857876][T16065] RDX: 0000000000004000 RSI: 0000200000000100 RDI: 0000000000000004 [ 338.857889][T16065] RBP: 00007fa9314c4090 R08: 0000000000000000 R09: 0000000000000000 [ 338.857901][T16065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 338.857913][T16065] R13: 00007fa9307e6038 R14: 00007fa9307e5fa0 R15: 00007ffdaac8d378 [ 338.857949][T16065] [ 339.337524][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5140 ms [ 339.345677][ C0] lec:lec_tx_timeout: lec0 [ 339.352412][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 339.444696][T16053] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.465297][T16053] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.614798][T16025] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.623966][T16025] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.633353][T16025] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.643147][T16025] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 339.652299][T16075] netlink: 'syz.5.2903': attribute type 12 has an invalid length. [ 339.773106][T16083] netlink: 'syz.0.2905': attribute type 7 has an invalid length. [ 339.820616][ T7455] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 339.839451][ T1155] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.839549][T16083] netlink: 'syz.0.2905': attribute type 7 has an invalid length. [ 339.849412][ T7455] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 339.857724][ T1155] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.875871][ T1155] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.889434][T16086] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2908'. [ 339.902140][T16086] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2908'. [ 339.922784][T16086] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2908'. [ 339.933920][ T1155] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.942700][T16093] netlink: 'syz.2.2908': attribute type 11 has an invalid length. [ 339.942723][T16093] netlink: 'syz.2.2908': attribute type 11 has an invalid length. [ 339.942739][T16093] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2908'. [ 340.067712][T16098] netlink: 'syz.0.2911': attribute type 1 has an invalid length. [ 340.142761][T16098] veth3: entered promiscuous mode [ 340.181434][T16103] FAULT_INJECTION: forcing a failure. [ 340.181434][T16103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 340.183116][T16101] vlan2: entered allmulticast mode [ 340.194837][T16103] CPU: 1 UID: 0 PID: 16103 Comm: syz.3.2912 Not tainted syzkaller #0 PREEMPT(full) [ 340.194862][T16103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 340.194873][T16103] Call Trace: [ 340.194880][T16103] [ 340.194889][T16103] dump_stack_lvl+0xe8/0x150 [ 340.194918][T16103] should_fail_ex+0x414/0x560 [ 340.194952][T16103] _copy_from_user+0x2d/0xb0 [ 340.194975][T16103] kstrtouint_from_user+0xc4/0x170 [ 340.194996][T16103] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 340.195032][T16103] proc_fail_nth_write+0x88/0x200 [ 340.195051][T16103] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 340.195076][T16103] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 340.195097][T16103] vfs_write+0x27e/0xb30 [ 340.195124][T16103] ? __pfx_vfs_write+0x10/0x10 [ 340.195143][T16103] ? __fget_files+0x2a/0x420 [ 340.195170][T16103] ? __fget_files+0x3a0/0x420 [ 340.195189][T16103] ? __fget_files+0x2a/0x420 [ 340.195220][T16103] ksys_write+0x145/0x250 [ 340.195240][T16103] ? __pfx_ksys_write+0x10/0x10 [ 340.195269][T16103] do_syscall_64+0xec/0xf80 [ 340.195288][T16103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.195305][T16103] ? trace_irq_disable+0x37/0x100 [ 340.195327][T16103] ? clear_bhb_loop+0x60/0xb0 [ 340.195349][T16103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.195366][T16103] RIP: 