last executing test programs: 4m7.697119254s ago: executing program 0 (id=749): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x4008004) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="414601", @ANYRES32=r2], 0x4) 4m7.417647907s ago: executing program 0 (id=756): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f00000002c0)={0x0, 'syzkaller0\x00', {0x1}, 0xb5}) r2 = socket$netlink(0x10, 0x3, 0x8) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000000)=""/30, 0x1e}], 0x1, 0x8, 0xffffffff) 4m7.120934732s ago: executing program 0 (id=763): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x28, r2, 0x5, 0x1000000, 0x101, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x890}, 0x0) 4m4.294009346s ago: executing program 0 (id=771): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000bc0)={0x128, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0x78, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x54, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x84, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x17}}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @private=0xa010100}}}]}]}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'sip-20000\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x128}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 4m4.159230901s ago: executing program 0 (id=776): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000014c0)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0xffff, 0x14}, @mpls={[], @ipv4=@generic={{0x5, 0x4, 0x0, 0x1, 0x18, 0x64, 0x0, 0xaa, 0x73, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x36}}, "d347df9c"}}}, 0x26) 4m3.851445652s ago: executing program 0 (id=781): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x80, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000000) 3m48.720041008s ago: executing program 32 (id=781): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x80, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000000) 2m25.508301231s ago: executing program 5 (id=1932): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@newtfilter={0x518, 0x2c, 0x800, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xfff2}, {0xc, 0x6}, {0x16, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x7fffffff}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_RATE={0x6, 0x5, {0x78, 0x4}}, @filter_kind_options=@f_fw={{0x7}, {0x4c4, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0xffe0, 0xc}}, @TCA_FW_ACT={0x1ec, 0x4, [@m_ife={0x110, 0x3, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x0, 0x10000000, 0x69cc2018, 0xfffffff7}}}, @TCA_IFE_DMAC={0xa, 0x3, @broadcast}, @TCA_IFE_SMAC={0xa, 0x4, @local}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x8, 0x3, 0x8, 0xffffa3ef, 0x1}}}]}, {0x97, 0x6, "1588fe2ed2a4a16a1b884cb6214d5b835bb77067e8eb9c0de037325ee0c90295a809826f9c418f2d54909e35a16f0c4d9607dc7c5ab9e99fb8d2efc652112c6ed43ec9eb24da94505a142f2f12f3b8d390f189a5ff12d713354e0dad7d970af354bf6a89609f14aeda4576e6ab2b60691a5abb677064c5221417bef1dd67bdbd3827b164515e8be41c6607e2e1f04a28d265d1"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}, @m_skbmod={0xd8, 0x0, 0x0, 0x0, {{0xb}, {0xac, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0x6, 0x7, 0xa, 0x1}, 0x1}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0xf2c, 0x2e, 0x3, 0x0, 0x5}, 0x1}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x6, 0xd, 0x7, 0x8000, 0x897}, 0x3}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x0, 0x5, 0x0, 0x2, 0xfff}}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}, @TCA_FW_MASK={0x8, 0x5, 0x7}, @TCA_FW_INDEV={0x14, 0x3, 'batadv0\x00'}, @TCA_FW_CLASSID={0x8, 0x1, {0x0, 0x4}}, @TCA_FW_MASK={0x8, 0x5, 0x2}, @TCA_FW_MASK={0x8, 0x5, 0x2}, @TCA_FW_MASK={0x8, 0x5, 0x3}, @TCA_FW_ACT={0x290, 0x4, [@m_ct={0x68, 0x1f, 0x0, 0x0, {{0x7}, {0x40, 0x2, 0x0, 0x1, [@TCA_CT_LABELS={0x14, 0x7, "4a3c9dd1604eeb144096e643bb17e2b4"}, @TCA_CT_LABELS={0x14, 0x7, "48454ab0b6edccfcc6e0e977ca6d07f9"}, @TCA_CT_LABELS={0x14, 0x7, "681e795e8041437f0d1715c7914586bc"}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x5}}}}, @m_connmark={0xbc, 0xc, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0xcc, 0x5, 0x2}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xa9, 0x401, 0x0, 0x2, 0x3}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x6, 0x20000004, 0x2, 0x240000}, 0xfffe}}]}, {0x38, 0x6, "eefea31bbeff309bef2a2a44ebb3b179c05d221ee22f3d833a41147446e49c9fb839aa9697535788d536db15aed17b5105a388c9"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_skbedit={0x168, 0x1a, 0x0, 0x0, {{0xc}, {0x5c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xfff, 0x4, 0x5, 0xdc1, 0x40}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x7, 0x772}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0xbeaa}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xc775}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x6}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7}]}, {0xe2, 0x6, "309452fc3bfac5bd78773f9a59c6bc2e6c8ea8d7334e7f7d1dad933f72cf42ed29affe1c7784d50472319174639a750b92fba76d84e1e0b5956136369d2fc49bc6e2ae3bcd6f1646bd49dfb8905f7e86046bc02b2e6ec95c75d1e3fe04d9f23782865e24fdd1689b7e1a940d61c15f82f2e74823bb8c9cb9241ce64a44e52282fbba3f454e7f82069c6c7735f8cfb52a1a4d3f327b12b1210adb5d36c40b8e13a00466a04067db00eeb7f61debfe45634c265a44bc2e17c49df9c5d4f3d42b872c1ed451ed27b7642face42bf436afa680cec109484adebcd978c34b4e69"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}, @TCA_CHAIN={0x8, 0xb, 0xe4}, @TCA_RATE={0x6, 0x5, {0x5, 0x2}}]}, 0x518}, 0x1, 0x0, 0x0, 0x40}, 0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0xffe0}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x2}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x101}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xce) ioctl$sock_ax25_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@default, @bcast, 0x2, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}) 2m25.337362344s ago: executing program 5 (id=1938): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000004) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000080)=ANY=[@ANYBLOB="0206000000"], 0x40) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r1, &(0x7f0000001940)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 2m25.142078709s ago: executing program 5 (id=1943): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x5, 0x1, 0x8e, 0xe7c9, 0x1}, 0x48) bpf$MAP_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xe30a, r0}, 0x38) 2m24.913578565s ago: executing program 5 (id=1949): socket$kcm(0x10, 0x400000002, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @link_local}) close(r0) 2m24.484648404s ago: executing program 5 (id=1959): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a3000000000540003"], 0xa8}}, 0x0) 2m24.343159959s ago: executing program 5 (id=1963): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x26, 0x1, 0x7fffd, 0x1000, {0x4}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x300000000000000, 0x0, 0x400c801}, 0x4008090) 2m9.277618219s ago: executing program 33 (id=1963): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x26, 0x1, 0x7fffd, 0x1000, {0x4}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x300000000000000, 0x0, 0x400c801}, 0x4008090) 6.255931395s ago: executing program 6 (id=3759): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x3, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0x30bd29, 0x40000002, {0x0, 0x0, 0x0, r3, {0x300, 0x3}, {}, {0xc, 0xa}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_FD={0x8, 0x6, r4}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0x44}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000001600), 0xffffffffffffffff) socket(0x1e, 0x1, 0x0) sendmsg$TIPC_CMD_SHOW_PORTS(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001640)={0x1c, r6, 0x1}, 0x1c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$SEG6_CMD_DUMPHMAC(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x14, r8, 0x301}, 0x14}}, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x1c, r8, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0xffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x80) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e78}, [@printk={@lu, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffe}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3252}, {0x85, 0x0, 0x0, 0x10}}]}, &(0x7f0000000000)='GPL\x00', 0xd, 0xfe7, &(0x7f0000001e00)=""/4071, 0x40f00, 0x9}, 0x90) sendmsg$NL80211_CMD_SET_INTERFACE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a40)={0x24, r10, 0x5, 0x0, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)={0x50, r10, 0x5, 0xfbfffffe, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_SSID={0x1c, 0x34, @random="9c0597322171a75d23a07167b9e2d06bca1d20f166d6ee7a"}, @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x300, {0x109, 0x4, 0x1, 0x5}}}, @NL80211_ATTR_WIPHY_FREQ_HINT={0x8, 0xc9, @random=0x985}]}, 0x50}}, 0x80) 5.811517748s ago: executing program 6 (id=3769): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='^\x00', 0x2240, &(0x7f0000000040)={@_ha_fsid={[0x80000001]}, {0x8, 0x2, 0x0, 0xfffffffffffffe01}}, 0x10, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x40}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x21, 0x2a, [@dsss={0x3, 0x1, 0xa9}, @mesh_id={0x72, 0x6}, @mic={0x8c, 0x10, {0xb28, "136dae7f2ef2", @short="7b9881b9f3cef5dd"}}]}, @NL80211_ATTR_TDLS_INITIATOR={0x4}, @NL80211_ATTR_TDLS_PEER_CAPABILITY={0x8, 0xcb, 0xeb8}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x2) recvmsg$can_bcm(r0, &(0x7f00000025c0)={&(0x7f00000002c0)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001540)=[{&(0x7f0000000340)=""/66, 0x42}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/11, 0xb}, {&(0x7f0000001400)=""/69, 0x45}, {&(0x7f0000001480)=""/158, 0x9e}], 0x5, &(0x7f00000015c0)=""/4096, 0x1000}, 0x1) r2 = socket$rds(0x15, 0x5, 0x0) connect(r2, &(0x7f0000002600)=@pppoe={0x18, 0x0, {0x2, @broadcast, 'nicvf0\x00'}}, 0x80) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000002680)=0xffffffffffffffff, 0x4) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f00000026c0)=0x1, 0x4) r3 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000004b80), 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r3, 0xc0c0583b, &(0x7f0000004bc0)={0x0, 0x0, 0x5, 0x0, '\x00', [{0xf426, 0x4, 0x7, 0x7b1b, 0x8, 0x81}, {0x0, 0xfffffa82, 0x2, 0xa, 0x100000001, 0x4}], ['\x00', '\x00', '\x00', '\x00', '\x00']}) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000004dc0), &(0x7f0000004e00)=0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f0000004e80)=@o_path={&(0x7f0000004e40)='./file0\x00', 0x0, 0x10, r2}, 0x18) ioctl$XFS_IOC_FSGROWFSDATA(r0, 0x4010586e, &(0x7f0000004ec0)={0x3, 0x5}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000004f40)={'bridge_slave_0\x00', &(0x7f0000004f00)=@ethtool_sset_info={0x37, 0x6, 0x2, [0x2, 0xff]}}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000004fc0)=@o_path={&(0x7f0000004f80)='./file0\x00', 0x0, 0x10, r3}, 0x18) bpf$OBJ_GET_PROG(0x7, &(0x7f0000005040)=@generic={&(0x7f0000005000)='./file0\x00'}, 0x18) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000050c0), r0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000005180)={&(0x7f0000005080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005140)={&(0x7f0000005100)={0x20, r4, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r2, 0x6628) sendmsg$NFT_BATCH(r0, &(0x7f00000054c0)={&(0x7f00000051c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000005480)={&(0x7f0000005200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELSET={0x30, 0xb, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_SET_POLICY={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x104, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x1dc, 0x14, 0xa, 0x304, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFTA_OBJ_USERDATA={0xc4, 0x8, "eee4f025343f8c81645b4d80de4f1ff019d80a1edca1406e40d839f2a7ac27aa11472ad52401cdd845792fa7b42843479c377fd123293edca16c2db1e4703b661c3b8ebfece03557858a38765177ad493a6647aca5bd798a1ee8122f06f804a2dedb30d91be6b095fb744e3412411c14055ba2331f473b957c1fe525591b3c7f26f1e1675753de8bf6e9ffd0ec742ceb8b1d3a05c0013b637cfe712c3717497d740435ac43698cce73a65173294a8bad7cd33685139bcce98e861ee13f0b533d"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0xd7, 0x8, "ad5420fa3c93cd089789af185c1fcffdcd92b3a5fcd194e651c65c1979b48ad780ff5b12bc1555c9f4230241bca4719262b362d087b557bd156c3096e4c5d6801ca4daab18d070665b51844af2c8de62ee356bcbd890cd44443da385cd877878ab2aa5c5f8adf6394e60642e8d61d210ffe59f330ac143d750fcc6e05384584d0b23225ea62767f05351fd5c17459960218e879d0a575e25a02779401f075dc73926bc75a3a297486230867bfd0e39f56a0a2367c542522e8c81810ef1697d258539097e56ee58ea3945ee1440a7ad42865888"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x254}, 0x1, 0x0, 0x0, 0x2000000}, 0x4804) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r5, &(0x7f0000005600)={&(0x7f0000005500)={0x10, 0x0, 0x0, 0x81000005}, 0xc, &(0x7f00000055c0)={&(0x7f0000005540)={0x4c, 0x6, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000800) 5.72046852s ago: executing program 6 (id=3772): r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x81000) getsockopt(r0, 0x1, 0x6, &(0x7f0000000240)=""/161, &(0x7f0000000100)=0xa1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) 5.620012627s ago: executing program 6 (id=3774): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r1, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='h'], 0x68}, 0x9}, 0x0) 5.551489699s ago: executing program 6 (id=3775): syz_init_net_socket$netrom(0x6, 0x5, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = epoll_create(0x3) r2 = socket(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x4, 0x5}, {}, {0x7, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x20048081}, 0xc0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) syz_emit_ethernet(0xc5, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2286dd60cabf00008f3afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3eddf07e26ca0a5c15b37adac15084dbaf736b41e5af2502000100000005000000002600040004fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d"], 0x0) r11 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r12, 0x3e}, 0x80, &(0x7f0000000480)=[{&(0x7f00000002c0)='\x00@', 0x5dc}], 0x1}, 0x4) write(r2, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r2, &(0x7f0000001500)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000000)=@xdp, 0x80, &(0x7f00000011c0)=[{0x0}, {&(0x7f0000000080)=""/236, 0xec}], 0x2, &(0x7f0000001200)=""/97, 0x61}}, {{&(0x7f00000015c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000001300)=""/68, 0x44}, {&(0x7f0000001380)=""/197, 0xc5}], 0x2, &(0x7f00000014c0)=""/45, 0x2d}}], 0x3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000004180)={0x4}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x8}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x3, {{0x5, 0x4, 0x0, 0x7, 0x14, 0x68, 0x0, 0x8e, 0x0, 0x0, @local, @private=0xa010102}}}}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000002b40), 0xffffffffffffffff) 4.574006761s ago: executing program 4 (id=3786): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0xfcfb, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xae0a}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048081}, 0x0) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x9}, {}, {0x7, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x18, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0xd, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa}}]}}]}, 0x44}}, 0x20000000) 4.504181715s ago: executing program 4 (id=3787): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f7, &(0x7f0000003200)={'ip6gre0\x00', 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000240)="94", 0x1) vmsplice(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7c8926dc6acd0ae6c178054e95986faff9544de5fc4c30adf404da41181a77466ac5075905ea5f50134fdd517a957fe2ee59b61f9fe8d7aabe595ea23de2723e437af0423a56686a4c2d957be1a0ab922fbbd3cb1d8c6ab0d58440a327c8eb05d445b4ac5f20abe449e4084f8b996268d0564f67980d3ed3479e0edfe5cec7b4f89bface391c9c4c58ad123b91c33173c72326d1df18804a9ea20f9ece48f784d8ca2318e3d2b3166", 0xab}, {&(0x7f0000013680)="c578381bf5113dad8319d9ea5294285ae9a90384ce23866477bef9de4399237d8b3522c9c194e71edaf3332a2f169682f9d8fa271683d4d441b710409e506333e0c3b64e52e8720734b6787f4a84f5bebb046649c6c697d978affd349031b2cd874c7a8961a586a9f2d62f945e7a5bf2f5f7a31684c0503704881d2578a2a98ac3", 0x81}], 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x1f, 0x18, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r5, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b4003a000001", 0x38}], 0x1}, 0x0) tee(r2, 0xffffffffffffffff, 0x2, 0x100000000000003) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="1401000020000107000000000000000001"], 0x114}], 0x1}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r7, 0x891b, &(0x7f0000000040)={'veth0_to_batadv\x00', {0x2, 0x0, @local}}) ioctl$XFS_IOC_INUMBERS(r0, 0x80405880, &(0x7f0000000100)={{0x1000, 0x3, 0x5, 0x8, 0xb646}, [{0x37e, 0x2, 0x9, 0x5}, {0x1, 0x100, 0x1, 0xe0}]}) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r9 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r9, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x4e22, 0x0, 0x2, 0x20, 0x0, 0x5c}, {0x0, 0x100000000, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x9, 0x1, 0x0, 0x0, 0x3}}, 0xb8}}, 0x0) 2.3793608s ago: executing program 6 (id=3788): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2, &(0x7f00000001c0)=0x7ff, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x1, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x406f413, 0x0) 2.377384206s ago: executing program 4 (id=3789): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0xfcfb, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xae0a}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048081}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x74, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x9}, {}, {0x7, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x48, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa, [{0x1fe, 0x500, 0x3, 0xe}, {0x6783, 0x2, 0x0, 0x10}, {0x40000, 0x53, 0xa9, 0x80000001}]}}]}}]}, 0x74}}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000440)=@xdp={0x2c, 0x7, r9, 0x3b}, 0x80, &(0x7f0000000840)=[{0x0}], 0x1}, 0x4) 1.910243168s ago: executing program 4 (id=3797): unshare(0x400) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = getpid() r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0) ioctl$sock_netdev_private(r5, 0x89fb, &(0x7f0000000280)="9adfde7402abcab646e8d8e1280ea60565ca42bd") syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r7, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 1.877298439s ago: executing program 2 (id=3799): syz_init_net_socket$netrom(0x6, 0x5, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = epoll_create(0x3) r2 = socket(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x4, 0x5}, {}, {0x7, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x20048081}, 0xc0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) syz_emit_ethernet(0xc5, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2286dd60cabf00008f3afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3eddf07e26ca0a5c15b37adac15084dbaf736b41e5af2502000100000005000000002600040004fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d"], 0x0) r11 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r12, 0x3e}, 0x80, &(0x7f0000000480)=[{&(0x7f00000002c0)='\x00@', 0x5dc}], 0x1}, 0x4) write(r2, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r2, &(0x7f0000001500)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000000)=@xdp, 0x80, &(0x7f00000011c0)=[{0x0}, {&(0x7f0000000080)=""/236, 0xec}], 0x2, &(0x7f0000001200)=""/97, 0x61}}, {{&(0x7f00000015c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000001300)=""/68, 0x44}, {&(0x7f0000001380)=""/197, 0xc5}], 0x2, &(0x7f00000014c0)=""/45, 0x2d}}], 0x3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000004180)={0x4}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x8}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x3, {{0x5, 0x4, 0x0, 0x7, 0x14, 0x68, 0x0, 0x8e, 0x0, 0x0, @local, @private=0xa010102}}}}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000002b40), 0xffffffffffffffff) 1.31762224s ago: executing program 2 (id=3807): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0xfcfb, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xae0a}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048081}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x74, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x9}, {}, {0x7, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x48, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa, [{0x1fe, 0x500, 0x3, 0xe}, {0x6783, 0x2, 0x0, 0x10}, {0x40000, 0x53, 0xa9, 0x80000001}]}}]}}]}, 0x74}}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000440)=@xdp={0x2c, 0x7, r9, 0x3b}, 0x80, &(0x7f0000000840)=[{0x0}], 0x1}, 0x4) 929.658828ms ago: executing program 1 (id=3811): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x1, 0xf0, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) writev(r1, 0x0, 0x0) 725.024408ms ago: executing