last executing test programs: 5.016051311s ago: executing program 2 (id=4109): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'vlan0\x00', @local}) writev(r0, &(0x7f00000006c0)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd6067", 0x14}, {&(0x7f00000001c0)="b7000018", 0x4}, {&(0x7f00000003c0)="37a8a6c41ef711513a5555633f6e4259616da007f3c18c191fd01b9c86095d07073b7fa031e1939d77746bd0b883a25b1e3b4c16b8fe3f22fcf807", 0x3b}], 0x3) 4.252748819s ago: executing program 2 (id=4118): socket$packet(0x11, 0xa, 0x300) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x2, 0x1000, @loopback}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@random="07ef00", @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000ec0)=@bpf_lsm={0x1d, 0x15, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1}, [@map_fd={0x18, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}, @exit, @tail_call, @btf_id={0x18, 0x3, 0x3, 0x0, 0x3}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x2}, @cb_func={0x18, 0x2, 0x4, 0x0, 0xfffffffffffffff9}, @generic={0x8, 0x6, 0x7, 0xff, 0xa0d3}]}, &(0x7f00000009c0)='GPL\x00', 0x6, 0x5c, &(0x7f0000000a00)=""/92, 0x40f00, 0x5, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000b40)={0x8, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000e80)=[{0x3, 0x5, 0x8}, {0x2, 0x3, 0x8, 0x7}, {0x5, 0x3, 0xe}, {0x1, 0x4, 0x0, 0x2}], 0x10, 0x399d0b6f}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0xfffffffe, {{@in=@rand_addr=0x64010100, @in=@multicast1, 0x4e24, 0x0, 0x0, 0x0, 0xa, 0x10, 0x20}, {0x0, 0x1, 0xfd, 0x0, 0x0, 0x9, 0xffffffff, 0x4}, {0x0, 0x200, 0x4}, 0x2000, 0x6e6b35, 0x2, 0x0, 0x1}}, 0xb8}}, 0x24000080) socket$packet(0x11, 0x3, 0x300) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="07009875f37538e484dd63d7fa5ad0109989e1641af025ec4fb2aa9aa3c2d373f39a4d397feacc617743b8e90a56c9a0fcbe42e8651369795815891b148badd4c2db321e262c66bc92bda4e2bbe7cc267eefc8352a779a30a0c099ed64505cd66df6a5a60b70bd13a88d4fd44771e2b9a18def69bc04b750c90b429419affca4300b6691d540fd2fbbd28ed33b60bdd45c22901a984f17b4f0899731669633da1fff8ca4dcdd7aa76fdff38f9ddc998a1a8b6bd7b05fc920ac5d77c5760e8cf09dd81e708430"], 0x5c47) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r6, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000280)='\x00', 0x1}], 0x1, &(0x7f0000000440)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x41, 0x4000000}}], 0x20, 0x2400c850}, 0x4008880) sendmsg$nl_xfrm(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r7, 0x0, 0xc, &(0x7f00000000c0)="e0", 0x1) getsockopt$inet_opts(r7, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f0000000080)=0x2b) 3.657097835s ago: executing program 1 (id=4125): r0 = socket(0x10, 0x3, 0x0) getsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f0000000000), &(0x7f0000000180)=0x4) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000000)=0x4, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f000009f580), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000380)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)={0x1c, r4, 0x909, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x6, 0x4, 0x400, 0xf, 0x0, 0x1}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x80000, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'pim6reg1\x00', 0x1000}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r8) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)={0x90, r12, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_IE={0x62, 0x2a, [@preq={0x82, 0x5c, {{0x0, 0x1}, 0xfc, 0x9, 0x3, @broadcast, 0x6, @void, 0x6, 0x8, 0x6, [{{}, @device_b, 0x2}, {{0x1, 0x0, 0x1}, @device_b, 0x5}, {{0x1}}, {{}, @device_b, 0x1a000000}, {{}, @device_a, 0x2}, {{}, @device_a, 0x5}]}}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r8, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, r10, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @val={0x8, 0x3, r13}, @val={0xc, 0x99, {0x401, 0x31}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8041}, 0x20040845) r14 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) ioctl$SIOCGSKNS(r9, 0x894c, &(0x7f0000000440)={'ip6gre0\x00', 0x600}) sendmsg$TIPC_NL_PEER_REMOVE(r8, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ac0)={0x18, r14, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x4}]}, 0x18}}, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000e00)=@newqdisc={0x68, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0x0, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x800, 0x8001, 0x1400}, 0xa5, 0x9, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}, @TCA_TBF_PBURST={0x8, 0x7, 0x99f}]}}]}, 0x68}}, 0x44080) 3.250385544s ago: executing program 2 (id=4128): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000003c0)={0x0, 0x0}, 0x10) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000280)=0x80000001, 0x4) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000140)=[@in6={0xa, 0x4e23, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, @in={0x2, 0x4e23, @private=0xa010102}], 0x2c) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0xe, 0x0, 0x0) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f00000004c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x2, 0x9, 0x1, @private1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7, 0x8000, 0xcf7, 0xfffffc01}}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) mmap(&(0x7f00008a9000/0x1000)=nil, 0x1000, 0x7, 0x3032, 0xffffffffffffffff, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES64=r4, @ANYBLOB="0000000002000000b70500000800000085000000a900000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x1002, &(0x7f0000002500)=""/4098, 0x0, 0x0, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x7a05, 0x1700) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='rdma.current\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000640)=ANY=[@ANYRES64=r6, @ANYRES16=r3, @ANYBLOB="85f108aab5511a218840b97eb4cf8debe4334f64c5e45be7f67499714e60368c6f461777ec50711d00bb9f31b9254bcf1c4f1a66bb3b", @ANYRES64=r7, @ANYRES64=r5, @ANYRES64=r5, @ANYBLOB="a2c551d82b0d09bec3a51124e01de4953208eb9760d572f82c03d44596a94fab9019b37da7c0a9", @ANYBLOB="1977d2ffa4aba168479d145e56e8b70750f529d0ea7085ea1fde32e584f97826fa5c7bf4109afe38ef785ccd4d2d3b8428fc2ef09e08211c80e319bd235ba6af024a22f4473835cc37104727909127c1a2fd1bbae1eba651ad50e9d4bb3e95311becfcc0a95fefde9626b894", @ANYBLOB="cd4cbe73ad1d5c2ecf41dcdae3712cb1d8030aaa3c813837b4b4a44aa2bfe3f81dc73a7685a43f77f06869ad9fea1c2aea2134ca3aa8ee8e6b8b0913dad8e6aff0636c7b752c5c482ac9a6d3f8d1afd03fa1c6da91f5ffb07d18addb7c54dd6142ed24bc3194275fba1d5ef30140fae4723d59f7096261aeedd80cc1e5f1cae0f0a52b40e83b8f0f3d5e4d42df0b2887f19f8cb52ad6249d096831d10785e0d811f507c42ddf7a6e10d77b18900de10b14d625e1e2d19656e1aa3499c9d62bf83a6c5b8013517c9db954d9f511735ef2bc93505479e501268315fce73fc379792d8be001d61a5e0c47f75b17117e639222c0a7a230e8469c9c116ae0becb"], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) (async) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r11) sendmsg$TIPC_CMD_ENABLE_BEARER(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYRESOCT=r5, @ANYRES16=r12, @ANYBLOB="0100e7ff0c0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x4004454) (async) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$unix(0x1, 0x2, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) 3.237031555s ago: executing program 1 (id=4130): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000780)={'sit0\x00', &(0x7f00000006c0)={'sit0\x00', 0x0, 0x80, 0x20, 0x4, 0xd7f, {{0x6, 0x4, 0x1, 0x1, 0x18, 0x64, 0x0, 0xb9, 0x29, 0x0, @private=0xa010101, @private=0xa010102, {[@timestamp={0x44, 0x4, 0x6a, 0x0, 0xf}]}}}}}) r3 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYRESOCT=r2, @ANYRES16=0x0, @ANYRES32, @ANYRESDEC=r2, @ANYRES16=r1], 0x48) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="700000001400010000000000fbdbdf25e00000010000000000000000000000000000000000000000000000000000000100000080000700000000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000c00080003030000000000000c0015"], 0x70}}, 0x4004040) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000004b000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000424c0000850000002d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r5}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0xfffff000, 0xe, 0x0, &(0x7f0000001700)="61df7100c80400d5721ff59fe864", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 3.092993174s ago: executing program 1 (id=4132): r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bond_slave_1\x00', 0x10) (async) sendmmsg(r0, &(0x7f0000000500)=[{{&(0x7f0000000000)=@in={0x2, 0x4e24, @empty}, 0x80, 0x0, 0x0, &(0x7f0000000240)}}], 0x1, 0x4000000) 3.039782332s ago: executing program 1 (id=4135): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x11, 0x10, &(0x7f0000000840)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@jmp={0x5, 0x1, 0x1, 0xa, 0xa, 0xfffffffffffffff5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0xb, 0x1000, &(0x7f0000001cc0)=""/4096, 0x41100, 0xd}, 0x94) 3.006897912s ago: executing program 0 (id=4137): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) ioctl$NILFS_IOCTL_GET_CPINFO(r0, 0x80186e82, &(0x7f0000000240)={&(0x7f00000000c0)=[{0x2, 0x0, 0x6347, 0x200, 0xb, 0x51, 0xfd, 0x4}, {0x2, 0x0, 0x4b6, 0xc, 0x7, 0x3ff, 0x8, 0x200}, {0x0, 0x0, 0x843, 0x7, 0x4, 0x400, 0x521f, 0x7}, {0x1, 0x0, 0x69e, 0x8, 0x7fffffff, 0x0, 0xe, 0xfffffffffffffe01}, {0x2, 0x0, 0x0, 0x4, 0x1c000000000000, 0x3, 0x6, 0x1}, {0x2, 0x0, 0x81, 0x30, 0xffffffffffffffff, 0xfff, 0x3, 0x80}], 0x6, 0x38, 0x0, 0x100}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x5, &(0x7f0000000280)=@framed={{0x18, 0x5, 0x0, 0x0, 0x1001, 0x0, 0x0, 0x0, 0x8}, [@map_fd={0x18, 0x4, 0x1, 0x0, r0}]}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.882814058s ago: executing program 0 (id=4138): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000005e6bf02f000000180001801400020076657468315f746f5f626174616476000c000380"], 0x38}}, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0xd0, 0x270, 0xd0, 0x340, 0x340, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x44}, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0xffffffff], 'tunl0\x00', 'bond_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x322}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @private1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'wg1\x00', 'team_slave_1\x00', {0xff}, {}, 0x2f, 0x6b, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) (async, rerun: 64) r5 = socket(0x40000000015, 0x5, 0x0) (rerun: 64) setsockopt$sock_int(r5, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) (async) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000002000)=@raw={'raw\x00', 0x8, 0x100000, 0x220, 0x0, 0x11, 0x148, 0x0, 0x0, 0x308, 0x2a8, 0x2a8, 0x308, 0x2a8, 0x3, 0x0, {[{{@ip={@loopback, @loopback, 0xff000000, 0xff, 'syz_tun\x00', 'sit0\x00', {0xff}, {}, 0x6c, 0x1, 0x77}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00'}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x0, 0x1, 0x7, 0x2, 0x5], 0x3, 0x1}, {0xffffffffffffffff, [0x3, 0x0, 0x2, 0x7, 0x1, 0x2], 0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) bind$inet(r5, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r5, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=""/127, 0x7f}}], 0x1, 0x0, 0x0) (async) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) (async) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r7, &(0x7f0000000040)="d6"}, 0x20) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000000000a0000010900020073797a311ec0910a334700000000090001007379"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r8 = socket$netlink(0x10, 0x3, 0x15) sendmsg$AUDIT_USER_TTY(r8, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000140)={0x8c, 0x464, 0x200, 0x70bd25, 0x25dfdbfe, "f869d47369a91ceb15ef5bd784acd38fdd563c111e4140eb49c665a775b798304200f203b4f849ada5f3d62c910c502a2fbce65d524164a55564adffe3943793d8ae4dc71379729c2e28caccfe19f94b8539f6aa79391b6acd386b3f7d8176aef3d8a868fcc2b7ec7a6fb0f597da3064a4b3e5b0974471ffe8", [""]}, 0x8c}, 0x1, 0x0, 0x0, 0x20044004}, 0x4004800) close(r2) (async) recvfrom(r4, 0x0, 0x0, 0x40002062, 0x0, 0x0) 2.762889227s ago: executing program 0 (id=4139): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x101000, &(0x7f0000000040)={@align=0x9, {0x1, 0x45, 0x6, 0x6}}, 0x0, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x8}) sendmsg$nl_crypto(r0, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)=@del={0x108, 0x11, 0x0, 0x70bd2c, 0x25dfdbfb, {{'xts(aes)\x00'}, '\x00', '\x00', 0x2000}, [{0x8, 0x1, 0x80}, {0x8, 0x1, 0xfffffff8}, {0x8, 0x1, 0x6}, {0x8, 0x1, 0x8}, {0x8, 0x1, 0xafe}]}, 0x108}, 0x1, 0x0, 0x0, 0x40000}, 0x3004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x2, 0x2, &(0x7f0000000080)=@raw=[@call={0x85, 0x0, 0x0, 0x19}, @exit], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2a}, 0x11a) 2.001138131s ago: executing program 0 (id=4140): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'lo\x00'}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000980)=@ethtool_coalesce={0xe, 0x2, 0x5a6, 0x400, 0x5, 0x10001, 0x2, 0x0, 0x8, 0x38, 0x1ff, 0x5, 0xfffffffd, 0x8, 0x2, 0xb, 0x81, 0x4, 0xfffff20f, 0x1, 0x3, 0x73, 0x9}}) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x4, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x30000013}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b921, 0x80000, {0x0, 0x0, 0x0, r10, {0x0, 0xf}, {0xfff1, 0xb}, {0xa, 0x6}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x8, 0x2, 0x80000000}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4010044}, 0x4000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) unshare(0x6a040000) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r11, 0x107, 0xa, 0x0, 0x0) 1.919276867s ago: executing program 4 (id=4141): r0 = socket$nl_crypto(0x10, 0x3, 0x15) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @private=0xa010101}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@rdma_args={0x48, 0x114, 0x1, {{0xc, 0x8}, {0x0}, &(0x7f00000001c0)=[{&(0x7f0000000340)=""/157, 0x9d}], 0x1, 0x4, 0x97}}, @rdma_args={0x48, 0x114, 0x1, {{0x9, 0x4}, {0x0}, &(0x7f0000000180)=[{&(0x7f00000007c0)=""/223, 0xdf}], 0x117f, 0x4, 0x5}}, @rdma_args={0x48, 0x114, 0x1, {{0x4, 0xeb}, {0x0}, 0x0, 0x0, 0x4, 0x401}}], 0xd8}, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r2, &(0x7f00000001c0)={0xa, 0x0, 0x81, @loopback={0x80fe}, 0x3, 0x2}, 0x20) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f00000003c0)=@filter={'filter\x00', 0x232, 0x0, 0x90, [0x0, 0x200000000300, 0x0, 0x0, 0x200000000330, 0x200000000360], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff00000000"]}, 0x108) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000007c0)={0x3, 'vlan1\x00'}) 1.918772564s ago: executing program 3 (id=4142): r0 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x80c00) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x10, r0, 0x1000) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x101, 0x0, 0x0, {}, [{0x54, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20}, {0x72}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) socket(0xb, 0x5, 0x7fffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x2c, r4, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2000d885}, 0x4000080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x17, &(0x7f00000003c0)=ANY=[@ANYRES16=r1, @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000fcff00008500000086000000bf0900000000000055090100000000809500000000000000180100002020752500000000010020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000080000008500000006000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0xa, 0xffe, &(0x7f0000000cc0)=""/4094, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000040), 0x4) 1.842785904s ago: executing program 4 (id=4143): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB="020100090e000000ff8000000000000005000600000000000a0000000000000000000000000000000000000000000000000000000000000005000500000000000a00000000000000000000000000000000000000000000000000000000000000020013"], 0x70}}, 0x0) 1.718606916s ago: executing program 4 (id=4144): r0 = socket(0x840000000002, 0x3, 0x100) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x8, 0x3, 0x500, 0x340, 0x11, 0x148, 0x0, 0x0, 0x468, 0x2a8, 0x2a8, 0x468, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x300, 0x0, 0x3f, 0x6, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x4, 0x0, 0x2}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x560) (async) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f00000001c0)=[{{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="85b27720db2ee4c4705959a88563bb83fe95c44c18052555cfab72fb197309bc4ad0fc69ec747474583edff85ba8ecb8c5f66ae437b334b1e6454de1c80ff44b235d4f29c9424b239e3855983b4e0fd24aa7a32725b971756d3e58e547c270e7233ccceb5471cdea014ed05a81d40c38c2325377e7", 0x75}, {&(0x7f0000000200)="f25bd903bbf8b63225bc1a51888a9f44c767b5a6", 0x14}], 0x2}}], 0x1, 0x840) (async, rerun: 32) r2 = socket(0x10, 0x3, 0x0) (rerun: 32) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000180)={0x4, 0x4, 0xfffffffd, 0x1}, 0x10) (async) write(r2, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000fe00000000020000", 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000240)={0x0, 0x4}, 0x8) (async, rerun: 64) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4001000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="b0000000020202020000000000000000020000031c00074000020000940002800c00028005000100880000002c00018014000300fe8800000000000000000000000001011400040000000000000000000000ffffe00000012c00018014000300000000000000fe8000000000000000000000000000bb2c00018014000300fc01200000000000000000000000000014000400ff02000000000000000000000000000100"/176], 0xb0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20010000) (rerun: 64) r3 = socket(0x10, 0x3, 0x0) (async, rerun: 64) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r0) (rerun: 64) sendmsg$NL80211_CMD_SET_POWER_SAVE(r0, &(0x7f0000000b00)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x70, r4, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x33}}}}, [@NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x1) (async) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000001200010025bd70000000000007000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008002e000300e9ff"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) setsockopt$inet_buf(r0, 0x0, 0x2f, 0x0, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000140)={0x2, 0x0, 0x4, 0x5, 0xdf2, 0x6}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) 1.569167937s ago: executing program 3 (id=4145): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x86, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x44}}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb00b3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 40) 1.558252088s ago: executing program 2 (id=4146): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000180)='disconnect aa:aa:aa:aa:aa:10 0', 0x1e) setsockopt$inet6_int(r0, 0x29, 0x19, 0x0, 0x0) r2 = socket(0xf, 0x800, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a480000000600000a0000040900010073797a31000000000900020073797a32000000f71c000480180001800d00010073796e70726f78790000000004000280140000001100010000000000000000000100000a000000000000000000"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c00000004000000040000b1d2422f0000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000040300"/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x52) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r5, {0xf}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newtfilter={0x40, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x14, 0x2, [@TCA_BPF_ACT={0x4}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0x40}}, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000080), 0x9) sendmmsg$inet6(r0, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e20, 0x10001, @initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, 0xff}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000000000029000000390000000000010800005ec0"], 0x18}}], 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000840)='\x80\xabM\xea\xaej\x05\xedd\xa2H|\a[(\xa6\xafR\xef\x17\x91\xeb/\xbe\xa9\x83\xd4,\x1b\x86P\xbf\xfa~5\xc9O\xc4\xa0>\x87\x1aar\x8d?pt\x95\xa4\xa9\x89\x8dO\xecZ\x909\xf73`\x1b\xe00\x85o\xb4\x80\x8dD\xec\xb1\xa8W\x9e(nN\xee\x9b\xb6\x9a\xb8\xedp\xa9\xd0w8\x98k\xbc\xd0\xbe\xdc\x97>n7w\xb5\xe1\x83\xb3~=\xfdw\r\x04\x00\x00\x00\x00\x00\x00\x00\"\n\xd5\xa5(\x916($\xa6M\x99\xf1\a\a?\xa1\x19\x19\xd5\xa9\xc5)\xfb\xa6\x8b\xc1\x89&A\x19Y\xe0\x97\xb3I\xf45\xaf\xf7\xcd\xbb\x00\xe9\xb4\f6\xde\xf5\xca4pD*\xbb\x8b\x16n\xadS\xc4@\xe2.