0033:0x7fa93058e1ff [ 340.195383][T16103] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 340.195398][T16103] RSP: 002b:00007fa9314c4030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 340.195418][T16103] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa93058e1ff [ 340.195431][T16103] RDX: 0000000000000001 RSI: 00007fa9314c40a0 RDI: 0000000000000005 [ 340.195442][T16103] RBP: 00007fa9314c4090 R08: 0000000000000000 R09: 0000000000000000 [ 340.195453][T16103] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 340.195463][T16103] R13: 00007fa9307e6038 R14: 00007fa9307e5fa0 R15: 00007ffdaac8d378 [ 340.195495][T16103] [ 340.422774][T16101] veth0_to_bridge: entered allmulticast mode [ 340.563158][T16116] netlink: 'syz.3.2915': attribute type 3 has an invalid length. [ 340.591029][T16116] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2915'. [ 340.846273][T16129] netlink: 'syz.6.2922': attribute type 11 has an invalid length. [ 340.855934][T16129] netlink: 'syz.6.2922': attribute type 32 has an invalid length. [ 340.891134][T16129] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2922'. [ 341.031191][T16129] bond6: option coupled_control: invalid value (52) [ 341.071666][T16129] bond6 (unregistering): Released all slaves [ 341.113009][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 341.123073][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 341.132419][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 341.140711][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 341.149951][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 341.206325][T16139] lo speed is unknown, defaulting to 1000 [ 341.406923][T16153] netlink: 'syz.5.2929': attribute type 1 has an invalid length. [ 341.518234][T16163] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2930'. [ 341.569496][T16153] 8021q: adding VLAN 0 to HW filter on device bond8 [ 341.679761][T16162] veth17: entered promiscuous mode [ 341.695814][T16162] bond8: (slave veth17): Enslaving as an active interface with a down link [ 341.719275][T16165] vlan0: entered allmulticast mode [ 341.724763][T16165] bond8: entered allmulticast mode [ 341.732126][T16165] bond8: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 342.085864][ T7448] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 342.234358][ T7448] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 342.255823][T16189] netlink: 'syz.6.2938': attribute type 3 has an invalid length. [ 342.309921][T16189] hsr_slave_0: left promiscuous mode [ 342.324309][T16189] hsr_slave_1: left promiscuous mode [ 342.379392][ T7448] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 342.489435][ T7448] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 342.848840][T16139] chnl_net:caif_netlink_parms(): no params data found [ 343.221338][ T5836] Bluetooth: hci0: command tx timeout [ 343.264365][ T7448] bond8 (unregistering): (slave ip6gretap1): Releasing active interface [ 343.697529][ T7448] dvmrp6 (unregistering): left allmulticast mode [ 343.725895][ T7448] bond9 (unregistering): (slave geneve3): Releasing active interface [ 343.963016][ T7448] bond6 (unregistering): (slave bridge3): Releasing active interface [ 344.050253][ T7448] bond0 (unregistering): Released all slaves [ 344.171669][ T7448] bond1 (unregistering): (slave veth3): Releasing active interface [ 344.180685][ T7448] bond1 (unregistering): Released all slaves [ 344.290540][ T7448] bond2 (unregistering): (slave veth5): Releasing active interface [ 344.299598][ T7448] bond2 (unregistering): Released all slaves [ 344.405615][ T7448] bond3 (unregistering): (slave veth7): Releasing active interface [ 344.415377][ T7448] bond3 (unregistering): Released all slaves [ 344.521713][ T7448] bond4 (unregistering): (slave