last executing test programs: 1m14.378151815s ago: executing program 4 (id=2838): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) getpeername(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='contention_end\x00'}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xc}]}}}]}]}], {0x14}}, 0x84}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r4, 0x0, 0xd}, 0x18) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000340)="3f000000010003", 0x7) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r8, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x28, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x5818680ba2430678}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x12) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00"/12], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000022bf000000000000ff7f000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000830000006909000000000000550901000000000095000000000000007617040007000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r6, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r11, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) 1m14.051878028s ago: executing program 4 (id=2841): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b37, &(0x7f0000000000)={'wlan0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000002, 0x4010, r2, 0x100000000) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r3, 0x1, 0x53, &(0x7f0000000240)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000300)=0x2c) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000280), r6) r7 = socket(0x10, 0x80002, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={0x6c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xa8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r5, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) unshare(0x22020600) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x3, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r9, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000300)=""/27, 0x1b}], 0x1}}], 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="190000000200000008000000f10f000000100400", @ANYRES32, @ANYBLOB="2fe78d385900000004000000f9ffffffffffffff", @ANYRES32=r5, @ANYRES32, @ANYBLOB="05000000050000000400"/28], 0x50) r10 = getpid() ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'gre0\x00', &(0x7f00000000c0)={'gre0\x00', 0x0, 0x10, 0x10, 0x80, 0xb4ea, {{0x6, 0x4, 0x1, 0x13, 0x18, 0x65, 0x0, 0x1, 0x4, 0x0, @multicast2, @local, {[@end]}}}}}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@bridge_getneigh={0x44, 0x1e, 0x200, 0x70bd2c, 0x25dfdbfc, {0x7, 0x0, 0x0, r5, 0x18002, 0x2030}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x8}, @IFLA_NET_NS_PID={0x8, 0x13, r10}, @IFLA_AF_SPEC={0x4}, @IFLA_MASTER={0x8, 0xa, r11}, @IFLA_TXQLEN={0x8, 0xd, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x4) 1m13.653600811s ago: executing program 4 (id=2843): r0 = socket$phonet(0x23, 0x2, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001280), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000012c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001380)={0x1c, r2, 0x1, 0x70bd2a, 0x1, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x8880) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r4, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000240)={0x84, r5, 0x813, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD, @TIPC_NLA_MON_REF, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x84}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x3, &(0x7f00000007c0)=ANY=[@ANYRES16=r5], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) r6 = accept4$rose(0xffffffffffffffff, &(0x7f0000000040)=@short={0xb, @remote, @default, 0x1, @netrom}, &(0x7f0000000200)=0x1c, 0x80000) r7 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r7, 0x400442c8, &(0x7f0000004040)={0xffffffffffffffff, 0x9, 0x8}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="180000002400010300000000000000000100"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r8, &(0x7f0000000e40)=[{{0x0, 0x43, &(0x7f0000000080)=[{&(0x7f0000000240)=""/89, 0x59}, {&(0x7f0000003780)=""/4097, 0x1001}, {&(0x7f00000002c0)=""/177, 0xe0}], 0x3}, 0x4}], 0x4000000000000a0, 0x40010000, 0x0) r9 = socket(0x29, 0x5, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x22c20}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x7}]}}}]}, 0x48}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r9, 0x6, 0x14, 0x0, 0x0) ioctl$SIOCRSGL2CALL(r6, 0x89e5, &(0x7f0000000180)=@rose) 1m13.267595898s ago: executing program 4 (id=2844): socket$alg(0x26, 0x5, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) socket$inet(0x2b, 0x801, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x3, 0xc, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000300)='GPL\x00', 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r2, 0x0, 0xe, 0x0, &(0x7f00000000c0)="e0b9545dd30a3731677b2d0bfa91", 0x0, 0x27cb, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038004000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a30"], 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r4 = socket$qrtr(0x2a, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x20) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000200)={r5}, 0x8) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000280)={r4, r3}) sendto$inet6(r5, &(0x7f00000002c0)='E', 0x1, 0x240000c4, &(0x7f0000000140)={0xa, 0x4e23, 0x9, @loopback, 0xffffffff}, 0x1c) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040)={0x2a, 0xffffffff, 0x4000}, 0xc) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) writev(r4, &(0x7f0000000240)=[{&(0x7f00000022c0)="f41421851204c67df789ee7baecf69717a747b4853c9900c3afa64115529a88985de8e2be97110852d562888be3a8862a0d6b9be953141229a857e96663b9632beced4a5f0bc2ff21772b7307ac8474a035a125e11c62252e53fa34b13acc5a5ea4ea29b3886d3adf6aac71ad26028ab5ad08fbfe37ec530624203abd294743c34b4d4ab2212cf449520727f24d6e8645ad6a63a0e0cbd7724aa3c4eef829a917867b366f13d47492c7f4322aa76451a6aaf7e0db31b2b85386d125a3fd55dd7e7c0658dc93d0260d22a0305d2422ccd5d29c0d7c9751ad4a282a87a09c55f8c9bf076b512119f55c9e5ee29b423200065b6444ca2c095b9018abbe4e6e38312681224ac7f216e96136b81d6869b8018f4353462c2327dd05b58f0038bcc9d6f1eb11a6e1c32bac66b49917f2af3582d3b3efe89f0b58a2b77ae7ae6116101a3384926762d67133f68a84919b7e88535f430aafafd95e42760b427f6594d4a512f3ee533f8d01056fd091795e8cffa081f7568508a9e54cc2e99cc4df03132988678eb5b57ac51a2ff96f15ce0da8f93ce57b7c4223a27d9a614aa625ffd2b6e59222ed630fd883685b06be34cac9f55a1433ece80115e431a75f742b8e69541209fe875775d634e4cfe790c4c268e8b3684129d088d6fbb85f6770d970d41736174600e99a987bc7a46a208bc50b1145aa0c139007af1cec1a4f45b5da38e04e862bd3395dea89c36f4a5f6f9abbe150f13a9fe266268a982fe98dcf672a3933b5a1de9221b41856c5bae1be37f1e5b116e262b649764d30a0dec4fa348f9195f9271bea037e0d87b708b05a0be7bef878bdb449407df85f19423606f3a307a4916b5bcffc312dcb04f2fd5c5c2bfc4c6ab8738fd89dd4a50621b6cbf90597fe7aea152c29b24822357228a877893d26e3f36808c98ceeb277e2c5797760d4e62a2fca881512c3e4c5e45252aa6472fc86b81409d52506e7529fc7e90115289a443de765554be54ede290caa3e091ef11af5eccf43c8dc6904faa4ca1c063c23f0a3035b0d8d204dbf7759be47f719b4a08af6f1b5620ac67b695918b57e1297b0d07b37647c31e4e05c69ed1a2bef9b46670714fc063e109484fe4cc5783a5d674a0723b28c23bd386046b1e234001bdfb32e65e3defe30814d6b7e0420bb94b8823383d04ed2db8f936a172c4485fd0a3de147e35f0e262365572e924d0e301ac385b66039df2f0736baafbef5225b07d7978ef7c936e35a052bba26331dd75e019a36ab84f4893e1e1456017bd94bde53791084cc79b309d3d33ec891ccb1b95b564e7a0d836947197e4401dac027e0c9cf93e66798df273549e7374f8776dae9f7a10ada94d788dbee44e8a1a72fe0c936815aa20edeeba2f81fbd5781868fc0bb57846df8d5c81ac8a2630543119f7cf5370d7b179198659d59910edcbbd79dfe06ca38da65dd29ae13e2aad826cbadc88c5d48bde9345477e8567e4de989cdce8ceb30fb0e082559b0b5ae2ba2ae911a900abe347324b949c786097a1761d0acb8fe6fa6a29aa1d93079257665a0dc123b22fd2aed2ac55934501c830c28dd773f227d127d6072d4f1da73ae0f6aaaa5fbdcfad20f1894f621c9e838e80cd679b93310200cae3bc363bc0be434c9b0b7d3acf8b5a558031848d5a301d262ea4d7c9e825420cbba3def26778a457f7d94a6bc625cacab7d1061e7197f51834c99bbd514229dc22491a603339be22f5e69c03eef8f9af93f97d75a7090220a05f5503392c43441045b6fa8ea7e7589f7d974e4631060b89d94301337fb6d416a050a49d15fdd75eac847be03fb6363fb97c32bc1203cf59512af290b451c54b3031dc842979c0240fea5e1756f68df768d1245c799f008acef65c6f1d22c45a1fc181d3b0bf3fa8e6781beafbe1a9258c2522b0926121be3ca8eae9bbd27461c0386b754d20b3984b273603fb7d9732fe27345609da6f25ecf9a6a14d1054971de687800a80a6f6f46e855ca04089b2b4c6d983140a14a09b9d78477a09cc6fd4498127fd43538c22a448d6b900c00542220dbacb8879622e8c03c34b79508f53404e08b9153d3661cdf57196477391acb91851bf78ca2fddeb7d9211af9e3c98515552368bdb90d95a95333cc6e7583268a2cad55de182443140175ac37d0e036538277dc678a36d1a61ad35fec37010deb71e2a07702cfc1ff97357ad64d5b9ca2adc0a8a908e3ea0b50d02b25e59b346dbfd721733f0a60abfd72fbef398ade01703ead621ac14f527b0a1371994ad8f98324cc945997d808909b5b95a8905f9c9af57f033bb9f7ad3976b278c50e9860df654e166fa17d08e1be19419731bcdda4306e95dc4c1f854895b77fa66401e916bc83dcb3a926dcf1cfe165d947e44add4ed3eb43233a32fcfadd5178d93867854d6cff0a92067a511077c8e98783449dfe1a190a6b14c333da44224fbee100ffb29aa9e8d987e6c79ff1715da2d3fea1a51895c876518ac3bd65d4baabad320e1ad8c0c0d1567b4c65063f58b30fb50c80de11984613799b8bbb2ba56586e2c5df2487e49a98c8bf8a24e328c0ccd2ffa470729b9465d5333317aa34b72bcb822d6ba1e8a0cb348be0f2353bdafb7800841b62878a6a09967bf875d7030fc27490af65ffaf01629a667754ebae5522cae302428f11ef960c9c0ecf9140538b5dbb2264985e6920a87e83172bd82c60a376f150576e576e8e4116f8b8245402954e306732cba1d6771ab20d11927c2f1412a07e6b2b3ad58cafea83ceab9a0f540350efdf1db1e8ceaa22136d8c6fefcc57589683cd0576aa18e9faf8dbfad8b52ba50c77c9f58ed814ef8d942e176911a7bcfa093fc1ddb0cb989cac9a107c2fe25662af724de5f2645a2cd1ff33bfb1e2400182eb15e3d6ec7106837ae3db51c508643471164fbe5320c420d96a677e5722f7edf179ffd224016dfde45241fee72123707a5c4f064e2d0b63b9cc80feeadb24af7e4a1e68485f77b85255182556522396daae7b7f42a3c9561d66924a40f8399cd1551c35ea42ae55e989c7057b5a1512511176db87624c1b2de2f15c06643b588259c9f0d3a468a26045ec37c4fa305ab80a54e17a3050839635c43142a04b38821e1ce08a9c5b47fa9c0f43e0b70a063323cb70d84593142e383504c3069ca9d6baeb5f8122f72205ed3f551a7dc847f0d5e724c35a812ca5a99f1913c17148875f3e148f8485f1a6173e25957470a3200cb3ad922171d480d4edbb03dda985d9a54ae0dfb5d3060a66c90d1ee15a93896566f45ea55a9e16cf81c97bde02cf59345a19f275707311ea6a1a09011bd165e8318fd3956f00c1e2f3f7078ce9a9c205100c6c22e7a700fbda9bc7bbabf605e986736e87a83ab81761a8f377ea79ba4449f73a6e593eecf02c616ed8dcd4259a04a66acd7b7f22bc896b85edf5a9882644a9f321970346f9651eb7a84cdc13b6d5baf308d043ade84660433771cac4c1a0c0d9f017539358aa64e0a8affa49e4a88367ef77f99d2d56e25633461be5d930577fa7d6d377a995f02737aeeb13076369e2a85edf4e6680a6566ac5269f5f54384bcc02a580a84eed498af43cfa6dd658c68c96287dc53b40d613dfabde0589539825e01d7e8028e10be3bcb737c273f502e3235f65fa332065b56527a8f01f8fee499e2688ff74ad6e7845dcb4d81c6f0970099e8a8b0c01d7030a4b934398fd287031f9213e12e64d6a2c6be7a807745698f4d6eac0bdccebd93e970be9c062e4750b131e837926a157ac6b9ffa029d27fe9f32a9446e739466b6de4e257c38b7c8cb6fc174ab609cb95e7ff5c72c92d6fe8550cfc7e85ff9dc47cb16322f2e0a6ab13298c60d9cc276de5c693040f374a35624ca2592fb5d1a35714f662a92c6164551735422d24c6b45973d6ca4b7c9bbc304b668f59c5452802134dd08471e5b5acf152aae55a086b58d30f430de789c5fa8eb44e9818d94c3765b175e60e511d490b47d191c07d02a12cf997661a92b3a0e55a384fbe7a89d8372231205180a05294ca54f4d9e2dfd65fd9024d2da7f7633d02808886eefc0dd3bf2ec9be38f61bfa5b8a0918647a63a5846f13b2e9a44c2de0ef916c3e6f006113288d73a299eff4db3cdccae367cc7fc72ee1f184f1321e2905ce504b42705afea13f5029861a11d136e7784a0382cc67fb55fce16d98d42c57bb2ed7653207505c398b5bea5865caa53a00ba5c25db4aca58da5b295694a0a6f0104bcf088a0a3277b61dde23324e69701c439fe6b1b440c85604185681dfccfb8b04204ddbd8216a7e960bf09fe2b87bd34a12e93d81a87fb4fee9ef8a75b9ae18d12417a5ed1c51ace8ffff2f195a9ca2a3d8f0d6af39ac6405d1b61be1b6f6f5f4dfc0ffc0ff0e6097ffea1b7eb93bc238683b08ad59d04ad76d9539fdd5ba5a863449cb541c860aeed24f6dc1f055213632ccb4b024bb32889a7df84e10976a565e3743fe1aa89510eb7c34306eff50a70ae37c885279bca6d8904e970e43382135e15c80bf2cc58a6759c11574dcb5d4a90ebddbc491d751c26fc2c2915357a8efbcb705f7cddc0001ffacb65bbb92d19d24ad88c8a2a21aa9590470a673f794a3cde37750f9a02a0d5a3fcb3211068b1188082a3404f69f1009b87936a2b688b183c80977cc45e2ba156ecc96d5c621eb20a94ea1", 0xcfc}], 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000017c00000400fc80a72601"], 0x26c0}}, 0x4010) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket$netlink(0x10, 0x3, 0x6) writev(r8, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) 1m12.386972958s ago: executing program 4 (id=2849): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r1, &(0x7f0000000400)=[{&(0x7f00000002c0)="2e9b5b0007e03dd65193dfb6c575963f88a86067", 0x14}, {&(0x7f00000006c0)="cb4c", 0x2}], 0x2) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_ERSPAN_DIR={0x5}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x28055}, 0x20008090) 1m11.81109966s ago: executing program 4 (id=2855): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) socket(0x11, 0x4, 0x9) (async) r1 = socket(0x11, 0x4, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000780)=ANY=[@ANYBLOB="b400000000000000791090000000000063000000000000009500000000000000cb5239a01b5b902367fd5ec1a64e367acb74c7e00c2f2bd72b3a0be2ea96caa37fb3469e8505342e47fc8929a6a015"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r4 = socket$xdp(0x2c, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/96, 0x2329000, 0x800}, 0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, r8, 0x800002, {0x2, 0x0, 0x4}, 0x2}, 0x18) sendmsg$inet(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{0x0}, {&(0x7f0000000200)="1479c369caf28b0c600d5d976b000089bdbf4075277f938a9d8616c6bf", 0x1d}], 0x2}, 0x4048081) (async) sendmsg$inet(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{0x0}, {&(0x7f0000000200)="1479c369caf28b0c600d5d976b000089bdbf4075277f938a9d8616c6bf", 0x1d}], 0x2}, 0x4048081) bind$can_j1939(r6, &(0x7f0000000140)={0x1d, r8, 0x2, {0x2, 0x0, 0x4}, 0x2}, 0x18) (async) bind$can_j1939(r6, &(0x7f0000000140)={0x1d, r8, 0x2, {0x2, 0x0, 0x4}, 0x2}, 0x18) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x74, r8, {0xfffd, 0xffeb}, {0xa, 0x1}, {0xfff2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x850) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x10000001, 0x7840}, 0xfffffffffffffe2f) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(aegis128-aesni)\x00'}, 0x58) (async) bind$alg(r9, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(aegis128-aesni)\x00'}, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r10, &(0x7f0000000600), 0x204083acb88ff8b, 0x2, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000480)={'syztnl2\x00', &(0x7f0000000580)={'syztnl0\x00', r8, 0x700, 0x10, 0x7, 0x7, {{0x1a, 0x4, 0x0, 0x0, 0x68, 0x67, 0x0, 0x5, 0x4, 0x0, @multicast2, @local, {[@timestamp={0x44, 0x20, 0x44, 0x0, 0xd, [0x2, 0x2, 0xb298, 0x7, 0xfd4e, 0xe, 0x928]}, @timestamp_prespec={0x44, 0x34, 0x32, 0x3, 0x1, [{@private=0xa010101, 0x740}, {@empty}, {@broadcast, 0x5}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x6}, {@empty, 0x82e}, {@remote, 0x1}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000480)={'syztnl2\x00', &(0x7f0000000580)={'syztnl0\x00', r8, 0x700, 0x10, 0x7, 0x7, {{0x1a, 0x4, 0x0, 0x0, 0x68, 0x67, 0x0, 0x5, 0x4, 0x0, @multicast2, @local, {[@timestamp={0x44, 0x20, 0x44, 0x0, 0xd, [0x2, 0x2, 0xb298, 0x7, 0xfd4e, 0xe, 0x928]}, @timestamp_prespec={0x44, 0x34, 0x32, 0x3, 0x1, [{@private=0xa010101, 0x740}, {@empty}, {@broadcast, 0x5}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x6}, {@empty, 0x82e}, {@remote, 0x1}]}]}}}}}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) 56.108314687s ago: executing program 32 (id=2855): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) socket(0x11, 0x4, 0x9) (async) r1 = socket(0x11, 0x4, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000780)=ANY=[@ANYBLOB="b400000000000000791090000000000063000000000000009500000000000000cb5239a01b5b902367fd5ec1a64e367acb74c7e00c2f2bd72b3a0be2ea96caa37fb3469e8505342e47fc8929a6a015"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r4 = socket$xdp(0x2c, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/96, 0x2329000, 0x800}, 0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, r8, 0x800002, {0x2, 0x0, 0x4}, 0x2}, 0x18) sendmsg$inet(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{0x0}, {&(0x7f0000000200)="1479c369caf28b0c600d5d976b000089bdbf4075277f938a9d8616c6bf", 0x1d}], 0x2}, 0x4048081) (async) sendmsg$inet(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{0x0}, {&(0x7f0000000200)="1479c369caf28b0c600d5d976b000089bdbf4075277f938a9d8616c6bf", 0x1d}], 0x2}, 0x4048081) bind$can_j1939(r6, &(0x7f0000000140)={0x1d, r8, 0x2, {0x2, 0x0, 0x4}, 0x2}, 0x18) (async) bind$can_j1939(r6, &(0x7f0000000140)={0x1d, r8, 0x2, {0x2, 0x0, 0x4}, 0x2}, 0x18) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x74, r8, {0xfffd, 0xffeb}, {0xa, 0x1}, {0xfff2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x850) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x10000001, 0x7840}, 0xfffffffffffffe2f) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(aegis128-aesni)\x00'}, 0x58) (async) bind$alg(r9, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(aegis128-aesni)\x00'}, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r10, &(0x7f0000000600), 0x204083acb88ff8b, 0x2, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000480)={'syztnl2\x00', &(0x7f0000000580)={'syztnl0\x00', r8, 0x700, 0x10, 0x7, 0x7, {{0x1a, 0x4, 0x0, 0x0, 0x68, 0x67, 0x0, 0x5, 0x4, 0x0, @multicast2, @local, {[@timestamp={0x44, 0x20, 0x44, 0x0, 0xd, [0x2, 0x2, 0xb298, 0x7, 0xfd4e, 0xe, 0x928]}, @timestamp_prespec={0x44, 0x34, 0x32, 0x3, 0x1, [{@private=0xa010101, 0x740}, {@empty}, {@broadcast, 0x5}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x6}, {@empty, 0x82e}, {@remote, 0x1}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000480)={'syztnl2\x00', &(0x7f0000000580)={'syztnl0\x00', r8, 0x700, 0x10, 0x7, 0x7, {{0x1a, 0x4, 0x0, 0x0, 0x68, 0x67, 0x0, 0x5, 0x4, 0x0, @multicast2, @local, {[@timestamp={0x44, 0x20, 0x44, 0x0, 0xd, [0x2, 0x2, 0xb298, 0x7, 0xfd4e, 0xe, 0x928]}, @timestamp_prespec={0x44, 0x34, 0x32, 0x3, 0x1, [{@private=0xa010101, 0x740}, {@empty}, {@broadcast, 0x5}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x6}, {@empty, 0x82e}, {@remote, 0x1}]}]}}}}}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) 3.882884317s ago: executing program 0 (id=3289): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="00006003ffffff0008004c00fe3240000000032f907800001fe1e0000001a0006558000c9078010900"/54], 0x32) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x84, &(0x7f0000000180)={r4, @in={{0x2, 0x4e22, @empty}}, 0x7, 0x4002}, 0x90) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0xe4, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xb8, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wlan0\x00'}, {0x14, 0x1, 'veth0_to_batadv\x00'}, {0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'veth1\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'wlan1\x00'}, {0x14, 0x1, 'veth1_virt_wifi\x00'}, {0x14, 0x1, 'veth0_to_bond\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_DELFLOWTABLE={0x24c, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xe8, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM, @NFTA_FLOWTABLE_HOOK_DEVS={0xcc, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6erspan0\x00'}, {0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'veth0_macvtap\x00'}, {0x14, 0x1, 'bond_slave_1\x00'}, {0x14, 0x1, 'bond_slave_0\x00'}, {0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'pimreg0\x00'}, {0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'veth1_to_team\x00'}, {0x14, 0x1, 'team_slave_0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8, 0x1, 0x1, 0x0, 0x20}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x110, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x101}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'ip_vti0\x00'}, {0x14, 0x1, 'bridge_slave_0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bond_slave_0\x00'}, {0x14, 0x1, 'wlan1\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'pimreg0\x00'}, {0x14, 0x1, 'veth1_macvtap\x00'}, {0x14, 0x1, 'veth0_macvtap\x00'}, {0x14, 0x1, 'syzkaller0\x00'}, {0x14, 0x1, 'dvmrp0\x00'}]}]}, @NFTA_FLOWTABLE_HANDLE={0x0, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x10}}, 0x378}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000000)={'veth0_vlan\x00', @multicast}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="400000001000030400000000fddbdf2500007400", @ANYRES32=0x0, @ANYBLOB="0008000087520100200012800b0001006272696467650000100002800c002e000000000001000000f953a45184dd955283cc3c932a858b0d70d9034e13fe9be50a189a8190cbf7c1f6b499ec447bd9892666e1cfe60573b9b9adc65ece9395bd4922f8cd910e8695d0e1181b580d08cbec2bfe2977d8f180e6b9ffbfaef8797eec6e71e0aef9a251eb7e3efbcf20ab868bc8dc0764ea7edee53e78669b0015c09f9cd8de7c63c801c3d54c6602ff1627f4d96ef09e8f3334d858cf08bd9192ed6246eef0bdf83b634d1e230dd7387a7afb03bc307e090fee7d4829206afa80d99709fe5d06"], 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.446204562s ago: executing program 0 (id=3295): socket$inet6(0xa, 0x2, 0x3a) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a499d0000000000000000020000010900010073797a310000000008000240000000030400060014000000110001"], 0x54}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010400000000000000000100000008000240000000020900010073797a300000000014000000110001"], 0x50}}, 0x4000) sendmsg$NFT_BATCH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000f00)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000003ca63bdd9d84e00020a010200000000000000000000000320000000000a051befebc3000000ff00020000040900010b73000200"/92], 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x20000824) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x7, 0x4) socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000780)=ANY=[@ANYRES16=r4], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r6}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="4000a6000a000200aaaaaaaaaabb000004"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket(0x10, 0x3, 0x3) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000180)=0x1, 0x4) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x48081) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000300)={0xa}, 0x4b) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 3.147197409s ago: executing program 0 (id=3300): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)={{0x14}, [@NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f0000007cc0)=[{{&(0x7f0000000800)={0xa, 0x4e21, 0x6, @dev={0xfe, 0x80, '\x00', 0xd}, 0x6}, 0x1c, &(0x7f0000001880)=[{&(0x7f0000000340)='(', 0x1}], 0x1, &(0x7f00000019c0)=ANY=[@ANYBLOB="24000000000000002001000000000000000000000000000e14b65b156c4d1400", @ANYRES32=0x0, @ANYBLOB="00000000400000000000000029000000360000001d04000000000000000100c90300000000000000000000ffffac1414aac910fe8800000000000000000000000001010014000000000000008400000008000000070000000000000014000000000000002900000008000000060000000000000014"], 