last executing test programs: 6m51.737134711s ago: executing program 1 (id=145): unshare(0x22020600) r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x67, 0x2, 0x0, 0x1, @void}}}, @IFLA_NET_NS_FD={0x8, 0x1c, r1}]}, 0x3c}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)={0x124, 0x0, 0x1, 0xa00, 0x0, 0x0, {0x0, 0x0, 0x3}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}, @CTA_TUPLE_REPLY={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TUPLE_ORIG={0x80, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x11}}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2641d28a3b3d4cc0}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_SEQ_ADJ_REPLY={0x1c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8}]}, @CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xe, 0x1, 'snmp_trap\x00'}}]}, 0x124}, 0x1, 0x0, 0x0, 0x800}, 0x0) 6m51.372718093s ago: executing program 1 (id=150): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000500), &(0x7f0000000540)=0x30) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)=@ipv6_getaddr={0x20, 0x16, 0x1, 0x0, 0x0, {0xa, 0x0, 0x38}, [@IFA_TARGET_NETNSID={0x8}]}, 0x20}}, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0000120000000000000060fc0380025d2c00fe8000000000000000000000000000aaff020000000000000000000000000001020090780000d93f640000000f081120ff020000000000000000000000000001fe8000000000000000000000000000125d0200000000000007"], 0x293) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$NL80211_CMD_FLUSH_PMKSA(r2, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0xaf40668080f90451}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, r4, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000010}, 0x20008811) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r7, 0xd10, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040080}, 0x800) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a32000000001400000011"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r9, 0x400454ce, 0xa) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0xe0901, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0xa, 0x3, 0x3a) syz_emit_ethernet(0x46, &(0x7f0000000100)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "121008", 0x10, 0x3a, 0x0, @remote, @local, {[@hopopts={0x2e}], @echo_request={0x80, 0x0, 0x0, 0x0, 0x5}}}}}}, 0x0) sendmsg$netlink(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000000)=ANY=[@ANYRES64=r0], 0x114}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r11, 0x8933, &(0x7f0000000180)={'wg2\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r11, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x88, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5, 0x7, 0x4}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x6}, @ETHTOOL_A_LINKMODES_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x2}, @ETHTOOL_A_LINKMODES_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x1}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x8}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xc2}, @ETHTOOL_A_LINKMODES_SPEED={0x8}]}, 0x88}, 0x1, 0x0, 0x0, 0x440c0}, 0x0) 6m51.007175841s ago: executing program 1 (id=157): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0xb0, 0x1, 0x2, 0x3, 0x0, 0x0, {0x1, 0x0, 0x2}, [@CTA_EXPECT_MASTER={0x38, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}, @CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}, @CTA_EXPECT_TUPLE={0x48, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1c}}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x24008040}, 0x11) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001500)=@newqdisc={0x70, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x40, 0x2, {{0x1ff, 0x4, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0x80000001, 0x6, 0x8, 0xfffffffe, 0xd99d}}]}]}}}]}, 0x70}}, 0x0) sendto$packet(r0, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c288a8", 0xe, 0x830, &(0x7f0000000440)={0x11, 0x0, r3, 0x1, 0x2, 0x6, @local}, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r4) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) sendmsg$ETHTOOL_MSG_EEE_SET(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000800)={0x3b4, r5, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_EEE_MODES_OURS={0xd4, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xf}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9c}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_VALUE={0xb5, 0x4, "81dfdb2407aff40b7fd8af3c805f8ba615fae92caf9756acb47846a4d628f71355e7aeb0da91326b8d09e646a2e667312ee50c69398990f95ce3a242f3de76112df2a0ede5074894550f4bdead9b5c4c9c477b4447f6b3cd9922227b63e55697047bc57c7ee591615b613eec6e9bd37d1f70260265d7f14dc6177443622f1f8601a3cfb5245354bd323dcbf555cc0597184b55537647f238e307e3ed402a5ee4aa439928248de9b545a25df143b3c78b4d"}]}, @ETHTOOL_A_EEE_MODES_OURS={0x2cc, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x36eb3446}, @ETHTOOL_A_BITSET_BITS={0x8c, 0x3, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '&!.\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}, {0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x12, 0x2, '{\\\x00*!!--@./#}B'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, ':/^^:\\[^\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xf}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '#[\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x14, 0x2, '[\\-{[{&\\-&#->\"F\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, ']K(+[%\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_MASK={0x79, 0x5, "478e26c3b0535d79c0c2c439e4f99b3f0cf2e81ab64389bb6c21f7bded23c49d59d04497a5888946c41c17a2ffa51c8ffcd2e7ec314819e502f3cb56bb629d60c85ae4919239b8912e785a455bf5e5ae31ad2a6b1c92c5600b03d8329d55413f7b62c05f120a1764e53e0d28001ad2bade6102755c"}, @ETHTOOL_A_BITSET_MASK={0x8b, 0x5, "bf2d3f264de391d74c9fa0ab3ff331747094d43a1be8b7dad3f65f11eac1fecec340cfe8bfdb51ec10a5248d19eb15c522c18615319c4e7e6d56b8822d7af3482585dc4b004d9d67006654757a4af14041f4fa9fef90e23029cdd9c857022001302bcc016ab1b556425b557c62186e1c433a48d7ffed31d36f20a4dab3d3725cadf8c2ae6338db"}, @ETHTOOL_A_BITSET_MASK={0x44, 0x5, "0dd13d1be3515a9cc30ea69b0612827d00c16693ee094df0fd3e2fb4100c0f8f53856d4c11636ab6d53cd82884e6b3e72b6e5fb0ca23320644427545de74fce1"}, @ETHTOOL_A_BITSET_VALUE={0x29, 0x4, "fe1aecb69d5b5b7a96943f919513c5e73018ee881bc7ff3009486cf0a9bf57e1c5bc1754af"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0xb3, 0x4, "f7b454912e3180c30164bfdaacf38ce86a7cd6079d7998b95ba0c433f996f7869dfa7825ae38f0d7f92603732f531b1d61f824a8dce57daf1d941c5e94aed9fa9d396f6e7daa518e484942962a20b77c1d1473fe236a0e873683c87947b4e2e84546ea3cc969f79bd37e111efa70ea9b7c2e5103f4c11538700514e3b5c9560b79144a475f68c6a3bec152fa2cde05e3e69b425cfd3142e8e0ea49998c85e703758b90ff4d8c1125ae36f4bcd89415"}]}]}, 0x3b4}, 0x1, 0x0, 0x0, 0x8010}, 0x4008000) 6m50.780816599s ago: executing program 1 (id=161): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000040)={@remote, @multicast1, 0x4, "d30f388c480b760100000001000000fa00", 0x0, 0x762, 0x7ff, 0x8}, 0x3c) (async) setsockopt$MRT_ADD_MFC(r0, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @multicast1, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0x0, 0x0, 0x4, 0xfffffffe}, 0x3c) (async) setsockopt$MRT_ADD_MFC(r0, 0x0, 0xcc, &(0x7f0000000200)={@empty, @private, 0x0, "606b177019716ea6ff1f4d7ed79c31e2e0f1da00000000230000002000", 0x800, 0x9, 0x3}, 0x3c) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f00000003c0)=0xa, 0x4) 6m50.566214046s ago: executing program 1 (id=165): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x42, &(0x7f0000000280)}, &(0x7f0000002100)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x42, &(0x7f0000000280)}, &(0x7f0000002100)=0x10) socket$alg(0x26, 0x5, 0x0) (async) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$sock(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000400)="c3ebdf02ccf049bcc145ba28e73853bc2beca0e03d5bd6c012e42d1428b917e255bc9e75cc701a5deacd14f062187f82e85e20e19b9ebfb6aef45d2ad0a7bc634373c630c98214899de376e8a8c2008b754001691c7b09262a9486cdd1654e717ddf0adc63e0a44f09a257aeb4827cea5c5eb652a7c34ace0d86abb34410bebcdd914d56bf83fd55d154e89e48870351e008a7462652501c07f9eabf4051243ef58362b6870778dbd820f1f674c5314c3dc2c9e671d1acc8a39f526c02fa98be", 0xc0}], 0x1}, 0x84) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r3, 0x84, 0x78, &(0x7f0000000040)=r1, 0x4) 6m49.969419605s ago: executing program 1 (id=177): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x3, 0x6) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a3a0000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000054000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d6163767461700000000800014000000005080007006e61740014", @ANYRES32=r0], 0xf0}}, 0x0) 6m49.629553782s ago: executing program 32 (id=177): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x3, 0x6) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a3a0000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000054000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d6163767461700000000800014000000005080007006e61740014", @ANYRES32=r0], 0xf0}}, 0x0) 43.867097496s ago: executing program 2 (id=3882): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0xffffffff}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff9, @ipv4}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000000440)="f408797dd53b71622ab702cf1a6e4175076da54553f1f1c4448cb5559e5eb078a74ceffd969430201c2f1f53b31d53c02dadde28e089a7826b3a70019a94c3904e886e9db630c31da4cd334add90a591a69918218a1cd15350d65dedd5f6f52adf57614c62eccb0054b456b28339cbacc915527d1d7690ae0690e7e53a1e8591f30d82b121285daeef50ac7e8a8ca3ce4bfa581c3e16c3ccf2c873f33552f0a20f0b372b02964a6c60d29b7c0863bf39f698cd64fcd9a15c0040e35909a1a5e3f5433f1ab771a630f0fff3ce1101f2c36f7a7f49dc9cf4d5398fdf00598216dad8df5e00816d7cf52c3a8ae6c112c289a18a97dca3c47be92b91544d9c6e8bc947de075c5b4378701f73aaec03dcab35979fefab31ff8ea47576a974e81045b2e5f9397dedd3fe70a5094a73f1a833b5720ed3065762508a4dee9ad42e48ef93cf03c6c80a64bccff5b3a52a9a718f87e5037bd7a9cc30e911e46049b35852fc55d79f8c5ab21ac345f06127bfe434197eca6b762c13967f105508bf0da040240d81e90a4f94a27b", 0x188}], 0x1}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r5, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000580)=ANY=[@ANYBLOB="680200000005010400000000000000000000000054020100"/40], 0x268}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 43.710051841s ago: executing program 2 (id=3886): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000180)={0x40, r0, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x9, 0x74}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}]]}, 0x40}}, 0x20000000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d71186e000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x625}, 0x94) 43.579187409s ago: executing program 2 (id=3888): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="b601000000000000bd110000000000008510000002000000850000007600000095000000000000009500a5050000000077d8f3b4000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f68a7d06d75357f21699cdc6751dfb265a0e3ccae669e173a649c1cfd6587d472d64e7cc955d77578f4c35235138d5421f9453559c35da860e8ef14142b2a3e314422b854421eed734ceb1efeecb9c66854c3b3ffe1b4ce25d7c983c005c03bf3a48dfe3e26e7a23129d6606fd28a697a9d552af6d9a9df2c3af333e2008e11bbec0727cb3f647535deb6277f5696833a71011a7d06602e2fd5234712596b696418f163d1a13ed38a682f87925bfa753f631cd027edd68149ee99eebc6f7d6dd4ae59af7588c8e1f4efab57644ccb1973d7879b70a70001040000000000000000d7900a820b63278f4e9a217b98ef7042ad2a923132f208fd8289eaf8cd00000000000009d27d753a300800000000000000a5686f2fccc33e3e34c3969c5ad781302d40e97a8ad10ce0cbe17366d5ac6af2fca2360a15b80400d52040ef7b28d300747877e176fe4c4b8e40dbf260f5a9f7eee30293c1b163b795d0aef4deb851a30000f569dc8f39943f889008e1ec914faa9e6cd0b3b4b3b5db666ebeb49d6a62019d76459e70b459543c4ac42e53b4ad4c77cff373ebd95848f01864e456969cd28000170996016aceb583df5ee4dd722e8c350af489f9a900000000a0dcc36b3d7c734a9cce0439f832a20d7cbdcda5dff3ba92dd66afb9d74aa222038994dcd3e7784dbea1e51a15b0f1a040cc63177f8fafa3192fc8e5552da1a982ab8dfe31ad1a0968faa47c2069d6bf09c3aa4f0fc128cb578d99b08a150b4cc4b22f6a464c6398c952519818a44a1b223ff502df87865c276588ea478e328e8277e811b99ce1acfecaf8e2c55ccc4b8eae0a61635514e99ffd438784060f23ba74c0b30b1180d935832deb686d789ba1d436d116394534e88492a42b8bf050c719661a2dc50b3a1dcfbc871e5c27e3d7260f6fa589e40000b89db451ff994845f6b49c12e89291398bcb3c06ef1289f74e0b0e2cab592d35f82a69e7284223a171c616b1f0fee6c4711d7aecb69746064d2c096554975d605ebe646302bf3d5cf32a9a09915ae3f3d4eb96615d7b237da56cd5e9904a19e145f25b6d98eb2c019967f553b61d0e80d6913cee9f8d18469a654a239a84a85debbc02846ac5791278f18c6759e3b513a68284d2efc30587e433431b2896a3bd48020af67e9ac071b2dd6dc3b9efae4ff03558fa619aea909c7f2416e7e7da1c51ccc7e6ac27412f728dc6d80da8adf317ca863ed683897321f8c8bb5a5d953d6783b7a06353ee496bbdff418de3e53234df87756eb99e330253cf5da4aa1a9648a38f07e2d302b4165983db4f7b8972923fffa8c03c288512a3a38fbd7c816a44634f7a03fab30811b7b93257bea4369ba46024dee5e9b0b2c3d3324e9b7c1f99ab9bb3f498b1485373b79ec84a67dad4e37575dab87ce55a9a69ed856a4c4410d1242ac1bd1539094a641cc086c2c53e363beafc74ab4e9ff320373705cbf5644586ffe60d293944fa2d9dc18b55f1af5c42f27747bef1ffd0c1766f062d47d61bf9f64e6ee288fa7fc12d48da526527b9f5c318c93ec447cb8b5eee7aa8a1e85696af3dfef96657c0545c8ebd96528d9c28828e5befd80d684b03b6d153da3e3cbd3bfbf4a9375b8ad04a1d241bcb5d5505cb6cc7a44e2e24bd0b1ca4879caaff59d0ce39dc7f3fea447f4e46967855208e63ec988bd2692afefbed2b001205e4b30ee8fe417defa566a73ace8f01f7181de0ef25f1744896a3c38859e6148c42454949cd64b1a888e7fe9c2d86bb01023b6ddeb67f5eb038af3e460c771518a4126c338b0390d459361e03adf6e6b558b3651a0e33d101b5febfff82794203da18db6fcf89715c2d338f78d8b9220171b41f528f857a7cb79ca990de1208777e13faaa9b9cb9e67797b07d9eb9e909410b50c5d981d9a72aa36498b630519d1530ef0000000000000000000037fcffffffffffffff8db8379bd2044c652dff399a9f8bfa4e9c507f049d18837464276830461ee203ba51f6102d262fc9a26bc3638ecce24e65c55da6efaa462f03d0e119c963a8c7a522b59f5a7b44d018cb2648383073d9e032492cae44350bc0a85697f431392eb22cae093e85954af97d6d7b2e6e8f43353062275ad1578a431594243452a2bfb89f91d8eaac038e9e17136e7c698f73faaabb3d00000000000080014573789425c4c32da528d89356aa6d2ae6da082e756c80cf39053431080ea6cbf9997a5a0ddad0b9d12bc3f880476ab32f0feaac5f16e61f7b72b8c9082eec423c6b3eaecfdcc9ec72795e7696421c83b76c2d6bac19bc875d009679778d8ef97d7e05329649d97b0dc54bea9b650873de2d3d702690176e0b23ee5cb5e469a8d1612d611722e6200e3a297d92f8e1de98326c5ef2b89d4e2d47767cd755783e5d865e373338e96ceb8399f296c59b2d70ca27735ecaff62982616d3ac1ab041733bce119d8002a6c8a2b08b32551b2313b1a2ff41b3f04af61c69c85cb2da48215727271bac2ffdeb62d9f5dc4845f1c3f63dc806e615ee8d28d6d7f181e30807afa27f41d0364c746a65a47464db68f3c433d88dd625db35fded2c86d75af88efaf20c8b37c644b6c4e773a9589200faa553bc92f916b75ddbfa18ab73979f46947b35914286d2499a0b8c970000000000000000f4fe74e0c26ab52329bd600627b256ca44dd121ffc8dbb6e5f70cbe03efccac70375b30cc927574d254d1b46c607e8b1ca7d1511568c3ef4b6b885f4582bdcef74e5e010627fc8e4fe00000000000000000000869d9640f06b11df2971909b90133983308ea4f033de613763f32d913bcbe9dd082a6fff197a20730269e6cfd31275395833f1c2b8a50a94c30cceae2a11fe9b9b835d0da73891c0b3ce22dea6bf31e7f51808cf72f44b4455b77a778440795e152dc1b7bb0a5636aa4742ce4d331a47de5836539cdf289176527277b70c8162aaf6f9475418b478329f3565450acfaf07000000eab8cabfa97e35081967bb92a264b07e8003d2f15537e72a1e4ca5ec1e2aaaf8236ecdefbaf512c75e636b6b6f518ad20521f909b12e9bc97e408e0dc82f950d12705f35708bc862196abb27e8d7991b5273987f38c4706289ff4f6130cee76465d487a07a74452f87da2029bd3debd9870335d58d3fe1ac80574fa3ea312997ab81bc6f569ffdb10ba3f20a86d95128d13e0c778998d3b3114bfb07bd61e4bff8a5e2ce4aa572c63e09b44ca4a181bcfe4eec3ce843c65c4948169fe639a186acc2b4a96c6b8d4d2e6d53ab97bea01eab953e6e89e3af34d4ada217bc6fda0fb2095c49195d0d6f365ca80a955b9ec81240a84ef672afa369fc8e3d444ba35d0f51a0065a3b982d09dfc6874fc0d8079b185447cb8a695e132d4d613a529d9c77e2a8f7320ecf698e8a2b170fd601dc1a9767a38b10788e92d1356f6a6c1bcfb2d31b46e735db13f1be80bac1b6be04fd98610000000000000000000000000000139af5493f74751c5e2501a4936bc4a0fa516117f4ccadc692003adee0a080eba2f1059660c0ee0e9aec72d4d0fe095632e4f641b0e34c611c5b3e0ba05fa36542d40837dda323910672a9097d68398fd3539686e4288db0d6bf7cb8a1835f46dfe11865a66ef47e736dada06677a5bca133d6cbc8fe5c4557e51b006bdccd7c5f32ff1d9e8b130f77df09236870fb3de5b87b4f8acc13df534eba329b86670000000000000000b27a2616c03cdf6c009447a652bca9b325e73c0737d5b717945e4fe7a169c5e2c54fc71a4104aa7cf0f5d30e2fcd9503650edbd8a5971a9a1fde5e5df37469ae204a6e899eacc1e63034cbabc5604739881cb82604bed3e53696a0606b26b879ef232a1a038291389593d1575cb79aa8284cf01a7e1a456acab9d8d608ad69d4c4b56492af7004e7ed9d47c5db3d76a00bea7c804f3a3638408bc1636f1009b7f185f51606918eaa0ab6bef11ae3d300"], &(0x7f0000000080)='GPL\x00', 0x9, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x20, &(0x7f0000000340)={&(0x7f0000000240)=""/156, 0x9c, 0x0, &(0x7f0000000300)=""/47, 0x2f}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x14, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffa}, {}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x3}, @jmp={0x5, 0x1, 0x7, 0x8, 0x4, 0x2, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x800, 0x0, 0x0, 0x41100, 0x22, '\x00', r1, @fallback=0x19, r2, 0x8, &(0x7f00000001c0)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0x9, 0x1, 0xffffffff}, 0x10, r3, r0, 0x7, 0x0, &(0x7f00000003c0)=[{0x2, 0x5, 0x3, 0x5}, {0x5, 0x5, 0x6, 0x3}, {0x5, 0x4, 0x3, 0x9}, {0x2, 0x3, 0x5}, {0x1, 0x5, 0x8, 0xdc4884e57762d972}, {0x5, 0x4, 0x3, 0xb}, {0x2, 0x1, 0x2, 0x6}], 0x10, 0xf}, 0x94) 43.46653003s ago: executing program 2 (id=3890): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r3], 0x20}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfb, {{@in6=@private0, @in6=@loopback, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000180)) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x0) sendmsg$IPSET_CMD_RENAME(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000301000001040000000000000000cb2973f935d0fd8ea667e36608005ec4cd3d8001"], 0x1c}}, 0x0) 43.189893591s ago: executing program 2 (id=3894): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r2) sendmsg$IEEE802154_LLSEC_ADD_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r3, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4084}, 0x8000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xfffffe6f, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0xffffffffffffff48}}, 0x44080) r6 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r8) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) r11 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63", 0x8}], 0x1}, 0x0) write$cgroup_subtree(r11, &(0x7f0000000040)=ANY=[@ANYBLOB="110000006a"], 0xfe33) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r10], 0x1c}}, 0x0) recvmmsg(r6, &(0x7f00000009c0)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000380)=""/185, 0xb9}], 0x1}, 0xb}], 0x1, 0x40012163, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x4}}}, 0x28}, 0x1, 0x0, 0x0, 0x845}, 0x24044011) 42.199235702s ago: executing program 2 (id=3904): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_DELETE_ELEM(0x4, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448dd, &(0x7f0000000240)={0x0, 0xfffd, '\x00', 0x7b}) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r1, r2, 0x26, 0x0, @void}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000940)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a5976ac6acd41fd8"}}, 0x48}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000680)={0x0, 0x300, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="06001500070000000c001680080001"], 0x38}}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendfile(r0, r0, &(0x7f0000000000)=0x711, 0x2) shutdown(0xffffffffffffffff, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r2, &(0x7f00000000c0)="c3b53a20e4c9ebff4d7b10637c83c5fe657bac53b932c6b427e924414b38e28f937fc68329c565b3e738fe4ef3e3f40e3e0835e5bf6436d894c97a30072bb0cec5700f65d8769b4d2392c05178a00a2c3ded9f69c09c3f0d938889af828940fe394feecdf7", &(0x7f0000000140)=@tcp=r7, 0x4}, 0x20) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWRULE={0x13c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x110, 0x4, 0x0, 0x1, [{0x10c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0xfc, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_NAME={0xc, 0x1, 'rateest\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MATCH_NAME={0x9, 0x1, 'sctp\x00'}, @NFTA_MATCH_INFO={0xc4, 0x3, "7c9e87718f69db0c60c8e1ea7290365022943d7a4483aebf3b57346b2f841bde67ba16cf5cb4724fc14014d2c512dc9a6b2ea9f653432f69ca136790d62c638c8c46bcd84f71b092894e30952fc07002ac312ec1a4447b425675547e464b8ee587cdae3bbb20276edee9536611dc9935a2f63f3ebe6fac212297cabfe451e1713034f4134c8180aecaa891f1c56ecd755687efc2ab1d12760991caa364dbc37e107e91d217f4269d11007d7f2ad4f3ef14e2c94de299cf91ebcc6dd04ca66352"}, @NFTA_MATCH_NAME={0xa, 0x1, 'icmp6\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x164}, 0x1, 0x0, 0x0, 0x24044800}, 0x0) 27.152934573s ago: executing program 33 (id=3904): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_DELETE_ELEM(0x4, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448dd, &(0x7f0000000240)={0x0, 0xfffd, '\x00', 0x7b}) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r1, r2, 0x26, 0x0, @void}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000940)={r4, 0x0, 0x0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a5976ac6acd41fd8"}}, 0x48}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000680)={0x0, 0x300, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="06001500070000000c001680080001"], 0x38}}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendfile(r0, r0, &(0x7f0000000000)=0x711, 0x2) shutdown(0xffffffffffffffff, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r2, &(0x7f00000000c0)="c3b53a20e4c9ebff4d7b10637c83c5fe657bac53b932c6b427e924414b38e28f937fc68329c565b3e738fe4ef3e3f40e3e0835e5bf6436d894c97a30072bb0cec5700f65d8769b4d2392c05178a00a2c3ded9f69c09c3f0d938889af828940fe394feecdf7", &(0x7f0000000140)=@tcp=r7, 0x4}, 0x20) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWRULE={0x13c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x110, 0x4, 0x0, 0x1, [{0x10c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0xfc, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_NAME={0xc, 0x1, 'rateest\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MATCH_NAME={0x9, 0x1, 'sctp\x00'}, @NFTA_MATCH_INFO={0xc4, 0x3, "7c9e87718f69db0c60c8e1ea7290365022943d7a4483aebf3b57346b2f841bde67ba16cf5cb4724fc14014d2c512dc9a6b2ea9f653432f69ca136790d62c638c8c46bcd84f71b092894e30952fc07002ac312ec1a4447b425675547e464b8ee587cdae3bbb20276edee9536611dc9935a2f63f3ebe6fac212297cabfe451e1713034f4134c8180aecaa891f1c56ecd755687efc2ab1d12760991caa364dbc37e107e91d217f4269d11007d7f2ad4f3ef14e2c94de299cf91ebcc6dd04ca66352"}, @NFTA_MATCH_NAME={0xa, 0x1, 'icmp6\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x164}, 0x1, 0x0, 0x0, 0x24044800}, 0x0) 2.915321165s ago: executing program 0 (id=4291): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x2, 0x80805, 0x0) (async, rerun: 32) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 32) shutdown(r1, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300010004000400eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x95}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r3, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2c}}}}, &(0x7f0000000040)=0x84) (async) setsockopt(r0, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x49, 0x800000, 0x8, 0x7, 0x8000}) write$bt_hci(r5, &(0x7f0000000080)=ANY=[], 0x6) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x3c, r6, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfc}, @ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x8}]}, 0x3c}}, 0x0) 2.658704273s ago: executing program 0 (id=4296): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newtaction={0x6c, 0x30, 0xeaa3ef926154ef0f, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{}, 0x2}}, @TCA_VLAN_PUSH_VLAN_ID={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) socket$netlink(0x10, 0x3, 0x10) 2.499343079s ago: executing program 6 (id=4298): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x5e) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000900)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0, 0x40}, {0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)="297e9fec0bff0304be28e64c7b4f8aac4403dab37301f7776378233bd0c798a80171076ae1fd5648f1e0b9840505e39b80139e81322069864f288d5a0edf75a8d9192777f37fc735bf75813c2a6f7d53a004245e401a708e5045093b0d602ecbf3d4a2c1dfe4", 0x66}, {&(0x7f0000000180)="d7d6dbf87330839f3a55a18c5f5a77082f38b661209fd97beed2036f230ef19961f2d93a8ee99269f9004067384a5f6305214eb30ea5d2b140567eb0d4cd6f487e72b1d9964dda9b62c25d7d6d95f93e467193acc8b27a666cdefe592ebb63f15bbdfc977c1aac0f92cb91b676cae52635d17615c5deaf71f59cf75669cb2112039d36603b566c472dcf6221dcb6d10fceb10b75293223a80e1923ceb3de988185ff82729caeb8861b1a32db78efb1b2902f6b5cfcf86ba12054f761453d28bced113a952b3ac2e5c7847345180f41f0ee06f40eb3ab5804697ff830ee71d1", 