veth9): Releasing active interface [ 344.530341][ T7448] bond4 (unregistering): Released all slaves [ 344.642370][ T7448] bond5 (unregistering): (slave veth11): Releasing active interface [ 344.651345][ T7448] bond5 (unregistering): Released all slaves [ 344.664611][ T7448] bond6 (unregistering): Released all slaves [ 344.789228][ T7448] bond7 (unregistering): (slave veth17): Releasing active interface [ 344.798201][ T7448] bond7 (unregistering): Released all slaves [ 344.905874][ T7448] bond8 (unregistering): Released all slaves [ 344.919390][ T7448] bond9 (unregistering): Released all slaves [ 345.031191][ T7448] bond10 (unregistering): (slave veth19): Releasing active interface [ 345.047690][ T7448] bond10 (unregistering): Released all slaves [ 345.157651][ T7448] bond11 (unregistering): (slave veth21): Releasing active interface [ 345.170718][ T7448] bond11 (unregistering): Released all slaves [ 345.278690][ T7448] bond12 (unregistering): (slave veth23): Releasing active interface [ 345.288775][ T7448] bond12 (unregistering): Released all slaves [ 345.308010][ T5836] Bluetooth: hci0: command tx timeout [ 345.407018][ T7448] bond13 (unregistering): Released all slaves [ 345.460915][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6110 ms [ 345.469045][ C0] lec:lec_tx_timeout: lec0 [ 345.474018][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 345.534692][ T7448] bond14 (unregistering): (slave veth25): Releasing active interface [ 345.544618][ T7448] bond14 (unregistering): Released all slaves [ 345.729519][T16264] __nla_validate_parse: 4 callbacks suppressed [ 345.729541][T16264] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2958'. [ 345.784995][T16264] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2958'. [ 345.814763][ T7448] : left promiscuous mode [ 345.861475][T16268] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode [ 345.886360][T16268] veth31: left promiscuous mode [ 345.899473][T16276] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2962'. [ 345.903915][T16268] veth35: left promiscuous mode [ 345.936440][T16269] tipc: Enabling of bearer rejected, failed to enable media [ 345.961720][T16139] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.988337][T16139] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.011200][T16139] bridge_slave_0: entered allmulticast mode [ 346.023195][T16139] bridge_slave_0: entered promiscuous mode [ 346.033595][ T7448] tipc: Disabling bearer [ 346.066905][T16139] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.074408][ T7448] tipc: Left network mode [ 346.094513][T16139] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.121743][T16139] bridge_slave_1: entered allmulticast mode [ 346.146021][T16139] bridge_slave_1: entered promiscuous mode [ 346.244176][T16139] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 346.304510][T16139] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 346.334443][T16292] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 346.393773][T16139] team0: Port device team_slave_0 added [ 346.422700][T16139] team0: Port device team_slave_1 added [ 346.478089][T16294] pim6reg: entered allmulticast mode [ 346.559065][T16139] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 346.566865][T16139] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.593339][T16139] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 346.630351][T16139] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 346.647772][T16139] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.701272][T16139] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.895403][T16317] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 347.026493][T16139] hsr_slave_0: entered promiscuous mode [ 347.043738][T16139] hsr_slave_1: entered promiscuous mode [ 347.199874][ T61] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 347.225287][ T61] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 347.236016][T16335] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 347.352607][T16324] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 347.381104][ T5836] Bluetooth: hci0: command tx timeout [ 347.389204][ T61] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 347.785116][ T7448] hsr_slave_0: left promiscuous mode [ 347.796125][ T7448] hsr_slave_1: left promiscuous mode [ 349.470097][ T5836] Bluetooth: hci0: command tx timeout [ 349.507031][T16399] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2994'. [ 349.545839][T16399] bond9: Invalid ad_actor_system MAC address. [ 349.556182][T16399] bond9: option ad_actor_system: invalid value (1) [ 349.594988][T16399] bond9 (unregistering): Released all slaves [ 350.010412][T16418] netlink: 212324 bytes leftover after parsing attributes in process `syz.6.3000'. [ 350.046033][T16419] netlink: 212324 bytes leftover after parsing attributes in process `syz.6.3000'. [ 350.183360][ T7448] IPVS: stop unused estimator thread 0... [ 350.231395][T16139] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 350.275161][T16139] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 350.306242][T16139] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 350.337498][T16139] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 350.381808][ T7448] ------------[ cut here ]------------ [ 350.387355][ T7448] WARNING: fs/proc/proc_sysctl.c:1558 at retire_sysctl_set+0x48/0x60, CPU#0: kworker/u8:16/7448 [ 350.397931][ T7448] Modules linked in: [ 350.402909][ T7448] CPU: 0 UID: 0 PID: 7448 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT(full) [ 350.412601][ T7448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 350.422773][ T7448] Workqueue: netns cleanup_net [ 350.427674][ T7448] RIP: 0010:retire_sysctl_set+0x48/0x60 [ 350.433355][ T7448] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 f0 e7 c4 ff 48 83 3b 00 75 0c e8 b5 c7 5e ff 5b e9 0f 60 fa 08 cc e8 a9 c7 5e ff 90 <0f> 0b 90 5b e9 ff 5f fa 08 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00 [ 350.453251][ T7448] RSP: 0018:ffffc9001b6978d0 EFLAGS: 00010293 [ 350.459354][ T7448] RAX: ffffffff82623017 RBX: ffff88807a29a948 RCX: ffff88802556db80 [ 350.467416][ T7448] RDX: 0000000000000000 RSI: ffffffff8d976175 RDI: ffff88807a29a8e8 [ 350.475527][ T7448] RBP: ffffc9001b6979b0 R08: ffffffff8f822377 R09: 1ffffffff1f0446e [ 350.483799][ T7448] R10: dffffc0000000000 R11: ffffffff8b161ef0 R12: ffffffff8f621b80 [ 350.491894][ T7448] R13: 1ffff920036d2f40 R14: ffffffff8f621b60 R15: ffff88807a29a668 [ 350.499899][ T7448] FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 350.508949][ T7448] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 350.515635][ T7448] CR2: 000000110c24fece CR3: 00000000586b0000 CR4: 00000000003526f0 [ 350.523681][ T7448] Call Trace: [ 350.526966][ T7448] [ 350.529892][ T7448] ops_undo_list+0x49a/0x990 [ 350.534589][ T7448] ? __pfx_ops_undo_list+0x10/0x10 [ 350.539841][ T7448] ? do_raw_spin_unlock+0x122/0x240 [ 350.545125][ T7448] cleanup_net+0x4d8/0x7a0 [ 350.549566][ T7448] ? __pfx_cleanup_net+0x10/0x10 [ 350.554612][ T7448] ? process_scheduled_works+0x9ef/0x1770 [ 350.560369][ T7448] ? process_scheduled_works+0x9ef/0x1770 [ 350.566578][ T7448] process_scheduled_works+0xad1/0x1770 [ 350.572275][ T7448] ? __pfx_process_scheduled_works+0x10/0x10 [ 350.578284][ T7448] ? do_raw_spin_lock+0x121/0x290 [ 350.584147][ T7448] worker_thread+0x8a0/0xda0 [ 350.588756][ T7448] ? __kthread_parkme+0x7b/0x200 [ 350.593968][ T7448] kthread+0x711/0x8a0 [ 350.598085][ T7448] ? __pfx_worker_thread+0x10/0x10 [ 350.603285][ T7448] ? __pfx_kthread+0x10/0x10 [ 