0xb0}}], 0x1, 0x931766f6319eed40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket(0x2, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0xb, &(0x7f00000000c0)=0x1002, 0x4) sendto$inet(r3, 0x0, 0xfffd, 0x80, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) recvmsg$unix(r3, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x2000) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000080)={0x0, 0x0, 0x7f, 0x8, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x35}, @remote}, 0x10) connect$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x1c) shutdown(r0, 0x0) 2.726324573s ago: executing program 0 (id=3307): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x5, 0x0, 0x0, 0x2}, 0x94) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x48, 0x10, 0x403, 0xfffffffc, 0x3f, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x7}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0xa1}]}}}]}, 0x48}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x5, 0x0, 0x0, 0x2}, 0x94) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x48, 0x10, 0x403, 0xfffffffc, 0x3f, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x7}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0xa1}]}}}]}, 0x48}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'erspan0\x00'}) (async) sendto$packet(r1, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) 2.724817023s ago: executing program 2 (id=3308): bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@bloom_filter={0x1e, 0x3, 0x1, 0x0, 0xc211, 0xffffffffffffffff, 0xe6f, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x5, 0x9}, 0x50) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000ffea0010000000e0000001000000000000000000000000ac1414bb00000000000000000000000000000000ffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000084010500ac1414aa000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe80000000000000000000000000000000000000000000000008000000000000000000007f000001000000000000000000000000000000003200000000000000e00000010000000000000000000000000000800003030000000000000000000000000000ff0100000000000000000000000000010000000033000000000000000a010101000000000000000000000000043500000000010000000000bf0a000000000000fe8000000000000000000000000000aa000004d533"], 0x23c}}, 0x3000000) 2.554227594s ago: executing program 2 (id=3311): socket$inet6(0xa, 0x2, 0x3a) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a499d0000000000000000020000010900010073797a310000000008000240000000030400060014000000110001"], 0x54}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010400000000000000000100000008000240000000020900010073797a300000000014000000110001"], 0x50}}, 0x4000) sendmsg$NFT_BATCH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000f00)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000003ca63bdd9d84e00020a010200000000000000000000000320000000000a051befebc3000000ff00020000040900010b73000200"/92], 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x20000824) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x7, 0x4) socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000780)=ANY=[@ANYRES16=r4], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r6}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="4000a6000a000200aaaaaaaaaabb000004"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket(0x10, 0x3, 0x3) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000180)=0x1, 0x4) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x48081) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000300)={0xa}, 0x4b) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 2.462043866s ago: executing program 0 (id=3312): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8fffdffbfa400000000000007040000f0ffffffb70200000800001f18230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2.254438124s ago: executing program 2 (id=3317): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='mm_lru_insertion\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r2, &(0x7f0000000180), 0x40010) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r6, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}]}, 0x1c}}, 0x0) write$nci(r3, &(0x7f0000000a40)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x0, 0x3, 0x5, 0x4, @a_listen={0x5, 0x2, 0x4, 0x80, 0x3, 0x4, 0x5, "", 0x4, 0xb, 0x2b, 0x3, 0x1, "f5"}}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0xb, &(0x7f0000000040)=ANY=[@ANYRES32=r0], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0xcf) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r7}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r8, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x5452, &(0x7f0000000a00)={'dvmrp0\x00', @random='c\b\x00'}) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r2, &(0x7f0000000b80)="b42831a509a8a7f3e2316ddd275b5df69febf7555816b9e4422bff5f24fdc69dbdba5495acca45cf49022c6fd532e8825efb76c13e4f79640a3a09e7402525eaf41862ff3aab76ecf196efbb175fc63b470ef6978d5dcd40429fae555300c2be54cd2c6d92ea46e0d2f1f97b9f4206c031bf5f331da9babbc6c4d12eebd492ff9c00c40834f26eb7f98b2bd20ee24a5cbf234cc0cee08f8e00d0bb521c15515894e44eb801e0fe7b960014ede4fc5a9cffc44311fd4f0ef2cf8a667ebd53697594dbaeef70f127a23832811d3568cd0b4600bbf75906f522164a3afa162a310aa97ae7ac89655037cf8c8cb9ee5d2d09151439c25bc0f69e8768e7ea32a6490aba34687d7e0140307907922c61e5377700a44fc51a6cfdbdf1874894c37014b59c9faf2f2be40c0b8f88ceb0a2ecb99615fdab99be0e8731fd25b4960187d01d0301845913b87719ef9edca20b8f46795b800ef8bfeeaa6da922df4d35dea2c34ca01ec82a7949a2f2c8c452269f7ecc49f29ad66b788e0e89cae4af3417096c54584509b121bad38f476256413691e6b7874625ab86622c6002f2e70b7ef6bf672a4213376b9c9b44b9987df26209811f6ca95d8075a2799c290ed02e8bcaa05939846786f17c3aa4779ceead602bb0087426e5e8777a02e3e06e4ccb32cf58862e3bd521e07b27372e5aadb88931b9ea9abd728c09dbad4a4c76c9d2f4cd6ec88ca23306d6795c43b090f3efefab449ab34ae984c3d47a9d8ee4bef80a09753167f7735b83e9d80672253f424ec65499accf1e52502afeb542afc2c3efbfbd5ac34443600f7f6caba1bc6978a1a2ef07bacd4376932cdf5b9c76c76322f6faa18d2518a066e28d9e17ff07a993d442af44f577dfe45d8bcef227e84fec3c3b879d8746a0b147d811b53abae11d9a6867ca1a83582a86c50d992fa37c662185ff1a8680d1217254c350bd0947d2b93ecd5dc2cf7105abdf3bf20feb7eb5215d4f4bd93c47c755756a95a5ae13344bfb60b96da11141ad42fe76a587c23f60c8b0cd7d5ad8562e738e0eb37c2f168f8f7bd3ee0ab5b16f7cf8f38176c30ae1c69e3953be528b8472ad5f395ac62d90cc330b9d9f8214c848e7aa2e4e4659653f2048a3bbdaac650dac1eac1927c5154f76ed5e507a50a5ff22406d3c6a73596fce81585983a287f98a42fc9e20f0f9d4d293859f0457ad06d5928bef0fc2ab5d236f374b45b7c3a5e6edc8d8ad9a9af79ff15240849e24d314e6abc278be4871e25e74205cecefed149da2cad5088252393236465528e245fdc54c3b42b13b9d69ec242d3bd0437663e93c3a33c2df7c050e12456f7c8e1c76a39ef3e7ea9606deec26ec48baa79ea7ff44358bfc816a4fe92245b4d6d6df3f4f44d9c61da0a054a5c21ec3cc143c8a60cce7be5326174ff7f328e03a838f7680f6bffb25d5f7b9bde72675514db336907073d9cc8b01324797d334f504209bbc2f67e590cee906b7732490fe4f6dbf8498dbae72096eb4462e8b3254ae49ee1b6b774cf61d9c7db1c27f31f678dd2d7cee26c59b2d440a8bf4e5635e4fd246010bcf92ee5ec16175c68b767db4f1b665867bdeba0645106e58bb0f1a316134cbacc0e2b610cb5e9665aec36d762a463a26ee113e12e21eb27cc67086eaa530c35f65ba94c6dd157d769756d4958de6ba2ec5dce4a1425737309bc168b09f13dab1a05d2abc810a2b26b3ac51092d3475aa4787bc2c454ad36305d0a6457590cfe79422c7380808d730c3f6fcafe7957a0a26f76085086b6e291b49499122d5b904484ddfd92531d577c44a538e46df338a3d91b463a2547b8d582b213088a6467cef29fb29da4d0c84df9b8a6b6fb6406a429c318c2ea3735985653d414de3650c5b1b0e3aba3b32a006e161c83d57a2989a8edc8598706bbc7731a07370d0aef3b130a661cb7e5d4a4770e8d0fd31805bd1fc23ba91cdff1449a03fc69b9be5b4ccd444fa268eb42933677427de7fe0e5d386f80686b9bde7dfff696d996bb47690626bade063770b0069f88075e72c628055b36999719a1d7aee03da6a2071a93e878841c4b28f837553840e968cdbb35f3af7225c735d6caa51d0241e13e0382206cf2e0fa4bef4bff1c0945912329abd9da51a713b3f1e85ecd842adace1b64cd832fdeff5909b65ec8dc0f50c12f3370a2d5cdf33441ae741d87004ea7d27712727ba428e7b68d613d3bfd887eb7c07ebab6678c46f5139b57169abbffb1a30603cd2e0d465921c527a7acbaeb04ccaaf412689b12e5a814065f03ebd4d6193c063d33f56579131c97e54a9004122cd7dbca8941315317e3c75086cb961e84162cb0cc0494123a548efac861f34c1633fddb2af6cbc3f5b8816be16f9eb5831caa39583387b3c18d677479b1659da3b2c90afb86c575d6f5fb8cbc676f2fbf46eb475ca0e382693f8a2f591d0a6ed88f98dcd52330b4a928f84e64261389c96154bc380f2d80b3018c8fa6b593ace4a6018b14cc121856545dc65c41d7297545163832feeb2d6745981662867dba6933079755527252c5dcd9c2cd3d0beb25062c7ae660b5af7c7384a06a47a94c5ae2e546d0516f280397d584950a76f7f9ecf23b46e50f43247356558fe25c9221291e5453e4efd80dc66e39d5085b3f99aaa8967575f29f2a5d4cfaccf72488bf347240628bbe4b0bd53fa07faf07d304cc8a696f5a097f4cc08a7e5bfad23a38473eefab034a2c689e28a3d90eb2c90dc727a97ede10dc221bd505315b89286e60d503c05eff4f36eb949e7184a090a0be28e5b2e16b79ecd572fb5fd47d1c4f817284542c92282c6d3be3e91778473c1ccf4b35c065c3eb207b7636523460c238e1cd17c3dd9b80a9a8561661fcfcb31b60ef915c4cc21ee5dc6514df17ff3ed08bafdf4c90c2dc57834ec879a111a2d1b723e27e4aa9a7fe1db32b9af831ded47842322c4770549975d691984b3b6cb7e5c6311c30ab172fa11b25b82412c1d44e994f0ad6e791f20781205dfdb15fa448ed53acfea626c6926d9a96278eb03c706689b9c7a10337d45d4964d99bab31b026695a324bac39013d28fe66c841cf72f1f5b64f1d0aa3d7152a4bbc85404c145cecf15c7be18045d56eb4138f63f1e9804491b3c8e0386ad8e116319254649e18f935d8126bdec0df3e8596dd788c78a226f434735db43609c6f5e2f1326c424e98f83ecc7cab67f445ec638e8b39f7fa3201946b8c6c9c5cd5d517b77d6c724a00af87af28f82e12177bffa0bf7c165c6666c213b80a7298dc73fec7461a17d840b2def9f26676dc6bc2d879913bae9c571322f3c2904c81e93f24b1933380a0516fad0a81d1292c8c25453fe17e330a92433486ff74e60d5d0ce1a967e80c71883a284e3d3a087a079e0856e4674b9e4fd60fb47300895faa96714c94dcb766d74f59441497e84e94e2a1248e80788077d87235d381cd9637afe650a543fab9d6f4f9739060f966f786edddae5e906841ccc95a325fca1addb9f3ad3a0c886f063720ee163d2337d0159ef0c6d6b50094b770d3f7ab8f408e3658ab9a02f5e80c30638143d83291f499302b38614bed41e314976aa55f310308a56155a2d376d852edb6775171ddb86efd762852603298ffeece9abd869f96b81ca05ee861d94dc1d0bef92b05d26d49804e58b8ae7bf4e2eafb673e4a6ff3d41a14966076e45ccce71e144e1672e42d9fe6fa84f0a8743f0b3da42a373f8e8921f84b425dd456df15437cdbd9fadc64fc1079e387ebbe28fd0495b088c0e3b8bfab289b8b3e1c8a7fa7a290c3b4ea92c850111d1ef9831ecfaddd9a6e79d6e02e1dec6456b9acb8739965849cf35e6bb2b834e3dd49b4bdec9b65a7e219b4f5483d81f74bf4153062f020c4bd54a0f548a3e9aa631218cdd83425fa8a6c9ca9a14a22870d2e5ac6f32d1cf8d8a83ee50eaa6b0cf4eb9e4b5d7e251afd6cdda12e70674cbe38de9e5f0627a07abdf5169809534f3318089c1bddeee23a62f3ea0141eac66b696871125aad5b9cc5153d85952cd79a88cd72452e632f24ccc8403ab2aa9b07476433bf57a6cf32904c5762954e8e6ab8e5e128637ab09aec47fbe51d436cdef147fbee2425d23c4ebb8e29d17461aeb43b28e2dd5def64b67edb3c323a91cbd89e8d22ff6b1c9cf493cc3250e6c737e2513f7e4247ef12ace41f546b8391cd70593019417ef6b6faaf2c100f8c2f7ee90cd14f731e4b81f9f040051a9041656583dd0c19d57e11f9b7cd4c2c94dd958bca14e4e600ba2457eb2241dd7091114a616201fccc1e392f5f4dde3fca9b0784f6dd0cd6aeea9f10481545b3ee65b6dbe097ceeddf2e81f4e3bb8edcdf07b50005a7f89155e1bb5867e8c3c215ebae394f398a320b121a0a7892dad8189fc6f010d95509f62cac1b0b7de91f9812cf96b920f38906a5b12965f87b6323f688492a88cb1a0cf5f03598e1b8c84811f5330bd3a7afc4fc8e434b35620d7fb39f77f136ca78e1bc61d2f6d82e88c9d63aec860be7dc0863c1d1ffff1994fae91db0cb79788a2da57c90d8bde0c8c15dbb84af384d92805e61f6da83f64ef0844a31af546dcd7bb6364573c1146b41d9f3c5c81224cc4ef8466e6eec608f0e282d138e70e191da6e4f05b2776874c8200bb21649cc9776c46f1efab37252fa9f8a9469210fef873a98100f7d6bca942154a43d6a66625b3bdded7c0add7a97cbbf6b89cd233495c14836ea2bf900c42b0bca3068a8295613466c5da08cad7c88fdb6f7276da02c957eb6b429dd0d5f15be21c703f66202dec4db000a18441c8d0e5de206af28a3f4029eda9478d2bfd22f56e7899ef2ca87a3f55c20fb1c077b29fdcf27a19691ff5f823d4c874cd3db2d07e9038167d47e7187108c6d5b50645ef85ecb2a5b0b3d308a222ab1b42ff22071e47ad12f495045b8e83b532f572c06a175d7abc8431b4aa9e2bfa149abdf75823d8d78939fb804e1c3ada288cce09e2efeaaff82abb3aeb5399b2e9b10ca00bba0b1704cae7752d2c1e4c84f3bf0025ce1848c14868971532e4f2f05f4b80fd3d472728ee64e25373c2f7ce7ea030a51858cdd74bded25ce3d81257dbbfd21334885e708a2b7cb0ff436588dde69b6c5ef154ea8d38a7b319e9f7e0d3e8dc35f29091429ce65c4ddf49259a798569aa4fec3eaa54c91ef1cf045bdf6b9d358eee5a0f48e5725e8f65a596157da64e2250ee01af4d475e00bde1ff300f7a5b479275959aca8bc09d8151814afdcaadb3dd13e1d778470897cf4f99bf57e1ffb1829525430f0bc5696829d9dd5baa84b4b0abf84ee154995deaa91039b414c6f12751d8760c4d16e95ef54bd110d4b4766c8f7f66a40018b0bc9f2266c5ef7cd243ad686f7e67d859eb4432029742e8acc35293badf22b082b80a2bd89acf784b1953f271c62e8704bd7248e2f8a4ef9bf38324fee451c93a8f8508acec1edd8d263aa492c7cf44b94ba9e002395d910bfb42a27c166e1bd7d776cab20bdea1bcd1fabbcc57d429975e500f2789cc9222c8038e8ab645685c44b505cfdc8fd0ad81f653635d12a8f6b17cdb055c2694ee2bc18d59a4f9f6cd312436a3572d63f129da71971182ae23dbc6abd6f89f56cbba0950986422762bdf1f21573c58acca241d7a01046594b89771d4db8728c7ded2ec88af825035b312afb604db7da0f32c499a24f65c94ee20f95bd0b167b4a3e3a16a419502463abe266a190fc2a43207a4a6fcad8b188ab88275d86d0bdf02bef6531822516f7a7c97607502ba4a07f370"}, 0x20) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$SIOCSIFMTU(r9, 0x8922, &(0x7f0000000b40)={'dummy0\x00'}) socket$inet6_tcp(0xa, 0x1, 0x0) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r10, 0x6) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0xb, 0x9, 0x10201, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000280)={r11, &(0x7f0000000000), &(0x7f00000000c0)=""/157, 0x8}, 0x20) 2.239439409s ago: executing program 0 (id=3318): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) unshare(0x62040200) write$tun(0xffffffffffffffff, 0x0, 0x3e) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r1, 0x5421, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002021702500000000002020207b1af8ff00000000bfa10000951234d35864aa628023ce005f3d367c00000701fefff7ffffffb702000008000000b703003e6d000083850054308de8c7749781c53da224ccde11e1586e8521a654fc2538faaff61c75b305f68d9e6e226e602f10e29e98c99a9db3afbe80cf"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) syz_init_net_socket$llc(0x1a, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000061000000b70000004000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socket$l2tp6(0xa, 0x2, 0x73) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=0xf) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x40000102) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r4, &(0x7f0000000280), 0x9) r5 = openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r8, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2) sendmsg$inet(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="92", 0x1}], 0x1}, 0x3) r9 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r9, &(0x7f0000000200)=0x1, 0x12) 2.141342428s ago: executing program 5 (id=3319): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x7c7, 0x3, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x86, 0x4, 0x0, @loopback, @local}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'syztnl0\x00', &(0x7f0000000040)={'tunl0\x00', 0x0, 0x20, 0x7, 0x7fffffd, 0x6, {{0x5, 0x4, 0x0, 0x16, 0xfffffffffffffe8b, 0xfffc, 0x0, 0x7f, 0x4, 0x0, @empty, @empty}}}}) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000ed000095"], &(0x7f00000000c0)='syzkaller\x00'}, 0x80) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000380)={'filter\x00', 0x0, 0x4, 0x5e, [0x5, 0x0, 0x6, 0x0, 0x8, 0x120000000000000], 0x1, &(0x7f0000000000)=[{}], &(0x7f0000000300)=""/94}, &(0x7f0000000400)=0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r3}, 0x10) sendmsg$netlink(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="140100001f0001030000000000000000010100800c00000000000000000000009a8aa489160a1150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb47d96206c08c029d1608a487f26fbe816b89f7cb81bff81a8b7a82565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875cf0d972df9e99f07976773f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fdc2f4393c05a007d12b505a84dfdb98d568175b62421d726d1e5331e1ddfd4d08000000ac1e0001000000"], 0x114}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, &(0x7f0000001540)=ANY=[@ANYBLOB="1803000000000020000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b5020000000000008500000086000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000000700000085000000b70000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x1003, &(0x7f0000001e40)=""/4099, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1006}, 0x94) 1.481754701s ago: executing program 3 (id=3323): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0xc, &(0x7f0000000340)=0x8, 0x4) accept(r2, &(0x7f0000000840)=@can, &(0x7f00000008c0)=0x80) r4 = socket$unix(0x1, 0x1, 0x0) recvmsg(r2, &(0x7f00000002c0)={&(0x7f0000000240)=@alg, 0x80, &(0x7f0000000080)=[{&(0x7f0000000400)=""/240, 0xf0}, {&(0x7f0000000540)=""/109, 0x6d}, {&(0x7f00000005c0)=""/84, 0x54}, {&(0x7f0000000640)=""/211, 0xd3}], 0x4, &(0x7f0000000740)=""/249, 0xf9}, 0x10060) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffffd, 0x40000006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x5, 0x8, 0x4, 0x2, 0x1, 0x7}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0xe}, {0x2, 0xb}, {0xd, 0xd}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x3}}]}, 0x38}}, 0x4008000) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r6, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b'], 0x24}}, 0x4001) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x4}}}, 0x10, 0x0}, 0x0) 1.426347741s ago: executing program 1 (id=3324): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) getpeername(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='contention_end\x00'}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xc}]}}}]}]}], {0x14}}, 0x84}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r4, 0x0, 0xd}, 0x18) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000340)="3f000000010003", 0x7) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r8, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x28, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x5818680ba2430678}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x12) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000140)=ANY=[@ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000830000006909000000000000550901000000000095000000000000007617040007000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r6, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r11, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) 1.264133939s ago: executing program 2 (id=3325): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0xb, &(0x7f00000002c0)=@framed={{}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}]}, &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x28}}, 0x0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x10681, 0x20000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x20044002) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) sendmsg$inet_sctp(r6, &(0x7f00000009c0)={&(0x7f00000004c0)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000500)="0e7cf003b9df5086bb08523f370e27858365e0b5681e17c957c76efadc8b2639a153753d8b37c12855920b8083ab7a249237e51ac7e35838723bf672526f461667d7995a98fac12911c6612c8e5b97a1ad7edf876da6856706cdedc0c7f3faa72a03baf3114fc3c53c2b536bd2c4665015f29f96c4512fc361d6923af119eb7e156fa18b9f843dc74848ee4592c7dc66a4db913d5d4e526c5d826a17594e63e817709e6da5c575795cabacf12455d086a898bfb4d62498855e355cdfc291789555c19268f4152ca869cb547cbff620adc90784423a6a740da1972fa12af5f5e87355735e44b457ccd5b66e940fc2", 0xee}, {&(0x7f0000000600)="d4570df52709c70fc4ef68ee2752da04969ca08c1345912feac05d2f7f17c717a9750381217b34e0f05c66458c477814164ec609416ea3dec907b1abbc2dff96ba0300204cfbe038a10772fa25314536a14d35884e37cd3972b5fdabcd9b80088ba082c54e2fa1af85c33b176e049c0197fa3c581c6538763f42fac0e8343064ed07fed4d38bfe55370c7fd11a53468e369a2f53d3d04c51ddd2a3c86f6cb9561dd257a628e881efdef1cae7513b508307291bfb547222afc8f28e2535f9391624bae6bb3cf0a487983fef894da47a3abb653f642d248daa6fbb2b5a6827cac0c1944cefc982bd6a778cab739738d7f30ad3f19f3ffb670a7d05440d26", 0xfd}, {&(0x7f0000000700)="f2706f25c4403ecd240f987e895a76271e67ef3abd7b61ed41aea0568f29165c86", 0x21}, {&(0x7f0000000740)="7582637f3033b5412bb98f62a5ff4cfa4d53de91b37f7219c655ff0c7b0f5f890da18a8d9430f4c2339fcec6652d23d2d0e74c058f160bd4b28c8d4ac4505ec2f45bd3a9a050f04eecbbaafcf98e5a6216d5eaa901c4fb4a3ef48701e24c625a70e6bc00e43a1e86e721d683da2b933696fbe09160b7902a4c3fe67e", 0x7c}, {&(0x7f00000007c0)="12ab0b4388474f24130f85d391ef786b516852f948500b80257ff2e9ce628f96c181bb79ef9c88b9821fdd243dd117cb367f012dd0da0312b4ef9dba6cd9512a9093f086633da9ac4545e63c3a624d34d02d91ca0559bc1f724ffdddb285473140", 0x61}, {&(0x7f0000000840)="e975945f92700e4e22bf5f16359a3e9cea791633ee4f0f020ee7d33e14d342d9964a207132ce257ed7eeee7a4ba81deb2fd3adf3ac61d98297e6e739b76f5af576c154aa680eaec85480da5413e0d97640fc283fb69e849ca2", 0x59}], 0x6, &(0x7f0000000940)=[@prinfo={0x18, 0x84, 0x5, {0x0, 0x6}}, @sndrcv={0x30, 0x84, 0x1, {0xe8, 0x7, 0x8004, 0x64a, 0x8, 0x9, 0x4, 0xffffffff, r7}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast1}], 0x68, 0x20040000}, 0x4) setsockopt$inet_sctp_SCTP_CONTEXT(r6, 0x84, 0x83, &(0x7f0000000140)={r9}, 0x8) r10 = socket(0x10, 0x803, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r12}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r13 = socket(0x10, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x28, r15, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8) sendmsg$nl_route(r13, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="400000001400010f00000000ffdbdf250a000400", @ANYRES32=r14, @ANYBLOB="140006000700000000010400000000000400000014000200fe"], 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r2, @ANYBLOB="01"], 0x3c}}, 0x0) 1.263693909s ago: executing program 5 (id=3326): r0 = socket$kcm(0x10, 0x2, 0x0) (async, rerun: 32) socket$kcm(0x10, 0x2, 0x0) (rerun: 32) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) (async) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r2, &(0x7f0000000100)={0x1f, 0x7, @any, 0x73, 0x2}, 0xe) connect$packet(r2, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0xa, 0x6, @remote}, 0x14) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000380)={r1, r3}, 0xc) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x3f, 0x40, 0x42}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async, rerun: 64) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) (async, rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) (async, rerun: 32) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000000c0)={0x3}, 0x8) (async, rerun: 32) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3a}, 0x94) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 64) socket(0x2a, 0x2, 0x0) (async, rerun: 64) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_CONNINFO(r6, 0x11, 0x2, 0x0, 0x0) (async) sendmsg$DEVLINK_CMD_PORT_SPLIT(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r5, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x1}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40080b1}, 0x8000) 1.052111667s ago: executing program 1 (id=3327): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) (async) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x24008090}, 