last executing test programs: 3.45309181s ago: executing program 2 (id=6926): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7}, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r4, 0x10040) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) ioctl$XFS_IOC_READLINK_BY_HANDLE(r4, 0xc038586c, &(0x7f00000003c0)={r0, &(0x7f0000000080)='\\\xb4\x00', 0x309000, &(0x7f0000000240)={@align=0x4, {0x7c, 0xa1, 0x7, 0xffffffffffffffff}}, 0x9, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000300)=0x9c4}) syz_emit_ethernet(0x42, &(0x7f0000000340)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x4, 0xca, 0x0, 0x1000, {[@timestamp={0x8, 0xa, 0x81000004, 0x56}]}}}}}}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x3, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x5}, @TCA_FQ_FLOW_MAX_RATE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0xdd86, r7, 0x15}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000200)="f3a7b9b72c617e5eb41027a91e9d5b7fdb0063f8c7aca5a07aaf5f52dd931825461946c368f9b10b", 0x28}], 0x1}, 0x44) 2.68264116s ago: executing program 3 (id=6934): r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x2, @empty}}]}, 0x50}}, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010003b1500000084fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800900010076321c663e0f2ec265746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="0100000001000000"], 0x48}}, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'veth0_to_bridge\x00', 0xe23}) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, 0x0}, 0x30004040) syz_emit_ethernet(0x79, &(0x7f00000004c0)={@link_local, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x6b, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0xfffd]}, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x800, [0x3]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "57a197f243aa2abb5f831e11b1"}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5}}}}}}}}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) close(r0) 2.310898827s ago: executing program 4 (id=6937): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000000)='GPL\x00', 0x201, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.279536023s ago: executing program 2 (id=6938): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r1, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008810}, 0x80) (async) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r4) sendmsg$NL80211_CMD_STOP_AP(r0, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, r5, 0x20, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x2b}}}}, ["", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x8004}, 0x20000841) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x24, r6, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000) (async) connect$pptp(r3, &(0x7f0000000080)={0x18, 0x2, {0x0, @private=0xa010102}}, 0x1e) (async) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x24, r10, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x828}, 0x0) (async) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r4) (async) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000340)=0x1) (async) ioctl$PPPIOCSFLAGS1(r8, 0x40047459, &(0x7f00000001c0)=0x4140) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="14f000000e00"/20], 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x0) 2.256367477s ago: executing program 3 (id=6939): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000080)=0x400808) socket$inet_sctp(0x2, 0x5, 0x84) pwritev(r0, &(0x7f0000000280)=[{&(0x7f0000000100)="1ea75b04f7f48bc4d33996768fa36a946a48d81430e9f0f79cd6cdc12c2a5f397a2571721996486ce58201ca5ba29650c5dbd1501736bab0cde7babeccf48dbfdbada31513d078ecd09dfb89b85437a0db8576ccfca5e9da327a7cd136b38f58a90882255d8aa52c4b3d227be8c05a5c2e9e69f0958e7d3b310812bcdf2b0f6cce859a0d972c553bed840ea77d3eb62b03866474260d9b36405bffbffbde3eb39f7f8e54274dbb10ae71d2a7586860fe7ad876b0c5e955ba0a9ab784b110b73669706374420db5cc5b119229f66792da1e6f7f58696e4e22977cb7", 0xdb}, {&(0x7f0000000240)="33553359f34584fd7ab095df373b52454a5ee9ff7d8950fb69353237393f5818bd54adc41ef3ec02aa4aaa6848b53d897f1721", 0x33}], 0x2, 0x10001, 0xff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x28, 0x3, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0x4) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)) close(0x3) 2.148249484s ago: executing program 4 (id=6941): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000080)={0xe, 0x1000, 0x4, 0xb, 0x3, 0x81}) r2 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x68, &(0x7f0000005a40)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x32, 0x3a, 0x1, @rand_addr=' \x01\x00', @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "a3579e", 0x0, 0x73, 0x0, @mcast2, @private2, [], "6be2"}}}}}}}, 0x0) r3 = socket$inet(0x2, 0x800, 0x6a3a) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000001c0)={r0, 0x7, 0x6, 0x2e}) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000100)={'caif0\x00', {0x2, 0x0, @loopback}}) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x6, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r6, 0x0) setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f00000000c0)={@multicast1=0xe0000300, @dev={0xac, 0x14, 0x14, 0x17}}, 0x8) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@can_delroute={0x24, 0x19, 0x103, 0x70bd2d, 0x25dfdbff, {0x1d, 0x1, 0x2}, [@CGW_SRC_IF={0x8, 0x9, r7}, @CGW_DST_IF={0x8, 0xa, r7}]}, 0x24}}, 0x4040000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3b, 0x301, 0x270bd24, 0x25dfdbfa, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0xc048) syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r8) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00e\x00\a', @ANYRES16=r0], 0x20}}, 0x0) 2.08434061s ago: executing program 2 (id=6942): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1410, 0x301, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000500)=ANY=[], 0x32600) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000c, 0x12, r1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000001280)=0x10) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) pipe(&(0x7f0000000040)) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$phonet(0x23, 0x2, 0x1) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r4, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c0000000000080012000000000008001f00000000006c000a80140007"], 0x134}}, 0x0) 1.965087272s ago: executing program 3 (id=6944): r0 = socket$inet6(0xa, 0x2, 0xfffffffc) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000100), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r3}, &(0x7f0000000000), &(0x7f0000000040)=r4}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r4, r2}, 0x14) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@remote, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x9, @multicast, @rand_addr=0x64010101, @local, @multicast2}}}}, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 1.929674128s ago: executing program 4 (id=6945): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x2}) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000100)={@val={0x0, 0x15}, @void, @eth={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @val={@val={0x88a8, 0x0, 0x0, 0x2}, {0x8100, 0x0, 0x0, 0x20}}, {@generic={0x60, "19d9"}}}}, 0x1c) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0x82, &(0x7f0000000180)={0x2}, &(0x7f0000000280)=0x20) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000080009000200000008000b"], 0x24}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010400000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) 1.830692443s ago: executing program 2 (id=6946): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x100000) ioctl$XFS_IOC_ERROR_CLEARALL(r0, 0x40085875) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="a00000001a0010002abd700000dcdf251c001003fd03fe878003009603a61f3adc01ba0000000000000000000000000000000000000000000000000000000000000000001d224dbe0000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000f08000000000000000000000001000000000000000000e6f8edbc35ed4f208197fa8b9837bee31dc1a801ce9a300aa06f3974049285cefee81bbdc5d1da3bb8c6a78d9df0369099a8858d5c6c77548150472666d8407a0971a06bee365daeb62ef8b1f989fe5e47540384e366088a71373e775dc0e4881facece0b7a8efb7383566149fbe5aa7b769e4969dbf22ca6ba742d388edf17a74deb5e049d22ae1eecd4678673c50a3da481d3d142ffe8d6fae8308b1f451a4dd08fa2ed1077c52cbd4122fcc5fc2baaee46e873ded5c4fa2d4f94aa06916d34b15"], 0xa0}, 0x1, 0x0, 0x0, 0x2000c081}, 0x20000000) pipe(&(0x7f0000000040)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x1e, 0x4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r3) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r3) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = socket(0x28, 0x2, 0x8) write(r4, &(0x7f0000000280)="2c0000001d005f800040000000000000050000000000000000000800", 0x1c) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x80000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x2, 0x0) (async) r6 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@getchain={0x24, 0x66, 0x200, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xfff2}, {0xfff1, 0x1001e}, {0x2, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) (async) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@getchain={0x24, 0x66, 0x200, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xfff2}, {0xfff1, 0x1001e}, {0x2, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) socket(0x1e, 0x4, 0x0) (async) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r8, 0x10f, 0x88) socket(0x10, 0x803, 0x0) (async) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r11, &(0x7f00000003c0)={@val={0x1c}, @val={0x0, 0x5, 0x0, 0x300}, @ipv6=@udp={0x0, 0x6, '\'\vB', 0x18, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @local}, {[], {0x0, 0x0, 0x18, 0x0, @wg=@data}}}}, 0x4e) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) 1.666305223s ago: executing program 3 (id=6950): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum={0x5}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x2b, 0x0, 0x1}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x6, 0x4, 0x3a7, 0x1, 0xffffffffffffffff, 0x2, '\x00', 0x0, r0, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0x22, 0x0, &(0x7f00000006c0)="f6f4e9a1d78ad62ceef1884366a578bb3fb7dbfc", 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="0102", 0x0}, 0x50) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x88581, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r6 = socket(0x400000000010, 0x3, 0x0) connect(r6, &(0x7f0000000380)=@vsock={0x28, 0x0, 0x0, @local}, 0x80) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$kcm(0x29, 0x6, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000540)={'ip6_vti0\x00', &(0x7f00000004c0)={'syztnl1\x00', r5, 0x2f, 0x3, 0x5, 0x10000000, 0xa, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, 0x20, 0x40, 0x9, 0xfffff844}}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xb, 0xe, &(0x7f0000003fc0)=ANY=[@ANYBLOB="b702000000010080bfa300000000000007020000fffeff7f7a03f0fff8ffffff79a4f0ff00000000b7060000d0b68af1de640300000000007502faff07cd10020404000003007d60b70700000d1000006a0a00fe000000188500000008000000b70000000604002995000000000000001da5ad3548ebb63d18db6a1c72821c9b767ac8328fbcd5c5e4a5ad1059b5725ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1aa503b8de7ab9a780001000000000000d4bf20c2bd152d814f01f2cd539e030b0000000000007f4133b08e6e497640000000aea5cac0ceafdb9a2eeb02a1f5104d16ddb64963d84d91004cd5817e0b7f005e6ee7a39e2f0b5a18ed786b783ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a62d79b4c03e53466fa4f22d8c19f958e8b34de3535e7dacf1b13f7e875d1843c2288e7ff949a7a48ce18799ee53de177a81ea67a8f84538a9a311c754e5ab59a43f56d2085786e7ec07d78917f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d34a442bc098f4fcc96623b7c373b0ef04d55b846b094b0d6c7a75a76d445e0dcdf72c7ef97e08200000007b6e09a6a7caffff0000141f65e7d9ebe3be70c4364333af9a9d91c3e41ac37a63f85ad8254479c12f7c84fa5df32b70a80cce69cf30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48eb19767e00b75041739952fe87fde27ce0172f497e251f5b102893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7686bc2e1b45577c205c70631e8ad585951950e851250540593e61860b69a521f4e210b6494e3ab2d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7f58bde38b44ab13d980c894e00009338923789a1edcd8043fe83919088383268324a25df14010c8ea79c0d93ca77fd6c7ee30ea3aad2c6d6b8c97c00eaa00ff9bc46e1cfecbdc0e4ffac53e8f76c8b556306b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404a0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37d2fe7a60b903d2d9fe9c151c2fcc8dc389671c2d08b6e2641500568445b00cee4585af04fa69e0380be0d66649dcf3bf8a9066e5961197332c5c9da52b573109ea8b308ff070000aab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628ebe757bae30b356521df06f995cb57f97052fc4158250ccecfb47ea8faf509593fadc76e5d3c6840ad05a57af1ede94d87590ce90a0a7579766f847ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6c9eb0dcca5303eed6689ea910900785f61278dde47e6672e93a314a5f60e7b682bf0cacde21f6090f4fb311afd7f8b48f3f0d8c66449d8687dcf2d0f76668b2b9bf8b32b518e01ffb985f8054d37959c529e99b7daf32acfed749d516d014cef5f98126324e202badc1e5c20d69e576a770000000000005addc0103756b894418e4591c624a9b2ccabbfb85ad413d923b0c901973cd7c9d197d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe84f483b15f45b9a1d3af087047c568aef1d8659c6146a793026ebfc0bb5ec10b6290dc757a4903a88fb2c035f9349b6d2f0c051b8b775152786118a1020000fc19928ccb713ff09e179c308fbe9bc543dcf43f731074d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad10e5e9d26631c2f1db3a2882f6e130a79517a88de7596429a20793e12616aa32b3e720c6521fbe933321adde8ca7dd99c0a0125ff8c18119a6926083f4a2c008a9f2a29e30823bf0ec3639cadaf9be9605a504bca38627df469cebb7db08358e1e5ab17eea477b1754f78f45468c9568471647f8bc03d11811ac6eec1741ceb39a3ecd043c325fcabbab3d12f6a759f7ce11dafa387a8077db8a2230d2014a57bc8dd47741270000008000000000b2eebd5e1626cab98499328ff024a240199993433ceb5be20427a32df7047d63010dfc6a461517ad48ff64042e84c85c899fd11c6320a8d8fc0e78c15a5a4dd567f91dd943f6c2b32d094a461a990000000000000000000000000000000000000000000200000000000000000000b385c644a4a170e6dc9e9e546bfa049d025b319abd87fd85481743db5d6c2cb6a204d4d888dd4140c8edb598a36e21ad132bf6b88c99c5a5ed047d6589c10a5f6633b01813fc5cd7d048469a966bbfb300fd772cbadf2cf26899bfd15e7d9408026a92f13f11d1c9832259b2f97227f84a3bb96253717a1f7ac091d0f4632f638b09a0307ff31729857f9e6fe9f19e481a3f77cead663f42456e080952636515c758f1047b2148944133a492ef20a1778088c42094903d6ece2497b99fc745c420b035ff7961484a0f62a2d957ae2e47ff1ea8a059f2d03bf9c3e8d2b16ab409de762522f6008de48bb70b698c5c9867437ac3127fad4bd699acaad78a5f66c7fc7d46e048082a0af61e6b052e473ed26b0309080ea10e985703b292c7336112b1f35c3b069363869dce725d8da75dcec76dcfa0c052feecee18c64c4600a0bc3d4945d4b918865bb7a8a726a500689cbd9a84d07846417796f2a85e7a41d27d64b10f8e970469cf495b4a1b4ea8b5322f78e9f3048351b550c59a634b47981420081ea4da18b9d318fa001ce660b28bbcf3c1a8893d130b26d25e491f478ae4f95f71ea8897b32858f78d6e25537b959b69a04c5507008b8453f08a5ae1b3b4d8c83053c57637a98ef57e5fa51971eba5e287e9d10cba734336703def181022cb9f1e62079c48c13fe1659b157e5d9de7bfb929e715ed1a9a505a04a8d8474482295afbb9de90de2e918522cac2d5b5ac09d1fdc4147d6393a684ad7234ecb65d0008000000000000560ad146e8b9e9cd9b050edb1f6735c90a76b1ba4dbdee34d0b6750f25ba7251944ada7766c301c65e56351d009a568c782f4438ecba9bee47f25286300e83bd1853076ad52eac84029335b86e7f21e39a1af3d070abef94bc0827db0046dcb7d63bf64bf801c836a40b0100d0961533737c57e9b7337b981a99f63f600f90647703f0640f6594dd9f26436024a1f90f174769bad5a283271e6d7f49dec90a05bd771dd0502dc2170ccf98ade27e858eb5686ac900000000ae1bc4246ae316c6af10bf02088b4bb2ac89c96e58578dc50eddbf01ece3cb8a363ecbeb8198997115d7151f691a2a755d8233e006dd38ed5ba350bd6aad3bf6f5108083f0100f8a20be455d16134d65ce69c4b906b76427224b69750b779d81eb6e37e1db62b1788ff918433787f8026ef5c518113d48419a14a2bd8d4afff527513a2efc8403be48e494b3de33b1deefd9d902e8dc868f30161c2cd13b21b0a20362181186ff8cf4c8d58d74822f92554287ee157e9f1597c3e2e238f382a91bf48b4de88363c841bd7a8cddae3344295bd3d434d9ecf74634ffc9539010f0d36e672b9d668cc6762c0b25e4a22afb4d184ba84498b1367e4b31faf75f1b3dcecfd80c57015d8cd16171507add30833865fc1a42780e9d57bb14a6ebea4018d26e18747546fc7a4a619753fd9ba9c18e746aa9ea132058eb90f9b80549473eea2fb9bc43d38d8719a1cca094bd933ceef87a3ec0c2ac70d5f843425100950000009e000000000008000018779600e4283095c203b1f2ae5ed34f5b7e77278f7ded9f030000002e050000009f95a59418f612dfa87c654043da1a59c3c43c7884ab65d4b34984afe30c67179c4f5a3ba0e491f2b942b754a3c0d5b878c4ad63591c3fc7d3a4d4296d4bab0a88e55ff9c2536654bb2f83e8015fac216119e8ce582698938c9a331a974087b71f07e50300f7ff00d03bf057b408c86a1165bd9a1bdbf3dff88c9b2173a75d5fc82dce6d8a3f297231e33588d7cf183109c1118d94a41d48f8efcf193ff2699a76973f3f1ec1cff64a1b912ededeb080f9a241e07709e6dd6a3a7e18200c9e80b9634e6f0c4d000000000000000000000000000000005e50e77d04fcf8931ad07b38a39957e6b3a3c909000000e9d694e483e848fe0d00ee7c7d6cc30932a9575aa8808d10a4963560250bb4e60e88c726f63662cb143daf4b9ebd0774998a59fbb42dc35f12452cca456a12b7d15cf3ce7ea350e9510e96527cde622998e83e65b235c284542d48052eb15e6600733ca32436f9e705dff00f08df1115175628a327876dea291480c2dde8a59d1856eed2b502965038af0d56e49e0e2e9cb0e25104805f386d460e212c27ac7bafe6a0078f8648ff9f1e0257338ae58457fb27b29430cc9ac6a33ea11b88ae8bc95dffa293aa69d6d47f89b28a25a7ec2fce6691549990f93d1f02e1b619813699303b6b1260d5537e85315551adabe00c98282795dc5547aab3dcbd82a06e7f00c8160af19f1fc456b5fc4f099814631024b734c0cd8843c5cb124a21092e6cdd8aa2f4d3f93e92c6d850898890d9449e3f499af92be74ba8ba7928feabbd99d6288dece7513c50b973bab87214415078857d18032ab5adb8d4bf32405cc5f63eba7e60bcd0098fd7957943b3c4cf13de4e049e06ad7ebc236d1088c99d35f40555364ff86cab4542261999bccd3269e51d10900a1c05696b47ff33a159abce6bb1d69193bd01f59f1d3f431b4e0868db623cb8375baa50785b8fcd37ce4c52abe43c1e3368735022e7cc7a9b397b494d0183cbd8dae2ba19b32adc91444f519ad33f7f2680e3cf7ecd3cfc67816eb66b1faa78dd8e3f7e233b6048c53813e6b508dfc713583d8ef8f9cfff5cdae59aa7aca654b1740c90eb75ca000000000000000000000000000000000000000000faa13c07b5f590ee4c8bfbd828e912b150dde95dafe80ee043a107bde9c0bb87155691d640fd000000e4a2d2aa0607b026f78417471e6ea0d10000309b29d0dae2d2c9c730ac21040000000000000009775f86a9e6d5b6c7b3c5d10177a873edb630fdf9b1e11005a1ce41d04a2ad3f5d25a1595e7609849033d2e86ac682f2f0cde376f50a88a3ab5e83f56e43a07641b82c077fa1479b79e85c71a9c00000000000000078ce7c4ab383dac0325fa7f4ffb201c479265ff572dd061679c0000000000000f4f6b4ef8eb757ac80dc44711ae17816e32e38d7c894ab51238b2d7051ee26121404c0ade6faea7e72449cf38be7173b066f3a7835a31f1516c4cb1fda57ec8c19bc2800e246c1b64cf278c7afb3c9a5e346bdb259ac6788eefd5086e45554c8e2bdde8a3ac990dd929277a6af1876940c7c012f4b7d3d7aa68f2f07d83e925b326b05f130000000000000000000000000000000003572023092306e73a16f4b362f725b22b32be04e53a2219e3b08d75537c158ea4c4821d17d3b844dbe87408c34bb0f26ba43bd4530000769d45b93b8f2b6c194afc197f77bfb136dfd38c265479bd4f74b9d0b5c2f37eaacb2894370ab02abe06b823a2753ca82ea8888f2a5063212212772dcc541de26c97c1312fc247b56a9cd3e05bcb8bc93363edfa05f9c76e94190f917c3af6884c8742371f25eb0000000000000000000000004ae9afd11c62a57a29a163acc55ca9fe6da9ce6d59bdd87adec5ba4052a5edcd9999720e8b2a08b69f79f78c78b9f720bcf6a2ab411d420db8231780cdf52d44985768353ce1bc587700adf3a307ff11be0ca772f1bcc565070ef9345c2d55f0506d9059fff65ca75c9809c8e5e423f6f210a195e9b59a08c43dab5b025b1dc33cfdafe62aa8f13c38341267a920fc0be4e61fe9d8bed61524ad62896e3dfba3091cf028cdb3fabb530f1d0d4bdf391c5dda4b8b248ea58cb56aed4d968d506a108626e2423c506cc11bc2ec9de3b793fec489d08085e8c582cf6fc06c20eb57f7a1ba7315c67bd0e50f529a01211f8add5f28fd65fcd373982ae902e67966990cf34be5ed5dcf39b9e44fb0165fa40fcc5643678bab244a3a76f43dd267db562efe5156b85f6e909066b8f37b81b756eeeeee4598195e70d74bd1e221c5e0cf111b816f8bd5c2ac451fabd160815b9e81b9c4abffef4b12d82e401a0cce36fbfedaec4ab6a89e128ef71e63f2239792338e87e4c7d571d6e4bc165ea1d476531b4ddfbb698101e8563f7c25b4d527240dafb074437aa96f66e293df5e132fa95aa09c08ee57f089afc0522b438480aa3dc9f41330dcd3b25703feb85777de8fd5ac57464a31ae5924745f797a0c852ddf67e01dd5736b4826e16f885afb91b6a7f226e0d0aaabd0c01a8262cb35e501ddb3c191797560c91717a2215012da9e717ec8d65887138e3bc3886e5b6f3058e58fb4320338d6413ce94012c293e0042a2f5dd86b78d05efd9e44bbbccfae8b9361072af38c1aa3c030196d72d01a160a19c0060900e8bb2f3613a7ddacf2b878aa6b2952556d79bd183ae195e14d32ffd398ae01dbd20b034da17f5a78ceb03a16e39181a07b14e54f4e2061049569046877b9f5478106f6ac76e56213ec2e85a4dcd5960ad486e7c05a21e52e5c688c1f315169452b1b6a795dd837867899c64a04ec08a4b2d5455d93f6d5baf14ffced8576bfde19de2903835607505b4af824a0a69aee28fe65683dc83c19f6d253a5824442530c85d354c05c8b95030e629fb817697f746b9dd02fb40edf4f9886a758e0741ca2711e425f2f5be70a7fa600718fa7af2eb416a2b774f5d36f5632d791e0ba01f58f2165e6d5e564aef11dbc558170cf47c5934d41f558b02dc04d3ae4aee08aa5ad7d1e5ad92cdb90db79e73524d97ca3ce0828513c74fb0a1543eba7d17d37cc1f1f2d937bfd5fafeb23f691b326554b92d8b97e76e2cbbcb858a16287c2090727334096e574b6bb937ec9f048e041f178e8d3a3543c6862fc8b63f968501fabd17cbc81db1ad47d37d3fe02190fde2af3ac5c9a2d64ec4db0c8b211dbdf4d7b7c01248de7269c0b8d4c374d9fecb9fdff846c4e57d7d976c3f571474e4f65a87954e31e67c8cf6ac7823451b448ec90ca0b36405f6d2eef4055b5d2f4dad1aa89216f6d89bd43c4de92d8f61781a9349626fb65952dfa3c68aada76c3105d65bde2bddb981f753407c7696b767aeb3707606d0d9930b79f449557d6c3088c740f2a08c68b67f8dbbf93da08544ca26db1b58baae17c091f9bc28042630d76248e4d9d326ee62fd6e5d9bedee38b0e8da3cff3ba22e92e800b28c26901cd1a32b7aae2d762e776d66f08d78666364a2fc154fadfd105b28495e8702400a53f5191908b98a4d109a9d44107369cdf864fa8be46f52d88b01bcd795025a90669e55fc634692e554fe3a73ae6db0a5aa706c83061ba3b99aa992947346327a2521d3d4294115d9c4b44f949ae465d5aa24e3911520658e542e85023552e91dd39d98065dabfec69691c868bfc45f5830de8089ae1074b6ff56b7dd8e9029b7e5ab8e500b970cb391b14302315f99ab3bc102fbcc8d911c931c662c2a53c7a7bce275bb76b4096ee6d21acb49b088c7b7e05f70e6ed4cade99d907717b43b958390caec36fdb71fb1a5f374e86d3181ae12d12ff6a279e2047d26803cf7b1684c561ee8ff8250230e5de4171803ec2f03615f231d51f8a005a1487fb51b657a7b7f352adbd86fe56bd9bd02063b2bad542ca2ca3b61b8946abb3012c87cfa11e6df516ae4f29577dfda12068197eafdf0e343738778335ea5491cdcd7fe699a075425c9a35a731d63c2f7d3260ca187e2959223dc1a70f55ce9d02ff56e0410e3bf5"], &(0x7f0000000480)='syzkaller\x00', 0x8d0, 0x0, 0x0, 0x0, 0x0, '\x00', r9, @fallback, r0, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000100)=ANY=[@ANYBLOB="98030000", @ANYRES16, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c09000056"], 0x398}}, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000080)=ANY=[@ANYBLOB="c40000001900f3fe0000000000000000fe8000000000000000000000000000bbac1e000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000b86b6e0000000000000000000c0008"], 0xc4}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x66, 0x903, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0xfff3, 0x7}, {0x6, 0xfff1}, {0xfff5}}}, 0x24}, 0x1, 0x0, 0x0, 0x240080c8}, 0x20004804) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r11, &(0x7f0000003500)=[{{&(0x7f0000000140)={0xa, 0x100, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000000)="81", 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000300)="8c", 0x1}], 0x1}}], 0x2, 0x4004851) setsockopt(r11, 0x84, 0x11, &(0x7f0000000040)="020000000980ffff", 0x8) 1.5026124s ago: executing program 1 (id=6952): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000d40)={0x0, 0x7000003, &(0x7f00000023c0)=[{&(0x7f0000000b40)='?', 0x1}, {0x0, 0x1}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x20001) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) (async) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) (async) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmsg$nl_route_sched_retired(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=@newtclass={0x1058, 0x28, 0x400, 0x70bd28, 0x8, {0x0, 0x0, 0x0, 0x0, {0x8}, {0x2}, {0xfff2, 0xffff}}, [@c_cbq={{0x8}, {0x80c, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0xa4b8, 0x3, 0x4, 0x10001, 0x8, 0x100, 0xd755, 0x7, 0x6, 0xffff, 0x4, 0x0, 0x6, 0x6, 0xb24, 0x80000001, 