last executing test programs: 2m53.842703714s ago: executing program 3 (id=3021): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'syz_tun\x00', 0x0}) r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl$sock_netdev_private(r0, 0x89f9, &(0x7f0000000040)) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x852ac000) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELCHAIN={0x84, 0x5, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_COUNTERS={0x64, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x4}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xaf}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x23}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xf}]}]}], {0x14}}, 0xf8}}, 0x0) r2 = socket(0x2a, 0x2, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03", 0x3}], 0x1}, 0x0) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x4008054) write$nci(r3, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) write$nci(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r2], 0x3b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYRESHEX=0x0, @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afffffff8000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x94) socket$igmp6(0xa, 0x3, 0x2) 2m51.296297317s ago: executing program 3 (id=3027): r0 = socket$netlink(0x10, 0x3, 0x10) (async) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f00000002c0)=0x1) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000000000000fbdbdf2525000000657464657673696d0000000f0002006e657464657673696d300000029939c8684bc9f88e3de74320e3346961ae531438cab000cb115c8884e48f3ee7f75ba0af2477e990ace5fc32b8ccd74536958a44ff895cea2032dd1ae047f08a3d49dabd7a7f1584a2621035e7e3c4f3aecf0826f76e318dd49f3ef01facd4bcdc1bdc202822887fc076d388d1749626037378dd1e9b1f420b923dc96e273d02831b099e2b0cbbb271038680605b44bafd59fce5f6d66b18d01f2d36dab45e8782e52e0b3e2cc938a331475074aada2ff65f7069cfa7c7ae0d1639a295b840d198edaa872b28f918631f2f4a0460d845616cba3e87f28c35d44ac299c612b7dbb3d5b04c2293fa71ecc540dda497f96c69e7fbd14d04f75da04e3ac64f1697353531082b7f6a4253817293cd308915fe2980"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r3, r4, 0x5, 0x0, @void}, 0x10) close(r5) (async) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r6, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r4, &(0x7f00000000c0)="ee8b8f41fb74165c564b3428a0e9553da093fe9d0ed0c8054851df877fc7a32b7ce25c03e99f2902419df30609a14d90ca4b85f941b35683e5cda9283a00b754270d195df829266cc78407a6acb6a4670a081492", &(0x7f0000000240)=@tcp=r7}, 0x20) (async) close(r6) 2m51.153179827s ago: executing program 3 (id=3030): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x8}, 0x20) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000080)={0x0, 0x4000, 0x0, 0x5, 0x2}, 0x20) r1 = accept4$ax25(0xffffffffffffffff, &(0x7f00000001c0)={{0x3, @rose}, [@null, @rose, @bcast, @remote, @default, @null, @netrom, @default]}, &(0x7f0000000240)=0x48, 0x81000) r2 = socket$rxrpc(0x21, 0x2, 0xa) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000eb15000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002060207b1a"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r3}, 0xc) sendto$rxrpc(r2, &(0x7f0000000400)="af26df6dcfb4c535e9f05ad5cb9a202b0c194d52b8cd03f2466ef3c661855353dfc72fb2fa00a1cad9ad110ed28613701d3023f145fde106cdde6bf2810a28eed902f571377ee91b32326d715c75223e48a48e2ff2988bb3171b14e813abb622185251453141a94ce00e1299c5d170eb6b3ad1f6bed3d091506c60425425b2036525086f9f4bc5d1e9cee06fec36adcfdcdc10e17f4d2c5a74", 0x99, 0x4000801, 0x0, 0x0) r4 = accept4$ax25(r1, &(0x7f0000000280)={{0x3, @default}, [@bcast, @bcast, @default, @remote, @netrom, @rose, @default, @null]}, &(0x7f0000000300)=0x48, 0x0) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000060000000400000000000007000000000000000000000001050000001000000000000000000000030000000001000000020000000000000000000000da"], &(0x7f0000000340)=""/142, 0x52, 0x8e, 0x1}, 0x20) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c00)={0x11, 0xf, &(0x7f0000002cc0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xb5}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0xc, &(0x7f0000001b40)={0x0, 0x1}, 0x8}, 0x94) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, &(0x7f0000000540)={0x0}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r6, 0xc0709411, &(0x7f0000000740)={{r7, 0x8, 0x100000001, 0xfffffffffffffff8, 0x1, 0x6, 0x39dc, 0x8, 0x0, 0x9, 0x5, 0x4, 0xea, 0x3, 0x8}, 0x30, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x421, 0x204, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x2e92}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x4}}}, @IFLA_TXQLEN={0x8, 0xd, 0x8}, @IFLA_BROADCAST={0xa, 0x2, @broadcast}]}, 0x48}}, 0xc080) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$AUTOFS_IOC_EXPIRE(r4, 0x810c9365, &(0x7f0000000800)={{0x6, 0x3}, 0x100, './file0\x00'}) 2m50.7318807s ago: executing program 3 (id=3032): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000100)={r0}) (async, rerun: 32) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000000c0)) (async, rerun: 32) close(0x3) (async) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0x100, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) (async) close(0x3) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0x58) socket$inet_tcp(0x2, 0x1, 0x0) (async) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000006006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4000010) (async, rerun: 64) setsockopt$ALG_SET_KEY(r5, 0x117, 0x7, &(0x7f00000000c0)="feffffff", 0x4) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x3, 0x8}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000001a00010000000000000000000a0000eb00a5"], 0x24}}, 0x0) (async) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000080)=@req3={0x800, 0x3, 0x800100, 0x0, 0x400, 0xe, 0x2}, 0x1c) (async, rerun: 64) r8 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route_sched(r8, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=@newtaction={0x14, 0x1e, 0x109, 0x100, 0x25dfdbff}, 0x14}, 0x1, 0x2b1e}, 0x200408d4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newtfilter={0x38, 0x2c, 0x601, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {}, {0xc, 0xffe0}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0xf, 0xfff1}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4884}, 0x24000840) (async) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2m50.594918378s ago: executing program 3 (id=3035): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$sock_buf(r0, 0x1, 0x47, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRES16=r0], &(0x7f0000000f40)=""/4089, 0x3e, 0xff9, 0x1, 0xfffffffa}, 0x28) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0xc, &(0x7f0000000040)=0xe00000, 0x4) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000001a0001970000ff7f00000000800000", @ANYRES32=0x0, @ANYBLOB="796e98"], 0x24}}, 0x0) read(r3, &(0x7f0000000580)=""/63, 0x3f) sendmsg$RDMA_NLDEV_CMD_RES_GET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYRES8=r2], 0x4e}, 0x1, 0x0, 0x0, 0x4000}, 0x48004) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0x5, &(0x7f0000000040)=0x2, 0x4) 2m49.460080766s ago: executing program 3 (id=3040): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r1, 0x89ef, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c011, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) socket(0x400000000010, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000f10900010073797a300000000058000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000201c001180090001006d657461000000000c0002800800024000000013140000001000010000000000000000000084000a"], 0xa0}}, 0x0) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x4, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x7c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="14000000260009002947b8c18100000006000000"], 0x14}, 0x1, 0x0, 0x0, 0x404c005}, 0x4000040) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x800) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$inet(r6, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c71f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}, {&(0x7f0000001080)="da44c1ea68d4fab61dbcda4920e5dffef9f0436b1f72ade29ca9b127131a8f3a2d6bf6d86808a75d2c47d0610952458c2ded6382b915fdd7808d31cf6649c6920416f459c74519d07b399a15e55a560c601369a0f69dd5837156cca7a36a5f9fa7f5e74caa514265f04113fde8a431f274c44894c4ca2a78762f1dfc974f13a2cf3ac8cb231120387a6a6531dc43e9300d9b6e90cb3bb3e2184fd11a0b8d4ba29fd9b21f23d7769e", 0xa8}, {&(0x7f0000001180)="0a816be6644cded02f22590c05fd6f746a2b4860e04d8cb62261cda5c31b8559fefc9c017af1f0b7a3b86c26c9e90a11cfc5453ac84d0d5dcc5c18344c9d801b3075b24a7bc7a54a77422c6c85e1993897659c6fe4b035d0aa1f5bf183964ea7a2d789c697f375909a0591b324ca59af6d4fe31609e4d53d29d5e5122c718783156161e821300bf7084b4d77ac4b1b64c7713fe00d45429959d22e4988fb7b7778d631b53a28f734458a4bb784b6ffe10f76da5ed6463e4e9f2c5b58", 0xbc}, {&(0x7f0000000140)="84fdbcf5714e0674f054e462712b8f2ed26ec13ea001aa0242e5be", 0x1b}, {&(0x7f0000001000)="df", 0x1}], 0x9, &(0x7f0000001240)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010102, @multicast1}}}], 0x20}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xe, 0x0, &(0x7f0000000000)="bc8dc60fc94186fcde727ec63f42", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) recvmsg$unix(r7, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0xfffffffffffffffd, 0x0, 0x1ff, 0x552}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 2m35.151855349s ago: executing program 2 (id=3114): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$ITER_CREATE(0x21, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth1_to_bond\x00', 0x0}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r2, r4, 0x25, 0x0, @void}, 0x10) bpf$LINK_DETACH(0x22, &(0x7f0000000000)=r5, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000280)={r5, r6, 0x4, r2}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[], 0xb0}, 0x1, 0x0, 0x0, 0x8815}, 0x40) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000140003801000009b0c0001800600010000000000001100010000000000000000000100000a000000"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c0000001800dd8d0000000000000000020010000000000000000000080005"], 0x2c}, 0x1, 0x0, 0x0, 0x841}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3ff, 0x1, 0xfffffff8, 0x0, 0x7, 0x7f, 0x8, 0x5, 0x1}}}}]}, 0x58}}, 0x44884) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000020200000008001e00010000003ca26a0de1b40805f4392f956bd016d1f1daa03e99bfc671e81fb136f64ffd063856ab24c73f28c4c05782784f692e328cd7e71ac37d15ed4ddc8b3337df4930310503c6669865223228f95581b5f3e2f89c94b24f9ea12b64182f79b4add6fc59dfd89b353d1b8492a27c300a702eb619dca841895b0f5d10ff17f704d0ee382494f3fe00"/180], 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x4000040) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r12, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x25, 0x0, 0x2}, {0x28, 0x0, 0x81, 0x1}, {0xb1, 0x0, 0x28, 0x7}, {0x16, 0xfc, 0x23, 0xffffffff}]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_EMATCHES={0x4}]}}]}, 0x38}}, 0x2000c800) socket$netlink(0x10, 0x3, 0x0) 2m34.758330526s ago: executing program 2 (id=3116): mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3f8, 0x400, 0x70bd2c, 0x25dfdbfd, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x84) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x1}, 0x20) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 2m34.546222293s ago: executing program 2 (id=3117): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x638ac82a33e0280f}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r1, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="18080000b0ff0000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100013800002c00000000000000b7020000000000006b9af8ff00000000b509000000000000dbaaf8fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffc70200000800000018220000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m34.281248755s ago: executing program 32 (id=3040): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r1, 0x89ef, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c011, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) socket(0x400000000010, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000f10900010073797a300000000058000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000201c001180090001006d657461000000000c0002800800024000000013140000001000010000000000000000000084000a"], 0xa0}}, 0x0) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x4, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x7c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="14000000260009002947b8c18100000006000000"], 0x14}, 0x1, 0x0, 0x0, 0x404c005}, 0x4000040) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x800) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$inet(r6, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c71f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}, {&(0x7f0000001080)="da44c1ea68d4fab61dbcda4920e5dffef9f0436b1f72ade29ca9b127131a8f3a2d6bf6d86808a75d2c47d0610952458c2ded6382b915fdd7808d31cf6649c6920416f459c74519d07b399a15e55a560c601369a0f69dd5837156cca7a36a5f9fa7f5e74caa514265f04113fde8a431f274c44894c4ca2a78762f1dfc974f13a2cf3ac8cb231120387a6a6531dc43e9300d9b6e90cb3bb3e2184fd11a0b8d4ba29fd9b21f23d7769e", 0xa8}, {&(0x7f0000001180)="0a816be6644cded02f22590c05fd6f746a2b4860e04d8cb62261cda5c31b8559fefc9c017af1f0b7a3b86c26c9e90a11cfc5453ac84d0d5dcc5c18344c9d801b3075b24a7bc7a54a77422c6c85e1993897659c6fe4b035d0aa1f5bf183964ea7a2d789c697f375909a0591b324ca59af6d4fe31609e4d53d29d5e5122c718783156161e821300bf7084b4d77ac4b1b64c7713fe00d45429959d22e4988fb7b7778d631b53a28f734458a4bb784b6ffe10f76da5ed6463e4e9f2c5b58", 0xbc}, {&(0x7f0000000140)="84fdbcf5714e0674f054e462712b8f2ed26ec13ea001aa0242e5be", 0x1b}, {&(0x7f0000001000)="df", 0x1}], 0x9, &(0x7f0000001240)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010102, @multicast1}}}], 0x20}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xe, 0x0, &(0x7f0000000000)="bc8dc60fc94186fcde727ec63f42", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) recvmsg$unix(r7, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0xfffffffffffffffd, 0x0, 0x1ff, 0x552}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 2m32.022710553s ago: executing program 2 (id=3121): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071123c000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async) r2 = socket(0x2, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f00000001c0)=[{0x30, 0x5, 0x53, 0xfffff034}, {0x6, 0x4a, 0x6, 0x6}]}, 0x10) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) r3 = socket$kcm(0x2, 0xa, 0x2) (async) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)={0x118, 0x20, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x105, 0xf2, 0x0, 0x1, [@typed={0xf, 0x18, 0x0, 0x0, @str='}:.\x9c[\xc8\\#\'}\x00'}, @typed={0x14, 0x2, 0x0, 0x0, @ipv6=@private2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c", @typed={0x4, 0xe9}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) (async) writev(r1, &(0x7f00000006c0)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd6067", 0x14}, {&(0x7f00000001c0)="b700001811005abeef4ba0d598", 0xd}, {&(0x7f0000000200)="37a8a6c41ef711513a5555633f6e4259616da007f3c18c191f", 0x19}], 0x3) (async) sendmsg$key(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="020d000010000000000000000000000008001200020002000000bd000000000010003c0002030000003fff00000000000200000000000000000000570d45f3dd65602100000000000000000000000000030005000000000002000000ac1414aa0000000000000000030006000000000002"], 0x80}}, 0x0) 2m31.80212465s ago: executing program 2 (id=3124): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000680)=@newtaction={0x44, 0x32, 0x216822a75a8bdd29, 0xffe4, 0x0, {}, [{0x30, 0x1, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e23, 0x0, @mcast2}}, 0x0, 0x0, 0x46, 0x0, "f1f7882eade7f9ed59dd754ed3fa9513bc8d9662eaae6a87ea17d19cced73fca9d00b370eaefb203ab4c20fb0d62c726cc3cb83d211da63fb4007c81ad7a2edac7859b8988028702e2027b84c554f86f"}, 0xd8) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001c40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f1ea3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2ed0300000000000000af99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14008c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000006da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b2213fdc2881e1a6ec9d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232f0485a2ca9f37fc9c3d2688efcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdcdeb2af1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f925f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4978ea8e4aa37014191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308c"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@bridge_newvlan={0x24, 0x76, 0x709, 0x2, 0x0, {0x7, 0x2}, [@BRIDGE_VLANDB_ENTRY={0xc, 0xd, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0x5, 0x3, 0x4}}]}, 0x24}, 0x1, 0x5502000000000000}, 0x4000) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000000)={@remote, @multicast1, 0x4, "d30f388c52647612d91de4353d68b0fa00", 0x0, 0x0, 0x4000000, 0x8}, 0x3c) setsockopt$MRT_ADD_MFC(r4, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @multicast1, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0x0, 0x0, 0x4, 0xfffffffe}, 0x3c) setsockopt$MRT_ADD_MFC(r4, 0x0, 0xcc, &(0x7f0000000200)={@empty, @private, 0x0, "606b177019716ea6ff1f4d7ed79c31e2e0f1da00000000230000002000", 0x1, 0x0, 0x3}, 0x3c) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), 0xffffffffffffffff) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff089069000030000000000002907800907800000000524200040064350000000000000000000000255a000000ffe200000000bed81fb148888323d1b13c01d94019a59c3a93df2beb5947e82722d896a67524e3700681486fe9cd475579b67f49c00c08037c6cc2c80d33a4"], 0x0) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@local, @multicast2=0xe000031f, 0x0, "ff7fefe428970548fc3c7b00000000000000fcff00", 0xb2, 0xb, 0x6, 0x6}, 0x3c) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f00000003c0)=0xa, 0x4) socket$inet(0x2, 0x1, 0x0) r7 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000480)={0x88, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'wlan1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}]}, 0x88}}, 0x20000000) r8 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$kcm(r8, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) 2m31.460262069s ago: executing program 2 (id=3126): socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x618e, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x78}, 0x0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010028bd70000700000002000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) 2m16.374659449s ago: executing program 33 (id=3126): socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x618e, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x78}, 0x0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010028bd70000700000002000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) 4.545148333s ago: executing program 4 (id=4348): socket$inet6(0xa, 0x80003, 0xff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x2a, 0x2, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100"], 0x1c}}, 0x4008054) write$nci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r0], 0x3b) 4.273255928s ago: executing program 4 (id=4351): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, 0x1}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000000000)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000059c0)=[{{0x0, 0x0, 0x0}, 0x7c00000}], 0x1, 0x60, 0x0) 4.09597449s ago: executing program 4 (id=4354): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'netdevsim0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) (async) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000040)={&(0x7f0000000280)={0x250, r6, 0x10, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xe1}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x9}, @NL80211_ATTR_FRAME_MATCH={0x42, 0x5b, "64d3a7b92b0803d226bdd87b0ef6f1fe36b19216140d8a212c46e897db4132044bae173aaf75ca3d3493d421801a85eb5e746c130c6c2bc31513980fabb0"}, @NL80211_ATTR_FRAME_MATCH={0x6c, 0x5b, "389766516af53a6fd537d3fd0dfd8af5b049e86e929e9263a065e0d51a5a9e8ab97435a554f2821a095501379e596963beb60d12de950daf205424a07db2d7526b5745613690aaf496b4f4f59a1237f275b441660d909608fc3a089218179974f126673aa27db5ff"}, @NL80211_ATTR_FRAME_MATCH={0xc0, 0x5b, "0d8d7ba64e9715d60abe71f38324c01f4e295184b4995e0e5d30464f738ca394ae77df7b35ca4a1c7606e654a7c9774bc54a9bdec001ea70cd3f7ed921caf9d81f923fc8f00748c9f2610195850ccb65fe14d4bde488644c4cea07347c7ac381e7c8ca53978e7a7c75e01f7cca95c32d8ec57ae7b775a76a033c56faf193803673c2ee1c90e5fb719ff6be836aed90d3bb680b71a906accb003e76a5f86a55b276062a795f576461e83eed83edac3661223a80776f758f3f119ceb3f"}, @NL80211_ATTR_FRAME_MATCH={0xb2, 0x5b, "de5eabf4f8e74cbb29e083e33aa890e304408c186c8ad07ef5267ab39882c39a2821285a3c09c0434c894c9ecf86b3efeccda4106034471ef51e3963c9cfc4d8f8285b0b8b175aab051bc3bc7ae644684a5520248300cc728e3be11fc38dca8baba4be0fe9f286e82aa76b01cf5d17e089367bd0e3aef7146821195c5ae244751c68eae3afdb83f5c7864a3b462207f7ad32975a524f8544292cccf4b5525cb98324f49240e4b2147ca089743f2e"}]}, 0x250}, 0x1, 0x0, 0x0, 0xc010}, 0x1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x2c, r4, 0x6a98047402e98331, 0x70bd2a, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x4886) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r9, 0x5, 0xe, 0x0, &(0x7f0000000440)="469dc2d34ae2b700000000000000", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000140)={'syztnl1\x00', r1, 0x7800, 0x20, 0xa, 0x30000000, {{0x19, 0x4, 0x2, 0x0, 0x64, 0x65, 0x0, 0x1, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x34}, @empty, {[@ra={0x94, 0x4, 0x1}, @generic={0x7, 0xb, "8e1108707be97b8153"}, @end, @cipso={0x86, 0x2a, 0xffffffffffffffff, [{0x1, 0x2}, {0x7, 0x11, "91bc4bf3ad2700a84d30bf9cef9c6c"}, {0x0, 0xf, "27325119baca10dc38b04fcb1e"}, {0x6, 0x2}]}, @rr={0x7, 0x13, 0xf, [@broadcast, @multicast2, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) sendmsg$ETHTOOL_MSG_EEE_GET(r2, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x10c, r4, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x4}, @HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x48840}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010000104fc0f000000dcdf2500000000", @ANYRES32=0x0, @ANYBLOB="4319030000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 3.981708213s ago: executing program 4 (id=4357): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 64) unshare(0x20000400) (async, rerun: 64) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x1d, &(0x7f0000002600)}, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) pwrite64(r2, &(0x7f0000000380)="4d9401d2f6ec24a96871b2a2ec00062ca40c68fa816e81fd8ec4a529c32c816b01e1dcf7fe9caa432e1ed093d13b13bb1e11a6e358bfd16fc5d61bc1a0d00fd867e71858c3de7f59d495d93099505c9f2c4eea9d961d83fb65741d3a2586556f0c142e05a9cc768239ad51e6fd1a535d0ad1f5551f1d5f80d54901928cc2e9d0b507c9ff9c23ef37396623ba70cc45ab64b665bacfdbf556e25d64c2f3abfc12743650165196862e8aad106a8f19c223a901881d68becca83903ed8fb48369d6b545c3f4b1411f625fd40dfaa603465b43a1d6d532ba1ad0dd1d8a47c8cb7e452463e4", 0xe3, 0x8000000000000001) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x3c, r1, 0x1, 0x70bd29, 0xffffffbe, {{0x2}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x48080}, 0x20004056) close(0x4) unshare(0x6020400) (async, rerun: 64) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 64) ioctl$PPPIOCATTCHAN(r4, 0x40047438, &(0x7f0000000000)=0x1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async, rerun: 32) unshare(0x6a040000) (async, rerun: 32) r5 = socket(0x9, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r5, 0x6180, 0x0) (async, rerun: 64) ioctl$sock_bt_bnep_BNEPCONNDEL(r5, 0x400442c9, 0x0) (rerun: 64) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x99, 0xb, 0x4, 0xf, 0x1ff, 0xfb9d, 0x9, {0x0, @in={{0x2, 0x4e22, @private=0xa010100}}, 0x81, 0x2, 0x80000001, 0x4b, 0x10000009}}, 0x0) (async, rerun: 32) r6 = socket$kcm(0x10, 0x2, 0x10) (rerun: 32) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}}, 0x20050840) (async, rerun: 64) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xf, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x2e}], 0x1}, 0x4c040) (rerun: 64) 2.98135885s ago: executing program 4 (id=4363): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080), 0x3) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000020c0)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/4096, 0x1000, 0x0, &(0x7f00000010c0)=""/4096, 0x1000}, &(0x7f0000002100)=0x40) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000002140)={0x1, [0x0]}, 0x6) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet(r0, &(0x7f00000023c0)={&(0x7f0000002180)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3b}}, 0x10, &(0x7f0000002380)=[{&(0x7f00000021c0)="72ba661c8d71545684cf644c071018dfc21810a76a01e42c24ab7ee398a4610e53ebc621ef21fd9361b3acc677274b4a58510116c2fbac8363f7dae43a72e97ffd5a064e7f7cd056bb3b179b9b0fcd3172679c1e55", 0x55}, {&(0x7f0000002240)="9670f03b4a330d4f529a812e6c400948f762d7c7c7cca25d3cc6fc2280eeaa229d6d9da5aa97448b541acea280967b704d8fb2de17dc5c0123b0f310392fee6bbfe84f2609be25c49176a573878b2523209ab1877f877f45c48afa7e9470caf2016ee42fcef2a251204bf1be215c4149bca98a5c92191d181db896e09866a6fd8b9eaa2c2ed537915d4b00a6367ce838b1bd141937c33dbcd24b6943590fadea636ea16783c206d8d5e5b43dacf54d04f80651a54f786de514e6e4e7fd3b0268984d433957bdca7e517258ee5870ba60002d6f645882e990332a02a39082cff885aeb49a4e3e30b692fbbf30ced39bcd100dccee0aa36fcf0eca40", 0xfb}, {&(0x7f0000002340)="c0a98d497b", 0x5}], 0x3}, 0x4000000) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000002400)='scalable', 0x8) setsockopt$sock_int(r1, 0x1, 0xd, &(0x7f0000002440)=0x3a, 0x4) ioctl$FITHAW(r0, 0xc0045878) ioctl$IMHOLD_L1(0xffffffffffffffff, 0x80044948, &(0x7f0000002480)=0x4) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000024c0)='cpuacct.usage_all\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002540), 0xffffffffffffffff) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000002640)={&(0x7f0000002500)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002600)={&(0x7f0000002580)={0x68, r4, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x62}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xaef}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x75b}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xadd}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x119c}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x4fc}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x64c}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x68}}, 0x440c0) epoll_create1(0x80000) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8, 0x50, r1, 0x33415000) setsockopt$PNPIPE_HANDLE(r3, 0x113, 0x3, &(0x7f0000002680)=0xc2, 0x4) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000002700), r3) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r3, &(0x7f0000002940)={&(0x7f00000026c0), 0xc, &(0x7f0000002900)={&(0x7f0000002740)={0x184, r5, 0x10, 0x70bd25, 0x25dfdbfd, {}, [{{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x101}, {0x6, 0x11, 0x7}, {0x8, 0x15, 0xa1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x6e8f5367}, {0x6, 0x11, 0xe000}, {0x8, 0x15, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0xf39d}, {0x8, 0x15, 0xa9}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x1}, {0x6, 0x11, 0xf06}, {0x8, 0x15, 0x66ee5ba4}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x2}, {0x8, 0x15, 0xfffffffc}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7fff}, {0x6, 0x11, 0x800}, {0x8, 0x15, 0xf}}]}, 0x184}, 0x1, 0x0, 0x0, 0x40800}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000002980)='caif0\x00', 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002a00), r3) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000002ac0)={&(0x7f00000029c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002a80)={&(0x7f0000002a40)={0x24, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x81}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x0) r7 = epoll_create1(0x80000) socket$inet_smc(0x2b, 0x1, 0x0) r8 = socket(0x29, 0x0, 0x85de) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000002b00)={0x0, 0x101, 0xf414, 0x6, 0x0, 0x5017, 0x3, 0xc, {0x0, @in={{0x2, 0x4e20, @rand_addr=0x64010101}}, 0xe, 0x8, 0x4, 0x7fff, 0x1}}, &(0x7f0000002bc0)=0xb0) setsockopt$inet_sctp6_SCTP_MAXSEG(r8, 0x84, 0xd, &(0x7f0000002c00)=@assoc_id=r9, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f0000002c40)={0xcaac, 0x8000, 0x8bf, 0x10068c1b}, 0x14) 2.8294552s ago: executing program 1 (id=4367): syz_genetlink_get_family_id$tipc2(&(0x7f0000001840), 0xffffffffffffffff) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) unshare(0x6a040000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r1 = socket(0x400000000010, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r2, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}, {&(0x7f00000007c0)="89c718f606d7", 0x6}], 0x2) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f000001bfc0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x8001, {0x0, 0x0, 0x0, 0x0, {0x7, 0xffe0}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x22044028}, 0x4c004) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70200001400004bb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r4}, 0xc) (async) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) r5 = socket(0x10, 0x803, 0x0) (async) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x40040}, 0x40) (async) syz_init_net_socket$netrom(0x6, 0x5, 0x0) (async) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd7000fbd3df2502000000050004000100000005000400010000001400020076657468315f746f5f7465616d0000000900030073797a3200000000090001"], 0x68}, 0x1, 0x0, 0x0, 0x4000145}, 0x0) (async) sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, r6, 0x700, 0x70bd28, 0x25dfdbfc, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'geneve1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6erspan0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x40800}, 0x4044040) (async) recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 2.769834774s ago: executing program 4 (id=4368): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x3c, r3, 0x1, 0x0, 0xfffffffe, {}, [@ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x6a40}]}, 0x3c}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0xc3f37cc}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000240)=0x2, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000180)=@gcm_256={{0x304}, "32f058ec27d46898", "d40f86fd02541c95afec379bdb3cc0d5646e20975202603a18fe7474dc4c3d7b", '\"\vEX', "010000000100"}, 0x38) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) socket(0x400000000010, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x12, &(0x7f00000004c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010004b0422000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c00028008000400000000000800150000000000050016"], 0x4c}, 0x1, 0x0, 0x0, 0x200400a0}, 0x0) write$cgroup_pid(r5, &(0x7f00000000c0), 0x12) pread64(r5, &(0x7f0000001840)=""/4096, 0x1000, 0x1) 2.423963967s ago: executing program 5 (id=4374): r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl$sock_netdev_private(r0, 0x89f9, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket(0x2a, 0x2, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03", 0x3}], 0x1}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[], 0x1c}}, 0x4008054) write$nci(r3, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) write$nci(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r2], 0x3b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYRESHEX=0x0, @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afffffff8000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x94) socket$igmp6(0xa, 0x3, 0x2) 2.05824956s ago: executing program 6 (id=4378): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="540000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000fe0f00001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="080004"], 0x54}, 0x1, 0xba01, 0x0, 0x20044004}, 0x4000000) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="540000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000fe0f00001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="080004"], 0x54}, 0x1, 0xba01, 0x0, 0x20044004}, 0x4000000) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="160000000000000004000000"], 0x48) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1, &(0x7f00000003c0)={@mcast2, 0x0}, &(0x7f0000000400)=0x14) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x50, 0x50, 0x6, [@type_tag={0x1, 0x0, 0x0, 0x12, 0x1}, @var={0xc, 0x0, 0x0, 0xe, 0x4, 0x1}, @decl_tag={0x10, 0x0, 0x0, 0x11, 0x2, 0x6}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x7f}}, @volatile={0x9, 0x0, 0x0, 0x9, 0x1}]}, {0x0, [0x0, 0x2e, 0x30, 0x61]}}, &(0x7f0000001300)=""/4096, 0x6e, 0x1000, 0x0, 0x5, 0x10000}, 0x28) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180), 0x8) (async) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x0, 0x0}, 0x8) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380)=r5, 0x4) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0xb, &(0x7f0000000600)=@raw=[@jmp={0x5, 0x0, 0x1d, 0x2, 0x8, 0x2, 0xfffffffffffffff0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @generic={0x7, 0x5, 0x1, 0x7, 0x3b0d}, @func], &(0x7f0000000680)='syzkaller\x00', 0x1, 0x1000, &(0x7f0000002300)=""/4096, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000700)={0x0, 0x5, 0x4, 0x40}, 0x10, 0x0, 0x0, 0x2, &(0x7f00000007c0)=[0x1], &(0x7f0000000800)=[{0x4, 0x4, 0xb, 0x6}, {0x4, 0x1, 0xa, 0x9}], 0x10, 0x7fff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x14, 0xc, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x8}, [@alu={0x7, 0x1, 0x6, 0x3, 0x2, 0xfffffffffffffff4, 0xfffffffffffffff0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}]}, &(0x7f0000000200)='GPL\x00', 0x7, 0x62, &(0x7f0000000340)=""/98, 0x41000, 0x0, '\x00', r3, @fallback=0x1c, r4, 0x8, &(0x7f0000000500)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000540)={0x5, 0x1, 0x6, 0x873}, 0x10, r5, r6, 0x6, 0x0, &(0x7f0000000900)=[{0x1, 0x4, 0x7, 0x1}, {0x4, 0x1, 0x3, 0x8}, {0x5, 0x2, 0x5, 0x4}, {0x2, 0x5, 0x7, 0x7}, {0x0, 0x4, 0xd, 0xb}, {0x4, 0x2, 0x5, 0x1}], 0x10, 0x2}, 0x94) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x4, 0x101, 0xffffffff, 0x7f, 0x810, 0x1, 0x90, '\x00', 0x0, 0xffffffffffffffff, 0x7, 0x1, 0x5}, 0x50) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x4, 0x101, 0xffffffff, 0x7f, 0x810, 0x1, 0x90, '\x00', 0x0, 0xffffffffffffffff, 0x7, 0x1, 0x5}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000480)='%pi6 \x00'}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x7, 0x8, 0x7ff, 0x1000, 0x1, 0x2, '\x00', r1, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3}, 0x50) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x7, 0x8, 0x7ff, 0x1000, 0x1, 0x2, '\x00', r1, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x10, 0x11, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x2, 0xb, 0x3, 0x7, 0xf63}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffffe}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3c88}}]}, &(0x7f0000000000)='syzkaller\x00', 0x9, 0x88, &(0x7f00000002c0)=""/136, 0x40f00, 0x20, '\x00', r1, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x1, 0x4}, 0x8, 0x10, &(0x7f00000000c0)={0x3, 0xe, 0xdc00000, 0x1}, 0x10, r5, 0xffffffffffffffff, 0x2, &(0x7f00000005c0)=[r7, r8, r9, r10, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000600)=[{0x1, 0x4, 0xe, 0x4}, {0x0, 0x2, 0x5, 0x4}], 0x10, 0xfffff09e}, 0x94) 2.048962095s ago: executing program 5 (id=4379): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc4d4}, 0x8) sendto$inet6(r2, &(0x7f0000000300)="a8", 0x1, 0x24004001, &(0x7f0000000280)={0xa, 0x0, 0xe8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x85}, 0x1c) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) clock_gettime(0x0, &(0x7f0000000000)) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000080)={0x7}, 0x4) (async, rerun: 64) getsockname(r1, &(0x7f00000014c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001540)=0x80) (rerun: 64) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000007c0)=@newchain={0x24, 0x64, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x7ff3}}}, 0x24}}, 0x0) (async, rerun: 64) r4 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x80, 0x0, 0x0, 0x1, 0x0, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x3}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP_DST={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2b}}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async, rerun: 64) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) r5 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) close(r5) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000004c0)={0x288, r6, 0x1, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x24, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x9}]}, {0x4}, {0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}]}]}, @NL80211_ATTR_TID_CONFIG={0x248, 0x11d, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}]}, {0x4}, {0x40, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x55}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x84}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x49ad19d75e56c003}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xf0}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf0}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x9b}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd3}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xc2}]}, {0x174, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x100}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x54, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x50, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4b, 0x2, [{0x4, 0xa}, {0x7, 0x5}, {0x2, 0x4}, {0x6, 0x3}, {0x7, 0x6}, {0x1, 0x6}, {0x0, 0x3}, {0x1, 0xa}, {0x1, 0x6}, {0x3, 0x6}, {0x5, 0x2}, {0x2, 0x5}, {0x7, 0x5}, {0x5, 0x7}, {0x0, 0x6}, {0x4, 0x5}, {0x4, 0x5}, {0x7}, {0x1, 0x1}, {0x2, 0x5}, {0x1, 0x4}, {0x4, 0x6}, {0x4, 0x2}, {0x6, 0x5}, {0x3, 0x4}, {0x0, 0x3}, {0x0, 0x8}, {0x3, 0x8}, {0x4, 0x8}, {0x1}, {0x4, 0x1}, {0x7, 0x5}, {0x5, 0x7}, {0x5}, {0x1, 0x6}, {0x5, 0x1}, {0x0, 0x2}, {0x7, 0x1}, {0x4, 0x9}, {0x2, 0x2}, {0x1, 0x2}, {0x7, 0x1}, {0x1, 0x3}, {0x4, 0x2}, {0x1, 0x3}, {0x6, 0xa}, {0x7, 0xa}, {0x3}, {0x1, 0x2}, {0x0, 0x1}, {0x1, 0x5}, {0x0, 0x7}, {0x0, 0x5}, {0x4, 0xa}, {0x6, 0x9}, {0x2, 0x8}, {0x6}, {0x5, 0x4}, {0x1, 0x4}, {0x3, 0x4}, {0x0, 0x5}, {0x5, 0x7}, {0x7, 0x1}, {0x5, 0x8}, {0x0, 0x8}, {0x0, 0x8}, {0x1, 0x9}, {0x1, 0x9}, {0x1, 0xa}, {0x0, 0x5}, {0x7, 0x4}]}]}]}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x6}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0xd4, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0xfffc, 0xd, 0x3, 0x1, 0x3, 0x1, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x7fff, 0x0, 0x100, 0x937a, 0x1, 0x1, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_6GHZ={0x88, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xb, 0x1, [0x12, 0x60, 0x1, 0x18, 0x18, 0x9, 0x2]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xc, 0x7, 0x5, 0xd, 0x5, 0x1, 0x5]}}, @NL80211_TXRATE_HT={0x32, 0x2, [{0x7}, {0x1, 0x3}, {0x2, 0x7}, {0x1, 0x7}, {0x1, 0x4}, {0x7, 0x9}, {0x7}, {0x0, 0xa}, {0x1, 0x7}, {0x4, 0x3}, {0x7, 0x4}, {0x4, 0xa}, {0x2, 0x3}, {0x2, 0x9}, {0x5, 0x8}, {0x4, 0x8}, {0x3, 0x5}, {0x7, 0x2}, {0x3, 0x2}, {0x5, 0x7}, {0x1, 0x7}, {0x5, 0x8}, {0x6, 0x1}, {0x1, 0x9}, {0x7, 0x3}, {0x5, 0x7}, {0x0, 0x5}, {0x1, 0x4}, {0x5, 0xa}, {0x6, 0x7}, {0x1, 0x9}, {0x0, 0x1}, {0x6, 0x2}, {0x2, 0x7}, {0x6, 0x4}, {0x0, 0x4}, {0x0, 0x7}, {0x4, 0x7}, {0x3, 0x4}, {0x6, 0x7}, {0x7, 0x9}, {0x1, 0x2}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x4}, {0x5, 0x5}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x7, 0x4445, 0x8, 0x2, 0xa, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0xfffa, 0x1, 0x4, 0x8000, 0x9, 0xf, 0x5]}}]}]}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}]}]}, 0x288}, 0x1, 0x0, 0x0, 0x4000020}, 0x0) r9 = socket(0x840000000002, 0x3, 0x100) connect$inet(r9, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) (async, rerun: 64) sendmmsg$inet(r9, &(0x7f0000005240), 0x4000095, 0x0) (rerun: 64) setsockopt$inet_buf(r9, 0x0, 0x24, 0x0, 0x0) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r11, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_START_AP(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000cc0)={0x7c, r11, 0x5, 0x1, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3d, 0xe, {{{}, {}, @broadcast, @broadcast, @random="0c26364ebeb3"}, 0x0, @default, 0x1, @void, @val, @void, @void, @val={0x6, 0x2, 0x6}, @void, @void, @void, @val={0x3c, 0x4, {0x1, 0xf, 0xa1, 0x4}}, @void, @void, @val={0x71, 0x7, {0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xff, 0x60}}, @void}}, @NL80211_ATTR_PROBE_RESP={0x7, 0x91, "c46608"}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x5}]}, 0x7c}, 0x1, 0x0, 0x0, 0x84}, 0x0) (async) sendmsg$NL80211_CMD_SET_MCAST_RATE(r9, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x44, r11, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x6e}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xb4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000801}, 0x28000000) 1.783471901s ago: executing program 0 (id=4380): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r0) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r1, 0x701, 0x4}, 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000000300), &(0x7f0000001080)=0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_TABLE(r4, 0x29, 0xcf, &(0x7f0000000000)=0xfd, 0x4) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) 1.702371838s ago: executing program 6 (id=4381): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x0, 0x27a}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x0, 0xe46}, &(0x7f0000000180)=0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="c000000040000701feffffff00000000017c1200040042800c00018006000600800a0000970002809470c4b9d425894604f2ef9d2877c76e6cff2cc03746b35836c0acd8948b974978ed58bdf5911ccfaed74609301189929cf0be024fe625adfb8a2230958e80bbcd69193952aff71c16a71b319c97f68d31a04ce3e42faf6f9a9080bc71d6fc8e88a759a2622cf548697149accdc2c647d3d025be3f7e971d8dcc3968e0c25aee12f24713c04065f88e291eec1dc708de4772dc00040008"], 0xc0}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x25dfdbfb, {0x7a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @erspan={{0xb}, {0xfffffffffffffdb5, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x20}, @IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x17fe}]}}}]}, 0x44}}, 0x0) 1.678853738s ago: executing program 5 (id=4382): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0x3fe3aa0262d8c58b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0x7}}}}]}, 0x40}}, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_freezer_state(r4, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r5, &(0x7f0000000040)='FROZEN\x00', 0x7) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@getnexthop={0x20, 0x6a, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@NHA_MASTER={0x8, 0xa, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x10) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r4}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e23, 0x3ff, @empty, 0x10000}}, [0x2, 0x6, 0x0, 0xffffffff, 0x9, 0x1f0fded9, 0xc4e7, 0x9, 0x8, 0x7, 0x6, 0x100, 0xa, 0xa, 0xb]}, &(0x7f0000000180)=0x100) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r10, 0x84, 0x7c, &(0x7f00000001c0)={r11, 0x9, 0x5}, &(0x7f0000000280)=0x8) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@bridge_dellink={0x24, 0x11, 0x5, 0x0, 0x300, {0x7, 0x0, 0x0, r9, 0x1}, [@IFLA_VFINFO_LIST={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) mkdirat$cgroup(r4, &(0x7f0000000100)='syz0\x00', 0x1ff) sendfile(r5, r5, 0x0, 0x9) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 1.505256432s ago: executing program 0 (id=4383): socket$inet6(0xa, 0x80003, 0xff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x2a, 0x2, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r0], 0x3b) 1.468373115s ago: executing program 6 (id=4384): socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$igmp6(0xa, 0x3, 0x3a) socket$kcm(0x10, 0x2, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000000000000000000d9bb000085000000b500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x54, 0x2, 0x2, 0x201, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x2}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASK={0x10, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}, @CTA_EXPECT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x5}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004001}, 0x20000884) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x50) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.369378094s ago: executing program 0 (id=4385): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0x14, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0xd}, [@map_idx_val={0x18, 0x10, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_val={0x18, 0x4, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}]}, &(0x7f00000002c0)='GPL\x00', 0x71, 0x0, &(0x7f0000000540), 0x41100, 0x18, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, &(0x7f0000000580)={0x3, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, &(0x7f0000000600)=[0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000640)=[{0x4, 0x5, 0x0, 0x1}, {0x3, 0x5, 0x6, 0x4}, {0x4, 0x3, 0xa, 0x4}], 0x10, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r0, 0x27, 0xe, 0x0, &(0x7f0000000240)="f8ad48cc02cb29dcc8007f5b86dd", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000300)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYRESOCT=r2, @ANYRES32=r3, @ANYBLOB="08002a000a0000001c002b8008000100020000"], 0x40}, 0x1, 0x0, 0x0, 0x24048004}, 0x810) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2002}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0xfe}]}}}]}, 0x3c}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280), r6) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, r7, 0x1, 0x0, 0x0, {0x6}}, 0x14}}, 0x0) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60084000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r7, 0x200, 0x70bd2c, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44080}, 0x40804) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_POWER_SAVE(r4, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r8, 0x200, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc040}, 0x4004000) 1.276947383s ago: executing program 6 (id=4386): unshare(0x20000400) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x3, 0x8, &(0x7f0000000700)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0x4f, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b705000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r4}, 0xc) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000a80)='nv', 0x2) shutdown(r2, 0x1) 1.225897422s ago: executing program 5 (id=4387): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0xffffffff, 0x4) write$tun(r2, 0x0, 0x1001) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) r5 = epoll_create1(0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x12, 0x8, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r7}, &(0x7f0000000040), &(0x7f0000000140)=r6}, 0x20) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000280)={0x20000008}) ioctl$F2FS_IOC_RESIZE_FS(r6, 0x4008f510, &(0x7f00000001c0)=0xfffffffffffeffff) r8 = socket$kcm(0x10, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f80)=ANY=[@ANYBLOB="280000002c00070100000000ffdbdf25027c00000800018004000800028004008e80000000000000"], 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r9, &(0x7f0000000180), &(0x7f0000000000)=""/4, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r9, &(0x7f0000000600)="a8fe1044858864ad725d", &(0x7f0000000000), 0x2}, 0x20) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 1.175269759s ago: executing program 6 (id=4388): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0xffffffff, 0x4) write$tun(r2, 0x0, 0x1001) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) r5 = epoll_create1(0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x12, 0x8, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r7}, &(0x7f0000000040), &(0x7f0000000140)=r6}, 0x20) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000280)={0x20000008}) ioctl$F2FS_IOC_RESIZE_FS(r6, 0x4008f510, &(0x7f00000001c0)=0xfffffffffffeffff) r8 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f80)=ANY=[@ANYBLOB="280000002c00070100000000ffdbdf25027c00000800018004000800028004008e80000000000000"], 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r10, 0x58, &(0x7f0000000100)}, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 768.440045ms ago: executing program 0 (id=4389): r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl$sock_netdev_private(r0, 0x89f9, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket(0x2a, 0x2, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03", 0x3}], 0x1}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[], 0x1c}}, 0x4008054) write$nci(r3, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) write$nci(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r2], 0x3b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYRESHEX=0x0, @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afffffff8000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x94) socket$igmp6(0xa, 0x3, 0x2) 615.549258ms ago: executing program 1 (id=4390): r0 = socket(0x10, 0x3, 0x6) r1 = socket(0x10, 0x3, 0x0) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) (rerun: 32) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newqdisc={0x88, 0x24, 0xf0b, 0x22, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x10, 0xf}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xfe, [0x0, 0x0, 0x1, 0x7, 0x6, 0xfd, 0x0, 0xfe, 0x3, 0x10, 0x80], 0xfe, [0x4, 0x2, 0xfffe, 0x4e3e, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) listen(0xffffffffffffffff, 0x8) (async) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001640)={&(0x7f00000001c0)=@in6={0xa, 0x4e22, 0x4, @private2, 0x7fd}, 0x1c, &(0x7f0000000280), 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000000"], 0x18}, 0x280400d5) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x16, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x92}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xa4}, @exit]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x70) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_DEV(r3, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc801}, 0x20008804) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid\x00') (async) unshare(0x6a040000) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0xa, &(0x7f0000000040)=0x8, 0x4) r5 = socket(0x8, 0x3, 0x0) r6 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000180)) (async) r7 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r7, 0x0, 0x81, 0x0, &(0x7f0000000200)) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x1d, 0x3, 0x1) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x403, 0x70bd29, 0x3d, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}, @IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x10001}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e20}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004}, 0x4804) 496.463827ms ago: executing program 1 (id=4391): unshare(0x20000400) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x3, 0x8, 0x0, &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0x4f, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b705000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r4}, 0xc) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000a80)='nv', 0x2) shutdown(r2, 0x1) 485.302377ms ago: executing program 0 (id=4392): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, &(0x7f0000000000)={@any, 0x104b, 0x67, 0x9, 0x5, 0xfffe, "a43d8057ade4cd7ee397e66a50a37ba87a5fe18034707dcd909ab46f4ae2ae71e6dac5ee5a816210bc6991f1411c04da87ff08f607c70a5171385fa53d77a0bb9870b7e07ba07aace3bf29e5bc6c512d3ae683fbc9bfe5cf014185701e446c82179c7bec4e42e1d7c157f97244ddfa01ebaabc609f5767149c13f2bccfcb7dee"}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x4, 0x9, 0x2, 0xf794, 0x40, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, 0x7801, 0x7, 0x7f}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000200)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0xa, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0x2e, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f00000005c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x60, r2, 0x800, 0x70bd28, 0x25dfdbff, {}, [@GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_PEER_ADDR6={0x14, 0xb, @private0}, @GTPA_LINK={0x8, 0x1, r3}, @GTPA_FAMILY={0x5, 0xd, 0x2a}, @GTPA_PEER_ADDRESS={0x8, 0x4, @broadcast}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_LINK={0x8, 0x1, r4}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008800}, 0x40) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000640)={'hsr0\x00', 0x0}) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x38, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_TID={0xc}, @GTPA_LINK={0x8, 0x1, r5}, @GTPA_LINK={0x8, 0x1, r3}, @GTPA_LINK={0x8, 0x1, r3}]}, 0x38}}, 0x20000000) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000780), r1) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x54, r6, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e23}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @empty}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040}, 0x40) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r7, 0x12, 0x3, &(0x7f00000008c0)=0x14, 0x4) bind$packet(0xffffffffffffffff, &(0x7f0000000900)={0x11, 0x18, r5, 0x1, 0xf1, 0x6, @local}, 0x14) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) r10 = syz_init_net_socket$ax25(0x3, 0x3, 0xce) bind$ax25(r10, &(0x7f0000000980)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) close(r1) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000a00)={0x200, 0x4, 0x1, 0xeeaa, 0xd}) r11 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000a40), &(0x7f0000000a80)=0xe, 0x800) ioctl$EXT4_IOC_SWAP_BOOT(r11, 0x6611) r12 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GCALLUSERDATA(r12, 0x89e4, &(0x7f0000000ac0)={0x7, "d80767513b3e765e31041f44d6a6da2a0f596f6016785f8acea405da311a10058c202028283726ade012ac0d45e78a372591386f5d300ddc1862ed34a9b78615a7d3b1a7ebdba91ed219454709af6eaacd5ce4367c38eed818d0e986e61cba3df8b30e0e469a47ec69141373c790b6f3d35a4f08ff8a9f8fbef6331a648cbc6b"}) r13 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$sock(r13, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000b80)="598f62425752b14420f49ed2e65349e64fe8b495281317a64e3de76ebe743926b070db3229705b8d5cefa712cd6c8d4bc505b2403e509dfba03f53c71fd4d39f71030b361d4b80bd79d9995b879b3b18ab4ae5a0baeb0a2d7f4724bf770b7f0631dbb5c7d57f4224ceb2ae2f71", 0x6d}, {&(0x7f0000000c00)="794ee5a6be49198c980ae9af9edf2530c52b7846ded68ba1b5af422b488f43587c08d2ab6b595db403a5ed65d07f1ff5b67f3294445801c7f5ce5f6bc99cf2ecc0ac5100a6e948a9e24ddb633b5b0d13c0c81a", 0x53}, {&(0x7f0000000c80)="5a63aed94cdc010b34459530d3c53947a433d6ba7a2439a2ce3d8a2fae0449715940d2c2556566981c535d9bbf4d03edbccc4564f4fe48997e4a6a5f14d2ac42ec3d231f3f9c5408359eca88037e6e241ee4f3a1e5c7725c47218e85ee06320300e8306dcc000c5900514851d5d5251d913e7abdea4118d577960daec865946887b0e8d66d142a0000306cf9add721360220af99973bae9b77767417dceae1da0662b9", 0xa3}, {&(0x7f0000000d40)="488fb69eda2ce0d0bf646d4e7caee7fbd903a3d6b01de383a80eee198abb8a6762f67b219aee29518855a3f6ceeee580f18f520fc2183ed541a7fcdba349f6410cbe04bced1857c6679a46f067b2581be51ac4f4fca2e543272fb13f96cd0befd17833147a", 0x65}, {&(0x7f0000000dc0)="a403d45f82f3aff2b62b1a8eb5f6464b24c4154939b0ec95353f2fef5db257e62bf7516cece0083df09ebead8bcdf8f05be0061fb97a0dac845d4151fb114bf07bca1405826a28ef0bfed6928200053c6d463cefcd798702", 0x58}], 0x5, &(0x7f0000000ec0)=[@txtime={{0x18, 0x1, 0x3d, 0x1000}}, @txtime={{0x18, 0x1, 0x3d, 0x1ff}}, @txtime={{0x18, 0x1, 0x3d, 0x6}}, @timestamping={{0x14, 0x1, 0x25, 0xf0}}, @txtime={{0x18, 0x1, 0x3d, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x8}}, @timestamping={{0x14, 0x1, 0x25, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x1178}}, @txtime={{0x18, 0x1, 0x3d, 0xffffffffffffff00}}, @timestamping={{0x14, 0x1, 0x25, 0xfffffff5}}], 0xf0}, 0x4002004) r14 = socket$unix(0x1, 0x5, 0x0) r15 = openat$nci(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) r16 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$unix(r14, &(0x7f0000001a00)=[{{&(0x7f0000001000)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001080), 0x0, &(0x7f0000001100)=[@rights={{0x30, 0x1, 0x1, [r12, r8, r15, r16, r11, 0xffffffffffffffff, r7, 0xffffffffffffffff]}}], 0x30, 0x4000010}}, {{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000001140)="15bc155435e56e90479b3e2dbe473b4b4cd1dae28b7e5addce9ed9a389e96c94dd4907917001", 0x26}, {&(0x7f0000001180)="ef93d62dc2dece4629fa40446cc355c63f83117912aa489ec1a550eddf2bdea115faa85e40d752099cf5d3528bf6609e534d318121ec65936a117bcfa19b59", 0x3f}, {&(0x7f00000011c0)="6b711b35a508f2ad64d738e2c44daa2948b66dc3fa15dedad61a104c4e2fdf09fee1b1c16ca12b21dbd3feb8e48a8427d2596c862965d989dffd5d17a4c9f18a5cf6f265c6f2adaa3b6702e6d27d467d9f29c1b668a2f80892a31b1536929ad3c6ae8e2c2b2d51fe03299f6278739e91b3f83bc38a11bbcd4a211f5b2766f1b27b5a4605d4e7e0a04a1843e76944e137d2267278f4441088d40946b0d45de35aa25d1c62e468217b191122fdc656ae", 0xaf}], 0x3, &(0x7f0000001940)=[@rights={{0x28, 0x1, 0x1, [r9, r11, r13, 0xffffffffffffffff, r10, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @rights={{0x28, 0x1, 0x1, [r9, r9, r9, r13, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90, 0x4048800}}], 0x2, 0x4001) 353.533864ms ago: executing program 1 (id=4393): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x200000b, 0x41071, 0xffffffffffffffff, 0x894f000) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000000)=0xa4, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x200000b, 0x41071, 0xffffffffffffffff, 0x894f000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) (async) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000000)=0xa4, 0x8) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) (async) 284.376891ms ago: executing program 5 (id=4394): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) r1 = socket(0x2b, 0x80801, 0x1) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x40080}, 0x24000001) 185.186386ms ago: executing program 1 (id=4395): socket$inet6(0xa, 0x80003, 0xff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x2a, 0x2, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r0], 0x3b) 142.016196ms ago: executing program 6 (id=4396): r0 = socket$l2tp(0x2, 0x2, 0x73) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f00000008c0)={0x0, 0x2, 0x1, [0x6, 0x3, 0x4, 0x7fffffffffffffff, 0x44], [0x2e4f, 0x4, 0x4, 0x9, 0x7, 0x5a00becf, 0xb, 0x3c7c, 0x1, 0x100, 0x400, 0x3, 0xc7, 0x9, 0xa8, 0x0, 0x80, 0x1c7, 0x2, 0x0, 0x6, 0x26, 0x5, 0x2, 0x10, 0x9, 0x2, 0x4000000000000, 0x3dc1, 0x6df7, 0x100000000, 0x5, 0x6, 0x7f, 0x0, 0x1, 0x6, 0xffffffff00000000, 0x1, 0xffffffffffffff58, 0x2, 0x4, 0x9, 0xfffffffeffffffff, 0x1, 0x4, 0x7, 0x3, 0x80000000, 0x800, 0x5, 0x3, 0x7, 0x7f, 0x9, 0x9, 0x1, 0x6, 0xf, 0x8000000000000000, 0xe, 0xaae, 0x5460, 0x100000000, 0x4, 0x6, 0x9, 0x7, 0x10001, 0x4, 0x7, 0x2, 0xfb3, 0x3, 0x9, 0x7, 0x615f9155, 0x81, 0xffffffff, 0xffffffff00000001, 0x4, 0x4, 0x3ea4bdbb, 0x5, 0x8000000000000001, 0x9, 0x3, 0x80000001, 0x9689, 0x40, 0x0, 0xa1, 0x211, 0x400, 0x5, 0x0, 0x81, 0x7f, 0x0, 0xf, 0x33f, 0x5, 0x1, 0x2, 0x3, 0x4, 0xffff, 0x3, 0x8, 0x8, 0x8, 0x9, 0xf3a1, 0x5, 0xffff, 0x4, 0x3, 0xffffffffffffffff, 0x7, 0x5, 0x401]}) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000d00)={r1, "bcad9a4c554085c7577a4b272933e103"}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@ipv6_newroute={0x1c, 0x18, 0x221, 0x70bd2c, 0x0, {0xa, 0x20, 0x14, 0x0, 0xff, 0x4, 0xff, 0x6}}, 0x1c}}, 0x40000) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) socket(0x400000000010, 0x3, 0x0) (async) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2b, 0x25dfdb01, {0x0, 0x0, 0x0, r8, {0x10, 0xc}, {0x0, 0xfff1}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x24009082) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0500000004000000040000000800000000000000", @ANYRES32, @ANYBLOB="000000fb0000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'}) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r9, 0xc004743e, &(0x7f0000000140)) socket$inet_mptcp(0x2, 0x1, 0x106) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) (async) r11 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000200)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2a, 0x25dfdbfe, {0x60, 0x0, 0x0, r12, {0x0, 0xe}, {0xffff, 0xffff}, {0x7, 0xffe1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TUPDATE={0x8, 0x8, 0xffffffff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048011}, 0x0) r13 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r13, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) bind$tipc(r13, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r13, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r13, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) 5.388778ms ago: executing program 0 (id=4397): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid\x00') unshare(0x6a040000) r4 = socket$netlink(0x10, 0x3, 0xb) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x840000000002, 0x3, 0xff) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f00000000c0)="510003000000", 0x6) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x8010) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc5, 0xe23, 0x3, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) unshare(0x20000400) bpf$BPF_LINK_CREATE_XDP(0x25, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x25, 0x1, @val=@tcx}, 0x1c) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b40)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x80000, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0x5, 0xb}, {0xffe0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x1, 0x406, 0x1, 0xffffffff, 0x9}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) r6 = socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 4.694491ms ago: executing program 1 (id=4398): unshare(0x20000400) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x3, 0x8, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r1], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r2, 0x18000000000002a0, 0x4f, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r3, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b705000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r5}, 0xc) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000a80)='nv', 0x2) shutdown(r3, 0x1) 0s ago: executing program 5 (id=4399): socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @private=0xa010101}, 0x10) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000006e00)={&(0x7f0000006c40)={0x14, 0x27, 0x1, 0x70bd27, 0x25dfdbfd, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x2000c810}, 0x8000) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010000d042abd70000000000000000000", @ANYRES32=r2, @ANYBLOB="01200000000000001c00128009000100626f6e64000000000c000280050001a16abb5d1d5e514bc70004000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(r4, &(0x7f00000005c0)="f5", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffc, @rand_addr=' \x01\x00'}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r5) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000780)=ANY=[@ANYBLOB="0b01000044a73e56a70d360c7213ba1f47a9495f189a399aeeca515a6eaf9b079652224bc9303f8999557e256513997801f62aa3cebeeede9ba86e49908a87350ce0b40c5ab4e4906289e7ed2f40037129072147bff2defcb9b1c2fda8e602da8bbc29234941a18dfdf1c4acdfe55b959731f51cdff0b966316f1b1c7a75ab3cdb2e6d06b9c2cafc5a39dbd929c16e10fcce98ce19d7", @ANYRES16=r6, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) socket(0x1, 0x803, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r9, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r9, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000002900000037"], 0x18}}], 0x1, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r8], 0x54}}, 0x0) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "12ad9a", 0x380, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0xa}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x19, 0x1, '\x00'/12}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x1f, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4610001394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "000000000000000200000000000000000000000000008879e66485201a0015ca837400000000000000000000001c000000000000000000"}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8ba7a514c4b7a94fe18e88605aa6be1a02a326a6bce65f"}]}}}}}}, 0x0) kernel console output (not intermixed with test programs): t 2(bridge_slave_1) entered blocking state [ 466.195468][ T9797] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.371118][T17961] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3053'. [ 466.571231][T17969] netlink: 'syz.2.3055': attribute type 2 has an invalid length. [ 466.688973][T17873] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.747947][T17358] Bluetooth: hci3: command tx timeout [ 466.788792][T17873] veth0_vlan: entered promiscuous mode [ 466.842059][T17873] veth1_vlan: entered promiscuous mode [ 466.937973][T17873] veth0_macvtap: entered promiscuous mode [ 466.966583][T17873] veth1_macvtap: entered promiscuous mode [ 467.011872][T17873] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 467.049821][T17873] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 467.091547][ T9797] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.119082][T17988] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3059'. [ 467.122640][ T9797] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.166854][ T9797] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.185413][ T9797] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.274125][T17992] netlink: 'syz.4.3060': attribute type 2 has an invalid length. [ 467.299891][T17992] xt_ecn: cannot match TCP bits for non-tcp packets [ 467.415731][ T6605] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.453217][ T6605] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.481137][T17998] lo speed is unknown, defaulting to 1000 [ 467.502801][T18003] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3064'. [ 467.515326][T17998] wg1 speed is unknown, defaulting to 1000 [ 467.519749][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.538077][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.772856][T18013] netlink: 'syz.0.3065': attribute type 1 has an invalid length. [ 467.798449][T18013] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3065'. [ 468.180106][T17875] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 468.199678][T17875] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 468.209496][T17875] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 468.217859][T17875] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 468.225684][T17875] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 468.290555][T18022] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3068'. [ 468.316017][T18025] tipc: Started in network mode [ 468.323665][T18025] tipc: Node identity a65bf0d94384, cluster identity 4711 [ 468.349999][T18025] tipc: Enabled bearer , priority 0 [ 468.415051][T18026] lo speed is unknown, defaulting to 1000 [ 468.450006][T18030] tipc: Resetting bearer [ 468.571256][T18025] syzkaller0: entered promiscuous mode [ 468.579395][T18025] syzkaller0: entered allmulticast mode [ 468.614659][T18024] tipc: Resetting bearer [ 468.681672][T18024] tipc: Disabling bearer [ 468.737058][T18026] wg1 speed is unknown, defaulting to 1000 [ 468.826570][ T5831] Bluetooth: hci3: command tx timeout [ 469.151183][T17358] block nbd1: Receive control failed (result -32) [ 469.151658][T18037] netlink: 'syz.1.3071': attribute type 4 has an invalid length. [ 469.186931][T18037] netlink: 'syz.1.3071': attribute type 1 has an invalid length. [ 469.194967][T18037] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3071'. [ 469.394180][T18038] lo speed is unknown, defaulting to 1000 [ 469.409219][T18038] wg1 speed is unknown, defaulting to 1000 [ 469.632276][T18049] bond1 (unregistering): Released all slaves [ 469.735888][T18026] chnl_net:caif_netlink_parms(): no params data found [ 469.808619][T18055] lo speed is unknown, defaulting to 1000 [ 469.860473][T18060] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3075'. [ 469.871284][T18055] wg1 speed is unknown, defaulting to 1000 [ 469.991580][T18026] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.999642][T18026] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.008358][T18026] bridge_slave_0: entered allmulticast mode [ 470.017279][T18026] bridge_slave_0: entered promiscuous mode [ 470.042123][T18026] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.051025][T18026] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.059007][T18026] bridge_slave_1: entered allmulticast mode [ 470.068306][T18026] bridge_slave_1: entered promiscuous mode [ 470.162547][T18026] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 470.193886][T18026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 470.267281][T17358] Bluetooth: hci0: command tx timeout [ 470.311979][T18026] team0: Port device team_slave_0 added [ 470.352079][T18026] team0: Port device team_slave_1 added [ 470.452861][T18026] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 470.460924][T18026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 470.488378][T18026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 470.517748][T18026] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 470.525238][T18026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 470.552568][T18026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 470.645179][T18026] hsr_slave_0: entered promiscuous mode [ 470.659249][T18026] hsr_slave_1: entered promiscuous mode [ 470.665497][T18026] debugfs: 'hsr0' already exists in 'hsr' [ 470.680171][T18026] Cannot create hsr debugfs directory [ 470.908094][T17358] Bluetooth: hci3: command tx timeout [ 470.986109][T18075] netlink: 'syz.2.3079': attribute type 1 has an invalid length. [ 471.244494][T18026] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.346948][T18080] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3080'. [ 471.370796][T18026] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.419409][T11002] IPVS: starting estimator thread 0... [ 471.427016][T18083] netlink: 320 bytes leftover after parsing attributes in process `syz.0.3081'. [ 471.457575][T18026] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.463949][T18083] nbd: must specify at least one socket [ 471.498022][T18086] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3082'. [ 471.508447][T18086] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3082'. [ 471.527465][T18084] IPVS: using max 28 ests per chain, 67200 per kthread [ 471.548036][T18026] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.688861][T18087] nbd2: detected capacity change from 0 to 127 [ 471.696226][T18083] block nbd0: reconnected socket [ 471.705357][T18083] nbd: socks must be embedded in a SOCK_ITEM attr [ 471.761788][T17358] block nbd2: Receive control failed (result -104) [ 471.772935][ T5831] block nbd0: Receive control failed (result -32) [ 471.838647][ T9800] bridge_slave_1: left allmulticast mode [ 471.844599][ T9800] bridge_slave_1: left promiscuous mode [ 471.863150][ T9800] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.930897][ T9800] bridge_slave_0: left allmulticast mode [ 471.938125][ T9800] bridge_slave_0: left promiscuous mode [ 471.944019][ T9800] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.968840][ T9800] veth0_to_bond: left allmulticast mode [ 471.975525][ T9800] veth0_to_bond: left promiscuous mode [ 471.983845][ T9800] bridge3: port 1(veth0_to_bond) entered disabled state [ 472.350625][ T5831] Bluetooth: hci0: command tx timeout [ 472.830354][ T9800] bond5 (unregistering): (slave bridge8): Releasing backup interface [ 472.936212][ T9800] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 472.965562][ T9800] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 472.985735][ T9800] bond0 (unregistering): (slave `): Releasing backup interface [ 472.999714][ T9800] bond0 (unregistering): Released all slaves [ 473.017152][ T9800] bond1 (unregistering): Released all slaves [ 473.036045][ T9800] bond2 (unregistering): Released all slaves [ 473.056178][ T9800] bond3 (unregistering): Released all slaves [ 473.086956][ T9800] bond4 (unregistering): Released all slaves [ 473.111188][ T9800] bond5 (unregistering): Released all slaves [ 473.139231][ T9800] bond6 (unregistering): Released all slaves [ 473.287872][T18100] __nla_validate_parse: 1 callbacks suppressed [ 473.287894][T18100] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3085'. [ 473.309875][ T9800] 9: left promiscuous mode [ 473.401705][T18026] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 473.461671][T18026] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 473.493583][T18026] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 473.506180][ T9800] tipc: Disabling bearer [ 473.514484][ T9800] tipc: Left network mode [ 473.520182][T18026] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 473.570285][T18104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3087'. [ 473.586844][T18106] netlink: 'syz.0.3086': attribute type 2 has an invalid length. [ 473.607719][T18106] netlink: 1696 bytes leftover after parsing attributes in process `syz.0.3086'. [ 473.759019][T18105] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.880904][T18105] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.975020][T18105] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.078673][T18105] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.314449][ T9797] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.347613][T18135] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 474.392179][T18137] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3094'. [ 474.408272][T18137] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3094'. [ 474.424217][T18137] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3094'. [ 474.441732][ T5831] Bluetooth: hci0: command tx timeout [ 474.452886][ T9797] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.469741][T18026] 8021q: adding VLAN 0 to HW filter on device bond0 [ 474.487851][T18138] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3093'. [ 474.500199][T18138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3093'. [ 474.562409][ T9798] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.716084][T18026] 8021q: adding VLAN 0 to HW filter on device team0 [ 474.817735][ T9798] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.831941][ T6605] bridge0: port 1(bridge_slave_0) entered blocking state [ 474.839186][ T6605] bridge0: port 1(bridge_slave_0) entered forwarding state [ 475.220423][ T9800] hsr_slave_0: left promiscuous mode [ 475.256681][ T9800] hsr_slave_1: left promiscuous mode [ 475.288040][ T9800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 475.310288][ T9800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 475.334989][ T9800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 475.350848][ T9800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 475.379648][ T9800] veth1_macvtap: left promiscuous mode [ 475.385592][ T9800] veth0_macvtap: left promiscuous mode [ 475.396893][ T9800] veth1_vlan: left promiscuous mode [ 475.402573][ T9800] veth0_vlan: left promiscuous mode [ 475.611719][ T9800] pimreg3 (unregistering): left allmulticast mode [ 475.813137][ T9800] team_slave_1 (unregistering): left promiscuous mode [ 475.821923][ T9800] ` (unregistering): Port device team_slave_1 removed [ 475.837916][ T9800] team_slave_0 (unregistering): left promiscuous mode [ 475.845377][ T9800] ` (unregistering): Port device team_slave_0 removed [ 475.938631][ T9800] dummy0 (unregistering): left promiscuous mode [ 475.953135][ T9800] ` (unregistering): Port device dummy0 removed [ 475.991457][T18150] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3098'. [ 476.039748][T18148] pim6reg: entered allmulticast mode [ 476.063510][ T6605] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.070790][ T6605] bridge0: port 2(bridge_slave_1) entered forwarding state [ 476.414330][T18165] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3102'. [ 476.482225][T18165] lo speed is unknown, defaulting to 1000 [ 476.506652][ T5831] Bluetooth: hci0: command tx timeout [ 476.535041][T18165] wg1 speed is unknown, defaulting to 1000 [ 476.640061][T18026] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 476.721292][ T9800] IPVS: stop unused estimator thread 0... [ 476.878726][T18190] netlink: 'syz.0.3106': attribute type 31 has an invalid length. [ 477.014342][T18195] Bluetooth: MGMT ver 1.23 [ 477.355262][T18209] FAULT_INJECTION: forcing a failure. [ 477.355262][T18209] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 477.379682][T18209] CPU: 0 UID: 0 PID: 18209 Comm: syz.2.3110 Not tainted syzkaller #0 PREEMPT(full) [ 477.379712][T18209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 477.379724][T18209] Call Trace: [ 477.379732][T18209] [ 477.379746][T18209] dump_stack_lvl+0xe8/0x150 [ 477.379779][T18209] should_fail_ex+0x412/0x560 [ 477.379809][T18209] _copy_from_user+0x2d/0xb0 [ 477.379838][T18209] ___sys_sendmsg+0x1c6/0x360 [ 477.379873][T18209] ? __pfx____sys_sendmsg+0x10/0x10 [ 477.379936][T18209] ? __fget_files+0x2a/0x420 [ 477.379957][T18209] ? __fget_files+0x3a0/0x420 [ 477.379989][T18209] __x64_sys_sendmsg+0x1bd/0x2a0 [ 477.380018][T18209] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 477.380056][T18209] ? __pfx_ksys_write+0x10/0x10 [ 477.380095][T18209] do_syscall_64+0xe2/0xf80 [ 477.380122][T18209] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.380140][T18209] ? trace_irq_disable+0x37/0x100 [ 477.380159][T18209] ? clear_bhb_loop+0x60/0xb0 [ 477.380182][T18209] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.380201][T18209] RIP: 0033:0x7f6386b9aeb9 [ 477.380219][T18209] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 477.380234][T18209] RSP: 002b:00007f6387979028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 477.380255][T18209] RAX: ffffffffffffffda RBX: 00007f6386e15fa0 RCX: 00007f6386b9aeb9 [ 477.380268][T18209] RDX: 0000000020000884 RSI: 00002000000012c0 RDI: 0000000000000006 [ 477.380279][T18209] RBP: 00007f6387979090 R08: 0000000000000000 R09: 0000000000000000 [ 477.380291][T18209] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 477.380302][T18209] R13: 00007f6386e16038 R14: 00007f6386e15fa0 R15: 00007ffff16bce18 [ 477.380334][T18209] [ 477.383000][T18026] veth0_vlan: entered promiscuous mode [ 477.594612][T18211] tipc: Started in network mode [ 477.618344][T18211] tipc: Node identity 0000000000002d210000000000000001, cluster identity 4711 [ 477.629271][T18211] tipc: Enabling of bearer rejected, failed to enable media [ 477.663782][T18026] veth1_vlan: entered promiscuous mode [ 477.835524][T18026] veth0_macvtap: entered promiscuous mode [ 477.852515][T18026] veth1_macvtap: entered promiscuous mode [ 477.915967][T18026] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 477.988722][T18026] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 478.023011][ T6605] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.045640][ T6605] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.098025][ T6605] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.176554][ T6605] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.630312][T17358] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 478.639744][T17358] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 478.648318][T17358] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 478.659848][T17358] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 478.678841][T17358] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 478.724677][T18239] lo speed is unknown, defaulting to 1000 [ 478.734189][T18239] wg1 speed is unknown, defaulting to 1000 [ 478.750940][T18241] lo speed is unknown, defaulting to 1000 [ 478.759347][T18241] wg1 speed is unknown, defaulting to 1000 [ 479.079274][T18239] chnl_net:caif_netlink_parms(): no params data found [ 479.235966][T18239] bridge0: port 1(bridge_slave_0) entered blocking state [ 479.244080][T18239] bridge0: port 1(bridge_slave_0) entered disabled state [ 479.253280][T18239] bridge_slave_0: entered allmulticast mode [ 479.261632][T18239] bridge_slave_0: entered promiscuous mode [ 479.271133][T18239] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.278538][T18239] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.285818][T18239] bridge_slave_1: entered allmulticast mode [ 479.318132][T18239] bridge_slave_1: entered promiscuous mode [ 479.468529][T18239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 479.489342][T18239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 479.524188][T18239] team0: Port device team_slave_0 added [ 479.534382][T18239] team0: Port device team_slave_1 added [ 479.564820][T18239] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 479.571994][T18239] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 479.599841][T18239] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 479.612441][T18239] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 479.619792][T18239] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 479.646887][T18239] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 479.690609][T18239] hsr_slave_0: entered promiscuous mode [ 479.697657][T18239] hsr_slave_1: entered promiscuous mode [ 479.703842][T18239] debugfs: 'hsr0' already exists in 'hsr' [ 479.709977][T18239] Cannot create hsr debugfs directory [ 480.725981][T18223] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 480.749384][ T5831] Bluetooth: hci1: command tx timeout [ 480.848345][T18239] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 480.883886][T18239] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 480.904710][T18239] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 480.943252][T18239] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 480.960651][ T6605] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.977891][ T6605] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 481.042953][T18259] __nla_validate_parse: 3 callbacks suppressed [ 481.042973][T18259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3123'. [ 481.115517][ T9798] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 481.116910][T18262] netlink: 'syz.2.3124': attribute type 3 has an invalid length. [ 481.136859][ T9798] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 481.173589][T18262] syz_tun: entered allmulticast mode [ 481.198311][T18262] siw: device registration error -23 [ 481.208686][T18269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3125'. [ 481.228767][T18261] syz_tun: left allmulticast mode [ 481.360286][T18239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 481.400995][T18275] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3066'. [ 481.428850][T18275] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3066'. [ 481.533196][T18239] 8021q: adding VLAN 0 to HW filter on device team0 [ 481.578555][ T9796] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.585763][ T9796] bridge0: port 1(bridge_slave_0) entered forwarding state [ 481.642437][ T9797] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.649669][ T9797] bridge0: port 2(bridge_slave_1) entered forwarding state [ 481.863772][T18288] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3125'. [ 481.902501][T18288] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3125'. [ 481.976930][T18288] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3125'. [ 482.128464][T18291] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.290162][T18291] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.328224][T18239] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 482.434715][T18291] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.618462][T18291] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.829452][ T5831] Bluetooth: hci1: command tx timeout [ 482.902358][ T9797] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.913942][ T9797] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.958282][ T9797] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.983689][ T4601] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.060567][T18239] veth0_vlan: entered promiscuous mode [ 483.091801][T18239] veth1_vlan: entered promiscuous mode [ 483.115729][T18316] Bluetooth: MGMT ver 1.23 [ 483.151185][T18239] veth0_macvtap: entered promiscuous mode [ 483.165535][T18239] veth1_macvtap: entered promiscuous mode [ 483.192081][T18318] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3133'. [ 483.202883][T18239] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 483.223818][T18318] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.232592][T18318] bridge0: port 1(bridge_slave_0) entered disabled state [ 483.258489][T18239] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 483.295004][ T9798] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.318728][ T9798] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.344688][ T9798] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.354581][ T9798] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.372733][T18327] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3133'. [ 483.414530][T18327] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.421904][T18327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 483.429533][T18327] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.436865][T18327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 483.452625][T18329] IPv6: NLM_F_CREATE should be specified when creating new route [ 483.454458][T18327] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3133'. [ 483.475730][T18327] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.483107][T18327] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.561581][T18337] bond1: invalid ARP target 0.0.0.0 specified for addition [ 484.570251][T18337] bond1: option arp_ip_target: invalid value (0) [ 484.578440][T18337] bond1 (unregistering): Released all slaves [ 484.765332][T18343] netlink: 'syz.1.3141': attribute type 10 has an invalid length. [ 484.779942][T18343] team0: Port device dummy0 added [ 484.793843][T18343] netlink: 'syz.1.3141': attribute type 10 has an invalid length. [ 484.807214][T18343] team0: Port device dummy0 removed [ 484.815307][T18343] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 484.908824][ T5831] Bluetooth: hci1: command tx timeout [ 485.271993][T18298] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 485.281857][T18354] netlink: 'syz.1.3143': attribute type 3 has an invalid length. [ 485.291890][T18354] netlink: 'syz.1.3143': attribute type 3 has an invalid length. [ 485.425664][ T9800] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 485.448243][ T9800] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 485.494804][T18361] netlink: 'syz.0.3145': attribute type 1 has an invalid length. [ 485.509054][ T9796] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 485.520931][ T9796] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 485.583682][T18361] 8021q: adding VLAN 0 to HW filter on device bond2 [ 485.655778][T18366] macvlan2: entered promiscuous mode [ 485.661404][T18366] macvlan2: entered allmulticast mode [ 485.668980][T18366] bond2: entered allmulticast mode [ 485.674239][T18366] bond2: entered promiscuous mode [ 485.697125][T18366] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 485.738544][T18366] team0: Port device macvlan2 added [ 485.771194][T18367] bond2: (slave ip6gretap1): making interface the new active one [ 485.780704][T18367] ip6gretap1: entered promiscuous mode [ 485.787391][T18367] ip6gretap1: entered allmulticast mode [ 485.798114][T18367] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 486.130067][T18383] __nla_validate_parse: 2 callbacks suppressed [ 486.130092][T18383] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3151'. [ 486.492185][T18400] syzkaller0: entered promiscuous mode [ 486.502490][T18400] syzkaller0: entered allmulticast mode [ 486.544342][T18400] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3156'. [ 486.790624][T18414] netlink: 'syz.4.3161': attribute type 1 has an invalid length. [ 486.798816][T18414] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3161'. [ 486.809931][T18414] syzkaller0: entered promiscuous mode [ 486.815549][T18414] syzkaller0: entered allmulticast mode [ 486.831236][T18414] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3161'. [ 486.987974][ T5831] Bluetooth: hci1: command tx timeout [ 487.228331][T18392] delete_channel: no stack [ 489.374099][T18391] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 489.540232][T18423] net_ratelimit: 16 callbacks suppressed [ 489.540254][T18423] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 489.660845][T18437] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3163'. [ 489.707793][T18435] vxcan3: entered promiscuous mode [ 489.784255][T18436] vxcan3: entered promiscuous mode [ 489.920172][T18443] netdevsim netdevsim0: Firmware load for './file0/../file0' refused, path contains '..' component [ 490.205114][T18447] netlink: 'syz.0.3169': attribute type 16 has an invalid length. [ 490.224425][T18447] netlink: 'syz.0.3169': attribute type 17 has an invalid length. [ 490.338604][T18447] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.372901][T18447] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.162482][T18466] FAULT_INJECTION: forcing a failure. [ 491.162482][T18466] name failslab, interval 1, probability 0, space 0, times 0 [ 491.175811][T18466] CPU: 0 UID: 0 PID: 18466 Comm: syz.0.3175 Not tainted syzkaller #0 PREEMPT(full) [ 491.175839][T18466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 491.175850][T18466] Call Trace: [ 491.175858][T18466] [ 491.175867][T18466] dump_stack_lvl+0xe8/0x150 [ 491.175896][T18466] should_fail_ex+0x412/0x560 [ 491.175926][T18466] should_failslab+0xa8/0x100 [ 491.175950][T18466] kmem_cache_alloc_noprof+0x87/0x6e0 [ 491.175981][T18466] ? skb_clone+0x212/0x3a0 [ 491.176014][T18466] skb_clone+0x212/0x3a0 [ 491.176045][T18466] __netlink_deliver_tap+0x404/0x850 [ 491.176081][T18466] ? netlink_deliver_tap+0x2e/0x1b0 [ 491.176105][T18466] netlink_deliver_tap+0x19c/0x1b0 [ 491.176127][T18466] netlink_sendskb+0x68/0x140 [ 491.176149][T18466] netlink_unicast+0x3a3/0x9b0 [ 491.176178][T18466] ? __pfx_netlink_unicast+0x10/0x10 [ 491.176209][T18466] netlink_rcv_skb+0x2b6/0x4b0 [ 491.176231][T18466] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 491.176261][T18466] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 491.176293][T18466] ? netlink_deliver_tap+0x2e/0x1b0 [ 491.176322][T18466] netlink_unicast+0x80f/0x9b0 [ 491.176350][T18466] ? __pfx_netlink_unicast+0x10/0x10 [ 491.176372][T18466] ? netlink_sendmsg+0x650/0xb40 [ 491.176392][T18466] ? skb_put+0x11b/0x210 [ 491.176420][T18466] netlink_sendmsg+0x813/0xb40 [ 491.176453][T18466] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.176478][T18466] ? aa_sock_msg_perm+0xf1/0x1b0 [ 491.176505][T18466] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 491.176536][T18466] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.176558][T18466] ____sys_sendmsg+0xa68/0xad0 [ 491.176584][T18466] ? __might_fault+0xaf/0x130 [ 491.176619][T18466] ? __pfx_____sys_sendmsg+0x10/0x10 [ 491.176656][T18466] ? import_iovec+0x73/0xa0 [ 491.176689][T18466] ___sys_sendmsg+0x2a5/0x360 [ 491.176714][T18466] ? __lock_acquire+0x6b5/0x2cf0 [ 491.176744][T18466] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.176811][T18466] ? __fget_files+0x2a/0x420 [ 491.176831][T18466] ? __fget_files+0x3a0/0x420 [ 491.176865][T18466] __x64_sys_sendmsg+0x1bd/0x2a0 [ 491.176895][T18466] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.176932][T18466] ? __pfx_ksys_write+0x10/0x10 [ 491.176974][T18466] do_syscall_64+0xe2/0xf80 [ 491.177000][T18466] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.177018][T18466] ? trace_irq_disable+0x37/0x100 [ 491.177036][T18466] ? clear_bhb_loop+0x60/0xb0 [ 491.177060][T18466] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.177079][T18466] RIP: 0033:0x7fce29f9aeb9 [ 491.177097][T18466] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.177114][T18466] RSP: 002b:00007fce281f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.177136][T18466] RAX: ffffffffffffffda RBX: 00007fce2a215fa0 RCX: 00007fce29f9aeb9 [ 491.177151][T18466] RDX: 0000000020000884 RSI: 00002000000012c0 RDI: 0000000000000006 [ 491.177164][T18466] RBP: 00007fce281f6090 R08: 0000000000000000 R09: 0000000000000000 [ 491.177176][T18466] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.177188][T18466] R13: 00007fce2a216038 R14: 00007fce2a215fa0 R15: 00007ffcb33f7c38 [ 491.177222][T18466] [ 491.820603][T18478] syzkaller0: entered promiscuous mode [ 491.830802][T18478] syzkaller0: entered allmulticast mode [ 491.848830][T18479] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3179'. [ 492.204571][T18491] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3182'. [ 492.270977][T18492] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3182'. [ 492.280532][T18492] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3182'. [ 492.546591][T18423] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 492.851152][T18502] FAULT_INJECTION: forcing a failure. [ 492.851152][T18502] name failslab, interval 1, probability 0, space 0, times 0 [ 492.867804][T18502] CPU: 0 UID: 0 PID: 18502 Comm: syz.1.3187 Not tainted syzkaller #0 PREEMPT(full) [ 492.867834][T18502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 492.867845][T18502] Call Trace: [ 492.867853][T18502] [ 492.867861][T18502] dump_stack_lvl+0xe8/0x150 [ 492.867891][T18502] should_fail_ex+0x412/0x560 [ 492.867922][T18502] should_failslab+0xa8/0x100 [ 492.867946][T18502] kmem_cache_alloc_noprof+0x87/0x6e0 [ 492.867976][T18502] ? skb_clone+0x212/0x3a0 [ 492.868006][T18502] skb_clone+0x212/0x3a0 [ 492.868036][T18502] __netlink_deliver_tap+0x404/0x850 [ 492.868069][T18502] ? netlink_deliver_tap+0x2e/0x1b0 [ 492.868093][T18502] netlink_deliver_tap+0x19c/0x1b0 [ 492.868114][T18502] netlink_sendskb+0x68/0x140 [ 492.868136][T18502] netlink_unicast+0x3a3/0x9b0 [ 492.868164][T18502] ? __pfx_netlink_unicast+0x10/0x10 [ 492.868196][T18502] netlink_rcv_skb+0x2b6/0x4b0 [ 492.868218][T18502] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 492.868245][T18502] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 492.868280][T18502] ? netlink_deliver_tap+0x2e/0x1b0 [ 492.868321][T18502] netlink_unicast+0x80f/0x9b0 [ 492.868351][T18502] ? __pfx_netlink_unicast+0x10/0x10 [ 492.868373][T18502] ? netlink_sendmsg+0x650/0xb40 [ 492.868393][T18502] ? skb_put+0x11b/0x210 [ 492.868420][T18502] netlink_sendmsg+0x813/0xb40 [ 492.868454][T18502] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.868480][T18502] ? aa_sock_msg_perm+0xf1/0x1b0 [ 492.868507][T18502] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 492.868530][T18502] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.868550][T18502] ____sys_sendmsg+0xa68/0xad0 [ 492.868576][T18502] ? __might_fault+0xaf/0x130 [ 492.868612][T18502] ? __pfx_____sys_sendmsg+0x10/0x10 [ 492.868648][T18502] ? import_iovec+0x73/0xa0 [ 492.868679][T18502] ___sys_sendmsg+0x2a5/0x360 [ 492.868704][T18502] ? __lock_acquire+0x6b5/0x2cf0 [ 492.868737][T18502] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.868801][T18502] ? __fget_files+0x2a/0x420 [ 492.868821][T18502] ? __fget_files+0x3a0/0x420 [ 492.868853][T18502] __x64_sys_sendmsg+0x1bd/0x2a0 [ 492.868880][T18502] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 492.868915][T18502] ? __pfx_ksys_write+0x10/0x10 [ 492.868954][T18502] do_syscall_64+0xe2/0xf80 [ 492.868978][T18502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.868995][T18502] ? trace_irq_disable+0x37/0x100 [ 492.869012][T18502] ? clear_bhb_loop+0x60/0xb0 [ 492.869035][T18502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.869053][T18502] RIP: 0033:0x7fc19539aeb9 [ 492.869071][T18502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.869087][T18502] RSP: 002b:00007fc196233028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.869108][T18502] RAX: ffffffffffffffda RBX: 00007fc195615fa0 RCX: 00007fc19539aeb9 [ 492.869122][T18502] RDX: 0000000020000884 RSI: 00002000000012c0 RDI: 0000000000000006 [ 492.869134][T18502] RBP: 00007fc196233090 R08: 0000000000000000 R09: 0000000000000000 [ 492.869145][T18502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.869157][T18502] R13: 00007fc195616038 R14: 00007fc195615fa0 R15: 00007fff97d5eb68 [ 492.869189][T18502] [ 493.197032][T18504] netlink: 'syz.5.3188': attribute type 5 has an invalid length. [ 493.216109][T18504] netlink: 'syz.5.3188': attribute type 10 has an invalid length. [ 493.751981][T18520] lo speed is unknown, defaulting to 1000 [ 493.781652][T18520] wg1 speed is unknown, defaulting to 1000 [ 493.799271][T18522] netlink: 'syz.4.3193': attribute type 1 has an invalid length. [ 493.878942][T18524] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3193'. [ 494.725378][T18540] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 494.738212][T18540] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 494.766714][T18540] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 494.795335][T18540] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 494.811337][T18540] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 495.207235][T18540] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.215225][T18540] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.777903][T18540] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 495.843723][T18540] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 496.097986][T18559] netlink: 'syz.0.3202': attribute type 39 has an invalid length. [ 496.493510][ T4601] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.514941][ T4601] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.537990][ T4601] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.574754][ T4601] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.712528][T17358] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 496.731180][T17358] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 496.742476][T17358] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 496.755559][T17358] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 496.763835][T17358] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 496.824255][T18573] lo speed is unknown, defaulting to 1000 [ 496.832277][T18573] wg1 speed is unknown, defaulting to 1000 [ 496.931520][T18579] __nla_validate_parse: 140 callbacks suppressed [ 496.931542][T18579] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3207'. [ 496.981271][T18579] netlink: 'syz.4.3207': attribute type 1 has an invalid length. [ 497.010909][T18579] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3207'. [ 497.033420][T18589] netlink: 'syz.5.3208': attribute type 1 has an invalid length. [ 497.045448][T18579] netlink: 658 bytes leftover after parsing attributes in process `syz.4.3207'. [ 497.067956][T18579] netlink: 'syz.4.3207': attribute type 1 has an invalid length. [ 497.717506][T18624] netlink: 'syz.1.3220': attribute type 3 has an invalid length. [ 497.750338][T18628] 8021q: VLANs not supported on wg0 [ 497.824874][T18627] lo speed is unknown, defaulting to 1000 [ 497.858188][T18627] wg1 speed is unknown, defaulting to 1000 [ 497.895608][T18573] chnl_net:caif_netlink_parms(): no params data found [ 498.269189][T18573] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.276984][T18573] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.284529][T18573] bridge_slave_0: entered allmulticast mode [ 498.293293][T18573] bridge_slave_0: entered promiscuous mode [ 498.318381][T18644] lo speed is unknown, defaulting to 1000 [ 498.344394][T18644] wg1 speed is unknown, defaulting to 1000 [ 498.551603][T18573] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.559381][T18660] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3228'. [ 498.577455][T18573] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.602648][T18573] bridge_slave_1: entered allmulticast mode [ 498.621005][T18573] bridge_slave_1: entered promiscuous mode [ 498.719925][T18573] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 498.725462][T18658] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3228'. [ 498.769086][T18573] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 498.798307][T18658] hsr_slave_0: left promiscuous mode [ 498.827934][T17358] Bluetooth: hci6: command tx timeout [ 498.973222][T18658] hsr_slave_1: left promiscuous mode [ 499.212289][T18573] team0: Port device team_slave_0 added [ 499.249338][T18573] team0: Port device team_slave_1 added [ 499.330627][T18677] syzkaller1: entered promiscuous mode [ 499.336661][T18677] syzkaller1: entered allmulticast mode [ 499.461256][T18573] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.485465][T18573] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.534117][T18573] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.564545][T18573] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.573935][T18573] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.600997][T18573] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 499.671705][T18686] netlink: 84 bytes leftover after parsing attributes in process `syz.5.3236'. [ 499.698045][T18686] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3236'. [ 499.723806][T11012] IPVS: starting estimator thread 0... [ 499.730240][T18686] IPVS: ip_vs_add_dest(): server weight less than zero [ 499.837111][T18688] IPVS: using max 25 ests per chain, 60000 per kthread [ 499.851534][T18573] hsr_slave_0: entered promiscuous mode [ 499.867320][T18573] hsr_slave_1: entered promiscuous mode [ 499.874064][T18573] debugfs: 'hsr0' already exists in 'hsr' [ 499.886700][T18573] Cannot create hsr debugfs directory [ 500.015689][T18699] xt_CONNSECMARK: invalid mode: 253 [ 500.077405][T18702] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 500.395918][T18714] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3243'. [ 500.419055][T18714] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3243'. [ 500.431379][T18714] openvswitch: netlink: Flow actions attr not present in new flow. [ 500.543830][T18719] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 500.555681][T18573] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 500.600552][T18718] lo speed is unknown, defaulting to 1000 [ 500.608430][T18718] wg1 speed is unknown, defaulting to 1000 [ 500.617573][T18573] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 500.649647][T18573] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 500.757020][T18573] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 500.907167][T17358] Bluetooth: hci6: command tx timeout [ 501.307857][T18758] bridge0: entered promiscuous mode [ 501.313576][T18758] macvtap1: entered promiscuous mode [ 501.320925][T18758] macvtap1: entered allmulticast mode [ 501.326816][T18758] bridge0: entered allmulticast mode [ 501.334444][T18758] bridge0: port 3(macvtap1) entered blocking state [ 501.361129][T18758] bridge0: port 3(macvtap1) entered disabled state [ 501.410092][T18758] bridge0: left allmulticast mode [ 501.426739][T18758] bridge0: left promiscuous mode [ 501.567524][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.576495][ T1303] clip:clip_start_xmit: skb_dst(skb) == NULL [ 501.577656][T18768] macsec1: entered promiscuous mode [ 501.589208][T18768] macsec1: entered allmulticast mode [ 501.611594][T18573] 8021q: adding VLAN 0 to HW filter on device bond0 [ 501.625180][T18768] x9: renamed from bridge_slave_0 [ 501.657454][T18573] 8021q: adding VLAN 0 to HW filter on device team0 [ 501.703431][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 501.710799][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 501.740393][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 501.747666][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 501.770818][T18775] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 501.797454][T18775] bridge1: entered allmulticast mode [ 502.189517][ T25] block nbd2: Possible stuck request ffff888025438000: control (read@0,1024B). Runtime 30 seconds [ 502.202982][ T25] block nbd2: Possible stuck request ffff888025438200: control (read@1024,1024B). Runtime 30 seconds [ 502.215290][ T25] block nbd2: Possible stuck request ffff888025438400: control (read@2048,1024B). Runtime 30 seconds [ 502.227016][ T25] block nbd2: Possible stuck request ffff888025438600: control (read@3072,1024B). Runtime 30 seconds [ 502.263413][T18573] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 502.784461][T18573] veth0_vlan: entered promiscuous mode [ 502.806338][T18573] veth1_vlan: entered promiscuous mode [ 502.884675][T18822] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3267'. [ 502.986685][T17358] Bluetooth: hci6: command tx timeout [ 503.014479][T18573] veth0_macvtap: entered promiscuous mode [ 503.029473][T18573] veth1_macvtap: entered promiscuous mode [ 503.082209][T18573] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 503.100376][T18825] tap0: tun_chr_ioctl cmd 2147767521 [ 503.123391][T18573] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 503.132670][T18825] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3268'. [ 503.146135][ T6563] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.163897][T18830] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3270'. [ 503.166968][ T6563] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.186644][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3268'. [ 503.198992][T18832] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3268'. [ 503.205077][ T6563] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.274622][ T6563] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.348027][ T9800] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.360277][ T9800] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.428453][ T9800] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.442132][ T9800] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.639872][T18844] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3273'. [ 503.813264][T18854] netlink: 'syz.1.3275': attribute type 7 has an invalid length. [ 503.908421][T18854] syzkaller0: entered promiscuous mode [ 503.913959][T18854] syzkaller0: entered allmulticast mode [ 503.927571][T18857] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3275'. [ 505.079920][T17358] Bluetooth: hci6: command tx timeout [ 506.951651][T18893] netlink: 16178 bytes leftover after parsing attributes in process `syz.5.3283'. [ 507.074486][T18892] vlan2: entered allmulticast mode [ 507.080071][T18892] veth0_to_bond: entered allmulticast mode [ 507.315339][T18906] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3285'. [ 507.401261][T18909] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3289'. [ 507.651709][T18932] x_tables: duplicate underflow at hook 3 [ 507.861466][T18939] bond0: (slave macvlan3): Error -98 calling set_mac_address [ 507.884879][T18943] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 507.985228][T18943] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 508.035235][T18947] pim6reg: entered allmulticast mode [ 508.046708][T18950] pim6reg: left allmulticast mode [ 508.429939][ T7384] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 509.079555][T19007] __nla_validate_parse: 4 callbacks suppressed [ 509.079571][T19007] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3314'. [ 509.477154][T10987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.187081][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.507956][T11002] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.143768][T18959] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 511.470692][T19017] 8021q: adding VLAN 0 to HW filter on device bond1 [ 511.508057][T19030] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3322'. [ 511.556869][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.566395][ T7384] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.578884][T19017] bridge0: port 3(macvlan2) entered blocking state [ 511.609056][T19017] bridge0: port 3(macvlan2) entered disabled state [ 511.626607][T19017] macvlan2: entered allmulticast mode [ 511.637555][T19017] macvlan2: entered promiscuous mode [ 511.775665][T19045] xt_TPROXY: Can be used only with -p tcp or -p udp [ 511.895947][T19054] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3329'. [ 512.100260][T19067] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 512.265927][T19079] netlink: 240 bytes leftover after parsing attributes in process `syz.6.3334'. [ 512.340648][T19066] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3334'. [ 512.588257][T11002] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.603527][T19101] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3341'. [ 512.639899][T19103] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3345'. [ 512.650755][T19102] lo speed is unknown, defaulting to 1000 [ 512.692979][T19102] wg1 speed is unknown, defaulting to 1000 [ 512.705904][T19107] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3345'. [ 513.226986][ T5884] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.470071][T19124] netlink: 5 bytes leftover after parsing attributes in process `syz.5.3351'. [ 513.505050][T19126] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.574799][T19124] syzkaller1: entered promiscuous mode [ 513.581313][T19124] syzkaller1: entered allmulticast mode [ 513.602354][T19124] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3351'. [ 513.632054][T10987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.779865][T10987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.071324][T19142] x_tables: duplicate underflow at hook 1 [ 514.400926][T19147] netlink: 'syz.4.3358': attribute type 10 has an invalid length. [ 514.453516][T19149] netlink: 'syz.4.3358': attribute type 10 has an invalid length. [ 514.513719][T19147] team0: Port device dummy0 added [ 514.591797][T19149] team0: Port device dummy0 removed [ 514.605767][T19149] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 514.670043][T19153] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.678819][T11012] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.688953][ T7384] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.697410][ T7384] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.705531][T19144] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.716841][T19144] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.725537][T19144] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.917673][T19160] netlink: 'syz.5.3360': attribute type 8 has an invalid length. [ 514.960388][T19164] netlink: 'syz.6.3362': attribute type 3 has an invalid length. [ 514.980830][T19164] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3362'. [ 515.003045][T19167] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3360'. [ 515.054892][T19167] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 515.207330][T19174] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3365'. [ 515.268277][T19172] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3366'. [ 515.306854][T19172] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3366'. [ 515.308075][T19180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3367'. [ 515.348333][T19183] IPVS: set_ctl: invalid protocol: 98 100.1.1.1:20002 [ 515.413782][T19188] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3369'. [ 515.458934][T19188] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3369'. [ 515.486435][T19188] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3369'. [ 515.749336][T19205] xfrm0: entered promiscuous mode [ 515.906460][T19208] netlink: 'syz.6.3375': attribute type 10 has an invalid length. [ 515.928996][T19209] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3375'. [ 515.975756][T19208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.067971][T19208] team0: Device bond0 failed to register rx_handler [ 516.279213][T19218] netlink: 'syz.0.3378': attribute type 21 has an invalid length. [ 516.316844][T19218] netlink: 'syz.0.3378': attribute type 21 has an invalid length. [ 516.429966][T19226] netlink: 'syz.6.3380': attribute type 1 has an invalid length. [ 516.442452][T19225] netlink: 'syz.6.3380': attribute type 1 has an invalid length. [ 516.525805][T19226] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.558705][T19226] bridge_slave_1: left allmulticast mode [ 516.606203][T19226] bridge_slave_1: left promiscuous mode [ 516.614542][T19226] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.678280][T19226] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 517.001976][T19251] 8021q: adding VLAN 0 to HW filter on device bond2 [ 517.024301][T19253] syzkaller0: entered promiscuous mode [ 517.033275][T19253] syzkaller0: entered allmulticast mode [ 517.149684][T19260] bond2: (slave ip6gretap1): making interface the new active one [ 517.227870][T19260] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 517.721045][T19276] lo speed is unknown, defaulting to 1000 [ 517.732980][T19284] netlink: 'syz.6.3392': attribute type 1 has an invalid length. [ 517.738152][T19276] wg1 speed is unknown, defaulting to 1000 [ 517.763964][T19284] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 519.854092][T19371] lo speed is unknown, defaulting to 1000 [ 519.920201][T19371] wg1 speed is unknown, defaulting to 1000 [ 519.999649][T19388] __nla_validate_parse: 16 callbacks suppressed [ 519.999673][T19388] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3420'. [ 520.425445][T19404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3424'. [ 520.432430][T19407] SET target dimension over the limit! [ 520.451992][T19406] SET target dimension over the limit! [ 521.747681][T19466] syzkaller1: entered promiscuous mode [ 521.784029][T19466] syzkaller1: entered allmulticast mode [ 521.943985][T19472] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 521.956479][T19472] bridge1: entered allmulticast mode [ 521.965362][T19475] xt_ecn: cannot match TCP bits for non-tcp packets [ 522.013899][T19476] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.098611][T19476] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.194922][T19476] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.271535][T19476] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.442001][T19490] syzkaller0: entered promiscuous mode [ 522.448309][T19490] syzkaller0: entered allmulticast mode [ 522.458915][T19498] lo: entered allmulticast mode [ 524.270920][T19506] bridge2: entered promiscuous mode [ 524.282814][T19511] sysfs: cannot create duplicate filename '/class/ieee80211/π,xb)% ]3DL̥!!b.>nS#^' [ 524.296508][T19511] CPU: 0 UID: 0 PID: 19511 Comm: syz.1.3453 Not tainted syzkaller #0 PREEMPT(full) [ 524.296538][T19511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 524.296550][T19511] Call Trace: [ 524.296559][T19511] [ 524.296567][T19511] dump_stack_lvl+0xe8/0x150 [ 524.296601][T19511] sysfs_warn_dup+0x8e/0xa0 [ 524.296631][T19511] sysfs_do_create_link_sd+0xc0/0x110 [ 524.296661][T19511] device_add_class_symlinks+0x1cf/0x240 [ 524.296687][T19511] device_add+0x475/0xb70 [ 524.296711][T19511] wiphy_register+0x1d73/0x2d50 [ 524.296752][T19511] ? __pfx_wiphy_register+0x10/0x10 [ 524.296776][T19511] ? __pfx_netdev_run_todo+0x10/0x10 [ 524.296802][T19511] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 524.296831][T19511] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 524.296857][T19511] ieee80211_register_hw+0x3571/0x4220 [ 524.296868][T19511] ? __lock_acquire+0x6b5/0x2cf0 [ 524.296892][T19511] ? ieee80211_register_hw+0x1431/0x4220 [ 524.296908][T19511] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 524.296930][T19511] ? __hrtimer_setup+0x181/0x200 [ 524.296941][T19511] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 524.296960][T19511] mac80211_hwsim_new_radio+0x2f97/0x5330 [ 524.296995][T19511] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 524.297009][T19511] ? kstrndup+0xbf/0x160 [ 524.297030][T19511] hwsim_new_radio_nl+0xf35/0x1bd0 [ 524.297060][T19511] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 524.297087][T19511] ? rcu_is_watching+0x15/0xb0 [ 524.297103][T19511] ? __nla_parse+0x40/0x60 [ 524.297121][T19511] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 524.297143][T19511] genl_family_rcv_msg_doit+0x22a/0x330 [ 524.297164][T19511] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 524.297188][T19511] ? bpf_lsm_capable+0x9/0x20 [ 524.297203][T19511] ? security_capable+0x7e/0x2c0 [ 524.297220][T19511] genl_rcv_msg+0x61c/0x7a0 [ 524.297246][T19511] ? __pfx_genl_rcv_msg+0x10/0x10 [ 524.297262][T19511] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 524.297285][T19511] netlink_rcv_skb+0x232/0x4b0 [ 524.297299][T19511] ? __pfx_genl_rcv_msg+0x10/0x10 [ 524.297315][T19511] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 524.297327][T19511] ? genl_rcv+0x19/0x40 [ 524.297362][T19511] ? down_read+0x272/0x2e0 [ 524.297372][T19511] ? genl_rcv+0xd/0x40 [ 524.297388][T19511] genl_rcv+0x28/0x40 [ 524.297404][T19511] netlink_unicast+0x80f/0x9b0 [ 524.297421][T19511] ? __pfx_netlink_unicast+0x10/0x10 [ 524.297434][T19511] ? netlink_sendmsg+0x650/0xb40 [ 524.297447][T19511] ? skb_put+0x11b/0x210 [ 524.297464][T19511] netlink_sendmsg+0x813/0xb40 [ 524.297483][T19511] ? __pfx_netlink_sendmsg+0x10/0x10 [ 524.297499][T19511] ? aa_sock_msg_perm+0xf1/0x1b0 [ 524.297514][T19511] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 524.297528][T19511] ? __pfx_netlink_sendmsg+0x10/0x10 [ 524.297541][T19511] ____sys_sendmsg+0xa68/0xad0 [ 524.297556][T19511] ? __might_fault+0xaf/0x130 [ 524.297577][T19511] ? __pfx_____sys_sendmsg+0x10/0x10 [ 524.297599][T19511] ? import_iovec+0x73/0xa0 [ 524.297618][T19511] ___sys_sendmsg+0x2a5/0x360 [ 524.297633][T19511] ? __lock_acquire+0x6b5/0x2cf0 [ 524.297652][T19511] ? __pfx____sys_sendmsg+0x10/0x10 [ 524.297672][T19511] ? futex_wait+0x29a/0x380 [ 524.297701][T19511] ? __fget_files+0x2a/0x420 [ 524.297713][T19511] ? __fget_files+0x3a0/0x420 [ 524.297732][T19511] __x64_sys_sendmsg+0x1bd/0x2a0 [ 524.297751][T19511] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 524.297773][T19511] ? rcu_is_watching+0x15/0xb0 [ 524.297792][T19511] do_syscall_64+0xe2/0xf80 [ 524.297807][T19511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.297818][T19511] ? trace_irq_disable+0x37/0x100 [ 524.297828][T19511] ? clear_bhb_loop+0x60/0xb0 [ 524.297842][T19511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.297853][T19511] RIP: 0033:0x7fc19539aeb9 [ 524.297865][T19511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.297876][T19511] RSP: 