0x40000) (async) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x4}, 0x8) (async) sendmmsg$inet6(r3, &(0x7f0000001ac0)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x2e1, @mcast1, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000080)="f8", 0x1}], 0x1}}, {{&(0x7f0000000440)={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x26}, 0x7}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000000480)="bc", 0x1}], 0x1}}], 0x2, 0x8000) unshare(0x8000400) (async) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r5}, 0x18) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x2a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) getsockopt$rose(r4, 0x104, 0x7, 0x0, &(0x7f0000000040)=0xfffffffffffffe3b) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000380), 0x8) (async) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x8002}, 0x4) (async) recvmmsg(r2, &(0x7f000000a140)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000580)=""/109, 0x1d}], 0x1}, 0x8}], 0x1, 0x40000061, 0x0) (async) setsockopt$inet_int(r2, 0x0, 0x1a, &(0x7f0000000300)=0x3, 0x0) (async) sendmsg$inet6(r0, &(0x7f0000000400)={&(0x7f0000000080)={0xa, 0x4e20, 0x5, @private0, 0x5}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000001140)='`', 0x1}], 0x1}, 0x4044844) 966.307944ms ago: executing program 5 (id=3328): socket$inet6(0xa, 0x2, 0x3a) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a499d0000000000000000020000010900010073797a310000000008000240000000030400060014000000110001"], 0x54}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010400000000000000000100000008000240000000020900010073797a300000000014000000110001"], 0x50}}, 0x4000) sendmsg$NFT_BATCH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000f00)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000003ca63bdd9d84e00020a010200000000000000000000000320000000000a051befebc3000000ff00020000040900010b73000200"/92], 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x20000824) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x7, 0x4) socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000780)=ANY=[@ANYRES16=r4], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r6}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYBLOB="4000a6000a000200aaaaaaaaaabb000004"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket(0x10, 0x3, 0x3) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000180)=0x1, 0x4) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x48081) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000300)={0xa}, 0x4b) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 965.739555ms ago: executing program 3 (id=3329): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bf"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000a80)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$tipc(0x1e, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x48, 0x0, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_PUBL={0x4}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x48025}, 0x8050) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0)=0x3a7b, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmsg$nl_route(r2, 0x0, 0x20008040) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x4444) 875.549984ms ago: executing program 1 (id=3330): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8fffdffbfa400000000000007040000f0ffffffb70200000800002018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 854.681005ms ago: executing program 2 (id=3331): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005e00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffc0}, 0x94) 730.22261ms ago: executing program 3 (id=3332): bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0500000004000000090000000800000000000000", @ANYRES32, @ANYBLOB="0800000000000000001000efff000000eeffffff", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000008000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r1}, 0x10) 729.901806ms ago: executing program 2 (id=3333): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r1, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003dc0)=""/226, 0x2c}, 0x7f}], 0x1, 0x832b, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4d, &(0x7f0000000180)=0x8, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) sendto$inet6(r2, &(0x7f0000000e80)="0d0ad7c36d6617110e434332d6ac582208222cfb7c37ce1148f448455bc37f5f70c92774dcb201629979039d7c8943b207e5bdf9ab8eed9ace110469c51f4f211dd9fad815eb5b273ac04e1edc679bcdf0a0d24482de5454be9003cb80714a95e136bb704ee58e707d1e69b3c3a1c2c37f9c0402e14abdeb32086a49aff25e5c0f0131d59b4783316b9fa2c71c51ce76942d5f519145c9e3bf0d4182b4a62970b2ce81d35a7afc8384b387b8e21f2051d90d92323a710cabe5275d335b64453e759251a140de480541d8dd7662a14296a59eba99b95bfdf5b22992c323865b471d13ad79867e2692fd4eece299a81e2b33336b6801f51c2ae8d73e4df90c9bd70cd535b72cbdf67754acdc44b3780450308d9c5527c3314eb7b2cc38b61e96403a30a8ba0c8a357aa04d3c62bc51bcf55cf214f44a909b29c30c18c3a43c86472612086664a80f2aa8490e58352732acb96eb46deab42895d1957a6029ad86e7a5ced6bde89c158aaee721954beeebe5973059007f7dd5459029af6d3f1d73d35f07d19b7cedfc80d1d7ef37f8b113f564afd0f093202929fef43e788619ca522c7f679dd2f27949d879b4dab46581a0e054b4ed1db37e43f528748b56ec5a54b7af198d4ae551046f7814fe3a5cbc1cc7cb6655fc198939b049f3c02443148c588e34d6ebef81096b4e48f468016d2bde0828664c0874d71e2d88b3bc04079d4a504255a83c3f07a4f1c3e5a4c66f55f36e51e344392487c8299d8d1bfb568780c0d57df48990cb5d6b35c3f7445f80312186d8598faf61072d4eefc961fb5a7e72b971c8f94a8346effd27362cee8d72a98b55e317de280d2d63ee83ca7140b7913122d402c536d914c8510c81d08f0ad1c952f5b7ad5e7ef72d7c58cb4d5bafbea535b381df6ebe94c62cf782cf7ab81c017c296a88ca91d641b45748d230cf5e87e5dbee4764ea4d131ae022e6bbf3ffc3ea7b264737d9db44354bfffa63d79bc403d3ac23fb615edc382d18b0daf1bbb2fbd708d1830ddac1c3f098b8cb1ef9a0019d804bf5d953110f12f3b9a8b9b7e0c61cb5d34116add1fc9a92721ffa5fdc83e1488cf88aa6e56ad2dd55e0aadd827cc7b4e7242f01241f49e905e5e7451092c28c3f6560a6a0002e5d91fc253a5a8fd8f27e42f4f02f5849528b7d93df9b0c568022acaff410e797e88d2f8eeadbba66e423335b843df734d203fa62a861b712da8f33d5ea721767871aa2cd53e659e505507de9a54d7e6fa3c20bbfb28cd6dd2b314dabbb59e9ce15c0a94ec3b3efc54eaaa27bd7576a687dcaf58dc182662539943014a02e76dc89f48c9f83cc7199038418f965ad3dc866098b89cabcac8691b0f51ffb71902337e49293309c4480a8f1b32411cc1b55a0ec0fe2c2572fe9d488a25bfc12ba74048e1d7beee93321c7aa49ea17cb9728dc46e5272154b3b995feacbacb8885621b335274af4df9365f8c8121ff323b572d320c8fc46acd6218b9579d43005e7b0506ccb14d9a0dac4cc6efaf5366c44342eaea8b5a11457f5afbea913ce4975ab67e6a85bc46e714ca5741da38a7cceb9e85d77fd03f83f7a5ecc7241e69e2bda327f769b48ba5f13662585c72778d12bd0e9a62a3d0dbe376d1aee81e6845c2cf23f42c458ae5668c8d387bf9ab224bc9703f1c08347be810d2f19278fe8d97560b3c9f1816667d0461a25e778eb1404dcaac1ed0a6a0745f3a5d2dc1b6babf98f5135d531cb26334ef2fec4c78c95b7193935139664fc65f17b047eb3dc39e251ba52ce33f8099719f1a789db1690347355e7b02d4c522692b9597fd31abb90f973ae4eb0bd0d900cdd887ff01d4845d7f0aee39b220a65a5aeee0fd386054070723c841c042d5339cc6325f07f0f733d124c6524f388ef7419f42c06278b8fceaa3a16b202dfb539b129762397e29cdd679ca6240272fa0c3e2e8c0a27aaa407f30b4024d0638dfca1bc9483db3ccc2880f", 0x5c6, 0x6d91fb6102d8910c, 0x0, 0xfffffffffffffe38) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000005c0), r4) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000077400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a7330000800020000000000080004200000000014000600626f6e64300000000000000000000000080003"], 0x78}, 0x1, 0xffffffff00000003, 0x0, 0x80}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c00)=""/84, 0x54}, 0x101) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000080)=0x474c, 0x4) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r6, 0x0, 0xd, &(0x7f0000000040)=0x6aba, 0x4) setsockopt$inet_int(r6, 0x0, 0x12, &(0x7f0000000180)=0x41fffffd, 0x4) recvmmsg(r6, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r5, 0x300, 0x70bd25, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:memory_device_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000c040}, 0x24000004) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x8091}, 0x8044) 689.35657ms ago: executing program 1 (id=3334): socket$kcm(0x10, 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4048841) sendmsg$NFT_BATCH(r1, 0x0, 0x4000000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TARGET_INFO={0x4}, @NFTA_TARGET_INFO={0x2c, 0x3, "22603e619235441644cfb579ebf9de93c17bfbc1acbbef1c644eb2fec9975d8db57563457fc28660"}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e45a8fda4f3c203ee7fe"], 0xfe1b) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r4, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 589.139128ms ago: executing program 5 (id=3335): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="2000000001070303000000e300000000030000060c0007"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)={0x0, 0x91, "1128784eee9c2553dd34fa74b7ff1d776f7abb50bacb5bd92ee7e6183548c7fee612c1fb4a245088e5fcc94cef9ddb02036c42d6b4c48515ae24d7d47481c00a076d6eae022a4d6503d39386b00eed6cb663434564e560884519f4a485398f30043cb0fe83eddc0f759d020e2b3b565acf856f92e7db37735c52914d9026b0f3ddc83900d106959ae4dbd7e825033105c4"}, &(0x7f00000000c0)=0x99) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000100)={r1, 0x80, 0xfff6, 0x401, 0x100, 0x3}, 0x14) r2 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000200)={{0x2, 0x4e23, @empty}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x40, {0x2, 0x4e21, @rand_addr=0x64010100}, 'batadv_slave_0\x00'}) 550.729334ms ago: executing program 1 (id=3336): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r1, 0xc6e9f000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0xffffe000) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x9, 0xa96b, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x4}, @in6={0xa, 0x4e22, 0x101, @mcast1, 0xf063}, @in6={0xa, 0x4e24, 0x800, @private2={0xfc, 0x2, '\x00', 0x1}, 0x18}, @in={0x2, 0x4e20, @multicast2}, @in={0x2, 0x4e20, @rand_addr=0x64010101}], 0x74) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) 482.376049ms ago: executing program 3 (id=3337): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) getpeername(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='contention_end\x00'}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r3, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xc}]}}}]}]}], {0x14}}, 0x84}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r4, 0x0, 0xd}, 0x18) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000340)="3f000000010003", 0x7) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r8, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x28, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x5818680ba2430678}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x12) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000830000006909000000000000550901000000000095000000000000007617040007000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r6, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r11, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) 369.440779ms ago: executing program 5 (id=3338): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003640)={0x30, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @pid}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x3, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) sendmsg$kcm(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000022008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@delchain={0x24, 0x5f, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x6, 0x2}, {0x1, 0xe}}}, 0x24}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200)=0x10001, 0x12) sendfile(r5, r4, 0x0, 0xf03a0005) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000bc0)={&(0x7f0000000a00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x2, [@int={0x1, 0x0, 0x0, 0x1, 0x0, 0x3b, 0x0, 0x74, 0xa6b7e94b1923397f}, @datasec={0x2, 0x0, 0x0, 0xf, 0x1, [], "d0"}, @datasec={0xe, 0x0, 0x0, 0xf, 0x3, [], "1cf525"}]}}, &(0x7f0000000b80)=""/24, 0x46, 0x18, 0x1, 0x4}, 0x28) pwritev(r6, &(0x7f00000001c0)=[{&(0x7f0000000200)="db", 0x1}], 0x1, 0x8040000, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r6, 0x891c, &(0x7f0000000000)={'rose0\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}) unshare(0x6a040000) writev(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r7, 0x0, 0x2e, &(0x7f00000004c0)={0x7, {{0x2, 0x4e22, @multicast2}}, {{0x2, 0x4e20, @loopback}}}, 0x108) 233.706527ms ago: executing program 1 (id=3339): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="7a0af8ff75257000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b25952850a84a70002b2ab3d6ffaa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc44bc25fb591cf77b9dfb379a3f611dbc2a364916f098dab10b1a297cf528666d1ddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e9e54687d3c56d7bedb6b2f25ddb8c640bb321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0b6dd7356aa79d5fabb5c0d0da6d719d7e0efb2bb713d18242cd5df6ca53307a4cdd91be4587f90e317c8de5e5c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1786eda2b20"], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r4}, &(0x7f0000000200), &(0x7f0000000240)=r1}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000700001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000001000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b7543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8f23e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae0000c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910ab193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b884057aeb68f3d675a79907a72ace70902459f6950a06a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68fe6b7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f8ce659e340c714809ec4d060bb1c9cfcde57b79625e2979fe689a5a246cbbd488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546308a0004be94dfab28c2a51dc816df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d044fa492aa38717481455e86dcd7816ad8940bd192595369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d4f17a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9570d730a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b94952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d830e1431ed6d646d13e8e7230300ef0a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000000000000000000002000000000044ff72f96f084f4b6cdcb1b4a9d8e9f9021b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded5027a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b092b70f77f0f428d2000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634009aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3f19f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f9863800f127d6b4518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c104fe52837a19006952fe2724c0105ab158a54a6a73000000000000000000000000b0d135da438cbe303f3ae070def97d6649b5a693ff5c788e5a406e1d06942ed51bff073011f6e6c29d3ea22e5fc26c7fbe37656229a6a12857ae9ed131ccdd513066bc9422ec38a1dc5212986d9bc330a23eb3b200af1a3678c2bfbe4b4ba6e8471495f6e82c5ee425973c590253e875352a3acaee044868f9b80f8fdc9d402007bb4c8df1b69d3d2b364ec9e4ed2f554118684eff1adf5b49b6b29232198e682dfa45dced8b332c404c8f292f36730845dc37dfe7a59e252ddc33ea9072dcd697a700cfac90b487660795f564ddb61fa3e4835f936984200000000000000000008e9f7bc3a00cd72ced7684e264e45398f7087734fcf2023a7a4c880f562f46f14cdc1bf472d74bc0c777b1021ff75de086c08f72a41399d3a3065b2f50a531cc90edbf88370ff50ba1aa6cc59076165a3ab90a3c90527b7c9711cf85bbb0cb0aebc47ab5c65458c40020f2cfb10e5f0a1594ae491e8756446e6873a8b222ae7e58dd7640666e359fc583e17ed6bcb30c0fafbba761e756ca80286d38bb92dd9ba17c1bb628e5b8d52c9a02a67f788ab88dca817cb4886942a279e06f45c8c936f5c46e1a008097471ca0ee26bcfabf7adb9c90a10539d960dec5c84464f6bc68318e7e899acf20ea41b071132d7a5945e941334855ce6149deaae1b5b83045e83bfc208079e6e58ebb4176b126c743111c5a712f465a3007d665ac21c43a544947c9d13e5206a21025f6acd47c2d333e648dcbf2e4989a1d4a176fe8f7a8cf0aeaf9736118b036639cb35810ea88213ff2a0842d420d418d026a101222a4ebd18fc89f04b5a9056ca6c00308936679474fa83bdf6eac126c9be33c551bccd42d8000736ed9a64ff7cb87d44c9bcf821c96dcd34aadfcc42fabd5976cedc9a4eef24764168056d0645c7aa007d69df4fa8de1224a56f0799ad59ee5c84418a1faae590b6c896cdd808376b6b51b217fcad5fbd7e3208d009e37484378df3ee5969f817d715d60fdd02c04e3fdd62a29285ac92f6836cbeb4d04d84c396150b2e17828d924013978173c48635e0b1ad4a0c5956717629794b39cf18d599e723d3c24689a5fea6cc1f59d1ba1fccfba88e02f9907"], &(0x7f0000000140)='GPL\x00'}, 0x48) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'\x00', 0x100}) 163.681228ms ago: executing program 3 (id=3340): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x20, 0x70bd2a, 0x25dfdbfc, {0x2, 0x80, 0x20, 0xc, 0xfd, 0x0, 0xff, 0x3, 0x3000}, [@RTA_PREFSRC={0x8, 0x7, @multicast1}, @RTA_SRC={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x40408c4) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x7, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000070000006a0a00ff01010000260000000019e1b6950000000000000018100000", @ANYRES32, @ANYBLOB="100000000000002505000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback=0x28}, 0x37) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x20, 0x70bd2a, 0x25dfdbfc, {0x2, 0x80, 0x20, 0xc, 0xfd, 0x0, 0xff, 0x3, 0x3000}, [@RTA_PREFSRC={0x8, 0x7, @multicast1}, @RTA_SRC={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x40408c4) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x7, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000070000006a0a00ff01010000260000000019e1b6950000000000000018100000", @ANYRES32, @ANYBLOB="100000000000002505000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback=0x28}, 0x37) (async) 36.812257ms ago: executing program 5 (id=3341): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x1) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=ANY=[@ANYRESOCT=r0], 0x5c}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) 0s ago: executing program 3 (id=3342): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bf"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000a80)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$tipc(0x1e, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x48, 0x0, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_PUBL={0x4}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x48025}, 0x8050) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0)=0x3a7b, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmsg$nl_route(r2, 0x0, 0x20008040) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x4444) kernel console output (not intermixed with test programs): process `syz.1.2413'. [ 332.840333][T14207] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2413'. [ 332.905108][T14207] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2413'. [ 332.940221][T14215] FAULT_INJECTION: forcing a failure. [ 332.940221][T14215] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 333.001056][T14215] CPU: 0 UID: 0 PID: 14215 Comm: syz.3.2415 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 333.001088][T14215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 333.001100][T14215] Call Trace: [ 333.001108][T14215] [ 333.001118][T14215] dump_stack_lvl+0x189/0x250 [ 333.001145][T14215] ? __pfx____ratelimit+0x10/0x10 [ 333.001176][T14215] ? __pfx_dump_stack_lvl+0x10/0x10 [ 333.001199][T14215] ? __pfx__printk+0x10/0x10 [ 333.001240][T14215] should_fail_ex+0x414/0x560 [ 333.001282][T14215] _copy_to_user+0x31/0xb0 [ 333.001316][T14215] simple_read_from_buffer+0xe1/0x170 [ 333.001355][T14215] proc_fail_nth_read+0x1b3/0x220 [ 333.001385][T14215] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 333.001414][T14215] ? rw_verify_area+0x258/0x650 [ 333.001443][T14215] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 333.001469][T14215] vfs_read+0x1fd/0x980 [ 333.001497][T14215] ? fdget_pos+0x247/0x320 [ 333.001521][T14215] ? __pfx___mutex_lock+0x10/0x10 [ 333.001559][T14215] ? __pfx_vfs_read+0x10/0x10 [ 333.001591][T14215] ? __fget_files+0x2a/0x420 [ 333.001617][T14215] ? __fget_files+0x3a0/0x420 [ 333.001636][T14215] ? __fget_files+0x2a/0x420 [ 333.001667][T14215] ksys_read+0x145/0x250 [ 333.001701][T14215] ? __pfx_ksys_read+0x10/0x10 [ 333.001738][T14215] ? do_syscall_64+0xbe/0x3b0 [ 333.001775][T14215] do_syscall_64+0xfa/0x3b0 [ 333.001806][T14215] ? lockdep_hardirqs_on+0x9c/0x150 [ 333.001835][T14215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.001857][T14215] ? clear_bhb_loop+0x60/0xb0 [ 333.001884][T14215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.001905][T14215] RIP: 0033:0x7f65f058d57c [ 333.001925][T14215] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 333.001950][T14215] RSP: 002b:00007f65f135a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 333.001975][T14215] RAX: ffffffffffffffda RBX: 00007f65f07b6080 RCX: 00007f65f058d57c [ 333.001991][T14215] RDX: 000000000000000f RSI: 00007f65f135a0a0 RDI: 0000000000000009 [ 333.002005][T14215] RBP: 00007f65f135a090 R08: 0000000000000000 R09: 0000000000000000 [ 333.002018][T14215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 333.002030][T14215] R13: 0000000000000001 R14: 00007f65f07b6080 R15: 00007fff15618a58 [ 333.002065][T14215] [ 333.550425][T14212] nbd36: detected capacity change from 0 to 127 [ 333.601895][ T5158] block nbd36: Receive control failed (result -32) [ 333.660692][T14226] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2419'. [ 333.705393][T14226] openvswitch: netlink: Flow key attr not present in new flow. [ 333.927360][T14238] IPv6: Can't replace route, no match found [ 334.283303][T14248] sctp: [Deprecated]: syz.0.2423 (pid 14248) Use of int in maxseg socket option. [ 334.283303][T14248] Use struct sctp_assoc_value instead [ 334.445437][T14247] nbd37: detected capacity change from 0 to 127 [ 334.466339][ T5158] block nbd37: Receive control failed (result -32) [ 334.718692][ T11] block nbd11: Possible stuck request ffff888025987000: control (read@0,1024B). Runtime 210 seconds [ 334.729738][ T11] block nbd11: Possible stuck request ffff8880259871c0: control (read@1024,1024B). Runtime 210 seconds [ 334.740900][ T11] block nbd11: Possible stuck request ffff888025987380: control (read@2048,1024B). Runtime 210 seconds [ 334.752745][ T11] block nbd11: Possible stuck request ffff888025987540: control (read@3072,1024B). Runtime 210 seconds [ 335.001308][T14282] netlink: 248 bytes leftover after parsing attributes in process `syz.1.2437'. [ 335.104075][T14286] vxcan2: entered promiscuous mode [ 335.268576][T14300] netlink: 'syz.2.2439': attribute type 10 has an invalid length. [ 335.287820][T14299] netlink: 'syz.2.2439': attribute type 10 has an invalid length. [ 335.486741][T14314] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 335.772307][T14328] netlink: 'syz.4.2449': attribute type 1 has an invalid length. [ 335.821451][T14328] 8021q: adding VLAN 0 to HW filter on device bond3 [ 335.877195][T14328] 8021q: adding VLAN 0 to HW filter on device bond3 [ 335.884764][T14328] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 335.899346][T14328] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 