0xe00, 0x5, 0x1, 0x7, 0x3c, 0x3, 0x5, 0xfffff6cd, 0x4, 0xe5e, 0x1, 0x10000, 0xf, 0x6, 0xa929, 0xf, 0xf, 0x200000, 0x7ff, 0x4, 0xfffffffe, 0x41, 0x2, 0x100, 0x5c, 0x9, 0x4, 0x30, 0x1, 0x3, 0xffffffff, 0x1, 0x6, 0xfc29, 0x6, 0xfffffe3f, 0x7fffffff, 0x0, 0x3, 0x5, 0x9, 0xe18, 0x2, 0x8, 0x8, 0xb0a, 0x9, 0xff, 0x3, 0x7, 0xf, 0x7, 0x5, 0x6, 0x1, 0x101, 0x7, 0x7ff, 0xcd, 0x8, 0x3ee, 0x4b, 0x3, 0x8, 0xa4, 0x7, 0x6, 0x4, 0x89dc, 0x2, 0x76, 0x9, 0x81, 0x9, 0x5, 0x7f, 0x6, 0x6, 0x7, 0x3, 0x5, 0x10, 0xb, 0x1, 0xffff8001, 0xb6d, 0x4, 0x7ff, 0xf61, 0x5, 0x7, 0x0, 0x5, 0x2, 0x0, 0x0, 0x0, 0x6, 0x6, 0x91, 0x1, 0x7, 0x8, 0x6, 0x1, 0x1800, 0x6, 0xe, 0x2, 0xd7d96f43, 0x40, 0x800, 0x9, 0xfffffff7, 0x3, 0x637d, 0x1000, 0x54, 0x15512f96, 0x2, 0x1, 0x39, 0x0, 0x3, 0x10, 0x1, 0x10, 0x4, 0x43, 0x8, 0x8001, 0x6, 0x2, 0x0, 0x0, 0xe, 0x0, 0xfff, 0x2, 0x3, 0x80000001, 0x7, 0x2e, 0x9, 0x0, 0x800, 0x6, 0x31, 0x6, 0x6, 0x5, 0x2, 0x3, 0x260df0e7, 0x8, 0x1, 0xb6, 0x4, 0x5, 0x8, 0x8141, 0x20000000, 0x1ff, 0x6, 0xfffffffe, 0x7, 0x3, 0xff, 0xb688, 0x7ff, 0x5, 0xff, 0x39, 0x100, 0x8, 0xd, 0x1, 0x0, 0x9, 0x7, 0x401, 0x8, 0x7, 0x40, 0x1, 0x4, 0x5, 0x0, 0x2f45, 0x40, 0x723, 0x5, 0x7ff, 0x2, 0x8000, 0x46, 0x5, 0x1, 0xac, 0x8001, 0x6, 0xfffffff9, 0x1, 0x73, 0x6, 0x48fbc151, 0x2, 0x6, 0x80000000, 0xff, 0x4, 0xfffffc00, 0x9, 0x8000, 0x6cb, 0x0, 0x80000000, 0x6, 0x6, 0x2, 0x8000, 0x847, 0xfffffff4, 0x7, 0x7, 0x1, 0x0, 0x8, 0x4, 0xb39, 0x9, 0x8, 0x5, 0x3, 0x29b, 0x4, 0x4c4, 0xffffffff, 0x9, 0x3ff]}, @TCA_CBQ_RTAB={0x404, 0x6, [0xffff, 0x3ff, 0x2, 0x800, 0x4, 0x6, 0x7ff, 0xfffffc00, 0x5, 0x6, 0x4, 0x4, 0x5, 0x5f6, 0x4, 0x1, 0x487a, 0x1b, 0x10000, 0xa, 0x4, 0x1, 0x5, 0x8c9, 0x10004, 0x400, 0x0, 0x6, 0x1538, 0x4, 0xff, 0x1000, 0x6, 0x0, 0x9, 0x542d, 0x9, 0xf, 0x4, 0x4, 0x1, 0x1, 0x7, 0x7, 0xd, 0x9, 0x81, 0x4, 0x130000, 0x252c000, 0x7, 0x1, 0x1, 0x4, 0x9f, 0x5, 0xe, 0xae7, 0x5, 0x7, 0x3, 0x8b, 0x0, 0x9, 0x0, 0x8, 0x10, 0x7, 0xfffffc01, 0x4c, 0x5, 0xfffffffb, 0xfffffffa, 0x8, 0x3, 0x2, 0xb42, 0x6, 0xfffffffb, 0x4, 0x9, 0x7f, 0x6, 0x379, 0x10000, 0xcca9, 0xcdd, 0x2, 0x0, 0x3, 0x1, 0x3a04, 0x7fffffff, 0x9, 0x1, 0x35, 0x3, 0xfffffffe, 0x1, 0x4, 0x8, 0x8, 0x1, 0x59be, 0xe5bd, 0xfffffffc, 0x5, 0x4, 0x6, 0x4, 0x1, 0x80, 0x31, 0xfff, 0x9, 0x2, 0x4, 0x9, 0x8, 0x3, 0x0, 0x8, 0xd, 0x7a31, 0x5, 0xffff590f, 0x1, 0x101, 0xc, 0x38, 0x3, 0x80000000, 0x5, 0x8b6, 0xb, 0x8, 0x80000001, 0xffff, 0x1, 0x87bb, 0x7, 0x7, 0x1, 0x40, 0x6, 0x4, 0x7, 0xa, 0x2, 0x2, 0x9, 0xffff, 0x5, 0x2, 0x9, 0x7fff, 0xc56e, 0x1, 0x8, 0x1000, 0x3790, 0x1, 0x3516, 0x1, 0x8, 0x6, 0x1, 0xfffff704, 0x0, 0xfffffbff, 0x5, 0x9, 0xd160, 0x7fffffff, 0x1, 0x2, 0xfffffffa, 0x3, 0x6, 0xe, 0xff, 0x4, 0x3, 0xfffffff9, 0x2, 0x46d, 0x4, 0xfffff957, 0x8, 0x1, 0x7, 0xeff, 0x5, 0xffffffff, 0x1, 0x0, 0xc27a, 0x4, 0x2, 0x1, 0xa, 0x0, 0x401, 0x588a, 0x7985, 0x0, 0x4, 0x3, 0x343e, 0xfffffffe, 0x400, 0x1, 0x0, 0xbd2, 0xfffffff4, 0x7fffffff, 0x1, 0xfffffb0c, 0x5, 0x3, 0xffff, 0x7a, 0x7, 0x8, 0x800, 0xf8000000, 0x3, 0x7, 0x8, 0x3, 0x3fc, 0x13, 0x7ff, 0x1ff, 0xe25e, 0x4648000, 0x3, 0xffff, 0x9ab, 0x5, 0x80, 0x7, 0x551cdd7, 0x1, 0x4, 0x8, 0x5, 0x4dd, 0x4384, 0x9, 0x2, 0x7, 0x80, 0x4e6, 0x5, 0x6]}]}}, @c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0xe, 0x7, 0x5, 0xfff, 0x8, 0x3, 0x7f, 0xfff, 0x4, 0x894, 0x9, 0x6, 0x4, 0x100, 0x6, 0x8001, 0x5, 0x2, 0x2, 0x7, 0x7ff, 0x2a651f85, 0x8, 0xee, 0x8f6, 0x1, 0x8, 0xd67, 0x6, 0x8, 0x8, 0x80000001, 0x45c, 0x1, 0x3ff, 0xff5f, 0x1, 0x294, 0x4, 0x7, 0x9, 0x200, 0x7, 0x3, 0x0, 0x4, 0x5, 0x2, 0xfffffffe, 0x80000, 0x2, 0x1fd, 0x9, 0x5, 0xea, 0x1, 0x5, 0xf175, 0xc7, 0x1, 0x1000, 0xfffffde2, 0x800, 0xddf, 0x10, 0xdf1d, 0x6, 0x10, 0x3ff, 0x2, 0x0, 0x1, 0x0, 0x10, 0xbf3b, 0x5, 0x3, 0x4dd, 0x200, 0x4, 0x8, 0x4, 0x6, 0x5, 0x2, 0x5, 0xc, 0x81, 0xb41f, 0x9, 0x6, 0x41, 0x2, 0x9, 0x1, 0x6, 0x51e0, 0x103, 0x4, 0x78, 0x1, 0x3ff, 0x8000, 0x2, 0xda, 0x1, 0x6, 0x0, 0x200000, 0x3, 0x9, 0x5, 0x97, 0x800, 0x3, 0x7, 0x0, 0x0, 0x903, 0xf, 0x100, 0x7, 0x100, 0x1, 0x3, 0x2, 0x200, 0x7ff, 0x1, 0xc54, 0x879, 0x73, 0x81, 0x1000, 0x7e5, 0x583, 0x401, 0x0, 0xe0000000, 0x0, 0x4, 0xd, 0x192d, 0x247, 0x0, 0x985, 0x0, 0xf470, 0xfffffffa, 0x2b7, 0x3, 0x3, 0x8, 0x4, 0x1, 0x2, 0x8, 0x1, 0x4, 0x0, 0xff, 0x4, 0x80000000, 0xfffffffc, 0x7, 0x3ff, 0x8, 0x4, 0x4, 0x4, 0x8, 0x1, 0x6, 0x4fb, 0x1, 0x8, 0x200, 0x2, 0x252d5040, 0xda, 0x8, 0x5, 0x80000000, 0x0, 0x1, 0x3, 0x3800, 0x3, 0x2, 0x1000, 0x2, 0x0, 0x8, 0x4, 0xfffffff9, 0x100, 0x9, 0x9, 0x8, 0x10, 0x5, 0x9, 0x9, 0x8, 0x6, 0x5, 0x9, 0xa8, 0x5, 0x3, 0x10, 0x3, 0x7, 0x9, 0xf4b6, 0x2, 0x6a, 0x2, 0x3, 0x5, 0x8, 0x40, 0x3b, 0x4800000, 0x800, 0xdae, 0x9, 0x0, 0xfff, 0x9, 0xf, 0x26, 0x1, 0x2, 0x6, 0x6, 0x6, 0x0, 0xffffffff, 0x7, 0xfffffff9, 0xffffffff, 0xfffffff6, 0x10000, 0x3, 0x8000, 0x3231, 0x74e, 0x9, 0x8009, 0x1, 0xe7e1, 0x3db2, 0x375b, 0x9, 0x80]}]}}, @c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x8, 0x5, 0x80, 0x4af8, 0x5, 0x1, 0x1, 0x6, 0x7, 0x5, 0x9, 0x0, 0x9, 0x1, 0x5, 0xe, 0x3, 0xff, 0x8, 0x0, 0xfffffe00, 0x9, 0x3, 0x4, 0x9, 0x4, 0x4, 0xf, 0x6, 0x2, 0x4, 0x7, 0x4000, 0xfff, 0xf30a, 0x0, 0x4, 0xf, 0x9, 0x4, 0x7, 0x4961, 0xf, 0x1, 0x7, 0x4, 0x4, 0x0, 0x317, 0x2, 0x0, 0x6, 0x5, 0x40, 0x1, 0xffffffff, 0x847, 0x7d, 0x9, 0xffc00000, 0x613b, 0x7, 0xfffffffa, 0x0, 0x4a4, 0x200, 0xb44, 0x3, 0x9, 0x6, 0x3, 0x0, 0x6c5, 0x2, 0x7fffffff, 0x9, 0x8, 0x1, 0x401, 0x5, 0xfffffffa, 0x6, 0x479d, 0x7, 0xffffffff, 0xa, 0x5, 0x800, 0x8, 0x1, 0x7, 0x5e7b, 0x4, 0x10001, 0x6, 0x4, 0x16ab, 0xffff, 0x40, 0x9, 0x3, 0x6, 0x9, 0x3, 0xfffffff8, 0xfffffffe, 0xfffffff7, 0x8, 0x6, 0x5, 0x6, 0xc, 0x0, 0xa, 0x13b, 0x7fff, 0x9, 0x9132, 0x9, 0x1, 0x9, 0x9, 0xfffffffe, 0x0, 0x8, 0x5, 0x5, 0xe2dd, 0x3fd, 0x80a, 0x1, 0xb, 0xffff0000, 0x80, 0xe, 0x0, 0xa2, 0x400, 0x0, 0x48000000, 0x8, 0x0, 0x4, 0x6, 0x7, 0x80000001, 0x8, 0x97, 0x1, 0xb, 0x3, 0x9, 0x4, 0xb, 0x7fff, 0x100, 0x7ff, 0x100, 0x6, 0x5, 0x1, 0x5, 0x9, 0x400, 0xfd04, 0x3ff, 0xfffffff5, 0x3ff, 0xbfcb, 0x9, 0x1, 0xe329, 0x7, 0xfffffffc, 0x50000000, 0xec, 0x7, 0x1, 0x1000, 0x8000, 0x7, 0x7ffb, 0x3, 0xfffffff9, 0x2, 0x67, 0x1, 0x4, 0xd, 0xff, 0x6, 0x101, 0xcd1a, 0x8, 0x7, 0x5, 0x0, 0x80, 0x1ff, 0x1, 0x1, 0x7, 0xf, 0x1, 0x0, 0xe11, 0x6, 0x3, 0xfffffffc, 0x1ff, 0x1, 0x2, 0x2cae, 0xf3ff, 0x48d, 0x7fff, 0x9, 0x1000, 0xfffffe00, 0x37f4, 0x0, 0x9, 0x2000, 0x5, 0x2, 0xd, 0x200, 0x822, 0x8, 0x0, 0xbec9, 0x9, 0x5, 0x35, 0xc2a, 0x4b, 0xa, 0x80, 0x2000007, 0x1, 0x7, 0x0, 0x12, 0x1c, 0x2, 0x4, 0x8, 0x5704, 0xc975, 0x7, 0x1000, 0x365a8a29, 0x5624, 0x1e9019bc, 0x800, 0xfffffffa]}]}}]}, 0x1058}, 0x1, 0x0, 0x0, 0x40004}, 0x20008000) (async) sendmmsg$alg(r6, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@assoc={0x18, 0x117, 0x4, 0x10}], 0x18, 0x40040}], 0x1, 0x8040) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r6) (async) recvmsg$qrtr(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)=""/59, 0x3b}, {&(0x7f00000002c0)=""/238, 0xee}], 0x2, 0x0, 0x0, 0x2}, 0x38, 0x100) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x40000c0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r3, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4800) sendmsg$NFC_CMD_FW_DOWNLOAD(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x24, r2, 0x101, 0x70bd25, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_FIRMWARE_NAME={0x5, 0x14, '\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x2400c040) 1.338474792s ago: executing program 0 (id=6953): r0 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000080)=ANY=[], 0x6) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, 0x0, 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r2}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x11, r3, 0xf3de6000) socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@newlink={0x110, 0x10, 0x2, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x90646, 0x2280}, [@IFLA_CARRIER_CHANGES={0x8, 0x23, 0x7}, @IFLA_VFINFO_LIST={0xe0, 0x16, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x2, 0xed3}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x3, 0xc49}}, @IFLA_VF_TRUST={0xc, 0x9, {0x1, 0x3}}]}, {0x48, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xa0000, 0x7ff}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x4}}, @IFLA_VF_TRUST={0xc, 0x9, {0x67c, 0x9}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x1, 0x5}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0xe96b, 0x200}}]}, {0x10, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x0, 0x1}}]}, {0x38, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0x0, 0x4}}, @IFLA_VF_TRUST={0xc, 0x9, {0x2aaa, 0x1}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x7ff, 0x9}}, @IFLA_VF_VLAN={0x10, 0x2, {0x9, 0x545, 0x543}}]}, {0x1c, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0x9, 0x401}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x101, 0xffffffff}}]}]}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}]}, 0x110}}, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000d40)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000005fdb2971dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359ca9daf3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae682acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da30000bce645451b851111dd98ac4d8da9317c2c082020e0b2d6340809000000000000008e053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456521cffdef93e29f10f4a11f0cfbfc0ff976b20fe"], &(0x7f0000000080)='GPL\x00', 0x0, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r13, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x20, 0x7, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xf}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r14 = socket$netlink(0x10, 0x3, 0x0) r15 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r14, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r16, {0xb}, {0xffff, 0xffff}, {0xffef, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x82, 0x3, 0x4, 0xffff, 0x7f, 0x7fffffff, 0x1, 0x40, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0xdc}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0xb}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0xd, 0x5}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000040)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0x10, '\x00', r4, r5, 0x1, 0x4}, 0x50) 1.337305779s ago: executing program 4 (id=6954): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000009200)={0x0, 0x0, &(0x7f00000091c0)={&(0x7f0000009140)={0x14, 0x2, 0x8, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x24000015}, 0x20000010) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@local, 0x9, 0x2, 0x1fc, 0x1, 0x9, 0x1}, 0xffffff9a) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r3, 0x8b32, &(0x7f0000000040)) sendmsg$key(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x2, 0xa, 0x0, 0x2, 0x2}, 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, 0x0, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x110, @dev={0xac, 0x14, 0x14, 0x41}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=ANY=[@ANYBLOB="44000000100003052abd70000400000000000000", @ANYRES32=0x0, @ANYBLOB="18800300a0010200140012800b0001006d616373656300000400028008000500", @ANYRES32=r4, @ANYBLOB="080003"], 0x44}}, 0x800) 1.14335163s ago: executing program 3 (id=6955): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_PMK(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, r1, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "a3862e60943f7fb75afa12056be74146"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "0822b0fc94a096b52ba80ac38599fb45"}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000040}, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000140)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) sendmsg$AUDIT_DEL_RULE(r3, &(0x7f0000000880)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000840)={&(0x7f0000000400)={0x424, 0x3f4, 0x8, 0x70bd2a, 0x25dfdbfe, {0x6, 0x1, 0x3f, [0x5, 0x1ff, 0x6, 0x6, 0x2, 0x6, 0x1ff, 0x9, 0x4, 0x9, 0x3, 0x81, 0x6, 0x8, 0x4072, 0x7, 0x9, 0x6, 0x7d8db13d, 0x7e, 0x8, 0x3, 0x9, 0x7fffffff, 0x1, 0x5, 0x7ff, 0x200, 0x1, 0x1000, 0xfffffff9, 0x8, 0x0, 0xf0bc, 0x80000001, 0x3, 0x3, 0x4, 0x5978, 0x2bfd, 0x0, 0x0, 0x40, 0x10001, 0x9, 0xfffffc00, 0x2, 0x84, 0x8, 0xffff9ab9, 0xe, 0x8, 0x800, 0x7, 0x5, 0x3ff, 0x3, 0x800, 0x2, 0x1000, 0xfff, 0x5663, 0x80000001, 0x4], [0x80000000, 0xfffffff9, 0x1, 0xd, 0xd, 0xf3, 0x3, 0x0, 0x80000000, 0x19, 0x8001, 0x2, 0x7fffffff, 0x2, 0xfffffff9, 0x2, 0xf53a, 0xff, 0x3, 0x1ff, 0x4, 0x7, 0x220, 0x97c, 0x401, 0x401, 0x7, 0x2, 0x1, 0xe, 0x8, 0x2, 0x405, 0x3, 0x3ff, 0x0, 0x8, 0x11, 0x4, 0x1, 0x100, 0x6, 0x2, 0x7, 0x7, 0x981, 0x400, 0x7, 0x9, 0x7ed, 0x3, 0x1, 0x0, 0x378, 0x7, 0x9, 0xfd, 0x4, 0x93e, 0x1, 0x9, 0xffff0000, 0x3, 0x5], [0x3, 0x7, 0x80, 0x6, 0x4, 0x3, 0x7fff, 0xf5, 0x8, 0x25, 0x6, 0x80000000, 0xa9, 0x200, 0x5, 0x8, 0x4, 0x9, 0x449, 0x6, 0x1000, 0x6, 0x2, 0x1a4d, 0x9, 0x1, 0xe8, 0xe, 0x4, 0x401, 0xfffffff8, 0x0, 0xaaf, 0x0, 0x36f7, 0x3, 0xbd7, 0x9d8000, 0x2, 0x7, 0x81e, 0x7, 0x4e3f, 0x4, 0x4, 0x9, 0xffffffff, 0x7fffffff, 0x5, 0xe49, 0x5, 0x6, 0x1, 0x7, 0x4, 0x9, 0x6d, 0x7, 0x637, 0x3, 0x0, 0xf7b, 0x10001, 0x6f], [0xe, 0x9, 0x6, 0xf, 0x0, 0x1, 0x5, 0x81, 0x3, 0x2, 0x7, 0x5385d67, 0x3, 0x0, 0x0, 0xd, 0x0, 0x1, 0x9, 0x3, 0x9, 0x9, 0x2, 0x0, 0x10000, 0x2, 0x2, 0x6, 0x7, 0x11f, 0x0, 0x400, 0x3fd9, 0xfffffffa, 0x2f08, 0x6b42, 0x8000, 0x3, 0x7, 0x81, 0x1, 0x0, 0x6, 0x4, 0x138, 0x5, 0x3, 0xfffffffd, 0x4, 0x7fff, 0x1, 0x80000001, 0x8, 0x7, 0x9, 0xf, 0x2, 0x1, 0x6, 0x5, 0x9, 0xe, 0x2, 0x400], 0x4, ['*.\x00', '\x00']}, [""]}, 0x424}, 0x1, 0x0, 0x0, 0x400c841}, 0x80) r4 = socket$rxrpc(0x21, 0x2, 0xa) listen(r4, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000940)=ANY=[@ANYBLOB="24f514cad1d2e582dcc424e0b642000015bb77d245a90c6569abde7a750d5a9825da1f38070b84e93926919297c4cc5d47c87cf6d90440b47106859d953e75b658d13562db5b1bdd1cc1", @ANYRES16=r6, @ANYBLOB="0100000000000000000000000000080002000000000008000100", @ANYRES32=0x0, @ANYBLOB], 0x24}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{0x304}, "e4fffffffffffbff", "9da15200", "b6730761", "f3ffffffffffffff"}, 0x28) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) (async, rerun: 64) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f5d937e5523", "4705a7b6113b967d7314f7201eb2babf", "1d1cbe23", "ecba06893bcdc493"}, 0x28) (async, rerun: 64) r8 = socket$netlink(0x10, 0x3, 0xb) (async) r9 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x2c, r9, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x31bca6d0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x880}, 0xd0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x6, &(0x7f0000000840)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000870000001800000007000000000000000300000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r10, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000900)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000380)={0x24, r9, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x40440) sendto$inet6(r2, 0x0, 0x0, 0x8080, 0x0, 0x0) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000007000007050001000700000005000500000e0500050002000000050004000100000005000400010000000000c3e300"/72], 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x240040c1) 1.093639179s ago: executing program 0 (id=6956): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000040)={0x81, 0x2, 0x80, 0x1, 0x0, 0x0, 0x0, 0x8, 0x1, 0x8, 0x0, 0x9, 0x0, 0x22}, 0xe) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e22, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000000080)={r5}, &(0x7f0000000140)=0x8) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_pressure(r6, &(0x7f0000000140)='io.pressure\x00', 0x2, 0x0) preadv(r7, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/58, 0x3a}], 0x1, 0x0, 0x0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x24, r2, 0x11, 0x0, 0xffffffff, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x24}}, 0x0) 986.770289ms ago: executing program 1 (id=6957): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0xe}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0xe}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000001240)={{r0, &(0x7f0000000080)='GPL\x00', 0x14000, &(0x7f00000000c0)={@_ha_fsid={[0xd7bc, 0x1]}, {0x1000, 0x5, 0x8, 0x6}}, 0x3853, &(0x7f0000000100), &(0x7f0000000200)=0x1ff}, {[0x0, 0x4, 0x2, 0x1]}, 0x1, 0x1000, &(0x7f0000000240)=""/4096}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000002340)={'wg0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r4) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r4) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}}, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r6}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0x11, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000100008000000000000000008500000041000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0x11, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000100008000000000000000008500000041000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r7, 0x0, 0xf, 0x0, &(0x7f00000003c0)="3eb5d4b44fa73cc4c14018d7a3da66", 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r7, 0x0, 0xf, 0x0, &(0x7f00000003c0)="3eb5d4b44fa73cc4c14018d7a3da66", 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f0000002800)={&(0x7f0000002740)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000027c0)={&(0x7f0000002780)={0x34, r5, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x80c4}, 0x811) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000002380), 0x4) pwrite64(r0, &(0x7f0000002640)="d5b277db19508d63e7a285167ea84db493a35ec9d8bccaa0dbbe477893f634aeb5444774eb17e6e5e30d4052a9cf32eb43121eb8bcb33b98ac7570fd0f4eb195dbe30c63cd26e5060a4bf1fa61ee29a118b6e03f553f335a291a38dfdb2d80990fe94154ec09d16ce5ad35ef4f19142d7a296ababd1e562cd62c4f929008424ddba794fb74c1d043fbf54469891a0413d20feb4ba07f6b40761993780f2b933a32be89c9cf76fc44b4df44a9b75aef66c6fc9cf50fbcbbc8fdc53362ee9e6b3ae5e112bd93457d17b2", 0xc9, 0x5) (async) pwrite64(r0, &(0x7f0000002640)="d5b277db19508d63e7a285167ea84db493a35ec9d8bccaa0dbbe477893f634aeb5444774eb17e6e5e30d4052a9cf32eb43121eb8bcb33b98ac7570fd0f4eb195dbe30c63cd26e5060a4bf1fa61ee29a118b6e03f553f335a291a38dfdb2d80990fe94154ec09d16ce5ad35ef4f19142d7a296ababd1e562cd62c4f929008424ddba794fb74c1d043fbf54469891a0413d20feb4ba07f6b40761993780f2b933a32be89c9cf76fc44b4df44a9b75aef66c6fc9cf50fbcbbc8fdc53362ee9e6b3ae5e112bd93457d17b2", 0xc9, 0x5) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002400)={0xffffffffffffffff}, 0xc) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000002440)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4, 0x3}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002580)={0x11, 0x4, &(0x7f00000012c0)=@raw=[@map_val={0x18, 0x9, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x7}], &(0x7f0000001300)='GPL\x00', 0x0, 0x1000, &(0x7f0000001340)=""/4096, 0x40f00, 0x68, '\x00', r2, 0x0, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f00000023c0)={0x1, 0x7, 0x1, 0x2}, 0x10, 0x0, 0x0, 0x5, &(0x7f00000024c0)=[r9, r10, 0x1], &(0x7f0000002500)=[{0x1, 0x2, 0x5, 0x8}, {0x1, 0x4, 0x10, 0xf}, {0x1, 0x1, 0xf, 0x5}, {0x3, 0x2, 0x9, 0x8}, {0x3, 0x5, 0x2, 0x5}], 0x10, 0x7}, 0x94) 957.313617ms ago: executing program 4 (id=6958): socket$nl_xfrm(0x10, 0x3, 0x6) (async) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffd, @empty}, 0x1c) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x58840, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000000)) ioctl$PPPIOCSNPMODE(r2, 0x4008744b, &(0x7f0000000040)={0x57}) (async) ioctl$PPPIOCSNPMODE(r2, 0x4008744b, &(0x7f0000000040)={0x57}) listen(r1, 0x0) (async) listen(r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r5, {0x0, 0xf}, {0xffff, 0xffff}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xc, 0x1, 0x0, 0x7, 0x0, 0x8], 0x0, [0x5, 0x6, 0x2, 0x0, 0x8, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x8001]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r7 = socket(0x11, 0x2, 0x0) setsockopt(r7, 0x107, 0x1, &(0x7f00000001c0)="010000000200060000071a80010061cc", 0x10) close(r7) ioctl$XFS_IOC_RTGROUP_GEOMETRY(r6, 0xc0805841, &(0x7f00000000c0)={0xc8c, 0x10001, 0xd080, 0x3}) (async) ioctl$XFS_IOC_RTGROUP_GEOMETRY(r6, 0xc0805841, &(0x7f00000000c0)={0xc8c, 0x10001, 0xd080, 0x3}) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) shutdown(r1, 0x0) (async) shutdown(r1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc020000000000000000000000000000ac1e000100000000000000000000000000000000000000000a00008088000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESHEX=r3], 0x23c}}, 0x4004000) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r9 = accept4(r8, 0x0, 0x0, 0x0) sendmsg$alg(r9, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="f0000000000000001701000002000000da000000a59276c7245f195eab2b8d22d04af613e8b6a1edaf1e74423e77cee4249795b76f5c87888bcd5d41c7acf33e6bff8d298fe40d036fc9501e8538f0f44ff3a1e1c934fc883cdcb93830d7a8a5872748f4ccdcf12b25e595fb7fc7eaf305dbd64d4424076a1a2a0023ea9f934aed4821d5d291d3d06eb867d30113e85caaaf987569cfcc79effed65802c09be607e9c83b69595562939afa20c6cdeb2d432b6f59988f98b424966021f25169a09ba54838b453db8c5844b0772834b1a4c0d0c398925cb6cafbcf9d4dff66554d7e44f667f1281893dbb6710c439b0000"], 0xf0, 0x24000004}, 0x40010) (async) sendmsg$alg(r9, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="f0000000000000001701000002000000da000000a59276c7245f195eab2b8d22d04af613e8b6a1edaf1e74423e77cee4249795b76f5c87888bcd5d41c7acf33e6bff8d298fe40d036fc9501e8538f0f44ff3a1e1c934fc883cdcb93830d7a8a5872748f4ccdcf12b25e595fb7fc7eaf305dbd64d4424076a1a2a0023ea9f934aed4821d5d291d3d06eb867d30113e85caaaf987569cfcc79effed65802c09be607e9c83b69595562939afa20c6cdeb2d432b6f59988f98b424966021f25169a09ba54838b453db8c5844b0772834b1a4c0d0c398925cb6cafbcf9d4dff66554d7e44f667f1281893dbb6710c439b0000"], 0xf0, 0x24000004}, 0x40010) sendmsg$nl_route_sched_retired(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@delqdisc={0x24, 0x25, 0x800, 0x70bd2d, 0x25dfdafe, {0x0, 0x0, 0x0, 0x0, {0xd}, {0x7, 0x9}, {0x1, 0xffe0}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched_retired(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@delqdisc={0x24, 0x25, 0x800, 0x70bd2d, 0x25dfdafe, {0x0, 0x0, 0x0, 0x0, {0xd}, {0x7, 0x9}, {0x1, 0xffe0}}}, 0x24}}, 0x0) recvmmsg(r9, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000500)=""/223, 0xdf}], 0x1}}], 0x1, 0x60, 0x0) 930.242473ms ago: executing program 1 (id=6959): sendmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="f8000000000000000b01000003000000b38ad0fa5344f86392a8a624588a9ebd811192cbcbc48c43148a7cc729a98cdc74f191ae2cd62d2652d78d6acf62b5eb8f161c8b04b3b2b547119b38e2badd726674a4693c080fe5c3496137c986cb152d529c9225c772f2f854bf5ab89e259312dacf6b9debd2bf43be3dc19840f0c35b2d960ac50a9f2bcf98156f76700462166d7eb6416b2a7510be974b3f7a06c8927e28a62f708cce515c9c922c8c0c8daf4646e725d7282571b819097b58963d71992c2938f34c3516c547423d99a2f90f3a146a044cb732f4f4a0305c9d37fcb667e5e900000000000028000000000000000000000000080000c133a12a91872b3730467c92a3a5050f02b82b7e452f3e6b500000000000000012010000ff030000ae15b1a3e016bb782adb738fa764d4487026530ac6f50e3b31ec875a38f17bac40e87117dbd6ba47cf721b216e5b8cb28d424f1b5ed9793f5167332a0000000038000000000000000a010000630a0000fa08ab919987305c8ad63785f4a4bc84cb79f70a5d7698a3"], 0x1c8}, 0x4000c010) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000005000000fd0900008400000005010000", @ANYRES32, @ANYBLOB="000000000007000006", @ANYRES32=0x0, @ANYRES32], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r0}, 0x38) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0xe) r2 = socket(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x10081, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f00000001c0)={'bond0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0xfffffffc}, 0x9) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x80, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe00000087000000000000bda100000000000007000000f8ffffffbfa400000000000007040000f0ffffffb702000008000000182300000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70400000800000085000000190000009500000000000000"], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 