program 2 (id=3812): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 724.597555ms ago: executing program 3 (id=3813): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e24, 0x8, @dev={0xfe, 0x80, '\x00', 0xa}, 0x3}, {0xa, 0x4e22, 0xffffffff, @private1, 0x9}, 0x1, {[0x10000, 0x7, 0xffffff80, 0x7, 0x5f88, 0x4, 0x2, 0x17]}}, 0x5c) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x37, &(0x7f0000000140)=ANY=[], 0x0) 624.075764ms ago: executing program 1 (id=3814): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x1f00, 0xe, 0x0, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0xd, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2", 0x0, 0x0, 0xffffffff}, 0x50) 623.773555ms ago: executing program 3 (id=3815): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x37, &(0x7f0000000140)=ANY=[], 0x0) (fail_nth: 1) 592.327343ms ago: executing program 1 (id=3816): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r2, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r3}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r4, &(0x7f0000000400)="e8", &(0x7f0000000480)=@tcp6=r1, 0x1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r7, {0x0, 0xfff2}, {}, {0xa, 0x6}}, [@TCA_RATE={0x6, 0x5, {0x3, 0x2}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x22044028}, 0x8815) 567.981653ms ago: executing program 3 (id=3817): syz_init_net_socket$netrom(0x6, 0x5, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = epoll_create(0x3) r2 = socket(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x4, 0x5}, {}, {0x7, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x20048081}, 0xc0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) syz_emit_ethernet(0xc5, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa2286dd60cabf00008f3afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3eddf07e26ca0a5c15b37adac15084dbaf736b41e5af2502000100000005000000002600040004fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d"], 0x0) r11 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r12, 0x3e}, 0x80, &(0x7f0000000480)=[{&(0x7f00000002c0)='\x00@', 0x5dc}], 0x1}, 0x4) write(r2, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r2, &(0x7f0000001500)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000000)=@xdp, 0x80, &(0x7f00000011c0)=[{0x0}, {&(0x7f0000000080)=""/236, 0xec}], 0x2, &(0x7f0000001200)=""/97, 0x61}}, {{&(0x7f00000015c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000001300)=""/68, 0x44}, {&(0x7f0000001380)=""/197, 0xc5}], 0x2, &(0x7f00000014c0)=""/45, 0x2d}}], 0x3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000004180)={0x4}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x8}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x3, {{0x5, 0x4, 0x0, 0x7, 0x14, 0x68, 0x0, 0x8e, 0x0, 0x0, @local, @private=0xa010102}}}}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000002b40), 0xffffffffffffffff) 509.349211ms ago: executing program 2 (id=3818): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'batadv0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x7f, 0x0, 0x0) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r7, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @null}, 0x1c) connect$rose(r7, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000340)={0xfffbfffc, 0x2000000, 0x5, 0x6}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000120001fbffffff000200000007"], 0x24}, 0x1, 0x0, 0x0, 0x40014}, 0x14) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'wrr\x00', 0x15, 0xff, 0xf}, 0x2c) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) 413.616934ms ago: executing program 1 (id=3819): r0 = socket(0x200000100000011, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x800b, 0x4) sendmsg$netlink(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 340.907325ms ago: executing program 1 (id=3820): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='^\x00', 0x2240, &(0x7f0000000040)={@_ha_fsid={[0x80000001]}, {0x8, 0x2, 0x0, 0xfffffffffffffe01}}, 0x10, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x40}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x21, 0x2a, [@dsss={0x3, 0x1, 0xa9}, @mesh_id={0x72, 0x6}, @mic={0x8c, 0x10, {0xb28, "136dae7f2ef2", @short="7b9881b9f3cef5dd"}}]}, @NL80211_ATTR_TDLS_INITIATOR={0x4}, @NL80211_ATTR_TDLS_PEER_CAPABILITY={0x8, 0xcb, 0xeb8}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x2) recvmsg$can_bcm(r0, &(0x7f00000025c0)={&(0x7f00000002c0)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001540)=[{&(0x7f0000000340)=""/66, 0x42}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/11, 0xb}, {&(0x7f0000001400)=""/69, 0x45}, {&(0x7f0000001480)=""/158, 0x9e}], 0x5, &(0x7f00000015c0)=""/4096, 0x1000}, 0x1) r2 = socket$rds(0x15, 0x5, 0x0) connect(r2, &(0x7f0000002600)=@pppoe={0x18, 0x0, {0x2, @broadcast, 'nicvf0\x00'}}, 0x80) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000002680)=0xffffffffffffffff, 0x4) sendmmsg(r2, &(0x7f0000004ac0)=[{{&(0x7f0000002700)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f0000002d00)=[{&(0x7f0000002780)="635428d865377f1ab8d41a0313adabc49dc8e2c6a23499a32c5f6e0ca479319b66227274dc6ef0b4f4ededea0de39f", 0x2f}, {&(0x7f00000027c0)="29c11078c73cf7def5493c5f3492a449dde8050ee1b9b24da411424d173f74ecb195d92141f2cd2ddb30442775ba34159c827f4d0f948cd02ed29bbe86c0bebf06f86f31b4101ac6bb03a724aeb7af3ae71c252b5aa95352402ac5f2079138efd91d56d96c589dc58a29f19ff6a58d6729ced0b946b8b22c45fd4484e89e74d4d5868f7d71676730aa98c0ca3e9ef55ab4f97081e0f948c23e9c7519aa1cb919a78a81bc371a8aeaf7173ddb4533b68bf15a0114c861685cfaed34d0999f25fb9afd24509fa2bc1a21dc1ff4c0", 0xcd}, {&(0x7f00000028c0)="add5dff81921364e95b6b0ed381c5fd474424c3c07745005e4126ecabf4d1c28d3ddc3a426c64b23221d4e6d95fe4d6a150cbad93c2283d78927c9156f746d8cce215deda5957b0846f7562ce62297e7284824251ff61cd13239914822fec454020a82c0d76d646369df9fd5166b0f34a34dca046e02bb5b58b300c840b66fa6604ef880f8f2619a20de4961d43b8ad6b5e3e461eb3470d70f847bcc6fca4c9bba391f356dd145be3c10062aa5194783fc07fa4c6a1cec4caa", 0xb9}, {&(0x7f0000002980)="82fb0b225304795ac2516ce2c92c52b499347bb5ba880f33dd074401197cca74bce12aa33e1abde30471bd1fe01987b12d540fe4caf913aed43ecf104b8b55e664e5ff1947ddb51b51fedcc8d70322afa85f23aed418091fd902b6b7922a845232a14e28a93b01cbcb5bd93a618b163c51ed5be6c8c4d97f0970a016e7741e7d4199be8a4c5c78fd70b034f5b48b13a1a117ae5a4d8098c1a937e1b14a5a289d5c4977c0bf8d7fa440d8cb37d446e63c0dc0c6a71ba43f1b6403cdd36f0d58d1707d8d82a97fbcbbb862ef", 0xcb}, {&(0x7f0000002a80)="96a07ab284986871c6bfbdf0d057e45d3d7ef4798467bfbbf1c51a9d8214e852d2920ce3b7fd31945a61283aff20ee80387be4da2ee3067c550ae1f6ed1a1e4561a68b41bb111bc2362e6add1828e57050006b486e63d1dfb36adc315a842cde6fd105f5d1", 0x65}, {&(0x7f0000002b00)="f4293ca1364848d2b97e56babc38b29ab25a67876a140e900f3d84d9b9d5a0d65b2682b82f876098cd604e9db9d8a7459aea1921c5f45407432e6febbaf6b22af838e65546d0519e665c6f07784c40c9d9a1e072cc9b031b45b71d6794598871ac179f2dca55d2d480d39d3cd15c2f2c78b2e2e0867668fb4760b9bb1eeb020cca871890ddaf494210a58929e99985df4865e2b027", 0x95}, {&(0x7f0000002bc0)="7aedd0bee7a38f6359f9dd3c3978d00f7b0515e83e52bac55f6c5538f8164e3a8923a08b61adafe3e110bb376eb54d799bf491d038b908b35432ce8c9d69ff8e564ee6f40ed231d180c30c9c5245cd1f0da15dfbe71b5f14432e20cb7838062fd2253cf61f2446b5419e9f4c086a09a7abde9c51918b3de0cb61fb816072584efc5e979d3eb840ade71c7753d315b72e5c92398ffb0cd91a301d78ef9bf8b3b34c6795ca527360b77877f15d23de711e7b000f9a8ef810700efcaaa37526", 0xbe}, {&(0x7f0000002c80)="93b07feb42455477ade0b08218275902a99c1c80db363e8cfd157bf5a259f4842932c1eba674394c51b4999718a0ec4e7a0108e3c72704d795e3f1ca3e3a607e6292e40fb15e5e5e52d583c60f630f3b", 0x50}], 0x8, &(0x7f0000002d80)=[{0x100, 0x10d, 0x2, "04e4b11d1dc3438bd3538608a436ea437176d8e66d184b213a2f8721e8876e43fb34b6a9b45777535d47cfb9369c600d765860c7cb7477b751ed8c3925fc4598ab64c08853e294508c26d3011ef1225c9543adc69fc05ddee0377a5b3c2161f1bcdb3ab7c2534fc21f9841f39cfba14ef390cae138c681443596b7c812656ef25b18d5e8d3f4a117cf0f489bfa9017816903b3b8af042d2453142154a84be24fbde0f081f5e09e4f8e04994a9ee1ecbdf9a356a64d6cb79eddf8afde344bc590a83796868256f121b291650fb64402563a2755d3c6ec9992eb0f236573798eec20e41abd65bcfe96f21f3cbeeb29"}, {0x60, 0xff, 0x5, "7a37ff3fc4a11eca2ba8c758221be7d2a5ab1efff6746703c285b74e5aef2072b84b0569e82aad523fb9d791a18b034e2d04b7a0b2c636b8860bd93fd29df1fc32a6acb1695d8b51ccf0453086b31806"}, {0x38, 0x1, 0x0, "6ad57092354f15eb932839170870961f674e52006d0dc2c1483692abd7af6a58d0cb87fa0c58"}, {0xe8, 0x1, 0x7, "4798b216b559c46464ab3c1168b932e3bb10012b123e696672c91db03b29efaecf2974d995b3c1a1b1b6ebf768bf8cd3876cdc30596694cbfe54450bf501ee448b25f84bc415273208607cbf05c9d0167e62cb3be3afddfe523db509878eea9d1860fa4a638714c29658ff0b9ce52a57f3b50e06001ce7626050acf52e356d6d554e77a5f2e4e0f046ba45242d526475a3f71e1032a9347bec16c0f847aee910459595ac049db90380434e3e8d33d89985522a52059a9a927d057118056d6c24e24f4f5b90f88235306cef6107acccbecfe7170e7b75"}, {0x30, 0x119, 0x1ff, "08a29cf4375f235b7ae76f05d5669d21a83d4ae331bd01efd2e3210184"}], 0x2b0}}, {{&(0x7f0000003040)=@llc={0x1a, 0xfce5, 0xf7, 0xa0, 0x1, 0xac}, 0x80, &(0x7f0000004200)=[{&(0x7f00000030c0)="efe302a272c6311f81e022498c74714c02906d4d47d6d5d63ab4c6d05b8e038d288da0fabb9594ed9cc5b79531da847eaa6e16d3a6b9bc3f3deecb3cb40e6bb82f60a4e615dffb1ddb0bf6434313a04abac84e1e494f4cd583da25f42b6f55d0192bb5d7637cbbb3d5ba66c4a9b075415f797d4251e74d1a75d6a9d780a4cf691133916d6433594b9994981b454a8fc386c35499e212d4f3d7785533c9875bd0bd2454fb97972860cfe7a6a28cc32d7a6c05e3ab1000b1a99e77b926d654a706dd620c759a33be00a7606aec4facf4ea95f7f4b975debd60d32214fc7f104df6975e383214cb3f6d975e3d541995870d", 0xf0}, {&(0x7f00000031c0)="c0a67e0ba7619f4ac72189ba274d7563fa657ec9ac53c81e1970cbf48a839bbab20dca96fca77cec7bbf013f82cc3df40e2992b586", 0x35}, {&(0x7f0000003200)="78e610e8c7f28c38dc0b244ec7d157d5b9c04419ede51c383484e1e2aced0d173f1649c22d59e11690de7d9e88f16277d2739d793416b91c932a3f513a190eff1d40f0847d02218c329668468bca541c31008d5f5340b2b6334cd87637b78e36a422e42be42ca88b9078001883a38c49a62245667626e614008f114841602dc6ccd9bb6b3bc003de991fc4ea8cd673dfc4b2be6c62f5581ca4a357af9bb9e30d4fd2daf261095ea65bb42867979a2cb3953f55478e7d13fc65d27a4c2a85b67164571009cf2cc7ca27931c780b2c67465562940a188a0c2bb0ba00c2934015bd526abe7df28771d0dde1d4849e13f1eac656baae2548858a8c962ecc1b20a6c9571b032e402ead84cf0866a361abfa8037198a0067889c8a907ddd155cdc496272e0bf5876486eeb9796e2e3ab5df9bb21eb6a3ab1105c8389570f9d206814ab0447e5e97bc58306646900158cefdfdf5aac437eac0aa31b48c72b55e25082e94e0c840b09c256855ced0917b42683cbeab38e9c5b45d18ea070741ef38f99d08dbac290213e74055d4fdbe6cb1b8521f23c2e8c856676db4116da78c0463c3888742800ccdb739a6d8cf071247163bb8ef3a24403949bcb0a8e0d73002b3248f8dfce19cd52d1addf78a66e23a2dbe93bebb3e1c6f380c261bfbb7c48f3d209d318900e761d6db83bb06ca9600bfa3c93a612c45b5493e76a11a0d52bff7ede3a734aa5441c3c3fff6a538fa03e34a3496768fac69e66df989a47d43bc0e94e99cca0976546be5d300e888577fc261184fb9be6a6ecac6951165f8f36737b132becdff5be4ccb0e9054ee0c449c558f6a058767b6b9b99230f61f86c30e3b58c66b940b7139437f276c16f2263a253baa932671f126fb8a093ed0b505c13ec2e13375bbf63c5c616c1e0ffc1055066c442a33f7a6da5a082f9ca11500da1ba361e3c1ac8fa7f3a872aa5c654214636e3815d47c407e91a7e745022829b2a707dd721f8671ab1f2b430ba691178d75d96a3e46443fb466d23cf0c0e8ce5169a8c3f657eea2cad21ae126a94753bcd296bc9185f204cf39125b935f08634418490f6e9873ceb9fbef9c9378377057b3131d8fbad8225718a2117ab67e1456b099fb5a7137268d688d72b4135300a3063eb12dd7b82271716e1831d01cc58db9787b42798e6d18bc8a4b269afea3285e4269e59a043e43d757a5bf20092ceb66acaa6e34c796633d889b97998032bd8e7272506cfc930ec4d3fd058272cf709d981c69ec9dba60119220ec217b12ff7c60ad4c6d27cc52bfe5b87cbb2f6424010ab42914afbc2ae1be722fb22d04dfb9764fa5626eb732c23b709dff3fb6c4feb27bbd21dd3f9604ee94f05db64fac7d92bb6b0f7acc423abf9cb72a9a20b05d03932dce6883b4b9c32217d68c0454735be4f183dd5518a61430bb9e698e90f45b0be59252ce786aa69e4c048379c600a63db1b39b076a84057da9077963a39facf3eba8882af404f71bb8e8da20ef40eb85ae3b382ba750ca4d2d315b47d2add957423c4ed6902aad1f85da3127c0c94d1f8d07d4e301ff279bebfbc5fe210698b6b38bdf207a82d6c2f94ec148618faf141369fa65fd42d623e26bd5411c0c283f12e8d142526bf4e2858af96ef5812194b850928966c963a8807b58ef8e12a74c8d422c749761503aa689ffccb9b36c0f3b91ca6876bd11b591b6753b40387fe2e4b1d3a8fab2eaa786902679dcffa845a12e13033a210d2c65a563778e6e5fc6312705b628a3a7ddabb43aef271da22dc7247543debce860c32dd66620f7d53fa69e138448c118be8d21e17ef1fe2d71df62d2d15f2051eca0752d3621cedd195c3824472696c811243b1e06d87d0aea3a30e83c90c640e8dca1b72c899703e2dd9ddd02fdc132f1f675851719696a6bdd35411d0fa286407e8d3d763f0ad9bcb801d58edef19bba14226c1db2352327718cae36391d935179776217f8fb8a09854b9088ce8bb58b37366b78485abe5517cb0a43b4c18426b3a25087286efd630d46beab45f11589437f1e804dd17b8de791806f4bef060f5bb0b5eb32665eda4303272da6fe58a84e12e933cab3aad04ee045e16cceaff02af95f9616741c12323fe97315cd42f94de0b863f3ee1cab3458f357760d5c2399da195ef132d2cc4176e19f249c2e1813f032b61f97477ba1155545478432b6beccd7a67ca47aea93bda169d54eb5414a57c5d9b3b4894928d6046681e632803bbe5ccf64dc1037b9a2b39cf554e958bf68a50c9fe57cf565baf2f6a811f1ee8f6004150c75744ffd2f03ba87b641d24502060476e5478b6f54083f12e36e45c28d850fbd5e280fd0f9b6a23b31384c3a54975258e3803945bd7637d898d8e3bd937d3e2522b2009265a19a6d62e00900e4c91151758d8b6ae229c0aa6c8c0085097e4087e6872f18c6b2faf222b2ff5d1cf9177ae27a71443e6925707d223b142453053ff2f3bdb81f23974d61b1357b246855183708d463c5c8503d7876c275a6cf47759b3baaed60cd8ab9c74803ac98a7d2125d420e5d0cdf575d3651c0ce882c73ef9f792b2c74bd4ff8312cb846e446b3a525e91c19a6c0db8ae37b1ae7adce5348127aba702d8d2d0a28c4dd3476ae84ec0609d85c2ee59159deb5ac8696cec60375252293783e3bb8c1d07f0f71def61439e654b1d00163dad8a2e148733828d253ffa3c4949b2fd6dbf59381e0935e8cc749633fb83547697c1a14edf28021ea5bc55dd622c074f80b8ace5943aa96a78f8d8f35d483b13df3a35e963e5b081b2a31458c407007b14627a123f1263075ab0ef8bbc6fdec1886732b76c033f11205ecffbcd4c637b025095971809d9c5ffd480a89c362d758d18764d7ccab90c3159b161a22700e415201b94294271d18f128223c6dcf187abfd7a3b46284da387038861185398556b5dea0d2b8bbf6279a6fc80c71562a1ea72256b2a67b5c28c2381b5b021ad6a9ccddc9fb9f10c24265beae136385043a664b5db84ed59fb6bfd24b4e3dce0a2e88f7c89db84dee5d4af0c638e8be85c0ea778e4be7175b9a8e2379115339d6b18f1aec380d4decdc5b9d277ac8fb1c15085b3151ddaff83a9dfe0205f2552b9c52d4d97c93fe200766512b17c9196985eaf91a2f5d58b70b1cdf8bbe388e0b677ec6e8619d42d1ee63b5a19a948083eb208be92ea901e48e9ebadef17268381d50d2ae800e138cd5933e31bd330c9fd08808c7eceebec3be12fdda702b5dd03938db8849a0ddfc0651a005f943e21a7ace5387c2c0d5ae03a02140e8ef68c23a2cbf35bfad79febcb3e27cc47aaaaa0278f0f3c526bdfbe91a5828e82f09a48bcfdd9d7a1afb939431969be02452574e1f8f536fcae7865d7d10ac0ee0ee3ecc8369f8f65f21e8fcf8cd30572d952b408049c650ca2c3c8dd7761c3bf538b7b7eca3bd73919bbd8084ab3c20d22fc3ba2ca9019a076195ff56160d5408f50544dae590a800619cfe44755b31eb83ae0a51ff5b6f4b5901952c89e4a45605d12a5569098b0e536cf0f271915cc09b68e40a600e5b99c61525ed07793635c4565ee0b40ccac2088eabd701fa9727bad2b43765bfa0002ffde79bf014547da704aa5a56610a978566534ba133aef4dc9bc3dc9772c7a4a9f92638972d46694b9460a26f7678e9f14a5a1298dc07e6db8048ae5736f6f39f8c03a9b29e518bb25bcf0cd2627362c21df83125e1eb4b0661751333b46a25abbfa82f48b0bd513294aa50d8d1e796e80077869f4c19def868fea3261e5a7a395a58347fdeb691b3ebe11f211b7e0cc153d7fd9f828e921f565ed9425564eeeec47fb8a0063f3aa8d89097f6a4a1abcaa4fbbd052971d90c306c90389ede7d9f185bd18fc49800f5b23701199d13bd39b74c86f2c1cd63dbc5bca2e4b5f0a269eefb146b82e495974df8fef7991ca886a371c21582423151da5eba1206ea79ba432baada07edec5256258911e2529e21366439c708de6de72ceea47486bf624e918332d7606c3dff44198ac5f80f0a76985cdcd931c2c6ed37b5ec8c9d207acd7fe815f08a4f701ef9d11a5cd845097f741f41da70d15d2a82e3d8d3be513225802ff60c960c491b409a519b7d554721b110493541f4a06bad62fdd79b92bc45eca098c7883b82a03395bdd8e5cbd479f60d3ab04359613bb664d212e6423b07aa6d2f2687b19736ab263c77bc70608182f51554812a9292f7f71feb656f883128210c6913096018d9b3d6892efeff659c102802e7f22d2b363280c76a6840f9c78fc2a22eb7051a92b15f6057478c60ea72a6518c551359517aa1ff92a07e3e85fa87d0698a383696b4444aba064c16b987a1050cf2719b5da725e4812eac9fb762ee1d6b5fe33f128258ad009413cf3f84f4c4332007a5e34f79982192d61f9b8564561066861d4b1769f9566028087957ea0f88b20942d23137d9fcd87507670f10562fed7862d5dd3a3add56d79879ccd02abb8ae9e4df1c32c36321fe4048e9a7767bab4035cc4fd17450858307a0fe3975ce6e1703e8e1edf4ced86a607c9fbfd902cf0bbc0bc236348649055800db931111d3b8f9abbe5af1e1e21b1f2ab13ec612d25d263c48d0f1d2fc5888a9aec15883f202c9167cdaf4e3a93859bed09007b978a5190d55539c46762993d1c42f4430c0d75c796cf3b5c4453550dfa313ad91c6feebeae97046a13d6b223a43ffb142439769a227ece32937a664728a17669e0ce823d25ec1c2f73e6763ec3d55b0ebcf3aa9fbb4660d9ea3fe01ca54f077a8c9b7559de24613b5c91879905e9ae69941b8607c062a6fe4d01a6b342332f1fc75055f685b421a2c9afaab6ba0d619359cd5a5517952c0f93fa5691caba43096f8892efe69e22bd36d97969d25c3d838429877eab9db6f94ca5303f0b5efc3c53e8d10d5033dc539d857df80be7a2fab5ff98e9fe395f585b86f8687f7e7291d5beef893fd5ad7462903cc2f74e77fbab23d0a893a206b848f41442842754a940692365ed355bfbfb8222e66f981d3601ab35c7ddf683ade817ed30000eab7f6c7f68282b5e4b02624c7b746f5f894d82358f6e309d4d5b6296e934446ad13bba25b701d78b01be1299d42759b8dfe59cc371e5553262b2a37382ef3aee08367f0e9cd5b5b14be542b03e97471a67ccdbc2309cf3fe2d8b433089d73182f0470d1784f15c151e47630e7d3f3d5293ee36d1062078d3fc348d83ab10e5abd427818dce728a92752540c0ee5ed116fd8519e9d6d7d780103bda98c331c027bd33fbf60e48f54b232d0bdd2cc5bdac57776ce805f410ddd3a9eaedfbeee9015a91d24c1cf6bd91d724c5d51e8525821a3b3073fcd15c6c0bdf9456a4cb6d6eb632bfae70a5a5aae71f10897e24362b743b9ab0a7b174bc823972a199fce26d283a26cd7be1eb413ee83e4da7faf9311fc8aaec0a241dda6c6924143f26984bb0a66354a953eb3fba7d20fb21741059f3105bd6b71ecf76d94c419835b1205a34676fee54573a9ef6ca254cb09f322f311443f4d63394f11d803897be38d871e3742cba80df2408683161f5542e173c97148083b1b7602a47a1b1c95595e0a3cc74acc91e3c1c8503702af3c26ef640aa912b2c2d89b8fb7c6f5530ed939dd8918a208f33b4fc48bb6ccd6231d91b7e81515f720dceab9c49602ea2906f08dcbc2ed7b2ee8bb842709d5985a4b5ec5a94a46f2c91249bd9a17b2f1c66d94f789b79b3d363e37f7f1932b90dc087279af24a5c471d2c335ca433b440b879832267d", 0x1000}], 0x3}}, {{0x0, 0x0, &(0x7f0000004980)=[{&(0x7f0000004240)="01fcef09995d49567de39cfa77a2b4aa", 0x10}, {&(0x7f0000004280)="6a627697bd2f5778a6549f9cb4edef960e7267510476bca43fd3cf5f1e80371454db59b750333798f3ca4542b72d4ce648e95494d903612a5b6324dbe3ceee2127cc09ded9e9d93bc1d0181dff37fdcb41c2d9851bf75b9bc18b17c7153dad84b299898e868413a3785894261d85a4b95e0af5ec09959382eae637e7f47a6f3ade2fd5cfe87299fc7f1d33af4d0bf1f83c824ae05956d4c512c37a319d3fead5749735c0bc59e68d46359d3c9d3ac7e9be1cdc19cbaf30fddd3676fb486fe20f4a69a61c08216322daf2bc7110ef23c1d6b37f04cfda5539aab4b639faaf3db8c4f90aee4ceee305a8002676689a010e1166", 0xf2}, {&(0x7f0000004380)="9c4b02a5feec5b8fafb0dbadf82973f274a1a46c6650c027f6f6f8dabcba973a70379746bb1b605aad3259e3c44952b43071a4ae992e7ed00f88cef6973d11fa09df41130b150d654f576585161027187c7038e9791738ca66b2c8a0d6601bdb63979add03adbfe4927940bdab47958f822da631003e126ee84c5f9cf49f29bf8c427f15655001bbe19f271471109832809479c75e8f265496ce3a43d252c8e12cb1e65fb96c45885195", 0xaa}, {&(0x7f0000004440)="0a69179c217dd2040301b5b35f3f18550afe31046122a8bd3741b6b9565c431d2719e1167bc1e19fffc6324a1f1f363acdb0c51ad425fa758273370542319b1090081c72e34974fa7842f0c78560d555b0f30362e504e293baea0d6a852a1501f42d2097177aeb6182146564470a270cbed3bd39676bb7b524ebd7d9e8bd666eb4434fd5ad6dd57db20cf3853e0f62553df8765af4e37672cff9c20c5493568ec9638e7c4f9c219260260f623e61fee35f66a4fb186baf8c2dc2d171581c2b166d1d4a32dc3eef7da0", 0xc9}, {&(0x7f0000004540)="2887b324fc4b0b4c266d79005f5c93a6fca03bf6abef5cf72436495ba7072e07c8e7116906e99c93aaefdceb3a72f543b7f6064db12bb2ba6873b778d76c7c851cd72fb54f26607338e308e9cc193e623812d9a1e3908345a8da7b3ce455c75b72b567380930ae759966a71886f341a285fe4f0c0ab6235f1654432e25cf7f28fe7fb4e5f0ea5ef137f50cef2c1682da9cf9f70a166c4deaef2c397fcf5724d4544447f21bc0dc5095f5b1615ccb8348749274cd29c6f5215b415e732734dafb9bbe70e572831ea50e58218cb7adbc313d0208", 0xd3}, {&(0x7f0000004640)="e65a5f9de49de83793c31a65fab7ec74ffda7ef59a0deef0d5c03eec59285652db469f85d2004c54b9c86933d9e5aea88d81ca22fa0addfa10e02d0c4bfc77b07c7df1d507a87f306c1b74f2377907a6f83c3837415f690d57866d4dfe21901e650ccc9469f42404d9a70c58cd67688c8e4a5445776438bbfef5c6d982764adfa88e1969e346fc3a018b", 0x8a}, {&(0x7f0000004700)="78caa31cc5c4", 0x6}, {&(0x7f0000004740)="3e9f376682872777d03cb043ee60c4373fdb8a10ddc8d0a1d5ebe3d446750daf73ae201495db49be4f0887806e0afa0ff0e1cae119b44e01094871af0c98ea71c186107b3197616e0bfcd658117794b0288e16a367abcc427eeee0c94756b7e0e65e3a1c2d36ce01ee8ff601ee83529acfa77441921358b96047eccc5e42319e87f6a219ed3067eee50c0c17556a561d2153551dcb65f817fb148b42b2573bf6eb242ea185d0a28d29fe7d3befa0a0ac17d1804eef8f6189f5ed0a70606748d6a1413cc1afca8101dc9622", 0xcb}, {&(0x7f0000004840)="caa285796f95e76b315e8835197e777c2097b6f57632c3376f3a84b3bf6a8943c317c6e58f277d79fe7fc2562bcffb936a43a38fe0fd2bfecab268279a41fc0e19e7d36ca7ff4e93f02d606ccf5b32ca4cffaa341e4206e31681", 0x5a}, {&(0x7f00000048c0)="4b48fdeee41cf0343debc49098e4b07bbf6376f4c6282f4402f3f35632928d8d198987d5cec789e1823198cf6b9fba716fbeb9901ba469319ba1b6b8d6f8a14ef71d8a85ddaf6586399be11cbfec4c812df6fa727eb05181103b891e6e26ad31dcf998c101f5accaf65d352282aec25ca10d06ccb2e8a59bcaaf3f3321def035e78310ca622bc520ca5ff6b6141147a38c93102d5759d303be51f8fca514db486a0e440531", 0xa5}], 0xa, &(0x7f0000004a40)=[{0x50, 0xff, 0x4, "7368b8935b39ad81419487b0637cb9034a7c6deb6fbedf659c1d1de21135898d834da112d6c5bd33c876752f3ed31da4023be97310ab55f06377d25861"}], 0x50}}], 0x3, 0x4040005) r3 