335.957968][T14334] gretap1: entered promiscuous mode [ 335.989716][T14334] bond3: (slave gretap1): making interface the new active one [ 335.998873][T14334] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 336.082716][T14328] macvlan0: entered promiscuous mode [ 336.095650][T14328] macvlan0: entered allmulticast mode [ 336.112926][T14328] bond3: entered promiscuous mode [ 336.138473][T14328] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 336.200200][T14328] bond3: (slave macvlan0): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 336.213896][T14328] bond3: left promiscuous mode [ 336.433264][T14348] netlink: 'syz.4.2454': attribute type 11 has an invalid length. [ 336.527335][T14355] sctp: [Deprecated]: syz.2.2456 (pid 14355) Use of struct sctp_assoc_value in delayed_ack socket option. [ 336.527335][T14355] Use struct sctp_sack_info instead [ 336.563520][T14358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2457'. [ 336.578812][T14358] vcan0: tx drop: invalid da for name 0x0000000000000004 [ 336.592491][T14358] IPVS: length: 148 != 24 [ 336.773959][T14364] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2458'. [ 337.007653][T14373] nbd38: detected capacity change from 0 to 127 [ 337.017799][ T5158] block nbd38: Receive control failed (result -32) [ 337.038651][T14376] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2463'. [ 337.171479][T14384] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2468'. [ 337.581324][T14406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2475'. [ 337.590797][T14406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2475'. [ 337.807255][T14412] nbd39: detected capacity change from 0 to 127 [ 337.821344][T14410] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2477'. [ 337.851649][T14419] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2479'. [ 337.874044][ T5158] block nbd39: Receive control failed (result -32) [ 338.220125][T14444] netlink: 'syz.0.2489': attribute type 1 has an invalid length. [ 338.245249][T14444] netlink: 232 bytes leftover after parsing attributes in process `syz.0.2489'. [ 338.278255][T14444] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2489'. [ 338.366146][T11043] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 338.391629][T11043] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 338.415479][T11043] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 338.423842][T11043] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 338.500619][T14462] macvtap1: entered allmulticast mode [ 338.507070][T14462] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 338.519156][T14462] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 338.546457][T14465] netlink: 'syz.0.2496': attribute type 1 has an invalid length. [ 338.558994][T14468] netlink: 'syz.4.2495': attribute type 1 has an invalid length. [ 338.649325][T14473] openvswitch: netlink: Key type 16144 is out of range max 32 [ 339.002221][T14489] netlink: zone id is out of range [ 339.011907][T14489] netlink: zone id is out of range [ 339.027146][T14489] netlink: zone id is out of range [ 339.032545][T14489] netlink: zone id is out of range [ 339.043738][T14489] netlink: zone id is out of range [ 339.050785][T14489] netlink: zone id is out of range [ 339.064072][T14489] netlink: zone id is out of range [ 339.072532][T14489] netlink: zone id is out of range [ 339.081339][T14489] netlink: zone id is out of range [ 339.417280][T14508] TCP: TCP_TX_DELAY enabled [ 340.933893][T14554] sctp: [Deprecated]: syz.1.2524 (pid 14554) Use of int in max_burst socket option. [ 340.933893][T14554] Use struct sctp_assoc_value instead [ 340.983894][T14552] gtp0: entered promiscuous mode [ 341.211614][T14564] syzkaller0: create flow: hash 3982905969 index 1 [ 341.253075][T11059] syzkaller0: tun_net_xmit 76 [ 341.271829][T11059] syzkaller0: tun_net_xmit 48 [ 341.278927][ T9] syzkaller0: tun_net_xmit 76 [ 341.400190][T14556] syzkaller0: delete flow: hash 3982905969 index 1 [ 343.163595][T14579] netlink: 'syz.3.2531': attribute type 7 has an invalid length. [ 343.177113][T14579] __nla_validate_parse: 13 callbacks suppressed [ 343.177136][T14579] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2531'. [ 343.879372][T14596] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2536'. [ 344.097761][T14569] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2528'. [ 344.108032][T14569] netem: invalid attributes len -16 [ 344.113363][T14569] netem: change failed [ 344.118370][T14591] batadv0: left allmulticast mode [ 344.124825][T14591] batadv0: left promiscuous mode [ 344.137415][T14591] bridge0: port 1(batadv0) entered disabled state [ 344.152163][T14591] bond0: (slave geneve1): Releasing backup interface [ 344.164820][T14591] bond0: (slave wlan1): Releasing backup interface [ 344.179800][T14591] bond1: (slave bridge2): Releasing backup interface [ 344.193558][T14591] bond4: (slave gretap1): Releasing active interface [ 344.238039][T14593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.247996][T14593] net_ratelimit: 116 callbacks suppressed [ 344.248017][T14593] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 344.278801][ T44] lo speed is unknown, defaulting to 1000 [ 344.284594][ T44] syz1: Port: 1 Link ACTIVE [ 344.508573][T14606] nbd40: detected capacity change from 0 to 127 [ 344.533915][ T5853] block nbd40: Receive control failed (result -32) [ 344.648549][ T5853] Bluetooth: hci4: link tx timeout [ 344.660411][ T5853] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 344.696892][T14626] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2546'. [ 344.724053][T14628] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 344.768098][T14628] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2543'. [ 344.771986][T14631] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2547'. [ 344.793736][T14636] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2549'. [ 344.802660][T14631] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2547'. [ 344.841153][T14639] netlink: 128 bytes leftover after parsing attributes in process `syz.4.2547'. [ 345.171687][T14650] netlink: 'syz.4.2551': attribute type 2 has an invalid length. [ 345.194208][T14650] þ: entered promiscuous mode [ 345.605905][ T55] block nbd14: Possible stuck request ffff888025af0000: control (read@0,1024B). Runtime 210 seconds [ 345.616821][ T55] block nbd14: Possible stuck request ffff888025af01c0: control (read@1024,1024B). Runtime 210 seconds [ 345.628018][ T55] block nbd14: Possible stuck request ffff888025af0380: control (read@2048,1024B). Runtime 210 seconds [ 345.639158][ T55] block nbd14: Possible stuck request ffff888025af0540: control (read@3072,1024B). Runtime 210 seconds [ 345.957579][T14683] sctp: [Deprecated]: syz.0.2563 (pid 14683) Use of int in max_burst socket option deprecated. [ 345.957579][T14683] Use struct sctp_assoc_value instead [ 346.247412][ T11] block nbd15: Possible stuck request ffff888025b27000: control (read@0,1024B). Runtime 210 seconds [ 346.258403][ T11] block nbd15: Possible stuck request ffff888025b271c0: control (read@1024,1024B). Runtime 210 seconds [ 346.270312][ T11] block nbd15: Possible stuck request ffff888025b27380: control (read@2048,1024B). Runtime 210 seconds [ 346.282086][ T11] block nbd15: Possible stuck request ffff888025b27540: control (read@3072,1024B). Runtime 210 seconds [ 346.325724][T14694] nbd41: detected capacity change from 0 to 127 [ 346.341968][ T5853] block nbd41: Receive control failed (result -32) [ 346.382439][T14708] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2571'. [ 346.395630][ T5853] Bluetooth: hci4: command 0x0405 tx timeout [ 346.577879][T14707] nbd42: detected capacity change from 0 to 127 [ 346.608123][ T5853] block nbd42: Receive control failed (result -32) [ 346.820891][T14738] netlink: 'syz.2.2577': attribute type 16 has an invalid length. [ 346.842773][T14738] netlink: 'syz.2.2577': attribute type 17 has an invalid length. [ 346.952701][T14743] FAULT_INJECTION: forcing a failure. [ 346.952701][T14743] name failslab, interval 1, probability 0, space 0, times 0 [ 346.967129][T14743] CPU: 0 UID: 0 PID: 14743 Comm: syz.4.2580 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 346.967162][T14743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 346.967175][T14743] Call Trace: [ 346.967184][T14743] [ 346.967193][T14743] dump_stack_lvl+0x189/0x250 [ 346.967222][T14743] ? __pfx____ratelimit+0x10/0x10 [ 346.967255][T14743] ? __pfx_dump_stack_lvl+0x10/0x10 [ 346.967277][T14743] ? __pfx__printk+0x10/0x10 [ 346.967322][T14743] should_fail_ex+0x414/0x560 [ 346.967362][T14743] should_failslab+0xa8/0x100 [ 346.967385][T14743] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 346.967418][T14743] ? __alloc_skb+0x112/0x2d0 [ 346.967456][T14743] __alloc_skb+0x112/0x2d0 [ 346.967502][T14743] send_monitor_replay+0x124/0x610 [ 346.967532][T14743] hci_sock_bind+0x772/0x1000 [ 346.967566][T14743] ? __pfx_aa_sk_perm+0x10/0x10 [ 346.967591][T14743] ? tomoyo_socket_bind_permission+0x150/0x290 [ 346.967627][T14743] ? __pfx_hci_sock_bind+0x10/0x10 [ 346.967666][T14743] ? bpf_lsm_socket_bind+0x9/0x20 [ 346.967695][T14743] __sys_bind+0x2c3/0x3e0 [ 346.967729][T14743] ? __pfx___sys_bind+0x10/0x10 [ 346.967775][T14743] ? __pfx_ksys_write+0x10/0x10 [ 346.967803][T14743] ? rcu_is_watching+0x15/0xb0 [ 346.967846][T14743] __x64_sys_bind+0x7a/0x90 [ 346.967878][T14743] do_syscall_64+0xfa/0x3b0 [ 346.967909][T14743] ? lockdep_hardirqs_on+0x9c/0x150 [ 346.967939][T14743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.967961][T14743] ? clear_bhb_loop+0x60/0xb0 [ 346.967988][T14743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.968009][T14743] RIP: 0033:0x7f0c8038eb69 [ 346.968030][T14743] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 346.968049][T14743] RSP: 002b:00007f0c81233038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 346.968073][T14743] RAX: ffffffffffffffda RBX: 00007f0c805b5fa0 RCX: 00007f0c8038eb69 [ 346.968089][T14743] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000005 [ 346.968103][T14743] RBP: 00007f0c81233090 R08: 0000000000000000 R09: 0000000000000000 [ 346.968117][T14743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.968130][T14743] R13: 0000000000000000 R14: 00007f0c805b5fa0 R15: 00007ffce854fa18 [ 346.968165][T14743] [ 347.282156][T14750] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 347.323727][T14751] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 347.514444][T14761] batman_adv: batadv0: Adding interface: ip6gretap1 [ 347.530277][ T11] block nbd16: Possible stuck request ffff88806cf57000: control (read@0,1024B). Runtime 210 seconds [ 347.533145][T14764] sctp: [Deprecated]: syz.1.2588 (pid 14764) Use of struct sctp_assoc_value in delayed_ack socket option. [ 347.533145][T14764] Use struct sctp_sack_info instead [ 347.541385][ T11] block nbd16: Possible stuck request ffff88806cf571c0: control (read@1024,1024B). Runtime 210 seconds [ 347.559100][T14761] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 347.569541][ T11] block nbd16: Possible stuck request ffff88806cf57380: control (read@2048,1024B). Runtime 210 seconds [ 347.606921][ T11] block nbd16: Possible stuck request ffff88806cf57540: control (read@3072,1024B). Runtime 210 seconds [ 347.628188][T14761] batman_adv: batadv0: Interface activated: ip6gretap1 [ 348.356839][T14806] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 348.487824][ T5853] Bluetooth: hci4: command 0x0405 tx timeout [ 348.884551][T14824] IPv6: Can't replace route, no match found [ 348.960172][T14816] lo speed is unknown, defaulting to 1000 [ 348.978644][T14816] lo speed is unknown, defaulting to 1000 [ 349.311585][T14834] __nla_validate_parse: 1 callbacks suppressed [ 349.311607][T14834] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2610'. [ 349.604280][T14843] lo speed is unknown, defaulting to 1000 [ 349.739339][T14815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 349.827546][T14853] netlink: 'syz.1.2617': attribute type 10 has an invalid length. [ 349.859004][T14853] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2617'. [ 349.887136][T14843] lo speed is unknown, defaulting to 1000 [ 349.904458][T14853] dummy0: entered promiscuous mode [ 349.944913][T14853] dummy0: entered allmulticast mode [ 349.972814][T14853] bridge0: port 1(dummy0) entered blocking state [ 349.986280][T14861] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2619'. [ 350.025436][T14853] bridge0: port 1(dummy0) entered disabled state [ 350.090440][ T55] block nbd17: Possible stuck request ffff88805899e000: control (read@0,1024B). Runtime 210 seconds [ 350.129571][T14853] bridge0: port 1(dummy0) entered blocking state [ 350.136228][T14853] bridge0: port 1(dummy0) entered listening state [ 350.727611][ T55] block nbd18: Possible stuck request ffff88806cf6e000: control (read@0,1024B). Runtime 210 seconds [ 350.741625][ T55] block nbd18: Possible stuck request ffff88806cf6e1c0: control (read@1024,1024B). Runtime 210 seconds [ 350.753033][ T55] block nbd18: Possible stuck request ffff88806cf6e380: control (read@2048,1024B). Runtime 210 seconds [ 350.764488][ T55] block nbd18: Possible stuck request ffff88806cf6e540: control (read@3072,1024B). Runtime 210 seconds [ 351.025100][T14884] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 351.227542][T14886] netlink: 'syz.0.2624': attribute type 10 has an invalid length. [ 351.275755][T14886] mac80211_hwsim hwsim8 wlan1: left allmulticast mode [ 351.957449][T14916] delete_channel: no stack [ 351.964927][T14916] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2631'. [ 351.977680][T14916] netlink: 'syz.2.2631': attribute type 5 has an invalid length. [ 352.286935][T14926] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2635'. [ 352.389633][T14934] IPv6: sit2: Disabled Multicast RS [ 352.478866][T14939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2640'. [ 352.665471][T14945] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2641'. [ 352.713861][T14948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2645'. [ 352.731781][T14948] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2645'. [ 352.892458][T14952] Â: renamed from pim6reg1 [ 352.925414][T14948] syzkaller0: entered allmulticast mode [ 352.938694][T14947] syzkaller0: left allmulticast mode [ 353.078670][T14965] tipc: Enabled bearer , priority 0 [ 353.085106][T14961] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2649'. [ 353.101916][T14964] netlink: 'syz.0.2650': attribute type 32 has an invalid length. [ 353.111453][T14964] syzkaller0: entered promiscuous mode [ 353.119411][T14964] syzkaller0: entered allmulticast mode [ 353.128235][T14965] syzkaller0: entered promiscuous mode [ 353.132474][T14964] tipc: Failed to remove unknown binding: 66,1,1/1552429999:2866813509/2866813511 [ 353.143649][T14965] syzkaller0: entered allmulticast mode [ 353.149623][T14964] tipc: Failed to remove unknown binding: 66,1,1/1552429999:2866813509/2866813511 [ 353.249719][T14969] sch_fq: defrate 257 ignored. [ 353.270321][T14965] tipc: Resetting bearer [ 353.297973][T14963] tipc: Resetting bearer [ 353.327651][T14963] tipc: Disabling bearer [ 353.921801][ T55] block nbd20: Possible stuck request ffff8880534e7000: control (read@0,1024B). Runtime 210 seconds [ 353.933185][ T55] block nbd20: Possible stuck request ffff8880534e71c0: control (read@1024,1024B). Runtime 210 seconds [ 353.945313][ T55] block nbd20: Possible stuck request ffff8880534e7380: control (read@2048,1024B). Runtime 210 seconds [ 353.956781][ T55] block nbd20: Possible stuck request ffff8880534e7540: control (read@3072,1024B). Runtime 210 seconds [ 354.265918][T15019] netlink: 'syz.1.2664': attribute type 15 has an invalid length. [ 354.318702][T15019] __nla_validate_parse: 2 callbacks suppressed [ 354.318722][T15019] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2664'. [ 354.479572][T15028] syzkaller1: entered promiscuous mode [ 354.506938][T15028] syzkaller1: entered allmulticast mode [ 354.674576][T15043] netlink: 'syz.2.2670': attribute type 10 has an invalid length. [ 354.789731][T15043] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 355.116383][T15048] nbd43: detected capacity change from 0 to 127 [ 355.161965][ T5158] block nbd43: Receive control failed (result -32) [ 355.178559][T15068] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2677'. [ 355.188680][T15068] nbd: must specify at least one socket [ 355.274119][T15073] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2676'. [ 355.394989][T15081] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2679'. [ 355.441550][T15078] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2680'. [ 355.747259][T15100] lo speed is unknown, defaulting to 1000 [ 355.836897][ T11] block nbd21: Possible stuck request ffff88806da47000: control (read@0,4096B). Runtime 180 seconds [ 355.958284][T15116] netlink: 'syz.1.2693': attribute type 10 has an invalid length. [ 355.978206][T15116] bridge0: port 1(dummy0) entered disabled state [ 355.991422][T15116] dummy0: left allmulticast mode [ 355.997548][T15116] dummy0: left promiscuous mode [ 356.002925][T15116] bridge0: port 1(dummy0) entered disabled state [ 356.019005][T15116] team0: Port device dummy0 added [ 356.040735][T15104] nbd44: detected capacity change from 0 to 127 [ 356.061127][T15114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2692'. [ 356.061264][ T5158] block nbd44: Receive control failed (result -32) [ 356.174342][T15122] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2694'. [ 356.504306][T15144] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2699'. [ 356.532946][T15151] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2700'. [ 356.581468][T15151] openvswitch: netlink: Flow actions attr not present in new flow. [ 356.641131][T15150] lo speed is unknown, defaulting to 1000 [ 356.717960][T15150] lo speed is unknown, defaulting to 1000 [ 357.020428][T15167] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2706'. [ 357.325711][T15173] nbd45: detected capacity change from 0 to 127 [ 357.340278][ T5158] block nbd45: Receive control failed (result -32) [ 357.525105][T15189] netlink: 'syz.4.2714': attribute type 9 has an invalid length. [ 357.650870][T15193] veth13: entered promiscuous mode [ 357.741222][T15204] FAULT_INJECTION: forcing a failure. [ 357.741222][T15204] name failslab, interval 1, probability 0, space 0, times 0 [ 357.754356][T15204] CPU: 0 UID: 0 PID: 15204 Comm: syz.2.2717 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 357.754388][T15204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 357.754402][T15204] Call Trace: [ 357.754412][T15204] [ 357.754422][T15204] dump_stack_lvl+0x189/0x250 [ 357.754450][T15204] ? __pfx____ratelimit+0x10/0x10 [ 357.754482][T15204] ? __pfx_dump_stack_lvl+0x10/0x10 [ 357.754505][T15204] ? __pfx__printk+0x10/0x10 [ 357.754549][T15204] should_fail_ex+0x414/0x560 [ 357.754589][T15204] should_failslab+0xa8/0x100 [ 357.754614][T15204] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 357.754647][T15204] ? __alloc_skb+0x112/0x2d0 [ 357.754677][T15204] ? kasan_quarantine_put+0xdd/0x220 [ 357.754710][T15204] __alloc_skb+0x112/0x2d0 [ 357.754749][T15204] create_monitor_event+0xbf/0x8b0 [ 357.754781][T15204] ? send_monitor_replay+0x3a7/0x610 [ 357.754806][T15204] send_monitor_replay+0x3c0/0x610 [ 357.754835][T15204] hci_sock_bind+0x772/0x1000 [ 357.754877][T15204] ? __pfx_aa_sk_perm+0x10/0x10 [ 357.754902][T15204] ? tomoyo_socket_bind_permission+0x150/0x290 [ 357.754937][T15204] ? __pfx_hci_sock_bind+0x10/0x10 [ 357.754977][T15204] ? bpf_lsm_socket_bind+0x9/0x20 [ 357.755005][T15204] __sys_bind+0x2c3/0x3e0 [ 357.755040][T15204] ? __pfx___sys_bind+0x10/0x10 [ 357.755086][T15204] ? __pfx_ksys_write+0x10/0x10 [ 357.755121][T15204] ? rcu_is_watching+0x15/0xb0 [ 357.755163][T15204] __x64_sys_bind+0x7a/0x90 [ 357.755194][T15204] do_syscall_64+0xfa/0x3b0 [ 357.755225][T15204] ? lockdep_hardirqs_on+0x9c/0x150 [ 357.755255][T15204] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.755276][T15204] ? clear_bhb_loop+0x60/0xb0 [ 357.755301][T15204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.755321][T15204] RIP: 0033:0x7f05d6b8eb69 [ 357.755341][T15204] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 357.755360][T15204] RSP: 002b:00007f05d79b7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 357.755383][T15204] RAX: ffffffffffffffda RBX: 00007f05d6db5fa0 RCX: 00007f05d6b8eb69 [ 357.755398][T15204] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000005 [ 357.755411][T15204] RBP: 00007f05d79b7090 R08: 0000000000000000 R09: 0000000000000000 [ 357.755424][T15204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 357.755436][T15204] R13: 0000000000000000 R14: 00007f05d6db5fa0 R15: 00007ffd131b2318 [ 357.755468][T15204] [ 358.024910][ T11] block nbd6: Possible stuck request ffff888025820000: control (read@0,4096B). Runtime 240 seconds [ 358.231769][T15216] netlink: 'syz.1.2722': attribute type 1 has an invalid length. [ 358.389752][T15216] 8021q: adding VLAN 0 to HW filter on device bond5 [ 358.474123][T15221] 8021q: adding VLAN 0 to HW filter on device bond5 [ 358.481792][T15221] bond5: (slave vxcan5): The slave device specified does not support setting the MAC address [ 358.503151][T15221] bond5: (slave vxcan5): Error -95 calling set_mac_address [ 358.748080][T15238] syzkaller0: entered promiscuous mode [ 358.753771][T15238] syzkaller0: entered allmulticast mode [ 358.755332][T15226] nbd46: detected capacity change from 0 to 127 [ 358.781708][ T5158] block nbd46: Receive control failed (result -32) [ 358.984083][T15249] lo speed is unknown, defaulting to 1000 [ 359.012631][T15249] lo speed is unknown, defaulting to 1000 [ 359.037900][ T55] block nbd7: Possible stuck request ffff888025857000: control (read@0,1024B). Runtime 240 seconds [ 359.049011][ T55] block nbd7: Possible stuck request ffff8880258571c0: control (read@1024,1024B). Runtime 240 seconds [ 359.060654][ T55] block nbd7: Possible stuck request ffff888025857380: control (read@2048,1024B). Runtime 240 seconds [ 359.071817][ T55] block nbd7: Possible stuck request ffff888025857540: control (read@3072,1024B). Runtime 240 seconds [ 359.603502][T15279] FAULT_INJECTION: forcing a failure. [ 359.603502][T15279] name failslab, interval 1, probability 0, space 0, times 0 [ 359.617107][T15279] CPU: 1 UID: 0 PID: 15279 Comm: syz.0.2744 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 359.617138][T15279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 359.617152][T15279] Call Trace: [ 359.617160][T15279] [ 359.617169][T15279] dump_stack_lvl+0x189/0x250 [ 359.617197][T15279] ? __pfx____ratelimit+0x10/0x10 [ 359.617227][T15279] ? __pfx_dump_stack_lvl+0x10/0x10 [ 359.617250][T15279] ? __pfx__printk+0x10/0x10 [ 359.617292][T15279] should_fail_ex+0x414/0x560 [ 359.617332][T15279] should_failslab+0xa8/0x100 [ 359.617354][T15279] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 359.617388][T15279] ? __alloc_skb+0x112/0x2d0 [ 359.617418][T15279] ? kasan_quarantine_put+0xdd/0x220 [ 359.617453][T15279] __alloc_skb+0x112/0x2d0 [ 359.617491][T15279] create_monitor_event+0x1ab/0x8b0 [ 359.617522][T15279] ? send_monitor_replay+0x431/0x610 [ 359.617546][T15279] send_monitor_replay+0x70/0x610 [ 359.617574][T15279] hci_sock_bind+0x772/0x1000 [ 359.617607][T15279] ? __pfx_aa_sk_perm+0x10/0x10 [ 359.617632][T15279] ? tomoyo_socket_bind_permission+0x150/0x290 [ 359.617668][T15279] ? __pfx_hci_sock_bind+0x10/0x10 [ 359.617707][T15279] ? bpf_lsm_socket_bind+0x9/0x20 [ 359.617736][T15279] __sys_bind+0x2c3/0x3e0 [ 359.617771][T15279] ? __pfx___sys_bind+0x10/0x10 [ 359.617817][T15279] ? __pfx_ksys_write+0x10/0x10 [ 359.617846][T15279] ? rcu_is_watching+0x15/0xb0 [ 359.617890][T15279] __x64_sys_bind+0x7a/0x90 [ 359.617922][T15279] do_syscall_64+0xfa/0x3b0 [ 359.617952][T15279] ? lockdep_hardirqs_on+0x9c/0x150 [ 359.617982][T15279] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.618004][T15279] ? clear_bhb_loop+0x60/0xb0 [ 359.618030][T15279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.618051][T15279] RIP: 0033:0x7f693b78eb69 [ 359.618078][T15279] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 359.618097][T15279] RSP: 002b:00007f693c56f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 359.618123][T15279] RAX: ffffffffffffffda RBX: 00007f693b9b5fa0 RCX: 00007f693b78eb69 [ 359.618139][T15279] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000005 [ 359.618152][T15279] RBP: 00007f693c56f090 R08: 0000000000000000 R09: 0000000000000000 [ 359.618166][T15279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 359.618179][T15279] R13: 0000000000000000 R14: 00007f693b9b5fa0 R15: 00007ffe0f122738 [ 359.618214][T15279] [ 359.918869][T15281] tc_dump_action: action bad kind [ 360.323301][ T11] block nbd8: Possible stuck request ffff888025895080: control (read@0,1024B). Runtime 240 seconds [ 360.334461][ T11] block nbd8: Possible stuck request ffff888025895240: control (read@1024,1024B). Runtime 240 seconds [ 360.346591][ T11] block nbd8: Possible stuck request ffff888025895400: control (read@2048,1024B). Runtime 240 seconds [ 360.357870][ T11] block nbd8: Possible stuck request ffff8880258955c0: control (read@3072,1024B). Runtime 240 seconds [ 360.433758][T15310] netlink: 'syz.0.2754': attribute type 1 has an invalid length. [ 360.480896][T15310] __nla_validate_parse: 3 callbacks suppressed [ 360.480920][T15310] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2754'. [ 360.721363][T15320] lo speed is unknown, defaulting to 1000 [ 360.808994][T15320] lo speed is unknown, defaulting to 1000 [ 362.905238][ T55] block nbd9: Possible stuck request ffff8880258e7000: control (read@0,1024B). Runtime 240 seconds [ 362.916305][ T55] block nbd9: Possible stuck request ffff8880258e71c0: control (read@1024,1024B). Runtime 240 seconds [ 362.927365][ T55] block nbd9: Possible stuck request ffff8880258e7380: control (read@2048,1024B). Runtime 240 seconds [ 362.938589][ T55] block nbd9: Possible stuck request ffff8880258e7540: control (read@3072,1024B). Runtime 240 seconds [ 364.045420][T15337] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2764'. [ 364.087208][T15339] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2762'. [ 364.165946][T15341] netlink: 47 bytes leftover after parsing attributes in process `syz.2.2765'. [ 364.273477][T15345] netlink: 'syz.3.2767': attribute type 1 has an invalid length. [ 364.415901][T15344] nbd47: detected capacity change from 0 to 127 [ 364.427406][ T5158] block nbd47: Receive control failed (result -32) [ 364.436638][T15347] atomic_op ffff88807c8dc198 conn xmit_atomic 0000000000000000 [ 364.576092][T15357] lo speed is unknown, defaulting to 1000 [ 364.584364][T15357] lo speed is unknown, defaulting to 1000 [ 364.732986][T15365] netlink: 196 bytes leftover after parsing attributes in process `syz.1.2771'. [ 364.801751][ T11] block nbd11: Possible stuck request ffff888025987000: control (read@0,1024B). Runtime 240 seconds [ 364.813246][ T11] block nbd11: Possible stuck request ffff8880259871c0: control (read@1024,1024B). Runtime 240 seconds [ 364.825884][ T11] block nbd11: Possible stuck request ffff888025987380: control (read@2048,1024B). Runtime 240 seconds [ 364.837523][ T11] block nbd11: Possible stuck request ffff888025987540: control (read@3072,1024B). Runtime 240 seconds [ 365.357987][T15365] veth0_to_team: left promiscuous mode [ 365.690276][T15365] tipc: Resetting bearer [ 365.726003][T15365] syzkaller0: left promiscuous mode [ 365.738271][T15365] vti0: left promiscuous mode [ 365.836132][T15365] vlan2: left promiscuous mode [ 365.976131][T15365] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 366.023365][T15365] batman_adv: batadv0: Interface deactivated: macvlan3 [ 366.224412][T15370] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2772'. [ 366.307003][T15373] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2773'. [ 366.324055][T15370] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2772'. [ 366.335611][T15373] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 366.355993][T15370] nbd: nbd63 already in use [ 366.993926][T15398] netlink: 'syz.4.2778': attribute type 64 has an invalid length. [ 367.069182][T15405] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2778'. [ 367.243118][T15396] syzkaller0: entered promiscuous mode [ 367.286997][T15396] syzkaller0: entered allmulticast mode [ 369.954463][T15442] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2791'. [ 370.143480][T15448] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2794'. [ 370.166381][T15448] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2794'. [ 370.193622][T15448] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2794'. [ 370.204201][T15450] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2795'. [ 370.233795][T11047] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.257701][T15454] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 370.259662][T11047] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.278775][T15452] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 370.320616][T15452] netlink: 'syz.2.2796': attribute type 1 has an invalid length. [ 370.344391][T15452] netlink: 144 bytes leftover after parsing attributes in process `syz.2.2796'. [ 370.369968][T15452] netlink: 'syz.2.2796': attribute type 1 has an invalid length. [ 370.767011][T15471] nbd: nbd63 already in use [ 370.837495][T15478] vlan3: entered promiscuous mode [ 370.853599][T15478] vlan3: entered allmulticast mode [ 370.866168][T15478] hsr_slave_1: entered allmulticast mode [ 371.112392][T15496] netlink: 'syz.2.2808': attribute type 3 has an invalid length. [ 371.304744][T15498] block nbd48: shutting down sockets [ 371.353848][T15501] __nla_validate_parse: 10 callbacks suppressed [ 371.353870][T15501] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2821'. [ 371.394516][T15504] netlink: 'syz.3.2812': attribute type 13 has an invalid length. [ 371.411950][T15501] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2821'. [ 371.440697][T15504] netlink: 'syz.3.2812': attribute type 17 has an invalid length. [ 371.468315][T15509] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2813'. [ 371.548451][T15504] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.616188][T15504] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 371.651991][T15517] pimreg: entered allmulticast mode [ 371.676003][T15514] tipc: Enabling of bearer rejected, already enabled [ 371.714920][T15514] syzkaller0: entered promiscuous mode [ 371.742687][T15517] pimreg: left allmulticast mode [ 371.953352][T15530] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2818'. [ 372.119383][T15534] tipc: Enabled bearer , priority 0 [ 372.193952][T15534] tipc: Resetting bearer [ 372.567088][T15559] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2830'. [ 372.601599][T11062] netdevsim netdevsim4 netdevsim0: set [1, 2] type 2 family 0 port 20000 - 0 [ 372.614230][T11062] netdevsim netdevsim4 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 372.639145][T11053] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.662502][T11062] netdevsim netdevsim4 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 372.692223][T11062] netdevsim netdevsim4 netdevsim3: set [1, 2] type 2 family 0 port 20000 - 0 [ 372.705388][T11053] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.742611][T15565] lo speed is unknown, defaulting to 1000 [ 372.750834][T15565] lo speed is unknown, defaulting to 1000 [ 373.154729][ T9] IPVS: starting estimator thread 0... [ 373.221796][T15576] lo speed is unknown, defaulting to 1000 [ 373.229908][T15576] lo speed is unknown, defaulting to 1000 [ 373.275280][T15582] IPVS: using max 25 ests per chain, 60000 per kthread [ 373.706558][T15591] netlink: 140 bytes leftover after parsing attributes in process `syz.4.2836'. [ 374.307778][T15598] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2838'. [ 374.478729][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2840'. [ 374.937278][T15615] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2843'. [ 375.093328][T15615] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2843'. [ 375.454555][T15623] netlink: zone id is out of range [ 375.483122][T15623] netlink: zone id is out of range [ 375.501955][T15623] netlink: zone id is out of range [ 375.542640][T15623] netlink: zone id is out of range [ 375.581420][T15623] netlink: zone id is out of range [ 375.620298][T15623] netlink: zone id is out of range [ 375.635847][T15623] netlink: zone id is out of range [ 375.641780][T15623] netlink: zone id is out of range [ 375.702876][ T55] block nbd14: Possible stuck request ffff888025af0000: control (read@0,1024B). Runtime 240 seconds [ 375.704260][T15623] netlink: zone id is out of range [ 375.714133][ T55] block nbd14: Possible stuck request ffff888025af01c0: control (read@1024,1024B). Runtime 240 seconds [ 375.714175][ T55] block nbd14: Possible stuck request ffff888025af0380: control (read@2048,1024B). Runtime 240 seconds [ 375.714207][ T55] block nbd14: Possible stuck request ffff888025af0540: control (read@3072,1024B). Runtime 240 seconds [ 376.215043][T15643] erspan1: entered promiscuous mode [ 376.253062][T15643] erspan1: entered allmulticast mode [ 376.322605][ T11] block nbd15: Possible stuck request ffff888025b27000: control (read@0,1024B). Runtime 240 seconds [ 376.339475][ T11] block nbd15: Possible stuck request ffff888025b271c0: control (read@1024,1024B). Runtime 240 seconds [ 376.351087][ T11] block nbd15: Possible stuck request ffff888025b27380: control (read@2048,1024B). Runtime 240 seconds [ 376.362851][ T11] block nbd15: Possible stuck request ffff888025b27540: control (read@3072,1024B). Runtime 240 seconds [ 376.564310][T15659] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (131073) [ 376.768718][T15668] sctp: [Deprecated]: syz.3.2856 (pid 15668) Use of int in maxseg socket option. [ 376.768718][T15668] Use struct sctp_assoc_value instead [ 376.980555][ T30] audit: type=1800 audit(1754341668.102:6): pid=15663 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2851" name="memory.events" dev="tmpfs" ino=3056 res=0 errno=0 [ 377.399823][T15665] __nla_validate_parse: 2 callbacks suppressed [ 377.399845][T15665] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2855'. [ 377.432927][T15687] net_ratelimit: 116 callbacks suppressed [ 377.432949][T15687] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 377.435266][T15683] nbd48: detected capacity change from 0 to 127 [ 377.468947][ T5158] block nbd48: Receive control failed (result -32) [ 377.596055][ T11] block nbd16: Possible stuck request ffff88806cf57000: control (read@0,1024B). Runtime 240 seconds [ 377.609137][ T11] block nbd16: Possible stuck request ffff88806cf571c0: control (read@1024,1024B). Runtime 240 seconds [ 377.631362][ T11] block nbd16: Possible stuck request ffff88806cf57380: control (read@2048,1024B). Runtime 240 seconds [ 377.643699][ T11] block nbd16: Possible stuck request ffff88806cf57540: control (read@3072,1024B). Runtime 240 seconds [ 377.650076][T15688] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2862'. [ 377.996169][T15701] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2865'. [ 378.332205][T15713] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input8 [ 378.727717][T15732] netlink: 'syz.3.2872': attribute type 30 has an invalid length. [ 378.744195][T15729] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2873'. [ 378.867846][T15743] netlink: 'syz.0.2875': attribute type 16 has an invalid length. [ 378.876962][T15743] netlink: 'syz.0.2875': attribute type 17 has an invalid length. [ 378.934778][T15743] 8021q: adding VLAN 0 to HW filter on device team0 [ 378.976058][T15743] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 379.153452][T15753] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2879'. [ 379.739006][T15780] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2887'. [ 380.160827][ T55] block nbd17: Possible stuck request ffff88805899e000: control (read@0,1024B). Runtime 240 seconds [ 380.329856][ T5853] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 380.339828][ T5853] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 380.349006][ T5853] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 380.358568][ T5853] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 380.367334][ T5853] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 380.419509][T15799] lo speed is unknown, defaulting to 1000 [ 380.431541][T15799] lo speed is unknown, defaulting to 1000 [ 380.481570][T15803] netlink: 'syz.1.2894': attribute type 21 has an invalid length. [ 380.491896][T15803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2894'. [ 380.688405][T15808] netlink: 'syz.1.2896': attribute type 1 has an invalid length. [ 380.784903][T15815] netlink: 5636 bytes leftover after parsing attributes in process `syz.2.2897'. [ 380.800590][T15815] syz_tun: entered allmulticast mode [ 380.807841][ T55] block nbd18: Possible stuck request ffff88806cf6e000: control (read@0,1024B). Runtime 240 seconds [ 380.819356][ T55] block nbd18: Possible stuck request ffff88806cf6e1c0: control (read@1024,1024B). Runtime 240 seconds [ 380.831960][ T55] block nbd18: Possible stuck request ffff88806cf6e380: control (read@2048,1024B). Runtime 240 seconds [ 380.843751][ T55] block nbd18: Possible stuck request ffff88806cf6e540: control (read@3072,1024B). Runtime 240 seconds [ 380.886645][T15815] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 380.994275][T15817] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 381.200040][T15799] chnl_net:caif_netlink_parms(): no params data found [ 381.283849][T15831] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2902'. [ 381.297764][T15833] netlink: 566 bytes leftover after parsing attributes in process `syz.2.2901'. [ 381.460652][T15799] bridge0: port 1(bridge_slave_0) entered blocking state [ 381.480986][T15799] bridge0: port 1(bridge_slave_0) entered disabled state [ 381.493751][T15799] bridge_slave_0: entered allmulticast mode [ 381.503137][T15799] bridge_slave_0: entered promiscuous mode [ 381.521510][T15799] bridge0: port 2(bridge_slave_1) entered blocking state [ 381.531684][T15799] bridge0: port 2(bridge_slave_1) entered disabled state [ 381.542942][T15799] bridge_slave_1: entered allmulticast mode [ 381.553614][T15799] bridge_slave_1: entered promiscuous mode [ 381.594586][T15848] netlink: 'syz.1.2905': attribute type 64 has an invalid length. [ 381.619491][T15799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 381.640126][T15799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 381.659043][T15850] netlink: 'syz.3.2906': attribute type 18 has an invalid length. [ 381.841316][T15850] netlink: 'syz.3.2906': attribute type 18 has an invalid length. [ 381.923279][T15799] team0: Port device team_slave_0 added [ 381.944857][T15799] team0: Port device team_slave_1 added [ 382.069943][T15799] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 382.083047][T15799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 382.173401][T15799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 382.208369][T15799] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 382.235256][T15799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 382.289743][T15799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 382.321328][T15864] lo speed is unknown, defaulting to 1000 [ 382.329726][T15864] lo speed is unknown, defaulting to 1000 [ 382.363126][T15873] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 382.400171][ T5853] Bluetooth: hci3: command tx timeout [ 382.509815][T15876] veth0_to_team: left allmulticast mode [ 382.533195][T15876] netlink: 'syz.1.2913': attribute type 10 has an invalid length. [ 382.543763][T15799] hsr_slave_0: entered promiscuous mode [ 382.558492][T15799] hsr_slave_1: entered promiscuous mode [ 382.572361][T15799] debugfs: 'hsr0' already exists in 'hsr' [ 382.578981][T15799] Cannot create hsr debugfs directory [ 382.594415][T15876] __nla_validate_parse: 7 callbacks suppressed [ 382.594436][T15876] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.2913'. [ 382.812791][T15878] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2914'. [ 383.333191][T15893] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2920'. [ 383.695018][T15905] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2921'. [ 383.712437][T15904] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2922'. [ 383.846902][T15799] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 383.864881][T15799] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 383.894904][T15799] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 383.924123][T15799] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 384.012815][ T55] block nbd20: Possible stuck request ffff8880534e7000: control (read@0,1024B). Runtime 240 seconds [ 384.021461][T15916] lo speed is unknown, defaulting to 1000 [ 384.024152][ T55] block nbd20: Possible stuck request ffff8880534e71c0: control (read@1024,1024B). Runtime 240 seconds [ 384.041330][ T55] block nbd20: Possible stuck request ffff8880534e7380: control (read@2048,1024B). Runtime 240 seconds [ 384.052638][ T55] block nbd20: Possible stuck request ffff8880534e7540: control (read@3072,1024B). Runtime 240 seconds [ 384.073824][T15916] lo speed is unknown, defaulting to 1000 [ 384.263671][T15799] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.328719][T15799] 8021q: adding VLAN 0 to HW filter on device team0 [ 384.352027][T11059] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.359285][T11059] bridge0: port 1(bridge_slave_0) entered forwarding state [ 384.407008][T11057] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.414216][T11057] bridge0: port 2(bridge_slave_1) entered forwarding state [ 384.494562][ T5853] Bluetooth: hci3: command tx timeout [ 384.499128][T15930] netlink: 'syz.3.2928': attribute type 1 has an invalid length. [ 384.544293][T15930] 8021q: adding VLAN 0 to HW filter on device bond6 [ 384.614079][T15930] 8021q: adding VLAN 0 to HW filter on device bond6 [ 384.623986][T15930] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 384.638930][T15930] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 384.889174][T15939] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2930'. [ 384.933194][T15799] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 384.986770][T15944] macvlan3: entered promiscuous mode [ 384.993937][T15944] macvlan3: entered allmulticast mode [ 385.001103][T15944] bond6: entered promiscuous mode [ 385.031099][T15944] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 385.043483][T15944] bond6: left promiscuous mode [ 385.081017][T15939] macsec1: entered promiscuous mode [ 385.086965][T15939] team0: entered promiscuous mode [ 385.092486][T15939] dummy0: entered promiscuous mode [ 385.099472][T15939] macsec1: entered allmulticast mode [ 385.104792][T15939] team0: entered allmulticast mode [ 385.111524][T15939] dummy0: entered allmulticast mode [ 385.117770][T15939] team0: Device macsec1 is already an upper device of the team interface [ 385.130456][T15939] team0: left allmulticast mode [ 385.135778][T15939] dummy0: left allmulticast mode [ 385.140866][T15939] team0: left promiscuous mode [ 385.145888][T15939] dummy0: left promiscuous mode [ 385.706629][T15799] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 385.820114][T15799] veth0_vlan: entered promiscuous mode [ 385.842500][T15799] veth1_vlan: entered promiscuous mode [ 385.900818][T15799] veth0_macvtap: entered promiscuous mode [ 385.916265][ T11] block nbd21: Possible stuck request ffff88806da47000: control (read@0,4096B). Runtime 210 seconds [ 385.944172][T15799] veth1_macvtap: entered promiscuous mode [ 385.969220][T15799] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 385.993309][T15799] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 386.039737][T11062] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.072206][T11062] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.114604][T11062] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.154754][T11062] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 386.217263][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.236885][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.293671][T11062] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.302860][T11062] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.556295][ T5853] Bluetooth: hci3: command tx timeout [ 386.743532][T15984] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2940'. [ 386.758336][T15984] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2940'. [ 386.797937][T15984] bridge0: port 3(vlan2) entered blocking state [ 386.805607][T15984] bridge0: port 3(vlan2) entered disabled state [ 386.813082][T15984] vlan2: entered allmulticast mode [ 386.822597][T15984] bridge0: entered allmulticast mode [ 386.857904][T15984] vlan2: left allmulticast mode [ 386.862926][T15984] bridge0: left allmulticast mode [ 386.946421][T15992] IPv6: Can't replace route, no match found [ 386.961710][T15988] lo speed is unknown, defaulting to 1000 [ 386.970243][T15988] lo speed is unknown, defaulting to 1000 [ 387.107252][T15997] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2945'. [ 387.143193][T15997] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2945'. [ 387.591468][T16009] delete_channel: no stack [ 387.796127][T16018] IPv6: NLM_F_CREATE should be specified when creating new route [ 387.899211][T16019] sctp: [Deprecated]: syz.1.2951 (pid 16019) Use of int in maxseg socket option. [ 387.899211][T16019] Use struct sctp_assoc_value instead [ 387.923932][T16018] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2951'. [ 388.239954][ T5158] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 388.251066][ T5158] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 388.265017][ T5158] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 388.278603][ T5158] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 388.290340][ T5158] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 388.476141][ T11] block nbd6: Possible stuck request ffff888025820000: control (read@0,4096B). Runtime 270 seconds [ 388.490881][T16023] lo speed