002b:00007fc196233028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 524.297891][T19511] RAX: ffffffffffffffda RBX: 00007fc195615fa0 RCX: 00007fc19539aeb9 [ 524.297899][T19511] RDX: 000000000004c304 RSI: 0000200000000040 RDI: 0000000000000004 [ 524.297907][T19511] RBP: 00007fc195408c1f R08: 0000000000000000 R09: 0000000000000000 [ 524.297915][T19511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 524.297922][T19511] R13: 00007fc195616038 R14: 00007fc195615fa0 R15: 00007fff97d5eb68 [ 524.297943][T19511] [ 524.791999][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.932543][ T12] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.960294][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.981417][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.090252][T19524] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3455'. [ 525.141485][T19529] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3459'. [ 525.172624][T19530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3459'. [ 525.180737][T19532] geneve2: entered promiscuous mode [ 525.446360][T19547] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3465'. [ 525.463596][T19547] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3465'. [ 525.562180][T19551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3467'. [ 525.574159][T19548] vlan4: entered promiscuous mode [ 525.574910][T19551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3467'. [ 525.583302][T19548] geneve1: entered promiscuous mode [ 525.598304][T19548] vlan4: entered allmulticast mode [ 525.648054][T19548] geneve1: entered allmulticast mode [ 525.721214][T19554] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3469'. [ 525.732409][T19554] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3469'. [ 525.830428][T19556] lo speed is unknown, defaulting to 1000 [ 525.838859][T19556] wg1 speed is unknown, defaulting to 1000 [ 526.212766][T19578] validate_nla: 1 callbacks suppressed [ 526.212786][T19578] netlink: 'syz.6.3473': attribute type 9 has an invalid length. [ 526.456927][T19572] can: request_module (can-proto-0) failed. [ 526.690322][T19585] ieee802154 phy0 wpan0: encryption failed: -22 [ 526.959573][T19591] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3478'. [ 527.189322][T19588] syzkaller0: entered promiscuous mode [ 527.195209][T19588] syzkaller0: entered allmulticast mode [ 527.461702][T19603] xfrm0: entered promiscuous mode [ 528.495077][T19632] syzkaller0: entered promiscuous mode [ 528.550490][T19632] syzkaller0: entered allmulticast mode [ 528.971630][T19655] xt_hashlimit: size too large, truncated to 1048576 [ 529.166469][T19667] netlink: 'syz.0.3501': attribute type 4 has an invalid length. [ 529.167762][T19663] bridge_slave_0 (unregistering): left allmulticast mode [ 529.238617][T19663] bridge_slave_0 (unregistering): left promiscuous mode [ 529.250586][T19663] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.588755][T19675] net_ratelimit: 2 callbacks suppressed [ 529.588778][T19675] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 529.774773][T19688] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvtap0, syncid = 2, id = 0 [ 529.832483][T19692] batadv_slave_0: entered promiscuous mode [ 529.904810][T19692] batadv1: entered promiscuous mode [ 530.102853][T19708] sctp: [Deprecated]: syz.5.3511 (pid 19708) Use of int in maxseg socket option. [ 530.102853][T19708] Use struct sctp_assoc_value instead [ 530.130770][T19691] batadv_slave_0: left promiscuous mode [ 530.422806][T19725] __nla_validate_parse: 13 callbacks suppressed [ 530.422827][T19725] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3520'. [ 530.489301][T19726] tipc: Enabling of bearer rejected, failed to enable media [ 530.511556][T19726] sctp: [Deprecated]: syz.0.3521 (pid 19726) Use of struct sctp_assoc_value in delayed_ack socket option. [ 530.511556][T19726] Use struct sctp_sack_info instead [ 530.871130][T19747] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 530.910357][T19749] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 531.011767][T19759] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3530'. [ 531.024755][T19747] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3528'. [ 531.160263][T19764] macsec1: entered promiscuous mode [ 531.165719][T19764] macsec1: entered allmulticast mode [ 531.259229][T19773] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 531.292774][T19773] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3537'. [ 531.400528][T19781] netlink: 'syz.6.3539': attribute type 21 has an invalid length. [ 531.541940][T19781] netlink: 132 bytes leftover after parsing attributes in process `syz.6.3539'. [ 531.931791][T19797] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 532.048050][T19798] netlink: 296 bytes leftover after parsing attributes in process `syz.1.3541'. [ 532.270648][ T25] block nbd2: Possible stuck request ffff888025438000: control (read@0,1024B). Runtime 60 seconds [ 532.283076][ T25] block nbd2: Possible stuck request ffff888025438200: control (read@1024,1024B). Runtime 60 seconds [ 532.296174][ T25] block nbd2: Possible stuck request ffff888025438400: control (read@2048,1024B). Runtime 60 seconds [ 532.308640][ T25] block nbd2: Possible stuck request ffff888025438600: control (read@3072,1024B). Runtime 60 seconds [ 532.396021][T19790] lo speed is unknown, defaulting to 1000 [ 532.403663][T19790] wg1 speed is unknown, defaulting to 1000 [ 532.520603][T19815] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 532.792251][T19826] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 533.614827][T19844] netlink: 'syz.0.3553': attribute type 21 has an invalid length. [ 534.176407][T19844] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3553'. [ 534.400623][T19863] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3556'. [ 534.554759][T19868] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.3557'. [ 534.691027][T19873] netlink: 76 bytes leftover after parsing attributes in process `syz.5.3559'. [ 534.929737][T19871] af_packet: tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 535.311201][T19886] IPVS: stopping backup sync thread 19688 ... [ 535.373729][T19889] sit0: entered promiscuous mode [ 535.403703][T19893] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 535.432033][T19893] netlink: 'syz.1.3561': attribute type 6 has an invalid length. [ 535.545428][T19898] netlink: 'syz.5.3567': attribute type 21 has an invalid length. [ 535.892302][T19889] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 535.999318][T19898] __nla_validate_parse: 3 callbacks suppressed [ 535.999333][T19898] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3567'. [ 536.016968][T19906] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3568'. [ 536.060673][ T6603] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.090303][ T6603] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.118446][T19908] tipc: Started in network mode [ 536.123372][T19908] tipc: Node identity 620321fd07db, cluster identity 4711 [ 536.150620][T19911] ip6t_REJECT: ECHOREPLY is not supported [ 536.159537][T19908] tipc: Enabled bearer , priority 0 [ 536.172290][ T6603] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.206889][ T6603] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.227150][T19909] syzkaller0: entered promiscuous mode [ 536.232680][T19909] syzkaller0: entered allmulticast mode [ 536.251185][T19908] netlink: 192 bytes leftover after parsing attributes in process `syz.6.3569'. [ 536.306178][T19908] netlink: 44 bytes leftover after parsing attributes in process `syz.6.3569'. [ 536.320195][T19915] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3572'. [ 536.333250][T19908] tipc: Resetting bearer [ 536.446928][T19907] tipc: Resetting bearer [ 536.486073][T19907] tipc: Disabling bearer [ 536.548253][T10987] IPVS: starting estimator thread 0... [ 536.666783][T19935] IPVS: using max 31 ests per chain, 74400 per kthread [ 536.842627][T19942] syzkaller1: entered promiscuous mode [ 536.865985][T19942] syzkaller1: entered allmulticast mode [ 537.092768][T19952] netlink: 'syz.1.3582': attribute type 21 has an invalid length. [ 537.137311][T19952] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3582'. [ 537.930044][T19977] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3586'. [ 538.013863][T19979] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3587'. [ 538.027733][T19979] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3587'. [ 538.179956][T19977] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.420482][T19977] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.527960][T19958] netlink: 'syz.6.3583': attribute type 1 has an invalid length. [ 538.604485][T19961] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3583'. [ 538.653896][T19977] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.744871][T19958] 8021q: adding VLAN 0 to HW filter on device bond2 [ 538.984753][T19977] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.045803][T20001] bridge0: entered allmulticast mode [ 539.057824][T20005] netlink: 'syz.5.3596': attribute type 21 has an invalid length. [ 539.351726][T20009] bridge_slave_1: left allmulticast mode [ 539.374351][T20009] bridge_slave_1: left promiscuous mode [ 539.406635][T20009] bridge0: port 2(bridge_slave_1) entered disabled state [ 539.467977][T20009] bridge_slave_0: left allmulticast mode [ 539.473766][T20009] bridge_slave_0: left promiscuous mode [ 539.488197][T20009] bridge0: port 1(bridge_slave_0) entered disabled state [ 539.757327][ T6563] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.843171][ T12] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.857917][ T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.904839][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.073794][T20030] lo speed is unknown, defaulting to 1000 [ 540.119014][T20030] wg1 speed is unknown, defaulting to 1000 [ 540.206559][T20042] x_tables: unsorted entry at hook 1 [ 540.659488][T20052] sctp: [Deprecated]: syz.1.3605 (pid 20052) Use of int in max_burst socket option deprecated. [ 540.659488][T20052] Use struct sctp_assoc_value instead [ 540.795444][T20067] netlink: 'syz.4.3611': attribute type 1 has an invalid length. [ 540.894168][T20067] 8021q: adding VLAN 0 to HW filter on device bond3 [ 540.931872][T20062] syzkaller0: entered promiscuous mode [ 540.947403][T20062] syzkaller0: entered allmulticast mode [ 540.963694][T20074] bond3: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 541.000738][T20062] netlink: 'syz.5.3610': attribute type 6 has an invalid length. [ 541.008977][T20062] netlink: 'syz.5.3610': attribute type 7 has an invalid length. [ 541.044012][T20062] netlink: 'syz.5.3610': attribute type 8 has an invalid length. [ 541.071022][T20062] netlink: 'syz.5.3610': attribute type 13 has an invalid length. [ 541.633987][T20099] __nla_validate_parse: 7 callbacks suppressed [ 541.634008][T20099] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3618'. [ 541.940414][ T6603] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.952764][ T6603] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.968834][T20103] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3619'. [ 541.980323][T20103] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3619'. [ 542.059078][T20103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 542.142494][T20111] bond1: entered promiscuous mode [ 542.170893][T20111] vcan0: entered promiscuous mode [ 542.175977][T20111] vcan0: entered allmulticast mode [ 542.181864][T20111] bond1: (slave vcan0): The slave device specified does not support setting the MAC address [ 542.193211][T20111] bond1: (slave vcan0): Error -95 calling set_mac_address [ 542.496110][T20121] netlink: 'syz.4.3628': attribute type 21 has an invalid length. [ 542.505980][T20121] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3628'. [ 542.877990][T20133] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3630'. [ 543.497943][T20139] netlink: 'syz.4.3633': attribute type 4 has an invalid length. [ 545.240563][T20196] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3648'. [ 545.368055][T20199] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3649'. [ 545.403220][T20198] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3649'. [ 545.847316][T20221] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 546.186086][T20239] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3662'. [ 546.201437][T17358] Bluetooth: hci6: link tx timeout [ 546.208221][T17358] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 546.220924][ T5831] Bluetooth: hci6: link tx timeout [ 546.226097][ T5831] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 546.235004][ T5831] Bluetooth: hci6: link tx timeout [ 546.242462][ T5831] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 546.250518][ T5831] Bluetooth: hci6: link tx timeout [ 546.255666][ T5831] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 546.448552][T20249] openvswitch: netlink: Key type 195 is out of range max 32 [ 546.467882][T20251] openvswitch: netlink: Key type 195 is out of range max 32 [ 546.594088][T20249] bond3: option lacp_active: invalid value (8) [ 546.606218][T20259] netlink: 'syz.4.3669': attribute type 1 has an invalid length. [ 546.619157][T20249] bond3 (unregistering): Released all slaves [ 547.602813][T20297] netlink: 'syz.1.3679': attribute type 10 has an invalid length. [ 547.621019][T20297] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3679'. [ 547.652367][T20300] netlink: 'syz.0.3681': attribute type 15 has an invalid length. [ 548.128821][T20322] syzkaller0: entered promiscuous mode [ 548.134358][T20322] syzkaller0: entered allmulticast mode [ 548.244554][T20322] tipc: Started in network mode [ 548.249579][T20322] tipc: Node identity def869187ab9, cluster identity 4711 [ 548.258399][T20322] tipc: Enabled bearer , priority 0 [ 548.266596][ T5831] Bluetooth: hci6: command 0x0406 tx timeout [ 548.320251][T20321] tipc: Resetting bearer [ 548.343670][T20321] tipc: Disabling bearer [ 548.359574][T20329] syzkaller1: entered promiscuous mode [ 548.365097][T20329] syzkaller1: entered allmulticast mode [ 548.595985][T20347] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3692'. [ 548.638099][T20348] netlink: 'syz.1.3693': attribute type 5 has an invalid length. [ 549.261539][T20347] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 549.299079][T20352] netlink: 236 bytes leftover after parsing attributes in process `syz.5.3694'. [ 549.985262][T20378] geneve2: entered allmulticast mode [ 550.046302][T20358] syzkaller0: entered promiscuous mode [ 550.052025][T20358] syzkaller0: entered allmulticast mode [ 550.071974][T20356] macsec1: entered allmulticast mode [ 550.078313][T20356] macsec0: entered allmulticast mode [ 550.116071][T20389] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3700'. [ 550.384740][T20408] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3705'. [ 550.486409][T20412] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3705'. [ 550.539354][T20417] netlink: 52 bytes leftover after parsing attributes in process `syz.6.3706'. [ 552.472594][T20429] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3710'. [ 552.472594][T20430] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3710'. [ 552.497644][T20432] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3711'. [ 552.682623][T20450] FAULT_INJECTION: forcing a failure. [ 552.682623][T20450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 552.712165][T20450] CPU: 0 UID: 0 PID: 20450 Comm: syz.1.3716 Not tainted syzkaller #0 PREEMPT(full) [ 552.712193][T20450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 552.712204][T20450] Call Trace: [ 552.712212][T20450] [ 552.712227][T20450] dump_stack_lvl+0xe8/0x150 [ 552.712260][T20450] should_fail_ex+0x412/0x560 [ 552.712291][T20450] _copy_to_user+0x31/0xb0 [ 552.712324][T20450] simple_read_from_buffer+0xe1/0x170 [ 552.712352][T20450] proc_fail_nth_read+0x1bb/0x230 [ 552.712385][T20450] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 552.712417][T20450] ? rw_verify_area+0x2a6/0x4d0 [ 552.712444][T20450] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 552.712475][T20450] vfs_read+0x20c/0xa70 [ 552.712501][T20450] ? fdget_pos+0x246/0x320 [ 552.712530][T20450] ? __pfx___mutex_lock+0x10/0x10 [ 552.712559][T20450] ? __pfx_vfs_read+0x10/0x10 [ 552.712589][T20450] ? __fget_files+0x2a/0x420 [ 552.712617][T20450] ? __fget_files+0x3a0/0x420 [ 552.712637][T20450] ? __fget_files+0x2a/0x420 [ 552.712669][T20450] ksys_read+0x150/0x270 [ 552.712700][T20450] ? __pfx_ksys_read+0x10/0x10 [ 552.712742][T20450] do_syscall_64+0xe2/0xf80 [ 552.712770][T20450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.712789][T20450] ? trace_irq_disable+0x37/0x100 [ 552.712808][T20450] ? clear_bhb_loop+0x60/0xb0 [ 552.712833][T20450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.712852][T20450] RIP: 0033:0x7fc19535b78e [ 552.712868][T20450] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 552.712884][T20450] RSP: 002b:00007fc196232fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 552.712905][T20450] RAX: ffffffffffffffda RBX: 00007fc1962336c0 RCX: 00007fc19535b78e [ 552.712919][T20450] RDX: 000000000000000f RSI: 00007fc1962330a0 RDI: 0000000000000004 [ 552.712932][T20450] RBP: 00007fc196233090 R08: 0000000000000000 R09: 0000000000000000 [ 552.712945][T20450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.712957][T20450] R13: 00007fc195616038 R14: 00007fc195615fa0 R15: 00007fff97d5eb68 [ 552.712993][T20450] [ 553.006156][T20455] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3718'. [ 553.032059][T20455] bridge1: port 1(veth0_to_bond) entered blocking state [ 553.040094][T20455] bridge1: port 1(veth0_to_bond) entered disabled state [ 553.050834][T20455] veth0_to_bond: entered promiscuous mode [ 553.459958][T20469] lo speed is unknown, defaulting to 1000 [ 553.523180][T20469] wg1 speed is unknown, defaulting to 1000 [ 553.695235][T20490] netlink: 'syz.0.3727': attribute type 2 has an invalid length. [ 554.378344][T20521] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.454582][T20521] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 554.469590][T20521] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 554.480870][T20521] xfrm0: left promiscuous mode [ 554.487013][T20527] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3735'. [ 554.619951][T20521] bridge1: left allmulticast mode [ 554.625513][T20521] bridge2: left promiscuous mode [ 554.632659][T20521] geneve2: left promiscuous mode [ 554.638558][T20521] macsec1: left promiscuous mode [ 554.643558][T20521] macsec1: left allmulticast mode [ 554.682590][ T9799] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.700645][ T9799] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.713136][ T9799] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.722829][ T9799] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.828604][T20533] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3737'. [ 555.269096][T20542] netlink: 'syz.0.3742': attribute type 2 has an invalid length. [ 555.407549][T20557] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3743'. [ 555.445545][T20557] x_tables: duplicate underflow at hook 1 [ 555.493357][T20563] netlink: 'syz.0.3745': attribute type 21 has an invalid length. [ 555.505170][T20563] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3745'. [ 555.544390][T20563] FAULT_INJECTION: forcing a failure. [ 555.544390][T20563] name failslab, interval 1, probability 0, space 0, times 0 [ 555.610695][T20563] CPU: 1 UID: 0 PID: 20563 Comm: syz.0.3745 Not tainted syzkaller #0 PREEMPT(full) [ 555.610726][T20563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 555.610738][T20563] Call Trace: [ 555.610746][T20563] [ 555.610755][T20563] dump_stack_lvl+0xe8/0x150 [ 555.610795][T20563] should_fail_ex+0x412/0x560 [ 555.610826][T20563] should_failslab+0xa8/0x100 [ 555.610851][T20563] __kmalloc_noprof+0xde/0x7e0 [ 555.610868][T20563] ? kfree+0x4d/0x650 [ 555.610892][T20563] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 555.610926][T20563] tomoyo_realpath_from_path+0xe3/0x5d0 [ 555.610955][T20563] ? tomoyo_domain+0xd7/0x130 [ 555.610989][T20563] ? tomoyo_path_number_perm+0x219/0x630 [ 555.611011][T20563] tomoyo_path_number_perm+0x246/0x630 [ 555.611036][T20563] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 555.611056][T20563] ? __lock_acquire+0x6b5/0x2cf0 [ 555.611101][T20563] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 555.611162][T20563] ? __fget_files+0x2a/0x420 [ 555.611187][T20563] ? __fget_files+0x2a/0x420 [ 555.611208][T20563] ? __fget_files+0x3a0/0x420 [ 555.611227][T20563] ? __fget_files+0x2a/0x420 [ 555.611253][T20563] security_file_ioctl+0xc3/0x2a0 [ 555.611277][T20563] __se_sys_ioctl+0x47/0x170 [ 555.611307][T20563] do_syscall_64+0xe2/0xf80 [ 555.611333][T20563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.611352][T20563] ? trace_irq_disable+0x37/0x100 [ 555.611368][T20563] ? clear_bhb_loop+0x60/0xb0 [ 555.611391][T20563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.611409][T20563] RIP: 0033:0x7fce29f9aeb9 [ 555.611427][T20563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.611443][T20563] RSP: 002b:00007fce281d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 555.611466][T20563] RAX: ffffffffffffffda RBX: 00007fce2a216090 RCX: 00007fce29f9aeb9 [ 555.611480][T20563] RDX: 00002000000000c0 RSI: 000000000000890c RDI: 0000000000000008 [ 555.611492][T20563] RBP: 00007fce281d5090 R08: 0000000000000000 R09: 0000000000000000 [ 555.611503][T20563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.611515][T20563] R13: 00007fce2a216128 R14: 00007fce2a216090 R15: 00007ffcb33f7c38 [ 555.611549][T20563] [ 555.611587][T20563] ERROR: Out of memory at tomoyo_realpath_from_path. [ 556.199325][T20581] vlan2: entered allmulticast mode [ 556.240855][T20581] veth0_to_bond: entered allmulticast mode [ 556.277427][T20581] team0: Port device vlan2 added [ 557.764722][T20636] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3768'. [ 557.766421][T20641] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.3770'. [ 557.775929][T20636] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3768'. [ 557.792569][T20641] openvswitch: netlink: EtherType 0 is less than min 600 [ 557.814304][T20636] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3768'. [ 557.826445][T20641] sctp: [Deprecated]: syz.4.3770 (pid 20641) Use of struct sctp_assoc_value in delayed_ack socket option. [ 557.826445][T20641] Use struct sctp_sack_info instead [ 557.983774][T20652] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3774'. [ 558.487576][T20680] bond3: option tlb_dynamic_lb: invalid value (5) [ 558.509218][T20680] bond3 (unregistering): Released all slaves [ 558.540766][T20692] netlink: 1004 bytes leftover after parsing attributes in process `syz.4.3786'. [ 558.583899][T20692] netlink: 'syz.4.3786': attribute type 7 has an invalid length. [ 558.593744][T20692] netlink: 'syz.4.3786': attribute type 8 has an invalid length. [ 558.789013][T20704] tipc: Enabled bearer , priority 0 [ 558.914503][T20697] tipc: Disabling bearer [ 559.008004][T20714] tipc: Started in network mode [ 559.013618][T20714] tipc: Node identity 0e975fe58a8e, cluster identity 4711 [ 559.021608][T20714] tipc: Enabled bearer , priority 0 [ 559.029079][T20719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3795'. [ 559.040505][T20714] syzkaller0: entered promiscuous mode [ 559.046106][T20714] syzkaller0: entered allmulticast mode [ 559.053687][T20704] lo speed is unknown, defaulting to 1000 [ 559.061644][T20704] wg1 speed is unknown, defaulting to 1000 [ 559.062375][T20721] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3796'. [ 559.080625][T20721] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3796'. [ 559.093481][T20721] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3796'. [ 