0xdf}, {&(0x7f00000002c0)="37e9b67b356a85e102cde7a00e8f425dd67d9e47aa14a49042206969857f055f6a9000f489eb98a0a41cb0629422f64a2021300eaced19424a55cb46860dc61ca3e50a64569333ca90b28015e0682de3acdb6b", 0x53}, {&(0x7f0000000000)="c47c9ae733340c30671c3e80cba709fe1623d12a88a00af9", 0x18}, {&(0x7f0000000340)="1ac4aea46dc316312a0b2cc19fbafeb8ff7be7622c57d574309b2d79aa3bb65e5db4fe5ff2ffa28d32863760097cd4968ab380b7a20274533b37d5dbde9d48cd0fae14b52e3937094c574afd6c7333d93152f300405ba08039b9b0a125c661a25e18a09f09030977af419a84d1cd7ad4c3f45e8078470da884d7cd135e8f141408e7c23c138915fa53952cf8114803e5828a14b5508d213f53883055d96685d2c08d1ca5b30a72ed02d1eb5e36768fd826", 0xb1}], 0x5, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4, 0x7}, @op={0x18}], 0x30, 0x40040}, {0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000540)="74db7b4f2604cc8ebf8c9a756bbf5195af9b212b825bb33d6fbbaabd0f79b5d555e9690d1b59be2c333c22bdb557c284513aa2299fae979adea0d802b6a7d580e1cfdc69254a484edec264a390858334f1d8715f", 0x54}, {&(0x7f0000000480)}, {&(0x7f00000005c0)="5a45983f8cc7da9c15f1ed46466858f33f09c67de69b652aca88a5308632f7f881252709a61d59504f22645c89b018f196b476e2508943de07e0a1e4cc596c1e5af9aff41da1fde3c3f91f79c4b031d494c0ee7927c0baa243909aa1a4cf75153f641150f9e016fbc674505f530969e2ec36d70a663cc6c253780fb5aebdc369b0eff33120b2dbd9e9f86e6f46a3c0cd3c4e65f2829eef66e1ecd51e73ecac01e6b94981409cba0eddd75b6cea8ebc7f66479ab0b4e9427bcf8902d15dd0f73f84cb63dd90849803d20ae1fe901dc350bd78a5b0874517b2c0e7ac6304d3d1c37f43261fdd418ab0a43329933882327e45f5b3183bf7762bf0fe9933f735", 0xfe}, {&(0x7f00000006c0)="b96ed60c91fb0e7b566a3df5", 0xc}, {&(0x7f0000000700)="8e0cc6ad1ff5f5bd49f05c79755f2dd48e263dfa89160281694b53", 0x1b}, {&(0x7f0000000740)="491bcaabaec813a01fca0169e71300f6732e23c1c0a3a3f0434296075b8847f8b042938b95dd6dc7ddb34120ad1dd8b7afd462c74625da303d8f39ce431a5946d2ea687b9be62cd77e5fc9d52264148242a0ec388e2108d3b0fa9b84cb02b5ee1964eaeaa9a3d346793c7b47100f0f4fa6ca45eb90ff76536b6a3ba5e0339feb34b9aa6b90", 0x85}], 0x6, &(0x7f00000009c0)=[@op={0x18}, @assoc={0x18, 0x117, 0x4, 0xff}, @assoc={0x18, 0x117, 0x4, 0x1}], 0x48, 0x40000}], 0x3, 0x40800) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000e8ff0000000000ff000000850000000e000000850000005000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x50) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r1) 2.398754791s ago: executing program 0 (id=4300): bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80001, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x17e5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) r7 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r7, 0x0, 0x4008804) sendmsg$kcm(r7, 0x0, 0x8400) sendmsg$inet(r7, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x4e22, 0x0, @mcast1}}, {{0xa, 0x4e24, 0x0, @local, 0x8}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, 0x0, 0x190) sendmsg$nl_route_sched(r2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, 0x0, 0x0}, 0x94) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r9}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0) 2.291244052s ago: executing program 6 (id=4301): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000d80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0xa}}, @NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x101, 0x0, 0x0, {0x73c3bfc5edc560a0, 0x0, 0x7}}, @NFT_MSG_DELSET={0x14, 0xb, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0xa}}, @NFT_MSG_DELRULE={0x14, 0x8, 0xa, 0x401, 0x0, 0x0, {0x3}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x98}, 0x1, 0x0, 0x0, 0x4}, 0x40c00) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000000c0)={0x4, [0x9, 0x93, 0xffff, 0x2]}, &(0x7f0000000100)=0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r1, @ANYRES32=0x0, @ANYRES32, @ANYRESHEX=r1], 0x428}}, 0x0) 2.074996083s ago: executing program 6 (id=4304): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001000)=ANY=[@ANYBLOB="70010000100033060000000000000000fc000000000000000000000000000000ffffffff00000000000000000000000000004000000080040000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414000000000000000000000000000000000032000000fe80000000000000000000000000001a27030000000000000000000000000000fdffffffffffffff0000000000000000ff0f000000000000fcffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008f000000000000000000000029bd7000000000000a00040000000000000000001c00200000004e2200000000ac1414bb00000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00040002"], 0x170}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket$inet6(0x10, 0x2, 0x6) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendfile(r1, r0, &(0x7f0000000000)=0xe510, 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a31000000005c000000060a010400000000ec0000000100000008000b400000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c00028008000180fffffffd0900010073797a3000000000140000001100010000000000000000000000000a"], 0xd0}}, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, r3, 0xbc8bf000) getsockopt$X25_QBITINCL(r2, 0x106, 0x1, 0x0, &(0x7f0000000040)=0x13fe4c102fd7fdb3) sendto$inet6(r1, &(0x7f00000002c0)="100000001200050f0c1000000049b23e", 0x10, 0x0, 0x0, 0x0) 1.928585781s ago: executing program 4 (id=4306): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000000), 0x8) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000040)=0x80000004, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000540)={0x1, &(0x7f0000000000)=[{0x4a, 0x0, 0xf, 0x1}]}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r3, @ANYBLOB="08002600940900000800b7"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 1.760821338s ago: executing program 4 (id=4309): r0 = socket(0x10, 0x80003, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56459, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xfffffffe}}]}, 0x38}}, 0x0) 1.620259887s ago: executing program 4 (id=4312): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'\x00', 0x8411}) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000000)={0x2, 0x0, 0x81, 0x10001, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x2b}, @remote}, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, 0x0, 0x4098) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) syz_emit_ethernet(0x9a, &(0x7f00000003c0)=ANY=[@ANYBLOB="bbbbd3bbbbbbffffffffffff86dd6a01a6040064110000000000000000000000ffffe0000002ff0200000000000000000000000000014e234e20006490"], 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) sendmmsg$inet(r1, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000002feffff720af0fff8ffffff71a4f0ff0000000071100000000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a00fe040026ca7203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51bf900000000000000d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba3a9508f9d6aba582a896a9f1e096df6ecea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350844ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6032399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0xffffffffffffffff}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYRES64, @ANYRES16=r6, @ANYBLOB="3d070000000000000000010005000500070000000000000009f700000000e1ff319644e908000a0000000002000000000014001f000000"], 0x5c}, 0x1, 0x6c}, 0x4000000) (async) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="413c55c0a7f6f9733f5b6891394d3fe29a971139f71d2db8cd957aa50c691266bcb6c3c8f5727d085038d960bf749c3571e4b6f54268c20ebbba21fca0fb8307ba4ec85938c92d2acbe0f742fa89903aad7a700b77d55616cc60b6b3bf2ef16297344c", @ANYRES16=r9, @ANYBLOB="010029bd7000000000003900000008000300", @ANYRES32=r8, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x20}, 0x1, 0x0, 0x0, 0x8007}, 0x8000) (async) sendmsg$NL80211_CMD_DEL_INTERFACE(r7, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20680008}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, r9, 0x800, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x2, 0x3d}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x10) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) getsockopt$bt_BT_SECURITY(r11, 0x112, 0x4, 0x0, 0x0) 1.446883428s ago: executing program 3 (id=4314): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xfffffe6f, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) ioctl$sock_netdev_private(r0, 0x89fa, &(0x7f00000001c0)="e5f3595e88e73061e1b29a94380f8231b5facdab9de14a9d8a33079d35eed83bf0edb3d3792dd7fe7e000bd0ea03b1bec04055935d57160237ca71158a1b718862ff5996acc67ccff4afca24d62adcea8b4bf4950a692f94caaccc2c6307677382897ec98a508f016ff8ad5b031eeb5cea6b59e23042911407320b51c09421bbfc1883408650b3") ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x6) writev(r4, &(0x7f0000000080)=[{&(0x7f0000000100)="480000001500257f09004b01fcfc860a881300f217e0b9be6e718b66984e060000e3325c4fa99d516b149a91bf05300242752ff310815cdab75dfcc6a1ea0e7bbd55694b0a83ee8e7ded7aad41c2cb342c7c1854e62c936e79bcf679e07e30e718e5de5f663ee3c13946e32480b797c617499d88f6103093202de440373f320431e0125b33e772f9c56da52635b38f474b13ca7ef92d", 0x96}], 0x1) 1.327462004s ago: executing program 5 (id=4315): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="6c01000010001307fefffffffcdbdf256401010100000000000000000000000020010000000000000000000000000001000000004e2100020a0000006c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe32000000200100000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000525a0000000000000000000000000000000000000000000043050000000000000400000000000000ffffffffffffff7f0000000000000000000000000000000002fdffffff000000000000002cbd70000035000002000400500000000000000060001200726663343130362867636d28616573292900000000000000000000000000000000000000000d0000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c5dec7cb7a1c0004"], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}], {0x14}}, 0x98}}, 0x0) 1.282209506s ago: executing program 4 (id=4316): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) socket(0x29, 0x803, 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x99}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit={0x95, 0x0, 0x1008}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r4, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r5 = socket(0x1d, 0x2, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={{0x14, 0x10, 0x9000, 0x6}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8}, @NFTA_SET_POLICY={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x6c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000000140)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0}, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0xfff0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a09000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a400000e6ff0900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r5, 0x6a, 0x3, 0x20000000, 0x4) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) socket$netlink(0x10, 0x3, 0x13) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r10], 0x54}}, 0x0) getsockname$packet(r3, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0xa) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="500000001000110f00"/20, @ANYRES32=0x0, @ANYBLOB="040100000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB=' \x00\x00\x00 \x00\x00\x00\b\x00\n\x00', @ANYRES32=r11], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.139262003s ago: executing program 5 (id=4317): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a80)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3fab00000000000000002e00"], 0x50}}, 0x80) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000850000000500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="b4050000000000007110880000000000460000000000000095000000004a000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x8}, 0x10}, 0x94) 1.138750554s ago: executing program 6 (id=4318): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) ioctl$int_in(r1, 0x5421, &(0x7f00000000c0)=0x7fffffffffffffff) listen(r1, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2, 0x2, {0x41}}, 0x10, 0x0}, 0x0) accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000043000000", 0xfe60) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x28}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x5, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x5, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private0}}}, 0x108) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040), 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)={0x1b, 0x0, 0x0, 0x59d, 0x0, r3, 0x0, '\x00', 0x0, r6, 0x0, 0x1}, 0x50) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000600)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x9, [{{0xa, 0x4e24, 0x7, @mcast2, 0x5}}, {{0xa, 0x4e24, 0x9, @local, 0xbd}}, {{0xa, 0x4e22, 0x6, @mcast2, 0x3}}, {{0xa, 0x4e23, 0x9d3c, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10000000}}, {{0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xfffffff7}}, {{0xa, 0x4e20, 0x7, @private2, 0x5}}, {{0xa, 0x4e23, 0x2, @private2, 0x40}}, {{0xa, 0x4e23, 0x2, @private0, 0x9}}, {{0xa, 0x4e20, 0x742, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xfffffff6}}]}, 0x510) 966.389826ms ago: executing program 0 (id=4319): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x3, 0x8, @loopback, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x303}, "41328ac34a4ad2ba", "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "89b06aff130000fd"}, 0x38) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0x1, 0x58, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_tos_int={{0x14, 0x11a, 0x1, 0x3}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @broadcast, @dev={0xac, 0x14, 0x14, 0x42}}}}], 0x38}, 0x8000) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "58474e6e18ddd767", "f9deb80a8fde5747f3e21c8415217ce2", "9a8fb891", "5cdd1d735d813c59"}, 0x28) socket$netlink(0x10, 0x3, 0x15) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) (async) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x3, 0x8, @loopback, 0xfffffffe}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x303}, "41328ac34a4ad2ba", "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "89b06aff130000fd"}, 0x38) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0x1, 0x58, &(0x7f0000000040)}, 0x10) (async) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_tos_int={{0x14, 0x11a, 0x1, 0x3}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @broadcast, @dev={0xac, 0x14, 0x14, 0x42}}}}], 0x38}, 0x8000) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "58474e6e18ddd767", "f9deb80a8fde5747f3e21c8415217ce2", "9a8fb891", "5cdd1d735d813c59"}, 0x28) (async) socket$netlink(0x10, 0x3, 0x15) (async) 916.146179ms ago: executing program 3 (id=4320): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r1) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r1) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001100)={0x40, r3, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x16, 0x34, @random="b0ff0ab9f07ba03cc524e072f9dc86e26200"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2a2}], @NL80211_ATTR_BSS_BASIC_RATES={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x0) (async) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001100)={0x40, r3, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x16, 0x34, @random="b0ff0ab9f07ba03cc524e072f9dc86e26200"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2a2}], @NL80211_ATTR_BSS_BASIC_RATES={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="800100001000010000000000000000ac141400000000000000000000000000ac14140000000000000000000000000000000000000000000a0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000000006c000000e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480002006374722873657270656e74290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000480003"], 0x180}}, 0x0) (async) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="800100001000010000000000000000ac141400000000000000000000000000ac14140000000000000000000000000000000000000000000a0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000000006c000000e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480002006374722873657270656e74290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000480003"], 0x180}}, 0x0) sendmmsg(r4, &(0x7f0000000bc0)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xdd87, r6, 0x4000}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000080)='O', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}, {{&(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @multicast2}, 0x3, 0x3, 0x3, 0x2}}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000340)="5c85afd046bfc3795459d4a5e31b280333347d77ffeb2054267810f31d8b94059b6c1bd44290bf1ff933a381d800d44e611f199885d3587bd2d80fb45491b76376cbf7709230c825b067249f905c55aeb220692b8b7a5766e2fc0697ea68f31196db190cd973774a76", 0x69}, {&(0x7f00000005c0)="d6b54790fd1a466de35e60d614a9ace67954988c958c567b1efb41a49d3179c13a31f0c8175b388f7c6f4af3f3a7668eeb86f822cca6ab67ada597ba3659db4402273d00c2d877510dfc6833d754167d0a6e1803ddcefcd65867c8ed78ef40acc408fb1b93dabe2d2048864c17e0be5ac1845c5615f9e8577f843bbeeab52496de7e0a28228e036e74027a568cb48a336a1410db0ca15c712a6d44ab3f9735ec737f44b52e3672eded021aa52ec33601523c19cb51a1fd4f4e8f7ed336dbb6bef937b43c", 0xc4}, {&(0x7f00000003c0)="e62a30556faa0845811d64acfff1ce55a2b094acc0112f9c7794420495439e705d2c7f043a586b13ed4c3810b53d45f2b512844c24caee14953fd4490bc20d99287221cc9dbe97d9317b2ef3e830f590ef0364", 0x53}, {&(0x7f0000000180)="705b3aa9801e718613b684b6bd41b1a6df35c651b492eac0950e61f7c3137c62b8130c657555f8f89d5e47c3", 0x2c}, {&(0x7f00000002c0)="7f61d2f193996d12", 0x8}, {&(0x7f0000000780)="1f4ac09f92dc1520184203385dad42f32afd613ac30c4b46c4092b226fe4466d8e10d8fa881a95aa3fa63d8650bbf411bbe148cd0b4633526b5f9d932c90694623699aea176620ea6a710f32b7ef3b70b64b684a1d3b07e1c2cdebef8388d8e0c371c91ce3dbf86bd21f285eb5272c043980c3861920e5d758afd9fca3c99e07d5eccb66943bd38c4e17104ae70b75fea610849d9304fc1d594c7cac611af26fb71cf0f959932d10f709743c44eabb", 0xaf}], 0x6, &(0x7f0000000840)=ANY=[@ANYBLOB="f0000000000000000801000009000000e477dde2dbb83140c5d06218b1b0507d55084a8d15c25ce024f83b25b0cb61e4943c7e8349b57fe2f119cb7ec623a663440b2ac099dc4f2af5786950fd755986ecd412aa38bb3b9399d81026a9a6db2a6a2d648b927eaa96b33c88fc9a6cdb8fcde903bd11263e05d7f4850d81f6f9f33aca1dd5e9fd5bcced2f802496c69f6052f7675cbf6179020465217754939c9d560408ba5320d2cdc26b7c9ef4d88a130f86eb11c81d1455c20d7bb3a5cac907825e4706010cf81634c399532d577c7f74af108483bdbc8270cf457bb5d7b9021e32cd0c7bd86622f249000000000000f80000000000000009010000080000002914552fdd2a3ae890d89031da988cdf5cb93796271dc92e6333223f8de6e70a0b801f060f4f5499db68d5119b20cbc40c0c0ea0ebce15e335165d506f245dec3eaa6e1df15494b2b9f2d0f62733addbb0c8bab93b5c2db9caff335ba189fddfd31e2973f4e48dfe8fd2be6549fa6d3a1c5988d85266526fa10d05eb656aa127f47548c331b142a2d79ac45a60bd538ff7d0cbc22497c3a51a8a4c15e09f8873cf67f0abb62a4c5e3688e3b3cfd97fcdad11d72ea6438d890c1c9858f055ae1f088482826537130bee00afbb74b4270514bf6491d78c95e1f710e7c15179160f2957d7610d5440bcd0ed38ebc8cbd616da078130c96e0078000000000000000801000008000000cb8bc8c8a421b0db526ae5928778f17616c37e89133330780795dfdb92f91e33915e726ae40bfcb67bc714bab378505126d61a7220899c4e8b92d866baea218bcf073927f426ac49b46578da3927a1b1d872a3dbbe5b64fa4661445ce42204fdc2480221ee71000008010000000000000f01000003000000a1c1134d696d24c23e3b78465c46ee8106f69c10d0c6be1f64aca2dd27dc49f34e994da8b44963f3f354f0cca5eed315ebd8f5c3fe49488e06fe1f899464e83ef2b1590a7634f06f049acdefdd90735b1cd7075097f64002e392086c6a9a8e6a5a9c1e5b938ce1b9e6186bdd1f0046a6afaa73a032d42601bc86ddd1c40f8b3c4e2f0900e71ad536b5c42703099eb5d471a6f4b0b1ed05a099cb2fc4a1c4802ce0ce8f2de91c754378f0c1ea9a42cc1148e385ea06b12708031ba565c7a4c13c47e62080e698b1c77f824a7302b97a5d4a3c0ade0c73b6f3cb0b0687773f6edf485178086c70db8303"], 0x368}}], 0x2, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000c80)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000c40)={&(0x7f00000006c0)={0x28, r3, 0x100, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x20000050) r8 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r10 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) (async) r13 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r14 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r14, r11, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f00000003c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) ioctl$TUNSETLINK(r9, 0x400454cd, 0x118) (async) ioctl$TUNSETLINK(r9, 0x400454cd, 0x118) socket$kcm(0x2, 0xa, 0x2) (async) r15 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r15, 0x8914, &(0x7f00000001c0)={'syzkaller1\x00', @broadcast}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000d00)=@o_path={&(0x7f0000000cc0)='./file0\x00', 0x0, 0x8, r8}, 0x18) (async) r16 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000d00)=@o_path={&(0x7f0000000cc0)='./file0\x00', 0x0, 0x8, r8}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001080)={r16, 0x0, 0xdf, 0xe4, &(0x7f0000000d40)="deb4eb941f482ed4265582b5b86e133fd9d05464cb6dd44de56d21d098466e4942a53a6b10191c2a1c4c2eeee94a0b2399bdb93c9583781fd13d5a5c020e4bc6e3ffdd76c45c0a38598d7d8ea5222d43ed4b25f648aa09bab3e65ceabde583494ff22276da34fa1111b3568c6d5082ea499dc1c7a5ca43772392c5db959fa8372e8eefc6862ab8bb46b039da920d40f59d66b6730df956245cf23d2a1ba7979ddb3f6a8722a19cb29bb5ebbf642503df2398058240dca29870c9210d447718ba6e877a166d3e6ce18085803fac9330235a8c750cfe495219e7a37ea68c8856", &(0x7f0000000e40)=""/228, 0x92a, 0x0, 0xa3, 0x46, &(0x7f0000000f40)="c59e8fbaa8bb3e25cfbde48146b60e7caf05ca35e568f78b444ec1319c9d4fa5f7bca1066b1a021bc3eb2f49aa5d0a47dcbb77b2f4ad42fb597c1ec1528607ec005ce732ca6e8509fb3e0338a060c41eafd3e44ef0aa059dc27f892a46da41760168d6f0881f46c4974442a3ea210d00d91825e7bd4a95610127b67c70a6b168f1455cc2b82f3a73eee3a16aed95b60e1018f8c88dc2b4bc2c926b08cbeab5f8946264", &(0x7f0000001000)="e0e0edb3868fbd0d41a1545caa39f4bc95ee5d3e10eef5b5d7bbf37ad5fef04ae0788d0d060654c3aa600827ceefc9789af3075c9b3a17ea1965d158a1aae6ec0b82e0b7971d", 0xfc6f01bba2b328e3, 0x0, 0x4}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001080)={r16, 0x0, 0xdf, 0xe4, &(0x7f0000000d40)="deb4eb941f482ed4265582b5b86e133fd9d05464cb6dd44de56d21d098466e4942a53a6b10191c2a1c4c2eeee94a0b2399bdb93c9583781fd13d5a5c020e4bc6e3ffdd76c45c0a38598d7d8ea5222d43ed4b25f648aa09bab3e65ceabde583494ff22276da34fa1111b3568c6d5082ea499dc1c7a5ca43772392c5db959fa8372e8eefc6862ab8bb46b039da920d40f59d66b6730df956245cf23d2a1ba7979ddb3f6a8722a19cb29bb5ebbf642503df2398058240dca29870c9210d447718ba6e877a166d3e6ce18085803fac9330235a8c750cfe495219e7a37ea68c8856", &(0x7f0000000e40)=""/228, 0x92a, 0x0, 0xa3, 0x46, &(0x7f0000000f40)="c59e8fbaa8bb3e25cfbde48146b60e7caf05ca35e568f78b444ec1319c9d4fa5f7bca1066b1a021bc3eb2f49aa5d0a47dcbb77b2f4ad42fb597c1ec1528607ec005ce732ca6e8509fb3e0338a060c41eafd3e44ef0aa059dc27f892a46da41760168d6f0881f46c4974442a3ea210d00d91825e7bd4a95610127b67c70a6b168f1455cc2b82f3a73eee3a16aed95b60e1018f8c88dc2b4bc2c926b08cbeab5f8946264", &(0x7f0000001000)="e0e0edb3868fbd0d41a1545caa39f4bc95ee5d3e10eef5b5d7bbf37ad5fef04ae0788d0d060654c3aa600827ceefc9789af3075c9b3a17ea1965d158a1aae6ec0b82e0b7971d", 0xfc6f01bba2b328e3, 0x0, 0x4}, 0x50) write$tun(r9, &(0x7f0000001400)=ANY=[@ANYBLOB='\x00\x00\x00\f'], 0x152) 831.127589ms ago: executing program 6 (id=4321): r0 = socket(0x10, 0x3, 0x0) (async, rerun: 32) r1 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="0c000280060001"], 0x24}}, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001840)=@newqdisc={0x470, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0xc, 0x7}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x444, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x8}, @TCA_TBF_RTAB={0x404, 0x2, [0x5, 0x9, 0x3, 0x38, 0x8d, 0xffffffe0, 0x8, 0x4, 0x0, 0x1, 0x4, 0xfffff4bf, 0xa, 0x6, 0x6, 0x6, 0x6e5, 0x5, 0x9, 0x7, 0x401, 0x7ff, 0x8, 0x0, 0x3, 0x8, 0x3ff, 0x3, 0x5, 0x4, 0x3, 0x4, 0x2, 0x9e21, 0x7ecf, 0x2, 0xc, 0x8977, 0x4312, 0x5, 0x80000000, 0x0, 0x1, 0x4, 0xd9, 0x4, 0x3, 0x3, 0x2d, 0x7a8, 0x7, 0x0, 0x1000, 0x0, 0x1, 0xe, 0xfffffffb, 0x8000, 0x27, 0xffffffff, 0x10000, 0x5, 0x9, 0xfffffffe, 0x5, 0xe, 0x101, 0x9677, 0xffffffa2, 0x8000, 0xeeec, 0x60, 0xe35, 0x9, 0xfee, 0x81, 0x400, 0x81, 0x3, 0x3362, 0x1, 0x9b6, 0x400, 0x5, 0x9, 0x7ffffffb, 0x1000, 0xe6d, 0x7fffffff, 0x4, 0x1, 0x7, 0xff, 0x6, 0x5, 0x2, 0x7, 0x2, 0x10000, 0x3ff, 0xe2, 0x1, 0x8, 0x6, 0x0, 0x7fffffff, 0xfffffff9, 0x140, 0x2, 0x7, 0x81, 0x7, 0x5, 0x2, 0x69b, 0x9, 0x7fffffff, 0x5, 0xf, 0xd3bd, 0x453, 0x7, 0x8, 0x4, 0xf, 0x6, 0x10320000, 0x7, 0x7ff, 0x4, 0x0, 0x9, 0xdf60, 0x7, 0x10000000, 0xd, 0xfffffffc, 0x80000001, 0xacc0, 0xf, 0x7ff, 0x6, 0x2c8, 0x5, 0x9, 0xfffffffe, 0x0, 0x3, 0x9603, 0x719b, 0x5, 0x7, 0x10000, 0xfff, 0x5, 0x6, 0x6, 0x20000, 0x7ff, 0x49d, 0xf, 0x7fffffff, 0x200, 0x6, 0x0, 0x7, 0x6, 0xa, 0x2f28, 0x20000, 0x400, 0x8001, 0x6, 0x5, 0x5a2, 0x7, 0x800, 0x2, 0xaa, 0x7348fb54, 0x93a8, 0x5, 0x8000, 0x80000001, 0xfff, 0x5, 0x5, 0x3, 0xc, 0xc5, 0x1004, 0x4, 0x7, 0x8001, 0x3, 0xfffffff8, 0x3ff, 0xff, 0x400, 0x8, 0x9, 0x3, 0x8, 0x8, 0x1be, 0xffffa9ab, 0x5868b5c9, 0x401, 0x1, 0x0, 0x3, 0x9, 0x7f, 0x200, 0x4b4975b4, 0xf39, 0x1, 0x101, 0x800, 0x4, 0x1000, 0xc, 0x80, 0x1dff, 0xc, 0x7, 0x8, 0xb390, 