874.720518ms ago: executing program 0 (id=6960): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) (async) ioctl$NILFS_IOCTL_GET_CPSTAT(r0, 0x80186e83, &(0x7f0000000000)) (async, rerun: 64) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async, rerun: 64) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000001c0)={r0, &(0x7f0000000040)='skcipher\x00', 0x280, &(0x7f0000000100)={@_ha_fsid={[0x472, 0x6]}, {0x81, 0x8000, 0x3f6, 0xffffffffffffff01}}, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x8}) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r2, 0x605, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) (async) r3 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000003c80)=ANY=[], 0x12f4}}, 0x0) (async) recvmsg$can_raw(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/234, 0xea}, {&(0x7f0000000a80)=""/133, 0x85}], 0x2}, 0x200) 872.052095ms ago: executing program 2 (id=6961): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0xb, [@enum={0x4, 0x9, 0x0, 0x6, 0x4, [{0xd, 0x120d}, {0x2, 0xff000000}, {0x0, 0xfffffffc}, {0x2, 0x1}, {0x0, 0x7}, {0x10}, {0xf, 0x39000000}, {0x0, 0x8}, {0xc, 0x800}]}, @const={0x8, 0x0, 0x0, 0xa, 0x3}]}, {0x0, [0x0, 0x61, 0x2e, 0x0, 0x30, 0x61, 0x2e, 0x30, 0x30]}}, &(0x7f00000002c0)=""/200, 0x83, 0xc8, 0x0, 0x5, 0x10000}, 0x28) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x28, r1, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0xc, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r0) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000cc0)={&(0x7f0000000540), 0xc, &(0x7f0000000c80)={&(0x7f0000000b00)={0x178, r4, 0x0, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x34, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xf, 0x3, "07181dc6c382c2dae1f9a9"}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_NET={0x38, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xf0dc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xb5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x401}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7f}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_NODE={0xa0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x44, 0x3, "19274cfd4cb123351b2f04a83ccc43eb0076553b8957f872662a7e8ea2352bf8a67696867a4f9626f41c36259b3edbcd43674a487ee105ddbce214f491462d69"}, @TIPC_NLA_NODE_KEY={0x46, 0x4, {'gcm(aes)\x00', 0x1e, "698bb2fa64f3dbf7f110ee87d6b58bd162d37ccad251e35757380fb84757"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xd}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7ff}, @TIPC_NLA_PUBL_UPPER={0x8}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x40830}, 0x4000) (async) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x28, r1, 0x1, 0x70bd2d, 0x4, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x3, 0x2b}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="d80000003f000701feffffff00000000027c0000040042800c0001"], 0xd8}, 0x1, 0x0, 0x0, 0x6008815}, 0xc000) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x4, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3}, 0x50) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) r9 = socket$packet(0x11, 0x2, 0x300) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0x0, 0x9}, {0x1, 0x10}, {0x0, 0xed27c9fa5277b9b7}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ALPHA={0x8, 0x5, 0xd}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0xfffffff8}]}}]}, 0x44}}, 0x20008000) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x19, &(0x7f0000000900)=ANY=[@ANYBLOB="18110000", @ANYRES32=r6, @ANYBLOB="000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000852000000200000018230000", @ANYRES32=r8, @ANYBLOB="0000000003000000f54181fff60000009520000001000000081101008619a37bc195ff4377731c7d5f641493d50550802fe1594dff6603234f0d7e6e043ac8f90743a0885dec2e6cdbbdbb081d07332deec7ea76495aae8c7a6f17ba674302b545b0037157f6b52932e7f95630fec21cd29d18672c0dbd143f2510df1a0b61941970dbddca0a72887cb46f1d27d0426e5f1587e5ab00c3d86e0101de2685d1694d869b528c716879617eaa5776a1f9399f04449bd3255d769c94c160e203c3e98491ffba11b3e29d3fc0aadeace70409689468358d3e08d0563614fa75b65c627716fd12e670f0beacdabdff0df0449486550b4f91c00fba26d6e77d1bd236abe9f443ead849cb303ceecf67af63cfcec3d6b891f08b2b617f4ad115", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000001800000008000000000000000800000018620000080000000000000003000000"], &(0x7f0000000640)='GPL\x00', 0x9, 0x11, &(0x7f0000000680)=""/17, 0x40f00, 0x0, '\x00', r10, 0x0, r7, 0x8, &(0x7f0000000740)={0x3, 0x4}, 0x8, 0x10, &(0x7f00000007c0)={0x3, 0xe, 0x0, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000800)=[r6, r8, r7, r8], 0x0, 0x10, 0x84}, 0x94) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000006c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}}]}, &(0x7f0000000780)='syzkaller\x00'}, 0x94) 755.003322ms ago: executing program 3 (id=6962): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000100001000000000000000033e3297882b128708419b01092000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a"], 0xcc}, 0x1, 0x0, 0x0, 0x4000}, 0x40) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e27, 0x101, @mcast1, 0x8e4}}, 0x0, 0x0, 0x2b, 0x0, "bb02a3c364ca41d6357e54452401400400941292f4925a1e1ea6324d6193fcf19b49f3eefb1f56c54dc46d8b6d2ccd118aa0cc1dc2767bbe000100060000010100"}, 0xd8) r4 = socket$kcm(0x23, 0x5, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c0000001200030300004e224e23b62a919030a885be04"], 0x4c}, 0x1, 0x0, 0x0, 0x20040849}, 0x8004) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) listen(r4, 0x800) accept4(r4, 0x0, 0x0, 0x80000) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), r0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r9, 0x1, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4011}, 0x40000) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000580)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000540)={&(0x7f00000002c0)={0x278, r7, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_KEY={0x1b8, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "e51cc9c364d5c9f75831600b5f3d1cfb"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "7f07207e9fd4f96ac72376f58cea9078"}, @NL802154_KEY_ATTR_ID={0x38, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x6}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "61462679eec646ce2ce7b8cabfd7035b8023667908ab4f48ba8414ac84af9585"}, @NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}]}, @NL802154_KEY_ATTR_ID={0x64, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x21}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x50, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0x5551}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}]}, @NL802154_KEY_ATTR_ID={0x9c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x40, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x24, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc}]}]}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "7a8094ede6fa82c88357080b943a4e22d0149ae46d13ece19ee8c9674a9da81f"}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r15}, @NL802154_ATTR_SEC_KEY={0x60, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "624014242e26ae8308753cad571b683a"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5}, @NL802154_KEY_ATTR_ID={0x10, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x5}]}, @NL802154_KEY_ATTR_ID={0x30, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}]}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x40800}, 0x4000005) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r3, @ANYBLOB="0c0005006c010000000000000c000200ff7f000000000000400007800c00018008000100", @ANYRES32=r3, @ANYBLOB="0c00018008000100", @ANYRES32=r1], 0x7c}}, 0x20000000) 746.790206ms ago: executing program 2 (id=6963): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) (async, rerun: 64) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x80087601, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="e80000000300000000000000759ad400000000000000000000e172775ab6df97823c438bfb08222a6d9258ad1d5e007f1d3fe995725a563a6a3557d934dcd6cf72fd7fe1e9dd480c110b07e5f74f0cf324e4aeeca395c6a84ee010e2a10331f0322ffcff053a2bf335b11531fdde91a90a8b6df1c270508033917220c23f48b3cdf216378802dbefe64a4434881387e368c6027a437121a928ce0f7dcb3e6a669df769508484a8fede3564118221b00bb3752466", @ANYRES32=r5, @ANYBLOB="0198000000000000c8001a800400070004001c0004000700300002802c00018008000800020000000800020040000000080005000300000008000d00ff000000080012000300000004001c000400070030000a80050008000d00000014000700fe880000000000000000000000000101050008000500000005000800ff00000030000a80140007000000000000000000000000000000000005000800fd000000050008000400000005000800fa000000200002801c000180080021000100000008001c00000100000800200002000000"], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async, rerun: 64) r6 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x4c000000, &(0x7f0000000080)=[{&(0x7f0000000300)="d8000000180081034e81f783db4cb9040a1d020006007c09e8fc55a10a0015000400142603600e120800060000000401a800080008000a400400000004000461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000000)=ANY=[@ANYRES64=r6, @ANYRES32=r5, @ANYBLOB="02001032140001000000ac1aee9558f0007c0000000000008000673a7f0000010a000200ffffffffffff0000"], 0x3c}}, 0x20024090) 622.754561ms ago: executing program 4 (id=6964): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_opts(r2, 0x0, 0x50, 0x0, &(0x7f0000002e40)=0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="142009002d008b000100f0000000000006000000ef8b66c1e52c1924f324763bb896d0e7f70bcb527ab9f66329150857513d15ccf9d87a6846faf029ad1aacf4315a912da33bbe33632eda91b27ea22c91a566a4c9aa7ee6e2706eba3b1c689df53a3e232bd7cda3c1ebeb239b85ec77cb055e63732e"], 0x14}}, 0x8000) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={r0}, 0x4) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000680)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}}], 0x1, 0x4000000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000100)) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r6, &(0x7f0000002a80)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbf198a084ce1c86dd62e6839300442fff0000"], 0x7e) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000040)={r5, 0x8001}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000690200000000000095"], &(0x7f0000000d40)='syzkaller\x00'}, 0x90) 620.975015ms ago: executing program 1 (id=6965): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x100, 0x0, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x10}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x78, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_team\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0x100}, 0x1, 0x0, 0x0, 0x4040}, 0x4008010) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f00000001c0)) r1 = accept(r0, &(0x7f0000000200)=@l2, &(0x7f0000000280)=0x80) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000002c0)={0x0, 0x200}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000340)=@sack_info={r2, 0x0, 0x3}, 0xc) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f00000003c0)={'filter\x00', 0x7, 0x4, 0x418, 0x110, 0x110, 0x220, 0x330, 0x330, 0x330, 0x4, &(0x7f0000000380), {[{{@arp={@rand_addr=0x64010100, @broadcast, 0xffffffff, 0x0, 0x7, 0x6, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}, {[0xff, 0xff, 0x0, 0xff, 0x0, 0xff]}}, {@mac=@multicast, {[0xff, 0xff, 0x0, 0xff, 0x0, 0x1fe]}}, 0x6, 0x7, 0x7, 0x2, 0x8001, 0x7f, 'pim6reg\x00', 'pim6reg1\x00', {}, {0xff}, 0x0, 0x10}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @loopback, @multicast1, 0x8}}}, {{@arp={@multicast1, @private=0xa010100, 0x0, 0xffff00, 0x6, 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x13}, {[0xff, 0x0, 0x0, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0xff, 0x0, 0xff]}}, 0xfbff, 0xffff, 0xfff, 0x8, 0x9, 0x7, 'netpci0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x191}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @local, @rand_addr=0x64010101, 0x4, 0xffffffff}}}, {{@arp={@multicast1, @broadcast, 0xff000000, 0xff000000, 0x7, 0x2, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@random="36a256d93741"}, 0x1, 0x6, 0x0, 0x0, 0xf, 0xe0, 'ip6gretap0\x00', 'tunl0\x00', {}, {0xff}, 0x0, 0xc8}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @multicast1, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000840)=0xd44, 0x4) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000008c0), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000900)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000000a00)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, r4, 0x100, 0x70bd27, 0x9, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x40000) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x13, r3, 0x8338000) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r3, 0x8002f515, &(0x7f0000000a40)) ioctl$sock_bt_hci(r1, 0x400448e6, &(0x7f0000000a80)="428f5480cfe2a257e329e8792c76320fe94cc8a118f7e9f4d58d94d995396d80cb0820c12a9a738dcfe3ab0f021aa9a6df7d9e183a7ed9f6643222036252c479941819fef932782d16bd23b719ac8ab7bb58a49d13ee169f2e4d8ff5d322786b1f3d32f302db7e3a9027cfa096de433f884e767fbfc928d460a62d6fe2d1") r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f00000010c0)={&(0x7f0000000b00)=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x4, 0x3}}, 0x10, &(0x7f0000001000)=[{&(0x7f0000000b40)="ec949a9477b9c98910a9371691532b2c6f2e391705cb52e5b69a93ee546a2b8f0be3c109b4f2f1555824fa5d23141e65917f2b7ad271c42d587dc914a69b9ed5c894652666c66497be4027eaf09cf018b357aafac766e57465c6edcbf01825da33af724f1b6ff4c5f1a028db0697492af1321b3474dd4a14aca4d556520e6f10d7a53f61e4d056b919b8e4f27667f209e6577e63f08e71bed6e0df7727dbdc71403fb85410", 0xa5}, {&(0x7f0000000c00)="47a57b437be37d3f901d61224844ac0cfc2c68520b22292c43786da325a98a34a99ffe327493bd721d8499c5ab1a91452277e78ab1295eb28270c9bfe837609a75ce860559c6757e", 0x48}, {&(0x7f0000000c80)="f43b6f137b9437fb8789a5a379ae85cafcf3305c4cf48d05c047f5d26c403ab05489a996994c8d", 0x27}, {&(0x7f0000000cc0)="10b8d73046729dff40e507578d6984a03da28b6ff587941bf5b2532acebb5a00558734f3767677d9fefe701a0ddebdebc3d4332e99feda174c3101d62ef9e0ed4cb1cdc1cea5814745a21c93f6b50328611047836a162d87815edfdaa81678ac59d666eed903d4be31032be66492ffa2634702a261f2da53d5c5107c3cfd50b17fffef4fa87c8d05390f62ac7b9544", 0x8f}, {&(0x7f0000000d80)}, {&(0x7f0000000dc0)="c08837b295b2722f1fa8b9adf2678b59bf7a19323981999105fd8b79a3f535643a983e98375a1855af014d1d399df0bb9cd4438411f678447a4add76a2f2ca9c6ec2f26064765899869fb1e47e30d623ae3be3510e41c9232dcfa90210c2b6e178cdd7726aec74c32e9b9e8a345bbbb6b9701eb17ef73f79fdd22f6728599bf0aca793fe7bb33902025d1b36347dffaf6261b4cb", 0x94}, {&(0x7f0000000e80)="fbcf629d76dc349e24949106d61b7010c1deeb9d9b68c0c8c82e7593e0d541ab0e448a33187921fcfae6ab4c9a2b58b626e40a6d53f11c2a4574ca2079d6b703d4053a8ccbbe68e51954d645835f5ba9af78389a40391097078758a0b86c8350a327ededa198b246f9a343f4eaad74289a47865c7c888ccd72e4dbf72b7887539a0b254003d8e399a68e33586446e5266fe7580cfb897a9a75c61e6894525012fd4825693f2720f56e1f8d62b542e7d757bca226b9e7e23183f17fffc2a9ac1cd3dc01832f230f4d3845f7808f5d0a6d317538f1d32e543a24", 0xd9}, {&(0x7f0000000f80)="62a7148c72f6a22f5cfd51df557c648aaff7a06e2604aefb8e1aabca65af95def399f182bf075c2490b4b38e27a39dd0c846555bd482580740ef8bba692187c163230ffd158125e07008a9fb781cb71f2a7a21ce9a6cd49bebefaa676e98e5eb32a183e51fab844810df6012b2d990bfd3cc0085bf2f", 0x76}], 0x8, &(0x7f0000001080), 0x0, 0x4}, 0x4050) r7 = socket$l2tp(0x2, 0x2, 0x73) sendto$inet(r7, &(0x7f0000001100)="899606406ade9d70e86dc40bf7e4a06b5c560b532f6a13b77e1669c7bc9d7a4c655b902c49b86e8abb54fd2cdb8d4f19f32ea4ce8d0f4ef9a5682f76c972fc24c67117ef636c9c135080d8e876f20c283295741bdb3b7c96af7597af690db35f29ba11f69b732f01b294c964b874bcc336aebcbf693b7344c068faed0d7c29bfe99ca66fe5e971e1249d80e5483827a2f5436af18b085fb941a2c18bd73d6387eede09107988a32c5a1803a66c3336f8fa2c4f97d32bb120b015cbc45fb4e83b699d21b99bcb6d9c3cc3458b9b14152be467e6da86e87cc7ba7c8ede0f74138e5b81f7a5fc5421cc7c6d49", 0xeb, 0x1, &(0x7f0000001200)={0x2, 0x4e20, @loopback}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001280), r1) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000001500)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000014c0)={&(0x7f00000012c0)={0x1d0, r8, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x650c}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x5c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x47}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3b4}]}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x401}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xe}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x101}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xc}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x1c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x12, 0x3, "2a16038ac28ba4653ff6c937db09"}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000000}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}]}, @TIPC_NLA_NODE={0x68, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "dc1774f4f6a47462eabcd9bbcac141feb85880141b1c777c"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x50}, 0x8) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001580), r1) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r0, &(0x7f0000001680)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x6c, r9, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x9}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x1}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2c}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x6}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x1}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xa}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4c557fb173a4b221}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x1}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x9}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8050}, 0x24000021) getsockname$tipc(r1, &(0x7f00000016c0)=@id, &(0x7f0000001700)=0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r10, 0x8982, &(0x7f0000001740)) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000001980)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001940)={&(0x7f00000017c0)={0x180, r8, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x80000000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x100}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x111}]}, @TIPC_NLA_BEARER={0x78, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'bridge0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'bond_slave_0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3a8}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}, 0xf0}}, {0x14, 0x2, @in={0x2, 0x4e24, @local}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdd4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @private0, 0x800}}}}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffffffd7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x262c874a}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000001ac0)={&(0x7f00000019c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a00)={0x6c, r4, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x80000000}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x20}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x6c}, 0x1, 0x0, 0x0, 0x2000c040}, 0x4000000) splice(0xffffffffffffffff, &(0x7f0000001b00)=0xaeb7, 0xffffffffffffffff, &(0x7f0000001b40)=0x1, 0x7, 0xd) 615.457891ms ago: executing program 0 (id=6966): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@datasec={0x1, 0x2, 0x0, 0xf, 0x2, [{0x4, 0x0, 0x2}], "f841"}, @datasec={0x0, 0x0, 0x0, 0xf, 0x2, [], "1ba4"}]}, {0x0, [0x61, 0x0]}}, &(0x7f0000000300)=""/2, 0x44, 0x2, 0x1}, 0x20) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast2, 0x5}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000001000008004500001c0000000000119078ac1e0101e00000014e244e2000089078"], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) r4 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000380)={0xffffffffffffffff, 0x0, 0x25, 0x8, @val=@perf_event={0x5}}, 0x18) close(r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0xe) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000080)={0x0, 0xe8b}, 0x8) syz_open_procfs$namespace(0x0, &(0x7f0000000000)) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c000180060006"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x0) syz_emit_ethernet(0xfe, &(0x7f0000000200)={@local, @local, @val={@val={0x88a8, 0x2, 0x1, 0x2}, {0x8100, 0x1, 0x0, 0x2}}, {@llc_tr={0x11, {@llc={0xfc, 0x184, "a1dd", "14901199305d29a62dd262730e5f56457cef9519deb6be2b067a831498d0a6facab5b3bcbfea6c1133aa5d2e29866568972d81ba35a13d183d472dab036084d782715dd79a0e98f479bffdf881f881a705979a0eb9015933724b9de3be0862f8712a8af737b1eddbc0d8d5f3c7e981baec68302527b111295c54289a2ee478637e69488552ab2cfdbe013ec4ec6488df0d0f9849af9c6cee79f3ade22237295df4dcee73fa9574f81dd9794a2aad53013761c9aa046dec43abd822dbfd5d7467804106464a2c7fffeef69feb227f826287e194fe4321ae67d888bc5b8ee87d004ca28baf"}}}}}, 0x0) r8 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0x10, 0x800) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r8, 0x28, 0x1, &(0x7f0000000300)=0xffffffffffffffff, 0x8) 518.916289ms ago: executing program 0 (id=6967): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000480)="b7028d7a89a1a9e34b7acba3d9bff1ab77e1013b52513a5cb7", 0x19}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5000009, 0x10012, r3, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x20) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="8c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100fe0f000004000480280003800c00010040000000060000000c000100ff04000000000000d8fd010006000000090000000600050088a800000800feff", @ANYRES32, @ANYBLOB="08000500", @ANYRES16=r2], 0x8c}, 0x1, 0xba01, 0x0, 0x4004001}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000200)=0x38) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000180)) 330.876285ms ago: executing program 1 (id=6968): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0) 323.676731ms ago: executing program 0 (id=6969): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0x439, 0x0, 0x5ffff, {0x0, 0x0, 0x0, r5, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @broadcast}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x8000000) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) (async) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) (async) sendto$packet(r2, &(0x7f0000000180)="280320000a0014000000fbf719143baa111f43c851ffab286e16195ecf3d77cc32b6d78839980700e6669d3c865c6b96e84000050016f37fe8c0295f5c", 0x3d, 0x840, &(0x7f00000000c0)={0x11, 0x86dd, r5, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2eaaaac15ca67ef2}}, 0x14) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) r10 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x0) (async, rerun: 32) recvmmsg$unix(r10, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)=""/4096, 0x1000}], 0x1}}], 0x14, 0x0, 0x0) (rerun: 32) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r8, @ANYBLOB="1c005a8018000080140005"], 0x38}}, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x1, 0x10000, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x6}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f00000003c0)=[@in6={0xa, 0x0, 0xfffffffc, @local}], 0x1c) (rerun: 64) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, 0x0, 0x800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[], 0x44}}, 0x0) 0s ago: executing program 1 (id=6970): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="24000000760009eeffffffffffffff0400000000", @ANYRES32, @ANYRES16=r0], 0x24}, 0x1, 