\xd8\xf5\x88\xfaJy\xac\xbb\xe3\x1b\xc9\xab\xd7\x02\x96K\x9f%\xef\xdd\x02\xd1\xdc\x9a\xef^2\x93\xc3/u\x88\xa5\xe3,r+s\xce\xd7\xa4\xb3\xe3\xc7lq\x01\b\xa3Ca\x01U\x93\x84', 0xec) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000b98bc2c900000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @cgroup_sock_addr=0x14, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000005880)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000380)="3f121b5ae730a16b38ec3c25a36f", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) socket$nl_rdma(0x10, 0x3, 0x14) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000240)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0xfffffffffffffefe) sendmsg$xdp(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20020014}, 0x200080d4) 1.512605645s ago: executing program 3 (id=4147): r0 = socket(0x10, 0x803, 0x0) (async) r1 = socket$unix(0x1, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) (async, rerun: 64) socket$unix(0x1, 0x2, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002480)=@newtfilter={0x8b4, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x880, 0x2, [@TCA_U32_POLICE={0x858, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x7, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x807, 0x1000, 0x8, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x8, 0x10000, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x8, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x80000000, 0x2, 0x6, 0x6, 0xaa, 0x0, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0x2f1e, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x4, 0xab, 0x9, 0x7, 0x0, 0xe, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x7, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0xe34d, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74dc, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x81, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x6, 0x5, 0x7, 0x4, 0x3, 0xff, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf8, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x80, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x3, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x2, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x6, 0xc4, 0x9, 0x0, 0xee2, 0x4, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x6, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0x7, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xfffc, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x4, 0x3, 0x7, 0x3, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x10042b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x3, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3ff}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8b4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) (async) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x628, '\x00', r2, 0xffffffffffffffff, 0x5, 0x1, 0x1}, 0x50) (async) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7fffffff, '\x00', r2, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0xd, 0x1, 0x6, 0x5, 0x20020, 0xffffffffffffffff, 0x8, '\x00', r2, 0xffffffffffffffff, 0x1, 0x0, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x14, 0x11, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ad2, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x9}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x4}, @map_idx={0x18, 0x2, 0x5, 0x0, 0xd}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x200}}]}, &(0x7f00000002c0)='GPL\x00', 0x0, 0x7b, &(0x7f0000000300)=""/123, 0x40f00, 0x4e, '\x00', r2, @lirc_mode2=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000500)=[0x1, r3, r4, r0, r5, 0xffffffffffffffff], &(0x7f0000000540)=[{0x1, 0x1, 0xc, 0x6}], 0x10, 0x9}, 0x94) 1.393068064s ago: executing program 4 (id=4148): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="00000000040000090000000000000000850000006a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000001800000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r2, 0x5, 0xe, 0x0, &(0x7f00000000c0)="469dc2d342e2b7000091000000000bcf48f3ac4e19a56ceb0b42c0", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x22) 1.33055043s ago: executing program 3 (id=4149): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$packet(0x11, 0x3, 0x300) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000008c0)=r4, 0x4) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, 0x0, 0x40240c4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r5, 0x18000000000002a0, 0x7f, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a81bff88641100404863330283ac14142ce934a0a662079f4b4d2f87e56dca6aab845013f208001a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72", 0x0, 0xfb, 0x60000000, 0x0, 0x77, &(0x7f0000000000), &(0x7f0000001c40)="beb61ec2ca90080239f2a54e2368fa761313c3a024a98109ba1e2e7b780d03c54b7a83d56fce397842e724674507d531762055fca371ea775f418df7bee236c9b9968146efb3232ae3413b617445e98bb644a892b9337f1a9135d9f30457a8ffb21aef4a95a155fab70a40b086056b0f63331a66b3457c", 0x2}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x9, [@enum={0x7, 0x1, 0x0, 0x6, 0x4, [{0x1000000, 0x3}]}]}, {0x0, [0x61, 0x0, 0x30, 0x2e, 0x61, 0x61, 0x5f]}}, 0x0, 0x35}, 0x28) readv(r2, 0x0, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000100000004000180100002800c0001800800010016"], 0x28}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0xc0}}, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r9, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r10}, 0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r9, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={r10, 0x211d9572}, &(0x7f00000001c0)=0x8) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000", @ANYRES32], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x40) r13 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r0) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000c00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000a00)={0x1c0, r13, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x130, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x96c3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8ce}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5ba}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x67}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8bef0}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa0}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}, @TIPC_NLA_LINK={0x64, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x85}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x400d}, 0x44004) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) 1.285831874s ago: executing program 2 (id=4150): syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) ioctl$FIBMAP(r0, 0x1, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, 0x0, 0x40) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x11, &(0x7f0000001480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@llc={0x4, {@llc={0xdc, 0x0, "85"}}}}}, 0x0) (async) ioctl$FICLONERANGE(r1, 0x4020940d, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@ipv6_newroute={0x30, 0x18, 0xffffffffffffffff, 0x0, 0x0, {0xa, 0x0, 0x10, 0x0, 0xfd, 0x0, 0xc8, 0x7}, [@RTA_GATEWAY={0x14, 0x5, @private0}]}, 0x30}, 0x1, 0x0, 0x0, 0x2048800}, 0x0) (async) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}], 0x1, 0x40800) (async) r3 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x800, 0x0, 0x0) (async) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40) (async) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000000000085000000bc00000095"], &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r4, r6, 0x25, 0x0, @val=@iter={0x0}}, 0x20) (async) syz_emit_ethernet(0x36, &(0x7f0000000000)=ANY=[], 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='\a'], 0x10) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r9, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r7}, 0x20) sendmmsg$inet6(r7, &(0x7f0000008c00)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="50558c", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a80)="fb24ba96", 0xc3fd}, {0x0, 0x11}], 0x2}}], 0x2, 0x20004810) syz_emit_ethernet(0x5e, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0xb, 0x0, 0x0, @broadcast=0x1000000, {0xd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0xffff, @private, @rand_addr=0x64010102, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @generic={0x84, 0x12, "f20f31a02cffc92e4a856585cb2bbe2f"}]}}}}}}}, 0x0) (async) readv(r7, &(0x7f0000000340)=[{&(0x7f00000001c0)=""/172, 0xac}, {&(0x7f0000000280)=""/165, 0xa5}], 0x2) 1.225642846s ago: executing program 1 (id=4151): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000000000000000000008500000022000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc}, [@ldst={0x3, 0x2, 0x6, 0x1, 0x3, 0x4a}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="38000000180001bd000000000000000002000000fc00bd0900000000060015000200000014"], 0x38}, 0x1, 0x0, 0x0, 0x22004044}, 0x4048080) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r2, 0x84, 0x68000, &(0x7f0000000080)="0200ffff0880ff01", 0xffffffffffffff8a) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, @multicast}]}) r3 = socket(0x1f, 0x1, 0xfffffffc) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xb619, '.\x00'}}) unshare(0x2a020400) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000300)={0x0, 0x7b, 0x4, 0xfffffffe}, &(0x7f00000003c0)=0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000005c0)={r5, 0x7ff}, &(0x7f0000000600)=0x8) r6 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000001100), 0x200200, 0x0) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000640)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="01000000010400000f0000000200000010020000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="00f5ffffffff15ffff68d614c71f88508a00"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYRES64=r6, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb7030000080000007b04000000000000850000000800000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x8}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000700)={0x3c, 0x2, 0x3, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0xb, 0x2}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x431}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x22}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xaf, 0x1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x14000014}, 0x804) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a98000000060a0b040000000000000000020000006c000480680001800a000100696e6e65720000005800028008000240000000840800034000000007080004400003000f0800014000000000340005800c0001007061796c6f61640024000280080004400000001c08000340000000b9080001400000000a08000240200000020900010073797a30000000000900020073797a"], 0xc0}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x2c, &(0x7f0000000380)=[@in6={0xa, 0x4e23, 0x8000000, @private0={0xfc, 0x0, '\x00', 0x6}, 0x7}, @in={0x2, 0x4e23, @multicast2}]}, &(0x7f0000000080)=0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000240), 0xffffffffffffffff) 976.333519ms ago: executing program 2 (id=4152): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000940)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x6, [@fwd={0xc}, @float={0xd, 0x0, 0x0, 0x10, 0x4}, @enum64={0xb, 0x5, 0x0, 0x13, 0x0, 0xd, [{0x4, 0x1, 0x4}, {0x6, 0x8, 0x800}, {0xc, 0xaae, 0x2}, {0x6, 0x0, 0x2}, {0xf, 0xfffff46e}]}, @enum64={0x4, 0x7, 0x0, 0x13, 0x1, 0x4, [{0xb, 0x7f, 0x8}, {0xb, 0x4, 0x2}, {0x2, 0x1, 0x14000000}, {0x4, 0x18ff, 0x7fffffff}, {0x8, 0x35, 0x995}, {0xa, 0x6}, {0x2, 0x962, 0x6}]}, @var={0x8, 0x0, 0x0, 0xe, 0x1}, @typedef={0x2, 0x0, 0x0, 0x8, 0x1}]}, {0x0, [0x30, 0x30, 0x61, 0x30]}}, &(0x7f0000000280)=""/227, 0xfa, 0xe3, 0x1, 0xdcc}, 0x28) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000006c1a6efdd2db44791a9dc7fa35b7648439257aae9e225cfe4858a70cf93d000cb2da0894a87a2ede095b813f0c1853e82e1951b37be59fa3b1811c6c6fc91f5e1b3bcf3f44f3a741ec7dc962ae1945440369195659b41b6d197b645f"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, &(0x7f0000000180)}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0xa, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r4, &(0x7f0000000300)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) syz_emit_ethernet(0xd2, &(0x7f0000000340)=ANY=[], 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0x14, 0x0, &(0x7f00000000c0)="259a53f271a76d2788a24c6588a81e0e88ca4483", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r8 = socket$packet(0x11, 0x3, 0x300) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000003280)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000000000280000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142da7646c4fe02996b60cf81ebcd50fa9ea4308123f602000000000000de89e661168c1886d0d4d94f204e345c652fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762011052eac2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dc8aff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340a1c8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e4b9ec7a410ec42315255be1ed66d9051f22614d1f62734d679039a97d2b74f9e8e997ccd314000f747f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798ab20000000bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d2000000000000000819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480e5aee9c9e5f2e5a56a6d920335c8e8726fd8329d9a728995b1531bd20360d33d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c55969a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba84279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047050d7296cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5603a9d801300000000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed03a6fe7860b3e13c3173a60a1823cb7dde8212a8531bd9060000006a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d535556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02221e963abc5ceb735c1b3c46b0a843de52a0000000000000001ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba0790ee0d112f99e59ba82e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af268c900a756e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee52303da186b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c44500f8ffff970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8f09c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c1b04e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3138e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305977eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f87204311327c18380fedf3d3dad8549f99bf6c5cb060fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39289f675f39d01719cdbab3f1ce1060f3e6806e774a5f079c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae794286b6c3e1f5a76b85ed6e1f0000c608b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32bf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba4664f35547cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1951393352bc756f3fcaad2c1c399a3e43eaaeca70db90f2fa395964434476719334482eb5424c81814079a24fe3681ad9ac361f71ac279a688f10a12105edebc5e3b8dad4c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fbdd351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b577243152374d7b367337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2dff78ce9308c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f200000000000000000089de7f8485d9507164a187220b36ddc7fa645d4bd0c1414c30a416f80ba17d21d53961471b2d2d459e4bb23230d676ca49633b25e26a322024beb7c3427da59f7daa70a5d44a0eb895f29245df6401295d3da939954e126a3be932f47fe61ef1bfe83086651af7e23c2a8fa702b9aaa65aa3edaaa6b3f5a0c7cdfd008c898d73bb97168ca390ef539800000000000077a5ad1e683aeff92bb0b66b33ed878df1e344b99450086c819bf174578705c049d2fb25a91ba04643cde1a3c391d8646e5249dbf28b13b1c4d5127f685ee0c0576bf74e17cd3b4df4eb7095e504e361689572b0f93ff1dc6f52e8728a03e5a4df80a32c6055df8f4f4152c0bf4d793b20ac2cfa907b5af80716118f82027d3e4cb096fe86de545008b85cb9b637bca30d765b0c3ad489db32955454dcfe000000002830e5e125322d2f5829040a91405bf2fe5bf14833fd7b1e72c775f267bc4511183096eff3188a288c408b10285e7ec75f826e9b08a82cde1f4470545eebc71440623752e87ecc689b7fec2f667e22705b4660b2ef936cce446244bb48f8c7d062ea4a955facf6c2957cfb3c3ee9229efab5b72a5c5266eb493c7c3b08a91971692d9673cb9df620a8240d4f94b9fafd8e2bf0f9cedd1e08f4f10fd8f25f3169ed878624adccb5572cb918e0e3ba7e4ac0967aa65241903509778e63bebf00107524f858d7d48ef9e2c112c75d732344dc0a9bc506172d5a45e3bcb203862307c24c20fe1ffe6b5a43dbc1b20156161b5f59ab9955f2a6fb2469d6cbf857a137b542045d203e43874fe17720a05d3bc42bde811dcf97732108f5cb5943e609856876c2108491e88875ead76331822c8f0151a1cf06e634ac0933487716484f30f17d8f29af19784814192b4677759b781fc1a6726b154bbf3f30c48f0b829397acb9b337a6929d1158492e49bfe9a1158a57b6a422c8d1a3c476487a736a74d01bf48e05ac030092c66a502a8a5c9ef0a29582b6fef6d0dcd6a3a277887134f98291d79a2ed48adb3086b7c1c7340e0998036686b1919d25c3aa9591f4135fdad46003d76b366b81e50fdefeecf3b5d17e946059e2883ca43d61e14e725f0acaff73e0922319b6ea7b09b7b9ea691f5598f014f362e033ba9bc2a64f1c2ed591ef9c6f1a7a08e8e2842c0a592dd82d72e141db440000000000000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89, 0x10, 0x0, 0xfffffffffffffcee}, 0x48) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000000)=r9, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x0, 0xa888, 0x0, 0x5000000}}]}}]}, 0x48}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000006000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 951.321048ms ago: executing program 4 (id=4153): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000280), r0) sendmsg$NLBL_UNLABEL_C_LIST(r0, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x70, r1, 0x54a51fcb3f411afb, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x17}}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_vlan\x00'}, @NLBL_UNLABEL_A_SECCTX={0x26, 0x7, 'system_u:object_r:mount_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @remote}]}, 0x70}, 0x1, 0x0, 0x0, 0x44}, 0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x4, &(0x7f00000002c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, r3, 0x2, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_SCAN_TYPE={0x5}, @IEEE802154_ATTR_DURATION={0x5, 0x15, 0xf7}, @IEEE802154_ATTR_CHANNELS={0x8, 0x14, 0x6}, @IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0xc0}]}, 0x34}, 0x1, 0x0, 0x0, 0x80c0}, 0x2000050) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$nfc(0x0, r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c0005006c010000000000000c000200ff7f000000000000400007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4], 0x7c}}, 0x20000000) 787.625107ms ago: executing program 1 (id=4154): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r3, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) sendmsg$inet(r3, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680), 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20008040) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000000840)={{r2, &(0x7f0000000200)='\x00', 0x8001, &(0x7f0000000280)={@_ha_fsid={[0x8e, 0x5]}, {0x200, 0x7, 0x2, 0x721d}}, 0x3, &(0x7f00000002c0)={@_ha_fsid}, &(0x7f00000003c0)=0x8}, {[0x6, 0x800, 0x101, 0x1]}, 0x6, 0x90, &(0x7f0000000780)=""/144}) bind$bt_l2cap(r6, &(0x7f00000008c0)={0x1f, 0x8, @none, 0x9, 0x2}, 0xe) 673.264248ms ago: executing program 0 (id=4155): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000c60700000000000000010000a50000001700000018410000fcffffff000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x25dfdbff, {{@in6=@ipv4={'\x00', '\xff\xff', @remote}, @in=@remote, 0x4e20, 0xb, 0xf7ff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {0x1, 0x9, 0x80}, 0xfffffffc}, [@tmpl={0xc4, 0x5, [{{@in6=@private0={0xfc, 0x0, '\x00', 0x4}, 0x0, 0x3c}, 0x0, @in6=@empty, 0x3502, 0x0, 0x2}, {{@in=@multicast2, 0x0, 0x33}, 0x0, @in6=@mcast2, 0x3504, 0x0, 0x2, 0x4, 0x0, 0xabb}, {{@in6=@empty, 0x4d4, 0x32}, 0x0, @in=@local, 0x4, 0x0, 0x1, 0x8, 0x0, 0x0, 0x400}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20006854}, 0x800) 540.638543ms ago: executing program 0 (id=4156): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r2, &(0x7f0000000b80)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="4400aff0", @ANYRES16=r3, @ANYBLOB="010029bd7000fedbdf250c000000080001000000000008000b008100000008000300", @ANYRES32=0x0, @ANYBLOB="0c00060002000000020000000c0006000200000002000000"], 0x44}, 0x1, 0x0, 0x0, 0x20040010}, 0x40000) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000440)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @private1}, 0x1c, &(0x7f0000000d00)=[{&(0x7f00000002c0)='\n', 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e23, 0x6, @remote, 0x8}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000180)='X', 0x1}], 0x1}}], 0x2, 0x40088d4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x58, r6, 0x1, 0x8070bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}}]}}]}, 0x58}, 0x1, 0x400000000000000, 0x0, 0x98}, 0x44810) shutdown(r4, 0x1) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000001dc0)=ANY=[], 0x4b) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000010400000000000000588035045a", @ANYRES32=0x0, @ANYBLOB="51420000000000002800128008000100687372001c00028008000200", @ANYRES32=r1, @ANYBLOB="050007000100000008000100", @ANYRES32=r10], 0x48}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r11) sendmsg$DEVLINK_CMD_RATE_GET(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, r12, 0x701, 0x0, 0x25dfdbfc, {0x41}}, 0x14}}, 0x24000040) ioctl$SIOCX25SCAUSEDIAG(r9, 0x89ec, &(0x7f00000000c0)={0xb8, 0x43}) 268.715256ms ago: executing program 3 (id=4157): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x86, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x44}}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb00b3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 41) 172.333236ms ago: executing program 3 (id=4158): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYRES64], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd700000000000220000001800018014000200766972745f7769666930000000000000f8c93822da8fb829f3e0b2672f84"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a3000000000080002"], 0x7c}}, 0x0) (async) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) shutdown(0xffffffffffffffff, 0x0) (async) close(0x3) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) write(r2, &(0x7f0000000240)="14000000140005b7ffccca38b9000000060860eb", 0x14) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYRES16=r5, @ANYBLOB="00042cbd7000fedbdf254c0000000c0058003300"], 0x20}}, 0x4008082) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=r4, @ANYBLOB="08009f000600000008002600b409000005005201"], 0x3c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000000308010800000000000000000500050003003a0000004ee3f849153a314645e1e31aa1705c7bdd17bd9ed6e3e08fa1851eb507e8b31fcb4e8cdccedd9c15fd2bc4b37ff0ac7f4600009909df1d924f119cc79a4ab34612737435c6f42bcdee1065a8527b44284bdaa12d4f83bf4920120d7da2760caf240756c53795c31e093e61892ee86f1dacc391a53b624a8c0fa7abc567261da1b8fad5b24f01bfbd7d1dc28d0a5b8ca8e211b6101831662b2c274a6b009c7d12e6609b83adf36040ebac45b4ba64ee3eae1b9b03873ea9a3577ae6e39edf177bd5d2fc9dba59529d6b534e90c9e6fd53857112e5dc0b6186e06c8345253ecbfd5822657f65a87b436dd01d714bd84553426c407dc05eef7aba19f31b4b66a3c91d9e64ebbd3c5e4cab0f55ee5b11a807523deda3b36e26e6b02791f2015dbf0018d34542b910c000"/331], 0x1c}, 0x1, 0x0, 0x0, 0x4050}, 0x4004010) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x16, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000440)={'veth0\x00', 0x8000}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) (async) r7 = socket(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) socket$inet6(0xa, 0x2, 0x0) 0s ago: executing program 4 (id=4159): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) sendmmsg$unix(r1, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c, 0x1, 0x2, {r2, 0xee00, r3}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38, 0x4}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000001c0)=[@in6={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x10}, @in6={0xa, 0x4e23, 0xfffffffd, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}], 0x38) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r4, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x2, @loopback={0xfec0ffffffffffff}, 0x80000000}], 0x1c) kernel console output (not intermixed with test programs): 35854][T18320] hsr_slave_1: entered promiscuous mode [ 551.747066][T18320] debugfs: 'hsr0' already exists in 'hsr' [ 551.752833][T18320] Cannot create hsr debugfs directory [ 552.389213][T18491] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3073'. [ 552.398244][T18491] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3073'. [ 552.442795][T17892] Bluetooth: hci4: command tx timeout [ 552.676720][T18501] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3071'. [ 552.694059][ T7841] veth11: left allmulticast mode [ 552.704009][ T7841] veth11: left promiscuous mode [ 552.714633][ T7841] bridge8: port 1(veth11) entered disabled state [ 552.740486][ T7841] pimreg: left allmulticast mode [ 552.869996][ T7841] team0: Port device ip6gre1 removed [ 552.906896][ T7841] bond0 (unregistering): (slave ip6gretap1): Releasing active interface [ 553.082009][ T7841] bond13 (unregistering): (slave geneve3): Releasing active interface [ 553.116817][ T7841] bridge0 (unregistering): left allmulticast mode [ 553.635727][T18506] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3077'. [ 553.689125][ T5638] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 553.689175][T17892] Bluetooth: hci2: command 0x0401 tx timeout [ 553.725840][ T7841] bond12 (unregistering): (slave bridge9): Releasing backup interface [ 553.900196][ T7841] bond0 (unregistering): Released all slaves [ 553.921910][ T7841] bond1 (unregistering): Released all slaves [ 553.948107][ T7841] bond2 (unregistering): Released all slaves [ 553.973182][ T7841] bond3 (unregistering): Released all slaves [ 553.995622][ T7841] bond4 (unregistering): (slave bond5): Releasing backup interface [ 554.016362][ T7841] bond4 (unregistering): Released all slaves [ 554.051541][ T7841] bond5 (unregistering): Released all slaves [ 554.073123][ T7841] bond6 (unregistering): Released all slaves [ 554.101410][ T7841] bond7 (unregistering): (slave lo): Releasing backup interface [ 554.116098][ T7841] bond7 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 554.136414][ T7841] bond7 (unregistering): Released all slaves [ 554.158036][ T7841] bond8 (unregistering): Released all slaves [ 554.178504][ T7841] bond9 (unregistering): Released all slaves [ 554.211447][ T7841] bond10 (unregistering): (slave batadv3): Releasing active interface [ 554.228371][ T7841] bond10 (unregistering): Released all slaves [ 554.251715][ T7841] bond11 (unregistering): Released all slaves [ 554.273676][ T7841] bond12 (unregistering): (slave veth13): Releasing backup interface [ 554.293980][ T7841] bond12 (unregistering): Released all slaves [ 554.319940][ T7841] bond13 (unregistering): Released all slaves [ 554.341007][ T7841] bond14 (unregistering): Released all slaves [ 554.385974][ T8852] lo speed is unknown, defaulting to 1000 [ 554.399464][ T8852] sqz0: Port: 1 Link DOWN [ 554.431797][ T8853] lo speed is unknown, defaulting to 1000 [ 554.479930][ T5638] Bluetooth: hci4: command tx timeout [ 554.977227][T18488] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 555.274698][T18320] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 555.334506][T18320] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 555.376986][T18320] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 555.432856][T18320] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 555.471247][T18320] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 555.516168][T18320] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 555.618357][T18320] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 555.677187][T18320] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 555.702319][T18518] lo speed is unknown, defaulting to 1000 [ 556.066176][T18550] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3084'. [ 556.109432][T18550] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3084'. [ 556.196388][T18320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 556.295599][T18320] 8021q: adding VLAN 0 to HW filter on device team0 [ 556.347248][T14966] bridge0: port 1(bridge_slave_0) entered blocking state [ 556.354516][T14966] bridge0: port 1(bridge_slave_0) entered forwarding state [ 556.372182][T18556] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3086'. [ 556.390562][T18559] netlink: 'syz.4.3087': attribute type 1 has an invalid length. [ 556.439513][ T7515] bridge0: port 2(bridge_slave_1) entered blocking state [ 556.446634][ T7515] bridge0: port 2(bridge_slave_1) entered forwarding state [ 556.511055][T18559] veth3: entered allmulticast mode [ 556.567289][T18556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3086'. [ 556.634812][T14966] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 556.654413][ T5638] Bluetooth: hci4: command tx timeout [ 556.871496][T18576] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3090'. [ 557.001605][T18580] syzkaller1: entered promiscuous mode [ 557.007146][T18580] syzkaller1: entered allmulticast mode [ 557.135562][T18576] veth5: entered allmulticast mode [ 557.164478][T18576] bond12: (slave veth5): Enslaving as an active interface with an up link [ 557.271529][T18581] bond12 (unregistering): (slave veth5): Releasing backup interface [ 557.346634][T18581] bond12 (unregistering): Released all slaves [ 557.786570][T18602] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 557.979821][T18608] only policy match revision 0 supported [ 557.979843][T18608] unable to load match [ 558.005755][T18610] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3096'. [ 558.032000][T18608] netlink: 'syz.0.3095': attribute type 21 has an invalid length. [ 558.066820][T18613] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3097'. [ 558.109734][T18613] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3097'. [ 558.173203][T18608] netlink: 'syz.0.3095': attribute type 21 has an invalid length. [ 558.186279][T18610] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3096'. [ 558.201552][ T7515] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 558.216616][ T7515] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 558.256854][ T7515] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 558.286912][ T7515] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 558.494680][T18320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 558.547884][T18622] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3100'. [ 558.762514][T18320] veth0_vlan: entered promiscuous mode [ 558.826790][T18320] veth1_vlan: entered promiscuous mode [ 559.118333][T18634] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 559.156222][T18320] veth0_macvtap: entered promiscuous mode [ 559.172738][T18320] veth1_macvtap: entered promiscuous mode [ 559.211695][T18320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 559.244896][T18320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 559.276122][ T7515] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.295505][ T7515] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.307008][ T7515] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.322520][ T7515] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.361855][T18649] IPVS: set_ctl: invalid protocol: 0 172.20.20.64:20001 [ 559.492670][ T1122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 559.506148][ T1122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 559.534200][T18651] syzkaller0: entered promiscuous mode [ 559.545603][T18651] syzkaller0: entered allmulticast mode [ 559.613001][T18655] openvswitch: netlink: Unexpected mask (mask=20440, allowed=10048) [ 559.661574][ T7514] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 559.732788][ T7514] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 559.924531][T18671] netlink: 'syz.1.3112': attribute type 21 has an invalid length. [ 560.225920][T18679] netlink: 'syz.1.3115': attribute type 1 has an invalid length. [ 560.238142][T18679] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 560.430959][T18694] netlink: 'syz.3.3113': attribute type 1 has an invalid length. [ 560.907826][T18698] : renamed from wg2 (while UP) [ 561.040361][T18706] gretap0: entered promiscuous mode [ 561.053645][T18706] vlan0: entered promiscuous mode [ 561.184309][T18710] netlink: 'syz.4.3121': attribute type 4 has an invalid length. [ 561.189328][T18708] syzkaller0: entered promiscuous mode [ 561.199964][T18708] syzkaller0: entered allmulticast mode [ 561.255706][T18710] __nla_validate_parse: 9 callbacks suppressed [ 561.255727][T18710] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3121'. [ 561.480101][T18715] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.3123'. [ 561.493975][T18715] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3123'. [ 561.510246][T17892] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 561.533586][T17892] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 561.556618][T17892] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 561.582918][T17892] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 561.599975][T17892] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 561.926782][T18731] tipc: Started in network mode [ 561.931719][T18731] tipc: Node identity 02fe1f8f3c49, cluster identity 4711 [ 561.939042][T18731] tipc: Enabled bearer , priority 0 [ 562.126596][T18741] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3129'. [ 562.164596][ T5635] bond0: (slave syz_tun): Releasing backup interface [ 562.174161][T18741] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3129'. [ 562.236508][T18716] lo speed is unknown, defaulting to 1000 [ 562.553415][T18751] netlink: 'syz.2.3132': attribute type 1 has an invalid length. [ 562.566743][T18730] tipc: Disabling bearer [ 562.624827][T18751] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3132'. [ 563.164375][T18772] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 563.260553][T18777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3139'. [ 563.270389][T18716] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.277643][T18716] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.284965][T18716] bridge_slave_0: entered allmulticast mode [ 563.309909][T18716] bridge_slave_0: entered promiscuous mode [ 563.318820][T18716] bridge0: port 2(bridge_slave_1) entered blocking state [ 563.326074][T18716] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.333421][T18716] bridge_slave_1: entered allmulticast mode [ 563.342387][T18716] bridge_slave_1: entered promiscuous mode [ 563.481761][T18772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3138'. [ 563.509977][T18780] tipc: Started in network mode [ 563.526167][T18780] tipc: Node identity , cluster identity 4711 [ 563.545277][T18780] tipc: Failed to set node id, please configure manually [ 563.555574][T18780] tipc: Enabling of bearer rejected, failed to enable media [ 563.577958][T18716] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 563.584600][T18787] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3141'. [ 563.617538][T18716] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 563.644607][T18787] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3141'. [ 563.678681][T17892] Bluetooth: hci0: command tx timeout [ 563.818111][T18716] team0: Port device team_slave_0 added [ 563.866848][T18716] team0: Port device team_slave_1 added [ 563.949802][T18794] xt_addrtype: ipv6 does not support BROADCAST matching [ 564.011876][T18793] lo speed is unknown, defaulting to 1000 [ 564.094488][T18799] netlink: 'syz.0.3142': attribute type 32 has an invalid length. [ 564.142065][T18716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 564.149056][T18716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 564.311804][T18716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 564.325225][T18716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 564.332189][T18716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 564.358098][T18716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 564.500767][T18799] bond1: option coupled_control: invalid value (119) [ 564.561771][T18799] bond1 (unregistering): Released all slaves [ 564.662013][T18797] Can't find ip_set type [ 564.747825][T18716] hsr_slave_0: entered promiscuous mode [ 564.778568][T18716] hsr_slave_1: entered promiscuous mode [ 564.788376][T18716] debugfs: 'hsr0' already exists in 'hsr' [ 564.794176][T18716] Cannot create hsr debugfs directory [ 565.717402][T18836] netem: change failed [ 565.779290][T17892] Bluetooth: hci0: command tx timeout [ 566.041448][T18851] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 566.044265][T18844] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 566.310140][T18864] Cannot find del_set index 14804 as target [ 567.080119][T18871] netlink: 'syz.0.3164': attribute type 1 has an invalid length. [ 567.096622][T18871] netlink: 'syz.0.3164': attribute type 2 has an invalid length. [ 567.291064][T18893] __nla_validate_parse: 5 callbacks suppressed [ 567.291083][T18893] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3169'. [ 567.836905][T18716] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 567.839961][T17892] Bluetooth: hci0: command tx timeout [ 567.874278][T18716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 567.899541][T18716] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 567.923816][T18716] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 567.931574][T18911] syzkaller0: entered promiscuous mode [ 567.937085][T18911] syzkaller0: entered allmulticast mode [ 568.000102][T18716] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 568.078781][T18716] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 568.086832][T18716] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 568.143611][T18716] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 568.415366][T18927] netlink: 'syz.4.3176': attribute type 1 has an invalid length. [ 568.555622][T18922] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3176'. [ 568.563225][T18927] bond1: entered promiscuous mode [ 568.571901][T18927] 8021q: adding VLAN 0 to HW filter on device bond1 [ 568.581225][T18924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3177'. [ 568.595170][T18924] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3177'. [ 568.633635][T18929] lo speed is unknown, defaulting to 1000 [ 568.662781][T18935] netlink: 'syz.0.3177': attribute type 13 has an invalid length. [ 568.671074][T18935] netlink: 'syz.0.3177': attribute type 17 has an invalid length. [ 568.678916][T18935] netlink: 'syz.0.3177': attribute type 27 has an invalid length. [ 568.729790][T18927] bond1: (slave bridge1): making interface the new active one [ 568.737446][T18927] bridge1: entered promiscuous mode [ 568.747732][T18927] bridge1: left promiscuous mode [ 568.748099][T18938] netlink: 'syz.2.3178': attribute type 13 has an invalid length. [ 568.775121][T18938] netlink: 'syz.2.3178': attribute type 17 has an invalid length. [ 568.933277][T18943] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3179'. [ 569.164480][T18934] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.173517][T18934] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.484664][T18934] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 569.501571][T18934] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 569.775966][T18937] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.776694][T18953] netlink: 'syz.1.3182': attribute type 3 has an invalid length. [ 569.785453][T18937] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.802092][T18953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3182'. [ 569.852276][T18937] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 569.864419][T18937] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 569.919964][T17892] Bluetooth: hci0: command tx timeout [ 570.048788][T18938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 570.057965][T18938] 8021q: adding VLAN 0 to HW filter on device team0 [ 570.072491][T18938] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 570.146316][T18938] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 570.156277][T18938] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 570.170321][T18938] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 570.181220][T18938] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 570.205558][T18938] veth1_vlan: left promiscuous mode [ 570.222260][T18938] veth0_vlan: left promiscuous mode [ 570.228515][T18938] veth0_vlan: entered promiscuous mode [ 570.237942][T18938] veth1_vlan: entered promiscuous mode [ 570.250092][T18938] veth1_macvtap: left promiscuous mode [ 570.256992][T18938] veth0_macvtap: left promiscuous mode [ 570.264289][T18938] veth0_macvtap: entered promiscuous mode [ 570.283214][T18938] veth1_macvtap: entered promiscuous mode [ 570.294510][T18938] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 570.310445][T18938] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 570.334493][T18938] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 570.348070][T18938] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 570.452061][ T7516] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.503715][ T7516] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.518921][ T7516] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.530752][ T7516] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.543879][ T7501] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.552932][ T7501] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.570880][ T1122] bridge0: port 1(bridge_slave_0) entered blocking state [ 570.578113][ T1122] bridge0: port 1(bridge_slave_0) entered forwarding state [ 570.587791][ T1122] bridge0: port 2(bridge_slave_1) entered blocking state [ 570.594962][ T1122] bridge0: port 2(bridge_slave_1) entered forwarding state [ 570.694317][ T7501] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.703824][ T7501] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.776101][T18964] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 570.996347][T18716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 571.022640][T18716] 8021q: adding VLAN 0 to HW filter on device team0 [ 571.038578][ T7513] bridge0: port 1(bridge_slave_0) entered blocking state [ 571.045756][ T7513] bridge0: port 1(bridge_slave_0) entered forwarding state [ 571.100811][ T7513] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.108067][ T7513] bridge0: port 2(bridge_slave_1) entered forwarding state [ 571.262180][T18716] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 571.607170][T18987] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.3191'. [ 571.684162][T18983] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 571.744698][T18991] openvswitch: netlink: Message has 8 unknown bytes. [ 571.773992][T18991] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3192'. [ 571.945527][T19000] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3194'. [ 572.001209][T18716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 572.052155][T19004] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 572.125026][T19007] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 572.163796][T18716] veth0_vlan: entered promiscuous mode [ 572.227892][T18716] veth1_vlan: entered promiscuous mode [ 572.270757][T18716] veth0_macvtap: entered promiscuous mode [ 572.281649][T18716] veth1_macvtap: entered promiscuous mode [ 572.306765][T18716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 572.325121][T18716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 572.354345][T19015] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3195'. [ 572.377583][ T7509] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.445061][ T7509] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.482908][T19017] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3199'. [ 572.484051][ T7509] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.522640][ T7509] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 572.707278][ T7509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 572.709290][T19027] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3202'. [ 572.723611][ T7509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 572.857210][T19029] syzkaller0: entered promiscuous mode [ 572.862755][T19029] syzkaller0: entered allmulticast mode [ 572.895977][T19031] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3203'. [ 572.907549][T19030] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3203'. [ 572.917826][ T7516] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 572.928443][ T7516] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 572.945581][T19031] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3203'. [ 573.063475][T19037] netlink: 'syz.1.3205': attribute type 13 has an invalid length. [ 573.077646][T19039] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3206'. [ 573.212288][T19044] lo speed is unknown, defaulting to 1000 [ 573.722404][ T5638] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 573.750003][ T5638] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 573.778185][ T5638] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 573.823180][ T5638] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 573.832048][ T5638] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 574.297554][T19064] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.3212'. [ 574.865167][T19070] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3214'. [ 