0x7f, 0xff, 0x8, 0x0, 0x8001, 0x1, 0x2, 0xddf5, 0x2, 0x5, 0xfffc0000, 0x6541, 0x5, 0x9, 0x69c, 0x2, 0x2, 0x7, 0x8002, 0x0, 0x8, 0x400, 0xfff, 0x474861a7, 0x440, 0x3, 0xd, 0x5]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x6, 0x2, 0x9, 0x2, 0x1, 0x8d}, {0x3, 0x0, 0x64, 0x40, 0x424, 0xe}, 0x0, 0x1, 0xdd8}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x97bdea2cc2d43cda}]}}]}, 0x470}, 0x1, 0x0, 0x0, 0x10}, 0x0) (rerun: 32) 827.754ms ago: executing program 5 (id=4322): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$inet_sctp(0x2, 0x1, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000200)={r2, 0x2, 0x30}, &(0x7f0000000240)=0xc) r4 = socket(0x400000000010, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="840000000a0601010000000000000000010000000900020073797a310000000005000100070000000800094000000008540008"], 0x84}}, 0x0) setsockopt$inet_MCAST_MSFILTER(r7, 0x0, 0x30, &(0x7f0000000a40)=ANY=[@ANYBLOB="030000018000000000000021e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000760000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014c5da4de4d92"], 0x90) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b401a0000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c08000140000000020800014000000030080002400000000308000140000000120800033524a707bfc82b74b25516770c10da7244ac6bed6e6290ee1c"], 0x122}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0x6, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000}, 0x8000) 780.54659ms ago: executing program 0 (id=4323): socket$inet6(0xa, 0x800000000000002, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_LOOKUP_ELEM(0x3, 0x0, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0xfffffffe, @loopback}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000000140)=0x9, 0x4) sendto$inet6(r0, &(0x7f0000000040)='H', 0x34000, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x9, @loopback}, 0x1c) socket$inet6(0xa, 0x800000000000002, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) bpf$MAP_LOOKUP_ELEM(0x3, 0x0, 0x0) (async) syz_init_net_socket$llc(0x1a, 0x801, 0x0) (async) bind$llc(r1, &(0x7f0000000080), 0x10) (async) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0xfffffffe, @loopback}, 0x1c) (async) setsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000000140)=0x9, 0x4) (async) sendto$inet6(r0, &(0x7f0000000040)='H', 0x34000, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x9, @loopback}, 0x1c) (async) 663.532578ms ago: executing program 3 (id=4324): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bf8200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) close(0x4) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000040)={r3, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x9}}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000004c0)={r3, 0x3, 0x6, @remote}, 0x10) close(r2) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) socket(0x8, 0x3, 0x0) ppoll(&(0x7f0000000040)=[{r4, 0x750e}], 0x1, &(0x7f0000000080)={0x0, 0x3938700}, 0x0, 0x0) 555.280354ms ago: executing program 4 (id=4325): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x1, &(0x7f00000004c0)=0x78, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r3, 0x1, 0x24, &(0x7f00000002c0)=0x5f53, 0x4) bind$inet6(r3, 0x0, 0x0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x0, 0xea60}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) sendmmsg$inet(r1, &(0x7f0000001080)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000011c0)="93bffce623851797a8dc7901f0048678cd", 0x11}], 0x1}}], 0x1, 0xc0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newtaction={0x9c, 0x30, 0x48b, 0x0, 0x0, {}, [{0x88, 0x1, [@m_ctinfo={0x30, 0x2, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @multicast2, @remote}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x9c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r4, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4410}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x20004000) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, 0xffffffffffffffcb}, 0xc090) 472.062432ms ago: executing program 0 (id=4326): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001600010a"], 0x14}}, 0x0) r2 = socket(0x18, 0x5, 0x400) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'ip6_vti0\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) r3 = socket(0x10, 0x3, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r4, &(0x7f00000000c0)="f461c5bbd75c3583", 0x8, 0x0, &(0x7f0000000100)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_int(r4, 0x0, 0x12, &(0x7f0000000600)=0x1b, 0x54) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_MPLS_PROTO={0x6}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) recvmmsg(r4, &(0x7f000000e280)=[{{0x0, 0x0, 0x0}, 0x8001}], 0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x18, 0x68, 0x5fb9a818fb7378e9}, 0x18}, 0x1, 0x0, 0x0, 0x95}, 0x88c1) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r8}, 0x10) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r9, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) sendmsg$inet6(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000600)="e5f1fddfe175759743a2d6055bef6ad67f4806ff6ac3a93555c1b5b84294df29b09e92680ca8bd3dc842c3147716237f0ad0c3ab59f41083aeb894e76f3c7fc753f2fca40d24553fdd9396171c35ecfd0932f37aa306040bd37f78526b319e572be0ae8b40f01b3835c385e789683bed9c65ccd19545b738fb470ef7c7247c631882fe3cee1ad627ad729a685446e0c1b6ca16a98bececc6ed604084f0de672a6143", 0xa2}, {&(0x7f0000001840)="fa4930e2f7feb52241e739006ef78c0aeb4dd989f1bf69e01e4eb4bb743569e49e3db4ab502ed6980a5794e38f83ba0c77252adc9d177719cb1f7991ee501ad1ff9d69f88d4bb7a70b76402fd5b363", 0x4f}, {&(0x7f0000000840)="3b9eccc918ce8c50894cb802b04e9492b64a02d85d3ed05eac49318868ad13e4fa9e2f1b165dfcc79e43ed30bb0c212bebb71afc79347f2f1a90e936a487e1ce171789626d34ffa8e3b4415ad869955133f81fab7f450d7ef6df7bf6a16cc39fd78e88662ffd1c3b31ffe836682b1ad9c331a068a75d12fd346d77f5cdacee9fee2203a321c260b0b5fdc8b5d7d43148f4b0fb550dd9d8746f0a0444cfa52af90a966921f9cb48b0c99727166a2f59c12dae2fcc4d891258bd723b5fd1fcb4cb219c87fadebe2582802ef18165f5ff67ba0d4eb4d3ef1f80ba9dff1a74dd5874b3d8017ff61b5174d9660e54f2b5f94f29f6665567b2ca6d0549a500a428ce29b197f754f8e3b6c7dc21260ce97551074886667837db75c9a21cdf92b14dcb2e1f997bab3bf1902b8d8e9eb238c021fdbe48675473dac385e2fada25f767ce5e7576c2dc496841123c81314f100e0648405f0ca9b5aa012d9316f3945e613aba10d1fbc2917143ed606c5513394343c9fac6f95ee678031ba5f4a81d8c2ae0d31c5711c91845f07b0add2bb4bd0f700217044582adf1850b0af5f04b63906918b7312fc3a800d67d8293604321633c41153f83662b2cbec354cf9c33e9eaa8ab2c5e4d86f82d379e98ad8d749595829b548ad77596448bf718c5e52a7dac04f62fde8ab1cc55ee5b6fd57327c8e678c1c8f9b8c235c132faffc553d54253f67d40075d91b7abaa303e5844ee31871fcdded3d8de8df952ae53e60d73e57267117129a4b42df34faa3287bb1c475d9ef904b7a4d33f1f8014e59905c3dc145e3974d71487ce05c9149fb4f9788ef0f519151d82391d783df5753819a0d967d842e60d28257741fb8b794b18a4e2f2f4f10412aa580062d0ef3691f4bdc14d283d672ae10fbbe23fa15f9225642aad56cc8a36538afe97750a0bf313cf3b9fdd881aa067b3b6ad9a69c04b50c9b4f8e29c11d7dcaf08b57ecd5cfd8a01b0e50313d09ea6b3634867f0c23c06055e04c36bddcdc6f4e30b2b6c0b0fa25a20843570bd582df937f7f48cd8e07abcfeaef4f8a72b34978ba5c95d65731943cdf2df8357311bb28d7d72fb9226dcbd059b14242c6fd4ab1ac90367a27ab715ebe553416966ceb79db37cd2dc45687269e4da211fbfdd77a44c730a4732a12ff99fd151d205379bee91935a7bf4eef879d564872fdb2d7c399972ce5d44b59ea05d19a6b00c717b1dd3401a169b4402152b6f21c84c865f00ed0a9da758decaf1ad20138b80bee54a918d5d7dd5432c7ee34ae786cf7f55ea7f67229c39b81cccf80ccb424d139df240a9b18b3c4223de42e71ee7264a1c5db8da2d7fb3dfae2befb2f26e0c996d204ba3df39b111c445f3affed9c9fc8c2b67630de56b5a922f3fd7e0c2ef97df3ad486354937c4606a91874c7403dadaeabd03fe82c92cde4d67c6ac2ad7eedc9761224bf0c6b73ba60934f5c2db9846de4c41c6cb2f5ac6a7ad47418279f6cdd951679c1530ee4dab6d81a8cb41db64fc28ab9598c26fe51f6ddb0900a971aacc92a7e2dfbb596a1571609a4b8bc86c5c218b9220ceca304b7052a58e8c6ce427e4c9b127a133e625c02bf77a89ebff746f829401230f2a757c3ce04a6d01b35350973d24637526278fa724cb3053fd04cba673f682992041dc1cbebe9b574e5ab39307d695b2470cc21122e9c587301630351eeaa5dc1c8bb685ce2b0f4cc25d584354799858c2a11fe1b70518659acff13ad9702e6fd3116d311628bbd9b86f6a09c2a00ad08440860b621716799576b0de92285d0700004719a1eddbb691878526c34ad392e1d72f04d7830686f792152e7e497bc76721aa1c0493698efb8f463d0403d134b9ca6b19240e496edad804be73acb88b0fd1e0de3f00f83a135cf1b58376137e6e93136682343440fd4f96f00d56f9ff265cf5f4b8cc663d56eace1c1eb9fc8bcfcc5f947f14633886ae2b4c6b2bdeb71fcc7802945e484188b3f0425fd96996780f4f9e5ba028e5a600c65bdf6fc6936fc5f9e1792a02cb428f97262167e47a13f6a6634b99eb1791e7cd82f14c8c3353a52569c12e5b40a404564b4cba2fa7f247fbd74e1ab16f4caf68f6ebad58634970c1336d38c3feaf2b5c4eb8afb45aedb65c54b7e6a811c337d68ca5fc58279d7c4c524eb02bb36cd61f6269ce6b81e542e86500c837f7144962b2a6772981bed18a2173e41d73a74235f468305b3f0d5bd0a8f6ce90f6ba63f25322705d6464f9a24cdc13a528a9ae5f3907aa7018f5a1582c5242dbd325d05fef384da2f2cbd65ac0905a2311d75f72e2e1d30d34a62f91ebb79464ad1ca22b94e84d14c2337d13a017f80b3011d715c8629b1a2b638d4e20cdd639ad3db15e85db21494fb5e6ea599f0412d2b238a8a93b9bc930a9e126942c04f26e27631a2a46ef3115c683494bf2d805d03f76b07ea99380725914d01de34b1a5ab51487ea4c70c9591d6f84db21bb1c65c29d47a61b4e227e8bd917e6ff9d8cc1027bd2cf453b49d59cc9d21b13533df66c76cade633aaea0345f8d6e3b14375cc99d0b3e4c0eab870c9bc7b6911014fa556c8db62c3fcfec23deb242278c49b743987d0f65969f2e517b8de7d0b2a74865246cb4f32d40e1a4ea050563f28d3b9f598cf16265b270183cbaf91a2ef96c5aaaf7223a0bdf83c9fbdb324497e11aa4ed8ef02c5c9b7556504c957f2123603c62df3098ba82cd8d9f9738af6067e509159689741a262afd436b8d21c6104d092e66e2fbefa0b7e2c84c6d8ed44410224929b5ff349bef8d9ed6df6193424858f58039e4437b01e12517c86056108c7e6bc21caa884b9f3fd116657b2c8ca30ea557e6c4b60641686d0edf7c49a1c26589f82715e2e1914385bb91100169cf509aa1f3372ab65ccb422d1db5ff6acfde3af9bc2aef6e01455ac94f9d9655dc6020e858f97bb69dce077215d1427f61aabe63786384a2195ce411207aea8af9e3a0e736bf1af08ce4aecf45ce79c46a7f3cb111b14c54de5ef13c54b68fa5fa11bfbbf6bfcde697b300a2bbc152260db6bd5d9e9a648d9e54531c4e16610b885dd9e2f620879ca8d126f843630f17ddc42fb502a0f51ee6c630eb734c54891094684f9e34e5331ccb5570bed0fc99361e681e9e2f9ee16c8d3d89ddc7b1e51c70942b0a890d69411f1e8a8e73c6415eeb848a6987f806af7ef5c62ec16b862164943325b8c5b3ae2d8df2e33bb5dac9546c2b32070d05bb2753c6ade48f1c54fb0e3333c2de138a736a19e895037090336bc5e7e3683f7cdf148d20f5bbcfaa458fb9a24faa62c7151577ac9ab8f10af0e70b35c8c2d5d30c53e394d1eda842fef1647ec686022df373ca10be06ab8d74b56f2c7108f08d56b6c9e3980c6f30e14a1a154c5fec893deb607868eeeb6f981cfd08056b54f3327bb733cbd64c7c79447489dd6950b07c079544da5f184e21dbe9478dc0b5ed245e0dc9f60b577d0230e4a92fe1d7c2d1cb354f65da8f28692159b103e6564c58854f8bedc969f4e1158b58a90f21aa67686fcd74a8cc8909fe8557662582bf916cb409af96267dc0cbb5232309c5934e152e758f28518f37fa1da83fdfefb0f2991a13aa4c03e4f8ba4e2721a7c5e78474c05581299f3e9d24c433685dcea029494a7b7bd74cc986b3a4a92b5f6a21a2f7dcee7605474e1508ab632a9a4aa1992c7bf3d9265bffb047cdd0ebce043e411a3260de73af0dcbf6197a60a81846b3ae05db1227d5fc2815a9a7572764bbcf83d47fe202ffff6bda074405bb6132e3063bfd0ebdca4b8f8074f784bb0823fba59188764a37f73adcbcd80e", 0xa98}], 0x3}, 0x20000044) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) sendmsg$nl_route(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="24000000b9f88851000000000000000002001000fe0400010000002008001e0002000000c4a0cd379afdd72d46b2fe7044d0bfc73b3f4ce26f95"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) 441.343302ms ago: executing program 5 (id=4327): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x15, 0x10, 0x4, 0x0, 0x0, 0x1, 0x25f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.kill\x00', 0x0, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e21, 0x7, @private1, 0x8}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000010010000002ffebdf2530000000", @ANYRES32=r3, @ANYBLOB="20000000000000001c0012800b0001006d616373656300000c00028005000f"], 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="b40500000000000079108100000000000500000000000000950004000000000060a633a45c6314764f8f0d80197bcfaae5c754979187bfd9a21bb0d7209bb7a0807413d4926746aa34"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 351.139762ms ago: executing program 4 (id=4328): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newsa={0xf0, 0x10, 0x713, 0x70bd28, 0x0, {{@in=@empty, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e23, 0xfffe, 0x0, 0x0, 0x2, 0x0, 0x80, 0x3c, 0x0, 0xffffffffffffffff}, {@in=@empty, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x0, 0x0, 0x7fff, 0x100000001, 0x6}, {0x0, 0x0, 0x2, 0xfffffffffffffffc}, {0xc}, 0x70bd28, 0x0, 0x2}}, 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x70bd2b, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x42}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) syz_emit_ethernet(0x46, &(0x7f0000000080)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd60f4adf7001000800000000000000000000000000000374d99f400000000000000000000000000013c0040af44ae88673c"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000054000100010000000000000007000000", @ANYRES32=0x0, @ANYBLOB=' \x00\t\x00', @ANYRES32=0x0, @ANYBLOB="01000300ac1e000100000000000000000000000086dd00"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x3, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x18, 0x14, 0x21, 0x0, 0x0, {0x23}, [@INET_DIAG_REQ_BYTECODE={0x4}]}, 0x18}}, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xa, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x88}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r4, 0x20, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4008) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000100)={0x50, r6, 0x1, 0x1, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x126}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x50}}, 0x20000000) socket$kcm(0x10, 0x2, 0x10) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newsa={0xf0, 0x10, 0x713, 0x70bd28, 0x0, {{@in=@empty, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e23, 0xfffe, 0x0, 0x0, 0x2, 0x0, 0x80, 0x3c, 0x0, 0xffffffffffffffff}, {@in=@empty, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x0, 0x0, 0x7fff, 0x100000001, 0x6}, {0x0, 0x0, 0x2, 0xfffffffffffffffc}, {0xc}, 0x70bd28, 0x0, 0x2}}, 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x70bd2b, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x42}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) (async) syz_emit_ethernet(0x46, &(0x7f0000000080)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd60f4adf7001000800000000000000000000000000000374d99f400000000000000000000000000013c0040af44ae88673c"], 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000054000100010000000000000007000000", @ANYRES32=0x0, @ANYBLOB=' \x00\t\x00', @ANYRES32=0x0, @ANYBLOB="01000300ac1e000100000000000000000000000086dd00"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket(0x10, 0x3, 0x0) (async) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x18, 0x14, 0x21, 0x0, 0x0, {0x23}, [@INET_DIAG_REQ_BYTECODE={0x4}]}, 0x18}}, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xa, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x88}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r4, 0x20, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4008) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000100)={0x50, r6, 0x1, 0x1, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x126}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x50}}, 0x20000000) (async) 350.657433ms ago: executing program 5 (id=4329): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff71a4f0ff000000002d040000000000003d400300000000006504000001ed000079110000000000006c440000000000007a0ab0fe000000007b13000000000000c500f9ffffff00009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e6b3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7a29aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b539"], 0x0, 0x7}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, 0x0, &(0x7f0000000280)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) r3 = socket(0x28, 0x5, 0x0) setsockopt$inet6_int(r3, 0x29, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_BT_SECURITY(r4, 0x112, 0x4, 0x0, 0x0) ioctl$TUNSETLINK(r2, 0x400454cd, 0x336) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) close(r2) 329.245824ms ago: executing program 3 (id=4330): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x301, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2b780af2}]}]}], {0x14}}, 0x90}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c00)={0x30, 0x3e, 0x1, 0x7fffc, 0x4, {0x1}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x10, 0x0, 0x1, [@nested={0x4, 0xf}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001b80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x4e23, @private=0xa010102}, 0x10) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000000000005c00000008000300", @ANYRES32=r4], 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x48000) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb0006"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 194.432329ms ago: executing program 5 (id=4331): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)={0xc0, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @local}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @empty}, @CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}]}]}, 0xc0}}, 0x0) (async) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, &(0x7f0000000080)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3, 0xfff1, 0x7, 0x80, 0x9, "d4c5e9e73b45e8224efa8f2af48689a777bb28252c6f300ae9693dba02351bb8a82bb9f52895f7d98cb95fcfa47d726f254e022b703f61ec0d1046ae944952240501dd79d98e59f8c13d11640c08cc9b3111f94a7fc89ffbd9071c67f91e97b72f1e5349b539a9550a93517e7f182415e495d1b949756e54002ab3f36db85cec"}) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x80) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r2}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) (async, rerun: 32) r5 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x6a, 0xa, 0xff00}, [@call={0xc}, @exit, @map_fd, @jmp]}, &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) (rerun: 32) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r5, 0x11, 0x0, 0x0, @void, @value=r4}, 0x20) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000001080)={0x44, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME={0x25, 0x33, @auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x6}, @device_a, @device_b, @initial, {0xc, 0xe}}, 0x0, 0x1, 0x26, @val={0x10, 0x1, 0xa4}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x20080050) sendmsg$NL80211_CMD_SET_PMKSA(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, r9, 0x800, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x2, 0x36}}}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x12}, @NL80211_ATTR_PMK={0x14, 0xfe, "e2dd21effc7e35a91d473a9a1a745978"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x23}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000840}, 0x10) r10 = socket(0x200000100000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'syz_tun\x00'}) (async) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r10, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x38, 0x1412, 0x300, 0x70bd26, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000084}, 0xc008004) 119.306413ms ago: executing program 3 (id=4332): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}, @TCA_RATE={0x6, 0x5, {0x5, 0x3}}]}, 0x34}}, 0x4000080) 9.357415ms ago: executing program 6 (id=4333): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r5, r2, 0x25, 0x2, @void}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x9c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff, r2, 0x10}, [@IFLA_LINKINFO={0x50, 0x12, 0x0, 0x1, @vti={{0x8}, {0x44, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @loopback}, @vti_common_policy=[@IFLA_VTI_OKEY={0x8, 0x3, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xec94}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}, @IFLA_VTI_IKEY={0x8, 0x2, 0xff}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x2}], @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @IFLA_VTI_REMOTE={0x8, 0x5, @remote}]}}}, @IFLA_GROUP={0x8}, @IFLA_MAP={0x24, 0xe, {0x0, 0x0, 0x0, 0x8000}}]}, 0x9c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r5, r2, 0x25, 0x2, @void}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x9c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff, r2, 0x10}, [@IFLA_LINKINFO={0x50, 0x12, 0x0, 0x1, @vti={{0x8}, {0x44, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @loopback}, @vti_common_policy=[@IFLA_VTI_OKEY={0x8, 0x3, 0x5}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xec94}, @IFLA_VTI_IKEY={0x8, 0x2, 0x9}, @IFLA_VTI_IKEY={0x8, 0x2, 0xff}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x2}], @IFLA_VTI_LOCAL={0x8, 0x4, @rand_addr=0x64010102}, @IFLA_VTI_REMOTE={0x8, 0x5, @remote}]}}}, @IFLA_GROUP={0x8}, @IFLA_MAP={0x24, 0xe, {0x0, 0x0, 0x0, 0x8000}}]}, 0x9c}}, 0x0) (async) 0s ago: executing program 3 (id=4334): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x169}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xb8}}, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006c6f7770076e0000040002b1ec00010000000000100000005b412226f367cfde548bf23613ca593b2b4885f4c9fdeb21a0294e9b7cf5d969d912f31406a99227b733a803e1ac170491b86ad72e7795017722481a40714d26b42b32f09ebed0a8a4d3810b057b320274f144a163a9eae1b038d0a39ceb9f96e6fe45aebfcdd69f4ec76c2ee538014da540cee505d301a58240043493e86cfa99cc3bfa1815a572"], 0x40}}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='svc_unregister\x00', r3, 0x0, 0xfaf}, 0x18) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000640)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff07003506000002000000170600000ee50000bf250000000000002d350000000000006507000002000000070700004c0001fa0f75000000000000bf54000000000000070400000400f9ff3d1401000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c4e704000000000000a04d1ffc187fa1a2ba7ba0c0d507b92de00435fd233cc0f0d9b2c312b68856656ca9caa2ee4dc258d72e690098804de235cf020e35245c9f5526d35df627a64ac7efde50fd7f1d8bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d474c570a385a459db8e7ada8ee987cc0000f6f902b261848d74096636ab6d8c63c8d62861cbc38d1e6bef45e672ac3d3d5243b85b3b15c7499ff39a3dadcbfbea9e050fb6940344dfbeebbf3e7e37d0a9a387518f926fba75479eacd4f51aeb28b6c56a75144ef6df55a275799897ca000000000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000000), 0x19f}, 0x48) getsockopt$IP_SET_OP_GET_FNAME(r4, 0x1, 0x53, &(0x7f0000000700)={0x8, 0x7, 0x0, 'syz1\x00'}, &(0x7f0000000280)=0x2c) r5 = socket(0x2b, 0x80801, 0x1) connect$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x20) ioctl$sock_qrtr_TIOCOUTQ(r5, 0x5411, &(0x7f0000000080)) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$F2FS_IOC_COMPRESS_FILE(r1, 0xf518, 0x0) connect$inet(r6, &(0x7f0000000380)={0x2, 0x4e24, @empty}, 0x10) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r6, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r7, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000100)='hsr0\x00', 0x10) sendmmsg$inet(r7, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x4e24, @broadcast}, 0x10, 0x0}, 0x500}], 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, 0x15, 0x1, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r7, 0x84, 0x65, 0x0, 0x0) r9 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) unshare(0x6020400) setsockopt(r9, 0x200000, 0xffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) kernel console output (not intermixed with test programs): ess `syz.3.2694'. [ 361.244431][T15914] netlink: 146780 bytes leftover after parsing attributes in process `syz.5.2695'. [ 361.732663][T15937] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2703'. [ 361.743231][T15939] netlink: 'syz.3.2704': attribute type 4 has an invalid length. [ 361.854754][T15895] vxcan1 speed is unknown, defaulting to 1000 [ 361.873533][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 361.934875][T15949] netlink: 'syz.3.2706': attribute type 6 has an invalid length. [ 361.971602][T15949] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2706'. [ 362.016366][T15949] netlink: 'syz.3.2706': attribute type 6 has an invalid length. [ 362.035514][T15949] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2706'. [ 362.217387][T15954] bridge7: entered allmulticast mode [ 362.555213][T15968] netlink: 'syz.3.2715': attribute type 1 has an invalid length. [ 363.088465][T15896] vxcan1 speed is unknown, defaulting to 1000 [ 363.353160][T16005] netlink: 'syz.3.2724': attribute type 21 has an invalid length. [ 363.774517][T16025] netlink: 'syz.5.2729': attribute type 4 has an invalid length. [ 363.816224][T16025] syzkaller1: entered promiscuous mode [ 363.821819][T16025] syzkaller1: entered allmulticast mode [ 364.220156][T16038] netlink: 'syz.4.2734': attribute type 11 has an invalid length. [ 364.372869][T16045] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 365.025695][T16076] netlink: 'syz.3.2745': attribute type 1 has an invalid length. [ 