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000004b80), 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r3, 0xc0c0583b, &(0x7f0000004bc0)={0x0, 0x0, 0x5, 0x0, '\x00', [{0xf426, 0x4, 0x7, 0x7b1b, 0x8, 0x81}, {0x0, 0xfffffa82, 0x2, 0xa, 0x100000001, 0x4}], ['\x00', '\x00', '\x00', '\x00', '\x00']}) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000004dc0), &(0x7f0000004e00)=0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f0000004e80)=@o_path={&(0x7f0000004e40)='./file0\x00', 0x0, 0x10, r2}, 0x18) ioctl$XFS_IOC_FSGROWFSDATA(r0, 0x4010586e, &(0x7f0000004ec0)={0x3, 0x5}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000004f40)={'bridge_slave_0\x00', &(0x7f0000004f00)=@ethtool_sset_info={0x37, 0x6, 0x2, [0x2, 0xff]}}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000004fc0)=@o_path={&(0x7f0000004f80)='./file0\x00', 0x0, 0x10, r3}, 0x18) bpf$OBJ_GET_PROG(0x7, &(0x7f0000005040)=@generic={&(0x7f0000005000)='./file0\x00'}, 0x18) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000050c0), r0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000005180)={&(0x7f0000005080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005140)={&(0x7f0000005100)={0x20, r4, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r2, 0x6628) sendmsg$NFT_BATCH(r0, &(0x7f00000054c0)={&(0x7f00000051c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000005480)={&(0x7f0000005200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELSET={0x30, 0xb, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_SET_POLICY={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x104, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x1dc, 0x14, 0xa, 0x304, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFTA_OBJ_USERDATA={0xc4, 0x8, "eee4f025343f8c81645b4d80de4f1ff019d80a1edca1406e40d839f2a7ac27aa11472ad52401cdd845792fa7b42843479c377fd123293edca16c2db1e4703b661c3b8ebfece03557858a38765177ad493a6647aca5bd798a1ee8122f06f804a2dedb30d91be6b095fb744e3412411c14055ba2331f473b957c1fe525591b3c7f26f1e1675753de8bf6e9ffd0ec742ceb8b1d3a05c0013b637cfe712c3717497d740435ac43698cce73a65173294a8bad7cd33685139bcce98e861ee13f0b533d"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0xd7, 0x8, "ad5420fa3c93cd089789af185c1fcffdcd92b3a5fcd194e651c65c1979b48ad780ff5b12bc1555c9f4230241bca4719262b362d087b557bd156c3096e4c5d6801ca4daab18d070665b51844af2c8de62ee356bcbd890cd44443da385cd877878ab2aa5c5f8adf6394e60642e8d61d210ffe59f330ac143d750fcc6e05384584d0b23225ea62767f05351fd5c17459960218e879d0a575e25a02779401f075dc73926bc75a3a297486230867bfd0e39f56a0a2367c542522e8c81810ef1697d258539097e56ee58ea3945ee1440a7ad42865888"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x254}, 0x1, 0x0, 0x0, 0x2000000}, 0x4804) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r5, &(0x7f0000005600)={&(0x7f0000005500)={0x10, 0x0, 0x0, 0x81000005}, 0xc, &(0x7f00000055c0)={&(0x7f0000005540)={0x4c, 0x6, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000800) 314.853264ms ago: executing program 2 (id=3821): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYRESOCT=r0, @ANYBLOB="763fe0958c1068275657f4cec7ef32093223d41c77c3f1c19d3445bdac263038308847394c63429304532aed04686a000100009ccb934bbaf333b56d22656902021fefefcf69c67e7e6b0632d6af48806336fb7cd92cf4dd83c2685714de2de582bd0f0a88acc9a9bbd96a9298a4bc537ada0937d010585f5489895e46b3693000e6fc0dac4be4d8d24c3262d15550b91ac2d8c6e1bbbb6d453cbbee674f8068f0c894030b7cb5268845b021020dc18513682f5188a3047889e2a93f0711fa02fe449cd43490cb40d9ec5179a8a4683412feac8668ab3868770242d50c383a175cebf9d07249af7d4513465f406b9b9f5307ac46bc9a6fb5a760a2a8", @ANYBLOB="0602150003000000100016800c00010237fb53a0c37a0b82f99e81b6d2bea80a5964b688fb084704230f3130758a8ace97a3ed0f9a32ee3610d5789798483ef6ea6032fc82e3934c90039e0d0c467cce62492e2f4b3bdfb3da76be7f3b92a456fb4f9e7a9d9809170c7a8f110b0b3f89943e1e5663850a536b9926fc22af591ee8a352b4d79f2cf12648f13c93d1773cf666040be26e00ea513cd8a8882e345684ab2127a2eb090000"], 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000814) 205.863961ms ago: executing program 2 (id=3822): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0xfcfb, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xae0a}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048081}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x74, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x9}, {}, {0x7, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x48, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa, [{0x1fe, 0x500, 0x3, 0xe}, {0x6783, 0x2, 0x0, 0x10}, {0x40000, 0x53, 0xa9, 0x80000001}]}}]}}]}, 0x74}}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000440)=@xdp={0x2c, 0x7, r9, 0x3b}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000540)}], 0x1}, 0x4) 201.483667ms ago: executing program 3 (id=3823): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9", 0x38}], 0x1}}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="bf", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c", 0x49}, {&(0x7f0000001b00)="1791613d45501cb6a8d8eaeb96ee68b2d8daad34b8c528b97ead9f051e427e309b714d3d12d8d401ee42a68183b0e95a5b22ea526737b16783f6d819d82b492bf64f5475d1e1f435a4fd5de8795db130dc9a9e82dae8", 0x56}, {&(0x7f0000000140)}], 0x3}}], 0x3, 0x2090) (fail_nth: 1) sendto$inet(r0, &(0x7f0000000580), 0x0, 0x10008095, 0x0, 0x0) shutdown(r0, 0x1) 185.189194ms ago: executing program 1 (id=3824): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@qipcrtr={0x2a, 0x4, 0x1}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)="27031c00160014000000002f1eafacf706e105000000894f00050003ee0b80558ddbba9b37786fd808252372a31e4939884f", 0x32}], 0x1}, 0x24004010) 183.543941ms ago: executing program 4 (id=3825): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x1, 0xf0, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) writev(r1, 0x0, 0x0) 68.981759ms ago: executing program 3 (id=3826): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x1f00, 0xe, 0x0, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0xd, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2", 0x0, 0x0, 0xffffffff}, 0x50) 39.473065ms ago: executing program 4 (id=3827): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x240, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) (async) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x2, 0x3, 0x201, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFQA_CFG_FLAGS={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) (async) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x44, 0x800000, 0x8, 0x7, 0x0, 0x81}) (async) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001ec0)=ANY=[@ANYBLOB="180055cf600807012bbd700000000000037c00000400fc80"], 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r5 = syz_genetlink_get_family_id$gtp(&(0x7f00000001c0), r4) sendmsg$GTP_CMD_NEWPDP(r4, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x24000000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b708000000000000a50a00001b000000bfa200000000000007020080f8ffffffb703000008000000b704000000000000850000004300d8044e"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 3 (id=3828): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000000300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)}], 0x1}}], 0x1, 0x20008000) shutdown(r0, 0x1) kernel console output (not intermixed with test programs): etlink: 32 bytes leftover after parsing attributes in process `syz.5.1918'. [ 225.102305][T11518] nbd: must specify at least one socket [ 225.344880][T11534] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1930'. [ 225.356267][T11534] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1930'. [ 225.413078][T11534] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1930'. [ 225.552723][T11548] netlink: 'syz.1.1936': attribute type 1 has an invalid length. [ 225.585694][T11548] netlink: 326 bytes leftover after parsing attributes in process `syz.1.1936'. [ 225.901413][T11570] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1946'. [ 226.220426][T11589] vxcan1 speed is unknown, defaulting to 1000 [ 226.284329][T11586] lec:lec_start_xmit: lec0:No lecd attached [ 226.829451][T11589] wg1 speed is unknown, defaulting to 1000 [ 227.841628][T11647] infiniband !yz!: set down [ 227.849476][T11647] infiniband !yz!: added team_slave_0 [ 227.903516][T11647] RDS/IB: !yz!: added [ 227.916700][T11647] smc: adding ib device !yz! with port count 1 [ 227.932576][T11647] smc: ib device !yz! port 1 has no pnetid [ 228.793545][T11717] __nla_validate_parse: 27 callbacks suppressed [ 228.793565][T11717] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2014'. [ 229.005887][T11723] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2017'. [ 229.229323][T11735] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2021'. [ 229.549711][T11751] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2029'. [ 229.717219][T11760] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 229.724744][T11760] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 230.068278][T11784] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2043'. [ 230.202025][T11789] netlink: 'syz.1.2044': attribute type 1 has an invalid length. [ 230.320299][T11795] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2048'. [ 230.417558][T11803] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2047'. [ 230.532838][T11812] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2054'. [ 230.641601][T11819] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2057'. [ 231.058314][T11850] team_slave_1: Caught tx_queue_len zero misconfig [ 231.150812][T11858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2067'. [ 231.755962][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5470 ms [ 231.764037][ C1] lec:lec_tx_timeout: lec0 [ 231.769213][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 232.485177][T11939] netlink: 'syz.3.2113': attribute type 1 has an invalid length. [ 232.683742][T11951] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 236.068853][T11981] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 236.624164][T12091] syzkaller0: entered promiscuous mode [ 236.633254][T12091] syzkaller0: entered allmulticast mode [ 236.776187][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 236.784334][ C1] lec:lec_tx_timeout: lec0 [ 236.838430][T12106] __nla_validate_parse: 1 callbacks suppressed [ 236.838448][T12106] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2179'. [ 237.094049][T12119] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2184'. [ 239.511367][T12211] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2227'. [ 239.681528][T12217] syzkaller0: entered promiscuous mode [ 239.687321][T12217] syzkaller0: entered allmulticast mode [ 240.018379][T12240] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2241'. [ 240.181366][T12254] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2247'. [ 240.604199][T12283] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2261'. [ 240.667455][T12288] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2263'. [ 240.736491][T12292] netlink: get zone limit has 8 unknown bytes [ 240.931035][T12305] syzkaller0: entered promiscuous mode [ 240.940322][T12305] syzkaller0: entered allmulticast mode [ 240.991687][T12309] syzkaller0: entered promiscuous mode [ 241.000061][T12309] syzkaller0: entered allmulticast mode [ 241.164870][T12319] ieee802154 phy0 wpan0: encryption failed: -22 [ 241.334449][T12325] vxcan1 speed is unknown, defaulting to 1000 [ 241.436088][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 241.709524][T12325] wg1 speed is unknown, defaulting to 1000 [ 241.747638][T12347] tipc: Enabled bearer , priority 0 [ 241.767141][T12347] syzkaller0: entered promiscuous mode [ 241.773262][ T5831] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 241.783318][T12347] syzkaller0: entered allmulticast mode [ 241.789502][ T5831] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 241.797956][ T5831] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 241.816423][ T5831] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 241.830794][ T5831] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 241.896857][T12350] vxcan1 speed is unknown, defaulting to 1000 [ 241.907314][T12347] tipc: Resetting bearer [ 242.036114][T12346] tipc: Resetting bearer [ 242.097787][T12356] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2292'. [ 242.108015][T12346] tipc: Disabling bearer [ 242.188787][T12350] wg1 speed is unknown, defaulting to 1000 [ 242.300711][T12364] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2296'. [ 242.522999][T12372] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 242.536087][T12375] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 242.543732][T12375] IPv6: NLM_F_CREATE should be set when creating new route [ 242.781298][T12385] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2306'. [ 243.198037][T12399] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 243.216235][T12399] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.281454][T12350] chnl_net:caif_netlink_parms(): no params data found [ 243.335627][T12399] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 243.353237][T12399] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.448226][T12399] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 243.459869][T12399] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.475777][T12412] syzkaller0: entered promiscuous mode [ 243.481810][T12412] syzkaller0: entered allmulticast mode [ 243.559551][T12399] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 243.570356][T12399] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.622902][T12350] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.631528][T12350] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.661975][T12350] bridge_slave_0: entered allmulticast mode [ 243.670711][T12350] bridge_slave_0: entered promiscuous mode [ 243.680708][T12350] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.698913][T12350] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.706722][T12350] bridge_slave_1: entered allmulticast mode [ 243.714464][T12350] bridge_slave_1: entered promiscuous mode [ 243.805293][T12350] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 243.828980][T12350] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 243.868574][ T13] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 243.878694][ T13] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.919257][ T5831] Bluetooth: hci6: command tx timeout [ 243.934200][T12430] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 243.951399][T12350] team0: Port device team_slave_0 added [ 243.967348][ T35] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 243.975647][ T35] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.995598][T12350] team0: Port device team_slave_1 added [ 244.067282][T12350] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 244.074280][T12350] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 244.105222][T12350] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 244.117404][ T35] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 244.125806][ T35] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.145291][T12350] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 244.153043][T12350] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 244.182230][T12350] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 244.204658][ T35] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 244.215019][ T35] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.314904][T12350] hsr_slave_0: entered promiscuous mode [ 244.327639][T12350] hsr_slave_1: entered promiscuous mode [ 244.334131][T12350] debugfs: 'hsr0' already exists in 'hsr' [ 244.340785][T12350] Cannot create hsr debugfs directory [ 244.451937][T12448] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2327'. [ 244.454340][T12441] vxcan1 speed is unknown, defaulting to 1000 [ 244.603640][ T795] vxcan1 speed is unknown, defaulting to 1000 [ 244.709123][T12441] wg1 speed is unknown, defaulting to 1000 [ 244.993790][T12466] netlink: 'syz.3.2334': attribute type 13 has an invalid length. [ 245.996177][ T5831] Bluetooth: hci6: command tx timeout [ 246.726054][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5290 ms [ 246.734077][ C1] lec:lec_tx_timeout: lec0 [ 246.738983][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 247.365518][T12442] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 247.376426][T12350] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 247.463512][T12350] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 247.541539][T12350] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 247.562951][T12350] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 247.697913][T12494] netlink: 'syz.3.2345': attribute type 1 has an invalid length. [ 247.721072][T12494] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2345'. [ 247.745101][T12350] 8021q: adding VLAN 0 to HW filter on device bond0 [ 247.811054][T12350] 8021q: adding VLAN 0 to HW filter on device team0 [ 247.852130][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.859739][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 247.884217][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.891612][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 247.972031][T12506] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2348'. [ 248.087377][ T5831] Bluetooth: hci6: command tx timeout [ 248.168247][T12518] vxcan1 speed is unknown, defaulting to 1000 [ 248.191623][T12350] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 248.378347][T12518] wg1 speed is unknown, defaulting to 1000 [ 248.520576][T12350] veth0_vlan: entered promiscuous mode [ 248.534857][T12350] veth1_vlan: entered promiscuous mode [ 248.593886][T12350] veth0_macvtap: entered promiscuous mode [ 248.616288][T12350] veth1_macvtap: entered promiscuous mode [ 248.709740][T12350] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 248.730452][T12350] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 248.770806][ T1152] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.847871][ T1152] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.884375][ T1152] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.902836][ T1152] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.004443][T12540] bond_slave_1: entered promiscuous mode [ 249.025092][T12540] bond_slave_1: left promiscuous mode [ 249.150887][T12542] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2358'. [ 250.156491][ T5831] Bluetooth: hci6: command tx timeout [ 250.823813][T12501] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 250.943992][ T1152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 250.953356][ T1152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.087125][T12565] netlink: 'syz.2.2367': attribute type 3 has an invalid length. [ 251.105833][T12558] syzkaller0: entered promiscuous mode [ 251.128689][T12558] syzkaller0: entered allmulticast mode [ 251.141534][ T1152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.170020][ T1152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.756490][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 251.764546][ C1] lec:lec_tx_timeout: lec0 [ 253.004033][T12611] bond6: (slave ip6_vti0): Device is not bonding slave [ 253.012909][T12611] bond6: option active_slave: invalid value (ip6_vti0) [ 253.023806][T12611] bond6 (unregistering): Released all slaves [ 253.095487][T12618] netlink: 'syz.6.2387': attribute type 1 has an invalid length. [ 254.050796][ T5831] Bluetooth: hci5: link tx timeout [ 254.056952][ T5831] Bluetooth: hci5: killing stalled connection 10:aa:aa:aa:aa:aa [ 254.398012][T12580] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 254.551132][T12654] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 254.981890][T12678] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2408'. [ 255.340460][T12696] syzkaller0: entered promiscuous mode [ 255.346085][T12696] syzkaller0: entered allmulticast mode [ 255.481065][T12708] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 255.607767][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.616876][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 256.029703][T12725] netlink: 'syz.3.2430': attribute type 10 has an invalid length. [ 256.079569][ T5817] Bluetooth: hci5: command 0x0406 tx timeout [ 256.868560][T12706] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2420'. [ 257.022617][T12725] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 257.115694][T12733] lo: Caught tx_queue_len zero misconfig [ 257.705355][T12768] bond2: (slave ip6_vti0): Device is not bonding slave [ 257.736068][T12768] bond2: option active_slave: invalid value (ip6_vti0) [ 257.760696][T12768] bond2 (unregistering): Released all slaves [ 258.539818][T12820] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2464'. [ 258.597868][T12820] netlink: 256 bytes leftover after parsing attributes in process `syz.6.2464'. [ 258.669327][T12824] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 259.067477][T12823] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 259.184845][T12848] bond3: (slave ip6_vti0): Device is not bonding slave [ 259.203208][T12865] netlink: 'syz.2.2478': attribute type 10 has an invalid length. [ 259.212911][T12848] bond3: option active_slave: invalid value (ip6_vti0) [ 259.233664][T12848] bond3 (unregistering): Released all slaves [ 259.338934][T12865] bond0: (slave bridge0): Enslaving as an active interface with a down link [ 259.548608][T12880] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2479'. [ 259.639218][T12880] netlink: 256 bytes leftover after parsing attributes in process `syz.6.2479'. [ 260.718613][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5100 ms [ 260.726741][ C1] lec:lec_tx_timeout: lec0 [ 260.739917][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 260.786287][T12939] batman_adv: batadv0: Adding interface: dummy0 [ 260.808058][T12939] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 260.890551][T12944] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2503'. [ 260.901408][T12939] batman_adv: batadv0: Interface activated: dummy0 [ 260.911599][T12948] batadv0: mtu less than device minimum [ 260.925517][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 260.937237][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 260.948969][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 260.960673][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 260.972332][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 260.984173][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 260.995879][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 261.007673][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 261.019440][T12948] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 261.082996][T12939] netlink: 5 bytes leftover after parsing attributes in process `syz.6.2500'. [ 261.306523][ T5823] IPVS: starting estimator thread 0... [ 261.374341][T12971] netlink: 'syz.3.2512': attribute type 10 has an invalid length. [ 261.398670][T12968] IPVS: using max 33 ests per chain, 79200 per kthread [ 261.412287][T12971] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 261.569571][T12983] netlink: 272 bytes leftover after parsing attributes in process `syz.4.2516'. [ 262.949353][T13075] netlink: 272 bytes leftover after parsing attributes in process `syz.4.2546'. [ 263.060230][T13072] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 263.070066][T13072] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 263.153021][T13086] netlink: 124 bytes leftover after parsing attributes in process `syz.2.2550'. [ 263.686703][T13116] netlink: 'syz.1.2560': attribute type 4 has an invalid length. [ 264.468286][T13169] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2580'. [ 265.697697][T13244] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2601'. [ 265.725381][T13244] vlan0: entered promiscuous mode [ 265.731061][T13244] gretap0: entered promiscuous mode [ 265.755965][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 265.764009][ C1] lec:lec_tx_timeout: lec0 [ 265.898033][T13252] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2604'. [ 266.263389][T13270] vxcan1 speed is unknown, defaulting to 1000 [ 266.636134][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 266.656506][T13290] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input10 [ 267.020153][T13270] wg1 speed is unknown, defaulting to 1000 [ 267.595226][T13338] bond2: (slave ip6_vti0): Device is not bonding slave [ 267.706315][T13338] bond2: option active_slave: invalid value (ip6_vti0) [ 267.785853][T13338] bond2 (unregistering): Released all slaves [ 268.053098][T13366] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2644'. [ 268.780771][T13398] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 268.788086][T13398] IPv6: NLM_F_CREATE should be set when creating new route [ 269.101356][T13422] ip6tnl0: Caught tx_queue_len zero misconfig [ 269.368274][T13433] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2670'. [ 269.399028][T13433] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2670'. [ 269.828766][ T5817] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 269.840733][ T5817] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 269.849030][ T5817] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 269.868694][ T5817] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 269.881939][ T5817] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 269.981149][T13451] vxcan1 speed is unknown, defaulting to 1000 [ 270.449061][T13483] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2688'. [ 270.512728][T13487] tipc: Enabling of bearer rejected, failed to enable media [ 270.769505][T13500] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2694'. [ 270.800162][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2694'. [ 270.801854][T13451] wg1 speed is unknown, defaulting to 1000 [ 270.822891][T13500] ip6tnl1: entered promiscuous mode [ 270.865425][T13506] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2694'. [ 270.907568][T13506] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2694'. [ 270.950822][ T1152] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.148000][ T1152] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.161996][T13520] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2703'. [ 271.423436][ T1152] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.631807][T13533] syzkaller0: entered promiscuous mode [ 271.638294][T13533] syzkaller0: entered allmulticast mode [ 271.688051][T13549] netlink: 5 bytes leftover after parsing attributes in process `syz.6.2711'. [ 271.701353][T13549] net_ratelimit: 11 callbacks suppressed [ 271.701371][T13549] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 271.722729][ T1152] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.755990][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5120 ms [ 271.764083][ C1] lec:lec_tx_timeout: lec0 [ 271.769006][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 271.781053][ T24] wg1 speed is unknown, defaulting to 1000 [ 271.791137][ T24] sy+Û: Port: 1 Link DOWN [ 271.919567][ T5831] Bluetooth: hci7: command tx timeout [ 272.115630][T13570] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2716'. [ 272.321789][T13574] netlink: 256 bytes leftover after parsing attributes in process `syz.6.2718'. [ 273.584792][T13551] bond6: (slave ip6_vti0): Device is not bonding slave [ 273.591852][T13551] bond6: option active_slave: invalid value (ip6_vti0) [ 273.601594][T13551] bond6 (unregistering): Released all slaves [ 273.668067][T13556] bond2: (slave ip6_vti0): Device is not bonding slave [ 273.687093][T13556] bond2: option active_slave: invalid value (ip6_vti0) [ 273.707565][T13556] bond2 (unregistering): Released all slaves [ 273.899660][T13588] netlink: 5 bytes leftover after parsing attributes in process `syz.6.2723'. [ 273.919920][T13588] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 273.997273][ T5831] Bluetooth: hci7: command tx timeout [ 274.077917][T13596] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2728'. [ 274.103188][ T1152] bridge_slave_1: left allmulticast mode [ 274.118058][ T1152] bridge_slave_1: left promiscuous mode [ 274.132279][ T1152] bridge0: port 2(bridge_slave_1) entered disabled state [ 274.158313][ T1152] bridge_slave_0: left allmulticast mode [ 274.168364][ T1152] bridge_slave_0: left promiscuous mode [ 274.186759][ T1152] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.528637][ T1152] bond2 (unregistering): (slave geneve2): Releasing active interface [ 274.691412][ T1152] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 274.702781][ T1152] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 274.713187][ T1152] bond0 (unregistering): Released all slaves [ 274.728405][ T1152] bond1 (unregistering): Released all slaves [ 274.751109][ T1152] bond2 (unregistering): Released all slaves [ 274.870946][T13628] bond2: (slave ip6_vti0): Device is not bonding slave [ 274.909789][T13628] bond2: option active_slave: invalid value (ip6_vti0) [ 274.922292][T13628] bond2 (unregistering): Released all slaves [ 275.185327][T13650] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2738'. [ 275.204960][T13650] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 275.242496][T13647] batman_adv: batadv0: Adding interface: dummy0 [ 275.256636][T13647] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.293903][T13647] batman_adv: batadv0: Interface activated: dummy0 [ 275.420759][T13640] syzkaller0: entered promiscuous mode [ 275.428640][T13640] syzkaller0: entered allmulticast mode [ 275.810296][T13676] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2746'. [ 276.079559][ T5831] Bluetooth: hci7: command tx timeout [ 276.777287][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 276.785294][ C1] lec:lec_tx_timeout: lec0 [ 277.091443][T13451] chnl_net:caif_netlink_parms(): no params data found [ 277.203407][T13687] syzkaller0: entered promiscuous mode [ 277.246092][T13687] syzkaller0: entered allmulticast mode [ 277.498830][T13717] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2751'. [ 277.516487][T13717] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 278.160181][ T5831] Bluetooth: hci7: command tx timeout [ 278.902128][T13711] batman_adv: batadv0: Adding interface: dummy0 [ 278.916217][T13711] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 278.946259][T13711] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 278.966019][T13725] netlink: 'syz.6.2753': attribute type 1 has an invalid length. [ 278.991398][ T6412] lec:lec_start_xmit: lec0:No lecd attached [ 279.360582][T13451] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.386349][T13451] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.393753][T13451] bridge_slave_0: entered allmulticast mode [ 279.439586][T13451] bridge_slave_0: entered promiscuous mode [ 279.463285][T13451] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.497391][T13451] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.519266][T13451] bridge_slave_1: entered allmulticast mode [ 279.539549][T13451] bridge_slave_1: entered promiscuous mode [ 279.628415][T13749] bond4: (slave ip6_vti0): Device is not bonding slave [ 279.653519][T13749] bond4: option active_slave: invalid value (ip6_vti0) [ 279.663590][ T29] audit: type=1107 audit(1770965278.532:2): pid=13759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='x²<' [ 279.702162][T13749] bond4 (unregistering): Released all slaves [ 279.777180][ T1152] hsr_slave_0: left promiscuous mode [ 279.813170][ T1152] hsr_slave_1: left promiscuous mode [ 279.840905][ T1152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 279.857626][ T1152] batadv0: mtu less than device minimum [ 279.873633][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.885957][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.897789][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.909585][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.921367][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.933150][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.944926][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.956682][ T1152] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 279.991055][ T1152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 280.003097][ T1152] batman_adv: batadv0: Interface deactivated: dummy0 [ 280.010656][ T1152] batman_adv: batadv0: Removing interface: dummy0 [ 280.027154][ T1152] veth1_macvtap: left promiscuous mode [ 280.393912][ T1152] team0 (unregistering): Port device team_slave_1 removed [ 280.448447][ T1152] team0 (unregistering): Port device team_slave_0 removed [ 280.571055][T13794] netlink: 5 bytes leftover after parsing attributes in process `syz.6.2764'. [ 280.742731][T13777] syzkaller0: entered promiscuous mode [ 280.751351][T13777] syzkaller0: entered allmulticast mode [ 282.236295][T13451] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.252922][T13451] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.384545][T13451] team0: Port device team_slave_0 added [ 282.417961][T13451] team0: Port device team_slave_1 added [ 282.556728][T13451] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.565027][T13830] netlink: 5 bytes leftover after parsing attributes in process `syz.3.2776'. [ 282.590431][T13451] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.607724][T13830] net_ratelimit: 12 callbacks suppressed [ 282.607744][T13830] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 282.643903][T13451] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 282.712678][T13831] bond1: (slave ip6_vti0): Device is not bonding slave [ 282.737392][T13831] bond1: option active_slave: invalid value (ip6_vti0) [ 282.757241][T13831] bond1 (unregistering): Released all slaves [ 282.927372][T13451] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 282.949100][T13451] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.979717][T13451] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 283.075062][ T1152] IPVS: stop unused estimator thread 0... [ 283.229834][T13451] hsr_slave_0: entered promiscuous mode [ 283.256425][T13451] hsr_slave_1: entered promiscuous mode [ 283.292495][T13451] debugfs: 'hsr0' already exists in 'hsr' [ 283.316283][T13451] Cannot create hsr debugfs directory [ 284.687729][T13451] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 284.716253][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5720 ms [ 284.723598][T13451] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 284.724340][ C1] lec:lec_tx_timeout: lec0 [ 284.735977][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 284.760178][T13451] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 284.804979][T13451] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 284.953866][T13949] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2799'. [ 284.977861][T13949] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2799'. [ 285.323989][T13968] netlink: 'syz.6.2803': attribute type 1 has an invalid length. [ 285.525507][T13451] 8021q: adding VLAN 0 to HW filter on device bond0 [ 285.581212][T13981] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2804'. [ 285.606539][T13451] 8021q: adding VLAN 0 to HW filter on device team0 [ 285.641631][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.648814][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 285.741018][ T5901] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.748446][ T5901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 286.089483][T14006] netlink: 'syz.4.2814': attribute type 1 has an invalid length. [ 286.403362][T13451] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 286.491961][T13451] veth0_vlan: entered promiscuous mode [ 286.528482][T13451] veth1_vlan: entered promiscuous mode [ 286.577277][T13451] veth0_macvtap: entered promiscuous mode [ 286.597110][T13451] veth1_macvtap: entered promiscuous mode [ 286.640100][T13451] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 286.681993][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880584b8400: rx timeout, send abort [ 286.691465][T13451] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 286.733352][ T68] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.760566][ T68] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.787768][ T68] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.813788][ T68] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.854869][T14040] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2824'. [ 286.952519][T14042] netlink: 'syz.3.2825': attribute type 1 has an invalid length. [ 287.087429][ T1152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 287.095291][ T1152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 287.182133][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807efc1400: rx timeout, send abort [ 287.190783][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880584b8400: abort rx timeout. Force session deactivation [ 287.212944][ T1152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 287.232676][ T1152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 287.246843][T14053] batman_adv: batadv0: Removing interface: dummy0 [ 287.247667][T14056] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2829'. [ 287.301319][T14056] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 287.374748][T14061] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2833'. [ 287.690556][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807efc1400: abort rx timeout. Force session deactivation [ 287.910807][ T5817] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 287.928425][ T5817] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 287.938694][ T5817] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 287.948140][ T5817] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 287.957150][ T5817] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 288.028637][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058c08400: rx timeout, send abort [ 288.057148][T14094] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2843'. [ 288.070705][T14086] vxcan1 speed is unknown, defaulting to 1000 [ 288.288100][T14101] batman_adv: batadv0: Removing interface: dummy0 [ 288.317655][T14101] netlink: 5 bytes leftover after parsing attributes in process `syz.3.2844'. [ 288.328936][ T47] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 288.332316][T14101] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 288.392374][ T47] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.470740][ T47] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 288.522285][ T47] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.532314][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058c08000: rx timeout, send abort [ 288.540738][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058c08400: abort rx timeout. Force session deactivation [ 288.707662][ T47] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 288.786302][ T47] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.955710][ T47] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 288.986513][ T47] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 289.032401][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058c08000: abort rx timeout. Force session deactivation [ 289.281795][T14145] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2853'. [ 289.544113][T14154] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2855'. [ 289.577327][T14154] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 289.766016][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 289.774194][ C1] lec:lec_tx_timeout: lec0 [ 289.969935][T14171] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 289.977278][T14171] IPv6: NLM_F_CREATE should be set when creating new route [ 290.000516][ T5831] Bluetooth: hci0: command tx timeout [ 290.021657][ T47] bond1 (unregistering): (slave gretap1): Releasing active interface [ 290.205263][ T47] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 290.225130][ T47] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 290.241655][ T47] bond0 (unregistering): Released all slaves [ 290.264237][ T47] bond1 (unregistering): Released all slaves [ 290.286369][T14182] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2866'. [ 290.289649][ T47] bond2 (unregistering): Released all slaves [ 290.314048][ T47] bond3 (unregistering): Released all slaves [ 290.355712][ T47] bond4 (unregistering): (slave bond5): Releasing backup interface [ 290.369862][ T47] bond5 (unregistering): left promiscuous mode [ 290.389157][ T47] bond4 (unregistering): Released all slaves [ 290.432023][ T47] bond5 (unregistering): Released all slaves [ 290.627489][T14186] syzkaller0: entered promiscuous mode [ 290.633147][T14186] syzkaller0: entered allmulticast mode [ 290.659757][ T47] tipc: Disabling bearer [ 290.674283][ T47] tipc: Left network mode [ 290.700785][T14198] batman_adv: batadv0: Local translation table size (108) exceeds maximum packet size (-320); Ignoring new local tt entry: 00:00:00:00:00:00 [ 290.890697][T14202] syzkaller0: entered promiscuous mode [ 290.898952][T14202] syzkaller0: entered allmulticast mode [ 291.004065][T14212] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2876'. [ 291.100921][T14214] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2877'. [ 291.145005][T14220] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2880'. [ 291.177003][T14222] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2878'. [ 291.226034][T14222] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 291.673686][T14247] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2887'. [ 291.685241][T14086] chnl_net:caif_netlink_parms(): no params data found [ 291.836107][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 292.005776][T14263] syzkaller0: entered promiscuous mode [ 292.031265][T14263] syzkaller0: entered allmulticast mode [ 292.076721][ T5817] Bluetooth: hci0: command tx timeout [ 292.751989][ T47] hsr_slave_0: left promiscuous mode [ 292.758705][ T47] hsr_slave_1: left promiscuous mode [ 292.766873][ T47] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 292.774510][ T47] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 292.785156][ T47] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 292.801241][ T47] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 292.838710][ T47] batman_adv: batadv0: Interface deactivated: dummy0 [ 292.871733][ T47] batman_adv: batadv0: Removing interface: dummy0 [ 292.924286][ T47] veth1_macvtap: left promiscuous mode [ 292.930657][ T47] veth0_macvtap: left promiscuous mode [ 293.272340][ T1152] smc: removing ib device syz2 [ 293.335471][T14086] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.344088][T14086] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.352790][T14086] bridge_slave_0: entered allmulticast mode [ 293.369665][T14086] bridge_slave_0: entered promiscuous mode [ 293.384832][T14306] syzkaller0: entered promiscuous mode [ 293.392641][T14306] syzkaller0: entered allmulticast mode [ 293.448398][T14315] syzkaller0: entered promiscuous mode [ 293.468888][T14315] syzkaller0: entered allmulticast mode [ 293.487482][ T24] vxcan1 speed is unknown, defaulting to 1000 [ 293.488635][T14086] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.494768][ T24] syz2: Port: 1 Link DOWN [ 293.506179][T14086] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.519041][ T5817] Bluetooth: hci4: command 0x0405 tx timeout [ 293.548425][T14086] bridge_slave_1: entered allmulticast mode [ 293.612230][T14086] bridge_slave_1: entered promiscuous mode [ 294.207105][ T5831] Bluetooth: hci0: command tx timeout [ 295.077477][T14365] __nla_validate_parse: 2 callbacks suppressed [ 295.077496][T14365] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2924'. [ 295.098899][T14365] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 296.236332][ T5831] Bluetooth: hci0: command tx timeout [ 296.378411][T14086] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 296.390894][T14086] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 296.475221][T14086] team0: Port device team_slave_0 added [ 296.495468][T14086] team0: Port device team_slave_1 added [ 296.571092][T14086] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 296.585976][T14086] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.615386][T14086] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 296.645387][T14086] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 296.653403][T14086] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.693891][T14086] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 296.770556][T14086] hsr_slave_0: entered promiscuous mode [ 296.777320][T14086] hsr_slave_1: entered promiscuous mode [ 296.783650][T14086] debugfs: 'hsr0' already exists in 'hsr' [ 296.789657][T14086] Cannot create hsr debugfs directory [ 296.799681][ T47] IPVS: stop unused estimator thread 0... [ 296.845938][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 296.853966][ C1] lec:lec_tx_timeout: lec0 [ 296.876125][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 297.539863][T14400] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2936'. [ 297.549777][T14400] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2936'. [ 297.772333][T14408] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 297.783471][T14408] team0 (unregistering): Port device team_slave_0 removed [ 297.793050][T14408] team0 (unregistering): Failed to send options change via netlink (err -105) [ 297.813457][T14408] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 297.827904][T14408] team0 (unregistering): Port device team_slave_1 removed [ 298.182473][T14367] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 298.215272][T14086] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 298.270007][T14086] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 298.360724][T14086] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 298.408053][T14086] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 298.733395][T14086] 8021q: adding VLAN 0 to HW filter on device bond0 [ 298.803852][T14086] 8021q: adding VLAN 0 to HW filter on device team0 [ 298.840857][ T5901] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.848189][ T5901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 298.901761][ T47] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.908977][ T47] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.053493][T14464] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.198295][T14464] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.404528][T14464] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.469460][T14086] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 299.612480][T14464] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.730995][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a49cc00: rx timeout, send abort [ 299.931363][ T68] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.974903][ T68] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.025487][ T68] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.075063][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.090884][T14523] netlink: 'syz.3.2963': attribute type 2 has an invalid length. [ 300.104244][T14086] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 300.141371][T14523] !: entered promiscuous mode [ 300.158589][T14527] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2963'. [ 300.231147][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a49e400: rx timeout, send abort [ 300.239607][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a49cc00: abort rx timeout. Force session deactivation [ 300.652201][T14086] veth0_vlan: entered promiscuous mode [ 300.666569][T14558] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2970'. [ 300.672494][T14086] veth1_vlan: entered promiscuous mode [ 300.696175][T14558] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2970'. [ 300.714797][T14558] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2970'. [ 300.726616][T14086] veth0_macvtap: entered promiscuous mode [ 300.739436][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a49e400: abort rx timeout. Force session deactivation [ 300.757484][T14086] veth1_macvtap: entered promiscuous mode [ 300.790568][T14086] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 300.818112][T14086] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 300.843224][ T5901] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.852906][ T5901] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.864204][ T5901] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.875239][ T5901] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.519662][T14580] syz_tun: entered allmulticast mode [ 301.532046][T14580] dvmrp1: entered allmulticast mode [ 301.539207][T14579] syz_tun: left allmulticast mode [ 301.885990][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 301.894045][ C1] lec:lec_tx_timeout: lec0 [ 301.916196][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 303.161017][T14528] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 303.255243][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 303.279137][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 303.373938][T14607] syz_tun: entered allmulticast mode [ 303.391016][T14607] dvmrp1: entered allmulticast mode [ 303.398379][T14606] syz_tun: left allmulticast mode [ 303.407443][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 303.415278][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 303.899452][T14640] syz_tun: entered allmulticast mode [ 303.937893][T14640] dvmrp1: entered allmulticast mode [ 304.030036][ T5817] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 304.039656][T14639] syz_tun: left allmulticast mode [ 304.045020][ T5817] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 304.055090][ T5817] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 304.068810][T14645] netlink: 'syz.4.2998': attribute type 29 has an invalid length. [ 304.068844][ T5817] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 304.106607][ T5817] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 304.131773][T14647] netlink: 'syz.4.2998': attribute type 29 has an invalid length. [ 304.488103][T14655] syzkaller0: entered promiscuous mode [ 304.494020][T14655] syzkaller0: entered allmulticast mode [ 306.012604][T14683] syz_tun: entered allmulticast mode [ 306.033382][T14683] dvmrp1: entered allmulticast mode [ 306.073664][T14643] chnl_net:caif_netlink_parms(): no params data found [ 306.130581][T14682] syz_tun: left allmulticast mode [ 306.156298][ T5817] Bluetooth: hci2: command tx timeout [ 306.192066][T14643] bridge0: port 1(bridge_slave_0) entered blocking state [ 306.200072][T14643] bridge0: port 1(bridge_slave_0) entered disabled state [ 306.207826][T14643] bridge_slave_0: entered allmulticast mode [ 306.215608][T14643] bridge_slave_0: entered promiscuous mode [ 306.227734][T14643] bridge0: port 2(bridge_slave_1) entered blocking state [ 306.235049][T14643] bridge0: port 2(bridge_slave_1) entered disabled state [ 306.243279][T14643] bridge_slave_1: entered allmulticast mode [ 306.252436][T14643] bridge_slave_1: entered promiscuous mode [ 306.289309][T14643] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 306.300862][T14643] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 306.340455][T14643] team0: Port device team_slave_0 added [ 306.349783][T14643] team0: Port device team_slave_1 added [ 306.379526][T14643] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 306.387934][T14643] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 306.414625][T14643] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 306.426854][T14643] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 306.433874][T14643] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 306.460177][T14643] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 306.496976][T14696] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3012'. [ 306.512947][T14643] hsr_slave_0: entered promiscuous mode [ 306.520249][T14643] hsr_slave_1: entered promiscuous mode [ 306.526936][T14643] debugfs: 'hsr0' already exists in 'hsr' [ 306.532692][T14643] Cannot create hsr debugfs directory [ 306.925967][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 306.934073][ C1] lec:lec_tx_timeout: lec0 [ 306.966164][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 307.369607][T14657] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 307.406947][T14643] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 307.454104][T14643] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 307.507235][T14643] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 307.533682][T14643] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 307.643272][T14718] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3021'. [ 307.654260][T14718] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 307.861551][T14723] syz_tun: entered allmulticast mode [ 307.913861][T14713] syz_tun: left allmulticast mode [ 308.125775][T14643] 8021q: adding VLAN 0 to HW filter on device bond0 [ 308.162338][T14643] 8021q: adding VLAN 0 to HW filter on device team0 [ 308.194308][ T47] bridge0: port 1(bridge_slave_0) entered blocking state [ 308.201458][ T47] bridge0: port 1(bridge_slave_0) entered forwarding state [ 308.226601][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 308.233862][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 308.246223][ T5817] Bluetooth: hci2: command tx timeout [ 308.413123][T14643] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 308.455193][T14643] veth0_vlan: entered promiscuous mode [ 308.467734][T14643] veth1_vlan: entered promiscuous mode [ 308.497802][T14643] veth0_macvtap: entered promiscuous mode [ 308.507785][T14643] veth1_macvtap: entered promiscuous mode [ 308.524840][T14643] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 308.540448][T14643] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 308.554127][ T68] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.571762][ T68] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.581736][ T68] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.592373][ T68] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.964683][T14768] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3032'. [ 308.979165][T14768] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3032'. [ 310.316216][ T5817] Bluetooth: hci2: command tx timeout [ 311.038359][T14744] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 311.048109][T14758] netlink: 'syz.6.3030': attribute type 1 has an invalid length. [ 311.196324][ T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.208115][T14781] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3035'. [ 311.217163][ T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.295554][ T47] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.320405][ T47] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 312.111872][ T5831] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 312.124296][ T5831] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 312.136091][ T5831] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 312.166283][ T5831] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 312.174063][ T5831] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 312.396151][ T5831] Bluetooth: hci2: command tx timeout [ 312.624858][T14822] chnl_net:caif_netlink_parms(): no params data found [ 312.692647][T14822] bridge0: port 1(bridge_slave_0) entered blocking state [ 312.699840][T14822] bridge0: port 1(bridge_slave_0) entered disabled state [ 312.707648][T14822] bridge_slave_0: entered allmulticast mode [ 312.715607][T14822] bridge_slave_0: entered promiscuous mode [ 312.725911][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5760 ms [ 312.733990][ C1] lec:lec_tx_timeout: lec0 [ 312.738689][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 312.740901][T14822] bridge0: port 2(bridge_slave_1) entered blocking state [ 312.752033][T14822] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.759343][T14822] bridge_slave_1: entered allmulticast mode [ 312.766997][T14822] bridge_slave_1: entered promiscuous mode [ 312.795568][T14822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 312.809670][T14822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 312.837412][T14822] team0: Port device team_slave_0 added [ 312.844930][T14822] team0: Port device team_slave_1 added [ 312.867096][T14822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 312.874054][T14822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 312.900954][T14822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 312.912992][T14822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 312.920523][T14822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 312.946456][T14822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 312.986660][T14822] hsr_slave_0: entered promiscuous mode [ 312.992988][T14822] hsr_slave_1: entered promiscuous mode [ 312.999269][T14822] debugfs: 'hsr0' already exists in 'hsr' [ 313.005029][T14822] Cannot create hsr debugfs directory [ 314.236734][ T5831] Bluetooth: hci3: command tx timeout [ 314.638934][T14804] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 314.672435][T14822] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 314.779538][T14822] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 314.815860][T14822] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 314.850482][T14822] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 314.891623][T14844] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 314.968985][T14844] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 314.981180][T14859] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3058'. [ 315.050361][T14844] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 315.074285][T14822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 315.090754][T14822] 8021q: adding VLAN 0 to HW filter on device team0 [ 315.104040][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.108468][T14862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3059'. [ 315.111233][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 315.149256][T14844] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 315.163132][ C1] vcan0: j1939_tp_rxtimer: 0xffff888031908000: rx timeout, send abort [ 315.179439][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 315.186650][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 315.281287][ T35] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.306078][ T35] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.331327][ T35] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.360200][ T47] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.450831][T14822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 315.517615][T14822] veth0_vlan: entered promiscuous mode [ 315.533177][T14822] veth1_vlan: entered promiscuous mode [ 315.565850][T14822] veth0_macvtap: entered promiscuous mode [ 315.580245][T14822] veth1_macvtap: entered promiscuous mode [ 315.604161][T14822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 315.623979][T14822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 315.652708][ T5901] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.663298][ C1] vcan0: j1939_tp_rxtimer: 0xffff88803190ac00: rx timeout, send abort [ 315.672264][ C1] vcan0: j1939_tp_rxtimer: 0xffff888031908000: abort rx timeout. Force session deactivation [ 315.672388][ T5901] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.724854][ T5901] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.737712][ T5901] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.953686][T14892] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3068'. [ 316.071526][T14896] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 316.088530][T14896] team0 (unregistering): Port device team_slave_0 removed [ 316.102734][T14896] team0 (unregistering): Failed to send options change via netlink (err -105) [ 316.113777][T14896] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 316.126428][T14896] team0 (unregistering): Port device team_slave_1 removed [ 316.171544][ C1] vcan0: j1939_tp_rxtimer: 0xffff88803190ac00: abort rx timeout. Force session deactivation [ 316.319313][ T5831] Bluetooth: hci3: command tx timeout [ 316.711915][T14908] syzkaller0: entered promiscuous mode [ 316.718301][T14908] syzkaller0: entered allmulticast mode [ 316.923302][T14915] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3077'. [ 317.040050][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.049556][ T1297] aoe: packet could not be sent on lec0. consider increasing tx_queue_len [ 317.719391][T14918] netlink: 256 bytes leftover after parsing attributes in process `syz.6.3078'. [ 317.756077][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 317.764134][ C1] lec:lec_tx_timeout: lec0 [ 318.396110][ T5831] Bluetooth: hci3: command tx timeout [ 318.609571][T14875] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 318.739186][T14925] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3081'. [ 318.756085][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 318.776301][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 318.801849][T14925] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3081'. [ 318.860628][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 318.875677][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 318.900818][T14932] syzkaller0: entered promiscuous mode [ 318.929111][T14932] syzkaller0: entered allmulticast mode [ 319.069513][T14940] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3088'. [ 319.200871][T14946] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3087'. [ 319.702764][T14972] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3096'. [ 319.996859][T14980] syzkaller0: entered promiscuous mode [ 320.002803][T14980] syzkaller0: entered allmulticast mode [ 320.477363][ T5831] Bluetooth: hci3: command tx timeout [ 320.960424][T15012] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3109'. [ 321.771058][T15012] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3109'. [ 321.781803][T15012] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.789300][T15012] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.884637][T15015] syzkaller0: entered promiscuous mode [ 321.913793][T15015] syzkaller0: entered allmulticast mode [ 322.076063][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 322.274370][T15045] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3121'. [ 322.289345][T15044] netlink: 164 bytes leftover after parsing attributes in process `syz.4.3120'. [ 322.422740][T15050] syzkaller0: entered promiscuous mode [ 322.429958][T15050] syzkaller0: entered allmulticast mode [ 324.181708][T15097] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3138'. [ 324.232767][T15096] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3136'. [ 324.542258][T15122] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3145'. [ 325.299627][T15165] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.361217][T15172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3161'. [ 325.425250][T15165] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.492680][T15177] netlink: 76 bytes leftover after parsing attributes in process `syz.6.3163'. [ 325.573871][T15165] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.720095][T15183] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3165'. [ 325.739802][T15165] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.834393][T15183] bridge0: port 2(bridge_slave_1) entered disabled state [ 325.842075][T15183] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.896572][T15190] syz_tun: entered allmulticast mode [ 325.908100][T15189] syz_tun: left allmulticast mode [ 326.133881][T14335] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.215142][T14335] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.276525][T14335] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.305119][ T5927] IPVS: starting estimator thread 0... [ 326.321117][ T47] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.396178][T15218] IPVS: using max 35 ests per chain, 84000 per kthread [ 326.592529][T15233] syz_tun: entered allmulticast mode [ 326.643716][T15233] dvmrp1: entered allmulticast mode [ 326.660913][T15231] syz_tun: left allmulticast mode [ 326.772975][T15242] __nla_validate_parse: 1 callbacks suppressed [ 326.772993][T15242] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3187'. [ 326.947698][T15253] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.964651][T15256] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3193'. [ 327.152177][T15253] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.217216][T15253] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.324638][T15253] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.597665][T14335] dvmrp1 (unregistering): left allmulticast mode [ 327.639014][T14335] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 327.756076][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5680 ms [ 327.764201][ C1] lec:lec_tx_timeout: lec0 [ 327.769106][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 327.782316][T14335] bond0 (unregistering): Released all slaves [ 327.792355][T14335] bond1 (unregistering): Released all slaves [ 327.805633][T14335] bond2 (unregistering): Released all slaves [ 327.820078][T14335] bond3 (unregistering): Released all slaves [ 327.991975][T14335] tipc: Left network mode [ 328.085701][T15287] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3205'. [ 328.200962][T15291] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3207'. [ 328.381394][T15298] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3210'. [ 328.401502][T15298] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3210'. [ 328.855218][T15313] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3216'. [ 328.955810][T15319] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3219'. [ 329.109903][T15320] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.170613][T14335] hsr_slave_0: left promiscuous mode [ 329.177500][T14335] hsr0: left allmulticast mode [ 329.302831][ T35] smc: removing ib device !yz! [ 329.405615][T14335] lo (unregistering): left allmulticast mode [ 329.982978][T15351] netlink: 'syz.6.3232': attribute type 10 has an invalid length. [ 330.014708][T15351] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.022581][T15351] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.105001][T15351] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.112185][T15351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 330.119727][T15351] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.126942][T15351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 330.178135][T15351] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 330.216721][T15357] batman_adv: batadv0: Adding interface: dummy0 [ 330.246134][T15357] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 330.276309][T15357] batman_adv: batadv0: Interface activated: dummy0 [ 330.385759][ T68] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.520956][T15372] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3235'. [ 330.532437][ T68] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.655369][T15366] syzkaller0: entered promiscuous mode [ 330.661479][T15366] syzkaller0: entered allmulticast mode [ 330.707346][ T13] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.406711][T15373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.574406][ T57] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.775915][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 332.783958][ C1] lec:lec_tx_timeout: lec0 [ 332.894613][T14335] IPVS: stop unused estimator thread 0... [ 333.571726][T15374] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 333.701015][T15426] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3253'. [ 333.741866][T15431] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3254'. [ 333.766431][T15426] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3253'. [ 333.783231][T15426] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.790992][T15426] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.860174][T15434] syzkaller0: entered promiscuous mode [ 333.872610][T15434] syzkaller0: entered allmulticast mode [ 333.976530][T15440] syz_tun: entered allmulticast mode [ 334.054547][T15439] syz_tun: left allmulticast mode [ 334.148650][T15446] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3262'. [ 334.233434][T15451] syzkaller0: entered promiscuous mode [ 334.253136][T15451] syzkaller0: entered allmulticast mode [ 334.303708][T15455] batman_adv: batadv0: Adding interface: dummy0 [ 334.316586][T15455] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.344789][T15455] batman_adv: batadv0: Interface activated: dummy0 [ 334.378704][T15457] bond2: (slave ip6_vti0): Device is not bonding slave [ 334.385573][T15457] bond2: option active_slave: invalid value (ip6_vti0) [ 334.430441][T15457] bond2 (unregistering): Released all slaves [ 334.698259][T15478] syzkaller0: entered promiscuous mode [ 334.710317][T15478] syzkaller0: entered allmulticast mode [ 334.714249][T15480] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3275'. [ 334.835128][T15489] syzkaller0: entered promiscuous mode [ 334.841342][T15489] syzkaller0: entered allmulticast mode [ 335.381991][T15517] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3288'. [ 335.407807][T15516] syzkaller0: entered promiscuous mode [ 335.413391][T15516] syzkaller0: entered allmulticast mode [ 336.026752][T15554] syzkaller0: entered promiscuous mode [ 336.032260][T15554] syzkaller0: entered allmulticast mode [ 336.215781][T15569] batman_adv: batadv0: Adding interface: dummy0 [ 336.242633][T15569] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.293031][T15569] batman_adv: batadv0: Interface activated: dummy0 [ 336.458814][T15583] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.610037][T15583] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.695076][T15583] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.741516][T15600] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3323'. [ 336.790665][T15602] syzkaller0: entered promiscuous mode [ 336.810446][T15602] syzkaller0: entered allmulticast mode [ 336.820707][T15583] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.847605][T15605] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3328'. [ 336.888967][T15605] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3328'. [ 337.021062][ T47] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.071463][ T35] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.114278][ T47] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.151266][ T47] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.208941][T15620] bond1: (slave ip6_vti0): Device is not bonding slave [ 337.226960][T15620] bond1: option active_slave: invalid value (ip6_vti0) [ 337.265257][T15620] bond1 (unregistering): Released all slaves [ 337.577360][T15644] syzkaller0: entered promiscuous mode [ 337.587943][T15644] syzkaller0: entered allmulticast mode [ 337.647975][T15646] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3342'. [ 338.297590][T15685] netlink: 'syz.6.3356': attribute type 1 has an invalid length. [ 338.320163][T15684] syzkaller0: entered promiscuous mode [ 338.325674][T15684] syzkaller0: entered allmulticast mode [ 339.081495][T15737] __nla_validate_parse: 4 callbacks suppressed [ 339.081540][T15737] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3370'. [ 339.242818][T15748] syzkaller0: entered promiscuous mode [ 339.256464][T15748] syzkaller0: entered allmulticast mode [ 340.013261][T15803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3389'. [ 340.264666][T15816] netlink: 'syz.2.3399': attribute type 21 has an invalid length. [ 340.703935][T15832] syzkaller0: entered promiscuous mode [ 340.711398][T15832] syzkaller0: entered allmulticast mode [ 340.878445][T15837] syz_tun: entered allmulticast mode [ 340.931311][T15836] syz_tun: left allmulticast mode [ 341.442737][T15868] syzkaller0: entered promiscuous mode [ 341.450340][T15868] syzkaller0: entered allmulticast mode [ 341.472478][T15870] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3420'. [ 341.483252][T15870] bridge0: port 2(bridge_slave_1) entered blocking state [ 341.490467][T15870] bridge0: port 2(bridge_slave_1) entered forwarding state [ 341.498068][T15870] bridge0: port 1(bridge_slave_0) entered blocking state [ 341.505216][T15870] bridge0: port 1(bridge_slave_0) entered forwarding state [ 341.527082][T15870] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3420'. [ 341.859239][T15886] syzkaller0: entered promiscuous mode [ 341.864816][T15886] syzkaller0: entered allmulticast mode [ 342.202368][T15903] syzkaller0: entered promiscuous mode [ 342.210560][T15908] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3433'. [ 342.236312][T15903] syzkaller0: entered allmulticast mode [ 342.457765][T15911] syzkaller0: entered promiscuous mode [ 342.463426][T15911] syzkaller0: entered allmulticast mode [ 342.495550][T15923] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.3441'. [ 342.579632][T15927] netlink: 'syz.2.3443': attribute type 21 has an invalid length. [ 342.591232][T15926] syzkaller0: entered promiscuous mode [ 342.608048][T15926] syzkaller0: entered allmulticast mode [ 342.953529][T15947] syzkaller0: entered promiscuous mode [ 342.966691][T15947] syzkaller0: entered allmulticast mode [ 343.014363][ T6412] lec:lec_start_xmit: lec0:No lecd attached [ 343.142307][T15957] syzkaller0: entered promiscuous mode [ 343.148102][T15957] syzkaller0: entered allmulticast mode [ 343.156090][T15961] netlink: 'syz.6.3459': attribute type 21 has an invalid length. [ 343.519505][T15983] syzkaller0: entered promiscuous mode [ 343.539663][T15983] syzkaller0: entered allmulticast mode [ 343.639432][T15995] netlink: 'syz.6.3472': attribute type 21 has an invalid length. [ 343.822606][T15992] syzkaller0: entered promiscuous mode [ 343.828326][T15992] syzkaller0: entered allmulticast mode [ 345.092117][T16043] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3490'. [ 345.583998][T16043] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.591197][T16043] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.600034][T16043] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.607165][T16043] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.629266][T16043] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3490'. [ 345.663767][T16043] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.671210][T16043] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.879530][T16053] syzkaller0: entered promiscuous mode [ 345.885133][T16053] syzkaller0: entered allmulticast mode [ 346.188564][T16072] syzkaller0: entered promiscuous mode [ 346.196493][T16072] syzkaller0: entered allmulticast mode [ 346.326891][T16079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3504'. [ 346.447916][T16085] batman_adv: batadv0: Adding interface: dummy0 [ 346.455096][T16085] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.482084][T16085] batman_adv: batadv0: Interface activated: dummy0 [ 346.516412][T16088] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 346.531904][T16088] team0 (unregistering): Port device team_slave_0 removed [ 346.548321][T16088] team0 (unregistering): Failed to send options change via netlink (err -105) [ 346.574917][T16088] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 346.586775][T16088] team0 (unregistering): Port device team_slave_1 removed [ 346.606462][T16096] syzkaller0: entered promiscuous mode [ 346.612063][T16096] syzkaller0: entered allmulticast mode [ 346.705449][T16095] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.839370][T16095] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.886705][T16108] syzkaller0: entered promiscuous mode [ 346.892217][T16108] syzkaller0: entered allmulticast mode [ 346.968951][T16114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3518'. [ 347.062801][T16095] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.072259][T16119] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3521'. [ 347.101303][T16119] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3521'. [ 347.213944][T16095] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.342699][T16132] syzkaller0: entered promiscuous mode [ 347.356457][T16132] syzkaller0: entered allmulticast mode [ 347.439312][T16129] syzkaller0: entered promiscuous mode [ 347.444826][T16129] syzkaller0: entered allmulticast mode [ 347.522197][ T68] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.536013][T16146] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3530'. [ 347.698695][T16156] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3535'. [ 348.716810][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5700 ms [ 348.724837][ C1] lec:lec_tx_timeout: lec0 [ 349.059856][T16156] bridge0: port 2(bridge_slave_1) entered blocking state [ 349.067095][T16156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 349.074551][T16156] bridge0: port 1(bridge_slave_0) entered blocking state [ 349.081775][T16156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 349.100494][T16156] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3535'. [ 349.109946][ T35] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.150217][ T47] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.217703][T16174] ip6t_srh: unknown srh match flags 5F28 [ 349.224950][T16172] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3537'. [ 349.252784][ T47] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.469180][T16190] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input11 [ 349.482536][T16188] syzkaller0: entered promiscuous mode [ 349.502564][T16188] syzkaller0: entered allmulticast mode [ 349.664291][T16198] syzkaller0: entered promiscuous mode [ 349.669988][T16198] syzkaller0: entered allmulticast mode [ 349.824680][T16207] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.006794][T16207] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.073593][T16207] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.218940][T16220] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.251344][T16207] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.319769][T16220] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.439708][T16220] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.453318][T16237] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input12 [ 350.524779][T14335] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.581565][T16220] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.625404][ T47] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.668877][T16207] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.759805][T16241] syzkaller0: entered promiscuous mode [ 350.767449][T16241] syzkaller0: entered allmulticast mode [ 350.799799][T16207] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.233436][ T68] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.254722][ T57] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.335050][ T47] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.364454][ T47] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.781070][T16288] __nla_validate_parse: 3 callbacks suppressed [ 352.781085][T16288] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3573'. [ 352.815807][T16288] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.823055][T16288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 352.830610][T16288] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.837748][T16288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 352.849792][T16288] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3573'. [ 353.012976][T16293] syzkaller0: entered promiscuous mode [ 353.018618][T16293] syzkaller0: entered allmulticast mode [ 353.029819][T16291] syzkaller0: entered promiscuous mode [ 353.035312][T16291] syzkaller0: entered allmulticast mode [ 353.094466][T16295] syzkaller0: entered promiscuous mode [ 353.101043][T16295] syzkaller0: entered allmulticast mode [ 353.406392][T16313] FAULT_INJECTION: forcing a failure. [ 353.406392][T16313] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.419887][T16313] CPU: 1 UID: 0 PID: 16313 Comm: syz.4.3584 Not tainted syzkaller #0 PREEMPT(full) [ 353.419937][T16313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 353.419953][T16313] Call Trace: [ 353.419960][T16313] [ 353.419967][T16313] dump_stack_lvl+0xe8/0x150 [ 353.419994][T16313] should_fail_ex+0x412/0x560 [ 353.420022][T16313] _copy_from_user+0x2d/0xb0 [ 353.420041][T16313] ___sys_sendmsg+0x1c6/0x360 [ 353.420062][T16313] ? __lock_acquire+0x6b5/0x2cf0 [ 353.420083][T16313] ? __pfx____sys_sendmsg+0x10/0x10 [ 353.420135][T16313] ? __fget_files+0x2a/0x420 [ 353.420152][T16313] ? __fget_files+0x3a0/0x420 [ 353.420184][T16313] __x64_sys_sendmsg+0x1bd/0x2a0 [ 353.420208][T16313] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 353.420237][T16313] ? __pfx_ksys_write+0x10/0x10 [ 353.420267][T16313] do_syscall_64+0x14d/0xf80 [ 353.420288][T16313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.420304][T16313] ? trace_irq_disable+0x37/0x100 [ 353.420321][T16313] ? clear_bhb_loop+0x40/0x90 [ 353.420342][T16313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.420358][T16313] RIP: 0033:0x7f6bbc79bf79 [ 353.420374][T16313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.420388][T16313] RSP: 002b:00007f6bbd735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 353.420408][T16313] RAX: ffffffffffffffda RBX: 00007f6bbca15fa0 RCX: 00007f6bbc79bf79 [ 353.420421][T16313] RDX: 0000000000000010 RSI: 0000200000000180 RDI: 0000000000000004 [ 353.420432][T16313] RBP: 00007f6bbd735090 R08: 0000000000000000 R09: 0000000000000000 [ 353.420442][T16313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.420452][T16313] R13: 00007f6bbca16038 R14: 00007f6bbca15fa0 R15: 00007ffd65b446f8 [ 353.420481][T16313] [ 353.897393][T16332] syzkaller0: entered promiscuous mode [ 353.902923][T16332] syzkaller0: entered allmulticast mode [ 354.348138][T16364] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3603'. [ 354.360003][ T5927] IPVS: starting estimator thread 0... [ 354.457025][T16365] IPVS: using max 34 ests per chain, 81600 per kthread [ 355.133744][T16400] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3614'. [ 355.575651][T16417] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3622'. [ 355.662123][T16414] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.727567][T16414] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.874910][T16414] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.931083][T16432] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 355.942609][T16432] team0 (unregistering): Port device team_slave_0 removed [ 355.958624][T16432] team0 (unregistering): Failed to send options change via netlink (err -105) [ 355.979963][T16432] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 355.992429][T16432] team0 (unregistering): Port device team_slave_1 removed [ 356.049856][T16414] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.130091][T16442] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.162382][T16444] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3630'. [ 356.414158][T16442] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.565579][ T35] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.598887][T16442] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.624117][T16457] syzkaller0: entered promiscuous mode [ 356.629709][T16457] syzkaller0: entered allmulticast mode [ 356.638068][ T35] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.648067][ T35] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.683664][T16459] syzkaller0: entered promiscuous mode [ 356.689482][T16459] syzkaller0: entered allmulticast mode [ 356.696703][ T68] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.791024][T16442] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.869281][T16468] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3640'. [ 356.888334][T16464] syzkaller0: entered promiscuous mode [ 356.893844][T16464] syzkaller0: entered allmulticast mode [ 356.901625][T16468] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.908963][T16468] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.046228][T16473] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3642'. [ 357.108977][ T68] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.136210][ T35] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.185004][ T68] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.239230][ T13] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.538294][T16498] syzkaller0: entered promiscuous mode [ 357.544003][T16498] syzkaller0: entered allmulticast mode [ 358.176684][T16486] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 