575.995235][T17892] Bluetooth: hci3: command tx timeout [ 577.299772][ T8878] page_pool_release_retry() stalled pool shutdown: id 40, 1 inflight 423 sec [ 578.099075][T17892] Bluetooth: hci3: command tx timeout [ 578.552822][T19084] netlink: 'syz.0.3216': attribute type 11 has an invalid length. [ 578.571368][T19084] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.3216'. [ 578.727247][T19081] bridge1: entered allmulticast mode [ 578.845572][T19052] lo speed is unknown, defaulting to 1000 [ 579.066666][T19098] : renamed from dummy0 [ 579.275886][T19106] xfrm1: entered allmulticast mode [ 579.491409][T19104] netlink: 'syz.4.3220': attribute type 4 has an invalid length. [ 579.499861][T19104] netlink: 3657 bytes leftover after parsing attributes in process `syz.4.3220'. [ 579.537094][T19116] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3222'. [ 579.592008][T19118] bridge0: port 3(batadv1) entered blocking state [ 579.602554][T19118] bridge0: port 3(batadv1) entered disabled state [ 579.610322][T19118] batadv1: entered allmulticast mode [ 579.617805][T19118] batadv1: entered promiscuous mode [ 579.625628][T19052] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.633469][T19052] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.641886][T19052] bridge_slave_0: entered allmulticast mode [ 579.658796][T19052] bridge_slave_0: entered promiscuous mode [ 579.734524][T19052] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.757992][T19052] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.771298][T19052] bridge_slave_1: entered allmulticast mode [ 579.782705][T19052] bridge_slave_1: entered promiscuous mode [ 579.807716][T19122] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.3225'. [ 579.858216][T19052] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 579.870959][T19052] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 579.967841][T19052] team0: Port device team_slave_0 added [ 579.977979][T19052] team0: Port device team_slave_1 added [ 580.007536][T19133] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3228'. [ 580.089241][ T7516] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 580.098945][T19052] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 580.098965][T19052] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.098985][T19052] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 580.100941][T19052] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 580.106596][ T7516] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 580.161531][T19052] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.161646][T19052] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 580.269363][T17892] Bluetooth: hci3: command tx timeout [ 580.306238][T19052] hsr_slave_0: entered promiscuous mode [ 580.327549][T19052] hsr_slave_1: entered promiscuous mode [ 580.332129][T19135] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 580.339567][T19052] debugfs: 'hsr0' already exists in 'hsr' [ 580.347143][T19052] Cannot create hsr debugfs directory [ 580.510820][T19142] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3231'. [ 580.622550][T19138] : entered promiscuous mode [ 580.639533][T19142] sctp: [Deprecated]: syz.2.3231 (pid 19142) Use of struct sctp_assoc_value in delayed_ack socket option. [ 580.639533][T19142] Use struct sctp_sack_info instead [ 580.771689][T19149] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3233'. [ 580.851338][T19152] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3234'. [ 580.892145][T19151] lo: entered allmulticast mode [ 581.036415][T19161] netlink: 'syz.4.3237': attribute type 2 has an invalid length. [ 581.350480][T19172] netlink: 'syz.4.3241': attribute type 1 has an invalid length. [ 581.415962][T19172] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3241'. [ 581.454452][T19172] macvlan2: entered promiscuous mode [ 581.462199][T19172] macvlan2: entered allmulticast mode [ 581.470935][T19172] bond2: entered promiscuous mode [ 581.476907][T19172] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 581.499835][T19172] bond2: left promiscuous mode [ 581.724471][T19154] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 582.130037][T19181] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3244'. [ 582.264875][T19183] tipc: Enabling of bearer rejected, media not registered [ 582.333873][ T5638] Bluetooth: hci3: command tx timeout [ 582.701517][T19052] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 582.750949][T19052] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 582.775947][T19052] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 582.835034][T19052] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 582.890053][T19052] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 582.919636][T19052] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 582.957251][T19052] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 582.985638][T19052] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 583.205913][T19222] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 583.509387][T19233] netlink: 'syz.2.3262': attribute type 2 has an invalid length. [ 583.533238][T19052] 8021q: adding VLAN 0 to HW filter on device bond0 [ 583.666655][T19052] 8021q: adding VLAN 0 to HW filter on device team0 [ 583.726224][ T7848] bridge0: port 1(bridge_slave_0) entered blocking state [ 583.733404][ T7848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 583.775350][ T7848] bridge0: port 2(bridge_slave_1) entered blocking state [ 583.782577][ T7848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 583.813234][T19240] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.820603][T19240] bridge0: port 1(bridge_slave_0) entered disabled state [ 583.839674][T19245] netlink: 'syz.4.3264': attribute type 1 has an invalid length. [ 583.858988][T19246] __nla_validate_parse: 2 callbacks suppressed [ 583.859009][T19246] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3267'. [ 583.930298][T19245] bond3: entered promiscuous mode [ 583.935822][T19245] 8021q: adding VLAN 0 to HW filter on device bond3 [ 584.056460][T19250] netlink: 153712 bytes leftover after parsing attributes in process `syz.2.3268'. [ 584.091010][T19241] netlink: 7 bytes leftover after parsing attributes in process `syz.4.3264'. [ 584.105390][T19257] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3269'. [ 584.125575][T19241] bond3: (slave bridge2): making interface the new active one [ 584.134738][T19241] bridge2: entered promiscuous mode [ 584.144727][T19241] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 584.225360][T19260] netlink: 'syz.0.3270': attribute type 13 has an invalid length. [ 584.264489][T19260] netlink: 'syz.0.3270': attribute type 17 has an invalid length. [ 584.272601][T19261] netlink: 'syz.0.3270': attribute type 13 has an invalid length. [ 584.272625][T19261] netlink: 'syz.0.3270': attribute type 17 has an invalid length. [ 584.404043][T19261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 584.412905][T19261] 8021q: adding VLAN 0 to HW filter on device team0 [ 584.430441][T19261] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 584.501273][T19261] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 584.510996][T19261] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 584.527912][T19261] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 584.538363][T19261] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 584.577270][T19261] veth1_vlan: left promiscuous mode [ 584.583895][T19261] veth0_vlan: left promiscuous mode [ 584.590211][T19261] veth0_vlan: entered promiscuous mode [ 584.597557][T19261] veth1_vlan: entered promiscuous mode [ 584.608002][T19261] veth1_macvtap: left promiscuous mode [ 584.615479][T19261] veth0_macvtap: left promiscuous mode [ 584.622217][T19261] veth0_macvtap: entered promiscuous mode [ 584.639858][T19261] veth1_macvtap: entered promiscuous mode [ 584.654325][T19261] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 584.675934][T19261] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 584.690559][T19261] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 584.704061][T19261] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 584.722991][T19261] vlan2: left promiscuous mode [ 584.727795][T19261] geneve1: left promiscuous mode [ 584.733225][T19261] vlan2: left allmulticast mode [ 584.738207][T19261] geneve1: left allmulticast mode [ 584.746300][T19261] ip6erspan0: left allmulticast mode [ 584.763697][T19261] A link change request failed with some changes committed already. Interface @ may have been left with an inconsistent configuration, please check. [ 584.806613][T19260] A link change request failed with some changes committed already. Interface @ may have been left with an inconsistent configuration, please check. [ 584.840113][T14966] bridge0: port 1(bridge_slave_0) entered blocking state [ 584.847433][T14966] bridge0: port 1(bridge_slave_0) entered forwarding state [ 584.857253][T14966] bridge0: port 2(bridge_slave_1) entered blocking state [ 584.864444][T14966] bridge0: port 2(bridge_slave_1) entered forwarding state [ 584.983114][T19275] bridge: RTM_NEWNEIGH with invalid ether address [ 584.989650][ T7514] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 584.998408][ T7514] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.017923][ T7514] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 585.026716][ T7514] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.035498][ T7514] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 585.044216][ T7514] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.053461][ T7514] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 585.062168][ T7514] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.205066][ T7509] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 585.334974][T19292] netlink: 64138 bytes leftover after parsing attributes in process `syz.4.3279'. [ 585.473399][T19289] netlink: 'syz.2.3278': attribute type 1 has an invalid length. [ 585.481321][T19289] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 585.763519][T19052] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 585.789602][T19304] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3281'. [ 585.815586][T19304] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3281'. [ 586.680529][T19332] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3289'. [ 586.736977][T19052] veth0_vlan: entered promiscuous mode [ 586.793667][T19052] veth1_vlan: entered promiscuous mode [ 586.910362][T19052] veth0_macvtap: entered promiscuous mode [ 586.953662][T19052] veth1_macvtap: entered promiscuous mode [ 587.004528][T19052] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 587.036852][T19052] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 587.108194][ T7513] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.118961][ T7513] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.132589][ T7513] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.242221][T19349] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3296'. [ 587.255589][T19357] x_tables: unsorted underflow at hook 2 [ 587.264789][T19357] IPVS: set_ctl: invalid protocol: 35 224.0.0.2:20000 [ 587.378246][T19345] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.502771][ T7513] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.052561][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.060564][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.068476][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.076493][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.084726][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.092835][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.101524][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.109601][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.118981][T19376] netlink: 'syz.0.3303': attribute type 8 has an invalid length. [ 588.270837][T19345] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.504733][ T7509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.516558][ T7509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.580230][T19382] bond4: (slave bridge3): making interface the new active one [ 588.592093][T19382] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 589.001319][T19382] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 589.045677][T19392] macvlan2: entered promiscuous mode [ 589.051763][T19392] macvlan2: entered allmulticast mode [ 589.060493][T19392] bond4: entered promiscuous mode [ 589.065749][T19392] bridge3: entered promiscuous mode [ 589.255833][T19392] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 589.273268][T19392] bond4: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 589.307004][T19392] bond4: left promiscuous mode [ 589.332410][T19392] bridge3: left promiscuous mode [ 589.437267][T19345] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.495713][ T7501] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.504051][ T7501] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.526506][T19398] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3308'. [ 589.600564][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 590.142157][T19345] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.193117][T19418] macsec1: entered promiscuous mode [ 590.284978][T19427] bond5 (unregistering): Released all slaves [ 590.460538][ T7514] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.547281][T19412] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 590.561949][ T7501] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.622650][ T7514] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.756220][T19435] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.764069][T19435] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.892414][T19435] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.925082][T19435] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 591.239991][ T7501] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.254517][ T7501] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.279148][T19446] validate_nla: 13 callbacks suppressed [ 591.279171][T19446] netlink: 'syz.0.3320': attribute type 5 has an invalid length. [ 591.379724][ T7501] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.530590][ T7501] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.550821][ T7501] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.104190][T19494] lo speed is unknown, defaulting to 1000 [ 592.223041][T19488] ip6gre1: entered allmulticast mode [ 592.231375][T19488] team0: Device ip6gre1 is of different type [ 592.432916][T19500] netlink: 'syz.0.3336': attribute type 1 has an invalid length. [ 592.465682][T19500] 8021q: adding VLAN 0 to HW filter on device bond2 [ 592.518410][T19500] vlan0: entered promiscuous mode [ 592.523515][T19500] bond2: entered promiscuous mode [ 592.540105][T19500] vlan0: entered allmulticast mode [ 592.545293][T19500] bond2: entered allmulticast mode [ 592.659615][T19506] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3336'. [ 592.690947][T19506] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 592.727734][T19506] bond2: (slave batadv1): making interface the new active one [ 592.737054][T19506] batadv1: entered promiscuous mode [ 592.754144][T19506] batadv1: entered allmulticast mode [ 592.761976][T19506] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 593.355911][T19519] FAULT_INJECTION: forcing a failure. [ 593.355911][T19519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 593.390801][T19519] CPU: 1 UID: 0 PID: 19519 Comm: syz.2.3342 Not tainted syzkaller #0 PREEMPT(full) [ 593.390840][T19519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 593.390860][T19519] Call Trace: [ 593.390868][T19519] [ 593.390877][T19519] dump_stack_lvl+0xe8/0x150 [ 593.390913][T19519] should_fail_ex+0x412/0x560 [ 593.390945][T19519] _copy_to_user+0x31/0xb0 [ 593.390975][T19519] simple_read_from_buffer+0xe1/0x170 [ 593.391005][T19519] proc_fail_nth_read+0x1bb/0x230 [ 593.391055][T19519] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 593.391082][T19519] ? rw_verify_area+0x2a6/0x4d0 [ 593.391104][T19519] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 593.391125][T19519] vfs_read+0x20c/0xa70 [ 593.391150][T19519] ? __pfx___mutex_lock+0x10/0x10 [ 593.391171][T19519] ? __pfx_vfs_read+0x10/0x10 [ 593.391196][T19519] ? __fget_files+0x2a/0x420 [ 593.391222][T19519] ? __fget_files+0x3a0/0x420 [ 593.391241][T19519] ? __fget_files+0x2a/0x420 [ 593.391270][T19519] ksys_read+0x150/0x270 [ 593.391296][T19519] ? __pfx_ksys_read+0x10/0x10 [ 593.391328][T19519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.391349][T19519] do_syscall_64+0x15f/0xf80 [ 593.391366][T19519] ? trace_irq_disable+0x3b/0x140 [ 593.391396][T19519] ? clear_bhb_loop+0x40/0x90 [ 593.391418][T19519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.391436][T19519] RIP: 0033:0x7f0fd815d60e [ 593.391454][T19519] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 593.391528][T19519] RSP: 002b:00007f0fd90f0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 593.391548][T19519] RAX: ffffffffffffffda RBX: 00007f0fd90f16c0 RCX: 00007f0fd815d60e [ 593.391561][T19519] RDX: 000000000000000f RSI: 00007f0fd90f10a0 RDI: 0000000000000004 [ 593.391571][T19519] RBP: 00007f0fd90f1090 R08: 0000000000000000 R09: 0000000000000000 [ 593.391582][T19519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 593.391592][T19519] R13: 00007f0fd8416038 R14: 00007f0fd8415fa0 R15: 00007ffe34addc38 [ 593.391622][T19519] [ 593.448516][T19523] nbd: must specify a device to reconfigure [ 593.957858][T19531] batman_adv: batadv0: Adding interface: macvtap1 [ 593.964578][T19531] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.990314][T19531] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 594.120727][T19538] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3348'. [ 594.130560][T19538] netlink: 'syz.3.3348': attribute type 1 has an invalid length. [ 594.138304][T19538] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3348'. [ 594.484032][T19557] netlink: 'syz.4.3353': attribute type 2 has an invalid length. [ 594.626945][T19561] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3354'. [ 594.674328][T19571] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3358'. [ 594.796804][T19576] netlink: 'syz.0.3360': attribute type 1 has an invalid length. [ 594.804851][T19576] netlink: 'syz.0.3360': attribute type 2 has an invalid length. [ 594.912276][ T30] audit: type=1107 audit(1778603952.814:15): pid=19583 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 594.917940][T19588] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3363'. [ 594.979718][T19587] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 594.988742][T19587] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 595.003355][T19586] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 595.013635][T19588] xt_hashlimit: size too large, truncated to 1048576 [ 595.269375][T19599] xt_hashlimit: size too large, truncated to 1048576 [ 596.157815][T19606] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 596.361753][T19624] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3375'. [ 596.643527][T19630] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3378'. [ 596.715257][T19637] netlink: 'syz.0.3379': attribute type 2 has an invalid length. [ 596.875569][T19641] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3381'. [ 596.915786][T19641] bond5: entered promiscuous mode [ 596.922182][T19641] 8021q: adding VLAN 0 to HW filter on device bond5 [ 596.963006][T19643] bridge4: entered promiscuous mode [ 596.975065][T19643] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 597.074190][T19645] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3382'. [ 597.124834][T19645] batadv_slave_1: entered promiscuous mode [ 597.143617][T19644] batadv_slave_1: left promiscuous mode [ 597.342945][T19649] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3383'. [ 597.603896][T19653] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3385'. [ 597.832946][T19660] netlink: 'syz.2.3388': attribute type 8 has an invalid length. [ 598.019442][T19671] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3391'. [ 598.158789][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 598.897346][T19695] netlink: 'syz.4.3396': attribute type 2 has an invalid length. [ 599.076237][T19683] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.088300][T19683] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.174081][ T7516] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.197433][T19699] syzkaller0: entered promiscuous mode [ 599.219238][T19699] syzkaller0: entered allmulticast mode [ 599.228119][ T7516] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.250184][ T7516] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.365242][ T7516] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.819581][T19723] netlink: 'syz.3.3407': attribute type 4 has an invalid length. [ 599.873605][T19723] netlink: 'syz.3.3407': attribute type 4 has an invalid length. [ 600.352388][T19743] mac80211_hwsim hwsim63 wlan0: entered promiscuous mode [ 600.365328][T19746] x_tables: duplicate underflow at hook 3 [ 600.576906][T19755] tipc: Enabling of bearer rejected, failed to enable media [ 600.650047][T19758] __nla_validate_parse: 5 callbacks suppressed [ 600.650070][T19758] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.3417'. [ 601.275181][T19781] veth1_to_bond: entered allmulticast mode [ 601.289806][T19780] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3424'. [ 601.379586][T19780] veth1_to_bond (unregistering): left allmulticast mode [ 601.443861][T19780] bond0: (slave bond_slave_1): Releasing backup interface [ 601.461793][T19794] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3427'. [ 601.497244][T19788] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3418'. [ 601.549293][T19788] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3418'. [ 601.584927][T19796] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3418'. [ 601.593940][T19796] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3418'. [ 