365.052107][T16073] 8021q: VLANs not supported on ip_vti0 [ 365.078441][T16077] __nla_validate_parse: 9 callbacks suppressed [ 365.078458][T16077] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2745'. [ 365.406613][T16086] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 365.456407][T16089] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2749'. [ 366.048984][T16118] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2755'. [ 366.089225][T16120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2756'. [ 366.118362][T16122] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2757'. [ 366.137684][T16124] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2756'. [ 366.264686][T16128] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2759'. [ 366.287880][T16131] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 366.328682][T16128] ip6tnl0: Caught tx_queue_len zero misconfig [ 366.374632][T16138] veth0_to_bond: entered allmulticast mode [ 366.392996][T16135] IPVS: set_ctl: invalid protocol: 60 0.0.0.0:20002 [ 366.747247][T16156] : entered promiscuous mode [ 366.874845][T16164] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2768'. [ 366.920462][T16166] netlink: 'syz.3.2770': attribute type 1 has an invalid length. [ 366.949519][T16166] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2770'. [ 367.257729][T16186] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2773'. [ 368.588823][T16265] tipc: Enabled bearer , priority 0 [ 368.619596][T16265] syzkaller0: entered promiscuous mode [ 368.637804][T16265] syzkaller0: entered allmulticast mode [ 368.684631][T16265] sch_tbf: burst 63 is lower than device syzkaller0 mtu (1514) ! [ 368.784729][T16273] tipc: Enabled bearer , priority 0 [ 368.798653][T16265] tipc: Resetting bearer [ 368.855716][T16266] tipc: Disabling bearer [ 368.879664][T16264] tipc: Resetting bearer [ 368.930851][T16264] tipc: Disabling bearer [ 368.979053][T16282] tipc: Enabled bearer , priority 0 [ 369.000957][T16280] syzkaller0: entered promiscuous mode [ 369.001456][T16292] netlink: 'syz.0.2800': attribute type 10 has an invalid length. [ 369.026378][T16280] syzkaller0: entered allmulticast mode [ 369.067042][T16295] netlink: 'syz.0.2800': attribute type 10 has an invalid length. [ 369.118589][T16280] tipc: Resetting bearer [ 369.161833][T16280] tipc: Disabling bearer [ 370.477546][ T5864] syz_tun (unregistering): left allmulticast mode [ 370.497916][ T5864] syz_tun (unregistering): left promiscuous mode [ 370.529332][ T5864] bridge0: port 3(syz_tun) entered disabled state [ 370.538486][ T5185] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 370.552270][ T5185] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 370.573595][ T5185] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 370.586888][ T5185] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 370.597984][ T5185] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 370.625263][ T5873] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 370.632699][ T5873] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 370.636287][T16362] netlink: 'syz.3.2821': attribute type 27 has an invalid length. [ 370.647812][ T5873] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 370.667819][ T5873] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 370.677559][ T5873] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 370.685263][T16362] netlink: 'syz.3.2821': attribute type 4 has an invalid length. [ 370.693548][T16363] __nla_validate_parse: 6 callbacks suppressed [ 370.693560][T16363] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2824'. [ 370.695610][T16362] netlink: 84 bytes leftover after parsing attributes in process `syz.3.2821'. [ 370.731041][T16363] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2824'. [ 370.770658][T16363] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2824'. [ 370.915148][T16375] tipc: Enabled bearer , priority 0 [ 371.058325][T16375] tipc: Disabling bearer [ 371.077485][T16382] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2829'. [ 371.302084][T16391] netlink: 'syz.3.2832': attribute type 5 has an invalid length. [ 371.502245][T16356] vxcan1 speed is unknown, defaulting to 1000 [ 371.535301][T16401] netlink: 'syz.0.2835': attribute type 8 has an invalid length. [ 371.752119][T16413] macsec0: entered promiscuous mode [ 371.762710][T16413] macsec0: entered allmulticast mode [ 371.785785][T16413] veth1_macvtap: entered allmulticast mode [ 371.819898][T16413] macsec0: left promiscuous mode [ 371.829965][T16413] macsec0: left allmulticast mode [ 371.839959][T16413] veth1_macvtap: left allmulticast mode [ 372.757793][ T5185] Bluetooth: hci2: command tx timeout [ 372.878025][T16433] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2845'. [ 373.155255][T16437] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2845'. [ 373.168647][T16437] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2845'. [ 373.691313][T16434] bridge: RTM_NEWNEIGH with invalid ether address [ 373.944473][T16442] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2847'. [ 374.038841][T16446] bond_slave_0: Caught tx_queue_len zero misconfig [ 374.216429][T16466] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2852'. [ 374.290204][T16468] ip6gre2: entered allmulticast mode [ 374.313992][T16356] chnl_net:caif_netlink_parms(): no params data found [ 374.474290][T16356] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.481605][T16356] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.488923][T16356] bridge_slave_0: entered allmulticast mode [ 374.497867][T16356] bridge_slave_0: entered promiscuous mode [ 374.507641][T16356] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.515165][T16356] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.522474][T16356] bridge_slave_1: entered allmulticast mode [ 374.531376][T16356] bridge_slave_1: entered promiscuous mode [ 374.617606][T16356] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 374.630656][T16356] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 374.729044][T16356] team0: Port device team_slave_0 added [ 374.752817][T16356] team0: Port device team_slave_1 added [ 374.820822][T16481] netlink: 'syz.2.2857': attribute type 83 has an invalid length. [ 374.825186][T16356] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 374.835912][ T5185] Bluetooth: hci2: command tx timeout [ 374.879951][T16356] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 374.944819][T16356] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 374.959181][T16356] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 374.988105][T16356] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 375.069259][T16356] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 375.330687][T16356] hsr_slave_0: entered promiscuous mode [ 375.344889][T16356] hsr_slave_1: entered promiscuous mode [ 375.360813][T16356] debugfs: 'hsr0' already exists in 'hsr' [ 375.367982][T16356] Cannot create hsr debugfs directory [ 375.501740][T16510] ipvlan0: entered promiscuous mode [ 375.878057][T16527] netlink: 'syz.2.2870': attribute type 83 has an invalid length. [ 375.949039][T16526] netlink: 'syz.3.2869': attribute type 9 has an invalid length. [ 376.070058][T16356] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.076937][T16537] __nla_validate_parse: 5 callbacks suppressed [ 376.076954][T16537] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2873'. [ 376.132423][T16537] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2873'. [ 376.152499][T16537] netlink: 'syz.2.2873': attribute type 5 has an invalid length. [ 376.173513][T16537] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2873'. [ 376.337432][T16356] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.512319][T16356] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.608722][T16558] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2877'. [ 376.645719][T16558] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2877'. [ 376.677758][T16558] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2877'. [ 376.736908][T16566] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 376.769185][T16356] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.913778][ T5185] Bluetooth: hci2: command tx timeout [ 377.233537][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 377.296793][T16356] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 377.416605][T16586] netlink: 'syz.0.2886': attribute type 7 has an invalid length. [ 377.452375][T16356] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 377.459247][T16586] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2886'. [ 377.669200][T16356] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 377.724996][T16599] syzkaller0: entered promiscuous mode [ 377.757259][T16599] syzkaller0: entered allmulticast mode [ 377.849703][T16356] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 378.149576][T16626] veth0: entered promiscuous mode [ 378.202844][T16625] veth0: left promiscuous mode [ 378.320935][T16356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 378.396348][T16356] 8021q: adding VLAN 0 to HW filter on device team0 [ 378.425682][T11028] bridge0: port 1(bridge_slave_0) entered blocking state [ 378.432855][T11028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 378.466780][T16643] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2900'. [ 378.485011][T11027] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.492153][T11027] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.904994][T16356] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 378.961948][T16666] netlink: 88 bytes leftover after parsing attributes in process `syz.3.2907'. [ 378.976116][T16666] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2907'. [ 378.994405][ T5185] Bluetooth: hci2: command tx timeout [ 379.743906][T16705] netlink: 'syz.2.2916': attribute type 2 has an invalid length. [ 379.796850][T16356] veth0_vlan: entered promiscuous mode [ 379.856152][T16707] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 379.891814][T16707] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 379.911868][T16707] gretap1: entered promiscuous mode [ 379.917563][T16707] gretap1: entered allmulticast mode [ 379.932317][T16707] netlink: 'syz.5.2918': attribute type 1 has an invalid length. [ 379.936095][T16356] veth1_vlan: entered promiscuous mode [ 379.957853][T16713] syzkaller0: entered promiscuous mode [ 379.963865][T16713] syzkaller0: entered allmulticast mode [ 380.106884][T16356] veth0_macvtap: entered promiscuous mode [ 380.168067][T16356] veth1_macvtap: entered promiscuous mode [ 380.216176][T16356] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.256756][T16356] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.315332][T11027] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.346143][T11027] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.402477][T11027] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.428371][T11027] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.439211][T16735] netlink: 'syz.3.2927': attribute type 10 has an invalid length. [ 380.760165][T11055] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.813545][T11055] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.971496][T16755] nbd: couldn't find a device at index -373156329 [ 381.010482][T11029] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.027820][T11029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.434309][T16783] __nla_validate_parse: 8 callbacks suppressed [ 381.434328][T16783] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2938'. [ 381.486710][T16783] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2938'. [ 381.654554][T16790] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2942'. [ 381.713102][T16792] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 381.969277][T16802] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2946'. [ 382.131520][T16805] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2946'. [ 382.164744][T16808] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2946'. [ 382.326781][ T5873] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 382.335827][ T5873] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 382.343624][ T5873] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 382.352452][ T5873] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 382.360559][ T5873] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 382.373976][T16814] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2950'. [ 382.733819][T16831] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2957'. [ 382.837259][T16838] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2960'. [ 382.905877][T16840] netlink: 'syz.4.2961': attribute type 5 has an invalid length. [ 383.007810][T16845] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2963'. [ 383.073206][T16812] vxcan1 speed is unknown, defaulting to 1000 [ 383.505421][T16859] netlink: 'syz.0.2967': attribute type 23 has an invalid length. [ 383.797372][T16853] vxcan1 speed is unknown, defaulting to 1000 [ 384.315560][T16812] chnl_net:caif_netlink_parms(): no params data found [ 384.433679][ T5185] Bluetooth: hci5: command tx timeout [ 384.885389][T16900] netlink: 'syz.5.2978': attribute type 1 has an invalid length. [ 384.897774][T16900] nbd: error processing sock list [ 384.907319][T16900] block nbd3: shutting down sockets [ 384.951428][T16902] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 385.132184][T16902] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 385.377923][T16812] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.433729][T16812] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.464162][T16812] bridge_slave_0: entered allmulticast mode [ 385.484407][T16812] bridge_slave_0: entered promiscuous mode [ 385.502562][T16812] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.535426][T16812] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.556469][T16812] bridge_slave_1: entered allmulticast mode [ 385.583311][T16812] bridge_slave_1: entered promiscuous mode [ 385.783213][T16812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 385.799400][T16812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 385.964907][T16928] tipc: Enabled bearer , priority 0 [ 385.978024][T16929] tipc: Enabling of bearer rejected, already enabled [ 386.013959][T16812] team0: Port device team_slave_0 added [ 386.034055][T16812] team0: Port device team_slave_1 added [ 386.035595][T16938] nbd: illegal input index -8454144 [ 386.053189][T16940] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 386.070122][T16929] tipc: Disabling bearer [ 386.226729][T16812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 386.263980][T16812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 386.357376][T16961] netlink: 'syz.0.2993': attribute type 6 has an invalid length. [ 386.383862][T16812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 386.502902][T16812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 386.510914][T16812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 386.552922][ T5185] Bluetooth: hci5: command tx timeout [ 386.554601][T16812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 386.837061][T16812] hsr_slave_0: entered promiscuous mode [ 386.855368][T16812] hsr_slave_1: entered promiscuous mode [ 386.864559][T16812] debugfs: 'hsr0' already exists in 'hsr' [ 386.870300][T16812] Cannot create hsr debugfs directory [ 386.987824][T16994] __nla_validate_parse: 4 callbacks suppressed [ 386.987842][T16994] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3003'. [ 387.072427][T16997] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3004'. [ 387.227558][T17000] netlink: 'syz.0.3008': attribute type 1 has an invalid length. [ 387.254706][T16997] netlink: 220 bytes leftover after parsing attributes in process `syz.4.3004'. [ 387.258751][T17000] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3008'. [ 387.313176][T17008] netlink: zone id is out of range [ 387.337466][T17008] netlink: zone id is out of range [ 387.342753][T17008] netlink: zone id is out of range [ 387.348978][T17008] netlink: zone id is out of range [ 387.354518][T17008] netlink: zone id is out of range [ 387.359732][T17008] netlink: zone id is out of range [ 387.370214][T17008] netlink: zone id is out of range [ 387.384993][T17008] netlink: zone id is out of range [ 387.424545][T17008] netlink: zone id is out of range [ 387.474064][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 387.575205][T16812] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 387.595897][T17017] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3011'. [ 387.605189][T16812] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 387.662134][T17018] netlink: 9 bytes leftover after parsing attributes in process `syz.5.3010'. [ 387.702107][T17018] gretap0: entered promiscuous mode [ 387.723939][T17024] netlink: 5 bytes leftover after parsing attributes in process `syz.5.3010'. [ 387.801707][T16812] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 387.839229][T16812] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 387.916974][T17024] 0ªî{X¹¦: renamed from gretap0 [ 387.947906][T17038] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3011'. [ 387.977367][T17024] 0ªî{X¹¦: left promiscuous mode [ 388.012871][T17024] 0ªî{X¹¦: entered allmulticast mode [ 388.065232][T17044] netlink: 277 bytes leftover after parsing attributes in process `syz.0.3015'. [ 388.115414][T16812] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 388.143680][T16812] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 388.181923][T17047] gtp0: entered promiscuous mode [ 388.201576][T17047] gtp0: entered allmulticast mode [ 388.296560][T16812] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 388.330691][T16812] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 388.595575][ T5185] Bluetooth: hci5: command tx timeout [ 388.631881][T17068] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3022'. [ 388.678283][T16812] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 388.699275][T16812] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 388.831748][T16812] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 388.910538][T16812] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 389.292962][T16812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 389.353329][T16812] 8021q: adding VLAN 0 to HW filter on device team0 [ 389.384835][T11026] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.392039][T11026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.421950][T11055] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.429186][T11055] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.994496][T17126] syzkaller1: entered promiscuous mode [ 390.017678][T17126] syzkaller1: entered allmulticast mode [ 390.281873][T16812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 390.498932][T16812] veth0_vlan: entered promiscuous mode [ 390.499444][T17153] IPv6: NLM_F_REPLACE set, but no existing node found! [ 390.546781][T16812] veth1_vlan: entered promiscuous mode [ 390.566652][T17153] netlink: 'syz.5.3044': attribute type 4 has an invalid length. [ 390.603765][T17153] netlink: 'syz.5.3044': attribute type 7 has an invalid length. [ 390.625597][T17153] netlink: 'syz.5.3044': attribute type 8 has an invalid length. [ 390.690016][T16812] veth0_macvtap: entered promiscuous mode [ 390.693491][ T5185] Bluetooth: hci5: command tx timeout [ 390.789300][T16812] veth1_macvtap: entered promiscuous mode [ 390.918622][T16812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 391.002028][T16812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 391.028611][T11029] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.097148][T11029] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.127083][T11029] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.197076][T17181] netlink: 'syz.3.3052': attribute type 4 has an invalid length. [ 391.206340][T11029] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.303188][T17188] tipc: Enabled bearer , priority 0 [ 391.335348][T17188] syzkaller0: entered promiscuous mode [ 391.340852][T17188] syzkaller0: entered allmulticast mode [ 391.343867][T17193] netlink: 'syz.3.3055': attribute type 1 has an invalid length. [ 391.389905][T17188] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 391.524985][T17188] tipc: Resetting bearer [ 391.570084][T17187] tipc: Resetting bearer [ 391.668121][T17187] tipc: Disabling bearer [ 391.741809][T17204] IPv6: sit2: Disabled Multicast RS [ 391.768503][T17204] sit2: entered allmulticast mode [ 391.808801][T17206] netlink: 'syz.3.3060': attribute type 5 has an invalid length. [ 391.857923][T11047] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.886689][T11047] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.056119][T11049] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.085504][T11049] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.311523][T17231] __nla_validate_parse: 10 callbacks suppressed [ 392.311544][T17231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2940'. [ 392.384393][T17231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2940'. [ 392.384529][T17235] net_ratelimit: 7 callbacks suppressed [ 392.384542][T17235] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 392.640661][T17245] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3073'. [ 392.840020][T17247] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3074'. [ 392.907624][T17247] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3074'. [ 392.907866][T17253] batadv3: left allmulticast mode [ 392.944696][T17253] batadv3: left promiscuous mode [ 392.959893][T17253] bridge0: port 3(batadv3) entered disabled state [ 393.060834][T17253] batadv2: left allmulticast mode [ 393.066663][T17253] batadv2: left promiscuous mode [ 393.075386][T17253] bridge0: port 2(batadv2) entered disabled state [ 393.127897][T17253] batadv1: left allmulticast mode [ 393.132962][T17253] batadv1: left promiscuous mode [ 393.138722][T17253] bridge0: port 1(batadv1) entered disabled state [ 393.237144][T17260] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3078'. [ 393.284704][T17260] bond0: entered promiscuous mode [ 393.289930][T17260] bond_slave_0: entered promiscuous mode [ 393.311443][ T5873] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 393.314857][T17260] bond_slave_1: entered promiscuous mode [ 393.326355][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 393.335298][ T5873] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 393.344328][T17260] bond0: left promiscuous mode [ 393.350623][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 393.350895][T17260] bond_slave_0: left promiscuous mode [ 393.375008][ T5873] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 393.404547][T17260] bond_slave_1: left promiscuous mode [ 393.656026][T17272] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 393.727911][ T5185] block nbd3: Receive control failed (result -32) [ 394.209550][T17295] sctp: [Deprecated]: syz.4.3089 (pid 17295) Use of int in maxseg socket option. [ 394.209550][T17295] Use struct sctp_assoc_value instead [ 394.308407][T17261] vxcan1 speed is unknown, defaulting to 1000 [ 394.604661][T17305] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3093'. [ 394.664947][T17304] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3093'. [ 394.675049][T17307] veth1_to_hsr: entered allmulticast mode [ 394.736837][T17310] netlink: 'syz.2.3094': attribute type 32 has an invalid length. [ 394.817919][T17314] netlink: 'syz.2.3094': attribute type 1 has an invalid length. [ 394.840033][T17314] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3094'. [ 394.987591][T17291] vxcan1 speed is unknown, defaulting to 1000 [ 395.403601][ T5185] Bluetooth: hci1: command tx timeout [ 395.452009][T17261] chnl_net:caif_netlink_parms(): no params data found [ 395.679817][T17335] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3098'. [ 396.039075][T17345] syz.2.3102 uses old SIOCAX25GETINFO [ 396.104989][T17261] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.112142][T17261] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.121366][T17261] bridge_slave_0: entered allmulticast mode [ 396.129650][T17261] bridge_slave_0: entered promiscuous mode [ 396.175948][T17261] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.183158][T17261] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.191653][T17261] bridge_slave_1: entered allmulticast mode [ 396.200260][T17261] bridge_slave_1: entered promiscuous mode [ 396.353883][T17261] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.410741][T17261] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 396.626013][T17261] team0: Port device team_slave_0 added [ 396.658912][T17261] team0: Port device team_slave_1 added [ 396.905875][T17261] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 396.923083][T17261] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 396.956209][T17376] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 396.978456][T17376] netlink: 'syz.4.3109': attribute type 1 has an invalid length. [ 396.986724][T17261] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.005123][T17261] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.022233][T17261] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 397.051315][T17261] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.226485][T17261] hsr_slave_0: entered promiscuous mode [ 397.246856][T17261] hsr_slave_1: entered promiscuous mode [ 397.253193][T17261] debugfs: 'hsr0' already exists in 'hsr' [ 397.262440][T17261] Cannot create hsr debugfs directory [ 397.382273][ T7894] IPVS: starting estimator thread 0... [ 397.473502][ T5185] Bluetooth: hci1: command tx timeout [ 397.494303][T17387] IPVS: using max 27 ests per chain, 64800 per kthread [ 397.550227][T17392] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 397.577937][T17392] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 397.702900][T17392] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.882724][T17392] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.960854][T17261] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.982423][T17261] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 398.003796][T17261] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 398.030865][T17261] netdevsim netdevsim3 eth3 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 398.138193][T17392] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.204453][T17261] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 398.226861][T17261] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 398.252877][T17261] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 398.275810][T17261] netdevsim netdevsim3 eth2 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 398.346089][T17392] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.394482][T17427] netlink: 'syz.0.3122': attribute type 39 has an invalid length. [ 398.415343][T17424] syz_tun: entered allmulticast mode [ 398.425344][T17261] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 398.435832][T17261] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 398.448156][T17261] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 398.459513][T17261] netdevsim netdevsim3 eth1 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 398.566169][T17261] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 398.607566][T17261] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 398.631632][T17261] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 398.645412][T17261] netdevsim netdevsim3 eth0 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 398.675680][ T30] audit: type=1107 audit(1759211816.544:4): pid=17433 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='‰,w(ÊbOÚ¢, !