358.409961][T16539] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:65535 [ 358.752415][T16549] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 358.752676][ T5871] IPVS: starting estimator thread 0... [ 358.846144][T16552] IPVS: using max 57 ests per chain, 136800 per kthread [ 359.436224][ T5831] Bluetooth: hci0: command 0x080f tx timeout [ 359.769230][ T5901] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.783617][ T5901] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.804500][ T5901] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.829563][ T5901] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.929007][T16558] FAULT_INJECTION: forcing a failure. [ 359.929007][T16558] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 359.952828][T16558] CPU: 0 UID: 0 PID: 16558 Comm: syz.2.3672 Not tainted syzkaller #0 PREEMPT(full) [ 359.952854][T16558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 359.952864][T16558] Call Trace: [ 359.952871][T16558] [ 359.952879][T16558] dump_stack_lvl+0xe8/0x150 [ 359.952906][T16558] should_fail_ex+0x412/0x560 [ 359.952934][T16558] _copy_from_user+0x2d/0xb0 [ 359.952952][T16558] ___sys_sendmsg+0x1c6/0x360 [ 359.952973][T16558] ? __lock_acquire+0x6b5/0x2cf0 [ 359.952995][T16558] ? __pfx____sys_sendmsg+0x10/0x10 [ 359.953020][T16558] ? kstrtouint+0x6e/0xe0 [ 359.953063][T16558] ? __fget_files+0x2a/0x420 [ 359.953080][T16558] ? __fget_files+0x3a0/0x420 [ 359.953105][T16558] __sys_sendmmsg+0x27c/0x4e0 [ 359.953131][T16558] ? __pfx___sys_sendmmsg+0x10/0x10 [ 359.953148][T16558] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 359.953193][T16558] ? ksys_write+0x242/0x270 [ 359.953215][T16558] ? __pfx_ksys_write+0x10/0x10 [ 359.953240][T16558] __x64_sys_sendmmsg+0xa0/0xc0 [ 359.953262][T16558] do_syscall_64+0x14d/0xf80 [ 359.953356][T16558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.953372][T16558] ? trace_irq_disable+0x37/0x100 [ 359.953390][T16558] ? clear_bhb_loop+0x40/0x90 [ 359.953411][T16558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.953427][T16558] RIP: 0033:0x7f04edd9bf79 [ 359.953442][T16558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.953456][T16558] RSP: 002b:00007f04ebff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 359.953475][T16558] RAX: ffffffffffffffda RBX: 00007f04ee015fa0 RCX: 00007f04edd9bf79 [ 359.953487][T16558] RDX: 0000000000000001 RSI: 00002000000007c0 RDI: 0000000000000003 [ 359.953498][T16558] RBP: 00007f04ebff6090 R08: 0000000000000000 R09: 0000000000000000 [ 359.953509][T16558] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000001 [ 359.953519][T16558] R13: 00007f04ee016038 R14: 00007f04ee015fa0 R15: 00007ffd09109968 [ 359.953544][T16558] [ 360.560509][T16585] netlink: 'syz.1.3686': attribute type 1 has an invalid length. [ 360.570040][T16589] FAULT_INJECTION: forcing a failure. [ 360.570040][T16589] name failslab, interval 1, probability 0, space 0, times 0 [ 360.572823][T16585] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3686'. [ 360.584114][T16589] CPU: 0 UID: 0 PID: 16589 Comm: syz.3.3685 Not tainted syzkaller #0 PREEMPT(full) [ 360.584138][T16589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 360.584149][T16589] Call Trace: [ 360.584157][T16589] [ 360.584164][T16589] dump_stack_lvl+0xe8/0x150 [ 360.584189][T16589] should_fail_ex+0x412/0x560 [ 360.584225][T16589] should_failslab+0xa8/0x100 [ 360.584249][T16589] __kmalloc_cache_noprof+0x88/0x660 [ 360.584270][T16589] ? sctp_datamsg_from_user+0x88/0xef0 [ 360.584292][T16589] sctp_datamsg_from_user+0x88/0xef0 [ 360.584309][T16589] ? __sk_mem_raise_allocated+0x290/0x1270 [ 360.584331][T16589] ? sctp_prsctp_prune+0x701/0x7a0 [ 360.584360][T16589] ? __sk_mem_schedule+0x7f/0xf0 [ 360.584384][T16589] sctp_sendmsg_to_asoc+0x1416/0x1900 [ 360.584414][T16589] ? tomoyo_check_open_permission+0x38e/0x470 [ 360.584440][T16589] ? do_raw_spin_lock+0x12b/0x2f0 [ 360.584460][T16589] ? lock_sock_nested+0x6a/0x100 [ 360.584477][T16589] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 360.584505][T16589] ? sctp_sendmsg_check_sflags+0x18a/0x330 [ 360.584529][T16589] sctp_sendmsg+0x1b3d/0x2c10 [ 360.584563][T16589] ? __pfx_sctp_sendmsg+0x10/0x10 [ 360.584581][T16589] ? aa_sk_perm+0x15a/0x960 [ 360.584603][T16589] ? aa_sk_perm+0x82d/0x960 [ 360.584621][T16589] ? aa_file_perm+0x12d/0x1630 [ 360.584649][T16589] ? __pfx_aa_sk_perm+0x10/0x10 [ 360.584672][T16589] ? sock_rps_record_flow+0x19/0x400 [ 360.584695][T16589] ? inet_sendmsg+0x2f4/0x370 [ 360.584714][T16589] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 360.584738][T16589] sock_write_iter+0x421/0x550 [ 360.584762][T16589] ? __pfx_sock_write_iter+0x10/0x10 [ 360.584804][T16589] do_iter_readv_writev+0x619/0x8c0 [ 360.584827][T16589] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 360.584852][T16589] ? bpf_lsm_file_permission+0x9/0x20 [ 360.584873][T16589] ? security_file_permission+0x75/0x260 [ 360.584900][T16589] ? rw_verify_area+0x255/0x4d0 [ 360.584922][T16589] vfs_writev+0x33c/0x990 [ 360.584951][T16589] ? __pfx_vfs_writev+0x10/0x10 [ 360.584987][T16589] ? __fget_files+0x2a/0x420 [ 360.585007][T16589] ? __fget_files+0x3a0/0x420 [ 360.585021][T16589] ? __fget_files+0x2a/0x420 [ 360.585045][T16589] do_writev+0x154/0x2e0 [ 360.585069][T16589] ? __pfx_do_writev+0x10/0x10 [ 360.585101][T16589] do_syscall_64+0x14d/0xf80 [ 360.585120][T16589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.585137][T16589] ? trace_irq_disable+0x37/0x100 [ 360.585154][T16589] ? clear_bhb_loop+0x40/0x90 [ 360.585173][T16589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.585189][T16589] RIP: 0033:0x7f703d59bf79 [ 360.585205][T16589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.585226][T16589] RSP: 002b:00007f703e416028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 360.585244][T16589] RAX: ffffffffffffffda RBX: 00007f703d815fa0 RCX: 00007f703d59bf79 [ 360.585256][T16589] RDX: 0000000000000001 RSI: 0000200000001300 RDI: 0000000000000003 [ 360.585267][T16589] RBP: 00007f703e416090 R08: 0000000000000000 R09: 0000000000000000 [ 360.585277][T16589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 360.585287][T16589] R13: 00007f703d816038 R14: 00007f703d815fa0 R15: 00007ffddcb433a8 [ 360.585320][T16589] [ 360.918354][T16585] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3686'. [ 361.119487][T16609] syzkaller0: entered promiscuous mode [ 361.132200][T16609] syzkaller0: entered allmulticast mode [ 361.227305][T16621] netlink: 'syz.1.3696': attribute type 10 has an invalid length. [ 361.244570][T16621] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.251941][T16621] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.300688][T16621] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.307933][T16621] bridge0: port 2(bridge_slave_1) entered forwarding state [ 361.315481][T16621] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.322670][T16621] bridge0: port 1(bridge_slave_0) entered forwarding state [ 361.380096][T16621] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 361.418478][T16627] syzkaller0: entered promiscuous mode [ 361.437362][T16627] syzkaller0: entered allmulticast mode [ 361.455771][T16630] bridge: RTM_NEWNEIGH with invalid ether address [ 361.563112][T16636] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3702'. [ 361.896781][T16659] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 361.907338][T16659] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3709'. [ 361.988600][T16665] dvmrp0: entered allmulticast mode [ 362.133208][T16675] syzkaller0: entered promiscuous mode [ 362.141971][T16675] syzkaller0: entered allmulticast mode [ 362.278252][T16686] FAULT_INJECTION: forcing a failure. [ 362.278252][T16686] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 362.295788][T16686] CPU: 0 UID: 0 PID: 16686 Comm: syz.3.3721 Not tainted syzkaller #0 PREEMPT(full) [ 362.295813][T16686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 362.295824][T16686] Call Trace: [ 362.295831][T16686] [ 362.295838][T16686] dump_stack_lvl+0xe8/0x150 [ 362.295867][T16686] should_fail_ex+0x412/0x560 [ 362.295892][T16686] _copy_from_iter+0x1d3/0x1670 [ 362.295918][T16686] ? __lock_acquire+0x6b5/0x2cf0 [ 362.295937][T16686] ? __pfx__copy_from_iter+0x10/0x10 [ 362.295964][T16686] ? __lock_acquire+0x6b5/0x2cf0 [ 362.295986][T16686] tun_get_user+0x275/0x3dd0 [ 362.296017][T16686] ? aa_file_perm+0x12d/0x1630 [ 362.296041][T16686] ? aa_file_perm+0x12d/0x1630 [ 362.296062][T16686] ? aa_file_perm+0x440/0x1630 [ 362.296083][T16686] ? __pfx_tun_get_user+0x10/0x10 [ 362.296107][T16686] ? __lock_acquire+0x6b5/0x2cf0 [ 362.296125][T16686] ? kstrtoull+0x12f/0x1d0 [ 362.296161][T16686] ? ref_tracker_alloc+0x363/0x4d0 [ 362.296185][T16686] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 362.296209][T16686] ? tun_get+0x1c/0x2f0 [ 362.296229][T16686] ? tun_get+0x1c/0x2f0 [ 362.296254][T16686] ? tun_get+0x1c/0x2f0 [ 362.296273][T16686] ? tun_get+0x1c/0x2f0 [ 362.296296][T16686] tun_chr_write_iter+0x113/0x200 [ 362.296319][T16686] vfs_write+0x61d/0xb90 [ 362.296346][T16686] ? __pfx_vfs_write+0x10/0x10 [ 362.296375][T16686] ? __fget_files+0x2a/0x420 [ 362.296399][T16686] ksys_write+0x150/0x270 [ 362.296420][T16686] ? __pfx_ksys_write+0x10/0x10 [ 362.296449][T16686] do_syscall_64+0x14d/0xf80 [ 362.296470][T16686] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.296486][T16686] ? trace_irq_disable+0x37/0x100 [ 362.296504][T16686] ? clear_bhb_loop+0x40/0x90 [ 362.296524][T16686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.296539][T16686] RIP: 0033:0x7f703d59bf79 [ 362.296555][T16686] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 362.296569][T16686] RSP: 002b:00007f703e416028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 362.296587][T16686] RAX: ffffffffffffffda RBX: 00007f703d815fa0 RCX: 00007f703d59bf79 [ 362.296600][T16686] RDX: 000000000000014c RSI: 00002000000006c0 RDI: 0000000000000004 [ 362.296611][T16686] RBP: 00007f703e416090 R08: 0000000000000000 R09: 0000000000000000 [ 362.296620][T16686] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 362.296630][T16686] R13: 00007f703d816038 R14: 00007f703d815fa0 R15: 00007ffddcb433a8 [ 362.296657][T16686] [ 362.828158][T16708] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 362.916510][T16709] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3730'. [ 362.960607][T16717] FAULT_INJECTION: forcing a failure. [ 362.960607][T16717] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 363.025154][T16717] CPU: 1 UID: 0 PID: 16717 Comm: syz.1.3732 Not tainted syzkaller #0 PREEMPT(full) [ 363.025180][T16717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 363.025191][T16717] Call Trace: [ 363.025199][T16717] [ 363.025206][T16717] dump_stack_lvl+0xe8/0x150 [ 363.025233][T16717] should_fail_ex+0x412/0x560 [ 363.025261][T16717] _copy_from_user+0x2d/0xb0 [ 363.025280][T16717] __sys_connect+0x156/0x450 [ 363.025309][T16717] ? __pfx___sys_connect+0x10/0x10 [ 363.025340][T16717] ? __pfx_ksys_write+0x10/0x10 [ 363.025368][T16717] __x64_sys_connect+0x7a/0x90 [ 363.025388][T16717] do_syscall_64+0x14d/0xf80 [ 363.025409][T16717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.025424][T16717] ? trace_irq_disable+0x37/0x100 [ 363.025442][T16717] ? clear_bhb_loop+0x40/0x90 [ 363.025460][T16717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.025475][T16717] RIP: 0033:0x7efeffb9bf79 [ 363.025490][T16717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 363.025516][T16717] RSP: 002b:00007efefddcd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 363.025534][T16717] RAX: ffffffffffffffda RBX: 00007efeffe16090 RCX: 00007efeffb9bf79 [ 363.025546][T16717] RDX: 000000000000000a RSI: 0000200000005dc0 RDI: 0000000000000004 [ 363.025557][T16717] RBP: 00007efefddcd090 R08: 0000000000000000 R09: 0000000000000000 [ 363.025567][T16717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 363.025576][T16717] R13: 00007efeffe16128 R14: 00007efeffe16090 R15: 00007fff8b1ccb48 [ 363.025604][T16717] [ 363.268873][T16724] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 363.412532][T16731] netlink: 'syz.4.3734': attribute type 5 has an invalid length. [ 363.578718][T16736] syzkaller0: entered promiscuous mode [ 363.592068][T16736] syzkaller0: entered allmulticast mode [ 363.707352][T16745] FAULT_INJECTION: forcing a failure. [ 363.707352][T16745] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 363.720764][T16745] CPU: 0 UID: 0 PID: 16745 Comm: syz.3.3742 Not tainted syzkaller #0 PREEMPT(full) [ 363.720788][T16745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 363.720797][T16745] Call Trace: [ 363.720804][T16745] [ 363.720811][T16745] dump_stack_lvl+0xe8/0x150 [ 363.720837][T16745] should_fail_ex+0x412/0x560 [ 363.720864][T16745] _copy_from_user+0x2d/0xb0 [ 363.720883][T16745] tls_setsockopt+0x77f/0x15c0 [ 363.720903][T16745] ? aa_sk_perm+0x15a/0x960 [ 363.720925][T16745] ? aa_sk_perm+0x82d/0x960 [ 363.720947][T16745] ? __pfx_tls_setsockopt+0x10/0x10 [ 363.720968][T16745] ? __pfx_aa_sk_perm+0x10/0x10 [ 363.720991][T16745] ? __fget_files+0x2a/0x420 [ 363.721006][T16745] ? aa_sock_opt_perm+0xff/0x1a0 [ 363.721038][T16745] ? sock_common_setsockopt+0x36/0xc0 [ 363.721054][T16745] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 363.721072][T16745] do_sock_setsockopt+0x17c/0x1b0 [ 363.721097][T16745] __x64_sys_setsockopt+0x13d/0x1b0 [ 363.721121][T16745] do_syscall_64+0x14d/0xf80 [ 363.721141][T16745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.721155][T16745] ? trace_irq_disable+0x37/0x100 [ 363.721172][T16745] ? clear_bhb_loop+0x40/0x90 [ 363.721190][T16745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.721206][T16745] RIP: 0033:0x7f703d59bf79 [ 363.721221][T16745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 363.721236][T16745] RSP: 002b:00007f703e416028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 363.721255][T16745] RAX: ffffffffffffffda RBX: 00007f703d815fa0 RCX: 00007f703d59bf79 [ 363.721267][T16745] RDX: 0000000000000004 RSI: 000000000000011a RDI: 0000000000000003 [ 363.721277][T16745] RBP: 00007f703e416090 R08: 0000000000000044 R09: 0000000000000000 [ 363.721288][T16745] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 363.721298][T16745] R13: 00007f703d816038 R14: 00007f703d815fa0 R15: 00007ffddcb433a8 [ 363.721324][T16745] [ 363.737917][T16749] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3743'. [ 363.936378][T16754] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3745'. [ 363.978150][T16754] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.985939][T16754] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.058003][T16756] syzkaller0: entered promiscuous mode [ 364.076414][T16756] syzkaller0: entered allmulticast mode [ 364.153098][T16760] FAULT_INJECTION: forcing a failure. [ 364.153098][T16760] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 364.179322][T16760] CPU: 1 UID: 0 PID: 16760 Comm: syz.1.3748 Not tainted syzkaller #0 PREEMPT(full) [ 364.179348][T16760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 364.179358][T16760] Call Trace: [ 364.179365][T16760] [ 364.179373][T16760] dump_stack_lvl+0xe8/0x150 [ 364.179399][T16760] should_fail_ex+0x412/0x560 [ 364.179426][T16760] _copy_from_user+0x2d/0xb0 [ 364.179446][T16760] __sys_bpf+0x229/0x950 [ 364.179468][T16760] ? __pfx___sys_bpf+0x10/0x10 [ 364.179501][T16760] ? ksys_write+0x242/0x270 [ 364.179523][T16760] ? __pfx_ksys_write+0x10/0x10 [ 364.179550][T16760] __x64_sys_bpf+0x7c/0x90 [ 364.179569][T16760] do_syscall_64+0x14d/0xf80 [ 364.179590][T16760] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.179606][T16760] ? trace_irq_disable+0x37/0x100 [ 364.179624][T16760] ? clear_bhb_loop+0x40/0x90 [ 364.179644][T16760] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.179660][T16760] RIP: 0033:0x7efeffb9bf79 [ 364.179676][T16760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.179691][T16760] RSP: 002b:00007efefddee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 364.179711][T16760] RAX: ffffffffffffffda RBX: 00007efeffe15fa0 RCX: 00007efeffb9bf79 [ 364.179723][T16760] RDX: 0000000000000094 RSI: 0000200000002c40 RDI: 0000000000000005 [ 364.179735][T16760] RBP: 00007efefddee090 R08: 0000000000000000 R09: 0000000000000000 [ 364.179746][T16760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.179756][T16760] R13: 00007efeffe16038 R14: 00007efeffe15fa0 R15: 00007fff8b1ccb48 [ 364.179785][T16760] [ 364.422555][T16767] netlink: 'syz.6.3749': attribute type 11 has an invalid length. [ 364.631798][T16782] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3757'. [ 364.634449][T16781] syzkaller0: entered promiscuous mode [ 364.649839][T16781] syzkaller0: entered allmulticast mode [ 364.703451][T16782] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.710940][T16782] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.764383][T16789] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3760'. [ 364.928657][T16797] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3766'. [ 365.085542][T16805] syzkaller0: entered promiscuous mode [ 365.091504][T16805] syzkaller0: entered allmulticast mode [ 365.194454][T16817] FAULT_INJECTION: forcing a failure. [ 365.194454][T16817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.208262][T16817] CPU: 1 UID: 0 PID: 16817 Comm: syz.1.3773 Not tainted syzkaller #0 PREEMPT(full) [ 365.208287][T16817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 365.208296][T16817] Call Trace: [ 365.208304][T16817] [ 365.208311][T16817] dump_stack_lvl+0xe8/0x150 [ 365.208337][T16817] should_fail_ex+0x412/0x560 [ 365.208364][T16817] _copy_from_user+0x2d/0xb0 [ 365.208382][T16817] ___sys_sendmsg+0x1c6/0x360 [ 365.208402][T16817] ? __lock_acquire+0x6b5/0x2cf0 [ 365.208424][T16817] ? __pfx____sys_sendmsg+0x10/0x10 [ 365.208476][T16817] ? __fget_files+0x2a/0x420 [ 365.208492][T16817] ? __fget_files+0x3a0/0x420 [ 365.208516][T16817] __x64_sys_sendmsg+0x1bd/0x2a0 [ 365.208538][T16817] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 365.208567][T16817] ? __pfx_ksys_write+0x10/0x10 [ 365.208599][T16817] do_syscall_64+0x14d/0xf80 [ 365.208619][T16817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.208633][T16817] ? trace_irq_disable+0x37/0x100 [ 365.208650][T16817] ? clear_bhb_loop+0x40/0x90 [ 365.208669][T16817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.208683][T16817] RIP: 0033:0x7efeffb9bf79 [ 365.208699][T16817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.208712][T16817] RSP: 002b:00007efefddee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 365.208730][T16817] RAX: ffffffffffffffda RBX: 00007efeffe15fa0 RCX: 00007efeffb9bf79 [ 365.208742][T16817] RDX: 0000000000028850 RSI: 0000200000000180 RDI: 0000000000000003 [ 365.208754][T16817] RBP: 00007efefddee090 R08: 0000000000000000 R09: 0000000000000000 [ 365.208764][T16817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.208774][T16817] R13: 00007efeffe16038 R14: 00007efeffe15fa0 R15: 00007fff8b1ccb48 [ 365.208802][T16817] [ 365.276581][ T5831] Bluetooth: hci3: command tx timeout [ 365.607427][T16840] __nla_validate_parse: 2 callbacks suppressed [ 365.607446][T16840] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3779'. [ 365.623437][T16840] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.630703][T16840] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.687352][T16842] syzkaller0: entered promiscuous mode [ 365.693924][T16842] syzkaller0: entered allmulticast mode [ 365.846361][T16847] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3782'. [ 365.961872][T16852] FAULT_INJECTION: forcing a failure. [ 365.961872][T16852] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.992080][T16852] CPU: 1 UID: 0 PID: 16852 Comm: syz.2.3784 Not tainted syzkaller #0 PREEMPT(full) [ 365.992105][T16852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 365.992115][T16852] Call Trace: [ 365.992122][T16852] [ 365.992129][T16852] dump_stack_lvl+0xe8/0x150 [ 365.992156][T16852] should_fail_ex+0x412/0x560 [ 365.992183][T16852] _copy_from_user+0x2d/0xb0 [ 365.992201][T16852] ___sys_sendmsg+0x1c6/0x360 [ 365.992221][T16852] ? __lock_acquire+0x6b5/0x2cf0 [ 365.992243][T16852] ? __pfx____sys_sendmsg+0x10/0x10 [ 365.992295][T16852] ? __fget_files+0x2a/0x420 [ 365.992311][T16852] ? __fget_files+0x3a0/0x420 [ 365.992337][T16852] __x64_sys_sendmsg+0x1bd/0x2a0 [ 365.992360][T16852] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 365.992389][T16852] ? __pfx_ksys_write+0x10/0x10 [ 365.992420][T16852] do_syscall_64+0x14d/0xf80 [ 365.992440][T16852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.992456][T16852] ? trace_irq_disable+0x37/0x100 [ 365.992474][T16852] ? clear_bhb_loop+0x40/0x90 [ 365.992493][T16852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.992509][T16852] RIP: 0033:0x7f04edd9bf79 [ 365.992526][T16852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.992540][T16852] RSP: 002b:00007f04ebfd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 365.992558][T16852] RAX: ffffffffffffffda RBX: 00007f04ee016090 RCX: 00007f04edd9bf79 [ 365.992571][T16852] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 365.992582][T16852] RBP: 00007f04ebfd5090 R08: 0000000000000000 R09: 0000000000000000 [ 365.992592][T16852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.992602][T16852] R13: 