601.640757][T19797] tipc: Started in network mode [ 601.645689][T19797] tipc: Node identity ac14140f, cluster identity 4711 [ 601.653281][T19797] tipc: New replicast peer: 255.255.255.255 [ 601.664037][T19797] tipc: Enabled bearer , priority 10 [ 601.814024][T19797] bond1 (unregistering): Released all slaves [ 601.872629][T19799] bridge0: port 1(bridge_slave_0) entered disabled state [ 601.932281][T19808] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3430'. [ 601.966253][T19799] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 602.475523][T19832] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 602.733420][ T5358] tipc: Node number set to 2886997007 [ 602.979722][T19853] netlink: 64138 bytes leftover after parsing attributes in process `syz.4.3442'. [ 602.994752][T19842] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3438'. [ 603.331875][T19860] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.727955][T19860] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.210497][T19860] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.546039][T19860] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.923298][T19915] lo speed is unknown, defaulting to 1000 [ 604.942256][ T7501] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.042679][ T7501] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.141022][ T7501] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.188466][ T7501] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.366045][T19937] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 605.408283][T19939] netlink: 'syz.1.3470': attribute type 1 has an invalid length. [ 605.878164][T19955] __nla_validate_parse: 9 callbacks suppressed [ 605.878193][T19955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3473'. [ 607.182798][T19973] FAULT_INJECTION: forcing a failure. [ 607.182798][T19973] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 607.196014][T19973] CPU: 0 UID: 0 PID: 19973 Comm: syz.1.3479 Not tainted syzkaller #0 PREEMPT(full) [ 607.196045][T19973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 607.196055][T19973] Call Trace: [ 607.196064][T19973] [ 607.196072][T19973] dump_stack_lvl+0xe8/0x150 [ 607.196092][T19973] should_fail_ex+0x412/0x560 [ 607.196110][T19973] _copy_from_user+0x2d/0xb0 [ 607.196126][T19973] ___sys_sendmsg+0x1c6/0x360 [ 607.196153][T19973] ? __lock_acquire+0x6b5/0x2cf0 [ 607.196169][T19973] ? __pfx____sys_sendmsg+0x10/0x10 [ 607.196200][T19973] ? __fget_files+0x2a/0x420 [ 607.196213][T19973] ? __fget_files+0x3a0/0x420 [ 607.196229][T19973] __x64_sys_sendmsg+0x1bd/0x2a0 [ 607.196245][T19973] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 607.196264][T19973] ? __pfx_ksys_write+0x10/0x10 [ 607.196283][T19973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.196294][T19973] do_syscall_64+0x15f/0xf80 [ 607.196304][T19973] ? trace_irq_disable+0x3b/0x140 [ 607.196319][T19973] ? clear_bhb_loop+0x40/0x90 [ 607.196332][T19973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.196342][T19973] RIP: 0033:0x7f688e19cdd9 [ 607.196354][T19973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.196363][T19973] RSP: 002b:00007f688f105028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 607.196375][T19973] RAX: ffffffffffffffda RBX: 00007f688e415fa0 RCX: 00007f688e19cdd9 [ 607.196382][T19973] RDX: 0000000000004000 RSI: 0000200000000140 RDI: 0000000000000004 [ 607.196389][T19973] RBP: 00007f688f105090 R08: 0000000000000000 R09: 0000000000000000 [ 607.196397][T19973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 607.196403][T19973] R13: 00007f688e416038 R14: 00007f688e415fa0 R15: 00007fff3b5a0058 [ 607.196418][T19973] [ 607.422832][T19975] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.3480'. [ 608.663042][T19947] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 608.772193][T19993] syzkaller1: entered promiscuous mode [ 608.797405][T19993] syzkaller1: entered allmulticast mode [ 608.921202][T19995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3488'. [ 608.945758][T19999] FAULT_INJECTION: forcing a failure. [ 608.945758][T19999] name failslab, interval 1, probability 0, space 0, times 0 [ 608.984395][T19999] CPU: 0 UID: 0 PID: 19999 Comm: syz.3.3490 Not tainted syzkaller #0 PREEMPT(full) [ 608.984413][T19999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 608.984420][T19999] Call Trace: [ 608.984425][T19999] [ 608.984431][T19999] dump_stack_lvl+0xe8/0x150 [ 608.984450][T19999] should_fail_ex+0x412/0x560 [ 608.984467][T19999] should_failslab+0xa8/0x100 [ 608.984486][T19999] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 608.984501][T19999] ? __alloc_skb+0x186/0x7d0 [ 608.984515][T19999] ? __alloc_skb+0x1d0/0x7d0 [ 608.984526][T19999] ? __local_bh_enable_ip+0xd0/0x130 [ 608.984628][T19999] __alloc_skb+0x1d0/0x7d0 [ 608.984644][T19999] netlink_sendmsg+0x5d4/0xb40 [ 608.984671][T19999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 608.984686][T19999] ? aa_sock_msg_perm+0xf1/0x1b0 [ 608.984703][T19999] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 608.984720][T19999] ____sys_sendmsg+0x972/0x9f0 [ 608.984736][T19999] ? __might_fault+0xaf/0x130 [ 608.984752][T19999] ? __pfx_____sys_sendmsg+0x10/0x10 [ 608.984770][T19999] ? import_iovec+0x73/0xa0 [ 608.984786][T19999] ___sys_sendmsg+0x2a5/0x360 [ 608.984800][T19999] ? __lock_acquire+0x6b5/0x2cf0 [ 608.984813][T19999] ? __pfx____sys_sendmsg+0x10/0x10 [ 608.984844][T19999] ? __fget_files+0x2a/0x420 [ 608.984855][T19999] ? __fget_files+0x3a0/0x420 [ 608.984871][T19999] __x64_sys_sendmsg+0x1bd/0x2a0 [ 608.984887][T19999] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 608.984906][T19999] ? __pfx_ksys_write+0x10/0x10 [ 608.984924][T19999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.984935][T19999] do_syscall_64+0x15f/0xf80 [ 608.984945][T19999] ? trace_irq_disable+0x3b/0x140 [ 608.984960][T19999] ? clear_bhb_loop+0x40/0x90 [ 608.984980][T19999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.984990][T19999] RIP: 0033:0x7f001619cdd9 [ 608.985002][T19999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 608.985010][T19999] RSP: 002b:00007f0016f7c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 608.985022][T19999] RAX: ffffffffffffffda RBX: 00007f0016415fa0 RCX: 00007f001619cdd9 [ 608.985029][T19999] RDX: 0000000000004000 RSI: 0000200000000140 RDI: 0000000000000004 [ 608.985035][T19999] RBP: 00007f0016f7c090 R08: 0000000000000000 R09: 0000000000000000 [ 608.985041][T19999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 608.985047][T19999] R13: 00007f0016416038 R14: 00007f0016415fa0 R15: 00007ffc9a811d48 [ 608.985062][T19999] [ 609.303100][T20004] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.3491'. [ 609.505585][T20015] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3497'. [ 609.524239][ T30] audit: type=1804 audit(1778603967.424:16): pid=20017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.3497" name="/newroot/83/cgroup.controllers" dev="tmpfs" ino=447 res=1 errno=0 [ 609.536349][T20018] lo speed is unknown, defaulting to 1000 [ 609.551873][ T30] audit: type=1800 audit(1778603967.454:17): pid=20015 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3497" name="cgroup.controllers" dev="tmpfs" ino=447 res=0 errno=0 [ 609.596361][T20020] xt_hashlimit: max too large, truncated to 1048576 [ 609.607209][T20010] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3494'. [ 609.638295][ T30] audit: type=1800 audit(1778603967.454:18): pid=20017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3497" name="cgroup.controllers" dev="tmpfs" ino=447 res=0 errno=0 [ 609.677346][T20020] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3496'. [ 609.707768][ T30] audit: type=1804 audit(1778603967.494:19): pid=20017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.3497" name="/newroot/83/cgroup.controllers" dev="tmpfs" ino=447 res=1 errno=0 [ 610.200427][T20043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3503'. [ 610.219271][T20038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 610.228657][ T5810] IPVS: starting estimator thread 0... [ 610.229344][T20038] 8021q: adding VLAN 0 to HW filter on device team0 [ 610.273317][T20038] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 610.401465][T20046] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3504'. [ 610.421265][T20038] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 610.431862][T20038] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 610.452022][T20038] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 610.484738][T20038] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 610.510856][T20038] veth1_vlan: left promiscuous mode [ 610.518715][T20038] veth0_vlan: left promiscuous mode [ 610.525757][T20038] veth0_vlan: entered promiscuous mode [ 610.535618][T20038] veth1_vlan: entered promiscuous mode [ 610.549073][T20038] veth1_macvtap: left promiscuous mode [ 610.556002][T20038] veth0_macvtap: left promiscuous mode [ 610.562654][T20038] veth0_macvtap: entered promiscuous mode [ 610.570356][T20038] veth1_macvtap: entered promiscuous mode [ 610.587629][T20044] IPVS: using max 39 ests per chain, 93600 per kthread [ 610.604023][T20038] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 610.613329][T20038] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 610.626394][T20038] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 610.635966][T20038] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 610.652940][T20039] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3500'. [ 610.665699][ T7848] bridge0: port 1(bridge_slave_0) entered blocking state [ 610.672920][ T7848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 610.681851][ T7848] bridge0: port 2(bridge_slave_1) entered blocking state [ 610.697997][ T7848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 610.746574][T14966] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.765533][T14966] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.832232][T20053] IPVS: set_ctl: invalid protocol: 46 127.0.0.1:20001 [ 610.866947][T14966] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.881330][T14966] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.946938][T20050] lo speed is unknown, defaulting to 1000 [ 611.186653][T20070] bond0: (slave bond_slave_1): Releasing backup interface [ 611.436800][T20075] __nla_validate_parse: 1 callbacks suppressed [ 611.436854][T20075] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.3515'. [ 612.123003][T20081] netlink: 'syz.3.3517': attribute type 7 has an invalid length. [ 612.133791][T20081] syzkaller1: entered promiscuous mode [ 612.140055][T20081] syzkaller1: entered allmulticast mode [ 612.270177][T20083] netlink: 'syz.2.3518': attribute type 1 has an invalid length. [ 612.387290][T20083] 8021q: adding VLAN 0 to HW filter on device bond1 [ 612.495658][T20099] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3520'. [ 612.525469][T20101] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3522'. [ 612.981345][T20121] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.3526'. [ 613.183068][T20126] netlink: 'syz.4.3527': attribute type 1 has an invalid length. [ 613.357948][T20126] 8021q: adding VLAN 0 to HW filter on device bond6 [ 613.515669][T20135] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3529'. [ 613.631944][T20145] A link change request failed with some changes committed already. Interface @ may have been left with an inconsistent configuration, please check. [ 613.761040][T20141] lo speed is unknown, defaulting to 1000 [ 614.663701][T20170] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.3538'. [ 614.885336][T20171] syzkaller0: entered promiscuous mode [ 614.909026][T20171] syzkaller0: entered allmulticast mode [ 615.099248][T20189] sctp: [Deprecated]: syz.4.3542 (pid 20189) Use of int in max_burst socket option deprecated. [ 615.099248][T20189] Use struct sctp_assoc_value instead [ 615.351905][T20199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3543'. [ 615.379480][T20199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3543'. [ 615.631872][T20211] netlink: 'syz.0.3546': attribute type 1 has an invalid length. [ 615.645297][T20211] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3546'. [ 616.080017][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 616.095609][T20211] macvlan2: entered promiscuous mode [ 616.102069][T20211] macvlan2: entered allmulticast mode [ 616.163664][T20230] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3548'. [ 616.356908][T20237] nr0: tun_chr_ioctl cmd 1074025677 [ 616.362432][T20237] nr0: linktype set to 774 [ 616.823230][T20272] "syz.3.3558" (20272) uses obsolete ecb(arc4) skcipher [ 617.537867][T20292] __nla_validate_parse: 1 callbacks suppressed [ 617.537885][T20292] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3559'. [ 617.547218][T20296] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3561'. [ 617.594896][T20289] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3559'. [ 617.624834][T20296] FAULT_INJECTION: forcing a failure. [ 617.624834][T20296] name failslab, interval 1, probability 0, space 0, times 0 [ 617.658705][T20296] CPU: 1 UID: 0 PID: 20296 Comm: syz.0.3561 Not tainted syzkaller #0 PREEMPT(full) [ 617.658732][T20296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 617.658743][T20296] Call Trace: [ 617.658751][T20296] [ 617.658759][T20296] dump_stack_lvl+0xe8/0x150 [ 617.658793][T20296] should_fail_ex+0x412/0x560 [ 617.658821][T20296] ? __d_alloc+0x37/0x6f0 [ 617.658961][T20296] should_failslab+0xa8/0x100 [ 617.658991][T20296] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 617.659023][T20296] __d_alloc+0x37/0x6f0 [ 617.659049][T20296] d_alloc+0x4b/0x190 [ 617.659067][T20296] ? lookup_one_qstr_excl+0xc4/0x360 [ 617.659119][T20296] lookup_one_qstr_excl+0xd8/0x360 [ 617.659141][T20296] ? lookup_noperm_common+0x245/0x430 [ 617.659165][T20296] start_dirop+0x5c/0x90 [ 617.659187][T20296] simple_start_creating+0xcc/0x110 [ 617.659211][T20296] ? __pfx_simple_start_creating+0x10/0x10 [ 617.659235][T20296] ? mntput+0x65/0xc0 [ 617.659258][T20296] debugfs_start_creating+0xdb/0x1a0 [ 617.659360][T20296] debugfs_create_dir+0x24/0x350 [ 617.659379][T20296] ieee80211_debugfs_recreate_netdev+0x1b4/0x1460 [ 617.659585][T20296] ? __pfx_ieee80211_debugfs_recreate_netdev+0x10/0x10 [ 617.659624][T20296] drv_remove_interface+0x1ed/0x570 [ 617.659740][T20296] ieee80211_do_stop+0x1708/0x2260 [ 617.659808][T20296] ? rcu_is_watching+0x15/0xb0 [ 617.659852][T20296] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 617.659910][T20296] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 617.659941][T20296] ieee80211_stop+0x1b1/0x220 [ 617.659960][T20296] ? __pfx_ieee80211_stop+0x10/0x10 [ 617.660006][T20296] __dev_close_many+0x36d/0x6e0 [ 617.660065][T20296] ? __pfx___dev_close_many+0x10/0x10 [ 617.660081][T20296] ? __dev_change_flags+0x2b0/0x7e0 [ 617.660140][T20296] __dev_change_flags+0x3c1/0x7e0 [ 617.660166][T20296] ? __pfx___dev_change_flags+0x10/0x10 [ 617.660184][T20296] ? __irq_work_queue_local+0x1f2/0x4c0 [ 617.660270][T20296] ? __pfx___irq_work_queue_local+0x10/0x10 [ 617.660293][T20296] ? console_unlock+0x150/0x1c0 [ 617.660362][T20296] ? preempt_schedule_thunk+0x16/0x30 [ 617.660441][T20296] netif_change_flags+0x88/0x1a0 [ 617.660469][T20296] do_setlink+0xfa5/0x45a0 [ 617.660519][T20296] ? __wake_up_klogd+0xe6/0x120 [ 617.660548][T20296] ? __pfx_vprintk_emit+0x10/0x10 [ 617.660577][T20296] ? __pfx_do_setlink+0x10/0x10 [ 617.660613][T20296] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 617.660637][T20296] ? rcu_is_watching+0x15/0xb0 [ 617.660663][T20296] ? __mutex_trylock_common+0x158/0x260 [ 617.660714][T20296] ? __pfx___mutex_trylock_common+0x10/0x10 [ 617.660738][T20296] ? rcu_is_watching+0x15/0xb0 [ 617.660757][T20296] ? trace_contention_end+0x3d/0x140 [ 617.660777][T20296] ? __mutex_lock+0x319/0x1550 [ 617.660792][T20296] ? __pfx___nla_validate_parse+0x10/0x10 [ 617.660825][T20296] ? rtnl_newlink+0x883/0x1bb0 [ 617.660850][T20296] ? __pfx___mutex_lock+0x10/0x10 [ 617.660880][T20296] ? ns_capable+0x89/0xe0 [ 617.660904][T20296] rtnl_newlink+0x15ad/0x1bb0 [ 617.660937][T20296] ? __pfx_rtnl_newlink+0x10/0x10 [ 617.660956][T20296] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.661005][T20296] ? kasan_quarantine_put+0xbb/0x1f0 [ 617.661026][T20296] ? lockdep_hardirqs_on+0x7a/0x110 [ 617.661060][T20296] ? nlmon_xmit+0xb0/0x100 [ 617.661213][T20296] ? kmem_cache_free+0x182/0x650 [ 617.661247][T20296] ? __lock_acquire+0x6b5/0x2cf0 [ 617.661269][T20296] ? __dev_queue_xmit+0x2b6/0x3950 [ 617.661288][T20296] ? __local_bh_enable_ip+0xd0/0x130 [ 617.661305][T20296] ? lockdep_hardirqs_on+0x7a/0x110 [ 617.661364][T20296] ? __dev_queue_xmit+0x2b6/0x3950 [ 617.661381][T20296] ? __local_bh_enable_ip+0xd0/0x130 [ 617.661406][T20296] ? __dev_queue_xmit+0x2b6/0x3950 [ 617.661432][T20296] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 617.661471][T20296] ? __pfx_rtnl_newlink+0x10/0x10 [ 617.661495][T20296] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 617.661520][T20296] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 617.661537][T20296] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 617.661557][T20296] ? ref_tracker_free+0x693/0x840 [ 617.661585][T20296] ? __pfx_ref_tracker_free+0x10/0x10 [ 617.661647][T20296] netlink_rcv_skb+0x232/0x4b0 [ 617.661677][T20296] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 617.661703][T20296] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 617.661741][T20296] ? netlink_deliver_tap+0x2e/0x1b0 [ 617.661765][T20296] ? netlink_deliver_tap+0x2e/0x1b0 [ 617.661796][T20296] netlink_unicast+0x75c/0x8e0 [ 617.661832][T20296] netlink_sendmsg+0x813/0xb40 [ 617.661868][T20296] ? __pfx_netlink_sendmsg+0x10/0x10 [ 617.661896][T20296] ? aa_sock_msg_perm+0xf1/0x1b0 [ 617.661924][T20296] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 617.661953][T20296] ____sys_sendmsg+0x972/0x9f0 [ 617.661981][T20296] ? __might_fault+0xaf/0x130 [ 617.662011][T20296] ? __pfx_____sys_sendmsg+0x10/0x10 [ 617.662047][T20296] ? import_iovec+0x73/0xa0 [ 617.662076][T20296] ___sys_sendmsg+0x2a5/0x360 [ 617.662102][T20296] ? __lock_acquire+0x6b5/0x2cf0 [ 617.662127][T20296] ? __pfx____sys_sendmsg+0x10/0x10 [ 617.662192][T20296] ? __fget_files+0x2a/0x420 [ 617.662213][T20296] ? __fget_files+0x3a0/0x420 [ 617.662246][T20296] __x64_sys_sendmsg+0x1bd/0x2a0 [ 617.662274][T20296] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 617.662310][T20296] ? __pfx_ksys_write+0x10/0x10 [ 617.662345][T20296] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.662365][T20296] do_syscall_64+0x15f/0xf80 [ 617.662382][T20296] ? trace_irq_disable+0x3b/0x140 [ 617.662415][T20296] ? clear_bhb_loop+0x40/0x90 [ 617.662438][T20296] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.662456][T20296] RIP: 0033:0x7f98c339cdd9 [ 617.662475][T20296] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 617.662490][T20296] RSP: 002b:00007f98c41ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 617.662510][T20296] RAX: ffffffffffffffda RBX: 00007f98c3615fa0 RCX: 00007f98c339cdd9 [ 617.662523][T20296] RDX: 0000000000004000 RSI: 0000200000000140 RDI: 0000000000000004 [ 617.662534][T20296] RBP: 00007f98c41ab090 R08: 0000000000000000 R09: 0000000000000000 [ 617.662545][T20296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 617.662556][T20296] R13: 00007f98c3616038 R14: 00007f98c3615fa0 R15: 00007ffddb687d78 [ 617.662587][T20296] [ 618.679802][T20324] syzkaller0: entered promiscuous mode [ 618.710476][T20324] syzkaller0: entered allmulticast mode [ 619.113055][T20335] nbd: couldn't find device at index 0 [ 619.295061][T20344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3573'. [ 619.474522][T20348] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3575'. [ 619.676802][T20364] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3580'. [ 619.864508][T20371] netlink: 'syz.1.3581': attribute type 6 has an invalid length. [ 619.876438][T20371] IPv6: NLM_F_CREATE should be specified when creating new route [ 620.040873][T20376] virt_wifi0: entered promiscuous mode [ 620.069352][T20376] macsec1: entered promiscuous mode [ 620.085198][T20376] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3583'. [ 620.167306][T20378] netlink: 'syz.4.3585': attribute type 213 has an invalid length. [ 620.196255][T20378] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3585'. [ 620.335667][ T5358] IPVS: starting estimator thread 0... [ 620.490158][T20392] netem: change failed [ 620.529441][T20393] IPVS: using max 32 ests per chain, 76800 per kthread [ 621.025859][T20411] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3593'. [ 621.115187][T20411] gretap0: entered promiscuous mode [ 621.319229][T20435] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3602'. [ 621.643080][T20443] block nbd2: Unsupported socket: should be TCP or UNIX. [ 621.929682][T20451] syzkaller0: entered promiscuous mode [ 621.935406][T20451] syzkaller0: entered allmulticast mode [ 622.046987][T20456] lo speed is unknown, defaulting to 1000 [ 622.273373][T20465] netlink: 'syz.0.3610': attribute type 1 has an invalid length. [ 622.904580][T20486] __nla_validate_parse: 1 callbacks suppressed [ 622.904621][T20486] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3618'. [ 623.555760][T20505] bond1: entered promiscuous mode [ 623.755063][T20513] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.3625'. [ 623.951650][T20516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3627'. [ 623.973133][T20517] x_tables: duplicate underflow at hook 2 [ 624.439933][T20535] FAULT_INJECTION: forcing a failure. [ 624.439933][T20535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 624.464647][T20532] lo speed is unknown, defaulting to 1000 [ 624.491895][T20535] CPU: 1 UID: 0 PID: 20535 Comm: syz.4.3630 Not tainted syzkaller #0 PREEMPT(full) [ 624.491919][T20535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 624.491930][T20535] Call Trace: [ 624.491937][T20535] [ 624.491945][T20535] dump_stack_lvl+0xe8/0x150 [ 624.491972][T20535] should_fail_ex+0x412/0x560 [ 