is unknown, defaulting to 1000 [ 388.507025][T16023] lo speed is unknown, defaulting to 1000 [ 388.635254][ T5158] Bluetooth: hci3: command tx timeout [ 388.843014][T16041] netlink: 'syz.0.2958': attribute type 1 has an invalid length. [ 389.121446][ T55] block nbd7: Possible stuck request ffff888025857000: control (read@0,1024B). Runtime 270 seconds [ 389.135197][ T55] block nbd7: Possible stuck request ffff8880258571c0: control (read@1024,1024B). Runtime 270 seconds [ 389.151183][ T55] block nbd7: Possible stuck request ffff888025857380: control (read@2048,1024B). Runtime 270 seconds [ 389.168248][ T55] block nbd7: Possible stuck request ffff888025857540: control (read@3072,1024B). Runtime 270 seconds [ 389.399153][T16058] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2964'. [ 389.437815][T16059] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2963'. [ 389.643549][T16023] chnl_net:caif_netlink_parms(): no params data found [ 389.714312][T16065] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2966'. [ 389.758268][T16065] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 389.900644][T16065] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 389.985072][T16074] lo speed is unknown, defaulting to 1000 [ 390.003954][T16074] lo speed is unknown, defaulting to 1000 [ 390.138524][T16023] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.147422][T16023] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.157054][T16023] bridge_slave_0: entered allmulticast mode [ 390.164061][T16083] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2971'. [ 390.165809][T16023] bridge_slave_0: entered promiscuous mode [ 390.184536][T16023] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.192563][T16023] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.205405][T16023] bridge_slave_1: entered allmulticast mode [ 390.213898][T16023] bridge_slave_1: entered promiscuous mode [ 390.323446][ T5158] Bluetooth: hci5: command tx timeout [ 390.396130][ T11] block nbd8: Possible stuck request ffff888025895080: control (read@0,1024B). Runtime 270 seconds [ 390.407539][ T11] block nbd8: Possible stuck request ffff888025895240: control (read@1024,1024B). Runtime 270 seconds [ 390.418996][ T11] block nbd8: Possible stuck request ffff888025895400: control (read@2048,1024B). Runtime 270 seconds [ 390.431593][ T11] block nbd8: Possible stuck request ffff8880258955c0: control (read@3072,1024B). Runtime 270 seconds [ 390.458622][T16023] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 390.504450][T16075] batadv_slave_1: entered promiscuous mode [ 390.510715][T16096] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input9 [ 390.520519][T16023] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 390.675524][T16081] netlink: 11 bytes leftover after parsing attributes in process `syz.3.2969'. [ 390.703925][T16023] team0: Port device team_slave_0 added [ 390.774184][T16023] team0: Port device team_slave_1 added [ 390.801986][T16105] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2977'. [ 390.895588][T16023] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 390.909999][T16023] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 390.965934][T16023] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 390.984015][T16073] batadv_slave_1: left promiscuous mode [ 391.032144][T16023] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.051414][T16023] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 391.129018][T16023] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 391.259942][T16109] lo speed is unknown, defaulting to 1000 [ 391.403534][T16109] lo speed is unknown, defaulting to 1000 [ 391.467871][T16023] hsr_slave_0: entered promiscuous mode [ 391.503820][T16023] hsr_slave_1: entered promiscuous mode [ 391.511958][T16023] debugfs: 'hsr0' already exists in 'hsr' [ 391.525640][T16023] Cannot create hsr debugfs directory [ 391.567382][T16119] sctp: [Deprecated]: syz.1.2981 (pid 16119) Use of int in max_burst socket option deprecated. [ 391.567382][T16119] Use struct sctp_assoc_value instead [ 391.877985][T16023] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.896214][T16023] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 391.967883][T16023] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.978071][T16023] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.056383][T16023] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.067760][T16023] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.134103][T16023] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.154248][T16023] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 392.395439][ T5158] Bluetooth: hci5: command tx timeout [ 392.693906][T16126] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2983'. [ 392.802235][T16023] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 392.844739][T16023] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 392.900178][T16023] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 392.918760][ T5853] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 392.941444][ T5853] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 392.951038][ T5853] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 392.959751][ T5853] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 392.989164][ T5853] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 392.989696][ T55] block nbd9: Possible stuck request ffff8880258e7000: control (read@0,1024B). Runtime 270 seconds [ 393.008274][ T55] block nbd9: Possible stuck request ffff8880258e71c0: control (read@1024,1024B). Runtime 270 seconds [ 393.019908][ T55] block nbd9: Possible stuck request ffff8880258e7380: control (read@2048,1024B). Runtime 270 seconds [ 393.031746][ T55] block nbd9: Possible stuck request ffff8880258e7540: control (read@3072,1024B). Runtime 270 seconds [ 393.079731][T16023] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 393.220531][T16127] lo speed is unknown, defaulting to 1000 [ 393.244201][T16127] lo speed is unknown, defaulting to 1000 [ 393.498605][T16023] 8021q: adding VLAN 0 to HW filter on device bond0 [ 393.560471][T16023] 8021q: adding VLAN 0 to HW filter on device team0 [ 393.610590][T11043] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.617848][T11043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 393.639572][T16145] Bluetooth: MGMT ver 1.23 [ 393.651011][T16145] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2987'. [ 393.741097][T11043] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.749516][T11043] bridge0: port 2(bridge_slave_1) entered forwarding state [ 393.869417][T16023] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 394.097514][T16158] pim6reg1: entered promiscuous mode [ 394.142377][T16158] pim6reg1: entered allmulticast mode [ 394.476328][ T5853] Bluetooth: hci5: command tx timeout [ 394.727853][ T30] audit: type=1800 audit(1754341685.852:7): pid=16181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2993" name="memory.events" dev="tmpfs" ino=3141 res=0 errno=0 [ 394.854610][ T30] audit: type=1804 audit(1754341685.862:8): pid=16182 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.2993" name="/newroot/607/memory.events" dev="tmpfs" ino=3141 res=1 errno=0 [ 394.888187][ T11] block nbd11: Possible stuck request ffff888025987000: control (read@0,1024B). Runtime 270 seconds [ 394.899814][ T11] block nbd11: Possible stuck request ffff8880259871c0: control (read@1024,1024B). Runtime 270 seconds [ 394.911783][ T11] block nbd11: Possible stuck request ffff888025987380: control (read@2048,1024B). Runtime 270 seconds [ 394.923616][ T11] block nbd11: Possible stuck request ffff888025987540: control (read@3072,1024B). Runtime 270 seconds [ 395.016878][T16023] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 395.101747][T16127] chnl_net:caif_netlink_parms(): no params data found [ 395.116378][ T5853] Bluetooth: hci0: command tx timeout [ 395.164175][T16184] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2994'. [ 395.467539][T16204] syz.3.2998: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 395.498607][T16204] CPU: 0 UID: 0 PID: 16204 Comm: syz.3.2998 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 395.498641][T16204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 395.498661][T16204] Call Trace: [ 395.498670][T16204] [ 395.498684][T16204] dump_stack_lvl+0x189/0x250 [ 395.498717][T16204] ? __pfx_dump_stack_lvl+0x10/0x10 [ 395.498741][T16204] ? __pfx__printk+0x10/0x10 [ 395.498770][T16204] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 395.498797][T16204] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 395.498825][T16204] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 395.498853][T16204] warn_alloc+0x214/0x310 [ 395.498877][T16204] ? stack_depot_save_flags+0x40/0x900 [ 395.498910][T16204] ? __pfx_warn_alloc+0x10/0x10 [ 395.498936][T16204] ? kasan_save_track+0x4f/0x80 [ 395.498968][T16204] ? xskq_create+0x56/0x170 [ 395.498996][T16204] ? xsk_init_queue+0xb0/0x110 [ 395.499022][T16204] ? xsk_setsockopt+0x4dc/0x8d0 [ 395.499047][T16204] ? do_sock_setsockopt+0x17c/0x1b0 [ 395.499066][T16204] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 395.499086][T16204] ? do_syscall_64+0xfa/0x3b0 [ 395.499117][T16204] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.499149][T16204] __vmalloc_node_range_noprof+0x125/0x12f0 [ 395.499207][T16204] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 395.499229][T16204] ? xskq_create+0x56/0x170 [ 395.499262][T16204] ? __kasan_kmalloc+0x93/0xb0 [ 395.499298][T16204] vmalloc_user_noprof+0xad/0xf0 [ 395.499320][T16204] ? xskq_create+0xbf/0x170 [ 395.499352][T16204] xskq_create+0xbf/0x170 [ 395.499386][T16204] xsk_init_queue+0xb0/0x110 [ 395.499418][T16204] xsk_setsockopt+0x4dc/0x8d0 [ 395.499450][T16204] ? __pfx_xsk_setsockopt+0x10/0x10 [ 395.499478][T16204] ? __pfx_aa_sk_perm+0x10/0x10 [ 395.499510][T16204] ? aa_sock_opt_perm+0x74/0x110 [ 395.499541][T16204] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 395.499565][T16204] ? __pfx_xsk_setsockopt+0x10/0x10 [ 395.499595][T16204] do_sock_setsockopt+0x17c/0x1b0 [ 395.499622][T16204] __x64_sys_setsockopt+0x13f/0x1b0 [ 395.499650][T16204] do_syscall_64+0xfa/0x3b0 [ 395.499681][T16204] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.499711][T16204] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.499732][T16204] ? clear_bhb_loop+0x60/0xb0 [ 395.499759][T16204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.499779][T16204] RIP: 0033:0x7f65f058eb69 [ 395.499800][T16204] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 395.499820][T16204] RSP: 002b:00007f65f135a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 395.499844][T16204] RAX: ffffffffffffffda RBX: 00007f65f07b6080 RCX: 00007f65f058eb69 [ 395.499860][T16204] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 395.499873][T16204] RBP: 00007f65f0611df1 R08: 0000000000000004 R09: 0000000000000000 [ 395.499887][T16204] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 395.499908][T16204] R13: 0000000000000000 R14: 00007f65f07b6080 R15: 00007fff15618a58 [ 395.499942][T16204] [ 395.499957][T16204] Mem-Info: [ 395.825970][T16127] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.834358][T16204] active_anon:12432 inactive_anon:0 isolated_anon:0 [ 395.834358][T16204] active_file:2054 inactive_file:39971 isolated_file:0 [ 395.834358][T16204] unevictable:768 dirty:268 writeback:0 [ 395.834358][T16204] slab_reclaimable:13486 slab_unreclaimable:152418 [ 395.834358][T16204] mapped:40800 shmem:4236 pagetables:1171 [ 395.834358][T16204] sec_pagetables:0 bounce:0 [ 395.834358][T16204] kernel_misc_reclaimable:0 [ 395.834358][T16204] free:1220342 free_pcp:32776 free_cma:0 [ 395.838641][T16212] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2999'. [ 395.882633][T16127] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.901511][T16127] bridge_slave_0: entered allmulticast mode [ 395.910979][T16204] Node 0 active_anon:49728kB inactive_anon:0kB active_file:8216kB inactive_file:159684kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:163200kB dirty:1072kB writeback:0kB shmem:15408kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:15128kB pagetables:4420kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 395.948863][T16127] bridge_slave_0: entered promiscuous mode [ 395.987170][T16204] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 396.036175][T16127] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.044098][T16204] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.048395][T16127] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.092617][T16204] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 396.099031][T16127] bridge_slave_1: entered allmulticast mode [ 396.102850][T16204] Node 0 DMA32 free:965888kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:49580kB inactive_anon:0kB active_file:8216kB inactive_file:157844kB unevictable:1536kB writepending:1068kB present:3129332kB managed:2560292kB mlocked:0kB bounce:0kB free_pcp:109424kB local_pcp:76384kB free_cma:0kB [ 396.108843][T16127] bridge_slave_1: entered promiscuous mode [ 396.154220][T16217] FAULT_INJECTION: forcing a failure. [ 396.154220][T16217] name failslab, interval 1, probability 0, space 0, times 0 [ 396.160610][T16204] lowmem_reserve[]: 0 0 1 1 1 [ 396.168836][T16217] CPU: 0 UID: 0 PID: 16217 Comm: syz.1.3000 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 396.168881][T16217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 396.168897][T16217] Call Trace: [ 396.168906][T16217] [ 396.168916][T16217] dump_stack_lvl+0x189/0x250 [ 396.168950][T16217] ? __pfx____ratelimit+0x10/0x10 [ 396.168987][T16217] ? __pfx_dump_stack_lvl+0x10/0x10 [ 396.169013][T16217] ? __pfx__printk+0x10/0x10 [ 396.169062][T16217] should_fail_ex+0x414/0x560 [ 396.169107][T16217] should_failslab+0xa8/0x100 [ 396.169134][T16217] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 396.169173][T16217] ? __alloc_skb+0x112/0x2d0 [ 396.169207][T16217] ? kasan_quarantine_put+0xdd/0x220 [ 396.169247][T16217] __alloc_skb+0x112/0x2d0 [ 396.169290][T16217] create_monitor_event+0xbf/0x8b0 [ 396.169326][T16217] ? send_monitor_replay+0x3a7/0x610 [ 396.169354][T16217] send_monitor_replay+0x3c0/0x610 [ 396.169386][T16217] hci_sock_bind+0x772/0x1000 [ 396.169424][T16217] ? __pfx_aa_sk_perm+0x10/0x10 [ 396.169453][T16217] ? tomoyo_socket_bind_permission+0x150/0x290 [ 396.169492][T16217] ? __pfx_hci_sock_bind+0x10/0x10 [ 396.169537][T16217] ? bpf_lsm_socket_bind+0x9/0x20 [ 396.169570][T16217] __sys_bind+0x2c3/0x3e0 [ 396.169606][T16217] ? __pfx___sys_bind+0x10/0x10 [ 396.169658][T16217] ? __pfx_ksys_write+0x10/0x10 [ 396.169689][T16217] ? rcu_is_watching+0x15/0xb0 [ 396.169739][T16217] __x64_sys_bind+0x7a/0x90 [ 396.169775][T16217] do_syscall_64+0xfa/0x3b0 [ 396.169811][T16217] ? lockdep_hardirqs_on+0x9c/0x150 [ 396.169844][T16217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.169877][T16217] ? clear_bhb_loop+0x60/0xb0 [ 396.169908][T16217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.169933][T16217] RIP: 0033:0x7f913cf8eb69 [ 396.169958][T16217] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 396.169980][T16217] RSP: 002b:00007f913de24038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 396.170010][T16217] RAX: ffffffffffffffda RBX: 00007f913d1b5fa0 RCX: 00007f913cf8eb69 [ 396.170028][T16217] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000005 [ 396.170043][T16217] RBP: 00007f913de24090 R08: 0000000000000000 R09: 0000000000000000 [ 396.170059][T16217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 396.170074][T16217] R13: 0000000000000000 R14: 00007f913d1b5fa0 R15: 00007fff24d68538 [ 396.170113][T16217] [ 396.427920][T16204] Node 0 Normal free:4kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1840kB unevictable:0kB writepending:4kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 396.432425][T16023] veth0_vlan: entered promiscuous mode [ 396.456993][T16204] lowmem_reserve[]: 0 0 0 0 0 [ 396.469055][T16204] Node 1 Normal free:3899528kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:21728kB local_pcp:11104kB free_cma:0kB [ 396.504297][T16023] veth1_vlan: entered promiscuous mode [ 396.526140][T16204] lowmem_reserve[]: 0 0 0 0 0 [ 396.539599][T16204] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 396.555477][ T5853] Bluetooth: hci5: command tx timeout [ 396.561646][T16204] Node 0 DMA32: 836*4kB (UME) 389*8kB (UM) 346*16kB (UME) 104*32kB (M) 9*64kB (M) 13*128kB (UME) 5*256kB (UME) 2*512kB (ME) 4*1024kB (UME) 3*2048kB (UME) 231*4096kB (UM) = 976280kB [ 396.589704][T16204] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 396.602157][T16204] Node 1 Normal: 168*4kB (UE) 49*8kB (UME) 48*16kB (UME) 69*32kB (UME) 25*64kB (UME) 5*128kB (UME) 6*256kB (UME) 5*512kB (UME) 2*1024kB (ME) 2*2048kB (UE) 948*4096kB (M) = 3899528kB [ 396.625821][T16204] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 396.636577][T16204] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 396.646387][T16204] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 396.656661][T16204] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 396.667021][T16204] 46260 total pagecache pages [ 396.672199][T16204] 0 pages in swap cache [ 396.676789][T16204] Free swap = 124996kB [ 396.681087][T16204] Total swap = 124996kB [ 396.685956][T16204] 2097051 pages RAM [ 396.689791][T16204] 0 pages HighMem/MovableOnly [ 396.694504][T16204] 424872 pages reserved [ 396.698939][T16204] 0 pages cma reserved [ 396.759126][T16205] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 397.506115][T16241] netlink: 'syz.1.3006': attribute type 39 has an invalid length. [ 398.778943][T16127] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 398.859319][T16127] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.031352][T16127] team0: Port device team_slave_0 added [ 399.056550][T16127] team0: Port device team_slave_1 added [ 399.063186][T16250] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3009'. [ 399.098820][T16248] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3008'. [ 399.178448][T16127] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.208982][T16127] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.238029][T16127] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.255537][T16127] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.262720][T16127] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.324264][T16127] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 399.350144][T16253] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.3011'. [ 399.482791][T16023] veth0_macvtap: entered promiscuous mode [ 399.894253][T16127] hsr_slave_0: entered promiscuous mode [ 399.901616][T16127] hsr_slave_1: entered promiscuous mode [ 399.908243][T16127] debugfs: 'hsr0' already exists in 'hsr' [ 399.914214][T16127] Cannot create hsr debugfs directory [ 399.942577][T16023] veth1_macvtap: entered promiscuous mode [ 400.117730][T16023] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 400.172454][T16023] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 400.251532][T11043] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.277599][T11043] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.328023][T16265] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3015'. [ 400.359427][T11043] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.370021][T11043] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.394668][T16271] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3017'. [ 400.576360][T16269] netem: change failed [ 400.647681][T16127] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 400.690640][T16127] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 400.722917][T16127] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 400.812084][T16127] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 400.909025][T16265] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 400.960740][T16265] syzkaller0: entered promiscuous mode [ 400.974948][T16265] syzkaller0: entered allmulticast mode [ 401.012791][T16267] lo speed is unknown, defaulting to 1000 [ 401.026371][T16267] lo speed is unknown, defaulting to 1000 [ 401.026852][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.066924][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.139134][T11053] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.161611][T11053] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 403.509508][T16307] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3019'. [ 403.531102][T16127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 403.591158][T16127] 8021q: adding VLAN 0 to HW filter on device team0 [ 403.671769][T11062] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.679041][T11062] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.712372][T11062] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.719719][T11062] bridge0: port 2(bridge_slave_1) entered forwarding state [ 404.292542][T16127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 404.410254][T16334] (unnamed net_device) (uninitialized): option mode: invalid value (254) [ 404.499651][T16341] (unnamed net_device) (uninitialized): option mode: invalid value (254) [ 404.564350][T16339] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3029'. [ 404.574747][T16339] sctp: [Deprecated]: syz.0.3029 (pid 16339) Use of struct sctp_assoc_value in delayed_ack socket option. [ 404.574747][T16339] Use struct sctp_sack_info instead [ 404.716625][T16344] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3030'. [ 404.737498][T16351] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 404.775597][T16354] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3033'. [ 405.082487][T16367] FAULT_INJECTION: forcing a failure. [ 405.082487][T16367] name failslab, interval 1, probability 0, space 0, times 0 [ 405.096486][T16367] CPU: 0 UID: 0 PID: 16367 Comm: syz.3.3038 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 405.096520][T16367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 405.096534][T16367] Call Trace: [ 405.096543][T16367] [ 405.096558][T16367] dump_stack_lvl+0x189/0x250 [ 405.096593][T16367] ? __pfx____ratelimit+0x10/0x10 [ 405.096626][T16367] ? __pfx_dump_stack_lvl+0x10/0x10 [ 405.096650][T16367] ? __pfx__printk+0x10/0x10 [ 405.096693][T16367] should_fail_ex+0x414/0x560 [ 405.096735][T16367] should_failslab+0xa8/0x100 [ 405.096758][T16367] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 405.096793][T16367] ? __alloc_skb+0x112/0x2d0 [ 405.096824][T16367] ? kasan_quarantine_put+0xdd/0x220 [ 405.096859][T16367] __alloc_skb+0x112/0x2d0 [ 405.096898][T16367] create_monitor_event+0xbf/0x8b0 [ 405.096930][T16367] ? send_monitor_replay+0x3a7/0x610 [ 405.096956][T16367] send_monitor_replay+0x3c0/0x610 [ 405.096985][T16367] hci_sock_bind+0x772/0x1000 [ 405.097019][T16367] ? __pfx_aa_sk_perm+0x10/0x10 [ 405.097044][T16367] ? tomoyo_socket_bind_permission+0x150/0x290 [ 405.097080][T16367] ? __pfx_hci_sock_bind+0x10/0x10 [ 405.097119][T16367] ? bpf_lsm_socket_bind+0x9/0x20 [ 405.097149][T16367] __sys_bind+0x2c3/0x3e0 [ 405.097183][T16367] ? __pfx___sys_bind+0x10/0x10 [ 405.097227][T16367] ? __pfx_ksys_write+0x10/0x10 [ 405.097255][T16367] ? rcu_is_watching+0x15/0xb0 [ 405.097299][T16367] __x64_sys_bind+0x7a/0x90 [ 405.097331][T16367] do_syscall_64+0xfa/0x3b0 [ 405.097362][T16367] ? lockdep_hardirqs_on+0x9c/0x150 [ 405.097392][T16367] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.097413][T16367] ? clear_bhb_loop+0x60/0xb0 [ 405.097441][T16367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.097461][T16367] RIP: 0033:0x7f65f058eb69 [ 405.097482][T16367] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 405.097501][T16367] RSP: 002b:00007f65f137b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 405.097526][T16367] RAX: ffffffffffffffda RBX: 00007f65f07b5fa0 RCX: 00007f65f058eb69 [ 405.097541][T16367] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000005 [ 405.097560][T16367] RBP: 00007f65f137b090 R08: 0000000000000000 R09: 0000000000000000 [ 405.097572][T16367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 405.097584][T16367] R13: 0000000000000000 R14: 00007f65f07b5fa0 R15: 00007fff15618a58 [ 405.097617][T16367] [ 405.115527][T16372] mac80211_hwsim hwsim32 wlan0: entered promiscuous mode [ 405.374321][T16372] macsec1: entered allmulticast mode [ 405.377972][T16379] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3039'. [ 405.385566][T16372] mac80211_hwsim hwsim32 wlan0: entered allmulticast mode [ 405.409798][T16372] mac80211_hwsim hwsim32 wlan0: left allmulticast mode [ 405.417533][T16372] mac80211_hwsim hwsim32 wlan0: left promiscuous mode [ 405.611053][T16127] veth0_vlan: entered promiscuous mode [ 405.697264][T16127] veth1_vlan: entered promiscuous mode [ 405.757784][ T55] block nbd14: Possible stuck request ffff888025af0000: control (read@0,1024B). Runtime 270 seconds [ 405.769731][ T55] block nbd14: Possible stuck request ffff888025af01c0: control (read@1024,1024B). Runtime 270 seconds [ 405.781211][ T55] block nbd14: Possible stuck request ffff888025af0380: control (read@2048,1024B). Runtime 270 seconds [ 405.793776][ T55] block nbd14: Possible stuck request ffff888025af0540: control (read@3072,1024B). Runtime 270 seconds [ 405.866755][T16127] veth0_macvtap: entered promiscuous mode [ 405.879499][T16127] veth1_macvtap: entered promiscuous mode [ 405.901791][T16395] netlink: 'syz.3.3041': attribute type 1 has an invalid length. [ 405.931342][T16127] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 405.950677][T16127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 405.976329][T16395] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3041'. [ 405.989716][T11057] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.034233][T11057] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.064134][T11057] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.127740][T11057] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.177337][T16397] lo speed is unknown, defaulting to 1000 [ 406.238870][T16397] lo speed is unknown, defaulting to 1000 [ 406.408661][ T11] block nbd15: Possible stuck request ffff888025b27000: control (read@0,1024B). Runtime 270 seconds [ 406.410937][T11057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 406.420873][ T11] block nbd15: Possible stuck request ffff888025b271c0: control (read@1024,1024B). Runtime 270 seconds [ 406.445819][ T11] block nbd15: Possible stuck request ffff888025b27380: control (read@2048,1024B). Runtime 270 seconds [ 406.458079][ T11] block nbd15: Possible stuck request ffff888025b27540: control (read@3072,1024B). Runtime 270 seconds [ 406.468133][T11057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 406.564818][T16406] lo speed is unknown, defaulting to 1000 [ 406.676069][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 406.683955][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 406.699516][T16419] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (71) [ 406.711494][T16420] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (71) [ 406.738169][T16418] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3047'. [ 406.747541][T16418] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3047'. [ 406.906782][T16406] lo speed is unknown, defaulting to 1000 [ 407.126787][T16437] bond0: option use_carrier: invalid value (2) [ 407.206522][T16438] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3050'. [ 407.678304][ T11] block nbd16: Possible stuck request ffff88806cf57000: control (read@0,1024B). Runtime 270 seconds [ 407.689352][ T11] block nbd16: Possible stuck request ffff88806cf571c0: control (read@1024,1024B). Runtime 270 seconds [ 407.701177][ T11] block nbd16: Possible stuck request ffff88806cf57380: control (read@2048,1024B). Runtime 270 seconds [ 407.713154][ T11] block nbd16: Possible stuck request ffff88806cf57540: control (read@3072,1024B). Runtime 270 seconds [ 408.066075][T16439] delete_channel: no stack [ 408.414758][ T5842] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 408.440264][ T5842] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 408.481220][ T5842] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 408.493382][ T5842] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 408.503359][ T5842] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 408.623211][T16457] lo speed is unknown, defaulting to 1000 [ 408.661481][T16457] lo speed is unknown, defaulting to 1000 [ 408.679400][T16469] lo speed is unknown, defaulting to 1000 [ 408.795325][ T5853] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 408.801857][ T5853] Bluetooth: hci2: command 0x0401 tx timeout [ 408.824810][T16475] !: renamed from dummy0 (while UP) [ 408.854342][T16479] batadv_slave_0: entered promiscuous mode [ 408.862030][T16477] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3060'. [ 408.936538][T16477] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 409.092876][T16477] batadv_slave_0 (unregistering): left promiscuous mode [ 409.103131][T16477] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 409.238308][T16469] lo speed is unknown, defaulting to 1000 [ 409.767072][T16494] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3063'. [ 409.857554][T16494] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3063'. [ 409.867759][T16497] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3064'. [ 409.898576][T16497] smc: net device bond0 applied user defined pnetid SYZ [ 409.905773][T16494] vxcan0: entered promiscuous mode [ 409.913985][T16499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3063'. [ 409.956277][T16494] vxcan0: entered allmulticast mode [ 409.987001][T16481] lo speed is unknown, defaulting to 1000 [ 410.239684][ T55] block nbd17: Possible stuck request ffff88805899e000: control (read@0,1024B). Runtime 270 seconds [ 410.367437][T16481] lo speed is unknown, defaulting to 1000 [ 410.565746][ T5853] Bluetooth: hci1: command tx timeout [ 410.891197][ T55] block nbd18: Possible stuck request ffff88806cf6e000: control (read@0,1024B). Runtime 270 seconds [ 410.904104][ T55] block nbd18: Possible stuck request ffff88806cf6e1c0: control (read@1024,1024B). Runtime 270 seconds [ 410.915637][ T55] block nbd18: Possible stuck request ffff88806cf6e380: control (read@2048,1024B). Runtime 270 seconds [ 410.926998][ T55] block nbd18: Possible stuck request ffff88806cf6e540: control (read@3072,1024B). Runtime 270 seconds [ 411.058617][T16507] delete_channel: no stack [ 411.378313][T16531] lo speed is unknown, defaulting to 1000 [ 411.450006][T16469] chnl_net:caif_netlink_parms(): no params data found [ 411.536241][T16531] lo speed is unknown, defaulting to 1000 [ 411.888172][T16539] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 411.913052][T16469] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.942309][T16469] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.967048][T16469] bridge_slave_0: entered allmulticast mode [ 411.991403][T16543] netlink: 'syz.5.3074': attribute type 1 has an invalid length. [ 411.997631][T16469] bridge_slave_0: entered promiscuous mode [ 412.006231][T16543] netlink: 84 bytes leftover after parsing attributes in process `syz.5.3074'. [ 412.153410][T16469] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.163495][T16469] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.185583][T16469] bridge_slave_1: entered allmulticast mode [ 412.225149][T16469] bridge_slave_1: entered promiscuous mode [ 412.320870][T16547] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3076'. [ 412.489798][T16549] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 412.511860][T16469] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 412.633262][T16469] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 412.642983][ T5853] Bluetooth: hci1: command tx timeout [ 412.791906][T16469] team0: Port device team_slave_0 added [ 412.829334][T16469] team0: Port device team_slave_1 added [ 412.861949][T16557] netlink: 'syz.0.3080': attribute type 2 has an invalid length. [ 412.945787][T16557] þ`Ì: entered promiscuous mode [ 413.032614][T16469] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 413.051761][T16469] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 413.081660][T16469] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 413.109402][T16469] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 413.137339][T16469] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 413.173703][T16469] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 413.283440][T16562] geneve0: entered allmulticast mode [ 413.349659][T16469] hsr_slave_0: entered promiscuous mode [ 413.379327][T16469] hsr_slave_1: entered promiscuous mode [ 413.392998][T16469] debugfs: 'hsr0' already exists in 'hsr' [ 413.403736][T16469] Cannot create hsr debugfs directory [ 413.445475][T16553] delete_channel: no stack [ 413.717667][T16586] openvswitch: netlink: Tunnel attr 16370 out of range max 16 [ 413.732903][T16575] lo speed is unknown, defaulting to 1000 [ 413.754781][T16575] lo speed is unknown, defaulting to 1000 [ 413.832305][T16586] openvswitch: netlink: Tunnel attr 16370 out of range max 16 [ 413.956410][T16595] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3087'. [ 414.105337][ T55] block nbd20: Possible stuck request ffff8880534e7000: control (read@0,1024B). Runtime 270 seconds [ 414.116421][ T55] block nbd20: Possible stuck request ffff8880534e71c0: control (read@1024,1024B). Runtime 270 seconds [ 414.127746][ T55] block nbd20: Possible stuck request ffff8880534e7380: control (read@2048,1024B). Runtime 270 seconds [ 414.139044][ T55] block nbd20: Possible stuck request ffff8880534e7540: control (read@3072,1024B). Runtime 270 seconds [ 414.484452][T16469] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 414.530672][T16469] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 414.659451][T16587] netlink: 'syz.5.3086': attribute type 6 has an invalid length. [ 414.717218][ T5853] Bluetooth: hci1: command tx timeout [ 414.738307][T16469] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 414.816035][T16469] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 415.018575][T16628] ip_vti0: Master is either lo or non-ether device [ 415.079077][T16469] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 415.106937][T16469] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 415.284047][T16634] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3100'. [ 415.320867][T16639] netlink: 'syz.1.3102': attribute type 1 has an invalid length. [ 415.331044][T16639] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3102'. [ 415.371967][T16469] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 415.384701][T16469] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 415.513547][ T37] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 415.529377][ T37] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 415.580416][ T37] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 415.590199][ T37] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 415.634165][T16654] netlink: 'syz.1.3105': attribute type 29 has an invalid length. [ 415.665065][T16654] netlink: 'syz.1.3105': attribute type 29 has an invalid length. [ 415.999920][ T11] block nbd21: Possible stuck request ffff88806da47000: control (read@0,4096B). Runtime 240 seconds [ 416.221138][T16469] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 416.299989][T16469] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 416.358489][T16469] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 416.405544][T16469] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 416.464020][T16676] lo speed is unknown, defaulting to 1000 [ 416.472502][T16676] lo speed is unknown, defaulting to 1000 [ 416.632103][T16685] lo speed is unknown, defaulting to 1000 [ 416.795983][ T5853] Bluetooth: hci1: command tx timeout [ 416.807552][T16469] 8021q: adding VLAN 0 to HW filter on device bond0 [ 416.870775][T16699] team0: Port device dummy0 removed [ 416.881894][T16699] batman_adv: batadv0: Removing interface: ip6gretap1 [ 416.918079][T16699] bond3: (slave gretap1): Releasing active interface [ 416.934093][T16699] batman_adv: batadv0: Removing interface: macvlan3 [ 416.952698][T16699] netlink: 'syz.1.3117': attribute type 10 has an invalid length. [ 416.964481][T16685] lo speed is unknown, defaulting to 1000 [ 416.981711][T16469] 8021q: adding VLAN 0 to HW filter on device team0 [ 417.157981][T11062] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.165215][T11062] bridge0: port 1(bridge_slave_0) entered forwarding state [ 417.184343][T11062] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.191632][T11062] bridge0: port 2(bridge_slave_1) entered forwarding state [ 417.317890][T16704] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3118'. [ 417.772206][T16716] netlink: 'syz.2.3122': attribute type 1 has an invalid length. [ 417.845902][T16713] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3121'. [ 417.961509][T16726] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3123'. [ 418.223323][T16469] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 418.280055][T16733] netlink: 'syz.2.3125': attribute type 4 has an invalid length. [ 418.503950][T16469] veth0_vlan: entered promiscuous mode [ 418.554442][T16469] veth1_vlan: entered promiscuous mode [ 418.561906][ T11] block nbd6: Possible stuck request ffff888025820000: control (read@0,4096B). Runtime 300 seconds [ 418.620271][T16469] veth0_macvtap: entered promiscuous mode [ 418.631561][T16469] veth1_macvtap: entered promiscuous mode [ 418.650133][T16742] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3131'. [ 418.764913][T16750] delete_channel: no stack [ 418.865803][T16742] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3131'. [ 418.875000][T16742] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3131'. [ 418.907703][T16469] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 419.009763][T16754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3133'. [ 419.036552][T16469] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 419.084695][T11047] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.120674][T11047] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.148381][T11047] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.202427][ T55] block nbd7: Possible stuck request ffff888025857000: control (read@0,1024B). Runtime 300 seconds [ 419.213551][ T55] block nbd7: Possible stuck request ffff8880258571c0: control (read@1024,1024B). Runtime 300 seconds [ 419.225777][ T55] block nbd7: Possible stuck request ffff888025857380: control (read@2048,1024B). Runtime 300 seconds [ 419.237169][ T55] block nbd7: Possible stuck request ffff888025857540: control (read@3072,1024B). Runtime 300 seconds [ 419.288688][T11047] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.887695][T11057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 419.926704][T11057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.051019][T11047] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 420.058391][T16773] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3138'. [ 420.083594][T11047] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.088499][T16773] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 420.133169][T16773] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 420.147633][T16773] (unnamed net_device) (uninitialized): option use_carrier: invalid value (5) [ 420.408971][T16782] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3052'. [ 420.430815][T16782] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3052'. [ 420.479741][ T11] block nbd8: Possible stuck request ffff888025895080: control (read@0,1024B). Runtime 300 seconds [ 420.493058][ T11] block nbd8: Possible stuck request ffff888025895240: control (read@1024,1024B). Runtime 300 seconds [ 420.507159][ T11] block nbd8: Possible stuck request ffff888025895400: control (read@2048,1024B). Runtime 300 seconds [ 420.518878][ T11] block nbd8: Possible stuck request ffff8880258955c0: control (read@3072,1024B). Runtime 300 seconds [ 420.694032][T16783] syz.5.3141: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 420.805256][T16783] CPU: 1 UID: 0 PID: 16783 Comm: syz.5.3141 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 420.805292][T16783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 420.805307][T16783] Call Trace: [ 420.805316][T16783] [ 420.805326][T16783] dump_stack_lvl+0x189/0x250 [ 420.805359][T16783] ? __pfx_dump_stack_lvl+0x10/0x10 [ 420.805382][T16783] ? __pfx__printk+0x10/0x10 [ 420.805410][T16783] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 420.805435][T16783] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 420.805461][T16783] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 420.805488][T16783] warn_alloc+0x214/0x310 [ 420.805517][T16783] ? __pfx_warn_alloc+0x10/0x10 [ 420.805549][T16783] ? __get_vm_area_node+0x28f/0x300 [ 420.805584][T16783] ? packet_set_ring+0x6f4/0x2380 [ 420.805612][T16783] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 420.805667][T16783] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 420.805690][T16783] ? alloc_pages_mpol+0x3cd/0x4a0 [ 420.805727][T16783] ? packet_set_ring+0x6f4/0x2380 [ 420.805751][T16783] vzalloc_noprof+0xb2/0xf0 [ 420.805771][T16783] ? packet_set_ring+0x6f4/0x2380 [ 420.805795][T16783] packet_set_ring+0x6f4/0x2380 [ 420.805854][T16783] ? __pfx_packet_set_ring+0x10/0x10 [ 420.805902][T16783] ? _copy_from_user+0x94/0xb0 [ 420.805936][T16783] packet_setsockopt+0xc5a/0x12c0 [ 420.805963][T16783] ? __pfx_packet_setsockopt+0x10/0x10 [ 420.805993][T16783] ? __lock_acquire+0xab9/0xd20 [ 420.806028][T16783] ? aa_sk_perm+0x81e/0x950 [ 420.806059][T16783] ? __pfx_aa_sk_perm+0x10/0x10 [ 420.806088][T16783] ? __fget_files+0x2a/0x420 [ 420.806108][T16783] ? aa_sock_opt_perm+0x74/0x110 [ 420.806140][T16783] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 420.806164][T16783] ? __pfx_packet_setsockopt+0x10/0x10 [ 420.806191][T16783] do_sock_setsockopt+0x17c/0x1b0 [ 420.806218][T16783] __x64_sys_setsockopt+0x13f/0x1b0 [ 420.806245][T16783] do_syscall_64+0xfa/0x3b0 [ 420.806276][T16783] ? lockdep_hardirqs_on+0x9c/0x150 [ 420.806306][T16783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.806328][T16783] ? clear_bhb_loop+0x60/0xb0 [ 420.806355][T16783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.806376][T16783] RIP: 0033:0x7f80dbf8eb69 [ 420.806396][T16783] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 420.806415][T16783] RSP: 002b:00007f80dce2b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 420.806440][T16783] RAX: ffffffffffffffda RBX: 00007f80dc1b6160 RCX: 00007f80dbf8eb69 [ 420.806457][T16783] RDX: 000000000000000d RSI: 0000000000000107 RDI: 0000000000000008 [ 420.806469][T16783] RBP: 00007f80dc011df1 R08: 000000000000001c R09: 0000000000000000 [ 420.806482][T16783] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 420.806497][T16783] R13: 0000000000000001 R14: 00007f80dc1b6160 R15: 00007ffeb4a6d7d8 [ 420.806532][T16783] [ 420.806540][T16783] Mem-Info: [ 420.865887][T16791] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3144'. [ 421.127349][T16783] active_anon:12281 inactive_anon:0 isolated_anon:0 [ 421.127349][T16783] active_file:2054 inactive_file:39984 isolated_file:0 [ 421.127349][T16783] unevictable:768 dirty:158 writeback:0 [ 421.127349][T16783] slab_reclaimable:13469 slab_unreclaimable:164479 [ 421.127349][T16783] mapped:35688 shmem:4236 pagetables:1157 [ 421.127349][T16783] sec_pagetables:0 bounce:0 [ 421.127349][T16783] kernel_misc_reclaimable:0 [ 421.127349][T16783] free:1221229 free_pcp:16543 free_cma:0 [ 421.177672][T16791] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3144'. [ 421.255921][T16783] Node 0 active_anon:49208kB inactive_anon:0kB active_file:8216kB inactive_file:159752kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:142768kB dirty:700kB writeback:0kB shmem:15408kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:15344kB pagetables:4412kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 421.384955][T16783] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 421.434547][T16797] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3145'. [ 421.552454][T16783] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 421.649671][T16783] lowmem_reserve[]: 0 2500 2502 2502 2502 [ 421.663593][T16783] Node 0 DMA32 free:976472kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:49260kB inactive_anon:0kB active_file:8216kB inactive_file:157912kB unevictable:1536kB writepending:696kB present:3129332kB managed:2560292kB mlocked:0kB bounce:0kB free_pcp:43084kB local_pcp:20940kB free_cma:0kB [ 421.707992][ T5158] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 421.718386][ T5158] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 421.727137][ T5158] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 421.738153][ T5158] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 421.750332][ T5158] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 421.791675][T16783] lowmem_reserve[]: 0 0 1 1 1 [ 421.796780][T16783] Node 0 Normal free:4kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1840kB unevictable:0kB writepending:4kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 421.825982][T16783] lowmem_reserve[]: 0 0 0 0 0 [ 421.831295][T16783] Node 1 Normal free:3899812kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:21440kB local_pcp:11072kB free_cma:0kB [ 421.866142][T16783] lowmem_reserve[]: 0 0 0 0 0 [ 421.870950][T16783] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 421.883931][T16783] Node 0 DMA32: 217*4kB (UM) 410*8kB (UME) 324*16kB (UME) 159*32kB (UME) 60*64kB (UME) 45*128kB (UME) 31*256kB (UME) 22*512kB (UME) 6*1024kB (UME) 3*2048kB (ME) 227*4096kB (UM) = 985300kB [ 421.902884][T16783] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 421.914951][T16783] Node 1 Normal: 167*4kB (UE) 49*8kB (UME) 48*16kB (UME) 74*32kB (UME) 27*64kB (UME) 5*128kB (UME) 6*256kB (UME) 5*512kB (UME) 2*1024kB (ME) 2*2048kB (UE) 948*4096kB (M) = 3899812kB [ 421.930619][T16807] lo speed is unknown, defaulting to 1000 [ 421.976553][T16807] lo speed is unknown, defaulting to 1000 [ 421.996594][T16783] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 