Ö\(íשn|ÍYxEÊÅœ¿Å)ùÓpþº´öê$x‚ÓÚèT¿½otÔ‰%ÆÑ$hÌôƒ›˜ÍÚiæ€ãŒ÷¿eâ:íÏGçaa6RÐ=SÂÞ_À˜8£~ûÇì>6MÑë¶;úúÖ^5í×¥SB"ügóÕe^ŽSKE¼Jý ªÌIg,wdš€æ_«F,̧n†öEÞ®:Ê9ŽÕWjXé»6*xo)”ƒ¨"¦ém’Œ(—Nž¯f{µÜÒ‡–Òn¥ºe=²kìDÞÍ)Úéç–' [ 398.852627][T11049] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 398.939249][T11047] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.035129][T11055] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.076422][T11028] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.176627][T17424] vxcan1 speed is unknown, defaulting to 1000 [ 399.198822][T17419] syz_tun: left allmulticast mode [ 399.275485][T17261] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 399.310368][T17455] __nla_validate_parse: 46 callbacks suppressed [ 399.310387][T17455] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3130'. [ 399.324500][T17261] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 399.379712][T17261] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 399.415925][T17261] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 399.554391][ T5185] Bluetooth: hci1: command tx timeout [ 399.831003][T17261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 400.096267][T17261] 8021q: adding VLAN 0 to HW filter on device team0 [ 400.171411][T17485] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 400.202247][T11047] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.209428][T11047] bridge0: port 1(bridge_slave_0) entered forwarding state [ 400.235748][T11047] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.242927][T11047] bridge0: port 2(bridge_slave_1) entered forwarding state [ 400.386078][T17261] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 400.702244][T17498] siw: device registration error -23 [ 400.821203][T17502] netlink: 'syz.5.3143': attribute type 1 has an invalid length. [ 400.871603][T17506] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3142'. [ 401.005113][T17261] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 401.055575][T17261] veth0_vlan: entered promiscuous mode [ 401.069782][T17261] veth1_vlan: entered promiscuous mode [ 401.126981][T17512] sch_fq: defrate 53322 ignored. [ 401.198175][T17510] netlink: 'syz.0.3144': attribute type 4 has an invalid length. [ 401.217063][T17513] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3144'. [ 401.248792][T17515] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3146'. [ 401.258252][T17515] openvswitch: netlink: nsh attribute has 13 unknown bytes. [ 401.268141][T17515] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 401.329097][T17261] veth0_macvtap: entered promiscuous mode [ 401.357516][T17261] veth1_macvtap: entered promiscuous mode [ 401.456841][T17261] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.546761][T17528] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 401.575919][T17261] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.613058][T11027] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.634982][T17532] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3150'. [ 401.649026][ T5185] Bluetooth: hci1: command tx timeout [ 401.658935][T11027] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.669977][T17532] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3150'. [ 401.692140][T11027] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.715727][T17532] netlink: 'syz.2.3150': attribute type 5 has an invalid length. [ 401.733526][T11027] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.050839][T11055] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.102180][T11055] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.252161][T11055] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.291765][T11055] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.403311][T17522] vxcan1 speed is unknown, defaulting to 1000 [ 402.425050][T17556] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 402.473332][T17556] veth1_to_hsr: left allmulticast mode [ 403.306249][T17582] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3167'. [ 403.344390][T17583] netlink: 'syz.3.3167': attribute type 75 has an invalid length. [ 403.394159][T17582] netdevsim netdevsim3 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 403.491873][T17585] netlink: ct family unspecified [ 403.517360][T17585] openvswitch: netlink: Actions may not be safe on all matching packets [ 403.706899][ T5873] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 403.714742][ T5869] Bluetooth: hci1: command tx timeout [ 403.717958][T17591] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3169'. [ 403.731040][ T5873] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 403.739244][ T5873] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 403.749417][ T5873] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 403.760046][ T5873] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 403.774276][T17589] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 404.472224][T17602] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3172'. [ 404.742521][T17611] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3175'. [ 404.781766][T17611] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 404.807682][T17611] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3175'. [ 404.819096][T17612] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3175'. [ 405.087717][T17622] syzkaller0: entered promiscuous mode [ 405.133557][T17622] syzkaller0: entered allmulticast mode [ 405.229842][T17627] netlink: 'syz.5.3181': attribute type 1 has an invalid length. [ 405.247107][T17625] pim6reg1: entered promiscuous mode [ 405.252524][T17625] pim6reg1: entered allmulticast mode [ 405.285814][T17627] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 405.308601][T17632] netlink: 240 bytes leftover after parsing attributes in process `syz.5.3181'. [ 405.317466][ T5873] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 405.328245][ T5873] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 405.338742][ T5873] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 405.347875][ T5873] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 405.349940][T17630] dvmrp0: entered allmulticast mode [ 405.364993][ T5873] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 406.040794][T17631] vxcan1 speed is unknown, defaulting to 1000 [ 406.257472][T17662] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.266227][T17662] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.279691][T17664] IPv6: NLM_F_CREATE should be specified when creating new route [ 407.103698][T17688] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3204'. [ 407.135584][T17690] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3205'. [ 407.162483][T17690] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 407.196020][T17690] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 407.299880][T17631] chnl_net:caif_netlink_parms(): no params data found [ 407.395130][ T5185] Bluetooth: hci3: command tx timeout [ 407.967664][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 408.257226][T17631] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.274521][T17631] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.303784][T17631] bridge_slave_0: entered allmulticast mode [ 408.326335][T17631] bridge_slave_0: entered promiscuous mode [ 408.350176][T17631] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.363803][T17631] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.381617][T17631] bridge_slave_1: entered allmulticast mode [ 408.401468][T17631] bridge_slave_1: entered promiscuous mode [ 408.571192][T17631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 408.599635][T17631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 408.716988][T17631] team0: Port device team_slave_0 added [ 408.739352][T17631] team0: Port device team_slave_1 added [ 408.831109][T17631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 408.862538][T17631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 408.910849][T17631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 408.928818][T17631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 408.935956][T17631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 409.079735][T17631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 409.296229][T17631] hsr_slave_0: entered promiscuous mode [ 409.317049][T17631] hsr_slave_1: entered promiscuous mode [ 409.334559][T17631] debugfs: 'hsr0' already exists in 'hsr' [ 409.340305][T17631] Cannot create hsr debugfs directory [ 409.474275][ T5185] Bluetooth: hci3: command tx timeout [ 410.292154][T17631] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.486895][T17631] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.625508][T17631] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.850382][T17631] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 411.232736][T17631] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 411.276226][T17631] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 411.305181][T17631] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 411.330646][T17631] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 411.554384][ T5185] Bluetooth: hci3: command tx timeout [ 411.649694][T17631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 411.723990][T17631] 8021q: adding VLAN 0 to HW filter on device team0 [ 411.771423][T11055] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.778629][T11055] bridge0: port 1(bridge_slave_0) entered forwarding state [ 411.835069][T11055] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.842294][T11055] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.286369][T17839] netlink: 'syz.4.3264': attribute type 1 has an invalid length. [ 412.298526][T17839] netlink: 236 bytes leftover after parsing attributes in process `syz.4.3264'. [ 412.488728][T17631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 412.634584][T17631] veth0_vlan: entered promiscuous mode [ 412.685870][T17631] veth1_vlan: entered promiscuous mode [ 412.782175][T17631] veth0_macvtap: entered promiscuous mode [ 412.845405][T17631] veth1_macvtap: entered promiscuous mode [ 412.868394][T17631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 412.885730][T17631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 412.958780][T11029] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.990007][T11029] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.081092][T11029] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.110562][T11029] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.415558][T11049] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.435198][T11049] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.497860][T11028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.506579][T11028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.590984][T17894] netlink: 'syz.5.3279': attribute type 10 has an invalid length. [ 413.635310][ T5185] Bluetooth: hci3: command tx timeout [ 413.657640][ T7894] IPVS: starting estimator thread 0... [ 413.740334][T17901] vxcan1: tx address claim with dlc 0 [ 413.763802][T17899] IPVS: using max 24 ests per chain, 57600 per kthread [ 413.775457][T17901] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3159'. [ 413.999054][T17912] netlink: 27 bytes leftover after parsing attributes in process `syz.0.3288'. [ 414.157438][T17918] sctp: [Deprecated]: syz.4.3289 (pid 17918) Use of struct sctp_assoc_value in delayed_ack socket option. [ 414.157438][T17918] Use struct sctp_sack_info instead [ 414.702841][T17936] tipc: Started in network mode [ 414.723908][T17936] tipc: Node identity aa3373c107, cluster identity 4711 [ 414.744286][T17936] tipc: Enabled bearer , priority 0 [ 414.767479][T17939] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3296'. [ 414.771603][T17936] syzkaller0: entered promiscuous mode [ 414.783023][T17936] syzkaller0: entered allmulticast mode [ 414.784552][ T5873] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 414.801268][ T5873] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 414.817787][ T5873] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 414.837575][ T5873] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 414.847388][ T5873] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 415.244781][T17947] tipc: Resetting bearer [ 415.279910][T17935] tipc: Resetting bearer [ 415.321645][T17935] tipc: Disabling bearer [ 415.603510][T17977] sch_fq: defrate 53322 ignored. [ 415.862651][T17986] syzkaller1: entered promiscuous mode [ 415.906216][T17986] syzkaller1: entered allmulticast mode [ 416.056261][T17941] vxcan1 speed is unknown, defaulting to 1000 [ 416.690892][T18029] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3321'. [ 416.921302][ T5185] Bluetooth: hci0: command tx timeout [ 417.072781][T18051] sctp: [Deprecated]: syz.2.3327 (pid 18051) Use of struct sctp_assoc_value in delayed_ack socket option. [ 417.072781][T18051] Use struct sctp_sack_info instead [ 417.120915][T17941] chnl_net:caif_netlink_parms(): no params data found [ 417.454039][T17941] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.464762][T17941] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.472019][T17941] bridge_slave_0: entered allmulticast mode [ 417.480973][T17941] bridge_slave_0: entered promiscuous mode [ 417.489085][T18062] syzkaller1: entered promiscuous mode [ 417.498052][T18062] syzkaller1: entered allmulticast mode [ 417.512732][T17941] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.521898][T17941] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.529793][T18062] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.3329'. [ 417.541142][T17941] bridge_slave_1: entered allmulticast mode [ 417.551862][T17941] bridge_slave_1: entered promiscuous mode [ 417.859903][T17941] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 417.872514][T18079] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3336'. [ 417.885988][T17941] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 417.983000][T17941] team0: Port device team_slave_0 added [ 417.992776][T18087] ªªªªªª: renamed from vlan0 (while UP) [ 418.029506][T17941] team0: Port device team_slave_1 added [ 418.176568][T18093] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3340'. [ 418.211674][T18093] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.219417][T18093] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.245438][T17941] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 418.252531][T17941] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 418.280784][T17941] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 418.331043][T17941] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 418.349886][T17941] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 418.449662][T17941] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 418.669897][T17941] hsr_slave_0: entered promiscuous mode [ 418.682061][T17941] hsr_slave_1: entered promiscuous mode [ 418.698878][T17941] debugfs: 'hsr0' already exists in 'hsr' [ 418.713707][T17941] Cannot create hsr debugfs directory [ 418.777613][T18096] vxcan1 speed is unknown, defaulting to 1000 [ 418.994028][ T5185] Bluetooth: hci0: command tx timeout [ 419.072707][T18119] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 419.126939][T18119] xt_l2tp: unknown flags: 10 [ 419.526523][T18136] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3357'. [ 419.579760][T18139] netlink: 'syz.3.3357': attribute type 2 has an invalid length. [ 419.588037][T18139] netlink: 'syz.3.3357': attribute type 8 has an invalid length. [ 419.606596][T18139] netlink: 1148 bytes leftover after parsing attributes in process `syz.3.3357'. [ 420.102487][T18162] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3364'. [ 420.107565][T18163] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3364'. [ 420.261045][T17941] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 420.326718][T17941] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 420.372791][T17941] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 420.487899][T17941] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 420.748935][T18184] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3368'. [ 420.777433][T18184] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3368'. [ 420.858051][T17941] 8021q: adding VLAN 0 to HW filter on device bond0 [ 420.892258][T17941] 8021q: adding VLAN 0 to HW filter on device team0 [ 420.941306][T11049] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.948493][T11049] bridge0: port 1(bridge_slave_0) entered forwarding state [ 421.026777][T11027] bridge0: port 2(bridge_slave_1) entered blocking state [ 421.033953][T11027] bridge0: port 2(bridge_slave_1) entered forwarding state [ 421.085155][ T5185] Bluetooth: hci0: command tx timeout [ 421.217235][T18206] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3372'. [ 421.253227][T17941] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 421.561874][T18223] xt_limit: Overflow, try lower: 271964/0 [ 421.751754][T18203] vxcan1 speed is unknown, defaulting to 1000 [ 422.031067][T17941] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 422.522462][T18209] vxcan1 speed is unknown, defaulting to 1000 [ 422.762124][T17941] veth0_vlan: entered promiscuous mode [ 422.792118][T17941] veth1_vlan: entered promiscuous mode [ 422.906709][T17941] veth0_macvtap: entered promiscuous mode [ 422.933183][T17941] veth1_macvtap: entered promiscuous mode [ 423.102171][T17941] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 423.154618][ T5185] Bluetooth: hci0: command tx timeout [ 423.172115][T17941] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 423.616029][T11047] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.641087][T11049] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.657340][T18260] __nla_validate_parse: 2 callbacks suppressed [ 423.657358][T18260] netlink: 212316 bytes leftover after parsing attributes in process `syz.4.3386'. [ 423.674118][T11049] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.696900][T11049] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.715883][T18260] netlink: 165 bytes leftover after parsing attributes in process `syz.4.3386'. [ 424.089584][T11047] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.112405][T11047] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.252824][T11028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 424.301288][T11028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 424.443227][T18276] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3392'. [ 424.603880][T18284] netlink: 'syz.3.3394': attribute type 2 has an invalid length. [ 425.019413][T18302] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3401'. [ 425.063985][T18302] 8021q: VLANs not supported on ip_vti0 [ 425.206514][T18315] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3405'. [ 425.304811][T18315] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3405'. [ 425.419773][T18322] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3408'. [ 425.963990][T18349] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 426.263526][T18365] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3422'. [ 426.284556][T18365] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3422'. [ 426.295697][T18369] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3425'. [ 426.345234][T18369] netlink: 'syz.4.3425': attribute type 1 has an invalid length. [ 426.467311][T18378] netlink: 'syz.3.3422': attribute type 2 has an invalid length. [ 427.679130][T18416] IPVS: set_ctl: invalid protocol: 1 10.1.1.1:20004 [ 427.761479][T18418] sock: sock_set_timeout: `syz.5.3442' (pid 18418) tries to set negative timeout [ 427.852128][T18423] netlink: 'syz.2.3441': attribute type 1 has an invalid length. [ 427.941186][T18429] netlink: 'syz.0.3445': attribute type 13 has an invalid length. [ 428.078369][T18423] 8021q: adding VLAN 0 to HW filter on device bond1 [ 428.236146][T18429] veth0_macvtap: left promiscuous mode [ 428.284534][T18429] macvtap0: entered allmulticast mode [ 428.301544][T18429] macvtap0: refused to change device tx_queue_len [ 428.357342][T18442] syzkaller0: entered promiscuous mode [ 428.363014][T18442] syzkaller0: entered allmulticast mode [ 428.857839][T18473] __nla_validate_parse: 6 callbacks suppressed [ 428.857858][T18473] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3456'. [ 428.926909][T18475] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.029837][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807994b000: rx timeout, send abort [ 429.525648][T18510] netlink: 'syz.4.3467': attribute type 4 has an invalid length. [ 429.529956][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807994b400: rx timeout, send abort [ 429.541636][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807994b000: abort rx timeout. Force session deactivation [ 429.574550][T18510] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3467'. [ 429.875636][T18525] netlink: 'syz.5.3473': attribute type 1 has an invalid length. [ 429.904647][T18527] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3474'. [ 430.024540][T18533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3475'. [ 430.041605][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807994b400: abort rx timeout. Force session deactivation [ 430.062989][T18533] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3475'. [ 430.102761][T18540] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3479'. [ 430.407727][T18557] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3483'. [ 430.453551][T18556] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3483'. [ 430.484988][T18559] ip6gre1: entered allmulticast mode [ 430.673887][T18568] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3488'. [ 430.836897][T18571] Bluetooth: MGMT ver 1.23 [ 431.177430][T18584] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3492'. [ 431.293041][T18586] netlink: 'syz.5.3493': attribute type 1 has an invalid length. [ 431.950405][T18600] tipc: Started in network mode [ 431.958815][T18600] tipc: Node identity ac14142f, cluster identity 4711 [ 431.966562][T18600] tipc: New replicast peer: 0.0.0.0 [ 431.972411][T18600] tipc: Enabled bearer , priority 10 [ 432.169824][T18628] tipc: Invalid UDP bearer configuration [ 432.169880][T18628] tipc: Enabling of bearer rejected, failed to enable media [ 432.397971][T18640] 8021q: adding VLAN 0 to HW filter on device bond1 [ 432.593241][T18643] 8021q: adding VLAN 0 to HW filter on device bond1 [ 432.601814][T18643] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 432.616941][T18643] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 432.686988][T18652] vlan3: entered allmulticast mode [ 432.692332][T18652] hsr0: entered allmulticast mode [ 432.705778][T18652] hsr_slave_0: entered allmulticast mode [ 432.722627][T18652] hsr_slave_1: entered allmulticast mode [ 432.914847][ T5873] Bluetooth: hci2: command 0x0401 tx timeout [ 432.921046][ T5185] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 433.085314][ T5917] tipc: Node number set to 2886997039 [ 433.306987][T18686] vlan3: entered promiscuous mode [ 433.325302][T18686] bridge0: entered promiscuous mode [ 433.978721][T18726] __nla_validate_parse: 5 callbacks suppressed [ 433.978740][T18726] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3537'. [ 434.204851][T18733] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3539'. [ 434.487593][T18751] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3543'. [ 434.526383][T18750] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3544'. [ 434.573009][T18756] netlink: 'syz.0.3546': attribute type 27 has an invalid length. [ 434.583240][T18756] netlink: 'syz.0.3546': attribute type 4 has an invalid length. [ 434.592366][T18756] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3546'. [ 434.651541][T18756] netlink: 18 bytes leftover after parsing attributes in process `syz.0.3546'. [ 434.981417][T18780] netlink: 'syz.4.3552': attribute type 1 has an invalid length. [ 435.088116][T18780] bond2: entered promiscuous mode [ 435.117152][T18780] 8021q: adding VLAN 0 to HW filter on device bond2 [ 435.208204][T18789] bond2: (slave bridge3): making interface the new active one [ 435.225230][T18789] bridge3: entered promiscuous mode [ 435.236771][T18789] bond2: (slave bridge3): Enslaving as an active interface with an up link [ 435.405451][T18803] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3559'. [ 435.655628][T18808] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3561'. [ 435.975909][T18791] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 436.071219][T18827] netlink: 'syz.4.3569': attribute type 2 has an invalid length. [ 436.237847][T18837] netlink: 'syz.3.3571': attribute type 1 has an invalid length. [ 436.278853][T18837] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3571'. [ 436.411875][T18848] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.3575'. [ 436.748216][T18861] openvswitch: netlink: Flow key attr not present in new flow. [ 436.937884][T18870] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 437.159679][T18885] nbd: must specify an index to disconnect [ 437.538289][T18908] netlink: 'syz.3.3596': attribute type 1 has an invalid length. [ 437.576306][T18908] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 437.994206][T18928] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 438.410140][T18952] bond0: (slave rose0): Error: Device can not be enslaved while up [ 438.908334][T18981] netlink: 'syz.0.3627': attribute type 3 has an invalid length. [ 438.931843][T18981] netlink: 'syz.0.3627': attribute type 3 has an invalid length. [ 438.945736][T18981] netlink: 'syz.0.3627': attribute type 3 has an invalid length. [ 438.956473][T18981] netlink: 'syz.0.3627': attribute type 3 has an invalid length. [ 438.971269][T18981] netlink: 'syz.0.3627': attribute type 3 has an invalid length. [ 438.980914][T18981] netlink: 'syz.0.3627': attribute type 3 has an invalid length. [ 439.379637][T19008] xt_bpf: check failed: parse error [ 439.755837][T19008] __nla_validate_parse: 7 callbacks suppressed [ 439.755856][T19008] netlink: 1036 bytes leftover after parsing attributes in process `syz.2.3634'. [ 439.772009][T19008] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 439.785175][T19012] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3636'. [ 440.005403][T19038] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge_slave_0 [ 440.096470][T19039] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3642'. [ 440.106548][T19039] validate_nla: 28 callbacks suppressed [ 440.106563][T19039] netlink: 'syz.2.3642': attribute type 7 has an invalid length. [ 440.127466][T19039] netlink: 'syz.2.3642': attribute type 8 has an invalid length. [ 440.148920][T19039] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3642'. [ 440.580437][T19066] netlink: 'syz.3.3653': attribute type 1 has an invalid length. [ 440.616635][T19063] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3648'. [ 440.915050][T19077] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3656'. [ 440.960253][T19082] netlink: 'syz.2.3658': attribute type 11 has an invalid length. [ 441.372038][T19099] dvmrp0: entered allmulticast mode [ 441.407604][T19099] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3663'. [ 441.440045][T19103] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3664'. [ 441.453550][T19099] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3663'. [ 441.496355][T19055] vxcan1 speed is unknown, defaulting to 1000 [ 441.758849][T19115] delete_channel: no stack [ 441.857330][T19118] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3668'. [ 442.462110][T19061] vxcan1 speed is unknown, defaulting to 1000 [ 442.499088][T19137] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 442.523580][T19134] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 442.584802][T19137] IPVS: set_ctl: invalid protocol: 135 10.1.1.0:20001 [ 442.632386][T19138] IPVS: set_ctl: invalid protocol: 135 10.1.1.0:20001 [ 444.219516][T19194] netlink: 'syz.4.3694': attribute type 2 has an invalid length. [ 444.275991][T19189] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 444.305502][T19196] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 444.434980][T19203] : renamed from bridge_slave_0 (while UP) [ 445.260090][T19232] syzkaller1: entered allmulticast mode [ 445.566944][T19244] netlink: 'syz.3.3709': attribute type 10 has an invalid length. [ 445.600933][T19244] team0: Port device dummy0 added [ 445.721396][T19250] __nla_validate_parse: 2 callbacks suppressed [ 445.721414][T19250] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3709'. [ 445.995873][T19260] netlink: 'syz.0.3713': attribute type 4 has an invalid length. [ 446.210152][T19267] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3716'. [ 446.329282][T19267] team0: Port device dummy0 removed [ 446.686231][T19291] FAULT_INJECTION: forcing a failure. [ 446.686231][T19291] name failslab, interval 1, probability 0, space 0, times 0 [ 446.775562][T19291] CPU: 0 UID: 0 PID: 19291 Comm: syz.2.3726 Not tainted syzkaller #0 PREEMPT(full) [ 446.775589][T19291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 446.775608][T19291] Call Trace: [ 446.775616][T19291] [ 446.775625][T19291] dump_stack_lvl+0x189/0x250 [ 446.775653][T19291] ? __pfx____ratelimit+0x10/0x10 [ 446.775675][T19291] ? __pfx_dump_stack_lvl+0x10/0x10 [ 446.775699][T19291] ? __pfx__printk+0x10/0x10 [ 446.775730][T19291] ? __pfx___might_resched+0x10/0x10 [ 446.775750][T19291] ? fs_reclaim_acquire+0x7d/0x100 [ 446.775774][T19291] should_fail_ex+0x414/0x560 [ 446.775809][T19291] should_failslab+0xa8/0x100 [ 446.775840][T19291] __kmalloc_noprof+0xcb/0x4f0 [ 446.775866][T19291] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 446.775900][T19291] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 446.775934][T19291] genl_family_rcv_msg_doit+0xb8/0x300 [ 446.775965][T19291] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 446.776002][T19291] ? apparmor_capable+0x137/0x1b0 [ 446.776029][T19291] ? bpf_lsm_capable+0x9/0x20 [ 446.776053][T19291] ? security_capable+0x7e/0x2e0 [ 446.776088][T19291] genl_rcv_msg+0x60e/0x790 [ 446.776120][T19291] ? __pfx_genl_rcv_msg+0x10/0x10 [ 446.776144][T19291] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 446.776168][T19291] ? __pfx_nl80211_new_key+0x10/0x10 [ 446.776194][T19291] ? __pfx_nl80211_post_doit+0x10/0x10 [ 446.776222][T19291] ? __asan_memcpy+0x40/0x70 [ 446.776244][T19291] ? __pfx_ref_tracker_free+0x10/0x10 [ 446.776272][T19291] netlink_rcv_skb+0x208/0x470 [ 446.776297][T19291] ? __lock_acquire+0xab9/0xd20 [ 446.776325][T19291] ? __pfx_genl_rcv_msg+0x10/0x10 [ 446.776354][T19291] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 446.776393][T19291] ? down_read+0x1ad/0x2e0 [ 446.776418][T19291] genl_rcv+0x28/0x40 [ 446.776440][T19291] netlink_unicast+0x82f/0x9e0 [ 446.776481][T19291] ? __pfx_netlink_unicast+0x10/0x10 [ 446.776511][T19291] ? netlink_sendmsg+0x642/0xb30 [ 446.776529][T19291] ? skb_put+0x11b/0x210 [ 446.776553][T19291] netlink_sendmsg+0x805/0xb30 [ 446.776585][T19291] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.776610][T19291] ? aa_sock_msg_perm+0xf1/0x1d0 [ 446.776632][T19291] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 446.776653][T19291] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.776676][T19291] __sock_sendmsg+0x219/0x270 [ 446.776708][T19291] ____sys_sendmsg+0x505/0x830 [ 446.776739][T19291] ? __pfx_____sys_sendmsg+0x10/0x10 [ 446.776775][T19291] ? import_iovec+0x74/0xa0 [ 446.776805][T19291] ___sys_sendmsg+0x21f/0x2a0 [ 446.776832][T19291] ? __pfx____sys_sendmsg+0x10/0x10 [ 446.776895][T19291] ? __fget_files+0x2a/0x420 [ 446.776912][T19291] ? __fget_files+0x3a0/0x420 [ 446.776942][T19291] __x64_sys_sendmsg+0x19b/0x260 [ 446.776969][T19291] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 446.777008][T19291] ? rcu_is_watching+0x15/0xb0 [ 446.777029][T19291] ? trace_sys_enter+0x25/0x100 [ 446.777063][T19291] do_syscall_64+0xfa/0x3b0 [ 446.777085][T19291] ? lockdep_hardirqs_on+0x9c/0x150 [ 446.777105][T19291] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.777124][T19291] ? clear_bhb_loop+0x60/0xb0 [ 446.777148][T19291] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.777172][T19291] RIP: 0033:0x7f52c978eec9 [ 446.777190][T19291] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 446.777208][T19291] RSP: 002b:00007f52ca654038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 446.777229][T19291] RAX: ffffffffffffffda RBX: 00007f52c99e5fa0 RCX: 00007f52c978eec9 [ 446.777243][T19291] RDX: 0000000000004010 RSI: 0000200000000000 RDI: 0000000000000003 [ 446.777256][T19291] RBP: 00007f52ca654090 R08: 0000000000000000 R09: 0000000000000000 [ 446.777269][T19291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.777285][T19291] R13: 00007f52c99e6038 R14: 00007f52c99e5fa0 R15: 00007ffef01ddb28 [ 446.777317][T19291] [ 447.340926][T19307] Bluetooth: MGMT ver 1.23 [ 447.346136][T19307] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3732'. [ 447.446636][T19316] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3735'. [ 447.532781][T19320] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3738'. [ 447.608108][T19326] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.3737'. [ 447.833271][T19336] netlink: 'syz.0.3740': attribute type 1 has an invalid length. [ 447.923895][T19346] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3742'. [ 447.981529][T19344] netlink: 104 bytes leftover after parsing attributes in process `syz.5.3743'. [ 447.983546][T19340] tipc: Enabled bearer , priority 0 [ 448.132425][T19360] siw: device registration error -23 [ 448.272390][T19340] tipc: Resetting bearer [ 448.287720][T19347] syzkaller0: entered promiscuous mode [ 448.293232][T19347] syzkaller0: entered allmulticast mode [ 448.389464][T19359] netlink: 596 bytes leftover after parsing attributes in process `syz.4.3741'. [ 448.414284][T19340] netlink: 'syz.4.3741': attribute type 29 has an invalid length. [ 448.415026][T19361] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3747'. [ 448.424119][ C1] syzkaller0: tun_net_xmit 90 [ 448.435992][ C1] syzkaller0: tun_net_xmit 90 [ 448.454577][T19347] netlink: 'syz.4.3741': attribute type 29 has an invalid length. [ 448.564266][ C1] syzkaller0: tun_net_xmit 90 [ 448.568998][ C1] syzkaller0: tun_net_xmit 90 [ 448.611006][T19337] tipc: Resetting bearer [ 448.655350][T19337] tipc: Disabling bearer [ 449.181653][T19410] sch_tbf: peakrate 7 is lower than or equals to rate 2147483647 ! [ 449.665283][T19426] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 450.754540][T19462] tipc: Started in network mode [ 450.760653][T19462] tipc: Node identity 6e2a8d23a6d2, cluster identity 4711 [ 450.788480][T19462] tipc: Enabled bearer , priority 0 [ 450.828237][T19473] FAULT_INJECTION: forcing a failure. [ 450.828237][T19473] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 450.901065][T19473] CPU: 0 UID: 0 PID: 19473 Comm: syz.2.3782 Not tainted syzkaller #0 PREEMPT(full) [ 450.901098][T19473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 450.901110][T19473] Call Trace: [ 450.901118][T19473] [ 450.901126][T19473] dump_stack_lvl+0x189/0x250 [ 450.901154][T19473] ? __pfx____ratelimit+0x10/0x10 [ 450.901177][T19473] ? __pfx_dump_stack_lvl+0x10/0x10 [ 450.901200][T19473] ? __pfx__printk+0x10/0x10 [ 450.901227][T19473] ? __might_fault+0xb0/0x130 [ 450.901266][T19473] should_fail_ex+0x414/0x560 [ 450.901300][T19473] _copy_from_iter+0x1de/0x1790 [ 450.901322][T19473] ? __lock_acquire+0xab9/0xd20 [ 450.901354][T19473] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 450.901383][T19473] ? policy_nodemask+0x27c/0x720 [ 450.901410][T19473] ? __pfx__copy_from_iter+0x10/0x10 [ 450.901438][T19473] ? set_page_refcounted+0xa0/0x1e0 [ 450.901465][T19473] ? page_copy_sane+0x4e/0x280 [ 450.901490][T19473] copy_page_from_iter+0xdd/0x170 [ 450.901519][T19473] tun_get_user+0x1d7b/0x3ea0 [ 450.901551][T19473] ? tun_get_user+0x6f6/0x3ea0 [ 450.901583][T19473] ? aa_file_perm+0x44d/0x1550 [ 450.901604][T19473] ? __pfx_tun_get_user+0x10/0x10 [ 450.901626][T19473] ? _parse_integer_limit+0x1ae/0x1f0 [ 450.901655][T19473] ? __lock_acquire+0xab9/0xd20 [ 450.901689][T19473] ? ref_tracker_alloc+0x318/0x460 [ 450.901706][T19473] ? __lock_acquire+0xab9/0xd20 [ 450.901736][T19473] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 450.901762][T19473] ? tun_get+0x1c/0x2f0 [ 450.901790][T19473] ? tun_get+0x1c/0x2f0 [ 450.901811][T19473] ? tun_get+0x1c/0x2f0 [ 450.901837][T19473] tun_chr_write_iter+0x113/0x200 [ 450.901862][T19473] vfs_write+0x5c9/0xb30 [ 450.901895][T19473] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 450.901919][T19473] ? __pfx_vfs_write+0x10/0x10 [ 450.901956][T19473] ? __fget_files+0x2a/0x420 [ 450.901984][T19473] ksys_write+0x145/0x250 [ 450.902011][T19473] ? __pfx_ksys_write+0x10/0x10 [ 450.902033][T19473] ? rcu_is_watching+0x15/0xb0 [ 450.902057][T19473] ? do_syscall_64+0xbe/0x3b0 [ 450.902090][T19473] do_syscall_64+0xfa/0x3b0 [ 450.902110][T19473] ? lockdep_hardirqs_on+0x9c/0x150 [ 450.902131][T19473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.902151][T19473] ? clear_bhb_loop+0x60/0xb0 [ 450.902175][T19473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.902195][T19473] RIP: 0033:0x7f52c978d97f [ 450.902212][T19473] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 450.902230][T19473] RSP: 002b:00007f52ca654000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 450.902252][T19473] RAX: ffffffffffffffda RBX: 00007f52c99e5fa0 RCX: 00007f52c978d97f [ 450.902266][T19473] RDX: 0000000000000086 RSI: 00002000000010c0 RDI: 00000000000000c8 [ 450.902279][T19473] RBP: 00007f52ca654090 R08: 0000000000000000 R09: 0000000000000000 [ 450.902290][T19473] R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000001 [ 450.902303][T19473] R13: 00007f52c99e6038 R14: 00007f52c99e5fa0 R15: 00007ffef01ddb28 [ 450.902332][T19473] [ 451.344929][T19462] tipc: Disabling bearer [ 451.464430][T19493] __nla_validate_parse: 9 callbacks suppressed [ 451.464448][T19493] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3787'. [ 451.651801][T19500] tipc: Started in network mode [ 451.664122][T19500] tipc: Node identity c2bc6d94c507, cluster identity 4711 [ 451.665447][T19502] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3792'. [ 451.679569][T19500] tipc: Enabled bearer , priority 0 [ 451.720995][T19506] syzkaller0: entered promiscuous mode [ 451.742781][T19506] syzkaller0: entered allmulticast mode [ 451.771556][T19500] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 451.973253][T19512] tipc: Resetting bearer [ 452.103042][T19498] tipc: Resetting bearer [ 452.154336][T19498] tipc: Disabling bearer [ 452.457489][T19542] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3806'. [ 452.753083][T19557] FAULT_INJECTION: forcing a failure. [ 452.753083][T19557] name failslab, interval 1, probability 0, space 0, times 0 [ 452.765765][T19557] CPU: 0 UID: 0 PID: 19557 Comm: syz.2.3809 Not tainted syzkaller #0 PREEMPT(full) [ 452.765795][T19557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 452.765805][T19557] Call Trace: [ 452.765812][T19557] [ 452.765819][T19557] dump_stack_lvl+0x189/0x250 [ 452.765843][T19557] ? __pfx____ratelimit+0x10/0x10 [ 452.765862][T19557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 452.765880][T19557] ? __pfx__printk+0x10/0x10 [ 452.765914][T19557] ? __lock_acquire+0xab9/0xd20 [ 452.765942][T19557] should_fail_ex+0x414/0x560 [ 452.765970][T19557] should_failslab+0xa8/0x100 [ 452.765995][T19557] kmem_cache_alloc_noprof+0x73/0x3c0 [ 452.766017][T19557] ? dst_alloc+0x105/0x170 [ 452.766043][T19557] dst_alloc+0x105/0x170 [ 452.766068][T19557] ip_route_input_rcu+0x1ed5/0x2ff0 [ 452.766102][T19557] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 452.766147][T19557] ? rcu_lockdep_current_cpu_online+0x37/0x120 [ 452.766170][T19557] ? ip_route_input_noref+0x98/0x250 [ 452.766194][T19557] ip_route_input_noref+0x167/0x250 [ 452.766218][T19557] ? __pfx_ip_route_input_noref+0x10/0x10 [ 452.766245][T19557] ? __lock_acquire+0xab9/0xd20 [ 452.766275][T19557] ip_rcv_finish_core+0x5af/0x1c00 [ 452.766304][T19557] ip_rcv_finish+0x14c/0x2f0 [ 452.766323][T19557] NF_HOOK+0x309/0x3a0 [ 452.766341][T19557] ? __pfx_ip_rcv_finish+0x10/0x10 [ 452.766357][T19557] ? NF_HOOK+0x9a/0x3a0 [ 452.766373][T19557] ? __pfx_NF_HOOK+0x10/0x10 [ 452.766387][T19557] ? ip_rcv_core+0x7f7/0xd00 [ 452.766405][T19557] ? __pfx_ip_rcv_finish+0x10/0x10 [ 452.766429][T19557] ? __pfx_ip_rcv+0x10/0x10 [ 452.766444][T19557] __netif_receive_skb+0x143/0x380 [ 452.766465][T19557] ? netif_receive_skb+0x115/0x790 [ 452.766488][T19557] netif_receive_skb+0x1cb/0x790 [ 452.766511][T19557] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 452.766529][T19557] ? __pfx_netif_receive_skb+0x10/0x10 [ 452.766558][T19557] ? tun_rx_batched+0x160/0x730 [ 452.766579][T19557] tun_rx_batched+0x1b9/0x730 [ 452.766597][T19557] ? __lock_acquire+0xab9/0xd20 [ 452.766624][T19557] ? __pfx_tun_rx_batched+0x10/0x10 [ 452.766646][T19557] ? tun_get_user+0x272f/0x3ea0 [ 452.766677][T19557] tun_get_user+0x2b65/0x3ea0 [ 452.766702][T19557] ? tun_get_user+0x6f6/0x3ea0 [ 452.766722][T19557] ? tun_get_user+0x272f/0x3ea0 [ 452.766744][T19557] ? aa_file_perm+0x44d/0x1550 [ 452.766761][T19557] ? __pfx_tun_get_user+0x10/0x10 [ 452.766789][T19557] ? __lock_acquire+0xab9/0xd20 [ 452.766818][T19557] ? ref_tracker_alloc+0x318/0x460 [ 452.766832][T19557] ? __lock_acquire+0xab9/0xd20 [ 452.766856][T19557] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 452.766877][T19557] ? tun_get+0x1c/0x2f0 [ 452.766903][T19557] ? tun_get+0x1c/0x2f0 [ 452.766921][T19557] ? tun_get+0x1c/0x2f0 [ 452.766943][T19557] tun_chr_write_iter+0x113/0x200 [ 452.766964][T19557] vfs_write+0x5c9/0xb30 [ 452.766990][T19557] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 452.767009][T19557] ? __pfx_vfs_write+0x10/0x10 [ 452.767040][T19557] ? __fget_files+0x2a/0x420 [ 452.767062][T19557] ksys_write+0x145/0x250 [ 452.767086][T19557] ? __pfx_ksys_write+0x10/0x10 [ 452.767105][T19557] ? rcu_is_watching+0x15/0xb0 [ 452.767126][T19557] ? do_syscall_64+0xbe/0x3b0 [ 452.767148][T19557] do_syscall_64+0xfa/0x3b0 [ 452.767165][T19557] ? lockdep_hardirqs_on+0x9c/0x150 [ 452.767181][T19557] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.767197][T19557] ? clear_bhb_loop+0x60/0xb0 [ 452.767217][T19557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.767232][T19557] RIP: 0033:0x7f52c978d97f [ 452.767247][T19557] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 452.767262][T19557] RSP: 002b:00007f52ca654000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 452.767279][T19557] RAX: ffffffffffffffda RBX: 00007f52c99e5fa0 RCX: 00007f52c978d97f [ 452.767291][T19557] RDX: 0000000000000086 RSI: 00002000000010c0 RDI: 00000000000000c8 [ 452.767303][T19557] RBP: 00007f52ca654090 R08: 0000000000000000 R09: 0000000000000000 [ 452.767313][T19557] R10: 0000000000000086 R11: 0000000000000293 R12: 0000000000000001 [ 452.767323][T19557] R13: 00007f52c99e6038 R14: 00007f52c99e5fa0 R15: 00007ffef01ddb28 [ 452.767349][T19557] [ 453.193528][T19558] º: renamed from veth1_vlan (while UP) [ 453.446233][T19565] tipc: Enabled bearer , priority 0 [ 453.490489][T19565] syzkaller0: entered promiscuous mode [ 453.519349][T19565] syzkaller0: entered allmulticast mode [ 453.544722][T19572] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3813'. [ 453.575764][T19565] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 453.713127][T19579] tipc: Resetting bearer [ 453.747208][T19563] tipc: Resetting bearer [ 453.856376][T19563] tipc: Disabling bearer [ 454.085654][T19601] sctp: [Deprecated]: syz.2.3822 (pid 19601) Use of int in max_burst socket option. [ 454.085654][T19601] Use struct sctp_assoc_value instead [ 454.206895][T19606] netlink: 'syz.4.3823': attribute type 1 has an invalid length. [ 454.253643][T19606] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3823'. [ 454.276821][T19608] netlink: 284 bytes leftover after parsing attributes in process `syz.3.3825'. [ 454.286843][T19611] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 454.446930][T19613] netlink: 'syz.3.3828': attribute type 1 has an invalid length. [ 454.463422][T19613] netlink: 208 bytes leftover after parsing attributes in process `syz.3.3828'. [ 454.506282][T19621] netlink: 'syz.3.3828': attribute type 10 has an invalid length. [ 454.560003][T19621] veth1_macvtap: left promiscuous mode [ 454.693727][T19619] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3827'. [ 454.756817][T19616] netlink: 'syz.5.3826': attribute type 1 has an invalid length. [ 454.777444][T19616] netlink: 212 bytes leftover after parsing attributes in process `syz.5.3826'. [ 454.817900][T19616] netlink: 'syz.5.3826': attribute type 1 has an invalid length. [ 455.227858][T19654] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3837'. [ 455.784811][T19681] syz_tun: entered allmulticast mode [ 455.857357][T19678] syz_tun: left allmulticast mode [ 456.029460][T19693] netlink: 'syz.2.3849': attribute type 1 has an invalid length. [ 456.139152][T19700] delete_channel: no stack [ 456.329999][T19710] netlink: 'syz.2.3853': attribute type 1 has an invalid length. [ 456.378218][T19709] syzkaller0: entered promiscuous mode [ 456.387586][T19709] syzkaller0: entered allmulticast mode [ 456.399460][T19659] vxcan1 speed is unknown, defaulting to 1000 [ 456.475045][T19710] 8021q: adding VLAN 0 to HW filter on device bond3 [ 456.485584][T19710] bond2: (slave bond3): making interface the new active one [ 456.501928][T19710] bond2: (slave bond3): Enslaving as an active interface with an up link [ 456.542804][T19713] : left allmulticast mode [ 456.553141][T19713] : left promiscuous mode [ 456.565799][T19713] bridge0: port 1() entered disabled state [ 456.588440][T19713] bridge_slave_1: left allmulticast mode [ 456.599657][T19713] bridge_slave_1: left promiscuous mode [ 456.637560][T19713] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.665089][T19713] bond0: (slave bond_slave_0): Releasing backup interface [ 456.685889][T19713] bond0: (slave bond_slave_1): Releasing backup interface [ 456.711328][T19713] team0: Port device team_slave_0 removed [ 456.736841][T19713] team0: Port device team_slave_1 removed [ 456.748699][T19713] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 456.766437][T19713] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 456.776260][T19713] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 456.784971][T19713] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 456.802758][T19713] bond2: (slave bridge3): Releasing backup interface [ 456.810369][T19713] bridge3: left promiscuous mode [ 456.887151][T19717] bond2: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 456.910995][T19717] bond2: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 457.194654][T19730] netlink: 'syz.0.3859': attribute type 1 has an invalid length. [ 457.249617][ T7894] IPVS: starting estimator thread 0... [ 457.290017][T19733] bridge4: entered promiscuous mode [ 457.296672][T19733] bridge4: entered allmulticast mode [ 457.363466][T19734] IPVS: using max 25 ests per chain, 60000 per kthread [ 457.609574][T19737] bridge2: entered allmulticast mode [ 457.664092][T19732] syzkaller0: entered