0x5502000000000000}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)=ANY=[@ANYBLOB="67da6282", @ANYRES16=r4, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r1, @ANYBLOB], 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) r5 = socket(0x10, 0x3, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x18, 0x14, 0x21, 0x0, 0x0, {0x23}, [@INET_DIAG_REQ_BYTECODE={0x4}]}, 0x18}}, 0x0) read$nci(r0, 0x0, 0x0) write$nci(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="700005040000080837000000b46ad46d040fbfe4877575dad4bc3a1659b5bca18284e4b4a988d567e9e01ec5a8fc7c6f633574b61de212afadf4eeae44f0ede5e34816b86ffb5b1a635531c8da763ff1f375fafc1bfca1664ca00676f6665cff9313252d71"], 0xc) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000280), r3) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'erspan0\x00', &(0x7f0000000540)={'syztnl2\x00', 0x0, 0x40, 0x20, 0x4, 0x2, {{0x24, 0x4, 0x2, 0x6, 0x90, 0x67, 0x0, 0x2, 0x4, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x21}, {[@cipso={0x86, 0x18, 0x3, [{0x5, 0x12, "4d33258627241d335dddbd74fd0e5dfd"}]}, @rr={0x7, 0xf, 0xc8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @multicast2]}, @timestamp={0x44, 0x14, 0xe8, 0x0, 0x4, [0x9, 0xcb, 0x10, 0x37]}, @timestamp={0x44, 0x8, 0xe3, 0x0, 0x9, [0x870]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x14, 0x90, 0x0, 0x8, [0x3, 0x4, 0x0, 0xfffffffb]}, @rr={0x7, 0x1b, 0xd4, [@local, @rand_addr=0x64010101, @empty, @remote, @remote, @broadcast]}, @timestamp_prespec={0x44, 0x4, 0x65, 0x3, 0x1}]}}}}}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r6 = socket$kcm(0x23, 0x5, 0x0) sendmsg$sock(r6, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) r8 = socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) close(r9) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r11}, &(0x7f00000006c0), &(0x7f0000000700)=r10}, 0x20) recvmsg$unix(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000009c0)=""/181, 0xb5}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r7, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) kernel console output (not intermixed with test programs): , 0] type 2 family 0 port 6081 - 0 [ 615.672978][T25243] 8021q: adding VLAN 0 to HW filter on device team0 [ 615.692945][T25224] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.847168][T25224] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.984260][T25224] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 616.154321][T25269] netlink: 'syz.4.5158': attribute type 1 has an invalid length. [ 619.169281][T25281] __nla_validate_parse: 4 callbacks suppressed [ 619.169300][T25281] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5163'. [ 619.217430][T16180] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.288528][T16182] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.406517][T16185] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.433744][T25299] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.5169'. [ 619.457285][T25299] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.5169'. [ 619.669855][T16190] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.807196][T25309] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5171'. [ 620.031167][T25331] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5178'. [ 620.057965][T25327] netlink: 'syz.1.5177': attribute type 26 has an invalid length. [ 620.080069][T25326] syzkaller0: entered promiscuous mode [ 620.080607][T25327] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5177'. [ 620.086705][T25326] syzkaller0: entered allmulticast mode [ 620.096314][T25326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5176'. [ 620.201245][T25327] netlink: 'syz.1.5177': attribute type 26 has an invalid length. [ 620.223034][T25327] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5177'. [ 620.541674][T25349] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5181'. [ 620.659244][T25352] netlink: 'syz.1.5182': attribute type 10 has an invalid length. [ 620.747302][T25354] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5183'. [ 621.187617][T25372] syzkaller0: entered promiscuous mode [ 621.212902][T25372] syzkaller0: entered allmulticast mode [ 621.503851][T25384] netlink: 'syz.4.5192': attribute type 12 has an invalid length. [ 621.525148][T25384] netlink: 'syz.4.5192': attribute type 12 has an invalid length. [ 621.549335][T25388] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 621.713567][T25395] xt_CT: You must specify a L4 protocol and not use inversions on it [ 621.792689][T25398] tunl0: left promiscuous mode [ 622.040609][T16187] nci: nci_rx_work: unknown MT 0x7 [ 622.149731][T25426] netlink: 'syz.3.5200': attribute type 8 has an invalid length. [ 622.250033][T25398] team0: left allmulticast mode [ 622.256790][T25398] team_slave_0: left allmulticast mode [ 622.269388][T25398] team_slave_1: left allmulticast mode [ 622.708100][T25398] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 622.758693][T25398] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 622.891311][T25398] 0·: left allmulticast mode [ 622.904937][T25398] hsr_slave_0: left allmulticast mode [ 622.912424][T25398] hsr_slave_1: left allmulticast mode [ 623.165666][T25398] mac80211_hwsim hwsim40 wlan0: left promiscuous mode [ 623.245158][T25398] ip6erspan0: left allmulticast mode [ 623.479129][T16190] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 623.512279][T16190] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.528195][T16190] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 623.539876][T16190] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.577421][T16190] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 623.597762][T16190] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.611086][T16190] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 623.633340][T16190] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.689394][T25438] syzkaller1: entered promiscuous mode [ 623.714425][T25438] syzkaller1: entered allmulticast mode [ 623.767690][T25447] syzkaller0: entered promiscuous mode [ 623.778403][T25447] syzkaller0: entered allmulticast mode [ 623.963889][T25452] netlink: 'syz.0.5206': attribute type 1 has an invalid length. [ 624.115983][T25452] 8021q: adding VLAN 0 to HW filter on device bond11 [ 624.193749][T25457] syzkaller0: entered promiscuous mode [ 624.202197][T25457] syzkaller0: entered allmulticast mode [ 624.899796][T25413] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 625.687364][T25522] xt_HMARK: proto mask must be zero with L3 mode [ 625.728707][T25519] lo speed is unknown, defaulting to 1000 [ 625.912068][T25531] ip6gretap0: entered promiscuous mode [ 625.948500][T25531] ip6gretap0: entered allmulticast mode [ 625.979350][T25543] __nla_validate_parse: 13 callbacks suppressed [ 625.979368][T25543] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5231'. [ 626.010254][T25542] syzkaller0: entered promiscuous mode [ 626.017510][T25543] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5231'. [ 626.017526][T25542] syzkaller0: entered allmulticast mode [ 626.196724][T25543] IPv6: sit2: Disabled Multicast RS [ 626.567522][T25559] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5234'. [ 626.620482][T25559] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5234'. [ 626.757437][T25567] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5236'. [ 626.768042][T25564] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 626.828113][T25570] netlink: 'syz.1.5237': attribute type 1 has an invalid length. [ 626.836883][T25570] netlink: 756 bytes leftover after parsing attributes in process `syz.1.5237'. [ 627.006756][T25570] syzkaller1: entered promiscuous mode [ 627.012531][T25570] syzkaller1: entered allmulticast mode [ 627.375340][T25588] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5241'. [ 627.512097][T25588] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 627.838245][T25595] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5243'. [ 627.841542][T25600] netlink: 'syz.2.5245': attribute type 5 has an invalid length. [ 627.963602][T25603] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5243'. [ 628.137267][T25609] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 628.251710][T25615] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5249'. [ 629.102733][T25651] netlink: 'syz.0.5260': attribute type 1 has an invalid length. [ 629.133892][T25653] netlink: 'syz.4.5262': attribute type 1 has an invalid length. [ 629.152483][T25653] netlink: 'syz.4.5262': attribute type 1 has an invalid length. [ 631.919342][T25651] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 632.222806][T25668] netlink: 'syz.0.5265': attribute type 11 has an invalid length. [ 632.243590][T25668] __nla_validate_parse: 3 callbacks suppressed [ 632.243613][T25668] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5265'. [ 633.020951][T25711] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5279'. [ 633.077332][T25711] team0 (unregistering): Port device team_slave_0 removed [ 633.096224][T25711] team0 (unregistering): Port device team_slave_1 removed [ 633.401987][T25730] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5285'. [ 633.457388][T16187] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 633.488053][T16187] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 633.527479][T16187] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 633.565153][T16187] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 633.750306][T25743] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5290'. [ 633.768217][T25742] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5291'. [ 634.438799][T25784] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5300'. [ 634.898324][T25807] xt_hashlimit: size too large, truncated to 1048576 [ 634.976586][T25809] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5308'. [ 635.053165][T25814] netlink: 'syz.0.5311': attribute type 12 has an invalid length. [ 635.076599][T25814] netlink: 'syz.0.5311': attribute type 1 has an invalid length. [ 635.099545][T25814] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5311'. [ 635.194904][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 635.512566][T25831] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5315'. [ 635.622050][T25836] tipc: Enabled bearer , priority 0 [ 635.654473][T25835] tipc: Resetting bearer [ 635.752735][T25835] tipc: Disabling bearer [ 636.061081][T25856] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 636.448998][T25876] netlink: 128 bytes leftover after parsing attributes in process `syz.1.5329'. [ 636.892356][T25905] geneve4: entered promiscuous mode [ 636.903658][T25905] team0: Port device geneve4 added [ 636.913377][ T57] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 20001 - 0 [ 636.951458][T16181] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 20001 - 0 [ 636.987166][T16181] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 20001 - 0 [ 637.033643][T16181] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 20001 - 0 [ 637.117098][T25917] xt_TCPMSS: Only works on TCP SYN packets [ 637.572952][T25929] __nla_validate_parse: 5 callbacks suppressed [ 637.572970][T25929] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5343'. [ 637.726033][T25939] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5345'. [ 638.098792][T25953] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5350'. [ 638.869680][T25994] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 638.971218][T26006] netlink: 'syz.3.5367': attribute type 4 has an invalid length. [ 639.128888][T26009] netlink: 'syz.0.5368': attribute type 33 has an invalid length. [ 639.380954][T26019] syzkaller0: entered promiscuous mode [ 639.392466][T26019] syzkaller0: entered allmulticast mode [ 639.724028][T26034] tipc: Enabling of bearer rejected, failed to enable media [ 640.206815][T26047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5380'. [ 640.371933][T26053] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5381'. [ 640.540473][T26065] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5384'. [ 640.615262][T26065] openvswitch: netlink: Missing key (keys=40, expected=100) [ 640.990584][T26080] netlink: 'syz.1.5390': attribute type 21 has an invalid length. [ 641.034280][T26080] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5390'. [ 641.259015][T26088] netlink: 'syz.3.5393': attribute type 23 has an invalid length. [ 641.533069][T26106] tipc: Enabling of bearer rejected, already enabled [ 641.547027][T26105] tipc: Enabling of bearer rejected, already enabled [ 641.774163][T26120] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5402'. [ 641.860439][ T4942] block nbd2: Receive control failed (result -32) [ 641.962832][T26131] netlink: 'syz.3.5405': attribute type 1 has an invalid length. [ 641.976208][T26131] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 642.131178][T26146] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 642.340556][T26156] netlink: 260 bytes leftover after parsing attributes in process `syz.3.5412'. [ 642.377720][T26158] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5411'. [ 642.610724][T26158] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5411'. [ 642.679628][T26175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 642.705226][T26178] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5415'. [ 642.941646][T26185] bond0: (slave bond_slave_0): Releasing backup interface [ 642.982513][T26185] bond0: (slave bond_slave_1): Releasing backup interface [ 643.002767][T26185] team0: Port device team_slave_0 removed [ 643.013487][T26185] team0: Port device team_slave_1 removed [ 643.021174][T26185] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.031026][T26185] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 643.046935][T26185] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 643.080721][T26194] netlink: 'syz.3.5422': attribute type 4 has an invalid length. [ 643.166478][T26195] syzkaller0: entered promiscuous mode [ 643.183757][T26195] syzkaller0: entered allmulticast mode [ 643.375566][T26203] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5427'. [ 643.503588][T26206] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 643.510892][T26206] IPv6: NLM_F_CREATE should be set when creating new route [ 643.518223][T26206] IPv6: NLM_F_CREATE should be set when creating new route [ 643.525488][T26206] IPv6: NLM_F_CREATE should be set when creating new route [ 646.680918][T26213] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 646.833018][T26235] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 646.953684][T26242] netlink: 220 bytes leftover after parsing attributes in process `syz.4.5439'. [ 646.957659][T26243] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5438'. [ 647.237155][T26258] bridge0: port 1(ipvlan2) entered blocking state [ 647.262509][T26258] bridge0: port 1(ipvlan2) entered disabled state [ 647.273313][T26258] ipvlan2: entered allmulticast mode [ 647.291354][T26258] bridge0: entered allmulticast mode [ 647.304054][T26258] ipvlan2: left allmulticast mode [ 647.312728][T26258] bridge0: left allmulticast mode [ 647.627949][T26280] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5450'. [ 648.289315][T26322] syzkaller0: entered promiscuous mode [ 648.296040][T26322] syzkaller0: entered allmulticast mode [ 648.534094][T26331] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5462'. [ 648.766615][T26342] netlink: 'syz.4.5466': attribute type 1 has an invalid length. [ 648.776789][T26342] netlink: 'syz.4.5466': attribute type 1 has an invalid length. [ 648.786617][T26342] netlink: 'syz.4.5466': attribute type 1 has an invalid length. [ 648.815497][T26342] netlink: 'syz.4.5466': attribute type 2 has an invalid length. [ 648.866925][T26342] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5466'. [ 649.012026][T26358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5469'. [ 649.217438][T26369] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5469'. [ 649.909102][T26380] netlink: 'syz.2.5474': attribute type 3 has an invalid length. [ 649.920380][T26380] netlink: 3 bytes leftover after parsing attributes in process `syz.2.5474'. [ 651.494141][T26329] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 651.504355][T26334] netlink: 256 bytes leftover after parsing attributes in process `syz.3.5463'. [ 651.761235][T26393] netlink: 252 bytes leftover after parsing attributes in process `syz.0.5480'. [ 651.762271][T26390] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5478'. [ 651.780392][T26395] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 651.844440][T26395] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5481'. [ 652.202042][T26415] pim6reg1: entered promiscuous mode [ 652.238122][T26415] pim6reg1: entered allmulticast mode [ 656.982933][T26492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 657.143024][T26497] __nla_validate_parse: 1 callbacks suppressed [ 657.143042][T26497] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5505'. [ 657.211695][T26500] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5506'. [ 657.347695][T26506] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5506'. [ 657.374907][T26506] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5506'. [ 657.402771][T26513] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5507'. [ 657.509091][T26503] syzkaller0: entered promiscuous mode [ 657.533413][T26503] syzkaller0: entered allmulticast mode [ 657.665937][T26523] bridge: RTM_NEWNEIGH with invalid ether address [ 657.739959][T26527] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5511'. [ 657.905167][T26527] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5511'. [ 661.728899][T26584] netlink: 'syz.3.5526': attribute type 3 has an invalid length. [ 661.774124][T26584] netlink: 3 bytes leftover after parsing attributes in process `syz.3.5526'. [ 661.795076][T26587] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5529'. [ 661.820037][T26593] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5527'. [ 661.925207][T26587] macsec1: entered promiscuous mode [ 661.936300][T26587] bridge0: entered promiscuous mode [ 661.951006][T26587] macsec1: entered allmulticast mode [ 661.959663][T26587] bridge0: entered allmulticast mode [ 661.966923][T26587] bridge0: port 1(macsec1) entered blocking state [ 661.973625][T26587] bridge0: port 1(macsec1) entered disabled state [ 662.004843][T26587] bridge0: left allmulticast mode [ 662.011800][T26587] bridge0: left promiscuous mode [ 662.043924][T26596] veth0_macvtap: left promiscuous mode [ 662.122449][T26597] lo: entered promiscuous mode [ 662.128391][T26597] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 662.400845][T26612] __nla_validate_parse: 4 callbacks suppressed [ 662.400864][T26612] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5535'. [ 662.638771][T26625] xt_hashlimit: size too large, truncated to 1048576 [ 662.711791][T26622] bond4: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 662.768575][T26622] bond4 (unregistering): Released all slaves [ 663.308599][T26655] ÿÿÿÿÿÿ: renamed from vlan1 [ 663.675873][T26673] bond8: option fail_over_mac: invalid value (16) [ 663.701522][T26673] bond8 (unregistering): Released all slaves [ 663.958027][T26687] syzkaller0: entered promiscuous mode [ 663.969435][T26687] syzkaller0: entered allmulticast mode [ 664.040451][T26689] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5558'. [ 664.383976][T26705] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 664.544152][T26721] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5565'. [ 665.035360][T26750] netlink: 'syz.1.5572': attribute type 1 has an invalid length. [ 665.096432][T26752] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5573'. [ 665.328248][T26760] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 665.530664][T26767] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5578'. [ 665.736161][T26783] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5583'. [ 665.761384][T26776] netlink: 'syz.2.5582': attribute type 10 has an invalid length. [ 665.789955][T26776] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 665.814577][T26776] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 666.063446][T26800] netlink: 'syz.3.5589': attribute type 16 has an invalid length. [ 666.109009][T26800] netlink: 'syz.3.5589': attribute type 3 has an invalid length. [ 666.152119][T26800] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5589'. [ 666.193447][T26794] can: request_module (can-proto-0) failed. [ 666.691007][T26808] syzkaller0: entered promiscuous mode [ 666.706226][T26808] syzkaller0: entered allmulticast mode [ 666.804583][T26832] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5599'. [ 666.843483][T26832] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5599'. [ 669.966371][T26838] netlink: 'syz.3.5601': attribute type 1 has an invalid length. [ 669.974471][T26838] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5601'. [ 669.993019][T26838] workqueue: Failed to create a rescuer kthread for wq "phy3": -EINTR [ 670.516708][T16187] team0: left promiscuous mode [ 670.586322][T16187] bridge0: port 1(team0) entered disabled state [ 670.681190][T16187] dvmrp8: left allmulticast mode [ 670.770574][T16187] batman_adv: batadv0: Interface deactivated: gretap1 [ 670.958038][ T5623] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 670.974224][ T5623] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 670.988145][ T5623] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 670.997962][ T5623] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 671.011302][ T5623] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 671.438183][T26894] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5613'. [ 671.583905][T16187] batman_adv: batadv0: Removing interface: gretap1 [ 671.625833][T16187] bond3 (unregistering): (slave geneve3): Releasing active interface [ 671.641005][T16187] bond2 (unregistering): (slave geneve2): Releasing active interface [ 671.773923][T16187] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 671.788260][T16187] bond0 (unregistering): Released all slaves [ 671.809775][T16187] bond1 (unregistering): Released all slaves [ 671.829761][T16187] bond2 (unregistering): Released all slaves [ 671.867322][T16187] bond3 (unregistering): Released all slaves [ 671.899404][T16187] bond4 (unregistering): (slave veth7): Releasing active interface [ 671.912899][T16187] bond4 (unregistering): Released all slaves [ 671.942878][T16187] bond5 (unregistering): Released all slaves [ 671.966376][T16187] bond6 (unregistering): Released all slaves [ 671.986972][T16187] bond7 (unregistering): Released all slaves [ 672.033684][T16187] bond8 (unregistering): Released all slaves [ 672.058141][T16187] bond9 (unregistering): Released all slaves [ 672.078563][T16187] bond10 (unregistering): Released all slaves [ 672.105682][T26872] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5610'. [ 672.584386][T16187] tipc: Disabling bearer [ 672.637639][T16187] tipc: Disabling bearer [ 672.661989][T16187] tipc: Left network mode [ 672.712683][T26914] syzkaller0: entered promiscuous mode [ 672.758422][T26914] syzkaller0: entered allmulticast mode [ 673.125070][ T5623] Bluetooth: hci1: command tx timeout [ 673.258998][T26926] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5622'. [ 673.407326][T26877] lo speed is unknown, defaulting to 1000 [ 673.665207][T26931] netlink: 'syz.4.5624': attribute type 4 has an invalid length. [ 673.868819][T26938] syzkaller0: entered promiscuous mode [ 673.899986][T26938] syzkaller0: entered allmulticast mode [ 674.057351][T26946] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5629'. [ 674.395938][T26951] xt_bpf: check failed: parse error [ 674.761256][T26967] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5636'. [ 674.784949][T26967] netlink: 'syz.4.5636': attribute type 10 has an invalid length. [ 