422.016931][T16783] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 422.034044][T16783] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 422.071803][T16783] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 422.097648][T16783] 46275 total pagecache pages [ 422.105202][T16783] 0 pages in swap cache [ 422.109405][T16783] Free swap = 124996kB [ 422.123849][T16783] Total swap = 124996kB [ 422.135664][T16783] 2097051 pages RAM [ 422.139631][T16783] 0 pages HighMem/MovableOnly [ 422.177631][T16783] 424872 pages reserved [ 422.181876][T16783] 0 pages cma reserved [ 422.566615][ T5903] IPVS: starting estimator thread 0... [ 422.656038][T16837] IPVS: using max 26 ests per chain, 62400 per kthread [ 423.032263][T16807] chnl_net:caif_netlink_parms(): no params data found [ 423.046330][ T55] block nbd9: Possible stuck request ffff8880258e7000: control (read@0,1024B). Runtime 300 seconds [ 423.057480][ T55] block nbd9: Possible stuck request ffff8880258e71c0: control (read@1024,1024B). Runtime 300 seconds [ 423.069066][ T55] block nbd9: Possible stuck request ffff8880258e7380: control (read@2048,1024B). Runtime 300 seconds [ 423.080559][ T55] block nbd9: Possible stuck request ffff8880258e7540: control (read@3072,1024B). Runtime 300 seconds [ 423.256713][T16858] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3164'. [ 423.279010][T16858] openvswitch: netlink: Key 6 has unexpected len 4096 expected 2 [ 423.428417][T16866] netlink: 'syz.3.3165': attribute type 1 has an invalid length. [ 423.625737][T16807] bridge0: port 1(bridge_slave_0) entered blocking state [ 423.633271][T16807] bridge0: port 1(bridge_slave_0) entered disabled state [ 423.653107][T16874] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3168'. [ 423.668551][T16807] bridge_slave_0: entered allmulticast mode [ 423.680150][T16807] bridge_slave_0: entered promiscuous mode [ 423.777190][T16870] veth3: entered promiscuous mode [ 423.828930][T16807] bridge0: port 2(bridge_slave_1) entered blocking state [ 423.836928][ T5158] Bluetooth: hci6: command tx timeout [ 423.854182][T16807] bridge0: port 2(bridge_slave_1) entered disabled state [ 423.873332][T16807] bridge_slave_1: entered allmulticast mode [ 423.893877][T16807] bridge_slave_1: entered promiscuous mode [ 423.903259][T16871] erspan0: entered allmulticast mode [ 424.030845][T16807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 424.047632][T16807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 424.089126][ T1087] nci: nci_rx_work: unknown MT 0x1 [ 424.110461][T16807] team0: Port device team_slave_0 added [ 424.138452][T16807] team0: Port device team_slave_1 added [ 424.288005][T16807] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 424.313170][T16807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 424.367917][T16807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 424.398280][T16807] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 424.406004][T16807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 424.436533][T16807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 424.533029][T16807] hsr_slave_0: entered promiscuous mode [ 424.549374][T16807] hsr_slave_1: entered promiscuous mode [ 424.563490][T16807] debugfs: 'hsr0' already exists in 'hsr' [ 424.571282][T16807] Cannot create hsr debugfs directory [ 424.976202][ T11] block nbd11: Possible stuck request ffff888025987000: control (read@0,1024B). Runtime 300 seconds [ 424.987786][ T11] block nbd11: Possible stuck request ffff8880259871c0: control (read@1024,1024B). Runtime 300 seconds [ 424.999927][ T11] block nbd11: Possible stuck request ffff888025987380: control (read@2048,1024B). Runtime 300 seconds [ 425.011092][ T11] block nbd11: Possible stuck request ffff888025987540: control (read@3072,1024B). Runtime 300 seconds [ 425.498295][T16933] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3180'. [ 425.514633][T16924] syzkaller0: entered promiscuous mode [ 425.524214][T16924] syzkaller0: entered allmulticast mode [ 425.889475][T16807] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 425.920694][T16948] tipc: Enabling of bearer rejected, failed to enable media [ 425.926035][ T5158] Bluetooth: hci6: command tx timeout [ 425.947892][T16807] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 425.980090][T16807] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 426.007072][T16807] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 426.040008][T16953] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3185'. [ 426.054158][T16954] !: renamed from dummy0 (while UP) [ 426.359086][T16807] 8021q: adding VLAN 0 to HW filter on device bond0 [ 426.454911][T16807] 8021q: adding VLAN 0 to HW filter on device team0 [ 426.552667][T11043] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.559933][T11043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 426.608261][T11043] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.615503][T11043] bridge0: port 2(bridge_slave_1) entered forwarding state [ 426.660181][T16966] lo speed is unknown, defaulting to 1000 [ 426.670049][T16979] netlink: 'syz.2.3192': attribute type 6 has an invalid length. [ 426.805327][T16985] mac80211_hwsim hwsim35 wlan1: entered allmulticast mode [ 426.886337][T16994] netlink: 'syz.2.3192': attribute type 10 has an invalid length. [ 427.059859][T16966] lo speed is unknown, defaulting to 1000 [ 427.111897][T16994] veth0_vlan: left promiscuous mode [ 427.120508][T16994] veth0_vlan: entered promiscuous mode [ 427.137892][T16994] team0: Device veth0_vlan failed to register rx_handler [ 427.236266][T16807] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 427.997115][ T5158] Bluetooth: hci6: command tx timeout [ 428.923971][T16807] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 428.973897][T17039] delete_channel: no stack [ 429.095736][T16807] veth0_vlan: entered promiscuous mode [ 429.152251][T16807] veth1_vlan: entered promiscuous mode [ 429.302342][T17048] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3203'. [ 429.398687][T16807] veth0_macvtap: entered promiscuous mode [ 429.422140][T16807] veth1_macvtap: entered promiscuous mode [ 429.487516][T16807] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 429.527399][T16807] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 429.580847][T11053] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.611824][T11053] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.690685][T11053] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.710204][T11053] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.741807][T17050] tipc: Started in network mode [ 429.759641][T17050] tipc: Node identity 424ef47ff7b3, cluster identity 4711 [ 429.797147][T17050] tipc: Enabled bearer , priority 0 [ 429.843959][T17051] syzkaller0: entered promiscuous mode [ 429.896402][T17051] syzkaller0: entered allmulticast mode [ 429.978410][T17050] tipc: Resetting bearer [ 430.072342][T17049] tipc: Resetting bearer [ 430.083144][ T5158] Bluetooth: hci6: command tx timeout [ 430.107184][T17049] tipc: Disabling bearer [ 430.232870][T11057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.265144][T11057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.378425][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.395942][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.432086][T17058] netlink: 156 bytes leftover after parsing attributes in process `syz.5.3206'. [ 430.707950][T17065] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3208'. [ 431.116905][T17076] tipc: Started in network mode [ 431.122014][T17076] tipc: Node identity 2a27431f61df, cluster identity 4711 [ 431.155702][T17076] tipc: Enabled bearer , priority 0 [ 431.168703][T17076] tipc: Resetting bearer [ 431.191942][T17082] delete_channel: no stack [ 431.225784][T17074] tipc: Disabling bearer [ 431.380893][T17086] netlink: 5636 bytes leftover after parsing attributes in process `syz.5.3215'. [ 431.414045][T17089] tipc: Started in network mode [ 431.419312][T17089] tipc: Node identity , cluster identity 4711 [ 431.432264][T17089] tipc: Failed to obtain node identity [ 431.445024][T17089] tipc: Enabling of bearer rejected, failed to enable media [ 431.481726][T17092] syz_tun: entered allmulticast mode [ 431.495734][T17092] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 431.799429][T17090] openvswitch: netlink: Message has 394 unknown bytes. [ 431.819056][T17101] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 431.832013][T17090] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3216'. [ 432.005527][T17103] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3217'. [ 432.052000][T17105] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3218'. [ 432.083812][T17084] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 432.132881][T17084] syzkaller0: entered promiscuous mode [ 432.155597][T17084] syzkaller0: entered allmulticast mode [ 432.171541][T17093] lo speed is unknown, defaulting to 1000 [ 432.184939][T17093] lo speed is unknown, defaulting to 1000 [ 433.163566][T17116] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3222'. [ 435.028776][ T1087] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 435.126106][ T1087] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 435.155734][ T1087] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 435.164614][ T1087] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 435.364881][T17140] delete_channel: no stack [ 435.701152][T17147] lo speed is unknown, defaulting to 1000 [ 435.709842][T17147] lo speed is unknown, defaulting to 1000 [ 435.922901][ T55] block nbd14: Possible stuck request ffff888025af0000: control (read@0,1024B). Runtime 300 seconds [ 435.934126][ T55] block nbd14: Possible stuck request ffff888025af01c0: control (read@1024,1024B). Runtime 300 seconds [ 435.945793][ T55] block nbd14: Possible stuck request ffff888025af0380: control (read@2048,1024B). Runtime 300 seconds [ 435.957250][ T55] block nbd14: Possible stuck request ffff888025af0540: control (read@3072,1024B). Runtime 300 seconds [ 436.433677][T17169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3236'. [ 436.523448][ T11] block nbd15: Possible stuck request ffff888025b27000: control (read@0,1024B). Runtime 300 seconds [ 436.535680][ T11] block nbd15: Possible stuck request ffff888025b271c0: control (read@1024,1024B). Runtime 300 seconds [ 436.547206][ T11] block nbd15: Possible stuck request ffff888025b27380: control (read@2048,1024B). Runtime 300 seconds [ 436.558836][ T11] block nbd15: Possible stuck request ffff888025b27540: control (read@3072,1024B). Runtime 300 seconds [ 436.650227][T17172] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3237'. [ 436.949236][ T9] IPVS: starting estimator thread 0... [ 437.085599][T17179] IPVS: using max 27 ests per chain, 64800 per kthread [ 437.096473][T17164] lo speed is unknown, defaulting to 1000 [ 437.104189][T17164] lo speed is unknown, defaulting to 1000 [ 437.767866][ T11] block nbd16: Possible stuck request ffff88806cf57000: control (read@0,1024B). Runtime 300 seconds [ 437.778913][ T11] block nbd16: Possible stuck request ffff88806cf571c0: control (read@1024,1024B). Runtime 300 seconds [ 437.791287][ T11] block nbd16: Possible stuck request ffff88806cf57380: control (read@2048,1024B). Runtime 300 seconds [ 437.802966][ T11] block nbd16: Possible stuck request ffff88806cf57540: control (read@3072,1024B). Runtime 300 seconds [ 438.541424][T17210] netlink: 'syz.1.3243': attribute type 3 has an invalid length. [ 438.555604][T17210] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3243'. [ 438.588977][T17212] tipc: Started in network mode [ 438.604197][T17212] tipc: Node identity 8e7122220641, cluster identity 4711 [ 438.649712][T17212] tipc: Enabled bearer , priority 0 [ 438.700517][T17215] syzkaller0: entered promiscuous mode [ 438.706617][T17215] syzkaller0: entered allmulticast mode [ 438.925775][T17215] tipc: Resetting bearer [ 439.055565][T17211] tipc: Resetting bearer [ 439.346566][T17211] tipc: Disabling bearer [ 439.561730][T17202] lo speed is unknown, defaulting to 1000 [ 439.656268][T17202] lo speed is unknown, defaulting to 1000 [ 439.805737][T17226] delete_channel: no stack [ 440.124582][T17229] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3248'. [ 440.288198][T17236] netlink: 'syz.3.3251': attribute type 1 has an invalid length. [ 440.319224][ T55] block nbd17: Possible stuck request ffff88805899e000: control (read@0,1024B). Runtime 300 seconds [ 440.390556][T17236] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 440.957979][ T55] block nbd18: Possible stuck request ffff88806cf6e000: control (read@0,1024B). Runtime 300 seconds [ 440.997535][ T55] block nbd18: Possible stuck request ffff88806cf6e1c0: control (read@1024,1024B). Runtime 300 seconds [ 441.010092][ T55] block nbd18: Possible stuck request ffff88806cf6e380: control (read@2048,1024B). Runtime 300 seconds [ 441.022074][ T55] block nbd18: Possible stuck request ffff88806cf6e540: control (read@3072,1024B). Runtime 300 seconds [ 441.856495][T17269] lo speed is unknown, defaulting to 1000 [ 441.874608][T17269] lo speed is unknown, defaulting to 1000 [ 442.296173][T17282] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3260'. [ 442.390912][T17288] netlink: 'syz.5.3262': attribute type 8 has an invalid length. [ 442.462693][T17291] delete_channel: no stack [ 443.224292][T17318] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3270'. [ 443.398160][T17325] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3271'. [ 443.683955][T17334] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3274'. [ 443.708836][T17334] netlink: 'syz.1.3274': attribute type 1 has an invalid length. [ 443.742970][T17342] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3277'. [ 443.764389][T17339] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3276'. [ 443.805720][T17334] 8021q: adding VLAN 0 to HW filter on device bond1 [ 443.884751][T17334] tipc: Cannot configure node identity twice [ 444.142372][T17360] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3283'. [ 444.143435][T17362] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3283'. [ 444.173468][T17361] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3282'. [ 444.177437][T17362] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3283'. [ 444.197648][T17360] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 444.197715][ T55] block nbd20: Possible stuck request ffff8880534e7000: control (read@0,1024B). Runtime 300 seconds [ 444.223955][ T55] block nbd20: Possible stuck request ffff8880534e71c0: control (read@1024,1024B). Runtime 300 seconds [ 444.235563][ T55] block nbd20: Possible stuck request ffff8880534e7380: control (read@2048,1024B). Runtime 300 seconds [ 444.248287][ T55] block nbd20: Possible stuck request ffff8880534e7540: control (read@3072,1024B). Runtime 300 seconds [ 444.335692][ T5903] IPVS: starting estimator thread 0... [ 444.438432][T17367] IPVS: using max 27 ests per chain, 64800 per kthread [ 444.539601][T17378] IPVS: set_ctl: invalid protocol: 4 172.20.20.68:20003 [ 445.862995][T17448] ip6gre1: entered promiscuous mode [ 445.984956][T17453] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input10 [ 446.077434][ T11] block nbd21: Possible stuck request ffff88806da47000: control (read@0,4096B). Runtime 270 seconds [ 446.244563][T17473] netlink: 'syz.1.3314': attribute type 3 has an invalid length. [ 446.347658][T11043] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 446.457478][T17480] lo speed is unknown, defaulting to 1000 [ 446.466322][T17480] lo speed is unknown, defaulting to 1000 [ 446.735983][T17495] syzkaller1: entered promiscuous mode [ 446.747588][T17495] syzkaller1: entered allmulticast mode [ 447.511719][T17507] __nla_validate_parse: 10 callbacks suppressed [ 447.511745][T17507] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3325'. [ 447.895362][T11043] wlan1: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID [ 447.953993][T17534] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3333'. [ 448.007217][T17536] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3335'. [ 448.054614][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.097660][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.174294][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.194243][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.198176][T17546] netlink: 'syz.5.3338': attribute type 2 has an invalid length. [ 448.214825][T17541] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3337'. [ 448.326073][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.358985][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.419808][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.457330][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.524876][T11047] ------------[ cut here ]------------ [ 448.531509][T11047] WARNING: CPU: 1 PID: 11047 at net/wireless/ibss.c:37 __cfg80211_ibss_joined+0x3ca/0x440 [ 448.541948][T11047] Modules linked in: [ 448.546504][T11047] CPU: 1 UID: 0 PID: 11047 Comm: kworker/u8:14 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 448.559035][T11047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 448.569298][T11047] Workqueue: cfg80211 cfg80211_event_work [ 448.575192][T11047] RIP: 0010:__cfg80211_ibss_joined+0x3ca/0x440 [ 448.581607][T11047] Code: 00 00 00 75 69 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 02 dc f0 f6 90 0f 0b 90 eb bd e8 f7 db f0 f6 90 <0f> 0b 90 4c 8b 6c 24 18 eb ad e8 e7 db f0 f6 90 0f 0b 90 e9 de fd [ 448.602788][T11047] RSP: 0018:ffffc9000b5f78e0 EFLAGS: 00010293 [ 448.610071][T11047] RAX: ffffffff8aced4b9 RBX: dffffc0000000000 RCX: ffff8880311f3c00 [ 448.618265][T11047] RDX: 0000000000000000 RSI: ffffffff8d9790f8 RDI: ffffffff8be30a00 [ 448.626638][T11047] RBP: ffffc9000b5f79b8 R08: ffffffff8fa07af7 R09: 1ffffffff1f40f5e [ 448.634739][T11047] R10: dffffc0000000000 R11: fffffbfff1f40f5f R12: ffff888065698d90 [ 448.643593][T11047] R13: 1ffff920016bef24 R14: ffff888032a4b338 R15: 0000000000000006 [ 448.646107][ T11] block nbd6: Possible stuck request ffff888025820000: control (read@0,4096B). Runtime 330 seconds [ 448.652416][T11047] FS: 0000000000000000(0000) GS:ffff888125d80000(0000) knlGS:0000000000000000 [ 448.671861][T11047] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 448.678637][T11047] CR2: 00007ff01184f4e3 CR3: 000000007bf48000 CR4: 00000000003526f0 [ 448.686773][T11047] Call Trace: [ 448.691324][T11047] [ 448.694295][T11047] ? lockdep_hardirqs_on+0x9c/0x150 [ 448.700432][T11047] ? __pfx___cfg80211_ibss_joined+0x10/0x10 [ 448.706470][T11047] ? __pfx___mutex_lock+0x10/0x10 [ 448.711570][T11047] cfg80211_process_wdev_events+0x38a/0x4f0 [ 448.717624][T11047] cfg80211_process_rdev_events+0xa1/0x110 [ 448.723530][T11047] cfg80211_event_work+0x2c/0x60 [ 448.728636][T11047] ? process_scheduled_works+0x9ef/0x17b0 [ 448.734421][T11047] process_scheduled_works+0xae1/0x17b0 [ 448.740122][T11047] ? __pfx_process_scheduled_works+0x10/0x10 [ 448.746291][T11047] worker_thread+0x8a0/0xda0 [ 448.750988][T11047] kthread+0x70e/0x8a0 [ 448.755207][T11047] ? __pfx_worker_thread+0x10/0x10 [ 448.760377][T11047] ? __pfx_kthread+0x10/0x10 [ 448.765038][T11047] ? _raw_spin_unlock_irq+0x23/0x50 [ 448.770367][T11047] ? lockdep_hardirqs_on+0x9c/0x150 [ 448.775664][T11047] ? __pfx_kthread+0x10/0x10 [ 448.780317][T11047] ret_from_fork+0x3fc/0x770 [ 448.785002][T11047] ? __pfx_ret_from_fork+0x10/0x10 [ 448.791524][T11047] ? __switch_to_asm+0x39/0x70 [ 448.797467][T11047] ? __switch_to_asm+0x33/0x70 [ 448.802304][T11047] ? __pfx_kthread+0x10/0x10 [ 448.807072][T11047] ret_from_fork_asm+0x1a/0x30 [ 448.811914][T11047] [ 448.814985][T11047] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 448.822304][T11047] CPU: 1 UID: 0 PID: 11047 Comm: kworker/u8:14 Not tainted 6.16.0-syzkaller-06574-gd9104cec3e8f #0 PREEMPT(full) [ 448.834320][T11047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 448.844419][T11047] Workqueue: cfg80211 cfg80211_event_work [ 448.850240][T11047] Call Trace: [ 448.853557][T11047] [ 448.856531][T11047] dump_stack_lvl+0x99/0x250 [ 448.861167][T11047] ? __asan_memcpy+0x40/0x70 [ 448.865812][T11047] ? __pfx_dump_stack_lvl+0x10/0x10 [ 448.871073][T11047] ? __pfx__printk+0x10/0x10 [ 448.875732][T11047] panic+0x2db/0x790 [ 448.879673][T11047] ? __pfx_panic+0x10/0x10 [ 448.884152][T11047] ? show_trace_log_lvl+0x4fb/0x550 [ 448.889408][T11047] ? ret_from_fork_asm+0x1a/0x30 [ 448.894378][T11047] __warn+0x31b/0x4b0 [ 448.898382][T11047] ? __cfg80211_ibss_joined+0x3ca/0x440 [ 448.903961][T11047] ? __cfg80211_ibss_joined+0x3ca/0x440 [ 448.909527][T11047] report_bug+0x2be/0x4f0 [ 448.913878][T11047] ? __cfg80211_ibss_joined+0x3ca/0x440 [ 448.919459][T11047] ? __cfg80211_ibss_joined+0x3ca/0x440 [ 448.925131][T11047] ? __cfg80211_ibss_joined+0x3cc/0x440 [ 448.930715][T11047] handle_bug+0x84/0x160 [ 448.934977][T11047] exc_invalid_op+0x1a/0x50 [ 448.939491][T11047] asm_exc_invalid_op+0x1a/0x20 [ 448.944363][T11047] RIP: 0010:__cfg80211_ibss_joined+0x3ca/0x440 [ 448.950536][T11047] Code: 00 00 00 75 69 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 02 dc f0 f6 90 0f 0b 90 eb bd e8 f7 db f0 f6 90 <0f> 0b 90 4c 8b 6c 24 18 eb ad e8 e7 db f0 f6 90 0f 0b 90 e9 de fd [ 448.970167][T11047] RSP: 0018:ffffc9000b5f78e0 EFLAGS: 00010293 [ 448.976287][T11047] RAX: ffffffff8aced4b9 RBX: dffffc0000000000 RCX: ffff8880311f3c00 [ 448.984275][T11047] RDX: 0000000000000000 RSI: ffffffff8d9790f8 RDI: ffffffff8be30a00 [ 448.992264][T11047] RBP: ffffc9000b5f79b8 R08: ffffffff8fa07af7 R09: 1ffffffff1f40f5e [ 449.000257][T11047] R10: dffffc0000000000 R11: fffffbfff1f40f5f R12: ffff888065698d90 [ 449.008790][T11047] R13: 1ffff920016bef24 R14: ffff888032a4b338 R15: 0000000000000006 [ 449.016817][T11047] ? __cfg80211_ibss_joined+0x3c9/0x440 [ 449.022412][T11047] ? lockdep_hardirqs_on+0x9c/0x150 [ 449.027639][T11047] ? __pfx___cfg80211_ibss_joined+0x10/0x10 [ 449.033585][T11047] ? __pfx___mutex_lock+0x10/0x10 [ 449.038639][T11047] cfg80211_process_wdev_events+0x38a/0x4f0 [ 449.044559][T11047] cfg80211_process_rdev_events+0xa1/0x110 [ 449.050381][T11047] cfg80211_event_work+0x2c/0x60 [ 449.055342][T11047] ? process_scheduled_works+0x9ef/0x17b0 [ 449.061105][T11047] process_scheduled_works+0xae1/0x17b0 [ 449.066698][T11047] ? __pfx_process_scheduled_works+0x10/0x10 [ 449.072721][T11047] worker_thread+0x8a0/0xda0 [ 449.077361][T11047] kthread+0x70e/0x8a0 [ 449.081453][T11047] ? __pfx_worker_thread+0x10/0x10 [ 449.086584][T11047] ? __pfx_kthread+0x10/0x10 [ 449.091204][T11047] ? _raw_spin_unlock_irq+0x23/0x50 [ 449.096425][T11047] ? lockdep_hardirqs_on+0x9c/0x150 [ 449.101743][T11047] ? __pfx_kthread+0x10/0x10 [ 449.106391][T11047] ret_from_fork+0x3fc/0x770 [ 449.111013][T11047] ? __pfx_ret_from_fork+0x10/0x10 [ 449.116155][T11047] ? __switch_to_asm+0x39/0x70 [ 449.120935][T11047] ? __switch_to_asm+0x33/0x70 [ 449.125718][T11047] ? __pfx_kthread+0x10/0x10 [ 449.130356][T11047] ret_from_fork_asm+0x1a/0x30 [ 449.135158][T11047] [ 449.139629][T11047] Kernel Offset: disabled [ 449.143997][T11047] Rebooting in 86400 seconds..