559.099043][T20719] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3795'. [ 559.109140][T20721] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3796'. [ 559.112611][T20719] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3795'. [ 559.125267][T20721] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3796'. [ 559.164342][T20721] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3796'. [ 559.216417][T20717] tipc: Resetting bearer [ 559.288093][T20717] tipc: Disabling bearer [ 559.678375][T20749] lo speed is unknown, defaulting to 1000 [ 559.697307][T20749] wg1 speed is unknown, defaulting to 1000 [ 559.718768][T20753] lo speed is unknown, defaulting to 1000 [ 559.741185][T20753] wg1 speed is unknown, defaulting to 1000 [ 559.769695][T20754] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 560.234801][T20761] openvswitch: netlink: Unexpected mask (mask=201040, allowed=10048) [ 561.560368][T20780] netlink: 'syz.6.3809': attribute type 21 has an invalid length. [ 561.997512][T20801] openvswitch: netlink: Missing key (keys=40, expected=100) [ 562.240902][T20811] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 562.356963][T20732] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 562.391617][ T25] block nbd2: Possible stuck request ffff888025438000: control (read@0,1024B). Runtime 90 seconds [ 562.402720][ T25] block nbd2: Possible stuck request ffff888025438200: control (read@1024,1024B). Runtime 90 seconds [ 562.416324][ T25] block nbd2: Possible stuck request ffff888025438400: control (read@2048,1024B). Runtime 90 seconds [ 562.427763][ T25] block nbd2: Possible stuck request ffff888025438600: control (read@3072,1024B). Runtime 90 seconds [ 562.478174][T20743] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 562.752267][T20836] bond3: option arp_interval: invalid value (18446744073709551615) [ 562.762673][T20836] bond3: option arp_interval: allowed values 0 - 2147483647 [ 562.821238][T20836] bond3 (unregistering): Released all slaves [ 562.997963][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 563.007664][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.017393][ T1303] clip:clip_start_xmit: skb_dst(skb) == NULL [ 563.057666][T20849] lo speed is unknown, defaulting to 1000 [ 563.074504][T20849] wg1 speed is unknown, defaulting to 1000 [ 563.314584][T20867] netlink: 'syz.6.3831': attribute type 21 has an invalid length. [ 563.515832][T20873] netlink: 'syz.6.3835': attribute type 13 has an invalid length. [ 564.076600][T20836] syzkaller0: entered promiscuous mode [ 564.092161][T20836] syzkaller0: entered allmulticast mode [ 566.456469][T20932] pim6reg1: entered promiscuous mode [ 566.472252][T20932] pim6reg1: entered allmulticast mode [ 566.904096][T20946] lo speed is unknown, defaulting to 1000 [ 566.925312][T20951] netlink: 'syz.5.3854': attribute type 7 has an invalid length. [ 566.968425][T20951] netlink: 'syz.5.3854': attribute type 8 has an invalid length. [ 566.981694][T20951] netlink: 'syz.5.3854': attribute type 8 has an invalid length. [ 567.012041][T20946] wg1 speed is unknown, defaulting to 1000 [ 567.026710][T20951] netlink: 'syz.5.3854': attribute type 4 has an invalid length. [ 567.034772][T20951] netlink: 'syz.5.3854': attribute type 7 has an invalid length. [ 567.061652][T20951] __nla_validate_parse: 5 callbacks suppressed [ 567.061671][T20951] netlink: 207236 bytes leftover after parsing attributes in process `syz.5.3854'. [ 567.727092][T20999] netlink: 'syz.5.3866': attribute type 3 has an invalid length. [ 567.751138][T20991] syzkaller0: entered promiscuous mode [ 567.757224][T20991] syzkaller0: entered allmulticast mode [ 568.152122][T21024] netlink: 'syz.6.3871': attribute type 21 has an invalid length. [ 568.169663][T21024] netlink: 132 bytes leftover after parsing attributes in process `syz.6.3871'. [ 568.181752][T21021] IPVS: set_ctl: invalid protocol: 92 100.1.1.0:20003 [ 568.608934][T21034] bridge5: entered promiscuous mode [ 568.909401][T21037] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 570.189158][ T5831] Bluetooth: hci5: command 0x0406 tx timeout [ 570.684673][T20993] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 570.887828][T21053] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3878'. [ 571.014908][T21063] batadv_slave_1: entered promiscuous mode [ 571.109609][T21066] lo speed is unknown, defaulting to 1000 [ 571.154431][T21056] batadv_slave_1: left promiscuous mode [ 571.165419][T21066] wg1 speed is unknown, defaulting to 1000 [ 571.560744][T21080] bond3: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 571.604198][T21080] bond3 (unregistering): Released all slaves [ 571.667613][T21086] "syz.5.3886" (21086) uses obsolete ecb(arc4) skcipher [ 571.908631][T21101] netlink: 'syz.6.3890': attribute type 6 has an invalid length. [ 572.235964][T21124] netlink: 'syz.0.3894': attribute type 21 has an invalid length. [ 572.267834][T21124] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3894'. [ 572.580699][T21128] lo speed is unknown, defaulting to 1000 [ 572.636029][T21128] wg1 speed is unknown, defaulting to 1000 [ 572.855552][T21156] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3902'. [ 573.058499][T21165] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3903'. [ 573.162680][T21164] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3904'. [ 573.389065][T21179] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3906'. [ 573.399299][T21178] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3906'. [ 573.620004][T21192] netlink: 'syz.0.3909': attribute type 21 has an invalid length. [ 573.628588][T10987] IPVS: starting estimator thread 0... [ 573.630962][T21188] netlink: 'syz.6.3910': attribute type 1 has an invalid length. [ 573.647086][T21192] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3909'. [ 573.670194][T21195] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3912'. [ 573.717666][T21193] IPVS: using max 24 ests per chain, 57600 per kthread [ 574.041016][T21208] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3916'. [ 574.620865][T21228] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3923'. [ 574.703161][T21232] bond0: Caught tx_queue_len zero misconfig [ 574.954439][T21245] netlink: 'syz.1.3928': attribute type 21 has an invalid length. [ 574.970527][T21247] lo speed is unknown, defaulting to 1000 [ 574.994407][T21245] netlink: 'syz.1.3928': attribute type 4 has an invalid length. [ 575.017360][T21247] wg1 speed is unknown, defaulting to 1000 [ 575.364339][T21267] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 575.404970][T21266] gre0: entered promiscuous mode [ 575.411011][T21266] gre0: entered allmulticast mode [ 575.863242][T21291] Unsupported ieee802154 address type: 0 [ 576.421433][T21314] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 576.672362][T21329] x_tables: duplicate underflow at hook 1 [ 576.737379][T21331] vlan2: entered promiscuous mode [ 576.766560][T21331] bridge0: entered promiscuous mode [ 578.038090][T21375] lo speed is unknown, defaulting to 1000 [ 578.050910][T21375] wg1 speed is unknown, defaulting to 1000 [ 578.230835][ T30] audit: type=1800 audit(1770361056.320:6): pid=21372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3962" name="memory.events" dev="tmpfs" ino=890 res=0 errno=0 [ 578.422151][T21381] __nla_validate_parse: 8 callbacks suppressed [ 578.422174][T21381] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3964'. [ 578.446543][T21381] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 578.798826][T21375] dvmrp1: entered allmulticast mode [ 578.805299][T21375] dvmrp1: left allmulticast mode [ 579.876104][T21343] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 580.178293][T21398] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3968'. [ 580.429509][ T5831] Bluetooth: hci2: command 0x0406 tx timeout [ 580.607585][T21418] syzkaller1: entered promiscuous mode [ 580.613255][T21418] syzkaller1: entered allmulticast mode [ 581.351189][T21454] vlan1: entered promiscuous mode [ 581.356773][T21454] bridge0: entered promiscuous mode [ 581.459064][T21451] syzkaller1: entered promiscuous mode [ 581.464584][T21451] syzkaller1: entered allmulticast mode [ 581.702365][T21463] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 582.031797][T21485] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3994'. [ 582.217879][T21492] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3995'. [ 582.233043][T21493] lo speed is unknown, defaulting to 1000 [ 582.243091][T21493] wg1 speed is unknown, defaulting to 1000 [ 582.252518][T21503] FAULT_INJECTION: forcing a failure. [ 582.252518][T21503] name failslab, interval 1, probability 0, space 0, times 0 [ 582.303749][T21503] CPU: 1 UID: 0 PID: 21503 Comm: syz.6.3996 Not tainted syzkaller #0 PREEMPT(full) [ 582.303779][T21503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 582.303792][T21503] Call Trace: [ 582.303800][T21503] [ 582.303809][T21503] dump_stack_lvl+0xe8/0x150 [ 582.303842][T21503] should_fail_ex+0x412/0x560 [ 582.303872][T21503] should_failslab+0xa8/0x100 [ 582.303897][T21503] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 582.303939][T21503] ? __alloc_skb+0x1d0/0x7d0 [ 582.303960][T21503] ? __local_bh_enable_ip+0xd0/0x130 [ 582.303984][T21503] __alloc_skb+0x1d0/0x7d0 [ 582.304008][T21503] ? netlink_ack_tlv_len+0x6c/0x210 [ 582.304032][T21503] netlink_ack+0x146/0xa50 [ 582.304050][T21503] ? __pfx_genl_rcv_msg+0x10/0x10 [ 582.304093][T21503] netlink_rcv_skb+0x2b6/0x4b0 [ 582.304116][T21503] ? __pfx_genl_rcv_msg+0x10/0x10 [ 582.304143][T21503] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 582.304160][T21503] ? genl_rcv+0x19/0x40 [ 582.304205][T21503] ? down_read+0x272/0x2e0 [ 582.304222][T21503] ? genl_rcv+0xd/0x40 [ 582.304250][T21503] genl_rcv+0x28/0x40 [ 582.304275][T21503] netlink_unicast+0x80f/0x9b0 [ 582.304306][T21503] ? __pfx_netlink_unicast+0x10/0x10 [ 582.304328][T21503] ? netlink_sendmsg+0x650/0xb40 [ 582.304349][T21503] ? skb_put+0x11b/0x210 [ 582.304378][T21503] netlink_sendmsg+0x813/0xb40 [ 582.304411][T21503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 582.304438][T21503] ? aa_sock_msg_perm+0xf1/0x1b0 [ 582.304466][T21503] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 582.304490][T21503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 582.304512][T21503] ____sys_sendmsg+0xa68/0xad0 [ 582.304540][T21503] ? __might_fault+0xaf/0x130 [ 582.304576][T21503] ? __pfx_____sys_sendmsg+0x10/0x10 [ 582.304613][T21503] ? import_iovec+0x73/0xa0 [ 582.304648][T21503] ___sys_sendmsg+0x2a5/0x360 [ 582.304671][T21503] ? __lock_acquire+0x6b5/0x2cf0 [ 582.304702][T21503] ? __pfx____sys_sendmsg+0x10/0x10 [ 582.304770][T21503] ? __fget_files+0x2a/0x420 [ 582.304792][T21503] ? __fget_files+0x3a0/0x420 [ 582.304826][T21503] __x64_sys_sendmsg+0x1bd/0x2a0 [ 582.304858][T21503] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 582.304897][T21503] ? __pfx_ksys_write+0x10/0x10 [ 582.304948][T21503] do_syscall_64+0xe2/0xf80 [ 582.304975][T21503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.304994][T21503] ? trace_irq_disable+0x37/0x100 [ 582.305015][T21503] ? clear_bhb_loop+0x60/0xb0 [ 582.305039][T21503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.305057][T21503] RIP: 0033:0x7f701fb9aeb9 [ 582.305076][T21503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.305095][T21503] RSP: 002b:00007f7020976028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 582.305117][T21503] RAX: ffffffffffffffda RBX: 00007f701fe16090 RCX: 00007f701fb9aeb9 [ 582.305130][T21503] RDX: 0000000004008054 RSI: 0000200000000200 RDI: 000000000000000b [ 582.305143][T21503] RBP: 00007f7020976090 R08: 0000000000000000 R09: 0000000000000000 [ 582.305155][T21503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 582.305167][T21503] R13: 00007f701fe16128 R14: 00007f701fe16090 R15: 00007ffe28745318 [ 582.305202][T21503] [ 582.842427][T21508] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3998'. [ 583.422785][T21527] lo speed is unknown, defaulting to 1000 [ 583.431125][T21527] wg1 speed is unknown, defaulting to 1000 [ 584.291550][T21546] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4009'. [ 584.329095][T21546] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4009'. [ 584.377917][T21546] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4009'. [ 584.450157][T21550] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4009'. [ 584.649014][T21553] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4011'. [ 585.112145][T21564] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.198740][T21567] lo speed is unknown, defaulting to 1000 [ 585.207400][T21567] wg1 speed is unknown, defaulting to 1000 [ 585.250601][T21564] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.557411][ T5831] Bluetooth: hci3: command 0x0406 tx timeout [ 585.816156][T21564] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.077873][T21564] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.112083][T21599] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4023'. [ 586.140498][T21599] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4023'. [ 586.261901][ T6605] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.407030][ T61] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.461981][ T61] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.570304][ T6605] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.902955][T21621] lo speed is unknown, defaulting to 1000 [ 586.949728][T21621] wg1 speed is unknown, defaulting to 1000 [ 587.878550][T21650] netlink: 11 bytes leftover after parsing attributes in process `syz.4.4039'. [ 587.897434][T21650] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4039'. [ 588.398330][T17596] udevd[17596]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 588.418774][T21663] batman_adv: batadv0: Adding interface: geneve3 [ 588.486472][T21663] batman_adv: batadv0: The MTU of interface geneve3 is too small (1430) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.581535][T21663] batman_adv: batadv0: Interface activated: geneve3 [ 588.581560][ T7384] IPVS: starting estimator thread 0... [ 588.670877][T21666] lo: entered allmulticast mode [ 588.691231][T21666] lo: left allmulticast mode [ 588.736359][T21671] IPVS: using max 31 ests per chain, 74400 per kthread [ 588.769138][T21673] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4043'. [ 588.814850][T21673] tipc: Enabled bearer , priority 0 [ 588.829293][T21675] syzkaller0: entered promiscuous mode [ 588.886388][T21675] syzkaller0: entered allmulticast mode [ 588.896758][T21673] geneve1: mtu less than device minimum [ 588.916941][T21672] tipc: Resetting bearer [ 589.018417][T21672] tipc: Disabling bearer [ 589.879134][T21703] netlink: 'syz.6.4049': attribute type 1 has an invalid length. [ 589.887686][T21703] netlink: 'syz.6.4049': attribute type 3 has an invalid length. [ 589.895452][T21703] netlink: 224 bytes leftover after parsing attributes in process `syz.6.4049'. [ 590.046297][T21709] netlink: 'syz.6.4053': attribute type 2 has an invalid length. [ 590.072186][T21709] netlink: 'syz.6.4053': attribute type 2 has an invalid length. [ 590.081644][T21709] netlink: 'syz.6.4053': attribute type 2 has an invalid length. [ 590.090267][T21709] netlink: 'syz.6.4053': attribute type 2 has an invalid length. [ 590.100379][T21709] netlink: 'syz.6.4053': attribute type 2 has an invalid length. [ 590.171665][T21715] netlink: 'syz.4.4054': attribute type 29 has an invalid length. [ 590.219157][T21715] netlink: 'syz.4.4054': attribute type 29 has an invalid length. [ 590.418748][T21723] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.4057'. [ 591.056962][T21759] IPVS: set_ctl: invalid protocol: 137 172.30.1.7:20004 [ 591.343349][T21776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4068'. [ 591.356893][T21776] x_tables: duplicate underflow at hook 3 [ 591.483028][T21780] lo speed is unknown, defaulting to 1000 [ 591.492540][T21780] wg1 speed is unknown, defaulting to 1000 [ 592.430349][ T25] block nbd2: Possible stuck request ffff888025438000: control (read@0,1024B). Runtime 120 seconds [ 592.441622][ T25] block nbd2: Possible stuck request ffff888025438200: control (read@1024,1024B). Runtime 120 seconds [ 592.453048][ T25] block nbd2: Possible stuck request ffff888025438400: control (read@2048,1024B). Runtime 120 seconds [ 592.466540][ T25] block nbd2: Possible stuck request ffff888025438600: control (read@3072,1024B). Runtime 120 seconds [ 592.492232][T21786] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4071'. [ 592.501581][T21786] netlink: 84 bytes leftover after parsing attributes in process `syz.1.4071'. [ 592.568962][T21788] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4072'. [ 592.757831][T21796] FAULT_INJECTION: forcing a failure. [ 592.757831][T21796] name failslab, interval 1, probability 0, space 0, times 0 [ 592.770983][T21796] CPU: 0 UID: 0 PID: 21796 Comm: syz.1.4074 Not tainted syzkaller #0 PREEMPT(full) [ 592.771003][T21796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 592.771010][T21796] Call Trace: [ 592.771016][T21796] [ 592.771022][T21796] dump_stack_lvl+0xe8/0x150 [ 592.771043][T21796] should_fail_ex+0x412/0x560 [ 592.771060][T21796] should_failslab+0xa8/0x100 [ 592.771076][T21796] __kmalloc_noprof+0xde/0x7e0 [ 592.771089][T21796] ? kfree+0x4d/0x650 [ 592.771103][T21796] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 592.771123][T21796] tomoyo_realpath_from_path+0xe3/0x5d0 [ 592.771139][T21796] ? tomoyo_domain+0xd7/0x130 [ 592.771159][T21796] ? tomoyo_path_number_perm+0x219/0x630 [ 592.771172][T21796] tomoyo_path_number_perm+0x246/0x630 [ 592.771187][T21796] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 592.771199][T21796] ? __lock_acquire+0x6b5/0x2cf0 [ 592.771225][T21796] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 592.771255][T21796] ? __fget_files+0x2a/0x420 [ 592.771270][T21796] ? __fget_files+0x2a/0x420 [ 592.771282][T21796] ? __fget_files+0x3a0/0x420 [ 592.771294][T21796] ? __fget_files+0x2a/0x420 [ 592.771309][T21796] security_file_ioctl+0xc3/0x2a0 [ 592.771323][T21796] __se_sys_ioctl+0x47/0x170 [ 592.771342][T21796] do_syscall_64+0xe2/0xf80 [ 592.771358][T21796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.771369][T21796] ? trace_irq_disable+0x37/0x100 [ 592.771381][T21796] ? clear_bhb_loop+0x60/0xb0 [ 592.771395][T21796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.771407][T21796] RIP: 0033:0x7fc19539aeb9 [ 592.771428][T21796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 592.771439][T21796] RSP: 002b:00007fc196233028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 592.771453][T21796] RAX: ffffffffffffffda RBX: 00007fc195615fa0 RCX: 00007fc19539aeb9 [ 592.771462][T21796] RDX: 0000000000000000 RSI: 00000000000089e4 RDI: 0000000000000008 [ 592.771470][T21796] RBP: 00007fc196233090 R08: 0000000000000000 R09: 0000000000000000 [ 592.771477][T21796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 592.771484][T21796] R13: 00007fc195616038 R14: 00007fc195615fa0 R15: 00007fff97d5eb68 [ 592.771504][T21796] [ 592.771611][T21796] ERROR: Out of memory at tomoyo_realpath_from_path. [ 593.619441][T21731] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 593.839949][T21815] netlink: 76 bytes leftover after parsing attributes in process `syz.6.4081'. [ 594.335527][T21840] netlink: 'syz.0.4086': attribute type 1 has an invalid length. [ 594.385784][T21840] bond3: entered promiscuous mode [ 594.392830][T21840] 8021q: adding VLAN 0 to HW filter on device bond3 [ 594.474186][T21849] RDS: rds_bind could not find a transport for ::ffff:172.30.1.1, load rds_tcp or rds_rdma? [ 594.730499][T21868] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4090'. [ 595.141966][T21890] lo speed is unknown, defaulting to 1000 [ 595.150095][T21890] wg1 speed is unknown, defaulting to 1000 [ 595.247621][T21904] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4098'. [ 595.404572][T21902] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4099'. [ 595.724239][T21931] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4106'. [ 595.855465][T21931] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 595.903742][T21952] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input5 [ 596.018331][T21940] lo speed is unknown, defaulting to 1000 [ 596.058578][T21940] wg1 speed is unknown, defaulting to 1000 [ 596.150379][T21958] tipc: Cannot configure node identity twice [ 596.211194][T21962] netlink: 'syz.1.4112': attribute type 21 has an invalid length. [ 596.296587][T21962] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4112'. [ 596.647741][T21985] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4115'. [ 596.923841][T21985] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4115'. [ 596.964271][T21994] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 596.965124][T16068] block nbd64: NBD_DISCONNECT [ 597.899008][T17596] udevd[17596]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 598.319104][T22036] IPVS: set_ctl: invalid protocol: 59 10.1.1.2:20001 [ 598.473434][T22038] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4129'. [ 598.492771][T22038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4129'. [ 598.519319][T22038] netlink: 'syz.1.4129': attribute type 1 has an invalid length. [ 598.548338][T22044] tap0: tun_chr_ioctl cmd 2148553947 [ 598.561316][T22038] netlink: 10 bytes leftover after parsing attributes in process `syz.1.4129'. [ 598.585377][T22038] block nbd3: Unsupported socket: should be TCP or UNIX. [ 598.662994][T22044] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4132'. [ 598.760036][T22038] lo speed is unknown, defaulting to 1000 [ 598.803119][T22054] tipc: Enabled bearer , priority 0 [ 598.905692][T22060] syzkaller0: entered promiscuous mode [ 598.911340][T22038] wg1 speed is unknown, defaulting to 1000 [ 598.924647][T22060] syzkaller0: entered allmulticast mode [ 599.119383][T22054] tipc: Resetting bearer [ 599.338714][T22052] tipc: Resetting bearer [ 599.371480][T22052] tipc: Disabling bearer [ 599.394335][T22068] team0: No ports can be present during mode change [ 600.022312][T22105] macvtap1: entered promiscuous mode [ 600.053901][T22105] veth1_to_hsr: entered promiscuous mode [ 600.065577][T22105] macvtap1: entered allmulticast mode [ 600.070189][T22109] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 600.076189][T22105] veth1_to_hsr: entered allmulticast mode [ 600.279200][T22116] rdma_rxe: rxe_newlink: failed to add lo [ 600.422184][T22126] 8021q: VLANs not supported on vxcan0 [ 600.675678][T22139] sctp: [Deprecated]: syz.4.4151 (pid 22139) Use of int in max_burst socket option deprecated. [ 600.675678][T22139] Use struct sctp_assoc_value instead [ 600.906845][ T5831] Bluetooth: hci1: command 0x0406 tx timeout [ 601.532753][T22149] __nla_validate_parse: 2 callbacks suppressed [ 601.532776][T22149] netlink: 428 bytes leftover after parsing attributes in process `syz.4.4153'. [ 601.565619][T22149] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4153'. [ 601.845842][T22171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4158'. [ 602.038625][T22177] netlink: 180 bytes leftover after parsing attributes in process `syz.0.4161'. [ 602.128095][T22177] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4161'. [ 602.729827][T22224] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvtap0, syncid = 2, id = 0 [ 602.975427][T22231] netlink: 'syz.0.4169': attribute type 1 has an invalid length. [ 603.023604][T22232] bond4 (unregistering): Released all slaves [ 603.057175][T22231] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 603.205489][T22243] netlink: 'syz.1.4171': attribute type 1 has an invalid length. [ 603.264089][T22250] netlink: 'syz.0.4173': attribute type 1 has an invalid length. [ 603.287082][T22250] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4173'. [ 603.347624][T22243] 8021q: adding VLAN 0 to HW filter on device bond2 [ 603.352346][T22255] netlink: 192 bytes leftover after parsing attributes in process `syz.5.4174'. [ 603.482658][T22257] netlink: 'syz.0.4176': attribute type 1 has an invalid length. [ 603.521286][T22259] bond4: entered promiscuous mode [ 603.715207][T22270] bond4: (slave gretap1): Enslaving as a backup interface with an up link [ 603.833944][T22264] macvlan3: entered promiscuous mode [ 603.863079][T22264] macvlan3: entered allmulticast mode [ 603.907181][T22264] bond4: entered promiscuous mode [ 603.912319][T22264] gretap1: entered promiscuous mode [ 603.928209][T22264] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 603.937558][T22264] bond4: left promiscuous mode [ 603.955457][T22264] gretap1: left promiscuous mode [ 603.965584][T22290] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4180'. [ 603.976978][T22290] netlink: 'syz.1.4180': attribute type 39 has an invalid length. [ 604.387275][ T5487] veth0_vlan: left promiscuous mode [ 604.445656][ T5487] veth0_vlan: entered promiscuous mode [ 604.825314][T22327] netlink: 'syz.0.4189': attribute type 2 has an invalid length. [ 604.862935][T22327] 9: entered promiscuous mode [ 605.367239][T22354] pim6reg1: entered promiscuous mode [ 605.387883][T22354] pim6reg1: entered allmulticast mode [ 605.487888][T22361] netlink: 'syz.4.4195': attribute type 10 has an invalid length. [ 605.520824][T22361] bond0: (slave wlan1): Opening slave failed [ 606.576015][T22390] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4201'. [ 608.082828][T22343] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 608.349661][T22421] bond5: entered promiscuous mode [ 608.427302][T22429] netlink: 'syz.1.4211': attribute type 4 has an invalid length. [ 608.471703][T22429] xt_hashlimit: max too large, truncated to 1048576 [ 608.493280][T22432] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4212'. [ 608.511533][T22429] syz_tun: entered allmulticast mode [ 608.526529][T22429] dvmrp6: entered allmulticast mode [ 608.534967][T22427] syz_tun: left allmulticast mode [ 608.564036][T22434] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4208'. [ 608.583533][T22434] netlink: 25 bytes leftover after parsing attributes in process `syz.4.4208'. [ 608.761800][T22441] lo speed is unknown, defaulting to 1000 [ 608.778392][T22441] wg1 speed is unknown, defaulting to 1000 [ 608.968068][T22450] lo speed is unknown, defaulting to 1000 [ 608.979120][T22450] wg1 speed is unknown, defaulting to 1000 [ 610.125496][T22493] netlink: 'syz.0.4225': attribute type 6 has an invalid length. [ 610.146590][T22493] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4225'. [ 610.188520][T22493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4225'. [ 610.577820][ T30] audit: type=1107 audit(1770361088.660:7): pid=22505 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N`ktdPX^6މPCV+ytzd,/wgn6&ˆE6p $gpZh͋ .w.