674.811703][T26967] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5636'. [ 674.955551][T26970] netlink: 'syz.2.5638': attribute type 30 has an invalid length. [ 674.962858][T26972] netlink: 'syz.0.5639': attribute type 2 has an invalid length. [ 674.990384][T26972] netlink: 'syz.0.5639': attribute type 5 has an invalid length. [ 675.195021][ T5623] Bluetooth: hci1: command 0x041b tx timeout [ 675.220689][T16187] hsr_slave_0: left promiscuous mode [ 675.234245][T16187] hsr_slave_1: left promiscuous mode [ 675.355722][T26986] sctp: [Deprecated]: syz.2.5643 (pid 26986) Use of int in maxseg socket option. [ 675.355722][T26986] Use struct sctp_assoc_value instead [ 675.381967][T16187] veth0_macvtap: left promiscuous mode [ 675.389086][T16187] veth1_vlan: left promiscuous mode [ 675.397415][T16187] veth0_vlan: left promiscuous mode [ 676.143960][T16187] smc: removing net device veth0_vlan with user defined pnetid SYZ2 [ 676.153980][T16185] smc: removing ib device syz0 [ 676.570015][T16185] smbdirect: ib_dev[syz0] removed [ 676.683399][T27002] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5644'. [ 676.695236][ T5746] syz0: Port: 1 Link DOWN [ 676.988011][T27028] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 677.132837][T27035] netlink: 'syz.4.5652': attribute type 2 has an invalid length. [ 677.171650][T27035] netlink: 8812 bytes leftover after parsing attributes in process `syz.4.5652'. [ 677.229544][T27035] netlink: 'syz.4.5652': attribute type 2 has an invalid length. [ 677.285734][ T4942] Bluetooth: hci1: command 0x041b tx timeout [ 677.553597][T27035] bond4: option fail_over_mac: invalid value (16) [ 677.572596][T27035] bond4 (unregistering): Released all slaves [ 677.911968][T27049] syzkaller0: entered promiscuous mode [ 677.918661][T27049] syzkaller0: entered allmulticast mode [ 678.054437][T27062] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 678.126757][T27071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5660'. [ 678.159677][T27071] netlink: 'syz.2.5660': attribute type 10 has an invalid length. [ 678.200736][T27071] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5660'. [ 678.476606][T27079] Bluetooth: MGMT ver 1.23 [ 678.504326][T27079] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 679.362542][ T4942] Bluetooth: hci1: command 0x041b tx timeout [ 681.436930][ T4942] Bluetooth: hci1: command 0x041b tx timeout [ 682.034312][T26877] bridge0: port 1(bridge_slave_0) entered blocking state [ 682.052416][T26877] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.066184][T26877] bridge_slave_0: entered allmulticast mode [ 682.080549][T26877] bridge_slave_0: entered promiscuous mode [ 682.103090][T26877] bridge0: port 2(bridge_slave_1) entered blocking state [ 682.117249][T26877] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.128884][T26877] bridge_slave_1: entered allmulticast mode [ 682.147789][T26877] bridge_slave_1: entered promiscuous mode [ 682.257105][T26877] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 682.286734][T26877] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 682.372328][T27114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5671'. [ 682.483969][T27114] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5671'. [ 682.498226][T26877] team0: Port device team_slave_0 added [ 682.520293][T16187] IPVS: stop unused estimator thread 0... [ 682.546088][T27114] openvswitch: netlink: Missing key (keys=40, expected=80) [ 682.563969][T26877] team0: Port device team_slave_1 added [ 682.595404][T27121] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5673'. [ 682.815526][T26877] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 682.840150][T26877] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 682.933952][T26877] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 682.965683][T26877] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 682.995287][T26877] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.012300][T27133] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 683.069483][T26877] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 683.157755][T27133] netlink: 'syz.0.5678': attribute type 1 has an invalid length. [ 683.315696][T27148] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5681'. [ 683.325659][T27148] netlink: 'syz.2.5681': attribute type 10 has an invalid length. [ 683.333564][T27148] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5681'. [ 683.440390][T27133] bond12: entered promiscuous mode [ 683.459753][T27133] 8021q: adding VLAN 0 to HW filter on device bond12 [ 683.522611][T26877] hsr_slave_0: entered promiscuous mode [ 683.531798][T26877] hsr_slave_1: entered promiscuous mode [ 683.561899][T27151] bond12: (slave bridge5): making interface the new active one [ 683.573099][T27151] bridge5: entered promiscuous mode [ 683.589146][T27151] bond12: (slave bridge5): Enslaving as an active interface with an up link [ 683.955604][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 683.965373][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 683.973758][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 683.982157][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 683.990534][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 683.998906][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 684.007326][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 684.015736][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 684.024084][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 684.032529][T27164] tc action pedit unable to extract header offset for header type (0x5) [ 684.040965][T27164] 0: reclassify loop, rule prio 0, protocol 800 [ 684.484087][T27188] tipc: Enabled bearer , priority 0 [ 684.600324][T27188] syzkaller0: entered promiscuous mode [ 684.627397][T27188] syzkaller0: entered allmulticast mode [ 684.657433][T27188] tipc: Resetting bearer [ 684.849817][T26877] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 684.864141][T26877] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 684.932754][T27187] tipc: Resetting bearer [ 684.960548][T27213] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5698'. [ 687.861708][T27187] tipc: Disabling bearer [ 687.906579][T27215] syzkaller0: entered promiscuous mode [ 687.918242][T27215] syzkaller0: entered allmulticast mode [ 687.928728][ T5753] tipc: Node number set to 3523950815 [ 688.011960][T26877] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 688.051160][T26877] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 688.087011][T27218] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5699'. [ 688.088640][T27222] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.127736][T27222] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.201334][T26877] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 688.219668][T26877] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 688.292805][T27225] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5702'. [ 688.319901][T27225] nbd: must specify a size in bytes for the device [ 688.394057][T26877] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 688.418022][T26877] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 688.881257][T27247] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5709'. [ 688.932878][T27247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5709'. [ 689.161073][T27263] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 689.168568][T27263] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 691.812119][T27248] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 691.867293][T26877] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 691.957485][T26877] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 692.017303][T27276] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5715'. [ 692.039905][T26877] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 692.118606][T26877] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 692.143509][T26877] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 692.163832][T26877] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 692.197514][T26877] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 692.206393][T27283] netlink: 'syz.0.5718': attribute type 1 has an invalid length. [ 692.227790][T26877] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 692.273218][T27290] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5718'. [ 692.311258][T27290] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5718'. [ 692.325922][T27283] bond13: entered promiscuous mode [ 692.331517][T27283] 8021q: adding VLAN 0 to HW filter on device bond13 [ 692.394171][T27283] bond13: (slave bridge6): making interface the new active one [ 692.402239][T27283] bridge6: entered promiscuous mode [ 692.409603][T27283] bond13: (slave bridge6): Enslaving as an active interface with an up link [ 692.460053][T27293] x_tables: unsorted underflow at hook 4 [ 692.696306][T27314] netlink: 88 bytes leftover after parsing attributes in process `syz.2.5726'. [ 692.815303][T26877] 8021q: adding VLAN 0 to HW filter on device bond0 [ 692.864557][T26877] 8021q: adding VLAN 0 to HW filter on device team0 [ 692.887705][T27321] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5728'. [ 692.936071][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.943267][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 692.954305][T27325] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 692.958507][T27321] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5728'. [ 693.014136][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.021373][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 693.050155][T27321] netlink: 'syz.0.5728': attribute type 3 has an invalid length. [ 693.125948][T27321] netlink: 'syz.0.5728': attribute type 2 has an invalid length. [ 693.149921][T27321] __nla_validate_parse: 1 callbacks suppressed [ 693.149939][T27321] netlink: 31 bytes leftover after parsing attributes in process `syz.0.5728'. [ 693.232519][T27329] syzkaller0: entered promiscuous mode [ 693.258409][T27329] syzkaller0: entered allmulticast mode [ 693.688338][T27351] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5736'. [ 693.772374][T27358] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5738'. [ 693.805933][T27358] netlink: 'syz.1.5738': attribute type 2 has an invalid length. [ 694.063945][T27374] netlink: 'syz.1.5743': attribute type 1 has an invalid length. [ 694.109058][T27374] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 695.010706][T26877] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 695.102649][T27411] netlink: 'syz.0.5752': attribute type 1 has an invalid length. [ 695.110735][T27416] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5753'. [ 695.134202][T27416] netlink: 80 bytes leftover after parsing attributes in process `syz.4.5753'. [ 695.303205][T26877] veth0_vlan: entered promiscuous mode [ 695.352220][T26877] veth1_vlan: entered promiscuous mode [ 695.550632][T26877] veth0_macvtap: entered promiscuous mode [ 695.600939][T26877] veth1_macvtap: entered promiscuous mode [ 695.670572][T27437] syzkaller0: entered promiscuous mode [ 695.679198][T27437] syzkaller0: entered allmulticast mode [ 695.731163][T27432] tipc: Enabled bearer , priority 0 [ 695.780881][T26877] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 695.870979][T26877] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 695.881402][T27448] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5758'. [ 695.916047][T27432] tipc: Resetting bearer [ 696.031613][T27432] tipc: Disabling bearer [ 696.072578][T16180] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.095296][T16180] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.177404][T16180] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.213850][T16180] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.554580][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 696.614297][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 696.728453][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 696.759422][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 697.067933][T27495] netlink: 'syz.0.5770': attribute type 1 has an invalid length. [ 697.079776][T27496] tipc: Enabling of bearer rejected, failed to enable media [ 697.137510][T27501] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5770'. [ 697.194568][T27495] bond14: entered promiscuous mode [ 697.210930][T27495] 8021q: adding VLAN 0 to HW filter on device bond14 [ 697.310877][T27508] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5773'. [ 697.374743][T27502] veth3: entered allmulticast mode [ 697.431510][T27495] 8021q: adding VLAN 0 to HW filter on device bond14 [ 697.455892][T27495] bond14: (slave vti0): The slave device specified does not support setting the MAC address [ 697.477476][T27495] bond14: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 697.498720][T27495] bond14: (slave vti0): making interface the new active one [ 697.507691][T27495] vti0: entered promiscuous mode [ 697.522199][T27495] bond14: (slave vti0): Enslaving as an active interface with an up link [ 697.542885][T27500] syzkaller0: entered promiscuous mode [ 697.548397][T27500] syzkaller0: entered allmulticast mode [ 697.762207][T27524] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5777'. [ 698.082534][T27539] geneve3: entered promiscuous mode [ 698.104850][T27539] geneve3: entered allmulticast mode [ 698.441975][T27565] Cannot find set identified by id 65534 to match [ 698.468527][T27565] Cannot find set identified by id 65534 to match [ 698.493259][T27565] Cannot find set identified by id 65534 to match [ 698.521086][T27565] Cannot find set identified by id 65534 to match [ 698.555224][T27565] Cannot find set identified by id 65534 to match [ 698.582097][T27565] Cannot find set identified by id 65534 to match [ 698.617159][T27565] Cannot find set identified by id 65534 to match [ 698.658939][T27565] Cannot find set identified by id 65534 to match [ 698.671603][T27565] Cannot find set identified by id 65534 to match [ 698.692141][T27565] Cannot find set identified by id 65534 to match [ 698.707794][T27567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5786'. [ 699.270576][T27594] lo speed is unknown, defaulting to 1000 [ 699.375922][T27610] netlink: 4096 bytes leftover after parsing attributes in process `syz.2.5794'. [ 700.318156][T27619] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5796'. [ 700.328784][T27619] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5796'. [ 701.404857][T27569] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 701.853231][T27636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 702.183600][T27658] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5806'. [ 702.552247][T27680] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5813'. [ 702.681526][T27685] netlink: 'syz.2.5814': attribute type 1 has an invalid length. [ 702.696035][T27686] netlink: 'syz.0.5815': attribute type 11 has an invalid length. [ 702.719968][T27686] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5815'. [ 702.806671][T27689] netlink: 'syz.0.5815': attribute type 1 has an invalid length. [ 702.906021][T27691] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5814'. [ 702.955049][T27691] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5814'. [ 703.022177][T27697] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5815'. [ 703.139714][T27685] bond9: entered promiscuous mode [ 703.172653][T27685] 8021q: adding VLAN 0 to HW filter on device bond9 [ 703.260802][T16190] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.305052][T16190] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.343338][T16190] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.451962][T16190] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.840414][T27729] netlink: 'syz.0.5826': attribute type 1 has an invalid length. [ 703.995503][T27734] xt_hashlimit: size too large, truncated to 1048576 [ 704.082543][T27729] 8021q: adding VLAN 0 to HW filter on device bond15 [ 704.163476][T27730] bond15: (slave geneve3): making interface the new active one [ 704.195169][T27730] bond15: (slave geneve3): Enslaving as an active interface with an up link [ 704.218006][T27746] __nla_validate_parse: 4 callbacks suppressed [ 704.218040][T27746] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5829'. [ 704.270133][T27746] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5829'. [ 704.415423][T27733] lo speed is unknown, defaulting to 1000 [ 705.032985][T27733] dvmrp0: entered allmulticast mode [ 705.097563][ T57] dvmrp0: left allmulticast mode [ 705.241438][T27748] netlink: 5 bytes leftover after parsing attributes in process `syz.1.5830'. [ 705.682985][T27777] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5836'. [ 705.711276][T27777] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 705.711276][T27777] Please contact the netfilter-devel mailing list or update your nftables rules. [ 705.821117][T27781] netlink: 'syz.2.5838': attribute type 13 has an invalid length. [ 705.840431][T27781] netlink: 'syz.2.5838': attribute type 58 has an invalid length. [ 705.850437][T27781] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5838'. [ 706.093469][T27796] tipc: Enabling of bearer rejected, media not registered [ 706.222351][T27803] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5846'. [ 706.243938][T27804] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5847'. [ 706.259118][T27805] openvswitch: netlink: IPv4 tunnel dst address is zero [ 706.678568][T27822] block nbd3: shutting down sockets [ 706.890050][T27836] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5854'. [ 706.935632][T27836] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5854'. [ 707.264378][T27842] bridge0: port 2(bridge_slave_1) entered disabled state [ 707.272411][T27842] bridge0: port 1(bridge_slave_0) entered disabled state [ 707.348488][T27847] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 707.403488][T27852] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5859'. [ 707.466951][T27857] vlan3: entered promiscuous mode [ 707.479650][T27857] bridge0: entered promiscuous mode [ 707.814170][T27874] syz_tun: refused to change device tx_queue_len [ 708.189320][T27893] x_tables: duplicate underflow at hook 1 [ 709.791141][T27982] netlink: 'syz.1.5897': attribute type 28 has an invalid length. [ 709.830228][T27982] netlink: 'syz.1.5897': attribute type 3 has an invalid length. [ 709.867820][T27982] __nla_validate_parse: 4 callbacks suppressed [ 709.867838][T27982] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5897'. [ 710.172726][T28005] IPVS: length: 239 != 24 [ 710.195199][T28001] syzkaller0: entered promiscuous mode [ 710.232471][T28001] syzkaller0: entered allmulticast mode [ 711.354965][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 711.412355][T28077] netlink: 'syz.3.5921': attribute type 1 has an invalid length. [ 711.447891][T28077] netlink: 756 bytes leftover after parsing attributes in process `syz.3.5921'. [ 711.713717][T28066] syzkaller0: entered promiscuous mode [ 711.727069][T28066] syzkaller0: entered allmulticast mode [ 712.378953][T28117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5929'. [ 712.389472][T28117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5929'. [ 714.997243][T28103] netlink: 'syz.3.5928': attribute type 29 has an invalid length. [ 715.005893][T28103] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5928'. [ 715.229406][T28125] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5933'. [ 715.248084][T28126] netlink: 'syz.4.5934': attribute type 5 has an invalid length. [ 715.272487][T28128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5930'. [ 715.367364][T28128] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 715.410266][ T5732] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 715.729525][T28140] can: request_module (can-proto-0) failed. [ 716.001220][T28155] netlink: 16215 bytes leftover after parsing attributes in process `syz.3.5940'. [ 716.086844][T28159] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 716.107158][T28159] bond0: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 716.432711][T28180] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5946'. [ 716.443720][T28182] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5946'. [ 716.496392][T28180] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5946'. [ 716.512959][T28184] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5947'. [ 716.678626][T28195] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5947'. [ 717.225786][T28225] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5960'. [ 717.599091][T28239] bridge7: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 717.616449][T28244] bridge0: port 2(bridge_slave_1) entered blocking state [ 717.623685][T28244] bridge0: port 2(bridge_slave_1) entered forwarding state [ 717.655289][T28244] bridge0: entered promiscuous mode [ 717.662807][T28244] bridge0: entered allmulticast mode [ 718.016849][T28263] syzkaller0: entered promiscuous mode [ 718.041741][T28263] syzkaller0: entered allmulticast mode [ 718.157115][T28269] netlink: 'syz.1.5974': attribute type 21 has an invalid length. [ 718.165029][T28264] netlink: zone id is out of range [ 718.180403][T28264] netlink: zone id is out of range [ 718.188741][T28264] netlink: zone id is out of range [ 718.196169][T28264] netlink: zone id is out of range [ 718.204323][T28264] netlink: zone id is out of range [ 718.214465][T28264] netlink: zone id is out of range [ 718.223590][T28264] netlink: zone id is out of range [ 718.241873][T28264] netlink: zone id is out of range [ 718.256181][T28264] netlink: zone id is out of range [ 718.272513][T28264] netlink: get zone limit has 4 unknown bytes [ 718.608184][T28287] netlink: 'syz.2.5979': attribute type 1 has an invalid length. [ 718.669331][T28291] netlink: 'syz.0.5981': attribute type 2 has an invalid length. [ 718.722872][T28289] netlink: 'syz.3.5980': attribute type 12 has an invalid length. [ 719.075207][T28305] syzkaller0: entered promiscuous mode [ 719.081918][T28305] syzkaller0: entered allmulticast mode [ 719.253766][T28309] netlink: 'syz.1.5989': attribute type 10 has an invalid length. [ 719.287616][T28309] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 719.333924][T28309] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 719.350788][T28309] bond0 (unregistering): Released all slaves [ 720.089703][T28346] netlink: 'syz.3.6000': attribute type 2 has an invalid length. [ 720.098646][T28346] netlink: 'syz.3.6000': attribute type 11 has an invalid length. [ 720.111207][T28346] __nla_validate_parse: 7 callbacks suppressed [ 720.111236][T28346] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6000'. [ 720.321889][T28354] syzkaller0: entered promiscuous mode [ 720.332695][T28356] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6003'. [ 720.360127][T28354] syzkaller0: entered allmulticast mode [ 721.269644][T28399] syzkaller0: entered promiscuous mode [ 721.290074][T28399] syzkaller0: entered allmulticast mode [ 721.744114][T28416] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6021'. [ 722.478435][T28442] netlink: 'syz.1.6028': attribute type 21 has an invalid length. [ 722.486784][T28443] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 722.495050][T28442] IPv6: NLM_F_CREATE should be specified when creating new route [ 722.509166][T28440] bridge_slave_1: left allmulticast mode [ 722.535824][T28440] bridge_slave_1: left promiscuous mode [ 722.553296][T28440] bridge0: port 2(bridge_slave_1) entered disabled state [ 722.598492][T28440] bridge_slave_0: left allmulticast mode [ 722.646974][T28440] bridge_slave_0: left promiscuous mode [ 722.667086][T28440] bridge0: port 1(bridge_slave_0) entered disabled state [ 722.796572][T28449] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 