350.607930][ T7448] ? _raw_spin_unlock_irq+0x23/0x50 [ 350.613249][ T7448] ? __pfx_kthread+0x10/0x10 [ 350.617878][ T7448] ret_from_fork+0x510/0xa50 [ 350.622573][ T7448] ? __pfx_ret_from_fork+0x10/0x10 [ 350.627716][ T7448] ? __switch_to+0xc9e/0x1480 [ 350.632525][ T7448] ? __pfx_kthread+0x10/0x10 [ 350.637152][ T7448] ret_from_fork_asm+0x1a/0x30 [ 350.642024][ T7448] [ 350.645068][ T7448] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 350.652368][ T7448] CPU: 0 UID: 0 PID: 7448 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT(full) [ 350.661905][ T7448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 350.671973][ T7448] Workqueue: netns cleanup_net [ 350.676741][ T7448] Call Trace: [ 350.680110][ T7448] [ 350.683072][ T7448] vpanic+0x1e0/0x670 [ 350.687202][ T7448] panic+0xb9/0xc0 [ 350.690962][ T7448] ? __pfx_panic+0x10/0x10 [ 350.695476][ T7448] ? ret_from_fork_asm+0x1a/0x30 [ 350.700443][ T7448] __warn+0x317/0x4b0 [ 350.704451][ T7448] ? retire_sysctl_set+0x48/0x60 [ 350.709443][ T7448] ? retire_sysctl_set+0x48/0x60 [ 350.714432][ T7448] __report_bug+0x288/0x500 [ 350.718983][ T7448] ? ret_from_fork_asm+0x1a/0x30 [ 350.723962][ T7448] ? retire_sysctl_set+0x48/0x60 [ 350.729031][ T7448] ? __pfx___report_bug+0x10/0x10 [ 350.734195][ T7448] ? retire_sysctl_set+0x48/0x60 [ 350.739439][ T7448] report_bug+0x16a/0x220 [ 350.743799][ T7448] ? retire_sysctl_set+0x48/0x60 [ 350.748766][ T7448] ? retire_sysctl_set+0x4a/0x60 [ 350.753842][ T7448] handle_bug+0x98/0x200 [ 350.758118][ T7448] exc_invalid_op+0x1a/0x50 [ 350.762804][ T7448] asm_exc_invalid_op+0x1a/0x20 [ 350.767668][ T7448] RIP: 0010:retire_sysctl_set+0x48/0x60 [ 350.773224][ T7448] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 f0 e7 c4 ff 48 83 3b 00 75 0c e8 b5 c7 5e ff 5b e9 0f 60 fa 08 cc e8 a9 c7 5e ff 90 <0f> 0b 90 5b e9 ff 5f fa 08 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00 [ 350.792922][ T7448] RSP: 0018:ffffc9001b6978d0 EFLAGS: 00010293 [ 350.799171][ T7448] RAX: ffffffff82623017 RBX: ffff88807a29a948 RCX: ffff88802556db80 [ 350.807232][ T7448] RDX: 0000000000000000 RSI: ffffffff8d976175 RDI: ffff88807a29a8e8 [ 350.815302][ T7448] RBP: ffffc9001b6979b0 R08: ffffffff8f822377 R09: 1ffffffff1f0446e [ 350.823293][ T7448] R10: dffffc0000000000 R11: ffffffff8b161ef0 R12: ffffffff8f621b80 [ 350.831379][ T7448] R13: 1ffff920036d2f40 R14: ffffffff8f621b60 R15: ffff88807a29a668 [ 350.839477][ T7448] ? __pfx_sysctl_net_exit+0x10/0x10 [ 350.844802][ T7448] ? retire_sysctl_set+0x47/0x60 [ 350.849761][ T7448] ops_undo_list+0x49a/0x990 [ 350.854374][ T7448] ? __pfx_ops_undo_list+0x10/0x10 [ 350.859507][ T7448] ? do_raw_spin_unlock+0x122/0x240 [ 350.864726][ T7448] cleanup_net+0x4d8/0x7a0 [ 350.869151][ T7448] ? __pfx_cleanup_net+0x10/0x10 [ 350.874110][ T7448] ? process_scheduled_works+0x9ef/0x1770 [ 350.879833][ T7448] ? process_scheduled_works+0x9ef/0x1770 [ 350.885563][ T7448] process_scheduled_works+0xad1/0x1770 [ 350.891239][ T7448] ? __pfx_process_scheduled_works+0x10/0x10 [ 350.897420][ T7448] ? do_raw_spin_lock+0x121/0x290 [ 350.902485][ T7448] worker_thread+0x8a0/0xda0 [ 350.907198][ T7448] ? __kthread_parkme+0x7b/0x200 [ 350.912158][ T7448] kthread+0x711/0x8a0 [ 350.916250][ T7448] ? __pfx_worker_thread+0x10/0x10 [ 350.921367][ T7448] ? __pfx_kthread+0x10/0x10 [ 350.925979][ T7448] ? _raw_spin_unlock_irq+0x23/0x50 [ 350.931198][ T7448] ? __pfx_kthread+0x10/0x10 [ 350.935803][ T7448] ret_from_fork+0x510/0xa50 [ 350.940401][ T7448] ? __pfx_ret_from_fork+0x10/0x10 [ 350.945511][ T7448] ? __switch_to+0xc9e/0x1480 [ 350.950298][ T7448] ? __pfx_kthread+0x10/0x10 [ 350.954898][ T7448] ret_from_fork_asm+0x1a/0x30 [ 350.959687][ T7448] [ 350.963049][ T7448] Kernel Offset: disabled [ 350.967374][ T7448] Rebooting in 86400 seconds..