promiscuous mode [ 457.673526][T19732] syzkaller0: entered allmulticast mode [ 458.299149][ T10] IPVS: starting estimator thread 0... [ 458.307911][T19778] __nla_validate_parse: 4 callbacks suppressed [ 458.307927][T19778] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3870'. [ 458.342781][T19780] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3872'. [ 458.424475][T19781] IPVS: using max 26 ests per chain, 62400 per kthread [ 459.226141][T19823] dvmrp0: left allmulticast mode [ 459.498864][T19839] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3892'. [ 459.534726][T19839] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3892'. [ 459.727464][T19856] sctp: [Deprecated]: syz.3.3897 (pid 19856) Use of int in max_burst socket option deprecated. [ 459.727464][T19856] Use struct sctp_assoc_value instead [ 460.264928][T19874] netlink: 'syz.4.3900': attribute type 18 has an invalid length. [ 460.272806][T19874] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3900'. [ 460.292564][T19874] netlink: 'syz.4.3900': attribute type 18 has an invalid length. [ 460.301626][T19874] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3900'. [ 460.310844][T11026] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.310889][T11026] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.310924][T11026] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.310958][T11026] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.366883][T19869] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3900'. [ 460.388523][T19870] netlink: 1 bytes leftover after parsing attributes in process `syz.4.3900'. [ 460.434049][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 460.564256][T19877] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3902'. [ 460.692102][T19888] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 460.699431][T19888] IPv6: NLM_F_CREATE should be set when creating new route [ 460.734437][T19889] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3907'. [ 460.766758][T19892] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 460.806677][T19895] netlink: 'syz.3.3909': attribute type 1 has an invalid length. [ 460.809567][T19889] netlink: 'syz.5.3907': attribute type 1 has an invalid length. [ 460.858967][T19902] netlink: 'syz.4.3910': attribute type 1 has an invalid length. [ 460.937090][T19889] bond1: entered promiscuous mode [ 460.943062][T19889] 8021q: adding VLAN 0 to HW filter on device bond1 [ 460.978935][T19910] netlink: 'syz.4.3910': attribute type 2 has an invalid length. [ 461.014123][T19904] 8021q: adding VLAN 0 to HW filter on device bond2 [ 461.039780][T19904] bond1: (slave bond2): making interface the new active one [ 461.049010][T19904] bond2: entered promiscuous mode [ 461.055950][T19904] bond1: (slave bond2): Enslaving as an active interface with an up link [ 461.526795][T19916] vxcan1 speed is unknown, defaulting to 1000 [ 462.456400][T19959] netlink: 'syz.4.3926': attribute type 19 has an invalid length. [ 462.544584][T19959] netlink: 'syz.4.3926': attribute type 19 has an invalid length. [ 462.683824][T19965] Bluetooth: MGMT ver 1.23 [ 463.404151][T20008] siw: device registration error -23 [ 463.459308][T20014] __nla_validate_parse: 7 callbacks suppressed [ 463.459326][T20014] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3945'. [ 463.637716][T20019] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3947'. [ 463.939454][T20033] pimreg: entered allmulticast mode [ 464.136537][T19806] udevd[19806]: inotify_add_watch(7, /dev/nbd4, 10) failed: No such file or directory [ 464.151962][T20041] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3955'. [ 464.412049][T20061] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3960'. [ 464.795327][T20080] sch_tbf: burst 21990 is lower than device lo mtu (65550) ! [ 464.901676][T20087] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3967'. [ 465.138231][T20097] netlink: 'syz.0.3972': attribute type 4 has an invalid length. [ 465.323125][T20108] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3975'. [ 465.365333][T20113] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3977'. [ 465.415372][T20114] FAULT_INJECTION: forcing a failure. [ 465.415372][T20114] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 465.434621][T20114] CPU: 1 UID: 0 PID: 20114 Comm: syz.5.3976 Not tainted syzkaller #0 PREEMPT(full) [ 465.434648][T20114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 465.434660][T20114] Call Trace: [ 465.434668][T20114] [ 465.434677][T20114] dump_stack_lvl+0x189/0x250 [ 465.434704][T20114] ? __pfx____ratelimit+0x10/0x10 [ 465.434734][T20114] ? __pfx_dump_stack_lvl+0x10/0x10 [ 465.434758][T20114] ? __pfx__printk+0x10/0x10 [ 465.434799][T20114] should_fail_ex+0x414/0x560 [ 465.434835][T20114] _copy_to_user+0x31/0xb0 [ 465.434864][T20114] simple_read_from_buffer+0xe1/0x170 [ 465.434898][T20114] proc_fail_nth_read+0x1b3/0x220 [ 465.434925][T20114] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 465.434952][T20114] ? rw_verify_area+0x2a6/0x4d0 [ 465.434976][T20114] ? __lock_acquire+0xab9/0xd20 [ 465.435003][T20114] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 465.435028][T20114] vfs_read+0x1fd/0xa30 [ 465.435052][T20114] ? fdget_pos+0x247/0x320 [ 465.435075][T20114] ? __pfx___mutex_lock+0x10/0x10 [ 465.435099][T20114] ? __pfx_vfs_read+0x10/0x10 [ 465.435127][T20114] ? __fget_files+0x2a/0x420 [ 465.435150][T20114] ? __fget_files+0x3a0/0x420 [ 465.435167][T20114] ? __fget_files+0x2a/0x420 [ 465.435194][T20114] ksys_read+0x145/0x250 [ 465.435223][T20114] ? __pfx_ksys_read+0x10/0x10 [ 465.435245][T20114] ? rcu_is_watching+0x15/0xb0 [ 465.435271][T20114] ? do_syscall_64+0xbe/0x3b0 [ 465.435298][T20114] do_syscall_64+0xfa/0x3b0 [ 465.435318][T20114] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.435339][T20114] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.435358][T20114] ? clear_bhb_loop+0x60/0xb0 [ 465.435382][T20114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.435401][T20114] RIP: 0033:0x7f58db58d8dc [ 465.435419][T20114] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 465.435437][T20114] RSP: 002b:00007f58dc4d8030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 465.435458][T20114] RAX: ffffffffffffffda RBX: 00007f58db7e5fa0 RCX: 00007f58db58d8dc [ 465.435472][T20114] RDX: 000000000000000f RSI: 00007f58dc4d80a0 RDI: 0000000000000004 [ 465.435485][T20114] RBP: 00007f58dc4d8090 R08: 0000000000000000 R09: 0000000000000000 [ 465.435498][T20114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.435510][T20114] R13: 00007f58db7e6038 R14: 00007f58db7e5fa0 R15: 00007ffd5fe75648 [ 465.435543][T20114] [ 465.779006][T20126] netlink: 212 bytes leftover after parsing attributes in process `syz.5.3982'. [ 465.816608][T20126] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 465.856392][T20131] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3981'. [ 465.992605][T20136] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3984'. [ 465.993716][T20127] netlink: 'syz.0.3981': attribute type 1 has an invalid length. [ 466.081538][T20127] 8021q: adding VLAN 0 to HW filter on device bond2 [ 466.190726][T20131] bond2: (slave veth3): Enslaving as an active interface with a down link [ 466.717728][T20166] netlink: 'syz.0.3992': attribute type 3 has an invalid length. [ 467.132759][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.132759][T20188] Use struct sctp_assoc_value instead [ 467.171360][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.171360][T20188] Use struct sctp_assoc_value instead [ 467.233233][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.233233][T20188] Use struct sctp_assoc_value instead [ 467.274466][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.274466][T20188] Use struct sctp_assoc_value instead [ 467.324937][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.324937][T20188] Use struct sctp_assoc_value instead [ 467.362935][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.362935][T20188] Use struct sctp_assoc_value instead [ 467.405007][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.405007][T20188] Use struct sctp_assoc_value instead [ 467.443540][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.443540][T20188] Use struct sctp_assoc_value instead [ 467.462070][T20197] netlink: 'syz.3.4002': attribute type 4 has an invalid length. [ 467.501700][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.501700][T20188] Use struct sctp_assoc_value instead [ 467.545321][T20188] sctp: [Deprecated]: syz.0.3998 (pid 20188) Use of int in maxseg socket option. [ 467.545321][T20188] Use struct sctp_assoc_value instead [ 467.561838][T20203] netlink: 'syz.4.4001': attribute type 4 has an invalid length. [ 467.651953][T20208] ipvlan2: entered promiscuous mode [ 468.305546][T20242] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 468.312382][T20242] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 468.421874][T20246] syzkaller1: entered promiscuous mode [ 468.440429][T20246] syzkaller1: entered allmulticast mode [ 468.497203][T20251] netlink: 'syz.5.4019': attribute type 4 has an invalid length. [ 468.650652][T20255] __nla_validate_parse: 5 callbacks suppressed [ 468.650671][T20255] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4022'. [ 468.674854][T20255] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4022'. [ 468.856459][T20266] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4024'. [ 469.237843][T20276] netlink: 'syz.5.4029': attribute type 29 has an invalid length. [ 469.248370][T20276] netlink: 'syz.5.4029': attribute type 29 has an invalid length. [ 469.297474][T20281] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4030'. [ 469.419511][T20285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4031'. [ 469.783078][T20296] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.930829][T20296] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.016415][T20296] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.049103][T20310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4038'. [ 470.067566][T20310] chnl_net:caif_netlink_parms(): no params data found [ 470.146758][T20296] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.674500][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 472.053568][T11049] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.104031][T11026] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.168192][T11027] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.226787][T11049] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.309045][T20345] netlink: 'syz.3.4045': attribute type 4 has an invalid length. [ 472.318454][T20345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4045'. [ 472.365968][T20348] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4047'. [ 472.398959][T20345] team_slave_0: entered promiscuous mode [ 472.404979][T20345] team_slave_1: entered promiscuous mode [ 472.465302][T20345] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 472.504436][T20353] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4049'. [ 472.543474][T20353] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4049'. [ 472.613751][T20355] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 473.274672][T20384] netlink: 'syz.3.4060': attribute type 4 has an invalid length. [ 473.309329][T20364] vxcan1 speed is unknown, defaulting to 1000 [ 473.788390][T20410] __nla_validate_parse: 6 callbacks suppressed [ 473.788411][T20410] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4066'. [ 473.903283][T20414] bond4: (slave vcan0): The slave device specified does not support setting the MAC address [ 473.921637][T20414] bond4: (slave vcan0): Error -95 calling set_mac_address [ 474.229606][T20435] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 474.288792][T20435] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4071'. [ 474.414318][T20442] tipc: Enabling of bearer rejected, media not registered [ 474.625153][T20446] dvmrp0: left allmulticast mode [ 474.634821][T20449] netlink: 'syz.0.4076': attribute type 1 has an invalid length. [ 474.677654][T20449] netlink: 17 bytes leftover after parsing attributes in process `syz.0.4076'. [ 475.175720][T20477] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4083'. [ 475.176393][T20476] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4084'. [ 475.196164][T20474] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4083'. [ 475.289289][T20481] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4086'. [ 475.310431][T20476] veth0: entered promiscuous mode [ 475.316529][T20481] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4086'. [ 475.324983][T20476] veth0: left promiscuous mode [ 475.655777][T20500] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 475.789242][T20505] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4093'. [ 475.839729][T20505] netlink: 'syz.3.4093': attribute type 5 has an invalid length. [ 475.897470][T20505] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4093'. [ 475.926090][T20505] geneve3: entered promiscuous mode [ 475.941644][T20505] geneve3: entered allmulticast mode [ 475.963789][T11049] netdevsim netdevsim3 ÿÿÿÿÿÿ: set [1, 1] type 2 family 0 port 256 - 0 [ 476.010271][T11049] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 476.051678][T11049] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 476.088475][T11049] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 476.161257][T20521] netlink: 'syz.3.4098': attribute type 1 has an invalid length. [ 476.243441][T20521] netlink: 'syz.3.4098': attribute type 1 has an invalid length. [ 476.499652][T19881] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 476.594747][T20541] erspan0: entered promiscuous mode [ 476.767631][ T5873] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 476.779273][ T5873] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 476.788241][ T5873] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 476.797174][ T5873] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 476.806394][ T5873] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 477.074535][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 477.450120][T20539] vxcan1 speed is unknown, defaulting to 1000 [ 478.170283][T20597] bond0: entered promiscuous mode [ 478.193204][T20597] bond_slave_0: entered promiscuous mode [ 478.200753][T20597] bond_slave_1: entered promiscuous mode [ 478.209814][T20597] bond0: left promiscuous mode [ 478.215280][T20597] bond_slave_0: left promiscuous mode [ 478.220960][T20597] bond_slave_1: left promiscuous mode [ 478.237106][T20547] vxcan1 speed is unknown, defaulting to 1000 [ 478.914330][ T5873] Bluetooth: hci4: command tx timeout [ 479.024166][T20621] netlink: 'syz.0.4130': attribute type 21 has an invalid length. [ 479.181650][T20621] __nla_validate_parse: 8 callbacks suppressed [ 479.181670][T20621] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4130'. [ 479.660994][T20654] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4139'. [ 479.732158][T20654] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4139'. [ 479.821373][T20657] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4140'. [ 479.888330][T20654] gretap1: entered promiscuous mode [ 479.894699][T20659] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4141'. [ 479.904244][T20654] gretap1: entered allmulticast mode [ 479.970220][T20547] chnl_net:caif_netlink_parms(): no params data found [ 480.074221][T20662] netlink: 332 bytes leftover after parsing attributes in process `syz.0.4140'. [ 480.289605][T20674] tipc: Enabled bearer , priority 0 [ 480.362753][T20682] netlink: 108 bytes leftover after parsing attributes in process `syz.4.4150'. [ 480.475935][T20674] syzkaller0: entered promiscuous mode [ 480.494229][T20674] syzkaller0: entered allmulticast mode [ 480.586978][T20547] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.604469][T20547] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.615891][T20547] bridge_slave_0: entered allmulticast mode [ 480.635628][T20547] bridge_slave_0: entered promiscuous mode [ 480.703027][T20674] tipc: Resetting bearer [ 480.732595][T20686] netlink: 11 bytes leftover after parsing attributes in process `syz.3.4148'. [ 480.751929][T20686] netlink: 11 bytes leftover after parsing attributes in process `syz.3.4148'. [ 480.772007][T20707] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4157'. [ 480.787361][T20547] bridge0: port 2(bridge_slave_1) entered blocking state [ 480.795512][T20707] openvswitch: netlink: Invalid VLAN frame [ 480.796698][T20547] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.825995][T20547] bridge_slave_1: entered allmulticast mode [ 480.847355][T20547] bridge_slave_1: entered promiscuous mode [ 480.993731][ T5873] Bluetooth: hci4: command tx timeout [ 481.019996][T20715] tipc: Started in network mode [ 481.026306][T20715] tipc: Node identity a647beed49dd, cluster identity 4711 [ 481.034147][T20715] tipc: Enabled bearer , priority 0 [ 481.068493][T20547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 481.118012][T20547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.154117][T20673] tipc: Resetting bearer [ 481.191864][T20673] tipc: Disabling bearer [ 481.208372][T20714] tipc: Disabling bearer [ 481.477021][T20547] team0: Port device team_slave_0 added [ 481.497275][T20547] team0: Port device team_slave_1 added [ 481.697009][T20547] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 481.708360][T20547] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 481.751897][T20547] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 481.764599][T20746] netlink: 'syz.0.4166': attribute type 5 has an invalid length. [ 481.842892][T20749] syzkaller0: entered promiscuous mode [ 481.876914][T20749] syzkaller0: entered allmulticast mode [ 481.905808][T20547] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 481.912783][T20547] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.005928][T20547] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 483.079052][ T5873] Bluetooth: hci4: command tx timeout [ 484.220376][T20794] hsr_slave_0: left promiscuous mode [ 484.234326][T20794] hsr_slave_1: left promiscuous mode [ 484.413525][T20796] openvswitch: netlink: Key type 29 is not supported [ 484.468760][T20798] netlink: 'syz.3.4181': attribute type 2 has an invalid length. [ 484.490149][T20547] hsr_slave_0: entered promiscuous mode [ 484.500279][T20801] __nla_validate_parse: 5 callbacks suppressed [ 484.500296][T20801] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4180'. [ 484.507414][T20547] hsr_slave_1: entered promiscuous mode [ 484.522408][T20798] netlink: 188 bytes leftover after parsing attributes in process `syz.3.4181'. [ 484.532989][T20547] debugfs: 'hsr0' already exists in 'hsr' [ 484.538976][T20547] Cannot create hsr debugfs directory [ 484.553216][T20802] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4182'. [ 484.583590][T20802] netlink: 'syz.0.4182': attribute type 3 has an invalid length. [ 485.000148][T20824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4188'. [ 485.062189][T20823] bridge_slave_0: left allmulticast mode [ 485.074274][T20823] bridge_slave_0: left promiscuous mode [ 485.093939][T20823] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.137887][T20823] bridge_slave_1: left allmulticast mode [ 485.153646][ T5873] Bluetooth: hci4: command tx timeout [ 485.161330][T20823] bridge_slave_1: left promiscuous mode [ 485.174372][T20823] bridge0: port 2(bridge_slave_1) entered disabled state [ 485.190433][T20823] bond0: (slave bond_slave_0): Releasing backup interface [ 485.219318][T20823] bond0: (slave bond_slave_1): Releasing backup interface [ 485.255760][T20823] team0: Port device team_slave_0 removed [ 485.285739][T20823] team0: Port device team_slave_1 removed [ 485.300504][T20823] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 485.319565][T20823] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 485.342404][T20823] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 485.361643][T20823] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 485.416909][T20823] bond1: (slave bond2): Releasing backup interface [ 485.436690][T20823] bond2: left promiscuous mode [ 485.481511][T20829] team0: Mode changed to "broadcast" [ 485.527785][T20833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4191'. [ 485.713005][T20849] netlink: 'syz.5.4193': attribute type 1 has an invalid length. [ 485.933606][T20863] netlink: 'syz.5.4197': attribute type 25 has an invalid length. [ 485.955682][T20547] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 485.995341][T20547] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 486.036145][T20547] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 486.077671][T20547] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 486.169905][T20876] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 486.324888][T20880] netlink: 'syz.3.4201': attribute type 2 has an invalid length. [ 486.368914][T20547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 486.406892][T20882] smc: removing ib device syz2 [ 486.424900][T20547] 8021q: adding VLAN 0 to HW filter on device team0 [ 486.521477][T20885] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4203'. [ 486.560652][T11049] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.567830][T11049] bridge0: port 1(bridge_slave_0) entered forwarding state [ 486.609362][T11027] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.616542][T11027] bridge0: port 2(bridge_slave_1) entered forwarding state [ 486.832066][T20892] netlink: 'syz.0.4206': attribute type 10 has an invalid length. [ 486.909671][T20892] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4206'. [ 487.112420][T20894] sctp: [Deprecated]: syz.3.4207 (pid 20894) Use of int in maxseg socket option. [ 487.112420][T20894] Use struct sctp_assoc_value instead [ 487.205519][T20892] team0: Port device geneve0 added [ 487.506604][T20902] delete_channel: no stack [ 487.684073][T20908] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4211'. [ 487.847108][T20547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 488.286024][T20922] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4214'. [ 488.326752][T20922] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz_tun! [ 488.725981][T20547] veth0_vlan: entered promiscuous mode [ 488.822703][T20547] veth1_vlan: entered promiscuous mode [ 488.879911][T20933] netlink: 'syz.3.4218': attribute type 15 has an invalid length. [ 488.970389][T20547] veth0_macvtap: entered promiscuous mode [ 489.056104][T20547] veth1_macvtap: entered promiscuous mode [ 489.212278][T20547] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 489.256373][T20547] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 489.311793][T11049] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.375685][T11049] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.426543][T11049] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.455316][T11049] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.679206][T20954] bond0: (slave rose0): Error: Device can not be enslaved while up [ 489.785668][T20958] netlink: 'syz.5.4226': attribute type 21 has an invalid length. [ 489.801509][T20958] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4226'. [ 489.845128][T20958] netlink: 'syz.5.4226': attribute type 1 has an invalid length. [ 490.136930][T20961] veth3: entered promiscuous mode [ 490.494649][T20969] 8021q: adding VLAN 0 to HW filter on device bond1 [ 490.511309][T20971] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 490.544688][T20974] netlink: 128 bytes leftover after parsing attributes in process `syz.5.4231'. [ 490.758224][T11047] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.793737][T11047] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.900998][T20987] openvswitch: netlink: Message has 4 unknown bytes. [ 490.908271][T20987] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.123815][T20993] netlink: 'syz.3.4235': attribute type 1 has an invalid length. [ 491.142903][T20993] netlink: 'syz.3.4235': attribute type 3 has an invalid length. [ 491.165403][T11026] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.175323][T11026] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.211012][T20993] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4235'. [ 491.227239][T20998] netlink: 'syz.0.4237': attribute type 1 has an invalid length. [ 491.236019][T20998] netlink: 15 bytes leftover after parsing attributes in process `syz.0.4237'. [ 491.296716][T21001] syz_tun: entered allmulticast mode [ 491.304720][T21000] !