722.860098][T28449] batman_adv: batadv0: Adding interface: gretap1 [ 722.913534][T28449] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 722.945390][T28449] batman_adv: batadv0: Interface activated: gretap1 [ 723.095733][T28457] netlink: 'syz.1.6032': attribute type 12 has an invalid length. [ 723.258921][T28460] netlink: 'syz.4.6034': attribute type 1 has an invalid length. [ 723.460425][T28472] ip6t_rpfilter: unknown options [ 723.725529][T28482] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6039'. [ 724.286138][T28475] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6035'. [ 724.763270][T28519] netlink: 420 bytes leftover after parsing attributes in process `syz.0.6047'. [ 724.898954][T28524] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6048'. [ 725.271194][T28530] netlink: 1788 bytes leftover after parsing attributes in process `syz.1.6051'. [ 725.388420][T28533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6050'. [ 725.435528][T28533] netlink: 14 bytes leftover after parsing attributes in process `syz.3.6050'. [ 725.978287][T28544] bond16: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-xor(2) [ 726.032690][T28544] bond16 (unregistering): Released all slaves [ 726.422472][T28558] bond7 (unregistering): Released all slaves [ 726.492661][T28570] netlink: 232 bytes leftover after parsing attributes in process `syz.3.6063'. [ 726.876642][T28588] syzkaller1: entered promiscuous mode [ 726.908363][T28588] syzkaller1: entered allmulticast mode [ 727.058270][T28598] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6067'. [ 727.883427][T28620] syzkaller0: entered promiscuous mode [ 727.889581][T28620] syzkaller0: entered allmulticast mode [ 728.247067][T28629] netlink: 'syz.0.6076': attribute type 1 has an invalid length. [ 728.274028][T28629] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.6076'. [ 728.989132][ T5623] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 729.003558][ T5623] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 729.017428][ T5623] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 729.031445][ T5623] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 729.045086][ T5623] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 729.440189][T28568] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 729.571832][T27945] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.623949][T27945] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 46186 - 0 [ 729.741793][T28658] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6083'. [ 730.011860][T28671] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6086'. [ 730.153545][T27945] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.171919][T27945] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 46186 - 0 [ 730.201322][T28683] Cannot find set identified by id 0 to match [ 730.392283][T27945] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.416530][T27945] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 46186 - 0 [ 730.448536][T28645] lo speed is unknown, defaulting to 1000 [ 730.624275][T27945] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.667038][T27945] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 46186 - 0 [ 730.751245][T28696] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6092'. [ 730.967477][T28707] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6094'. [ 731.107259][T28678] netlink: 'syz.4.6087': attribute type 13 has an invalid length. [ 731.116687][ T5623] Bluetooth: hci5: command tx timeout [ 731.592009][T27945] dvmrp0: left allmulticast mode [ 731.600495][T27945] dvmrp8: left allmulticast mode [ 731.623238][T27945] batman_adv: batadv0: Interface deactivated: gretap1 [ 732.230949][T27945] batman_adv: batadv0: Removing interface: gretap1 [ 732.358711][T27945] bond1 (unregistering): Released all slaves [ 732.378071][T27945] bond2 (unregistering): Released all slaves [ 732.407405][T27945] bond3 (unregistering): Released all slaves [ 732.426049][T27945] bond4 (unregistering): Released all slaves [ 732.445637][T27945] bond5 (unregistering): Released all slaves [ 732.473773][T27945] bond6 (unregistering): Released all slaves [ 732.499735][T27945] bond0 (unregistering): Released all slaves [ 732.927602][T27945] tipc: Left network mode [ 733.195600][ T5623] Bluetooth: hci5: command tx timeout [ 733.255130][T28776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6113'. [ 733.857569][T28804] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6121'. [ 734.190020][T28820] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6124'. [ 734.322259][T28645] bridge0: port 1(bridge_slave_0) entered blocking state [ 734.370210][T28645] bridge0: port 1(bridge_slave_0) entered disabled state [ 734.390298][T28645] bridge_slave_0: entered allmulticast mode [ 734.434167][T28645] bridge_slave_0: entered promiscuous mode [ 734.598926][T28645] bridge0: port 2(bridge_slave_1) entered blocking state [ 734.616467][T28645] bridge0: port 2(bridge_slave_1) entered disabled state [ 734.643904][T28645] bridge_slave_1: entered allmulticast mode [ 734.672559][T28645] bridge_slave_1: entered promiscuous mode [ 734.787997][T28833] ip6gre0: Caught tx_queue_len zero misconfig [ 734.794296][T28833] sch_tbf: peakrate 8 is lower than or equals to rate 7508080445633888606 ! [ 734.866006][ T5287] 8021q: adding VLAN 0 to HW filter on device eth1 [ 734.999316][T28846] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6129'. [ 735.050058][T28854] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6130'. [ 735.050202][T28645] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 735.107504][T28854] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6130'. [ 735.140036][T28645] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 735.288199][ T5623] Bluetooth: hci5: command tx timeout [ 735.530649][T28872] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6134'. [ 735.658502][T28878] netlink: 'syz.4.6134': attribute type 1 has an invalid length. [ 735.666644][T28877] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6136'. [ 735.952686][T28871] ip6tnl0: Caught tx_queue_len zero misconfig [ 736.197846][T28645] team0: Port device team_slave_0 added [ 736.238537][T28645] team0: Port device team_slave_1 added [ 736.335621][T28890] __nla_validate_parse: 2 callbacks suppressed [ 736.335655][T28890] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6139'. [ 736.428057][T28645] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 736.444468][T28894] net_ratelimit: 3 callbacks suppressed [ 736.444490][T28894] netlink: zone id is out of range [ 736.481458][T28645] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 736.521590][T28894] netlink: zone id is out of range [ 736.535946][T28894] netlink: zone id is out of range [ 736.552031][T28645] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 736.592029][T28894] netlink: zone id is out of range [ 736.626460][T28894] netlink: zone id is out of range [ 736.654135][T28894] netlink: zone id is out of range [ 736.700040][T28645] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 736.709321][T28894] netlink: zone id is out of range [ 736.752605][T28645] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 736.783117][T28894] netlink: zone id is out of range [ 736.809880][T28894] netlink: zone id is out of range [ 736.842223][T28894] netlink: zone id is out of range [ 736.883124][T28645] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 736.983440][T27945] IPVS: stop unused estimator thread 0... [ 737.303690][T28645] hsr_slave_0: entered promiscuous mode [ 737.335334][T28645] hsr_slave_1: entered promiscuous mode [ 737.348733][T28645] debugfs: 'hsr0' already exists in 'hsr' [ 737.362360][T28645] Cannot create hsr debugfs directory [ 737.365089][ T5623] Bluetooth: hci5: command tx timeout [ 737.515376][T28939] netlink: 'syz.2.6146': attribute type 1 has an invalid length. [ 737.786963][T28942] syzkaller0: entered promiscuous mode [ 737.794855][T28942] syzkaller0: entered allmulticast mode [ 738.007854][T28947] mac80211_hwsim hwsim56 wlan0: entered promiscuous mode [ 738.128010][T28956] netlink: 1204 bytes leftover after parsing attributes in process `syz.3.6150'. [ 738.143316][ T5287] 8021q: adding VLAN 0 to HW filter on device eth2 [ 738.242424][T28954] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6149'. [ 738.286715][T28954] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6149'. [ 738.527511][T28977] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6154'. [ 739.435304][ T4942] Bluetooth: hci5: command 0x0405 tx timeout [ 739.572401][T29024] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6163'. [ 739.930917][T29035] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6167'. [ 740.022613][T29043] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6168'. [ 740.057311][T29042] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6168'. [ 740.247254][T28645] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 740.300798][T28645] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 740.342677][T28645] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 740.387685][T28645] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 740.403701][T28645] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 740.434549][T28645] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 740.452029][T29055] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 740.471615][T28645] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 740.506338][T28645] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 740.661578][T29069] netlink: 'syz.2.6174': attribute type 10 has an invalid length. [ 740.694068][T29071] xt_cgroup: invalid path, errno=-2 [ 740.706806][T29069] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 740.717780][T29069] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 740.866240][T28645] 8021q: adding VLAN 0 to HW filter on device bond0 [ 740.949667][T28645] 8021q: adding VLAN 0 to HW filter on device team0 [ 741.012668][T27943] bridge0: port 1(bridge_slave_0) entered blocking state [ 741.019937][T27943] bridge0: port 1(bridge_slave_0) entered forwarding state [ 741.107547][T27943] bridge0: port 2(bridge_slave_1) entered blocking state [ 741.114762][T27943] bridge0: port 2(bridge_slave_1) entered forwarding state [ 741.306186][T29089] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6179'. [ 741.364224][T29091] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6180'. [ 741.495207][T29091] syzkaller1: entered promiscuous mode [ 741.525876][T29091] syzkaller1: entered allmulticast mode [ 741.797451][T29108] veth1_to_bond: entered allmulticast mode [ 741.843063][T29098] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6181'. [ 741.909719][T29098] veth1_to_bond (unregistering): left allmulticast mode [ 742.219714][T29124] netlink: 'syz.3.6185': attribute type 1 has an invalid length. [ 742.440063][T29124] bond1: entered promiscuous mode [ 742.486948][T29124] 8021q: adding VLAN 0 to HW filter on device bond1 [ 742.670126][T29132] 8021q: adding VLAN 0 to HW filter on device bond1 [ 742.719832][T29132] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 742.779712][T29132] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 742.828176][T29132] bond1: (slave vti0): making interface the new active one [ 742.849964][T29132] vti0: entered promiscuous mode [ 742.860695][T29132] vti0: left promiscuous mode [ 742.926658][T29143] netlink: 'syz.2.6190': attribute type 23 has an invalid length. [ 742.944338][T29147] netlink: 300 bytes leftover after parsing attributes in process `syz.4.6189'. [ 742.983469][T29150] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 743.013064][T29147] net_ratelimit: 69 callbacks suppressed [ 743.013098][T29147] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 743.148190][T29147] lo: Caught tx_queue_len zero misconfig [ 743.230797][T29164] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6192'. [ 743.260330][T29164] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 743.267641][T29164] IPv6: NLM_F_CREATE should be set when creating new route [ 743.274915][T29164] IPv6: NLM_F_CREATE should be set when creating new route [ 743.287268][T29162] vlan2: entered promiscuous mode [ 743.300715][T29162] bridge0: entered promiscuous mode [ 743.453965][T29171] netlink: 'syz.2.6194': attribute type 21 has an invalid length. [ 743.661876][T28645] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 743.746334][T29177] syzkaller0: entered promiscuous mode [ 743.782680][T29177] syzkaller0: entered allmulticast mode [ 743.895213][T29189] netlink: 'syz.3.6199': attribute type 1 has an invalid length. [ 743.898681][T29186] netlink: 336 bytes leftover after parsing attributes in process `syz.2.6197'. [ 743.971123][T29177] tipc: Enabled bearer , priority 0 [ 744.103596][T28645] veth0_vlan: entered promiscuous mode [ 744.149450][T29193] tipc: Enabling of bearer rejected, already enabled [ 744.164756][ T5623] Bluetooth: hci2: command 0x0406 tx timeout [ 744.226264][T28645] veth1_vlan: entered promiscuous mode [ 744.300166][T28645] veth0_macvtap: entered promiscuous mode [ 744.380457][T28645] veth1_macvtap: entered promiscuous mode [ 744.429992][T29176] tipc: Resetting bearer [ 744.463018][T29205] netlink: 14 bytes leftover after parsing attributes in process `syz.3.6201'. [ 744.476908][T29202] netlink: 'syz.4.6203': attribute type 1 has an invalid length. [ 744.528345][T29207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6204'. [ 744.566498][T29208] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6203'. [ 744.579388][T29176] tipc: Disabling bearer [ 744.658224][T29208] macvlan3: entered promiscuous mode [ 744.664415][T29208] macvlan3: entered allmulticast mode [ 744.687169][T29196] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6201'. [ 744.755654][T28645] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 744.788786][T28645] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 744.860207][T29216] syzkaller0: entered promiscuous mode [ 744.873232][T29216] syzkaller0: entered allmulticast mode [ 744.940301][T29221] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6206'. [ 745.135459][T27943] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 745.162519][T27943] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 745.198351][T27943] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 745.238262][T27943] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 745.701536][T27947] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.719369][T27947] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 745.921463][T29263] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 745.978957][T27943] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.999720][T27943] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 747.194051][T29304] __nla_validate_parse: 1 callbacks suppressed [ 747.194070][T29304] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6220'. [ 747.228668][T29304] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6220'. [ 747.388664][T29304] gretap1: entered promiscuous mode [ 747.428055][T29304] gretap1: entered allmulticast mode [ 748.337492][ T5623] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 748.350536][ T5623] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 748.362870][ T5623] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 748.377965][ T5623] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 748.388919][ T5623] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 748.574392][T29357] netlink: 'syz.0.6232': attribute type 32 has an invalid length. [ 748.685249][T29360] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6234'. [ 748.941531][T29375] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6236'. [ 749.019750][T29374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6236'. [ 749.108692][T29370] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 749.152680][T17459] syz_tun (unregistering): left allmulticast mode [ 749.215955][T29388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6238'. [ 749.407831][T29398] netlink: 'syz.3.6239': attribute type 4 has an invalid length. [ 749.460345][T29401] netlink: 'syz.3.6239': attribute type 4 has an invalid length. [ 749.560466][T29398] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6239'. [ 750.143678][T29349] lo speed is unknown, defaulting to 1000 [ 750.478228][ T5623] Bluetooth: hci4: command tx timeout [ 751.151798][T29463] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6252'. [ 751.172478][T29465] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6254'. [ 751.195117][T29463] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6252'. [ 751.620553][T16182] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.652914][T16182] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.823810][T29481] bond16: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 751.873059][T29481] bond16 (unregistering): Released all slaves [ 752.028074][T16182] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.038459][T29504] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 752.121766][ T6489] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.518136][T29349] bridge0: port 1(bridge_slave_0) entered blocking state [ 752.554970][ T5623] Bluetooth: hci4: command tx timeout [ 752.571037][T29349] bridge0: port 1(bridge_slave_0) entered disabled state [ 752.626766][T29349] bridge_slave_0: entered allmulticast mode [ 752.688663][T29349] bridge_slave_0: entered promiscuous mode [ 752.733101][T29349] bridge0: port 2(bridge_slave_1) entered blocking state [ 752.758303][T19928] IPVS: starting estimator thread 0... [ 752.768640][T29349] bridge0: port 2(bridge_slave_1) entered disabled state [ 752.768758][T29536] IPVS: sh: FWM 3 0x00000003 - no destination available [ 752.796095][T29349] bridge_slave_1: entered allmulticast mode [ 752.817062][T29349] bridge_slave_1: entered promiscuous mode [ 752.884809][T29537] IPVS: using max 34 ests per chain, 81600 per kthread [ 753.180765][T29550] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6267'. [ 753.216333][T29349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 753.276669][T29349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 753.499572][T29349] team0: Port device team_slave_0 added [ 753.526999][T29561] netlink: 'syz.2.6270': attribute type 5 has an invalid length. [ 753.548203][T29349] team0: Port device team_slave_1 added [ 753.674459][T29568] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6269'. [ 753.726584][T29349] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 753.767167][T29349] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 753.898299][T29349] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 753.974550][T29349] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 754.017614][T29349] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.167656][T29349] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 754.493806][T29349] hsr_slave_0: entered promiscuous mode [ 754.504034][T29349] hsr_slave_1: entered promiscuous mode [ 754.511738][T29349] debugfs: 'hsr0' already exists in 'hsr' [ 754.518373][T29349] Cannot create hsr debugfs directory [ 754.643862][ T5623] Bluetooth: hci4: command tx timeout [ 755.222979][T29629] openvswitch: netlink: Missing key (keys=40, expected=100) [ 755.366284][T29626] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 755.396196][T29626] syzkaller1: group set to 0 [ 755.607425][T29634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6283'. [ 756.214077][T29663] netlink: 7936 bytes leftover after parsing attributes in process `syz.3.6290'. [ 756.227628][T29663] openvswitch: netlink: IPv4 tunnel dst address is zero [ 756.516459][T29673] netlink: 'syz.2.6293': attribute type 10 has an invalid length. [ 756.536201][T29670] bond1: entered promiscuous mode [ 756.546537][T29670] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6292'. [ 756.563112][T29673] bond0: (slave batadv0): Releasing backup interface [ 756.713520][T29678] IPVS: length: 8 != 1152 [ 756.726291][ T5623] Bluetooth: hci4: command tx timeout [ 756.961906][T29349] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 756.987130][T29349] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 757.009023][T29349] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 757.059856][T29349] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 757.089663][T29349] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 757.112637][T29349] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 757.133743][T29349] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 757.155728][T29349] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 757.563142][T29349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 757.618768][T29349] 8021q: adding VLAN 0 to HW filter on device team0 [ 757.633937][T27947] bridge0: port 1(bridge_slave_0) entered blocking state [ 757.641178][T27947] bridge0: port 1(bridge_slave_0) entered forwarding state [ 757.670678][T27947] bridge0: port 2(bridge_slave_1) entered blocking state [ 757.677911][T27947] bridge0: port 2(bridge_slave_1) entered forwarding state [ 758.282492][T29741] bond2: entered promiscuous mode [ 758.300379][T29741] bond2: entered allmulticast mode [ 758.307388][T29741] 8021q: adding VLAN 0 to HW filter on device bond2 [ 758.622547][T29758] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6316'. [ 758.673272][T29761] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6317'. [ 758.748571][T29761] bridge0: port 2(bridge_slave_1) entered disabled state [ 759.190045][T29781] syzkaller0: entered promiscuous mode [ 759.204223][T29781] syzkaller0: entered allmulticast mode [ 759.329601][T29349] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 759.491057][T16182] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 759.504511][T29791] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 760.029161][T29818] sctp: [Deprecated]: syz.3.6329 (pid 29818) Use of int in maxseg socket option. [ 760.029161][T29818] Use struct sctp_assoc_value instead [ 760.459624][T29349] veth0_vlan: entered promiscuous mode [ 760.551174][T29349] veth1_vlan: entered promiscuous mode [ 760.665187][T29848] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6338'. [ 760.679408][T29852] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6337'. [ 760.733688][T29838] syzkaller0: entered promiscuous mode [ 760.756919][T29838] syzkaller0: entered allmulticast mode [ 764.183803][T16184] pim6reg: left allmulticast mode [ 764.199006][T16184] pim6reg527: left allmulticast mode [ 764.224384][T16184] pimreg: left allmulticast mode [ 764.460436][T16184] bond11 (unregistering): (slave ip6gretap2): Releasing active interface [ 764.719239][T16184] bond4 (unregistering): (slave gretap0): Releasing backup interface [ 764.821125][T16184] team0: Port device geneve4 removed [ 764.838116][T16184] bond2 (unregistering): (slave geneve2): Releasing active interface [ 764.908254][T16184] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 764.916528][T16184] bridge2 (unregistering): left promiscuous mode [ 765.049666][T16184] bond0 (unregistering): (slave bond6): Releasing backup interface [ 765.063703][T16184] bond6 (unregistering): left promiscuous mode [ 765.070561][T16184] bond6 (unregistering): left allmulticast mode [ 765.077267][T16184] bond0 (unregistering): Released all slaves [ 765.101847][T16184] bond1 (unregistering): Released all slaves [ 765.133940][T16184] bond2 (unregistering): Released all slaves [ 765.153064][T16184] bond3 (unregistering): Released all slaves [ 765.173263][T16184] bond4 (unregistering): (slave bond5): Releasing backup interface [ 765.192508][T16184] bond4 (unregistering): Released all slaves [ 765.212760][T16184] bond5 (unregistering): Released all slaves [ 765.231933][T16184] bond6 (unregistering): Released all slaves [ 765.250688][T16184] bond7 (unregistering): Released all