624.492000][T20535] _copy_from_user+0x2d/0xb0 [ 624.492025][T20535] __sys_bpf+0x229/0x950 [ 624.492182][T20535] ? __pfx___sys_bpf+0x10/0x10 [ 624.492228][T20535] ? ksys_write+0x242/0x270 [ 624.492253][T20535] ? __pfx_ksys_write+0x10/0x10 [ 624.492279][T20535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.492296][T20535] __x64_sys_bpf+0x7c/0x90 [ 624.492321][T20535] do_syscall_64+0x15f/0xf80 [ 624.492338][T20535] ? trace_irq_disable+0x3b/0x140 [ 624.492363][T20535] ? clear_bhb_loop+0x40/0x90 [ 624.492383][T20535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.492400][T20535] RIP: 0033:0x7efcb999cdd9 [ 624.492418][T20535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 624.492432][T20535] RSP: 002b:00007efcba863028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 624.492451][T20535] RAX: ffffffffffffffda RBX: 00007efcb9c15fa0 RCX: 00007efcb999cdd9 [ 624.492463][T20535] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 624.492474][T20535] RBP: 00007efcba863090 R08: 0000000000000000 R09: 0000000000000000 [ 624.492483][T20535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 624.492493][T20535] R13: 00007efcb9c16038 R14: 00007efcb9c15fa0 R15: 00007ffdf2b30da8 [ 624.492551][T20535] [ 624.794426][T17892] Bluetooth: hci5: command 0x040f tx timeout [ 625.016222][T20539] syzkaller0: entered promiscuous mode [ 625.021818][T20539] syzkaller0: entered allmulticast mode [ 625.032686][T20546] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3632'. [ 625.246388][T20556] netlink: 'syz.2.3635': attribute type 1 has an invalid length. [ 625.265480][T20556] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 627.348360][T20543] Set syz1 is full, maxelem 65536 reached [ 630.815369][T20577] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3640'. [ 630.973682][T20581] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3641'. [ 631.084824][T20592] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.3643'. [ 631.094807][T20592] openvswitch: netlink: EtherType 0 is less than min 600 [ 631.132750][T20592] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 631.413013][T20607] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3648'. [ 631.441301][T20612] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 631.801659][T20617] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3651'. [ 631.819368][T20617] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 632.925999][T20625] geneve1: entered promiscuous mode [ 633.640264][T20649] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 633.678261][T20651] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3660'. [ 633.679191][T20652] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 633.729144][T20652] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 633.821658][T20657] digital: digital_start_poll: Unknown protocol [ 633.978380][T20665] netlink: 'syz.0.3667': attribute type 3 has an invalid length. [ 633.996138][T20665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3667'. [ 634.010950][T20665] netlink: 'syz.0.3667': attribute type 3 has an invalid length. [ 634.021096][T20665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3667'. [ 634.185946][T20669] openvswitch: netlink: VXLAN extension 307 out of range max 1 [ 634.243111][T20672] bridge_slave_0: left allmulticast mode [ 634.249736][T20672] bridge_slave_0: left promiscuous mode [ 634.255642][T20672] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.274908][T20672] bridge_slave_1: left allmulticast mode [ 634.281239][T20672] bridge_slave_1: left promiscuous mode [ 634.287232][T20672] bridge0: port 2(bridge_slave_1) entered disabled state [ 634.298692][T20675] rdma_rxe: rxe_newlink: failed to add lo [ 634.347919][T20672] bond0: (slave bond_slave_0): Releasing backup interface [ 634.369677][T20672] team0: Port device team_slave_0 removed [ 634.380935][T20672] team0: Port device team_slave_1 removed [ 634.392331][T20672] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 634.407832][T20672] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 634.435969][T20672] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 634.461484][T20678] team0: Mode changed to "activebackup" [ 634.534579][T20683] sock: sock_set_timeout: `syz.3.3670' (pid 20683) tries to set negative timeout [ 635.018519][T20701] syzkaller0: entered promiscuous mode [ 635.024060][T20701] syzkaller0: entered allmulticast mode [ 635.034473][ T7514] 0: reclassify loop, rule prio 0, protocol 700 [ 635.056701][T20701] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3677'. [ 635.188951][T20705] Bluetooth: MGMT ver 1.23 [ 637.992668][T20703] netlink: 'syz.0.3678': attribute type 4 has an invalid length. [ 638.172303][T20719] netlink: 'syz.1.3681': attribute type 32 has an invalid length. [ 638.192365][ T1222] page_pool_release_retry() stalled pool shutdown: id 40, 1 inflight 484 sec [ 638.227285][T20709] lo speed is unknown, defaulting to 1000 [ 639.080916][T20748] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3689'. [ 639.217678][T20748] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3689'. [ 640.262587][T20800] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3699'. [ 640.548853][T20815] lo speed is unknown, defaulting to 1000 [ 640.595148][T20819] syz_tun: entered allmulticast mode [ 640.633684][T20817] syz_tun: left allmulticast mode [ 640.802309][T20825] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 640.903246][T20825] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3706'. [ 641.025297][T20832] x_tables: ip_tables: osf match: only valid for protocol 6 [ 641.953380][T20856] syzkaller0: entered promiscuous mode [ 641.959916][T20856] syzkaller0: entered allmulticast mode [ 641.979787][T20855] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3716'. [ 642.169303][T20849] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3714'. [ 642.191491][T20851] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 642.226580][T20851] netlink: 'syz.2.3711': attribute type 3 has an invalid length. [ 642.247365][T20851] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3711'. [ 642.270015][T20861] veth5: entered allmulticast mode [ 642.281000][T20861] bond7: (slave veth5): Enslaving as an active interface with an up link [ 642.296095][T20863] bridge2: entered promiscuous mode [ 642.303864][T20849] mac80211_hwsim hwsim63 wlan0: left promiscuous mode [ 642.361122][T20864] bond7 (unregistering): (slave veth5): Releasing backup interface [ 642.383221][T20864] bond7 (unregistering): Released all slaves [ 642.566070][T20872] netlink: 'syz.2.3718': attribute type 1 has an invalid length. [ 642.577961][T20872] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3718'. [ 642.799917][T20881] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3722'. [ 642.866100][T20881] x_tables: duplicate underflow at hook 2 [ 642.929951][T20885] netlink: 'syz.2.3724': attribute type 13 has an invalid length. [ 642.935949][T20883] gtp0: entered promiscuous mode [ 642.942773][T20883] gtp0: entered allmulticast mode [ 643.557135][T20898] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3728'. [ 643.675576][T20901] netlink: 'syz.3.3729': attribute type 1 has an invalid length. [ 643.714080][T20901] 8021q: adding VLAN 0 to HW filter on device bond3 [ 643.775431][T20901] bond3: (slave geneve2): making interface the new active one [ 643.786856][T20901] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 643.800478][T20901] netlink: 'syz.3.3729': attribute type 1 has an invalid length. [ 643.903252][T20910] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 643.922672][T20910] rdma_rxe: rxe_newlink: failed to add lo [ 644.177130][T20921] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 644.196054][T20921] x_tables: duplicate underflow at hook 1 [ 644.203153][T20921] IPVS: set_ctl: invalid protocol: 51 0.0.0.0:20003 [ 644.325158][T20915] __nla_validate_parse: 4 callbacks suppressed [ 644.325277][T20915] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3735'. [ 644.684014][T20943] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3745'. [ 644.805454][T20954] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3747'. [ 644.817414][T20954] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3747'. [ 644.900832][T20960] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3749'. [ 645.065414][T20956] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3748'. [ 645.366276][T20978] netlink: 'syz.0.3752': attribute type 13 has an invalid length. [ 645.374224][T20978] netlink: 'syz.0.3752': attribute type 17 has an invalid length. [ 645.427604][T20974] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3752'. [ 645.540484][T20987] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3756'. [ 645.583357][T20988] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.3757'. [ 645.752151][T20978] A link change request failed with some changes committed already. Interface @ may have been left with an inconsistent configuration, please check. [ 645.851130][T20992] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3756'. [ 646.352822][T21002] vcan0: tx drop: invalid da for name 0xfffffffffffffffd [ 646.360465][ T8878] IPVS: starting estimator thread 0... [ 646.450816][T21014] IPVS: using max 36 ests per chain, 86400 per kthread [ 646.827031][T21037] netlink: 'syz.1.3765': attribute type 8 has an invalid length. [ 646.858109][T21037] veth1_to_team: entered promiscuous mode [ 646.868081][T21037] gretap0: entered promiscuous mode [ 646.877587][T21037] veth1_to_team: left promiscuous mode [ 646.896886][T21037] gretap0: left promiscuous mode [ 647.161944][T21051] tun0: tun_chr_ioctl cmd 1074025675 [ 647.167299][T21051] tun0: persist enabled [ 647.171964][T21051] tun0: tun_chr_ioctl cmd 1074025675 [ 647.177286][T21051] tun0: persist enabled [ 647.181886][T21051] tun0: tun_chr_ioctl cmd 1074025673 [ 647.233715][T21057] netlink: 'syz.3.3768': attribute type 6 has an invalid length. [ 647.496343][T21070] netlink: 'syz.0.3772': attribute type 1 has an invalid length. [ 647.538807][T21070] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 647.589440][T21070] IPVS: set_ctl: invalid protocol: 94 255.255.255.255:20002 [ 648.664315][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.675309][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.692875][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.702098][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.712760][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.724691][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.734007][T21124] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 648.854893][T21133] syz.4.3789: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 648.870427][T21133] CPU: 0 UID: 0 PID: 21133 Comm: syz.4.3789 Not tainted syzkaller #0 PREEMPT(full) [ 648.870521][T21133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 648.870532][T21133] Call Trace: [ 648.870538][T21133] [ 648.870544][T21133] dump_stack_lvl+0xe8/0x150 [ 648.870566][T21133] warn_alloc+0x249/0x340 [ 648.870621][T21133] ? stack_trace_save+0xa9/0x100 [ 648.870698][T21133] ? __pfx_warn_alloc+0x10/0x10 [ 648.870717][T21133] ? kasan_save_track+0x4f/0x80 [ 648.870770][T21133] ? kasan_save_track+0x3e/0x80 [ 648.870784][T21133] ? __kasan_kmalloc+0x93/0xb0 [ 648.870799][T21133] ? __kmalloc_cache_noprof+0x31c/0x660 [ 648.870814][T21133] ? xskq_create+0x56/0x170 [ 648.870940][T21133] ? xsk_setsockopt+0x54c/0x990 [ 648.870953][T21133] ? do_sock_setsockopt+0x17c/0x1b0 [ 648.870968][T21133] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 648.870983][T21133] ? do_syscall_64+0x15f/0xf80 [ 648.870995][T21133] __vmalloc_node_range_noprof+0x132/0x1750 [ 648.871050][T21133] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 648.871069][T21133] ? __kasan_kmalloc+0x93/0xb0 [ 648.871087][T21133] vmalloc_user_noprof+0xad/0xe0 [ 648.871103][T21133] ? xskq_create+0xbf/0x170 [ 648.871118][T21133] xskq_create+0xbf/0x170 [ 648.871135][T21133] xsk_init_queue+0x8a/0xe0 [ 648.871151][T21133] xsk_setsockopt+0x54c/0x990 [ 648.871166][T21133] ? __pfx_xsk_setsockopt+0x10/0x10 [ 648.871180][T21133] ? __pfx_aa_sk_perm+0x10/0x10 [ 648.871197][T21133] ? aa_sock_opt_perm+0xff/0x1a0 [ 648.871214][T21133] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 648.871229][T21133] ? __pfx_xsk_setsockopt+0x10/0x10 [ 648.871243][T21133] do_sock_setsockopt+0x17c/0x1b0 [ 648.871262][T21133] __x64_sys_setsockopt+0x13d/0x1b0 [ 648.871279][T21133] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.871292][T21133] do_syscall_64+0x15f/0xf80 [ 648.871302][T21133] ? trace_irq_disable+0x3b/0x140 [ 648.871318][T21133] ? clear_bhb_loop+0x40/0x90 [ 648.871331][T21133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.871342][T21133] RIP: 0033:0x7efcb999cdd9 [ 648.871355][T21133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.871365][T21133] RSP: 002b:00007efcba863028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 648.871378][T21133] RAX: ffffffffffffffda RBX: 00007efcb9c15fa0 RCX: 00007efcb999cdd9 [ 648.871386][T21133] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 648.871393][T21133] RBP: 00007efcb9a32d69 R08: 0000000000000004 R09: 0000000000000000 [ 648.871399][T21133] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 648.871406][T21133] R13: 00007efcb9c16038 R14: 00007efcb9c15fa0 R15: 00007ffdf2b30da8 [ 648.871424][T21133] [ 648.871451][T21133] Mem-Info: [ 649.158131][T21133] active_anon:5719 inactive_anon:0 isolated_anon:0 [ 649.158131][T21133] active_file:3357 inactive_file:40181 isolated_file:0 [ 649.158131][T21133] unevictable:768 dirty:227 writeback:0 [ 649.158131][T21133] slab_reclaimable:12861 slab_unreclaimable:190567 [ 649.158131][T21133] mapped:29599 shmem:1292 pagetables:1274 [ 649.158131][T21133] sec_pagetables:0 bounce:0 [ 649.158131][T21133] kernel_misc_reclaimable:0 [ 649.158131][T21133] free:1211654 free_pcp:21844 free_cma:0 [ 649.207590][T21133] Node 0 active_anon:22876kB inactive_anon:0kB active_file:13428kB inactive_file:160524kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:110228kB dirty:956kB writeback:0kB shmem:3636kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16296kB pagetables:5020kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 649.242873][T21133] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:8192kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 649.276859][T21133] Node 0 DMA free:11116kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:148kB local_pcp:104kB free_cma:0kB [ 649.308250][T21133] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 649.314428][T21133] Node 0 DMA32 free:1038172kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22876kB inactive_anon:0kB active_file:13428kB inactive_file:160524kB unevictable:1536kB writepending:956kB zspages:0kB present:3129332kB managed:2552532kB mlocked:0kB bounce:0kB free_pcp:39964kB local_pcp:21152kB free_cma:0kB [ 649.349115][T21133] lowmem_reserve[]: 0 0 0 0 0 [ 649.353965][T21133] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:668kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:4kB free_cma:0kB [ 649.385261][T21133] lowmem_reserve[]: 0 0 0 0 0 [ 649.390785][T21133] Node 1 Normal free:3797264kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:47252kB local_pcp:18880kB free_cma:0kB [ 649.423821][T21133] lowmem_reserve[]: 0 0 0 0 0 [ 649.430482][T21133] Node 0 DMA: 1*4kB (U) 1*8kB (U) 2*16kB (U) 2*32kB (U) 2*64kB (U) 1*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11116kB [ 649.446886][T21133] Node 0 DMA32: 4319*4kB (UME) 5786*8kB (UME) 2801*16kB (UME) 515*32kB (UME) 176*64kB (UME) 584*128kB (UME) 635*256kB (UME) 364*512kB (UM) 208*1024kB (UME) 118*2048kB (U) 6*4096kB (U) = 1039036kB [ 649.466687][T21133] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 649.478382][T21133] Node 1 Normal: 4*4kB (U) 8*8kB (UM) 12*16kB (UM) 2*32kB (UM) 13*64kB (UM) 9*128kB (UM) 6*256kB (UM) 7*512kB (UM) 5*1024kB (UM) 2*2048kB (U) 923*4096kB (UM) = 3797264kB [ 649.496206][T21133] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 649.506306][T21133] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 649.516238][T21133] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 649.526595][T21133] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 649.536531][T21133] 44827 total pagecache pages [ 649.542009][T21133] 0 pages in swap cache [ 649.546237][T21133] Free swap = 124996kB [ 649.550886][T21133] Total swap = 124996kB [ 649.555042][T21133] 2097051 pages RAM [ 649.559439][T21133] 0 pages HighMem/MovableOnly [ 649.564127][T21133] 427136 pages reserved [ 649.568262][T21133] 0 pages cma reserved [ 649.736642][T21142] syzkaller1: entered promiscuous mode [ 649.742209][T21142] syzkaller1: entered allmulticast mode [ 650.889385][T21103] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 651.123930][T21158] __nla_validate_parse: 5 callbacks suppressed [ 651.123953][T21158] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3795'. [ 651.147485][T21158] block nbd2: Unsupported socket: should be TCP or UNIX. [ 651.276123][T21164] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3797'. [ 651.318782][T21164] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3797'. [ 651.697306][T21174] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3801'. [ 651.859567][T21182] openvswitch: netlink: Flow actions attr not present in new flow. [ 651.920255][T21185] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3801'. [ 652.032486][T21187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3803'. [ 652.050007][T21187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3803'. [ 652.156506][T21190] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3803'. [ 652.368212][T21192] syzkaller1: entered allmulticast mode [ 652.419723][T21194] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3805'. [ 652.558872][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 652.621205][T21198] : renamed from veth0_to_bond (while UP) [ 653.015773][T21219] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3812'. [ 653.074727][T21221] netlink: 'syz.0.3813': attribute type 11 has an invalid length. [ 653.082594][T21221] netlink: 'syz.0.3813': attribute type 5 has an invalid length. [ 653.607502][T21238] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 653.623161][ T5358] IPVS: starting estimator thread 0... [ 653.719322][T21243] IPVS: using max 28 ests per chain, 67200 per kthread [ 653.871247][T21252] pim6reg: entered allmulticast mode [ 653.878776][T21252] pim6reg: left allmulticast mode [ 653.981653][T21259] team0 (unregistering): Port device team_slave_0 removed [ 654.002338][T21259] team0 (unregistering): Port device team_slave_1 removed [ 654.324572][T21266] syzkaller0: entered promiscuous mode [ 654.330510][T21266] syzkaller0: entered allmulticast mode [ 654.420948][T21285] vxcan2: entered allmulticast mode [ 655.532644][T17892] Bluetooth: hci1: command 0x0406 tx timeout [ 656.167728][T21370] bridge1: entered promiscuous mode [ 656.186106][T21370] bridge1: entered allmulticast mode [ 656.294558][T21370] team0: Port device bridge1 added [ 656.322225][T21372] bridge0: port 3(team0) entered blocking state [ 656.328609][T21372] bridge0: port 3(team0) entered disabled state [ 656.335164][T21372] team0: entered allmulticast mode [ 656.340310][T21372] team_slave_0: entered allmulticast mode [ 656.346056][T21372] team_slave_1: entered allmulticast mode [ 656.355502][T21372] team0: entered promiscuous mode [ 656.360589][T21372] team_slave_0: entered promiscuous mode [ 656.383850][T21372] team_slave_1: entered promiscuous mode [ 656.410965][T21372] bridge0: port 3(team0) entered blocking state [ 656.417376][T21372] bridge0: port 3(team0) entered forwarding state [ 656.570418][T21386] __nla_validate_parse: 10 callbacks suppressed [ 656.570443][T21386] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.3847'. [ 656.749843][T21390] netlink: 'syz.4.3850': attribute type 8 has an invalid length. [ 656.780088][T21390] netlink: 'syz.4.3850': attribute type 4 has an invalid length. [ 656.832635][T21396] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3853'. [ 656.930917][T21399] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3854'. [ 657.003543][T21399] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3854'. [ 657.115892][ T30] audit: type=1107 audit(1778604015.014:20): pid=21409 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='}1UzN͆*+HBN%' [ 657.138025][T21401] bond2: entered promiscuous mode [ 657.143971][T21401] 8021q: adding VLAN 0 to HW filter on device bond2 [ 657.394150][T21425] tipc: Enabled bearer , priority 0 [ 657.427340][T21425] syzkaller0: entered promiscuous mode [ 657.439666][T21425] syzkaller0: entered allmulticast mode [ 657.607482][T21425] tipc: Resetting bearer [ 657.740824][T21424] tipc: Resetting bearer [ 657.814212][T21424] tipc: Disabling bearer [ 657.945750][T21444] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3868'. [ 657.954815][T21448] FAULT_INJECTION: forcing a failure. [ 657.954815][T21448] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 657.969348][T21448] CPU: 0 UID: 0 PID: 21448 Comm: syz.0.3869 Not tainted syzkaller #0 PREEMPT(full) [ 657.969396][T21448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 657.969417][T21448] Call Trace: [ 657.969433][T21448] [ 657.969448][T21448] dump_stack_lvl+0xe8/0x150 [ 657.969481][T21448] should_fail_ex+0x412/0x560 [ 657.969511][T21448] _copy_from_user+0x2d/0xb0 [ 657.969543][T21448] __sys_bpf+0x229/0x950 [ 657.969590][T21448] ? __pfx___sys_bpf+0x10/0x10 [ 657.969634][T21448] ? rcu_is_watching+0x15/0xb0 [ 657.969661][T21448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 657.969741][T21448] __x64_sys_bpf+0x7c/0x90 [ 657.969765][T21448] do_syscall_64+0x15f/0xf80 [ 657.969792][T21448] ? trace_irq_disable+0x3b/0x140 [ 657.969818][T21448] ? clear_bhb_loop+0x40/0x90 [ 657.969840][T21448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 657.969858][T21448] RIP: 0033:0x7f98c339cdd9 [ 657.969876][T21448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 657.969890][T21448] RSP: 002b:00007f98c41ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 657.969910][T21448] RAX: ffffffffffffffda RBX: 00007f98c3615fa0 RCX: 00007f98c339cdd9 [ 657.969923][T21448] RDX: 0000000000000022 RSI: 0000200000000100 RDI: 000000000000000a [ 657.969934][T21448] RBP: 00007f98c41ab090 R08: 0000000000000000 R09: 0000000000000000 [ 657.969944][T21448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 657.969955][T21448] R13: 00007f98c3616038 R14: 00007f98c3615fa0 R15: 00007ffddb687d78 [ 657.969986][T21448] [ 658.365186][T21458] IPv6: NLM_F_CREATE should be specified when creating new route [ 658.381064][T21458] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 658.388427][T21458] IPv6: NLM_F_CREATE should be set when creating new route [ 658.395789][T21458] IPv6: NLM_F_CREATE should be set when creating new route [ 658.403106][T21458] IPv6: NLM_F_CREATE should be set when creating new route [ 658.414548][T21456] lo speed is unknown, defaulting to 1000 [ 658.669527][T21475] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 658.955922][T21489] FAULT_INJECTION: forcing a failure. [ 658.955922][T21489] name failslab, interval 1, probability 0, space 0, times 0 [ 659.002265][T21489] CPU: 0 UID: 0 PID: 21489 Comm: syz.3.3880 Not tainted syzkaller #0 PREEMPT(full) [ 659.002292][T21489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 659.002369][T21489] Call Trace: [ 659.002377][T21489] [ 659.002386][T21489] dump_stack_lvl+0xe8/0x150 [ 659.002415][T21489] should_fail_ex+0x412/0x560 [ 659.002467][T21489] should_failslab+0xa8/0x100 [ 659.002496][T21489] __kmalloc_noprof+0xe8/0x760 [ 659.002522][T21489] ? bpf_test_init+0x9f/0x150 [ 659.002589][T21489] ? __lock_acquire+0x6b5/0x2cf0 [ 659.002613][T21489] bpf_test_init+0x9f/0x150 [ 659.002641][T21489] bpf_prog_test_run_skb+0x392/0x2260 [ 659.002685][T21489] ? __fget_files+0x3a0/0x420 [ 659.002706][T21489] ? __fget_files+0x2a/0x420 [ 659.002729][T21489] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 659.002754][T21489] bpf_prog_test_run+0x2c7/0x340 [ 659.002773][T21489] __sys_bpf+0x643/0x950 [ 659.002799][T21489] ? __pfx___sys_bpf+0x10/0x10 [ 659.002835][T21489] ? ksys_write+0x242/0x270 [ 659.002865][T21489] ? __pfx_ksys_write+0x10/0x10 [ 659.002893][T21489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.002912][T21489] __x64_sys_bpf+0x7c/0x90 [ 659.002933][T21489] do_syscall_64+0x15f/0xf80 [ 659.002949][T21489] ? trace_irq_disable+0x3b/0x140 [ 659.002981][T21489] ? clear_bhb_loop+0x40/0x90 [ 659.003029][T21489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.003047][T21489] RIP: 0033:0x7f001619cdd9 [ 659.003066][T21489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 659.003081][T21489] RSP: 002b:00007f0016f7c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 659.003102][T21489] RAX: ffffffffffffffda RBX: 00007f0016415fa0 RCX: 00007f001619cdd9 [ 659.003115][T21489] RDX: 0000000000000022 RSI: 0000200000000100 RDI: 000000000000000a [ 659.003126][T21489] RBP: 00007f0016f7c090 R08: 0000000000000000 R09: 0000000000000000 [ 659.003137][T21489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 659.003148][T21489] R13: 00007f0016416038 R14: 00007f0016415fa0 R15: 00007ffc9a811d48 [ 659.003178][T21489] [ 659.405030][T21501] batman_adv: batadv0: Adding interface: ipvlan2 [ 659.412307][T21501] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 659.441725][T21501] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 659.454805][T21501] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 659.465887][T21501] batman_adv: batadv0: Interface activated: ipvlan2 [ 659.692730][T21509] netlink: 'syz.3.3888': attribute type 1 has an invalid length. [ 659.702516][T21509] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3888'. [ 659.716359][T21509] netlink: 658 bytes leftover after parsing attributes in process `syz.3.3888'. [ 659.734380][T21509] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3888'. [ 659.857801][T21515] hsr0: entered promiscuous mode [ 659.887821][T21513] hsr0: left promiscuous mode [ 660.007666][T21518] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3891'. [ 660.020387][T21518] netem: change failed [ 661.065170][T21542] lo speed is unknown, defaulting to 1000 [ 662.181737][T21576] syzkaller0: entered promiscuous mode [ 662.197633][T21576] syzkaller0: entered allmulticast mode [ 662.224981][T21576] tipc: Started in network mode [ 662.237530][T21576] tipc: Node identity 86c0adba2759, cluster identity 4711 [ 662.260342][T21576] tipc: Enabled bearer , priority 0 [ 662.546562][T21575] tipc: Resetting bearer [ 662.816609][T21575] tipc: Disabling bearer [ 663.092148][T21605] sctp: [Deprecated]: syz.4.3903 (pid 21605) Use of int in maxseg socket option. [ 663.092148][T21605] Use struct sctp_assoc_value instead [ 663.547183][T21617] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3905'. [ 668.577227][T21653] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3911'. [ 668.588224][T21653] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3911'. [ 668.701648][T21657] netlink: 'syz.3.3914': attribute type 1 has an invalid length. [ 668.709629][T21657] netlink: 'syz.3.3914': attribute type 2 has an invalid length. [ 668.746888][T21657] netlink: 'syz.3.3914': attribute type 1 has an invalid length. [ 668.756493][T21657] netlink: 'syz.3.3914': attribute type 3 has an invalid length. [ 668.772465][T21657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3914'. [ 668.835236][T21659] syzkaller1: entered promiscuous mode [ 668.861517][T21659] syzkaller1: entered allmulticast mode [ 668.906822][T21666] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3917'. [ 669.116167][T21666] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3917'. [ 669.287160][T21684] netlink: 'syz.0.3921': attribute type 11 has an invalid length. [ 669.295039][T21684] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.3921'. [ 669.483165][T21684] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3921'. [ 669.620036][T21684] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 669.627781][T21700] netlink: 'syz.4.3923': attribute type 21 has an invalid length. [ 669.638312][T21701] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3924'. [ 669.639960][T21684] bond0 (unregistering): Released all slaves [ 669.658636][T21700] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3923'. [ 669.743681][T21705] netlink: 'syz.3.3925': attribute type 8 has an invalid length. [ 669.751463][T21705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3925'. [ 669.778582][T21705] netlink: 'syz.3.3925': attribute type 8 has an invalid length. [ 669.975382][T21713] netlink: 'syz.2.3928': attribute type 4 has an invalid length. [ 669.981511][T21711] netlink: 'syz.4.3927': attribute type 1 has an invalid length. [ 670.344223][T21729] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 670.502844][T21737] netlink: 'syz.3.3936': attribute type 1 has an invalid length. [ 670.639350][ T5638] Bluetooth: hci4: command 0x0406 tx timeout [ 670.858260][T21733] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.991347][T21739] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 671.031729][T21739] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 671.082756][T21743] bond5: (slave bridge2): Enslaving as an active interface with a down link [ 671.097554][T21745] 8021q: adding VLAN 0 to HW filter on device bond5 [ 671.183390][T21733] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 671.664186][T21733] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 671.826632][ T8854] hsr0: entered promiscuous mode [ 671.927046][T21733] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 671.940753][T21773] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 672.088677][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880a041ec00: rx timeout, send abort [ 672.116727][T21782] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 672.528368][T21792] NCSI netlink: No device for ifindex 813332851 [ 672.536357][T21792] syzkaller1: entered promiscuous mode [ 672.541970][T21792] syzkaller1: entered allmulticast mode [ 672.686309][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880a041ec00: abort rx timeout. Force session deactivation [ 673.237020][ T7509] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 673.297353][T21814] block nbd4: not configured, cannot reconfigure [ 673.347996][ T7840] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 673.358034][ T7840] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 673.410885][ T7509] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 673.466265][T21805] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 673.620010][T21826] syzkaller0: entered promiscuous mode [ 673.630391][T21826] syzkaller0: entered allmulticast mode [ 673.814502][T21831] __nla_validate_parse: 13 callbacks suppressed [ 673.814520][T21831] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3965'. [ 674.297559][T21847] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3969'. [ 674.375610][T21832] bridge0: port 2(bridge_slave_1) entered disabled state [ 674.383270][T21832] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.399184][T21853] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3966'. [ 674.911860][T21832] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 674.932745][T21832] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 675.253782][T21836] vlan2: entered promiscuous mode [ 675.259357][T21836] dummy0: entered promiscuous mode [ 675.277782][ T7514] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.289280][ T7514] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.297725][ T7514] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.365906][ T7514] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.484674][T21868] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3973'. [ 675.531579][T21872] IPVS: length: 151 != 8 [ 676.007696][T21898] netlink: 456 bytes leftover after parsing attributes in process `syz.1.3981'. [ 676.020372][T21898] validate_nla: 4 callbacks suppressed [ 676.020387][T21898] netlink: 'syz.1.3981': attribute type 6 has an invalid length. [ 676.033567][T21898] netlink: 3936 bytes leftover after parsing attributes in process `syz.1.3981'. [ 676.042725][T21898] netlink: 'syz.1.3981': attribute type 1 has an invalid length. [ 676.050484][T21898] block nbd2: Unsupported socket: should be TCP or UNIX. [ 676.230622][T21901] netlink: 'syz.1.3982': attribute type 1 has an invalid length. [ 676.667491][T21918] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 676.689071][T21922] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 676.967117][T21933] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3990'. [ 677.024914][T21933] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3990'. [ 677.210434][T21950] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 678.428997][T21996] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 678.909079][T22013] lo speed is unknown, defaulting to 1000 [ 679.048452][T22021] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 679.060306][T22016] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4007'. [ 679.285608][T22026] : renamed from wg2 [ 679.303506][T22026] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4010'. [ 679.481474][T22029] netlink: 'syz.0.4011': attribute type 27 has an invalid length. [ 679.664764][T22035] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4014'. [ 681.732006][T22083] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4024'. [ 681.796828][T22083] veth1_to_team: entered promiscuous mode [ 681.804014][T22083] gretap0: entered promiscuous mode [ 681.811121][T22083] debugfs: 'hsr1' already exists in 'hsr' [ 681.817248][T22083] Cannot create hsr debugfs directory [ 681.823449][T22083] hsr1: entered promiscuous mode [ 681.837643][T22088] tipc: Enabling of bearer rejected, failed to enable media [ 682.425546][T22101] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4026'. [ 682.448449][T22101] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4026'. [ 682.670948][T22111] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4027'. [ 682.698111][T22109] syzkaller0: entered promiscuous mode [ 682.704791][T22109] syzkaller0: entered allmulticast mode [ 683.049797][T22127] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4035'. [ 683.068193][T22127] macvtap1: entered promiscuous mode [ 683.073633][T22127] bridge0: entered promiscuous mode [ 683.103970][T22127] macvtap1: entered allmulticast mode [ 683.109423][T22127] bridge0: entered allmulticast mode [ 683.149392][T22127] bridge0: left allmulticast mode [ 683.161750][T22127] macvtap1: left promiscuous mode [ 683.166946][T22127] macvtap1: left allmulticast mode [ 683.182369][ T5358] bridge0: left promiscuous mode [ 683.342525][T22135] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 683.391281][T22135] syzkaller0: entered promiscuous mode [ 683.396806][T22135] syzkaller0: entered allmulticast mode [ 683.423486][T17892] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 683.455607][T22135] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.468201][T22141] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4039'. [ 683.489819][T22135] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 683.537147][T22136] netdevsim netdevsim0: Direct firmware load for . failed with error -2 [ 683.572101][T22136] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 683.683965][T22143] netlink: 9 bytes leftover after parsing attributes in process `syz.2.4040'. [ 683.729904][T22143] gretap0: entered promiscuous mode [ 683.952281][T22151] lo speed is unknown, defaulting to 1000 [ 684.447780][T22143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 684.775035][T22174] netlink: 'syz.2.4046': attribute type 30 has an invalid length. [ 684.823595][T22174] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4046'. [ 684.879741][T22186] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 684.944712][T22174] bond4: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 685.041959][T22174] bond4 (unregistering): Released all slaves [ 685.461843][T22220] syzkaller0: entered promiscuous mode [ 685.481593][T22220] syzkaller0: entered allmulticast mode [ 685.607446][T22220] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4061'. [ 685.938392][T22241] hsr0: entered promiscuous mode [ 685.955007][T22241] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4067'. [ 685.988997][T22241] hsr_slave_0: left promiscuous mode [ 686.000464][T22241] hsr_slave_1: left promiscuous mode [ 686.013277][T22241] hsr0 (unregistering): left promiscuous mode [ 686.155541][T22249] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4070'. [ 686.182223][T22253] netlink: 'syz.1.4072': attribute type 1 has an invalid length. [ 686.239075][T22253] 8021q: adding VLAN 0 to HW filter on device bond3 [ 686.315442][T22250] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4071'. [ 686.353461][T22253] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4072'. [ 686.361708][T22250] netlink: 'syz.3.4071': attribute type 1 has an invalid length. [ 686.383060][T22250] netlink: 'syz.3.4071': attribute type 4 has an invalid length. [ 686.391193][T22253] bond3: entered promiscuous mode [ 686.410878][T22253] bond3: entered allmulticast mode [ 686.426505][T22261] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4070'. [ 686.650646][T22269] netem: invalid attributes len -1 [ 686.655819][T22269] netem: change failed [ 686.997012][T22254] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 687.054370][T22254] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 687.245605][T22254] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 687.251569][T22254] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 687.306962][T22254] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 687.314054][T22254] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 687.337581][T22254] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 687.343567][T22254] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 687.359469][T22254] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 687.365437][T22254] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 687.681256][T22327] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4084'. [ 687.691703][T22327] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4084'. [ 687.700620][T22327] netlink: 'syz.3.4084': attribute type 15 has an invalid length. [ 688.265704][T22329] dummy0: Caught tx_queue_len zero misconfig [ 688.310634][T22327] bond0: (slave wlan0): Error: Device is in use and cannot be enslaved [ 688.744404][T22364] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4094'. [ 688.913358][T22369] gretap0: left promiscuous mode [ 688.927582][T22369] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 689.122437][T22377] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 689.842549][T22412] xt_hashlimit: max too large, truncated to 1048576 [ 689.857160][T22414] netlink: 'syz.1.4112': attribute type 1 has an invalid length. [ 689.898827][T22414] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4112'. [ 689.942958][T22415] lo speed is unknown, defaulting to 1000 [ 690.778628][T22450] netlink: 'syz.0.4122': attribute type 2 has an invalid length. [ 690.789880][T22450] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4122'. [ 690.805823][T22450] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4122'. [ 690.828341][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 690.839956][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 690.880801][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 690.896154][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 690.905156][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 690.922194][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 690.955045][T22453] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4123'. [ 691.111213][T22453] bridge0: port 3(team0) entered disabled state [ 691.117699][T22453] bridge0: port 2(bridge_slave_1) entered disabled state [ 691.194762][T22453] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 691.207633][T22453] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 691.286058][T22453] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 691.363124][ T7848] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.395020][ T7848] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.405155][ T7848] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.410625][T22474] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 691.414936][ T7848] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.743508][T22495] netlink: 'syz.4.4136': attribute type 1 has an invalid length. [ 691.843110][T22495] bond8: entered promiscuous mode [ 691.849885][T22495] 8021q: adding VLAN 0 to HW filter on device bond8 [ 691.870156][T22506] ipvlan0: entered allmulticast mode [ 691.875512][T22506] bond8: entered allmulticast mode [ 691.907408][T22500] lo speed is unknown, defaulting to 1000 [ 691.973541][T22495] bond8: (slave bridge5): making interface the new active one [ 691.981072][T22495] bridge5: entered promiscuous mode [ 691.986513][T22495] bridge5: entered allmulticast mode [ 691.994034][T22495] bond8: (slave bridge5): Enslaving as an active interface with an up link [ 692.016592][T22494] sysfs: cannot create duplicate filename '/class/ieee80211/!' [ 692.024735][T22494] CPU: 1 UID: 0 PID: 22494 Comm: syz.3.4133 Not tainted syzkaller #0 PREEMPT(full) [ 692.024774][T22494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 692.024788][T22494] Call Trace: [ 692.024797][T22494] [ 692.024808][T22494] dump_stack_lvl+0xe8/0x150 [ 692.024841][T22494] sysfs_warn_dup+0x8e/0xa0 [ 692.024961][T22494] sysfs_do_create_link_sd+0xc0/0x110 [ 692.024989][T22494] device_add_class_symlinks+0x1cf/0x240 [ 692.025150][T22494] device_add+0x475/0xbb0 [ 692.025180][T22494] wiphy_register+0x1fb1/0x2fe0 [ 692.025286][T22494] ? __pfx_wiphy_register+0x10/0x10 [ 692.025308][T22494] ? __pfx_netdev_run_todo+0x10/0x10 [ 692.025333][T22494] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 692.025435][T22494] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 692.025513][T22494] ieee80211_register_hw+0x3c53/0x4910 [ 692.025551][T22494] ? ieee80211_register_hw+0x18c1/0x4910 [ 692.025607][T22494] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 692.025636][T22494] ? __asan_memset+0x22/0x50 [ 692.025660][T22494] ? __hrtimer_setup+0x1b7/0x260 [ 692.025758][T22494] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 692.025869][T22494] mac80211_hwsim_new_radio+0x3327/0x57e0 [ 692.025929][T22494] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 692.025956][T22494] ? kstrndup+0xbf/0x160 [ 692.026047][T22494] hwsim_new_radio_nl+0xe20/0x26e0 [ 692.026072][T22494] ? unwind_next_frame+0xa6/0x2550 [ 692.026116][T22494] ? is_bpf_text_address+0x26/0x2b0 [ 692.026149][T22494] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 692.026176][T22494] ? __kernel_text_address+0xd/0x30 [ 692.026278][T22494] ? unwind_get_return_address+0x4d/0x90 [ 692.026303][T22494] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 692.026335][T22494] ? arch_stack_walk+0xfb/0x150 [ 692.026449][T22494] ? stack_trace_save+0xa9/0x100 [ 692.026480][T22494] ? __pfx_stack_trace_save+0x10/0x10 [ 692.026513][T22494] ? stack_depot_save_flags+0x33/0x810 [ 692.026540][T22494] ? unwind_next_frame+0xa6/0x2550 [ 692.026579][T22494] ? __nla_validate_parse+0x2480/0x2dc0 [ 692.026608][T22494] ? ____sys_sendmsg+0x972/0x9f0 [ 692.026638][T22494] ? ___sys_sendmsg+0x2a5/0x360 [ 692.026688][T22494] ? __pfx___nla_validate_parse+0x10/0x10 [ 692.026740][T22494] ? rcu_is_watching+0x15/0xb0 [ 692.026776][T22494] ? trace_kmalloc+0x2a/0xf0 [ 692.026812][T22494] ? __nla_parse+0x40/0x60 [ 692.026849][T22494] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 692.026905][T22494] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 692.026940][T22494] genl_family_rcv_msg_doit+0x22a/0x330 [ 692.026975][T22494] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 692.027014][T22494] ? bpf_lsm_capable+0x9/0x20 [ 692.027061][T22494] ? security_capable+0x7e/0x2c0 [ 692.027155][T22494] genl_rcv_msg+0x61c/0x7a0 [ 692.027188][T22494] ? __pfx_genl_rcv_msg+0x10/0x10 [ 692.027208][T22494] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 692.027251][T22494] netlink_rcv_skb+0x232/0x4b0 [ 692.027284][T22494] ? __pfx_genl_rcv_msg+0x10/0x10 [ 692.027307][T22494] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 692.027355][T22494] ? down_read+0x270/0x2e0 [ 692.027376][T22494] ? genl_rcv+0xd/0x40 [ 692.027401][T22494] genl_rcv+0x28/0x40 [ 692.027422][T22494] netlink_unicast+0x75c/0x8e0 [ 692.027461][T22494] netlink_sendmsg+0x813/0xb40 [ 692.027501][T22494] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.027535][T22494] ? aa_sock_msg_perm+0xf1/0x1b0 [ 692.027564][T22494] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 692.027592][T22494] ____sys_sendmsg+0x972/0x9f0 [ 692.027623][T22494] ? __might_fault+0xaf/0x130 [ 692.027658][T22494] ? __pfx_____sys_sendmsg+0x10/0x10 [ 692.027701][T22494] ? import_iovec+0x73/0xa0 [ 692.027737][T22494] ___sys_sendmsg+0x2a5/0x360 [ 692.027779][T22494] ? __lock_acquire+0x6b5/0x2cf0 [ 692.027810][T22494] ? __pfx____sys_sendmsg+0x10/0x10 [ 692.027850][T22494] ? futex_wait+0x2a2/0x390 [ 692.027977][T22494] ? __fget_files+0x2a/0x420 [ 692.028004][T22494] ? __fget_files+0x3a0/0x420 [ 692.028047][T22494] __x64_sys_sendmsg+0x1bd/0x2a0 [ 692.028083][T22494] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 692.028125][T22494] ? rcu_is_watching+0x15/0xb0 [ 692.028157][T22494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.028181][T22494] do_syscall_64+0x15f/0xf80 [ 692.028203][T22494] ? trace_irq_disable+0x3b/0x140 [ 692.028234][T22494] ? clear_bhb_loop+0x40/0x90 [ 692.028261][T22494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.028283][T22494] RIP: 0033:0x7f001619cdd9 [ 692.028305][T22494] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.028352][T22494] RSP: 002b:00007f0016f7c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 692.028378][T22494] RAX: ffffffffffffffda RBX: 00007f0016415fa0 RCX: 00007f001619cdd9 [ 692.028394][T22494] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000004 [ 692.028408][T22494] RBP: 00007f0016232d69 R08: 0000000000000000 R09: 0000000000000000 [ 692.028422][T22494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 692.028434][T22494] R13: 00007f0016416038 R14: 00007f0016415fa0 R15: 00007ffc9a811d48 [ 692.028467][T22494] [ 692.846042][T22509] netlink: 'syz.1.4135': attribute type 4 has an invalid length. [ 692.944008][T22520] tipc: Started in network mode [ 692.957547][T22520] tipc: Node identity 9670f427c1a7, cluster identity 4711 [ 692.976492][T22520] tipc: Enabled bearer , priority 0 [ 693.000007][T22525] syzkaller0: entered promiscuous mode [ 693.008290][T22525] syzkaller0: entered allmulticast mode [ 693.036428][T22527] xt_hashlimit: max too large, truncated to 1048576 [ 693.063964][T22527] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 693.187318][T22518] tipc: Resetting bearer [ 693.289095][T22518] lo speed is unknown, defaulting to 1000 [ 693.540493][T22544] sctp: [Deprecated]: syz.3.4149 (pid 22544) Use of struct sctp_assoc_value in delayed_ack socket option. [ 693.540493][T22544] Use struct sctp_sack_info instead [ 693.582004][T22544] sctp: [Deprecated]: syz.3.4149 (pid 22544) Use of struct sctp_assoc_value in delayed_ack socket option. [ 693.582004][T22544] Use struct sctp_sack_info instead [ 693.667397][T22544] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 693.759680][T22515] tipc: Resetting bearer [ 693.841445][T22515] tipc: Disabling bearer [ 694.188549][T22575] netlink: 'syz.1.4154': attribute type 2 has an invalid length. [ 694.196822][T22572] netlink: 'syz.1.4154': attribute type 2 has an invalid length. [ 694.578105][T22561] nbd2: detected capacity change from 0 to 63 [ 694.596697][T17892] block nbd2: Receive control failed (result -32) [ 694.604034][ T5638] block nbd2: Receive control failed (result -32) [ 694.642723][T21696] block nbd2: Dead connection, failed to find a fallback [ 694.653158][T21696] block nbd2: shutting down sockets [ 694.663888][T21696] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 694.678027][T21696] Buffer I/O error on dev nbd2, logical block 0, async page read [ 694.688990][ T7841] unregister_netdevice: waiting for bond7 to become free. Usage count = 2 [ 694.692121][T21696] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 694.707859][T21696] Buffer I/O error on dev nbd2, logical block 1, async page read [ 694.716714][T21696] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 694.726679][T21696] Buffer I/O error on dev nbd2, logical block 2, async page read [ 694.736052][T21696] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 694.746541][T21696] Buffer I/O error on dev nbd2, logical block 3, async page read [ 694.755535][T21696] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 694.765781][T21696] Buffer I/O error on dev nbd2, logical block 0, async page read [ 694.775137][T21696] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 694.785752][T22584] [ 694.788108][T22584] ====================================================== [ 694.795144][T22584] WARNING: possible circular locking dependency detected [ 694.802297][T22584] syzkaller #0 Not tainted [ 694.806720][T22584] ------------------------------------------------------ [ 694.813733][T22584] syz.3.4158/22584 is trying to acquire lock: [ 694.819788][T22584] ffffffff8ea85520 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_node_track_caller_noprof+0x9d/0x7b0 [ 694.830175][T22584] [ 694.830175][T22584] but task is already holding lock: [ 694.837529][T22584] ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x830 [ 694.847171][T22584] [ 694.847171][T22584] which lock already depends on the new lock. [ 694.847171][T22584] [ 694.857580][T22584] [ 694.857580][T22584] the existing dependency chain (in reverse order) is: [ 694.866596][T22584] [ 694.866596][T22584] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 694.874742][T22584] down_write+0x96/0x200 [ 694.879542][T22584] kernfs_add_one+0x41/0x5c0 [ 694.884651][T22584] kernfs_create_dir_ns+0xde/0x130 [ 694.890281][T22584] internal_create_group+0x425/0x1180 [ 694.896173][T22584] cpuhp_invoke_callback+0x445/0x860 [ 694.901989][T22584] cpuhp_issue_call+0x430/0x7a0 [ 694.907355][T22584] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 694.913938][T22584] __cpuhp_setup_state+0x3f/0x60 [ 694.919394][T22584] do_one_initcall+0x250/0x870 [ 694.924692][T22584] do_initcall_level+0x104/0x190 [ 694.930335][T22584] do_initcalls+0x59/0xa0 [ 694.935199][T22584] kernel_init_freeable+0x2a6/0x3e0 [ 694.940946][T22584] kernel_init+0x1d/0x1d0 [ 694.945817][T22584] ret_from_fork+0x514/0xb70 [ 694.951009][T22584] ret_from_fork_asm+0x1a/0x30 [ 694.956305][T22584] [ 694.956305][T22584] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 694.964136][T22584] [ 694.964136][T22584] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 694.971877][T22584] cpus_read_lock+0x42/0x160 [ 694.977019][T22584] static_key_slow_inc+0x12/0x30 [ 694.982601][T22584] tcp_md5_do_add+0x1d4/0x390 [ 694.987905][T22584] tcp_v6_parse_md5_keys+0x562/0x680 [ 694.993797][T22584] do_tcp_setsockopt+0x12ec/0x2060 [ 694.999614][T22584] do_sock_setsockopt+0x17c/0x1b0 [ 695.005180][T22584] __x64_sys_setsockopt+0x13d/0x1b0 [ 695.010901][T22584] do_syscall_64+0x15f/0xf80 [ 695.016009][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.022422][T22584] [ 695.022422][T22584] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 695.030154][T22584] lock_sock_nested+0x41/0x100 [ 695.035441][T22584] inet_shutdown+0x6a/0x390 [ 695.040539][T22584] nbd_mark_nsock_dead+0x2e9/0x560 [ 695.046303][T22584] sock_shutdown+0x15e/0x260 [ 695.051422][T22584] nbd_clear_sock+0x24/0x170 [ 695.056528][T22584] nbd_config_put+0x2dd/0x580 [ 695.061721][T22584] nbd_genl_connect+0x19d5/0x1cf0 [ 695.067261][T22584] genl_family_rcv_msg_doit+0x22a/0x330 [ 695.073339][T22584] genl_rcv_msg+0x61c/0x7a0 [ 695.078384][T22584] netlink_rcv_skb+0x232/0x4b0 [ 695.083667][T22584] genl_rcv+0x28/0x40 [ 695.088168][T22584] netlink_unicast+0x75c/0x8e0 [ 695.093446][T22584] netlink_sendmsg+0x813/0xb40 [ 695.098735][T22584] ____sys_sendmsg+0x972/0x9f0 [ 695.104025][T22584] ___sys_sendmsg+0x2a5/0x360 [ 695.109242][T22584] __x64_sys_sendmsg+0x1bd/0x2a0 [ 695.114721][T22584] do_syscall_64+0x15f/0xf80 [ 695.119830][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.126248][T22584] [ 695.126248][T22584] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 695.133907][T22584] __mutex_lock+0x1a3/0x1550 [ 695.139021][T22584] nbd_queue_rq+0x37b/0x1100 [ 695.144207][T22584] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 695.150373][T22584] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 695.157266][T22584] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 695.163789][T22584] blk_mq_run_hw_queue+0x348/0x4f0 [ 695.169419][T22584] blk_mq_dispatch_list+0xd16/0xe10 [ 695.175155][T22584] blk_mq_flush_plug_list+0x48d/0x570 [ 695.181048][T22584] __blk_flush_plug+0x3ed/0x4d0 [ 695.186528][T22584] __submit_bio+0x28d/0x580 [ 695.191546][T22584] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 695.197700][T22584] block_read_full_folio+0x599/0x830 [ 695.203613][T22584] filemap_read_folio+0x137/0x3b0 [ 695.209199][T22584] do_read_cache_folio+0x358/0x590 [ 695.214850][T22584] read_part_sector+0xb6/0x2b0 [ 695.220192][T22584] adfspart_check_ICS+0xb1/0x960 [ 695.225648][T22584] bdev_disk_changed+0x817/0x1770 [ 695.231191][T22584] blkdev_get_whole+0x380/0x510 [ 695.236608][T22584] bdev_open+0x31e/0xd30 [ 695.241367][T22584] blkdev_open+0x470/0x610 [ 695.246296][T22584] do_dentry_open+0x785/0x14e0 [ 695.251580][T22584] vfs_open+0x3b/0x340 [ 695.256163][T22584] path_openat+0x2e08/0x3860 [ 695.261272][T22584] do_file_open+0x23e/0x4a0 [ 695.266296][T22584] do_sys_openat2+0x113/0x200 [ 695.271497][T22584] __x64_sys_openat+0x138/0x170 [ 695.276866][T22584] do_syscall_64+0x15f/0xf80 [ 695.281971][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.288387][T22584] [ 695.288387][T22584] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 695.295622][T22584] __mutex_lock+0x1a3/0x1550 [ 695.300745][T22584] nbd_queue_rq+0xc6/0x1100 [ 695.305766][T22584] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 695.311833][T22584] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 695.318696][T22584] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 695.325218][T22584] blk_mq_run_hw_queue+0x348/0x4f0 [ 695.330860][T22584] blk_mq_dispatch_list+0xd16/0xe10 [ 695.336585][T22584] blk_mq_flush_plug_list+0x48d/0x570 [ 695.342509][T22584] __blk_flush_plug+0x3ed/0x4d0 [ 695.347904][T22584] __submit_bio+0x28d/0x580 [ 695.352945][T22584] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 695.359155][T22584] block_read_full_folio+0x599/0x830 [ 695.365000][T22584] filemap_read_folio+0x137/0x3b0 [ 695.370542][T22584] do_read_cache_folio+0x358/0x590 [ 695.376175][T22584] read_part_sector+0xb6/0x2b0 [ 695.381461][T22584] adfspart_check_ICS+0xb1/0x960 [ 695.386920][T22584] bdev_disk_changed+0x817/0x1770 [ 695.392465][T22584] blkdev_get_whole+0x380/0x510 [ 695.397841][T22584] bdev_open+0x31e/0xd30 [ 695.402671][T22584] blkdev_open+0x470/0x610 [ 695.407600][T22584] do_dentry_open+0x785/0x14e0 [ 695.412876][T22584] vfs_open+0x3b/0x340 [ 695.417454][T22584] path_openat+0x2e08/0x3860 [ 695.422564][T22584] do_file_open+0x23e/0x4a0 [ 695.427583][T22584] do_sys_openat2+0x113/0x200 [ 695.432775][T22584] __x64_sys_openat+0x138/0x170 [ 695.438143][T22584] do_syscall_64+0x15f/0xf80 [ 695.443245][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.449661][T22584] [ 695.449661][T22584] -> #3 (set->srcu){.+.+}-{0:0}: [ 695.456781][T22584] __synchronize_srcu+0xca/0x300 [ 695.462240][T22584] elevator_switch+0x1e8/0x7a0 [ 695.467529][T22584] elevator_change+0x2cc/0x450 [ 695.472815][T22584] elevator_set_default+0x36c/0x430 [ 695.478532][T22584] blk_register_queue+0x3e9/0x4e0 [ 695.484068][T22584] __add_disk+0x677/0xd50 [ 695.488910][T22584] add_disk_fwnode+0xfb/0x480 [ 695.494096][T22584] nbd_dev_add+0x72c/0xb50 [ 695.499026][T22584] nbd_init+0x168/0x1f0 [ 695.503839][T22584] do_one_initcall+0x250/0x870 [ 695.509122][T22584] do_initcall_level+0x104/0x190 [ 695.514575][T22584] do_initcalls+0x59/0xa0 [ 695.519423][T22584] kernel_init_freeable+0x2a6/0x3e0 [ 695.525141][T22584] kernel_init+0x1d/0x1d0 [ 695.529987][T22584] ret_from_fork+0x514/0xb70 [ 695.535090][T22584] ret_from_fork_asm+0x1a/0x30 [ 695.540371][T22584] [ 695.540371][T22584] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 695.548192][T22584] __mutex_lock+0x1a3/0x1550 [ 695.553307][T22584] elevator_change+0x1b3/0x450 [ 695.558589][T22584] elevator_set_none+0xb5/0x140 [ 695.563959][T22584] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 695.570287][T22584] nbd_start_device+0x17f/0xb10 [ 695.575674][T22584] nbd_genl_connect+0x165b/0x1cf0 [ 695.581208][T22584] genl_family_rcv_msg_doit+0x22a/0x330 [ 695.587274][T22584] genl_rcv_msg+0x61c/0x7a0 [ 695.592309][T22584] netlink_rcv_skb+0x232/0x4b0 [ 695.597608][T22584] genl_rcv+0x28/0x40 [ 695.602154][T22584] netlink_unicast+0x75c/0x8e0 [ 695.607435][T22584] netlink_sendmsg+0x813/0xb40 [ 695.612714][T22584] ____sys_sendmsg+0x972/0x9f0 [ 695.617993][T22584] ___sys_sendmsg+0x2a5/0x360 [ 695.623189][T22584] __x64_sys_sendmsg+0x1bd/0x2a0 [ 695.628645][T22584] do_syscall_64+0x15f/0xf80 [ 695.633751][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.640168][T22584] [ 695.640168][T22584] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 695.648775][T22584] blk_alloc_queue+0x546/0x680 [ 695.654062][T22584] __blk_mq_alloc_disk+0x197/0x390 [ 695.659743][T22584] nbd_dev_add+0x499/0xb50 [ 695.664677][T22584] nbd_init+0x168/0x1f0 [ 695.669344][T22584] do_one_initcall+0x250/0x870 [ 695.674626][T22584] do_initcall_level+0x104/0x190 [ 695.680086][T22584] do_initcalls+0x59/0xa0 [ 695.684945][T22584] kernel_init_freeable+0x2a6/0x3e0 [ 695.690677][T22584] kernel_init+0x1d/0x1d0 [ 695.695524][T22584] ret_from_fork+0x514/0xb70 [ 695.700629][T22584] ret_from_fork_asm+0x1a/0x30 [ 695.705907][T22584] [ 695.705907][T22584] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 695.713114][T22584] __lock_acquire+0x15a5/0x2cf0 [ 695.718481][T22584] lock_acquire+0x106/0x350 [ 695.723496][T22584] fs_reclaim_acquire+0x71/0x100 [ 695.728952][T22584] __kmalloc_node_track_caller_noprof+0x9d/0x7b0 [ 695.735799][T22584] kstrdup+0x42/0x100 [ 695.740301][T22584] kernfs_rename_ns+0x476/0x830 [ 695.745677][T22584] sysfs_rename_link_ns+0x16e/0x1b0 [ 695.751395][T22584] device_rename+0x110/0x210 [ 695.756498][T22584] cfg80211_dev_rename+0x131/0x200 [ 695.762205][T22584] nl80211_set_wiphy+0x2a5/0x2ea0 [ 695.767815][T22584] genl_family_rcv_msg_doit+0x22a/0x330 [ 695.773879][T22584] genl_rcv_msg+0x61c/0x7a0 [ 695.778896][T22584] netlink_rcv_skb+0x232/0x4b0 [ 695.784177][T22584] genl_rcv+0x28/0x40 [ 695.788766][T22584] netlink_unicast+0x75c/0x8e0 [ 695.794148][T22584] netlink_sendmsg+0x813/0xb40 [ 695.799444][T22584] ____sys_sendmsg+0x972/0x9f0 [ 695.804731][T22584] ___sys_sendmsg+0x2a5/0x360 [ 695.809930][T22584] __x64_sys_sendmsg+0x1bd/0x2a0 [ 695.815390][T22584] do_syscall_64+0x15f/0xf80 [ 695.820490][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.826897][T22584] [ 695.826897][T22584] other info that might help us debug this: [ 695.826897][T22584] [ 695.837115][T22584] Chain exists of: [ 695.837115][T22584] fs_reclaim --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 695.837115][T22584] [ 695.850307][T22584] Possible unsafe locking scenario: [ 695.850307][T22584] [ 695.857766][T22584] CPU0 CPU1 [ 695.863130][T22584] ---- ---- [ 695.868571][T22584] lock(&root->kernfs_rwsem); [ 695.873422][T22584] lock(cpuhp_state_mutex); [ 695.880547][T22584] lock(&root->kernfs_rwsem); [ 695.887932][T22584] lock(fs_reclaim); [ 695.891906][T22584] [ 695.891906][T22584] *** DEADLOCK *** [ 695.891906][T22584] [ 695.900044][T22584] 4 locks held by syz.3.4158/22584: [ 695.905231][T22584] #0: ffffffff8fe3fac8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 695.913424][T22584] #1: ffffffff8fdd0300 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_set_wiphy+0x99/0x2ea0 [ 695.922829][T22584] #2: ffff88806a7207a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: nl80211_set_wiphy+0x25b/0x2ea0 [ 695.932852][T22584] #3: ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x830 [ 695.942865][T22584] [ 695.942865][T22584] stack backtrace: [ 695.948932][T22584] CPU: 0 UID: 0 PID: 22584 Comm: syz.3.4158 Not tainted syzkaller #0 PREEMPT(full) [ 695.948953][T22584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 695.948963][T22584] Call Trace: [ 695.948972][T22584] [ 695.948982][T22584] dump_stack_lvl+0xe8/0x150 [ 695.949004][T22584] print_circular_bug+0x2e1/0x300 [ 695.949026][T22584] check_noncircular+0x12e/0x150 [ 695.949049][T22584] __lock_acquire+0x15a5/0x2cf0 [ 695.949065][T22584] ? __lock_acquire+0x6b5/0x2cf0 [ 695.949083][T22584] ? __lock_acquire+0x6b5/0x2cf0 [ 695.949098][T22584] ? irqentry_exit+0x218/0x730 [ 695.949114][T22584] ? trace_irq_disable+0x3b/0x140 [ 695.949137][T22584] ? __kmalloc_node_track_caller_noprof+0x9d/0x7b0 [ 695.949158][T22584] lock_acquire+0x106/0x350 [ 695.949173][T22584] ? __kmalloc_node_track_caller_noprof+0x9d/0x7b0 [ 695.949195][T22584] ? kernfs_root+0x1c/0x230 [ 695.949217][T22584] fs_reclaim_acquire+0x71/0x100 [ 695.949238][T22584] ? __kmalloc_node_track_caller_noprof+0x9d/0x7b0 [ 695.949258][T22584] __kmalloc_node_track_caller_noprof+0x9d/0x7b0 [ 695.949286][T22584] ? kernfs_rename_ns+0x476/0x830 [ 695.949309][T22584] kstrdup+0x42/0x100 [ 695.949323][T22584] kernfs_rename_ns+0x476/0x830 [ 695.949348][T22584] sysfs_rename_link_ns+0x16e/0x1b0 [ 695.949367][T22584] device_rename+0x110/0x210 [ 695.949388][T22584] cfg80211_dev_rename+0x131/0x200 [ 695.949412][T22584] nl80211_set_wiphy+0x2a5/0x2ea0 [ 695.949436][T22584] ? __rtnl_unlock+0xc8/0xf0 [ 695.949452][T22584] ? irqentry_exit+0x218/0x730 [ 695.949465][T22584] ? lockdep_hardirqs_on+0x7a/0x110 [ 695.949487][T22584] ? irqentry_exit+0x218/0x730 [ 695.949500][T22584] ? trace_irq_disable+0x3b/0x140 [ 695.949520][T22584] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 695.949543][T22584] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 695.949568][T22584] genl_family_rcv_msg_doit+0x22a/0x330 [ 695.949586][T22584] ? irqentry_exit+0x218/0x730 [ 695.949601][T22584] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 695.949621][T22584] ? bpf_lsm_capable+0x9/0x20 [ 695.949638][T22584] ? security_capable+0x7e/0x2c0 [ 695.949657][T22584] genl_rcv_msg+0x61c/0x7a0 [ 695.949676][T22584] ? __pfx_genl_rcv_msg+0x10/0x10 [ 695.949690][T22584] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 695.949709][T22584] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 695.949728][T22584] ? __pfx_nl80211_post_doit+0x10/0x10 [ 695.949751][T22584] netlink_rcv_skb+0x232/0x4b0 [ 695.949774][T22584] ? __pfx_genl_rcv_msg+0x10/0x10 [ 695.949789][T22584] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 695.949815][T22584] ? down_read+0x270/0x2e0 [ 695.949830][T22584] ? genl_rcv+0xd/0x40 [ 695.949844][T22584] genl_rcv+0x28/0x40 [ 695.949858][T22584] netlink_unicast+0x75c/0x8e0 [ 695.949881][T22584] netlink_sendmsg+0x813/0xb40 [ 695.949905][T22584] ? __pfx_netlink_sendmsg+0x10/0x10 [ 695.949926][T22584] ? aa_sock_msg_perm+0xf1/0x1b0 [ 695.949946][T22584] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 695.949968][T22584] ____sys_sendmsg+0x972/0x9f0 [ 695.949990][T22584] ? __might_fault+0xaf/0x130 [ 695.950010][T22584] ? __pfx_____sys_sendmsg+0x10/0x10 [ 695.950035][T22584] ? import_iovec+0x73/0xa0 [ 695.950057][T22584] ___sys_sendmsg+0x2a5/0x360 [ 695.950077][T22584] ? __lock_acquire+0x6b5/0x2cf0 [ 695.950095][T22584] ? __pfx____sys_sendmsg+0x10/0x10 [ 695.950116][T22584] ? irqentry_exit+0x218/0x730 [ 695.950140][T22584] ? __fget_files+0x2a/0x420 [ 695.950158][T22584] ? __fget_files+0x3a0/0x420 [ 695.950177][T22584] __x64_sys_sendmsg+0x1bd/0x2a0 [ 695.950201][T22584] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 695.950226][T22584] ? rcu_is_watching+0x15/0xb0 [ 695.950245][T22584] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.950268][T22584] do_syscall_64+0x15f/0xf80 [ 695.950284][T22584] ? clear_bhb_loop+0x40/0x90 [ 695.950301][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.950316][T22584] RIP: 0033:0x7f001619cdd9 [ 695.950333][T22584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.950345][T22584] RSP: 002b:00007f0016f7c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 695.950364][T22584] RAX: ffffffffffffffda RBX: 00007f0016415fa0 RCX: 00007f001619cdd9 [ 695.950374][T22584] RDX: 0000000004040000 RSI: 0000200000000040 RDI: 0000000000000003 [ 695.950384][T22584] RBP: 00007f0016232d69 R08: 0000000000000000 R09: 0000000000000000 [ 695.950394][T22584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 695.950402][T22584] R13: 00007f0016416038 R14: 00007f0016415fa0 R15: 00007ffc9a811d48 [ 695.950421][T22584] [ 696.404384][T21696] Buffer I/O error on dev nbd2, logical block 1, async page read [ 696.412889][T21696] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 696.422516][T21696] Buffer I/O error on dev nbd2, logical block 2, async page read [ 696.430956][T21696] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 696.440574][T21696] Buffer I/O error on dev nbd2, logical block 3, async page read [ 696.449136][T21696] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 696.458222][T21696] Buffer I/O error on dev nbd2, logical block 0, async page read [ 696.466863][T21696] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 696.476484][T21696] Buffer I/O error on dev nbd2, logical block 1, async page read [ 696.487236][T21696] ldm_validate_partition_table(): Disk read failed. [ 696.495964][T21696] Dev nbd2: unable to read RDB block 0 [ 696.503893][T21696] nbd2: unable to read partition table [ 696.531654][T21696] ldm_validate_partition_table(): Disk read failed. [ 696.570900][T21696] Dev nbd2: unable to read RDB block 0 [ 696.577759][T21696] nbd2: unable to read partition table [ 698.479684][ T1222] page_pool_release_retry() stalled pool shutdown: id 40, 1 inflight 544 sec