00007f04ee016128 R14: 00007f04ee016090 R15: 00007ffd09109968 [ 365.992631][T16852] [ 368.391661][T16826] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 368.402659][T16862] netlink: 'syz.4.3787': attribute type 1 has an invalid length. [ 368.544623][T16868] syzkaller0: entered promiscuous mode [ 368.554273][T16868] syzkaller0: entered allmulticast mode [ 368.580246][T16872] FAULT_INJECTION: forcing a failure. [ 368.580246][T16872] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 368.602549][T16873] bridge1: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 368.614339][T16872] CPU: 0 UID: 0 PID: 16872 Comm: syz.2.3791 Not tainted syzkaller #0 PREEMPT(full) [ 368.614362][T16872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 368.614372][T16872] Call Trace: [ 368.614378][T16872] [ 368.614385][T16872] dump_stack_lvl+0xe8/0x150 [ 368.614412][T16872] should_fail_ex+0x412/0x560 [ 368.614440][T16872] _copy_from_user+0x2d/0xb0 [ 368.614459][T16872] do_sock_getsockopt+0x165/0x3f0 [ 368.614483][T16872] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 368.614504][T16872] ? __fget_files+0x3a0/0x420 [ 368.614520][T16872] ? __fget_files+0x2a/0x420 [ 368.614552][T16872] __x64_sys_getsockopt+0x1a4/0x240 [ 368.614581][T16872] do_syscall_64+0x14d/0xf80 [ 368.614602][T16872] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.614618][T16872] ? trace_irq_disable+0x37/0x100 [ 368.614636][T16872] ? clear_bhb_loop+0x40/0x90 [ 368.614656][T16872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.614672][T16872] RIP: 0033:0x7f04edd9bf79 [ 368.614689][T16872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.614703][T16872] RSP: 002b:00007f04ebff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 368.614722][T16872] RAX: ffffffffffffffda RBX: 00007f04ee015fa0 RCX: 00007f04edd9bf79 [ 368.614734][T16872] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000003 [ 368.614745][T16872] RBP: 00007f04ebff6090 R08: 0000200000000380 R09: 0000000000000000 [ 368.614756][T16872] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 368.614767][T16872] R13: 00007f04ee016038 R14: 00007f04ee015fa0 R15: 00007ffd09109968 [ 368.614794][T16872] [ 368.629962][T16875] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3793'. [ 368.785593][T16878] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 369.086973][T16887] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 369.104599][T16887] team0 (unregistering): Port device team_slave_0 removed [ 369.134797][T16887] team0 (unregistering): Failed to send options change via netlink (err -105) [ 369.155452][T16897] FAULT_INJECTION: forcing a failure. [ 369.155452][T16897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 369.165812][T16887] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 369.177274][T16897] CPU: 1 UID: 0 PID: 16897 Comm: syz.1.3801 Not tainted syzkaller #0 PREEMPT(full) [ 369.177300][T16897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 369.177311][T16897] Call Trace: [ 369.177318][T16897] [ 369.177325][T16897] dump_stack_lvl+0xe8/0x150 [ 369.177351][T16897] should_fail_ex+0x412/0x560 [ 369.177377][T16897] _copy_from_user+0x2d/0xb0 [ 369.177395][T16897] __sys_connect+0x156/0x450 [ 369.177416][T16897] ? __pfx___sys_connect+0x10/0x10 [ 369.177451][T16897] ? __pfx_ksys_write+0x10/0x10 [ 369.177477][T16897] __x64_sys_connect+0x7a/0x90 [ 369.177496][T16897] do_syscall_64+0x14d/0xf80 [ 369.177516][T16897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.177532][T16897] ? trace_irq_disable+0x37/0x100 [ 369.177549][T16897] ? clear_bhb_loop+0x40/0x90 [ 369.177569][T16897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.177585][T16897] RIP: 0033:0x7efeffb9bf79 [ 369.177600][T16897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.177614][T16897] RSP: 002b:00007efefddee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 369.177632][T16897] RAX: ffffffffffffffda RBX: 00007efeffe15fa0 RCX: 00007efeffb9bf79 [ 369.177644][T16897] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000005 [ 369.177655][T16897] RBP: 00007efefddee090 R08: 0000000000000000 R09: 0000000000000000 [ 369.177665][T16897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 369.177675][T16897] R13: 00007efeffe16038 R14: 00007efeffe15fa0 R15: 00007fff8b1ccb48 [ 369.177701][T16897] [ 369.344382][T16887] team0 (unregistering): Port device team_slave_1 removed [ 369.385998][T16898] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.492795][T16898] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.521390][T16914] FAULT_INJECTION: forcing a failure. [ 369.521390][T16914] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 369.550768][T16914] CPU: 0 UID: 0 PID: 16914 Comm: syz.1.3806 Not tainted syzkaller #0 PREEMPT(full) [ 369.550792][T16914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 369.550803][T16914] Call Trace: [ 369.550809][T16914] [ 369.550817][T16914] dump_stack_lvl+0xe8/0x150 [ 369.550843][T16914] should_fail_ex+0x412/0x560 [ 369.550870][T16914] _copy_from_user+0x2d/0xb0 [ 369.550888][T16914] ___sys_sendmsg+0x1c6/0x360 [ 369.550907][T16914] ? __lock_acquire+0x6b5/0x2cf0 [ 369.550928][T16914] ? __pfx____sys_sendmsg+0x10/0x10 [ 369.550978][T16914] ? __fget_files+0x2a/0x420 [ 369.550993][T16914] ? __fget_files+0x3a0/0x420 [ 369.551016][T16914] __x64_sys_sendmsg+0x1bd/0x2a0 [ 369.551037][T16914] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 369.551061][T16914] ? __pfx_ksys_write+0x10/0x10 [ 369.551092][T16914] do_syscall_64+0x14d/0xf80 [ 369.551112][T16914] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.551128][T16914] ? trace_irq_disable+0x37/0x100 [ 369.551146][T16914] ? clear_bhb_loop+0x40/0x90 [ 369.551163][T16914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.551180][T16914] RIP: 0033:0x7efeffb9bf79 [ 369.551195][T16914] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.551209][T16914] RSP: 002b:00007efefddee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 369.551227][T16914] RAX: ffffffffffffffda RBX: 00007efeffe15fa0 RCX: 00007efeffb9bf79 [ 369.551239][T16914] RDX: 0000000004000004 RSI: 0000200000000100 RDI: 0000000000000003 [ 369.551248][T16914] RBP: 00007efefddee090 R08: 0000000000000000 R09: 0000000000000000 [ 369.551257][T16914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 369.551266][T16914] R13: 00007efeffe16038 R14: 00007efeffe15fa0 R15: 00007fff8b1ccb48 [ 369.551290][T16914] [ 369.785553][T16916] syzkaller0: entered promiscuous mode [ 369.791392][T16916] syzkaller0: entered allmulticast mode [ 369.854736][T16898] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.889234][T16922] FAULT_INJECTION: forcing a failure. [ 369.889234][T16922] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 369.904683][T16922] CPU: 1 UID: 0 PID: 16922 Comm: syz.3.3810 Not tainted syzkaller #0 PREEMPT(full) [ 369.904708][T16922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 369.904719][T16922] Call Trace: [ 369.904726][T16922] [ 369.904733][T16922] dump_stack_lvl+0xe8/0x150 [ 369.904759][T16922] should_fail_ex+0x412/0x560 [ 369.904784][T16922] _copy_from_user+0x2d/0xb0 [ 369.904803][T16922] __sys_sendto+0x2af/0x7a0 [ 369.904825][T16922] ? __pfx___sys_sendto+0x10/0x10 [ 369.904841][T16922] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 369.904873][T16922] ? __fget_files+0x3a0/0x420 [ 369.904899][T16922] ? ksys_write+0x242/0x270 [ 369.904920][T16922] ? __pfx_ksys_write+0x10/0x10 [ 369.904944][T16922] __x64_sys_sendto+0xde/0x100 [ 369.904965][T16922] do_syscall_64+0x14d/0xf80 [ 369.904985][T16922] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.905001][T16922] ? trace_irq_disable+0x37/0x100 [ 369.905020][T16922] ? clear_bhb_loop+0x40/0x90 [ 369.905039][T16922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.905056][T16922] RIP: 0033:0x7f703d59bf79 [ 369.905071][T16922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.905084][T16922] RSP: 002b:00007f703e416028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 369.905103][T16922] RAX: ffffffffffffffda RBX: 00007f703d815fa0 RCX: 00007f703d59bf79 [ 369.905115][T16922] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000003 [ 369.905126][T16922] RBP: 00007f703e416090 R08: 000020000005ffe4 R09: 000000000000001c [ 369.905138][T16922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 369.905148][T16922] R13: 00007f703d816038 R14: 00007f703d815fa0 R15: 00007ffddcb433a8 [ 369.905173][T16922] [ 370.219282][T16898] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.384845][ T57] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.421673][ T57] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.432242][T16939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3818'. [ 370.451618][ T5871] IPVS: starting estimator thread 0... [ 370.471941][ T47] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.556316][T16944] IPVS: using max 32 ests per chain, 76800 per kthread [ 370.571794][ T57] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.674715][T16952] FAULT_INJECTION: forcing a failure. [ 370.674715][T16952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 370.688498][T16952] CPU: 1 UID: 0 PID: 16952 Comm: syz.3.3823 Not tainted syzkaller #0 PREEMPT(full) [ 370.688522][T16952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 370.688533][T16952] Call Trace: [ 370.688539][T16952] [ 370.688546][T16952] dump_stack_lvl+0xe8/0x150 [ 370.688581][T16952] should_fail_ex+0x412/0x560 [ 370.688607][T16952] _copy_from_user+0x2d/0xb0 [ 370.688626][T16952] ___sys_sendmsg+0x1c6/0x360 [ 370.688647][T16952] ? __lock_acquire+0x6b5/0x2cf0 [ 370.688669][T16952] ? __pfx____sys_sendmsg+0x10/0x10 [ 370.688694][T16952] ? kstrtouint+0x6e/0xe0 [ 370.688737][T16952] ? __fget_files+0x2a/0x420 [ 370.688754][T16952] ? __fget_files+0x3a0/0x420 [ 370.688780][T16952] __sys_sendmmsg+0x27c/0x4e0 [ 370.688805][T16952] ? __pfx___sys_sendmmsg+0x10/0x10 [ 370.688823][T16952] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 370.688867][T16952] ? ksys_write+0x242/0x270 [ 370.688889][T16952] ? __pfx_ksys_write+0x10/0x10 [ 370.688915][T16952] __x64_sys_sendmmsg+0xa0/0xc0 [ 370.688937][T16952] do_syscall_64+0x14d/0xf80 [ 370.688957][T16952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.688972][T16952] ? trace_irq_disable+0x37/0x100 [ 370.688990][T16952] ? clear_bhb_loop+0x40/0x90 [ 370.689010][T16952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.689026][T16952] RIP: 0033:0x7f703d59bf79 [ 370.689040][T16952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.689054][T16952] RSP: 002b:00007f703e416028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 370.689071][T16952] RAX: ffffffffffffffda RBX: 00007f703d815fa0 RCX: 00007f703d59bf79 [ 370.689082][T16952] RDX: 0000000000000003 RSI: 0000200000000300 RDI: 0000000000000003 [ 370.689091][T16952] RBP: 00007f703e416090 R08: 0000000000000000 R09: 0000000000000000 [ 370.689100][T16952] R10: 0000000000002090 R11: 0000000000000246 R12: 0000000000000001 [ 370.689108][T16952] R13: 00007f703d816038 R14: 00007f703d815fa0 R15: 00007ffddcb433a8 [ 370.689134][T16952] [ 370.699534][T16950] syzkaller0: entered promiscuous mode [ 370.856180][ T30] INFO: task syz.5.1963:11608 blocked for more than 143 seconds. [ 370.864292][T16950] syzkaller0: entered allmulticast mode [ 370.865746][ T30] Not tainted syzkaller #0 [ 370.926511][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 370.935819][ T30] task:syz.5.1963 state:D stack:27104 pid:11608 tgid:11606 ppid:8889 task_flags:0x400140 flags:0x00080002 [ 370.955992][ T30] Call Trace: [ 370.959488][ T30] [ 370.962494][ T30] __schedule+0x1568/0x5290 [ 370.967219][ T30] ? __pfx___schedule+0x10/0x10 [ 370.972289][ T30] ? schedule+0x90/0x360 [ 370.976873][ T30] schedule+0x164/0x360 [ 370.981132][ T30] schedule_preempt_disabled+0x13/0x30 [ 370.986974][ T30] __mutex_lock+0x7fe/0x1300 [ 370.991605][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.997905][ T30] ? __mutex_lock+0x5ac/0x1300 [ 371.002681][ T30] ? nfsd_nl_version_set_doit+0xcd/0x7a0 [ 371.008581][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 371.013628][ T30] nfsd_nl_version_set_doit+0xcd/0x7a0 [ 371.019266][ T30] ? rcu_is_watching+0x15/0xb0 [ 371.024045][ T30] ? __pfx_nfsd_nl_version_set_doit+0x10/0x10 [ 371.030447][ T30] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 371.036894][ T30] genl_family_rcv_msg_doit+0x22a/0x330 [ 371.042617][ T30] ? __asan_memcpy+0x40/0x70 [ 371.047321][ T30] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 371.053510][ T30] ? bpf_lsm_capable+0x9/0x20 [ 371.058242][ T30] ? security_capable+0x7e/0x2c0 [ 371.063202][ T30] genl_rcv_msg+0x61c/0x7a0 [ 371.067890][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 371.072928][ T30] ? __pfx_nfsd_nl_version_set_doit+0x10/0x10 [ 371.079140][ T30] ? __pfx_ref_tracker_free+0x10/0x10 [ 371.084536][ T30] netlink_rcv_skb+0x232/0x4b0 [ 371.089472][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 371.094524][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 371.100060][ T30] ? genl_rcv+0x19/0x40 [ 371.104248][ T30] ? down_read+0x272/0x2e0 [ 371.109007][ T30] ? genl_rcv+0xd/0x40 [ 371.113128][ T30] genl_rcv+0x28/0x40 [ 371.118134][ T30] netlink_unicast+0x80f/0x9b0 [ 371.122995][ T30] ? __pfx_netlink_unicast+0x10/0x10 [ 371.128385][ T30] ? netlink_sendmsg+0x650/0xb40 [ 371.133328][ T30] ? skb_put+0x11b/0x210 [ 371.137722][ T30] netlink_sendmsg+0x813/0xb40 [ 371.142500][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.147922][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 371.152876][ T30] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 371.158273][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.163570][ T30] ____sys_sendmsg+0xa68/0xad0 [ 371.168450][ T30] ? __might_fault+0xaf/0x130 [ 371.173135][ T30] ? __pfx_____sys_sendmsg+0x10/0x10 [ 371.178534][ T30] ? import_iovec+0x73/0xa0 [ 371.183054][ T30] ___sys_sendmsg+0x2a5/0x360 [ 371.187838][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 371.192808][ T30] ? __pfx____sys_sendmsg+0x10/0x10 [ 371.198144][ T30] ? futex_wait+0x29a/0x380 [ 371.202668][ T30] ? __fget_files+0x2a/0x420 [ 371.207375][ T30] ? __fget_files+0x3a0/0x420 [ 371.212075][ T30] __x64_sys_sendmsg+0x1bd/0x2a0 [ 371.217067][ T30] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 371.222538][ T30] ? rcu_is_watching+0x15/0xb0 [ 371.227407][ T30] do_syscall_64+0x14d/0xf80 [ 371.232010][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.238147][ T30] ? trace_irq_disable+0x37/0x100 [ 371.243177][ T30] ? clear_bhb_loop+0x40/0x90 [ 371.248038][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.253940][ T30] RIP: 0033:0x7f5c4759bf79 [ 371.258388][ T30] RSP: 002b:00007f5c483a1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 371.266933][ T30] RAX: ffffffffffffffda RBX: 00007f5c47815fa0 RCX: 00007f5c4759bf79 [ 371.274909][ T30] RDX: 0000000004008090 RSI: 0000200000000140 RDI: 0000000000000003 [ 371.283075][ T30] RBP: 00007f5c476327e0 R08: 0000000000000000 R09: 0000000000000000 [ 371.291165][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 371.299173][ T30] R13: 00007f5c47816038 R14: 00007f5c47815fa0 R15: 00007fff559f9e88 [ 371.307279][ T30] [ 371.310415][ T30] [ 371.310415][ T30] Showing all locks held in the system: [ 371.326540][ T30] 2 locks held by ksoftirqd/0/15: [ 371.331619][ T30] #0: ffff8880b863abe0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 371.341788][ T30] #1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 371.350790][ T30] 1 lock held by khungtaskd/30: [ 371.355633][ T30] #0: ffffffff8e75e0a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 371.365746][ T30] 3 locks held by kworker/u8:3/47: [ 371.370985][ T30] #0: ffff88813fe44148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 371.383270][ T30] #1: ffffc90000b87c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 371.395136][ T30] #2: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 371.404311][ T30] 3 locks held by kworker/0:2/795: [ 371.409676][ T30] #0: ffff88813fe03548 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 371.420849][ T30] #1: ffffc900030d7c40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 371.433726][ T30] #2: ffff888043251240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x202/0x3d0 [ 371.446371][ T30] 1 lock held by syslogd/5168: [ 371.452343][ T30] #0: ffff8880b873abe0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 371.462571][ T30] 2 locks held by getty/5570: [ 371.467386][ T30] #0: ffff8880375aa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 371.477263][ T30] #1: ffffc900036c32f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 371.487506][ T30] 2 locks held by syz.0.781/8383: [ 371.492538][ T30] #0: ffffffff8fc2c430 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.500847][ T30] #1: ffffffff8ea7eb88 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x16c0 [ 371.511565][ T30] 2 locks held by syz.5.1963/11608: [ 371.518035][ T30] #0: ffffffff8fc2c430 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 371.528398][ T30] #1: ffffffff8ea7eb88 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_version_set_doit+0xcd/0x7a0 [ 371.538845][ T30] 1 lock held by syz.2.3822/16949: [ 371.543972][ T30] #0: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 371.553227][ T30] 2 locks held by syz.4.3827/16965: [ 371.558513][ T30] #0: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 371.567769][ T30] #1: ffffffff8e764338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 371.578923][ T30] [ 371.581253][ T30] ============================================= [ 371.581253][ T30] [ 371.595620][ T30] NMI backtrace for cpu 0 [ 371.595637][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 371.595656][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 371.595666][ T30] Call Trace: [ 371.595672][ T30] [ 371.595679][ T30] dump_stack_lvl+0xe8/0x150 [ 371.595705][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 371.595716][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 371.595729][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 371.595746][ T30] sys_info+0x135/0x170 [ 371.595767][ T30] watchdog+0xf90/0xfe0 [ 371.595789][ T30] ? watchdog+0x209/0xfe0 [ 371.595816][ T30] kthread+0x388/0x470 [ 371.595831][ T30] ? __pfx_watchdog+0x10/0x10 [ 371.595842][ T30] ? __pfx_kthread+0x10/0x10 [ 371.595865][ T30] ret_from_fork+0x51e/0xb90 [ 371.595885][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 371.595900][ T30] ? __switch_to+0xc7d/0x1400 [ 371.595917][ T30] ? __pfx_kthread+0x10/0x10 [ 371.595937][ T30] ret_from_fork_asm+0x1a/0x30 [ 371.595972][ T30] [ 371.701886][ T30] Sending NMI from CPU 0 to CPUs 1: [ 371.707825][ C1] NMI backtrace for cpu 1 [ 371.707842][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 371.707858][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 371.707867][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 371.707889][ C1] Code: 44 7b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 38 2b 00 fb f4 7c e8 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 371.707902][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000246 [ 371.707915][ C1] RAX: 0000000000175a33 RBX: ffffffff8199661d RCX: 0000000080000001 [ 371.707925][ C1] RDX: 0000000000000001 RSI: ffffffff8dee250a RDI: ffffffff8c276500 [ 371.707936][ C1] RBP: ffffc90000197f10 R08: ffff8880b873375b R09: 1ffff110170e66eb [ 371.707946][ C1] R10: dffffc0000000000 R11: ffffed10170e66ec R12: ffffffff90109070 [ 371.707956][ C1] R13: 1ffff11003b5a000 R14: 0000000000000001 R15: 0000000000000001 [ 371.707966][ C1] FS: 0000000000000000(0000) GS:ffff8881255b0000(0000) knlGS:0000000000000000 [ 371.707978][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 371.707988][ C1] CR2: 00007f97661e6ad8 CR3: 000000001f7b2000 CR4: 00000000003526f0 [ 371.708002][ C1] Call Trace: [ 371.708007][ C1] [ 371.708013][ C1] default_idle+0x9/0x20 [ 371.708031][ C1] default_idle_call+0x72/0xb0 [ 371.708050][ C1] do_idle+0x1bd/0x500 [ 371.708066][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 371.708084][ C1] ? __pfx_do_idle+0x10/0x10 [ 371.708104][ C1] cpu_startup_entry+0x43/0x60 [ 371.708119][ C1] start_secondary+0x101/0x110 [ 371.708134][ C1] common_startup_64+0x13e/0x147 [ 371.708160][ C1] [ 371.877904][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 371.884759][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 371.893849][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 371.903890][ T30] Call Trace: [ 371.907158][ T30] [ 371.910081][ T30] vpanic+0x1e0/0x670 [ 371.914056][ T30] panic+0xc5/0xd0 [ 371.917762][ T30] ? __pfx_panic+0x10/0x10 [ 371.922175][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 371.927530][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 371.933669][ T30] watchdog+0xfda/0xfe0 [ 371.937817][ T30] ? watchdog+0x209/0xfe0 [ 371.942135][ T30] kthread+0x388/0x470 [ 371.946199][ T30] ? __pfx_watchdog+0x10/0x10 [ 371.950857][ T30] ? __pfx_kthread+0x10/0x10 [ 371.955433][ T30] ret_from_fork+0x51e/0xb90 [ 371.960034][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 371.965129][ T30] ? __switch_to+0xc7d/0x1400 [ 371.969798][ T30] ? __pfx_kthread+0x10/0x10 [ 371.974384][ T30] ret_from_fork_asm+0x1a/0x30 [ 371.979147][ T30] [ 371.982633][ T30] Kernel Offset: disabled [ 371.986941][ T30] Rebooting in 86400 seconds..