[ғ M"P!8,s#p-u`S}*-jRf劺 &2z" iN' [ 610.771565][T22512] netlink: 'syz.6.4231': attribute type 1 has an invalid length. [ 610.787751][T22512] netlink: 224 bytes leftover after parsing attributes in process `syz.6.4231'. [ 613.731823][T22511] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 613.925128][T22572] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 613.971134][T22578] netlink: 212360 bytes leftover after parsing attributes in process `syz.0.4244'. [ 614.048833][T22578] syzkaller1: entered promiscuous mode [ 614.061012][T22578] syzkaller1: entered allmulticast mode [ 614.071593][T22585] bridge0: entered allmulticast mode [ 614.101066][T22578] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4244'. [ 614.109012][T22585] macvlan2: left allmulticast mode [ 614.111667][T22584] xt_CT: You must specify a L4 protocol and not use inversions on it [ 614.125442][T22585] macvlan2: left promiscuous mode [ 614.132237][T22585] bridge0: port 3(macvlan2) entered disabled state [ 614.153394][T22585] bridge_slave_0: left allmulticast mode [ 614.166791][T22585] bridge0: port 1(bridge_slave_0) entered disabled state [ 615.268454][T22611] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4254'. [ 616.653319][T22616] lo: Caught tx_queue_len zero misconfig [ 616.705055][T22619] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4255'. [ 616.738171][T22622] siw: device registration error -23 [ 616.867773][T22633] IPVS: set_ctl: invalid protocol: 47 0.0.0.0:52769 [ 617.159901][T22647] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4261'. [ 617.272863][T22645] sctp: [Deprecated]: syz.4.4260 (pid 22645) Use of struct sctp_assoc_value in delayed_ack socket option. [ 617.272863][T22645] Use struct sctp_sack_info instead [ 617.866050][T22677] lo speed is unknown, defaulting to 1000 [ 617.881054][T22696] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4268'. [ 617.959431][T22677] wg1 speed is unknown, defaulting to 1000 [ 618.108283][T22706] netlink: 'syz.4.4270': attribute type 29 has an invalid length. [ 618.332587][T22706] netlink: 'syz.4.4270': attribute type 29 has an invalid length. [ 618.362665][T22710] gtp0: entered promiscuous mode [ 618.381312][T22710] gtp0: entered allmulticast mode [ 618.518908][T22722] IPVS: set_ctl: invalid protocol: 4 172.20.20.187:20004 [ 618.537931][T22714] bond3: entered promiscuous mode [ 618.565472][T22716] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 618.899671][T22724] : renamed from bond_slave_0 (while UP) [ 619.246176][T22743] netlink: 'syz.4.4278': attribute type 1 has an invalid length. [ 619.538099][T22743] bond5: entered promiscuous mode [ 619.552702][T22743] 8021q: adding VLAN 0 to HW filter on device bond5 [ 619.624930][T22751] bond5: (slave bridge6): making interface the new active one [ 619.639271][T22751] bridge6: entered promiscuous mode [ 619.655197][T22751] bond5: (slave bridge6): Enslaving as an active interface with an up link [ 620.650652][T22781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4286'. [ 620.723991][T22785] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4288'. [ 620.736893][T22786] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4288'. [ 620.754195][T22783] tipc: Enabled bearer , priority 0 [ 620.780649][T22783] syzkaller0: entered promiscuous mode [ 620.846443][T22783] syzkaller0: entered allmulticast mode [ 620.859262][T22785] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 620.861020][T22786] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 621.038376][T22797] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4290'. [ 621.070438][T22783] tipc: Resetting bearer [ 621.076160][T22797] netlink: 'syz.6.4290': attribute type 39 has an invalid length. [ 621.128309][T22783] tipc: Disabling bearer [ 621.889836][T22828] geneve0: entered promiscuous mode [ 621.910954][T22827] geneve0: left promiscuous mode [ 621.971099][T22833] "syz.6.4299" (22833) uses obsolete ecb(arc4) skcipher [ 622.100652][T22838] xt_TPROXY: Can be used only with -p tcp or -p udp [ 622.130134][T22838] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4300'. [ 622.165283][T22842] netlink: 188 bytes leftover after parsing attributes in process `syz.1.4301'. [ 622.180771][T22840] netlink: 'syz.5.4300': attribute type 5 has an invalid length. [ 622.250810][T22844] netlink: 188 bytes leftover after parsing attributes in process `syz.1.4301'. [ 622.489310][T22851] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 622.515080][ T25] block nbd2: Possible stuck request ffff888025438000: control (read@0,1024B). Runtime 150 seconds [ 622.526462][ T25] block nbd2: Possible stuck request ffff888025438200: control (read@1024,1024B). Runtime 150 seconds [ 622.538131][ T25] block nbd2: Possible stuck request ffff888025438400: control (read@2048,1024B). Runtime 150 seconds [ 622.549988][ T25] block nbd2: Possible stuck request ffff888025438600: control (read@3072,1024B). Runtime 150 seconds [ 624.432503][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 624.451226][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.467663][ T1303] clip:clip_start_xmit: skb_dst(skb) == NULL [ 624.485257][T22836] xfrm0: entered promiscuous mode [ 624.490618][T22836] xfrm0: entered allmulticast mode [ 624.496165][T22838] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4300'. [ 624.822851][T22868] lo speed is unknown, defaulting to 1000 [ 624.842872][T22883] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4310'. [ 624.858110][T22868] wg1 speed is unknown, defaulting to 1000 [ 624.878697][T22879] vlan3: entered promiscuous mode [ 624.883796][T22879] bond0: entered promiscuous mode [ 624.927945][T22879] bond_slave_0: entered promiscuous mode [ 624.946719][T22879] bond_slave_1: entered promiscuous mode [ 624.973504][T22888] netlink: 'syz.0.4312': attribute type 1 has an invalid length. [ 625.167660][T22888] bond6: entered promiscuous mode [ 625.206729][T22888] 8021q: adding VLAN 0 to HW filter on device bond6 [ 625.289244][T22877] dvmrp1: entered allmulticast mode [ 625.491318][T22907] lo speed is unknown, defaulting to 1000 [ 625.502998][T22907] wg1 speed is unknown, defaulting to 1000 [ 625.832639][T22930] netlink: 'syz.5.4319': attribute type 3 has an invalid length. [ 625.862168][T22930] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4319'. [ 626.252913][T22938] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input6 [ 626.378717][T22937] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 626.900723][T22966] netlink: 'syz.0.4327': attribute type 13 has an invalid length. [ 626.935664][T22968] netlink: 'syz.4.4328': attribute type 39 has an invalid length. [ 626.957494][T22969] nbd: nbd0 already in use [ 627.152939][T22973] syzkaller0: entered promiscuous mode [ 627.158643][T22973] syzkaller0: entered allmulticast mode [ 627.324399][T22984] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.4331'. [ 627.456138][T22997] netlink: 'syz.4.4335': attribute type 10 has an invalid length. [ 627.472762][T22997] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4335'. [ 627.532190][T23001] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4334'. [ 627.543945][T23001] netlink: 'syz.1.4334': attribute type 21 has an invalid length. [ 627.596853][T23001] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4334'. [ 627.600254][T23011] netlink: 'syz.0.4338': attribute type 1 has an invalid length. [ 627.641131][T23011] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4338'. [ 627.713968][T23001] netlink: 'syz.1.4334': attribute type 21 has an invalid length. [ 627.724668][T23008] lo speed is unknown, defaulting to 1000 [ 627.730823][ T4601] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.767364][T23001] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4334'. [ 627.771817][ T4601] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.795003][ T4601] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.808615][ T4601] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.828328][T23008] wg1 speed is unknown, defaulting to 1000 [ 628.054252][T23033] netlink: 'syz.1.4341': attribute type 16 has an invalid length. [ 628.065152][T23033] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.4341'. [ 628.161261][T23044] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.4344'. [ 628.473661][T23066] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4350'. [ 628.485315][T23068] team0 (unregistering): Port device team_slave_0 removed [ 628.561017][T23068] team0 (unregistering): Port device team_slave_1 removed [ 628.863226][T23091] netlink: 'syz.6.4355': attribute type 10 has an invalid length. [ 628.882526][T23091] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 629.913409][T23131] netlink: 'syz.5.4365': attribute type 11 has an invalid length. [ 630.109837][T23138] lo speed is unknown, defaulting to 1000 [ 630.141619][T23138] wg1 speed is unknown, defaulting to 1000 [ 630.293711][T23149] x_tables: duplicate underflow at hook 1 [ 630.328075][T23144] lo speed is unknown, defaulting to 1000 [ 630.371538][T23144] wg1 speed is unknown, defaulting to 1000 [ 630.899364][T23175] vlan2: entered allmulticast mode [ 630.905634][T23175] bridge_slave_0: entered allmulticast mode [ 630.968146][T23176] vlan2: entered allmulticast mode [ 631.208758][T23188] __nla_validate_parse: 3 callbacks suppressed [ 631.208780][T23188] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4381'. [ 631.668658][T23203] bond7: option mode: invalid value (254) [ 631.683967][T23210] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4387'. [ 631.715588][T23210] validate_nla: 3 callbacks suppressed [ 631.715610][T23210] netlink: 'syz.5.4387': attribute type 39 has an invalid length. [ 631.732875][T23203] bond7 (unregistering): Released all slaves [ 631.830455][T23214] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4388'. [ 631.844010][T23214] netlink: 'syz.6.4388': attribute type 39 has an invalid length. [ 632.604023][T23245] bridge0: entered allmulticast mode [ 632.701751][T23253] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 632.709071][T23253] IPv6: NLM_F_CREATE should be set when creating new route [ 632.716404][T23253] IPv6: NLM_F_CREATE should be set when creating new route [ 632.723659][T23253] IPv6: NLM_F_CREATE should be set when creating new route [ 632.734241][T23254] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 632.742303][T23254] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 632.753752][ T31] INFO: task syz.2.3126:18274 blocked for more than 143 seconds. [ 632.776462][T23253] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 632.785935][ T31] Not tainted syzkaller #0 [ 632.793508][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 632.803709][ T31] task:syz.2.3126 state:D stack:26456 pid:18274 tgid:18273 ppid:17647 task_flags:0x400140 flags:0x00080002 [ 632.819898][ T31] Call Trace: [ 632.823229][ T31] [ 632.829123][ T31] __schedule+0x14ea/0x5050 [ 632.833736][ T31] ? __pfx___schedule+0x10/0x10 [ 632.853158][ T31] ? schedule+0x90/0x360 [ 632.859927][ T31] schedule+0x164/0x360 [ 632.864335][ T31] schedule_preempt_disabled+0x13/0x30 [ 632.872789][ T31] __mutex_lock+0x7fe/0x1300 [ 632.878036][ T31] ? __mutex_lock+0x5ac/0x1300 [ 632.883053][ T31] ? nfsd_nl_threads_set_doit+0x2cb/0x960 [ 632.891498][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 632.899043][ T31] ? net_generic+0x1e/0x240 [ 632.903606][ T31] ? net_generic+0x1e/0x240 [ 632.908867][ T31] ? net_generic+0x1e/0x240 [ 632.914555][ T31] ? net_generic+0x1e/0x240 [ 632.922335][ T31] nfsd_nl_threads_set_doit+0x2cb/0x960 [ 632.928571][ T31] genl_family_rcv_msg_doit+0x22a/0x330 [ 632.934388][ T31] ? __asan_memcpy+0x40/0x70 [ 632.946773][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 632.952979][ T31] ? bpf_lsm_capable+0x9/0x20 [ 632.966319][ T31] ? security_capable+0x7e/0x2c0 [ 632.971322][ T31] genl_rcv_msg+0x61c/0x7a0 [ 632.993543][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 633.006276][ T31] ? __pfx_nfsd_nl_threads_set_doit+0x10/0x10 [ 633.012571][ T31] netlink_rcv_skb+0x232/0x4b0 [ 633.030017][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 633.038774][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 633.050024][ T31] ? genl_rcv+0x19/0x40 [ 633.059150][ T31] ? down_read+0x272/0x2e0 [ 633.063628][ T31] ? genl_rcv+0xd/0x40 [ 633.068394][ T31] genl_rcv+0x28/0x40 [ 633.072396][ T31] netlink_unicast+0x80f/0x9b0 [ 633.077376][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 633.082782][ T31] ? netlink_sendmsg+0x650/0xb40 [ 633.087881][ T31] ? skb_put+0x11b/0x210 [ 633.092393][ T31] netlink_sendmsg+0x813/0xb40 [ 633.097352][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 633.102799][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 633.108006][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 633.113304][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 633.118975][ T31] ____sys_sendmsg+0xa68/0xad0 [ 633.123777][ T31] ? __might_fault+0xaf/0x130 [ 633.128674][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 633.134299][ T31] ? import_iovec+0x73/0xa0 [ 633.138944][ T31] ___sys_sendmsg+0x2a5/0x360 [ 633.143821][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 633.148979][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 633.154216][ T31] ? futex_wake+0x4ac/0x580 [ 633.159129][ T31] ? __fget_files+0x2a/0x420 [ 633.163765][ T31] ? __fget_files+0x3a0/0x420 [ 633.168540][ T31] __x64_sys_sendmsg+0x1bd/0x2a0 [ 633.173679][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 633.179432][ T31] ? rcu_is_watching+0x15/0xb0 [ 633.184298][ T31] do_syscall_64+0xe2/0xf80 [ 633.188914][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.195012][ T31] ? trace_irq_disable+0x37/0x100 [ 633.200397][ T31] ? clear_bhb_loop+0x60/0xb0 [ 633.205215][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.211232][ T31] RIP: 0033:0x7f6386b9aeb9 [ 633.215784][ T31] RSP: 002b:00007f6387979028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 633.224490][ T31] RAX: ffffffffffffffda RBX: 00007f6386e15fa0 RCX: 00007f6386b9aeb9 [ 633.232973][ T31] RDX: 0000000000008004 RSI: 0000200000000180 RDI: 0000000000000009 [ 633.241436][ T31] RBP: 00007f6386c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 633.249863][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 633.258238][ T31] R13: 00007f6386e16038 R14: 00007f6386e15fa0 R15: 00007ffff16bce18 [ 633.266422][ T31] [ 633.278100][ T31] [ 633.278100][ T31] Showing all locks held in the system: [ 633.306990][ T31] 1 lock held by pool_workqueue_/3: [ 633.312250][ T31] #0: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 633.356437][ T31] 1 lock held by khungtaskd/31: [ 633.361487][ T31] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 633.375928][T23262] 8021q: adding VLAN 0 to HW filter on device bond3 [ 633.383289][ T31] 2 locks held by kworker/u8:3/50: [ 633.389588][ T31] #0: ffff88813fe69148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 633.401843][ T31] #1: ffffc90000bb7bc0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 633.414394][ T31] 1 lock held by udevd/5192: [ 633.419724][ T31] 2 locks held by getty/5576: [ 633.424510][ T31] #0: ffff888034a450a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 633.434759][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 633.445432][ T31] 3 locks held by kworker/u8:14/6563: [ 633.450999][ T31] #0: ffff88813fe69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 633.463192][ T31] #1: ffffc9000e487bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 633.474512][ T31] #2: ffffffff8f9ac008 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 633.483946][ T31] 1 lock held by udevd/16064: [ 633.488949][ T31] #0: ffff888025388358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 633.498361][ T31] 2 locks held by syz.3.3040/17894: [ 633.503668][ T31] #0: ffffffff8fa19c30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 633.512053][ T31] #1: ffffffff8e879428 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x16c0 [ 633.522785][ T31] 2 locks held by syz.2.3126/18274: [ 633.528039][ T31] #0: ffffffff8fa19c30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 633.536554][ T31] #1: ffffffff8e879428 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x2cb/0x960 [ 633.546896][ T31] 2 locks held by syz.4.4368/23144: [ 633.554542][ T31] #0: ffffffff8f99d790 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 633.564311][ T31] #1: ffffffff8e560b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 633.574550][ T31] 2 locks held by syz.0.4397/23259: [ 633.579997][ T31] #0: ffffffff8f9ac008 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 633.589184][ T31] #1: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 633.600141][ T31] 2 locks held by syz.0.4397/23269: [ 633.605467][ T31] #0: ffffffff8f99d790 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 633.615068][ T31] #1: ffffffff8f9ac008 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x88/0x290 [ 633.625322][ T31] 1 lock held by syz.0.4397/23271: [ 633.630631][ T31] #0: ffffffff8f9ac008 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 633.648869][ T31] [ 633.651490][ T31] ============================================= [ 633.651490][ T31] [ 633.660230][ T31] NMI backtrace for cpu 0 [ 633.660248][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 633.660270][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 633.660280][ T31] Call Trace: [ 633.660289][ T31] [ 633.660298][ T31] dump_stack_lvl+0xe8/0x150 [ 633.660337][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 633.660360][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 633.660391][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 633.660417][ T31] sys_info+0x135/0x170 [ 633.660434][ T31] watchdog+0xf90/0xfe0 [ 633.660461][ T31] ? watchdog+0x209/0xfe0 [ 633.660489][ T31] kthread+0x726/0x8b0 [ 633.660514][ T31] ? __pfx_watchdog+0x10/0x10 [ 633.660535][ T31] ? __pfx_kthread+0x10/0x10 [ 633.660560][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 633.660583][ T31] ? __pfx_kthread+0x10/0x10 [ 633.660605][ T31] ret_from_fork+0x51b/0xa40 [ 633.660636][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 633.660661][ T31] ? __switch_to+0xc82/0x1410 [ 633.660688][ T31] ? __pfx_kthread+0x10/0x10 [ 633.660710][ T31] ret_from_fork_asm+0x1a/0x30 [ 633.660754][ T31] [ 633.660765][ T31] Sending NMI from CPU 0 to CPUs 1: [ 633.781051][ C1] NMI backtrace for cpu 1 [ 633.781071][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 633.781089][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 633.781099][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 633.781131][ C1] Code: 08 60 02 e9 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 39 11 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 633.781145][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000246 [ 633.781162][ C1] RAX: 000000000013997d RBX: ffffffff8199370d RCX: 0000000080000001 [ 633.781175][ C1] RDX: 0000000000000001 RSI: ffffffff8dcd0e36 RDI: ffffffff8c073a00 [ 633.781187][ C1] RBP: ffffc90000197f10 R08: ffff8880b87336db R09: 1ffff110170e66db [ 633.781198][ C1] R10: dffffc0000000000 R11: ffffed10170e66dc R12: ffffffff8fef4b70 [ 633.781210][ C1] R13: 1ffff110039dcb70 R14: 0000000000000001 R15: 0000000000000001 [ 633.781221][ C1] FS: 0000000000000000(0000) GS:ffff8881257ea000(0000) knlGS:0000000000000000 [ 633.781235][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 633.781247][ C1] CR2: 000000110c3cdb1f CR3: 00000000762b8000 CR4: 00000000003526f0 [ 633.781264][ C1] Call Trace: [ 633.781272][ C1] [ 633.781278][ C1] default_idle+0x9/0x20 [ 633.781292][ C1] default_idle_call+0x72/0xb0 [ 633.781309][ C1] do_idle+0x1bd/0x500 [ 633.781328][ C1] ? __pfx_do_idle+0x10/0x10 [ 633.781344][ C1] ? do_idle+0x4d0/0x500 [ 633.781360][ C1] cpu_startup_entry+0x43/0x60 [ 633.781374][ C1] start_secondary+0x101/0x110 [ 633.781395][ C1] common_startup_64+0x13e/0x147 [ 633.781423][ C1] [ 633.948617][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 633.955522][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 633.964749][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 633.974809][ T31] Call Trace: [ 633.978099][ T31] [ 633.981030][ T31] vpanic+0x1e0/0x670 [ 633.985029][ T31] panic+0xc5/0xd0 [ 633.988765][ T31] ? __pfx_panic+0x10/0x10 [ 633.993182][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 633.998559][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 634.004755][ T31] watchdog+0xfda/0xfe0 [ 634.008919][ T31] ? watchdog+0x209/0xfe0 [ 634.013264][ T31] kthread+0x726/0x8b0 [ 634.017350][ T31] ? __pfx_watchdog+0x10/0x10 [ 634.022039][ T31] ? __pfx_kthread+0x10/0x10 [ 634.026631][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 634.031857][ T31] ? __pfx_kthread+0x10/0x10 [ 634.036446][ T31] ret_from_fork+0x51b/0xa40 [ 634.041036][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 634.046149][ T31] ? __switch_to+0xc82/0x1410 [ 634.050861][ T31] ? __pfx_kthread+0x10/0x10 [ 634.055595][ T31] ret_from_fork_asm+0x1a/0x30 [ 634.060413][ T31] [ 634.063890][ T31] Kernel Offset: disabled [ 634.068312][ T31] Rebooting in 86400 seconds..