€ÿ: renamed from bond_slave_0 [ 491.367514][T11027] batadv5: left allmulticast mode [ 491.372633][T11027] batadv5: left promiscuous mode [ 491.394727][T11027] bridge0: port 6(batadv5) entered disabled state [ 491.524234][T11027] batadv4: left allmulticast mode [ 491.529301][T11027] batadv4: left promiscuous mode [ 491.537850][T11027] bridge0: port 5(batadv4) entered disabled state [ 491.560474][T11027] batadv3: left allmulticast mode [ 491.573619][T11027] batadv3: left promiscuous mode [ 491.581135][T11027] bridge0: port 4(batadv3) entered disabled state [ 491.646732][T11027] batadv2: left allmulticast mode [ 491.651811][T11027] batadv2: left promiscuous mode [ 491.673052][T11027] bridge0: port 2(batadv2) entered disabled state [ 491.701877][T11027] batadv1: left allmulticast mode [ 491.726698][T11027] batadv1: left promiscuous mode [ 491.731878][T11027] bridge0: port 1(batadv1) entered disabled state [ 492.079040][T11027] bond3 (unregistering): (slave gretap1): Releasing active interface [ 492.170574][T11027] bond4 (unregistering): (slave geneve2): Releasing active interface [ 492.306426][T11027] bond2 (unregistering): (slave bridge0): Releasing active interface [ 492.543144][T11027] bond1 (unregistering): Released all slaves [ 492.560852][T11027] bond2 (unregistering): Released all slaves [ 492.682165][T11027] bond3 (unregistering): Released all slaves [ 492.797576][T11027] bond4 (unregistering): Released all slaves [ 492.816469][T11027] bond5 (unregistering): (slave veth7): Releasing backup interface [ 492.828203][T11027] bond5 (unregistering): Released all slaves [ 492.942398][T11027] bond6 (unregistering): Released all slaves [ 493.061243][T11027] bond7 (unregistering): Released all slaves [ 493.078955][T11027] bond0 (unregistering): Released all slaves [ 493.100072][T11027] bond8 (unregistering): Released all slaves [ 493.119623][T11027] bond9 (unregistering): Released all slaves [ 493.173537][T21009] netlink: 'syz.0.4239': attribute type 29 has an invalid length. [ 493.235726][ T5185] Bluetooth: hci2: command 0x0401 tx timeout [ 493.327350][T21022] tipc: Started in network mode [ 493.332249][T21022] tipc: Node identity 92575671279f, cluster identity 4711 [ 493.339985][T21022] tipc: Enabled bearer , priority 0 [ 493.365476][T21022] syzkaller0: entered promiscuous mode [ 493.370966][T21022] syzkaller0: entered allmulticast mode [ 493.434126][T21023] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 493.434227][T21027] netlink: 'syz.0.4242': attribute type 11 has an invalid length. [ 493.466226][T21023] tipc: Resetting bearer [ 493.475176][T21021] tipc: Resetting bearer [ 493.485167][T21027] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4242'. [ 493.543103][T21021] tipc: Disabling bearer [ 493.679824][T21029] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4243'. [ 493.896707][T11027] tipc: Left network mode [ 493.947699][T21035] netlink: 'syz.6.4245': attribute type 2 has an invalid length. [ 494.038629][T21043] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4248'. [ 494.972087][T21072] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4256'. [ 494.974155][T21068] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.025242][T21072] bridge0: entered promiscuous mode [ 495.662875][T21083] netlink: 160 bytes leftover after parsing attributes in process `syz.6.4260'. [ 495.752443][T21091] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4262'. [ 495.803486][T21091] openvswitch: netlink: Flow actions attr not present in new flow. [ 495.995336][T21107] syz.6.4264: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 496.010881][T21107] CPU: 1 UID: 0 PID: 21107 Comm: syz.6.4264 Not tainted syzkaller #0 PREEMPT(full) [ 496.010908][T21107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 496.010921][T21107] Call Trace: [ 496.010930][T21107] [ 496.010938][T21107] dump_stack_lvl+0x189/0x250 [ 496.010972][T21107] ? __pfx_dump_stack_lvl+0x10/0x10 [ 496.010999][T21107] ? __pfx__printk+0x10/0x10 [ 496.011027][T21107] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 496.011052][T21107] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 496.011078][T21107] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 496.011106][T21107] warn_alloc+0x214/0x310 [ 496.011137][T21107] ? stack_depot_save_flags+0x40/0x860 [ 496.011171][T21107] ? __pfx_warn_alloc+0x10/0x10 [ 496.011204][T21107] ? kasan_save_track+0x4f/0x80 [ 496.011231][T21107] ? xskq_create+0x56/0x170 [ 496.011248][T21107] ? xsk_init_queue+0xb0/0x110 [ 496.011265][T21107] ? xsk_setsockopt+0x4dc/0x8d0 [ 496.011293][T21107] ? do_sock_setsockopt+0x179/0x1b0 [ 496.011316][T21107] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 496.011347][T21107] ? do_syscall_64+0xfa/0x3b0 [ 496.011368][T21107] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.011398][T21107] __vmalloc_node_range_noprof+0x125/0x12f0 [ 496.011460][T21107] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 496.011498][T21107] ? __kasan_kmalloc+0x93/0xb0 [ 496.011529][T21107] vmalloc_user_noprof+0xad/0xf0 [ 496.011558][T21107] ? xskq_create+0xbf/0x170 [ 496.011579][T21107] xskq_create+0xbf/0x170 [ 496.011602][T21107] xsk_init_queue+0xb0/0x110 [ 496.011623][T21107] xsk_setsockopt+0x4dc/0x8d0 [ 496.011657][T21107] ? __pfx_xsk_setsockopt+0x10/0x10 [ 496.011685][T21107] ? __pfx_aa_sk_perm+0x10/0x10 [ 496.011719][T21107] ? aa_sock_opt_perm+0xff/0x1b0 [ 496.011743][T21107] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 496.011765][T21107] ? __pfx_xsk_setsockopt+0x10/0x10 [ 496.011795][T21107] do_sock_setsockopt+0x179/0x1b0 [ 496.011825][T21107] __x64_sys_setsockopt+0x13f/0x1b0 [ 496.011854][T21107] do_syscall_64+0xfa/0x3b0 [ 496.011875][T21107] ? lockdep_hardirqs_on+0x9c/0x150 [ 496.011896][T21107] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.011915][T21107] ? clear_bhb_loop+0x60/0xb0 [ 496.011940][T21107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.011959][T21107] RIP: 0033:0x7f987298eec9 [ 496.011977][T21107] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 496.011995][T21107] RSP: 002b:00007f98737cd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 496.012016][T21107] RAX: ffffffffffffffda RBX: 00007f9872be6180 RCX: 00007f987298eec9 [ 496.012032][T21107] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009 [ 496.012044][T21107] RBP: 00007f9872a11f91 R08: 0000000000000004 R09: 0000000000000000 [ 496.012057][T21107] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 496.012070][T21107] R13: 00007f9872be6218 R14: 00007f9872be6180 R15: 00007ffed9c6b828 [ 496.012099][T21107] [ 496.012118][T21107] Mem-Info: [ 496.107557][T21113] nftables ruleset with unbound set [ 496.277592][T21107] active_anon:4744 inactive_anon:0 isolated_anon:0 [ 496.277592][T21107] active_file:3213 inactive_file:40046 isolated_file:0 [ 496.277592][T21107] unevictable:768 dirty:103 writeback:0 [ 496.277592][T21107] slab_reclaimable:13362 slab_unreclaimable:136707 [ 496.277592][T21107] mapped:31398 shmem:1377 pagetables:1128 [ 496.277592][T21107] sec_pagetables:0 bounce:0 [ 496.277592][T21107] kernel_misc_reclaimable:0 [ 496.277592][T21107] free:1283481 free_pcp:13716 free_cma:0 [ 496.453926][T21107] Node 0 active_anon:19276kB inactive_anon:0kB active_file:12852kB inactive_file:159980kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:125592kB dirty:408kB writeback:0kB shmem:3972kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16656kB pagetables:4352kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 496.540692][T21107] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 496.584512][T21107] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 496.667028][T21107] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 496.710843][T21107] Node 0 DMA32 free:1221664kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:18932kB inactive_anon:0kB active_file:12852kB inactive_file:158400kB unevictable:1536kB writepending:408kB present:3129332kB managed:2557408kB mlocked:0kB bounce:0kB free_pcp:41512kB local_pcp:20444kB free_cma:0kB [ 496.808336][T21107] lowmem_reserve[]: 0 0 1 1 1 [ 496.828723][T21107] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1580kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 496.952329][T21107] lowmem_reserve[]: 0 0 0 0 0 [ 496.969160][T21107] Node 1 Normal free:3898152kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:14464kB local_pcp:4544kB free_cma:0kB [ 496.971550][T21116] team0: Device wireguard0 is of different type [ 497.077153][T21107] lowmem_reserve[]: 0 0 0 0 0 [ 497.083232][T21107] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 497.099143][T21107] Node 0 DMA32: 1642*4kB (UME) 581*8kB (UM) 197*16kB (UME) 327*32kB (UM) 276*64kB (UM) 46*128kB (UM) 30*256kB (UME) 9*512kB (UM) 2*1024kB (UM) 5*2048kB (UME) 281*4096kB (UM) = 1223936kB [ 497.119297][T21107] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 497.135924][T21107] Node 1 Normal: 214*4kB (UME) 56*8kB (UME) 51*16kB (UME) 207*32kB (UME) 64*64kB (UME) 8*128kB (UME) 3*256kB (ME) 3*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 946*4096kB (M) = 3898152kB [ 497.156115][T21107] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 497.165890][T21107] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 497.175540][T21107] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 497.189159][T21107] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 497.198704][T21107] 44633 total pagecache pages [ 497.203539][T21107] 0 pages in swap cache [ 497.207751][T21107] Free swap = 124996kB [ 497.211956][T21107] Total swap = 124996kB [ 497.216879][T21107] 2097051 pages RAM [ 497.220729][T21107] 0 pages HighMem/MovableOnly [ 497.225820][T21107] 425673 pages reserved [ 497.230929][T21107] 0 pages cma reserved [ 497.248249][T11027] hsr_slave_0: left promiscuous mode [ 497.254598][T11027] hsr_slave_1: left promiscuous mode [ 497.260331][T11027] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 498.418231][T21142] veth0: entered promiscuous mode [ 498.426155][T21142] veth0: left promiscuous mode [ 498.842275][T21156] veth0: entered promiscuous mode [ 498.855856][T21156] veth0: left promiscuous mode [ 499.173244][T11027] IPVS: stop unused estimator thread 0... [ 499.211611][T21172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4282'. [ 499.263921][T21172] openvswitch: netlink: Unknown nsh attribute 0 [ 499.270219][T21172] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 500.067896][T21211] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4293'. [ 500.318348][T21222] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 500.376611][T21222] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 500.461637][T21231] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4299'. [ 500.585966][T21233] vlan2: entered allmulticast mode [ 500.591115][T21233] hsr0: entered allmulticast mode [ 500.626951][T21233] hsr_slave_0: entered allmulticast mode [ 500.632620][T21233] hsr_slave_1: entered allmulticast mode [ 500.714505][T21239] netlink: 'syz.6.4304': attribute type 32 has an invalid length. [ 501.427215][T21271] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4314'. [ 501.592972][T21230] Set syz1 is full, maxelem 6117 reached [ 501.601342][T21277] netlink: 'syz.4.4316': attribute type 1 has an invalid length. [ 501.693932][T21277] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4316'. [ 501.719558][T21286] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4317'. [ 501.969250][T21290] veth5: entered promiscuous mode [ 501.978653][T21290] bond5: (slave veth5): Enslaving as a backup interface with a down link [ 501.995092][T21299] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 502.079114][T21305] netlink: 108 bytes leftover after parsing attributes in process `syz.5.4322'. [ 502.293979][T21316] veth0: entered promiscuous mode [ 502.381347][T21310] veth0: left promiscuous mode [ 502.439283][T21323] openvswitch: netlink: IP tunnel dst address not specified [ 502.451489][T21323] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4330'. [ 502.478961][T21325] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.4328'. [ 502.490514][T21323] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.817151][T21325] [ 502.819514][T21325] ====================================================== [ 502.826528][T21325] WARNING: possible circular locking dependency detected [ 502.833548][T21325] syzkaller #0 Not tainted [ 502.837963][T21325] ------------------------------------------------------ [ 502.844976][T21325] syz.4.4328/21325 is trying to acquire lock: [ 502.851021][T21325] ffffffff8e21e8e8 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x286/0x1720 [ 502.860587][T21325] [ 502.860587][T21325] but task is already holding lock: [ 502.867933][T21325] ffff88802824e2c8 (&q->q_usage_counter(io)#70){++++}-{0:0}, at: nbd_start_device+0x17f/0xb10 [ 502.878199][T21325] [ 502.878199][T21325] which lock already depends on the new lock. [ 502.878199][T21325] [ 502.888581][T21325] [ 502.888581][T21325] the existing dependency chain (in reverse order) is: [ 502.897580][T21325] [ 502.897580][T21325] -> #2 (&q->q_usage_counter(io)#70){++++}-{0:0}: [ 502.906171][T21325] lock_acquire+0x120/0x360 [ 502.911188][T21325] blk_alloc_queue+0x538/0x620 [ 502.916466][T21325] __blk_mq_alloc_disk+0x15c/0x340 [ 502.922088][T21325] nbd_dev_add+0x46c/0xae0 [ 502.927013][T21325] nbd_genl_connect+0x919/0x18f0 [ 502.932456][T21325] genl_family_rcv_msg_doit+0x212/0x300 [ 502.938512][T21325] genl_rcv_msg+0x60e/0x790 [ 502.943530][T21325] netlink_rcv_skb+0x208/0x470 [ 502.948805][T21325] genl_rcv+0x28/0x40 [ 502.953299][T21325] netlink_unicast+0x82f/0x9e0 [ 502.958577][T21325] netlink_sendmsg+0x805/0xb30 [ 502.963845][T21325] __sock_sendmsg+0x219/0x270 [ 502.969034][T21325] ____sys_sendmsg+0x505/0x830 [ 502.974306][T21325] ___sys_sendmsg+0x21f/0x2a0 [ 502.979488][T21325] __x64_sys_sendmsg+0x19b/0x260 [ 502.984935][T21325] do_syscall_64+0xfa/0x3b0 [ 502.989954][T21325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.996351][T21325] [ 502.996351][T21325] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 503.003553][T21325] lock_acquire+0x120/0x360 [ 503.008577][T21325] fs_reclaim_acquire+0x72/0x100 [ 503.014024][T21325] prepare_alloc_pages+0x153/0x610 [ 503.019637][T21325] __alloc_frozen_pages_noprof+0x123/0x370 [ 503.025952][T21325] __alloc_pages_noprof+0xa/0x30 [ 503.031396][T21325] pcpu_populate_chunk+0x182/0xb30 [ 503.037018][T21325] pcpu_alloc_noprof+0xcbf/0x1720 [ 503.042553][T21325] bpf_map_alloc_percpu+0xbc/0x1b0 [ 503.048176][T21325] prealloc_init+0x225/0x630 [ 503.053275][T21325] htab_map_alloc+0x6ce/0xc70 [ 503.058461][T21325] map_create+0xaa3/0x14d0 [ 503.063388][T21325] __sys_bpf+0x60f/0x870 [ 503.068148][T21325] __x64_sys_bpf+0x7c/0x90 [ 503.073069][T21325] do_syscall_64+0xfa/0x3b0 [ 503.078080][T21325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.084476][T21325] [ 503.084476][T21325] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 503.092196][T21325] validate_chain+0xb9b/0x2140 [ 503.097467][T21325] __lock_acquire+0xab9/0xd20 [ 503.102664][T21325] lock_acquire+0x120/0x360 [ 503.107676][T21325] __mutex_lock+0x187/0x1350 [ 503.112773][T21325] pcpu_alloc_noprof+0x286/0x1720 [ 503.118311][T21325] sbitmap_init_node+0x1e1/0x630 [ 503.123755][T21325] sbitmap_queue_init_node+0x3e/0x4d0 [ 503.129644][T21325] blk_mq_init_tags+0x110/0x280 [ 503.135005][T21325] blk_mq_alloc_map_and_rqs+0xbd/0x9f0 [ 503.140968][T21325] blk_mq_update_nr_hw_queues+0xa26/0x1aa0 [ 503.147282][T21325] nbd_start_device+0x17f/0xb10 [ 503.152636][T21325] nbd_genl_connect+0x135b/0x18f0 [ 503.158165][T21325] genl_family_rcv_msg_doit+0x212/0x300 [ 503.164225][T21325] genl_rcv_msg+0x60e/0x790 [ 503.169245][T21325] netlink_rcv_skb+0x208/0x470 [ 503.174513][T21325] genl_rcv+0x28/0x40 [ 503.179004][T21325] netlink_unicast+0x82f/0x9e0 [ 503.184280][T21325] netlink_sendmsg+0x805/0xb30 [ 503.189550][T21325] __sock_sendmsg+0x219/0x270 [ 503.194745][T21325] ____sys_sendmsg+0x505/0x830 [ 503.200015][T21325] ___sys_sendmsg+0x21f/0x2a0 [ 503.205200][T21325] __x64_sys_sendmsg+0x19b/0x260 [ 503.210644][T21325] do_syscall_64+0xfa/0x3b0 [ 503.215656][T21325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.222058][T21325] [ 503.222058][T21325] other info that might help us debug this: [ 503.222058][T21325] [ 503.232274][T21325] Chain exists of: [ 503.232274][T21325] pcpu_alloc_mutex --> fs_reclaim --> &q->q_usage_counter(io)#70 [ 503.232274][T21325] [ 503.245924][T21325] Possible unsafe locking scenario: [ 503.245924][T21325] [ 503.253361][T21325] CPU0 CPU1 [ 503.258709][T21325] ---- ---- [ 503.264056][T21325] lock(&q->q_usage_counter(io)#70); [ 503.269424][T21325] lock(fs_reclaim); [ 503.275912][T21325] lock(&q->q_usage_counter(io)#70); [ 503.283798][T21325] lock(pcpu_alloc_mutex); [ 503.288286][T21325] [ 503.288286][T21325] *** DEADLOCK *** [ 503.288286][T21325] [ 503.296417][T21325] 6 locks held by syz.4.4328/21325: [ 503.301603][T21325] #0: ffffffff8f59f870 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 503.309790][T21325] #1: ffffffff8f59f688 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 503.318756][T21325] #2: ffff88802769c988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xa7/0x1aa0 [ 503.330147][T21325] #3: ffff88802769c8d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xba/0x1aa0 [ 503.341102][T21325] #4: ffff88802824e2c8 (&q->q_usage_counter(io)#70){++++}-{0:0}, at: nbd_start_device+0x17f/0xb10 [ 503.351801][T21325] #5: ffff88802824e300 (&q->q_usage_counter(queue)#52){+.+.}-{0:0}, at: nbd_start_device+0x17f/0xb10 [ 503.362757][T21325] [ 503.362757][T21325] stack backtrace: [ 503.368630][T21325] CPU: 0 UID: 0 PID: 21325 Comm: syz.4.4328 Not tainted syzkaller #0 PREEMPT(full) [ 503.368648][T21325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 503.368659][T21325] Call Trace: [ 503.368666][T21325] [ 503.368674][T21325] dump_stack_lvl+0x189/0x250 [ 503.368696][T21325] ? __pfx_dump_stack_lvl+0x10/0x10 [ 503.368715][T21325] ? __pfx__printk+0x10/0x10 [ 503.368738][T21325] ? print_lock_name+0xde/0x100 [ 503.368760][T21325] print_circular_bug+0x2ee/0x310 [ 503.368780][T21325] check_noncircular+0x134/0x160 [ 503.368800][T21325] validate_chain+0xb9b/0x2140 [ 503.368827][T21325] __lock_acquire+0xab9/0xd20 [ 503.368852][T21325] ? pcpu_alloc_noprof+0x286/0x1720 [ 503.368875][T21325] lock_acquire+0x120/0x360 [ 503.368896][T21325] ? pcpu_alloc_noprof+0x286/0x1720 [ 503.368931][T21325] __mutex_lock+0x187/0x1350 [ 503.368949][T21325] ? pcpu_alloc_noprof+0x286/0x1720 [ 503.368974][T21325] ? kasan_save_track+0x4f/0x80 [ 503.368993][T21325] ? kasan_save_track+0x3e/0x80 [ 503.369011][T21325] ? __kasan_kmalloc+0x93/0xb0 [ 503.369030][T21325] ? blk_mq_init_tags+0x85/0x280 [ 503.369051][T21325] ? blk_mq_alloc_map_and_rqs+0xbd/0x9f0 [ 503.369067][T21325] ? blk_mq_update_nr_hw_queues+0xa26/0x1aa0 [ 503.369085][T21325] ? pcpu_alloc_noprof+0x286/0x1720 [ 503.369106][T21325] ? nbd_genl_connect+0x135b/0x18f0 [ 503.369122][T21325] ? genl_family_rcv_msg_doit+0x212/0x300 [ 503.369144][T21325] ? genl_rcv_msg+0x60e/0x790 [ 503.369164][T21325] ? __pfx___mutex_lock+0x10/0x10 [ 503.369180][T21325] ? ____sys_sendmsg+0x505/0x830 [ 503.369199][T21325] ? do_syscall_64+0xfa/0x3b0 [ 503.369216][T21325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.369250][T21325] pcpu_alloc_noprof+0x286/0x1720 [ 503.369293][T21325] sbitmap_init_node+0x1e1/0x630 [ 503.369311][T21325] ? __kasan_kmalloc+0x93/0xb0 [ 503.369334][T21325] sbitmap_queue_init_node+0x3e/0x4d0 [ 503.369355][T21325] blk_mq_init_tags+0x110/0x280 [ 503.369377][T21325] blk_mq_alloc_map_and_rqs+0xbd/0x9f0 [ 503.369397][T21325] ? blk_mq_update_nr_hw_queues+0x928/0x1aa0 [ 503.369415][T21325] ? kfree+0x18e/0x440 [ 503.369436][T21325] blk_mq_update_nr_hw_queues+0xa26/0x1aa0 [ 503.369464][T21325] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 503.369493][T21325] ? sysfs_add_file_mode_ns+0x259/0x300 [ 503.369522][T21325] nbd_start_device+0x17f/0xb10 [ 503.369540][T21325] ? device_create_file+0xf4/0x1c0 [ 503.369559][T21325] nbd_genl_connect+0x135b/0x18f0 [ 503.369579][T21325] ? __pfx_nbd_genl_connect+0x10/0x10 [ 503.369601][T21325] ? __nla_parse+0x40/0x60 [ 503.369618][T21325] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 503.369644][T21325] genl_family_rcv_msg_doit+0x212/0x300 [ 503.369670][T21325] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 503.369697][T21325] ? stack_trace_save+0x9c/0xe0 [ 503.369719][T21325] genl_rcv_msg+0x60e/0x790 [ 503.369742][T21325] ? __pfx_genl_rcv_msg+0x10/0x10 [ 503.369763][T21325] ? __pfx_nbd_genl_connect+0x10/0x10 [ 503.369784][T21325] netlink_rcv_skb+0x208/0x470 [ 503.369799][T21325] ? __lock_acquire+0xab9/0xd20 [ 503.369821][T21325] ? __pfx_genl_rcv_msg+0x10/0x10 [ 503.369843][T21325] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 503.369870][T21325] ? down_read+0x1ad/0x2e0 [ 503.369895][T21325] genl_rcv+0x28/0x40 [ 503.369918][T21325] netlink_unicast+0x82f/0x9e0 [ 503.369947][T21325] ? __pfx_netlink_unicast+0x10/0x10 [ 503.369971][T21325] ? netlink_sendmsg+0x642/0xb30 [ 503.369986][T21325] ? skb_put+0x11b/0x210 [ 503.370005][T21325] netlink_sendmsg+0x805/0xb30 [ 503.370026][T21325] ? __pfx_netlink_sendmsg+0x10/0x10 [ 503.370044][T21325] ? aa_sock_msg_perm+0xf1/0x1d0 [ 503.370065][T21325] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 503.370082][T21325] ? __pfx_netlink_sendmsg+0x10/0x10 [ 503.370099][T21325] __sock_sendmsg+0x219/0x270 [ 503.370124][T21325] ____sys_sendmsg+0x505/0x830 [ 503.370145][T21325] ? __pfx_____sys_sendmsg+0x10/0x10 [ 503.370169][T21325] ? import_iovec+0x74/0xa0 [ 503.370191][T21325] ___sys_sendmsg+0x21f/0x2a0 [ 503.370211][T21325] ? __pfx____sys_sendmsg+0x10/0x10 [ 503.370246][T21325] ? __fget_files+0x2a/0x420 [ 503.370259][T21325] ? __fget_files+0x3a0/0x420 [ 503.370278][T21325] __x64_sys_sendmsg+0x19b/0x260 [ 503.370298][T21325] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 503.370322][T21325] ? rcu_is_watching+0x15/0xb0 [ 503.370339][T21325] ? do_syscall_64+0xbe/0x3b0 [ 503.370358][T21325] do_syscall_64+0xfa/0x3b0 [ 503.370374][T21325] ? lockdep_hardirqs_on+0x9c/0x150 [ 503.370390][T21325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.370404][T21325] ? clear_bhb_loop+0x60/0xb0 [ 503.370422][T21325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.370437][T21325] RIP: 0033:0x7f2b6358eec9 [ 503.370451][T21325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 503.370465][T21325] RSP: 002b:00007f2b64466038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.370481][T21325] RAX: ffffffffffffffda RBX: 00007f2b637e5fa0 RCX: 00007f2b6358eec9 [ 503.370493][T21325] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000006 [ 503.370503][T21325] RBP: 00007f2b63611f91 R08: 0000000000000000 R09: 0000000000000000 [ 503.370513][T21325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 503.370524][T21325] R13: 00007f2b637e6038 R14: 00007f2b637e5fa0 R15: 00007ffc1ce32628 [ 503.370552][T21325] [ 503.892196][T21341] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4334'. [ 503.955665][T21325] nbd4: detected capacity change from 0 to 63 [ 503.985896][T21141] block nbd4: Send control failed (result -32) [ 503.987950][ T5873] block nbd4: Receive control failed (result -32) [ 503.998756][ T5185] block nbd4: Receive control failed (result -32) [ 504.010883][T21141] block nbd4: Request send failed, requeueing [ 504.017808][ T55] block nbd4: Dead connection, failed to find a fallback [ 504.026668][ T55] block nbd4: shutting down sockets [ 504.031879][ T55] blk_print_req_error: 138 callbacks suppressed [ 504.031894][ T55] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.051785][ T55] buffer_io_error: 138 callbacks suppressed [ 504.051801][ T55] Buffer I/O error on dev nbd4, logical block 0, async page read [ 504.065675][T21141] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.074776][T21141] Buffer I/O error on dev nbd4, logical block 1, async page read [ 504.082606][T21141] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.091879][T21141] Buffer I/O error on dev nbd4, logical block 2, async page read [ 504.099761][T21141] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.109048][T21141] Buffer I/O error on dev nbd4, logical block 3, async page read [ 504.117028][T21141] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.126285][T21141] Buffer I/O error on dev nbd4, logical block 0, async page read [ 504.134219][T21141] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.143254][T21141] Buffer I/O error on dev nbd4, logical block 1, async page read [ 504.152109][T21141] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.161235][T21141] Buffer I/O error on dev nbd4, logical block 2, async page read [ 504.169157][T21141] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.178249][T21141] Buffer I/O error on dev nbd4, logical block 3, async page read [ 504.186258][T21141] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.195345][T21141] Buffer I/O error on dev nbd4, logical block 0, async page read [ 504.203168][T21141] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 504.212364][T21141] Buffer I/O error on dev nbd4, logical block 1, async page read [ 504.221515][T21141] ldm_validate_partition_table(): Disk read failed. [ 504.230643][T21141] Dev nbd4: unable to read RDB block 0 [ 504.238926][T21141] nbd4: unable to read partition table [ 504.250848][T21141] ldm_validate_partition_table(): Disk read failed. [ 504.258965][T21141] Dev nbd4: unable to read RDB block 0 [ 504.265695][T21141] nbd4: unable to read partition table