slaves [ 765.282758][T16184] bond8 (unregistering): Released all slaves [ 765.302494][T16184] bond9 (unregistering): Released all slaves [ 765.322737][T16184] bond10 (unregistering): Released all slaves [ 765.353921][T16184] bond11 (unregistering): Released all slaves [ 765.379061][T29873] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 765.390661][T29881] bridge0: port 1(ipvlan0) entered blocking state [ 765.422265][T29881] bridge0: port 1(ipvlan0) entered disabled state [ 765.439944][T29881] ipvlan0: entered allmulticast mode [ 765.461565][T29881] ipvlan0: left allmulticast mode [ 765.618552][T16184] tipc: Disabling bearer [ 765.680400][T16184] tipc: Left network mode [ 765.747426][T29349] veth0_macvtap: entered promiscuous mode [ 765.803338][T29349] veth1_macvtap: entered promiscuous mode [ 765.860977][T29907] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6351'. [ 765.911405][T29349] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 765.969516][T29349] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 766.086954][T29909] syzkaller0: entered promiscuous mode [ 766.106155][T29909] syzkaller0: entered allmulticast mode [ 766.137558][T27947] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.165275][ T6489] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.267265][T29924] x_tables: duplicate underflow at hook 2 [ 766.313182][ T6489] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.356272][ T6489] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.688362][T29948] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6361'. [ 766.948088][T29947] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6362'. [ 767.102217][T16184] hsr_slave_0: left promiscuous mode [ 767.116075][T16184] hsr_slave_1: left promiscuous mode [ 767.216408][T16184] veth1_vlan: left allmulticast mode [ 767.261564][T29972] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6367'. [ 768.494920][T29961] veth1_to_bond: entered allmulticast mode [ 768.499114][ T6489] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.519008][ T6489] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.622320][T29961] veth1_to_bond: left allmulticast mode [ 768.741793][T29997] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6371'. [ 768.755841][T27945] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.783678][T27945] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.815247][T30000] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6371'. [ 768.869044][T30000] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6371'. [ 768.948859][T30009] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6374'. [ 769.639693][T30033] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 769.735366][ T4942] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 769.757082][ T4942] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 769.768469][ T4942] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 769.778829][ T4942] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 769.793003][ T4942] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 769.941413][T30050] netlink: 'syz.3.6385': attribute type 10 has an invalid length. [ 769.992826][T30050] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6385'. [ 770.033776][T30050] team0: entered allmulticast mode [ 770.059834][T30050] team_slave_0: entered allmulticast mode [ 770.094784][T30050] team_slave_1: entered allmulticast mode [ 770.123347][T30050] bridge0: port 3(team0) entered blocking state [ 770.151410][T30050] bridge0: port 3(team0) entered disabled state [ 770.169908][T30050] team0: entered promiscuous mode [ 770.176505][T30050] team_slave_0: entered promiscuous mode [ 770.183652][T30050] team_slave_1: entered promiscuous mode [ 770.406522][T30062] netlink: 'syz.3.6388': attribute type 2 has an invalid length. [ 770.421944][T30065] xt_hashlimit: size too large, truncated to 1048576 [ 770.499077][T30067] xt_CT: You must specify a L4 protocol and not use inversions on it [ 770.522038][T30069] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.538340][T30062] netlink: 'syz.3.6388': attribute type 2 has an invalid length. [ 770.589899][T30073] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6391'. [ 770.604469][T30069] bridge_slave_0 (unregistering): left allmulticast mode [ 770.644215][T30069] bridge_slave_0 (unregistering): left promiscuous mode [ 770.665477][T30069] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.953942][T16182] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.193923][T16182] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.369837][T30090] x_tables: duplicate underflow at hook 1 [ 771.528251][T30104] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6398'. [ 771.542477][T16182] bond0: (slave netdevsim1): Releasing backup interface [ 771.577576][T16182] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.597212][T30037] lo speed is unknown, defaulting to 1000 [ 771.673989][T16182] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.809992][T30109] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6400'. [ 771.848349][ T4942] Bluetooth: hci3: command tx timeout [ 771.871309][T30115] netlink: 'syz.3.6402': attribute type 4 has an invalid length. [ 772.229142][T30124] gretap2: entered promiscuous mode [ 772.377714][T30135] IPVS: set_ctl: invalid protocol: 25647 0.0.0.0:12148 [ 772.558384][T30141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6408'. [ 772.948722][T30141] syzkaller0: entered promiscuous mode [ 772.970443][T30141] syzkaller0: entered allmulticast mode [ 773.022193][T30150] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6409'. [ 773.083340][T30163] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 773.283200][T30161] syzkaller0: entered promiscuous mode [ 773.290981][T30161] syzkaller0: entered allmulticast mode [ 773.348766][T30172] xt_CT: You must specify a L4 protocol and not use inversions on it [ 773.915138][ T4942] Bluetooth: hci3: command tx timeout [ 773.921346][T16182] bond5 (unregistering): (slave gretap1): Releasing backup interface [ 774.019901][T16182] bond2 (unregistering): (slave bridge3): Releasing backup interface [ 774.106225][T16182] bond0 (unregistering): Released all slaves [ 774.121068][T16182] bond1 (unregistering): Released all slaves [ 774.141571][T16182] bond2 (unregistering): Released all slaves [ 774.161609][T16182] bond3 (unregistering): Released all slaves [ 774.186006][T16182] bond4 (unregistering): Released all slaves [ 774.208845][T16182] bond5 (unregistering): (slave bond6): Releasing backup interface [ 774.228696][T16182] bond5 (unregistering): Released all slaves [ 774.253659][T16182] bond6 (unregistering): Released all slaves [ 774.272902][T16182] bond7 (unregistering): Released all slaves [ 774.301907][T16182] bond8 (unregistering): Released all slaves [ 774.320994][T16182] bond9 (unregistering): Released all slaves [ 775.996639][ T4942] Bluetooth: hci3: command tx timeout [ 777.229458][T30184] sit0: entered promiscuous mode [ 777.251893][T30184] netlink: 'syz.3.6414': attribute type 1 has an invalid length. [ 777.274007][T30184] netlink: 1 bytes leftover after parsing attributes in process `syz.3.6414'. [ 777.306277][ T5287] 8021q: adding VLAN 0 to HW filter on device eth1 [ 777.360865][T30194] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6416'. [ 777.371688][T30194] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6416'. [ 777.445347][T16184] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.508297][T16184] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.532641][T30194] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 777.619163][T16184] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.646942][T16184] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 777.694518][T30037] bridge0: port 1(bridge_slave_0) entered blocking state [ 777.720803][T30037] bridge0: port 1(bridge_slave_0) entered disabled state [ 777.736820][T30037] bridge_slave_0: entered allmulticast mode [ 777.758135][T30037] bridge_slave_0: entered promiscuous mode [ 777.792138][T30037] bridge0: port 2(bridge_slave_1) entered blocking state [ 777.809971][T30037] bridge0: port 2(bridge_slave_1) entered disabled state [ 777.823174][T30037] bridge_slave_1: entered allmulticast mode [ 777.848635][T30037] bridge_slave_1: entered promiscuous mode [ 777.902706][T30224] openvswitch: netlink: Missing key (keys=40, expected=100) [ 777.919682][T16182] tipc: Left network mode [ 778.037968][T30037] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 778.078203][ T4942] Bluetooth: hci3: command tx timeout [ 778.121701][T30037] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 778.198978][T30226] netlink: 256 bytes leftover after parsing attributes in process `syz.3.6424'. [ 778.388504][T30037] team0: Port device team_slave_0 added [ 778.443502][T30226] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6424'. [ 778.491758][T30037] team0: Port device team_slave_1 added [ 778.726674][T30246] sctp: [Deprecated]: syz.4.6427 (pid 30246) Use of struct sctp_assoc_value in delayed_ack socket option. [ 778.726674][T30246] Use struct sctp_sack_info instead [ 778.810955][T30037] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 778.836819][T30037] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 778.906909][T30037] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 778.941119][T30257] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6429'. [ 778.970266][T30257] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6429'. [ 778.989758][T30256] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6429'. [ 779.014464][T30256] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6429'. [ 779.040994][T30037] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 779.062725][T30037] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 779.107909][T30037] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 779.481297][T30279] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6434'. [ 779.560488][T30037] hsr_slave_0: entered promiscuous mode [ 779.576262][T30037] hsr_slave_1: entered promiscuous mode [ 779.598860][T30037] debugfs: 'hsr0' already exists in 'hsr' [ 779.615688][T30037] Cannot create hsr debugfs directory [ 779.725088][ T5287] 8021q: adding VLAN 0 to HW filter on device eth2 [ 780.438990][T30303] netlink: 'syz.0.6440': attribute type 2 has an invalid length. [ 780.875134][ T4942] Bluetooth: hci3: command 0x0405 tx timeout [ 781.458399][T16182] hsr_slave_0: left promiscuous mode [ 781.504090][T16182] hsr_slave_1: left promiscuous mode [ 782.919972][ T5287] 8021q: adding VLAN 0 to HW filter on device eth3 [ 782.967647][ C0] IPv4: Oversized IP packet from 127.0.0.1 [ 783.783759][T30400] netlink: 'syz.0.6459': attribute type 1 has an invalid length. [ 783.794999][T30400] netlink: 'syz.0.6459': attribute type 2 has an invalid length. [ 784.247933][T16182] IPVS: stop unused estimator thread 0... [ 784.512984][T30427] netlink: 'syz.3.6465': attribute type 1 has an invalid length. [ 785.140757][T30434] bond3: (slave gretap3): making interface the new active one [ 785.176785][T30434] bond3: (slave gretap3): Enslaving as an active interface with an up link [ 785.513647][T30037] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 785.568077][T30037] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 785.656040][T30467] team0: Device ipvlan2 is already an upper device of the team interface [ 785.781197][T30037] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 785.826503][T30037] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 785.864374][T30037] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 785.925537][T30037] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 785.976743][T30037] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 786.030606][T30037] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 786.659831][T30037] 8021q: adding VLAN 0 to HW filter on device bond0 [ 786.809954][T30037] 8021q: adding VLAN 0 to HW filter on device team0 [ 786.885421][T16182] bridge0: port 1(bridge_slave_0) entered blocking state [ 786.892872][T16182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 786.980160][T16182] bridge0: port 2(bridge_slave_1) entered blocking state [ 786.987396][T16182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 787.965618][ T5623] block nbd3: Receive control failed (result -32) [ 788.020446][T16183] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 788.077150][T16183] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 788.284316][T30568] __nla_validate_parse: 6 callbacks suppressed [ 788.284338][T30568] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6487'. [ 788.591067][T30582] netlink: 96 bytes leftover after parsing attributes in process `syz.4.6491'. [ 788.618417][T30583] netlink: 156 bytes leftover after parsing attributes in process `syz.1.6490'. [ 788.977094][T30589] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6492'. [ 789.011534][T30589] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6492'. [ 789.053203][T30600] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6494'. [ 789.090904][T30037] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 789.414257][T30037] veth0_vlan: entered promiscuous mode [ 789.478398][T30615] sit0: entered promiscuous mode [ 789.532752][T30615] netlink: 'syz.0.6498': attribute type 1 has an invalid length. [ 789.566994][T30615] netlink: 1 bytes leftover after parsing attributes in process `syz.0.6498'. [ 789.657732][T30621] bond0: entered promiscuous mode [ 789.684282][T30621] bond_slave_0: entered promiscuous mode [ 789.705058][T30621] bond_slave_1: entered promiscuous mode [ 789.723956][T30621] batadv0: entered promiscuous mode [ 789.778275][T30621] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 789.802651][T30621] bond0: left promiscuous mode [ 789.809705][T30621] bond_slave_0: left promiscuous mode [ 789.816209][T30621] bond_slave_1: left promiscuous mode [ 789.833747][T30621] batadv0: left promiscuous mode [ 789.875649][T30626] veth3: entered allmulticast mode [ 789.893994][T30634] netlink: 156 bytes leftover after parsing attributes in process `syz.3.6504'. [ 789.914369][T30634] netlink: 156 bytes leftover after parsing attributes in process `syz.3.6504'. [ 789.958574][T30037] veth1_vlan: entered promiscuous mode [ 790.140042][T30037] veth0_macvtap: entered promiscuous mode [ 790.283819][T30037] veth1_macvtap: entered promiscuous mode [ 790.297105][T30649] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.6507'. [ 790.330750][T30037] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 790.369793][T30037] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 790.420853][T16183] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.458135][T16183] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.508053][T16183] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.549564][T16183] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.764337][T16184] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.808044][T16184] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.919392][T16182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.959424][T16182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 791.721848][T30688] netlink: 'syz.3.6518': attribute type 12 has an invalid length. [ 791.859620][T30688] bond4: option primary_reselect: invalid value (255) [ 791.940294][T30688] bond4 (unregistering): Released all slaves [ 791.948903][T30700] netlink: 'syz.4.6521': attribute type 1 has an invalid length. [ 792.222847][ T4942] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 792.231567][T30700] bond1: entered promiscuous mode [ 792.243182][ T4942] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 792.256721][ T4942] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 792.268951][T30700] 8021q: adding VLAN 0 to HW filter on device bond1 [ 792.278976][ T4942] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 792.295974][ T4942] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 792.341122][T30706] bond1: entered allmulticast mode [ 792.404212][T30700] netlink: 'syz.4.6521': attribute type 2 has an invalid length. [ 792.451771][T30700] netlink: 'syz.4.6521': attribute type 1 has an invalid length. [ 792.468326][T30713] bond1: (slave bridge2): making interface the new active one [ 792.504574][T30713] bridge2: entered promiscuous mode [ 792.549278][T30713] bridge2: entered allmulticast mode [ 792.621208][T30713] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 793.001719][T18069] bond4: (slave syz_tun): Removing an active aggregator [ 793.009179][T16180] bond4: Warning: Found an uninitialized port [ 793.026588][T18069] bond4: (slave syz_tun): Releasing backup interface [ 793.040510][ T29] audit: type=1800 audit(1782772727.421:17): pid=30745 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.6529" name="memory.events" dev="tmpfs" ino=225 res=0 errno=0 [ 793.084065][T30746] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 793.399387][T30714] lo speed is unknown, defaulting to 1000 [ 793.943533][T30714] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.952080][T30714] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.961289][T30714] bridge_slave_0: entered allmulticast mode [ 793.972163][T30714] bridge_slave_0: entered promiscuous mode [ 793.985441][T30714] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.993828][T30714] bridge0: port 2(bridge_slave_1) entered disabled state [ 794.003037][T30714] bridge_slave_1: entered allmulticast mode [ 794.013754][T30714] bridge_slave_1: entered promiscuous mode [ 794.089253][T30714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 794.106613][T30714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 794.178670][T30714] team0: Port device team_slave_0 added [ 794.196064][T30714] team0: Port device team_slave_1 added [ 794.258659][T30714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 794.266408][T30714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 794.293159][T30714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 794.307643][T30714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 794.315858][T30714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 794.343810][T30714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 794.356927][T30773] tc_dump_action: action bad kind [ 794.372185][T30774] __nla_validate_parse: 5 callbacks suppressed [ 794.372203][T30774] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6533'. [ 794.395144][ T5623] Bluetooth: hci0: command tx timeout [ 794.443952][T30714] hsr_slave_0: entered promiscuous mode [ 794.458009][T30714] hsr_slave_1: entered promiscuous mode [ 794.466542][T30714] debugfs: 'hsr0' already exists in 'hsr' [ 794.472937][T30714] Cannot create hsr debugfs directory [ 794.709599][T30783] netlink: 'syz.2.6536': attribute type 6 has an invalid length. [ 794.733614][T30714] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.744931][T30714] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.825150][T30714] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.835171][T30714] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.905368][T30714] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.915202][T30714] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.947856][T30714] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.958745][T30714] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.354893][ T5623] Bluetooth: hci1: command 0x041b tx timeout [ 795.533927][T30731] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 795.588337][T30714] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 795.639507][T30714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 795.679021][T30714] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 795.716818][T30714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 795.735390][T30714] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 795.777128][T30714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 795.806864][T30714] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 795.855961][T30795] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6540'. [ 795.856208][T30714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 795.970822][T30792] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 796.016399][T30792] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 796.044201][T30792] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 796.177521][T30714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 796.206444][T30714] 8021q: adding VLAN 0 to HW filter on device team0 [ 796.222097][T27943] bridge0: port 1(bridge_slave_0) entered blocking state [ 796.229327][T27943] bridge0: port 1(bridge_slave_0) entered forwarding state [ 796.260466][T27943] bridge0: port 2(bridge_slave_1) entered blocking state [ 796.267686][T27943] bridge0: port 2(bridge_slave_1) entered forwarding state [ 796.476965][ T4942] Bluetooth: hci0: command tx timeout [ 796.813003][T30830] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6546'. [ 796.858627][T30830] netlink: 'syz.4.6546': attribute type 83 has an invalid length. [ 796.862530][T30833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6547'. [ 796.880892][T30833] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 796.890587][T30833] netlink: 152 bytes leftover after parsing attributes in process `syz.1.6547'. [ 796.971252][T30833] xt_ecn: cannot match TCP bits for non-tcp packets [ 797.121590][T30841] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6550'. [ 797.563326][T30714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 797.664304][T30714] veth0_vlan: entered promiscuous mode [ 797.732276][T30714] veth1_vlan: entered promiscuous mode [ 797.777098][T30867] syzkaller0: entered promiscuous mode [ 797.782811][T30867] syzkaller0: entered allmulticast mode [ 797.792453][T30867] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6555'. [ 797.882259][T30714] veth0_macvtap: entered promiscuous mode [ 797.895011][T30714] veth1_macvtap: entered promiscuous mode [ 797.929697][T30872] ipvlan2: entered promiscuous mode [ 798.006718][T30714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 798.048637][T30714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 798.078174][T27944] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.089967][T27944] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.107831][T27944] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.117272][T27944] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.365313][T27944] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 798.400221][T27944] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.513956][T27943] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 798.544011][T27943] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.555008][ T4942] Bluetooth: hci0: command tx timeout [ 798.793571][T30897] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6565'. [ 799.212606][T30927] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6573'. [ 799.239963][T30925] nbd: must specify a device to reconfigure [ 799.441359][T30933] workqueue: Failed to create a rescuer kthread for wq "nfc6_nci_cmd_wq": -EINTR [ 799.857900][T30964] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6579'. [ 799.970275][T30966] tipc: Started in network mode [ 799.988090][T30966] tipc: Node identity 6eeb881c702d, cluster identity 4711 [ 800.012505][T30966] tipc: Enabled bearer , priority 0 [ 800.041648][T30971] syzkaller0: entered promiscuous mode [ 800.051964][T30972] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6582'. [ 800.062216][T30971] syzkaller0: entered allmulticast mode [ 800.074840][T30966] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 800.167309][T30966] tipc: Resetting bearer [ 800.190179][T30981] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6585'. [ 800.306155][T30965] tipc: Resetting bearer [ 800.365708][T30965] tipc: Disabling bearer [ 800.635325][ T4942] Bluetooth: hci0: command tx timeout [ 800.698435][T31009] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6589'. [ 800.713017][T31008] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6589'. [ 801.126723][T31026] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 801.465329][T31039] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6598'. [ 801.524241][T31038] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6597'. [ 801.712041][T31048] vlan2: entered allmulticast mode [ 801.718057][T31048] bond0: entered allmulticast mode [ 801.723265][T31048] bond_slave_0: entered allmulticast mode [ 801.732695][T31048] bond_slave_1: entered allmulticast mode [ 801.982770][T31055] tipc: Started in network mode [ 802.001114][T31055] tipc: Node identity fc, cluster identity 4711 [ 802.013200][T31063] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6603'. [ 802.023996][T31055] tipc: Enabling of bearer rejected, failed to enable media [ 802.040563][T31063] netlink: 216 bytes leftover after parsing attributes in process `syz.2.6603'. [ 802.056785][T31063] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6603'. [ 802.432360][T31082] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input6 [ 802.669420][T31098] netlink: 'syz.1.6611': attribute type 3 has an invalid length. [ 802.712670][T31098] netlink: 'syz.1.6611': attribute type 1 has an invalid length. [ 803.742325][T31149] vlan0: entered promiscuous mode [ 803.896118][T31157] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 804.248870][T31164] netlink: 'syz.0.6629': attribute type 11 has an invalid length. [ 804.579956][T31188] netlink: 'syz.4.6636': attribute type 32 has an invalid length. [ 804.664212][T31188] bond2: Setting coupled_control to off (0) [ 804.813105][T31202] ip6t_srh: unknown srh match flags 4000 [ 804.865477][T25421] IPVS: starting estimator thread 0... [ 804.908003][T31205] bond2: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 804.938810][T31205] bond2 (unregistering): Released all slaves [ 804.977478][T31211] IPVS: using max 32 ests per chain, 76800 per kthread [ 805.184498][T31227] __nla_validate_parse: 10 callbacks suppressed [ 805.184520][T31227] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6648'. [ 805.192078][T31228] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6649'. [ 805.223735][T31228] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6649'. [ 805.368801][T31232] batadv0: entered promiscuous mode [ 805.377391][T31233] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6651'. [ 805.388397][T31232] macsec1: entered promiscuous mode [ 805.389020][T31233] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6651'. [ 805.396108][T31232] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 805.414942][T31233] block nbd4: Unsupported socket: should be TCP or UNIX. [ 805.427661][T31232] batadv0: left promiscuous mode [ 805.470117][T31239] netlink: 9 bytes leftover after parsing attributes in process `syz.3.6653'. [ 805.490406][T31235] ip6gre1: entered allmulticast mode [ 805.497933][T31239] 0·: renamed from hsr0 (while UP) [ 805.534078][T31239] 0·: entered allmulticast mode [ 805.550100][T31239] hsr_slave_0: entered allmulticast mode [ 805.577436][T31239] hsr_slave_1: entered allmulticast mode [ 805.605813][T31239] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 805.644052][T31248] SET target dimension over the limit! [ 805.667725][T31248] team0: Cannot enslave team device to itself [ 805.723253][T31256] netlink: 'syz.2.6655': attribute type 1 has an invalid length. [ 805.784190][T31261] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 805.902443][T31263] bond1: (slave bridge1): making interface the new active one [ 805.912310][T31263] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 805.931075][T31266] lo speed is unknown, defaulting to 1000 [ 805.938194][T31266] lo speed is unknown, defaulting to 1000 [ 805.943973][T31258] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 806.009890][T31266] lo speed is unknown, defaulting to 1000 [ 806.042099][T31266] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 806.088450][T31266] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 806.125644][T31266] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 806.153539][T31266] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 806.206829][T31266] lo speed is unknown, defaulting to 1000 [ 806.216888][T31266] lo speed is unknown, defaulting to 1000 [ 806.229341][T31266] lo speed is unknown, defaulting to 1000 [ 806.241800][T31266] lo speed is unknown, defaulting to 1000 [ 806.253953][T31266] lo speed is unknown, defaulting to 1000 [ 806.262505][T31266] lo speed is unknown, defaulting to 1000 [ 806.271437][T31266] lo speed is unknown, defaulting to 1000 [ 806.279316][T31266] lo speed is unknown, defaulting to 1000 [ 806.390809][T31288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6663'. [ 806.446908][T31288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6663'. [ 808.602144][T31245] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 808.612465][T31262] netlink: 'syz.3.6657': attribute type 1 has an invalid length. [ 808.622575][T31262] netlink: 'syz.3.6657': attribute type 3 has an invalid length. [ 808.631882][T31262] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6657'. [ 808.921195][T31314] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 808.961781][T31312] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6668'. [ 808.981643][T31310] bond2: entered promiscuous mode [ 809.041742][T31309] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 809.390856][T31338] bridge: RTM_NEWNEIGH with invalid state 0x10 [ 809.412639][T31340] netlink: 'syz.4.6676': attribute type 7 has an invalid length. [ 809.440809][T31340] netlink: 'syz.4.6676': attribute type 8 has an invalid length. [ 809.801600][T16190] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 810.306013][T31388] lo speed is unknown, defaulting to 1000 [ 810.313491][T31388] lo speed is unknown, defaulting to 1000 [ 810.367089][T31346] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 810.932897][T31400] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 810.956504][T31419] __nla_validate_parse: 3 callbacks suppressed [ 810.956541][T31419] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6701'. [ 811.182587][T31429] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6704'. [ 811.210951][T31429] netlink: 'syz.2.6704': attribute type 7 has an invalid length. [ 811.231751][T31429] netlink: 'syz.2.6704': attribute type 8 has an invalid length. [ 811.251924][T31435] netlink: 'syz.3.6706': attribute type 21 has an invalid length. [ 811.261103][T31429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6704'. [ 811.271508][T31435] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6706'. [ 811.284061][T31436] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6704'. [ 811.286338][T31435] netlink: 3 bytes leftover after parsing attributes in process `syz.3.6706'. [ 811.549457][T31440] bond1 (unregistering): Released all slaves [ 811.581142][T31450] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6711'. [ 811.729085][T31454] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6713'. [ 811.740187][T31452] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6713'. [ 812.110559][ T29] audit: type=1804 audit(1782772746.491:18): pid=31472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.6717" name="/newroot/216/cgroup.controllers" dev="tmpfs" ino=1122 res=1 errno=0 [ 812.137676][ T29] audit: type=1800 audit(1782772746.491:19): pid=31472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.6717" name="cgroup.controllers" dev="tmpfs" ino=1122 res=0 errno=0 [ 812.867261][T31496] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6722'. [ 813.286311][T31517] bridge3: entered promiscuous mode [ 813.292275][T31517] bridge3: entered allmulticast mode [ 813.432400][T31526] tunl0: entered promiscuous mode [ 813.450873][T31526] netlink: 'syz.1.6731': attribute type 4 has an invalid length. [ 814.192584][T31575] veth1_macvtap: left promiscuous mode [ 814.203047][T31575] macsec0: entered promiscuous mode [ 814.208900][T31575] macsec0: entered allmulticast mode [ 814.225664][T31575] veth1_macvtap: entered promiscuous mode [ 814.231660][T31575] veth1_macvtap: entered allmulticast mode [ 814.248900][T31575] macsec0: left promiscuous mode [ 814.255485][T31575] macsec0: left allmulticast mode [ 814.261293][T31575] veth1_macvtap: left allmulticast mode [ 814.345915][T31577] netlink: 'syz.4.6742': attribute type 30 has an invalid length. [ 814.522039][T31577] bond3: option arp_missed_max: invalid value (0) [ 814.534047][T31577] bond3: option arp_missed_max: allowed values 1 - 255 [ 814.557171][T31577] bond3 (unregistering): Released all slaves [ 814.849019][T31601] xt_ecn: cannot match TCP bits for non-tcp packets [ 815.121551][T31609] xt_hashlimit: overflow, try lower: 3/0 [ 816.501483][T31536] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 816.832645][T31646] Bluetooth: MGMT ver 1.23 [ 817.349407][T31673] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 817.548805][T31677] netlink: 'syz.1.6771': attribute type 5 has an invalid length. [ 817.585150][T31686] __nla_validate_parse: 3 callbacks suppressed [ 817.585185][T31686] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6773'. [ 817.604952][T31689] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6776'. [ 817.614468][T31690] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6776'. [ 818.022820][T31712] sctp: [Deprecated]: syz.1.6781 (pid 31712) Use of struct sctp_assoc_value in delayed_ack socket option. [ 818.022820][T31712] Use struct sctp_sack_info instead [ 818.146196][T31719] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6783'. [ 818.206322][T31710] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 818.498793][T31736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6789'. [ 818.522892][T31710] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 818.590108][T31736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6789'. [ 818.706529][T31728] syzkaller0: entered promiscuous mode [ 818.712298][T31728] syzkaller0: entered allmulticast mode [ 818.734266][T31736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6789'. [ 818.803962][T31710] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 818.830418][T31736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6789'. [ 822.038586][T31710] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 822.190085][T31764] syzkaller0: entered promiscuous mode [ 822.210960][T31764] syzkaller0: entered allmulticast mode [ 822.440622][T31764] tipc: Started in network mode [ 822.446912][T31764] tipc: Node identity be0e4e9d4412, cluster identity 4711 [ 822.457056][T31764] tipc: Enabled bearer , priority 0 [ 822.467992][T16184] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 822.510267][T16190] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 822.546181][T31763] tipc: Resetting bearer [ 822.588996][T31763] tipc: Disabling bearer [ 822.609977][T31786] openvswitch: netlink: Flow actions attr not present in new flow. [ 822.637238][T31789] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6804'. [ 822.683979][T27942] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 822.741658][T16190] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 823.021820][T31805] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6808'. [ 823.206380][T31813] bond2: option all_slaves_active: invalid value (222) [ 823.244349][T31813] bond2 (unregistering): Released all slaves [ 823.287516][T31820] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6813'. [ 823.311232][T31784] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 823.552180][T31830] bridge0: port 2(bridge_slave_1) entered disabled state [ 823.562174][T31830] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.664983][T31835] block nbd4: server does not support multiple connections per device. [ 823.693563][T31838] openvswitch: netlink: Missing key (keys=40, expected=100) [ 823.731652][T31835] block nbd4: shutting down sockets [ 823.813522][T31848] netlink: 46 bytes leftover after parsing attributes in process `syz.1.6821'. [ 824.153384][T16190] pim6reg527: left allmulticast mode [ 824.392427][T31871] Cannot find del_set index 0 as target [ 824.638490][ T5623] Bluetooth: hci0: command 0x080f tx timeout [ 824.714537][T16190] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 824.728545][T16190] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 824.742344][T16190] bond0 (unregistering): Released all slaves [ 824.755428][T16190] bond1 (unregistering): Released all slaves [ 824.775518][T16190] bond2 (unregistering): Released all slaves [ 824.794359][T16190] bond3 (unregistering): Released all slaves [ 824.823587][T16190] bond4 (unregistering): Released all slaves [ 824.849273][T16190] bond5 (unregistering): Released all slaves [ 825.027159][T16190] tipc: Left network mode [ 825.426139][T31895] netlink: 'syz.3.6834': attribute type 39 has an invalid length. [ 825.675847][T31908] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6838'. [ 825.836931][T31914] netlink: 'syz.1.6840': attribute type 9 has an invalid length. [ 825.849054][T31914] netlink: 'syz.1.6840': attribute type 6 has an invalid length. [ 825.888900][T31915] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6839'. [ 825.900212][T31915] netlink: 2 bytes leftover after parsing attributes in process `syz.4.6839'. [ 826.212412][T16190] hsr_slave_0: left promiscuous mode [ 826.248390][T16190] hsr_slave_1: left promiscuous mode [ 826.274067][T16190] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 826.316120][T16190] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 826.494182][T31941] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 826.572959][T31951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6850'. [ 826.688873][T31959] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6850'. [ 826.716707][ T5623] Bluetooth: hci0: command 0x080f tx timeout [ 826.810086][T31959] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6850'. [ 827.579392][T31951] macvlan2: entered promiscuous mode [ 827.584981][T31951] macvlan2: entered allmulticast mode [ 827.842807][T31982] __nla_validate_parse: 2 callbacks suppressed [ 827.842826][T31982] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6855'. [ 827.880566][T31985] bridge3: entered promiscuous mode [ 827.886179][T31985] bridge3: entered allmulticast mode [ 828.132556][T16190] IPVS: stop unused estimator thread 0... [ 828.193728][T31991] netlink: 'syz.0.6856': attribute type 21 has an invalid length. [ 828.217487][T31991] netlink: 128 bytes leftover after parsing attributes in process `syz.0.6856'. [ 828.258557][T31991] netlink: 3 bytes leftover after parsing attributes in process `syz.0.6856'. [ 828.282667][T31998] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6859'. [ 828.302153][T31998] netlink: 35 bytes leftover after parsing attributes in process `syz.4.6859'. [ 828.329322][T31998] netlink: 'syz.4.6859': attribute type 5 has an invalid length. [ 828.354751][T31998] netlink: 'syz.4.6859': attribute type 6 has an invalid length. [ 828.381231][T32001] xt_TCPMSS: Only works on TCP SYN packets [ 828.404974][T31998] netlink: 35 bytes leftover after parsing attributes in process `syz.4.6859'. [ 828.699006][T32015] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6864'. [ 828.728856][T32009] netlink: 'syz.3.6862': attribute type 8 has an invalid length. [ 828.740424][T32011] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6864'. [ 828.753123][T32009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6862'. [ 829.258595][T32034] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 829.338664][T32040] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 829.468117][T32044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6876'. [ 829.904440][T32059] batadv_slave_0: entered promiscuous mode [ 829.925115][T32059] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 830.082560][T32059] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 830.421343][T32077] bond4: (slave bridge5): Enslaving as an active interface with an up link [ 831.212969][T32105] netlink: 'syz.1.6896': attribute type 11 has an invalid length. [ 831.331355][T32108] TCP: TCP_TX_DELAY enabled [ 831.353400][T32108] netlink: 'syz.0.6895': attribute type 1 has an invalid length. [ 831.412694][T32108] bond1: entered promiscuous mode [ 831.418697][T32108] 8021q: adding VLAN 0 to HW filter on device bond1 [ 831.636192][T32108] bond1: (slave bridge2): making interface the new active one [ 831.655863][T32108] bridge2: entered promiscuous mode [ 831.680219][T32108] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 831.708847][T16183] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 831.721432][T16183] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 831.740025][T16183] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 831.803951][T32126] netlink: 'syz.3.6902': attribute type 1 has an invalid length. [ 831.822652][T16183] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 831.942806][T32126] 8021q: adding VLAN 0 to HW filter on device bond5 [ 831.951656][T32133] netlink: 'syz.1.6904': attribute type 4 has an invalid length. [ 831.966100][T32133] netlink: 'syz.1.6904': attribute type 1 has an invalid length. [ 832.221909][T32126] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 832.271858][T32126] macvlan2: entered promiscuous mode [ 832.277350][T32126] macvlan2: entered allmulticast mode [ 832.283560][T32126] bond5: entered promiscuous mode [ 832.291743][T32126] veth0_to_bond: entered promiscuous mode [ 832.301968][T32126] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 832.315793][T25421] page_pool_release_retry() stalled pool shutdown: id 183, 1 inflight 60 sec [ 832.326947][T32126] bond5: left promiscuous mode [ 832.335426][T32126] veth0_to_bond: left promiscuous mode [ 832.364434][T32142] bridge3: port 1(dummy0) entered blocking state [ 832.372441][T32142] bridge3: port 1(dummy0) entered disabled state [ 832.379803][T32142] dummy0: entered allmulticast mode [ 832.389884][T32142] dummy0: entered promiscuous mode [ 832.593023][T32157] netlink: zone id is out of range [ 832.609673][T32157] netlink: del zone limit has 4 unknown bytes [ 832.714339][T32156] syzkaller1: entered promiscuous mode [ 832.721397][T32156] syzkaller1: entered allmulticast mode [ 832.741318][T32172] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 832.786626][T32156] netlink: 'syz.2.6912': attribute type 13 has an invalid length. [ 833.313715][T32194] __nla_validate_parse: 14 callbacks suppressed [ 833.313735][T32194] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6922'. [ 833.405953][T32202] bond0: mtu less than device minimum [ 833.584251][T32212] syzkaller0: entered promiscuous mode [ 833.616764][T32212] syzkaller0: entered allmulticast mode [ 833.656651][T32216] Unsupported ieee802154 address type: 0 [ 833.759328][T32217] bond6: option fail_over_mac: invalid value (16) [ 833.768682][T32217] bond6 (unregistering): Released all slaves [ 834.218372][T32244] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6934'. [ 834.732514][T32270] netlink: 'syz.1.6940': attribute type 4 has an invalid length. [ 834.830174][T32276] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6940'. [ 834.869753][T32272] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6940'. [ 834.905793][T32278] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6943'. [ 835.120136][T32294] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6948'. [ 835.553778][T32319] netlink: 'syz.0.6953': attribute type 1 has an invalid length. [ 835.988637][T32336] lo: entered allmulticast mode [ 836.010740][T32336] lo: left allmulticast mode [ 836.038550][T32336] netlink: 388 bytes leftover after parsing attributes in process `syz.4.6958'. [ 836.289096][T32352] netlink: 'syz.2.6963': attribute type 21 has an invalid length. [ 836.299427][T32364] x_tables: duplicate underflow at hook 1 [ 836.314332][T32352] IPv6: NLM_F_CREATE should be specified when creating new route [ 836.347997][T32362] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6964'. [ 836.823035][T32380] [ 836.825414][T32380] ====================================================== [ 836.832459][T32380] WARNING: possible circular locking dependency detected [ 836.839497][T32380] syzkaller #0 Not tainted [ 836.843918][T32380] ------------------------------------------------------ [ 836.850944][T32380] syz.3.6962/32380 is trying to acquire lock: [ 836.857013][T32380] ffff888027a72ac8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 836.866446][T32380] [ 836.866446][T32380] but task is already holding lock: [ 836.873806][T32380] ffff888027a725a0 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 836.884279][T32380] [ 836.884279][T32380] which lock already depends on the new lock. [ 836.884279][T32380] [ 836.894681][T32380] [ 836.894681][T32380] the existing dependency chain (in reverse order) is: [ 836.903695][T32380] [ 836.903695][T32380] -> #6 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 836.912319][T32380] blk_alloc_queue+0x544/0x690 [ 836.917623][T32380] __blk_mq_alloc_disk+0x194/0x390 [ 836.923265][T32380] nbd_dev_add+0x494/0xb60 [ 836.928207][T32380] nbd_init+0x15f/0x1e0 [ 836.932886][T32380] do_one_initcall+0x250/0x870 [ 836.938167][T32380] do_initcall_level+0x10a/0x1a0 [ 836.943623][T32380] do_initcalls+0x59/0xa0 [ 836.948466][T32380] kernel_init_freeable+0x29d/0x3e0 [ 836.954179][T32380] kernel_init+0x1d/0x1d0 [ 836.959032][T32380] ret_from_fork+0x514/0xb70 [ 836.964147][T32380] ret_from_fork_asm+0x1a/0x30 [ 836.969424][T32380] [ 836.969424][T32380] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 836.976635][T32380] fs_reclaim_acquire+0x71/0x100 [ 836.982091][T32380] __kmalloc_cache_node_noprof+0x66/0x630 [ 836.988332][T32380] create_worker+0x112/0x7b0 [ 836.993440][T32380] workqueue_prepare_cpu+0xe4/0x170 [ 836.999152][T32380] cpuhp_invoke_callback+0x434/0x810 [ 837.004947][T32380] _cpu_up+0x2ce/0x5b0 [ 837.009533][T32380] cpu_up+0x1d2/0x220 [ 837.014031][T32380] cpuhp_bringup_mask+0xb2/0x1a0 [ 837.019487][T32380] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 837.025814][T32380] bringup_nonboot_cpus+0x17/0x30 [ 837.031360][T32380] smp_init+0x32/0x110 [ 837.035949][T32380] kernel_init_freeable+0x27f/0x3e0 [ 837.041663][T32380] kernel_init+0x1d/0x1d0 [ 837.046504][T32380] ret_from_fork+0x514/0xb70 [ 837.051605][T32380] ret_from_fork_asm+0x1a/0x30 [ 837.056911][T32380] [ 837.056911][T32380] -> #4 (cpu_hotplug_lock){++++}-{0:0}: [ 837.064641][T32380] cpus_read_lock+0x42/0x160 [ 837.069752][T32380] static_key_slow_inc+0x12/0x30 [ 837.075202][T32380] nbd_genl_reconfigure+0x1301/0x1e80 [ 837.081100][T32380] genl_family_rcv_msg_doit+0x233/0x340 [ 837.087175][T32380] genl_rcv_msg+0x614/0x7a0 [ 837.092197][T32380] netlink_rcv_skb+0x226/0x4a0 [ 837.097473][T32380] genl_rcv+0x28/0x40 [ 837.101971][T32380] netlink_unicast+0x7bb/0x940 [ 837.107245][T32380] netlink_sendmsg+0x813/0xb40 [ 837.112525][T32380] sock_sendmsg_nosec+0x13a/0x180 [ 837.118064][T32380] ____sys_sendmsg+0x54e/0x850 [ 837.123343][T32380] ___sys_sendmsg+0x2a5/0x360 [ 837.128545][T32380] __x64_sys_sendmsg+0x1b1/0x290 [ 837.133994][T32380] do_syscall_64+0x174/0x580 [ 837.139095][T32380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.145498][T32380] [ 837.145498][T32380] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 837.153229][T32380] __mutex_lock+0x19d/0x1550 [ 837.158335][T32380] nbd_queue_rq+0x373/0x1150 [ 837.163442][T32380] blk_mq_dispatch_rq_list+0x499/0x1990 [ 837.169510][T32380] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 837.176376][T32380] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 837.182873][T32380] blk_mq_run_work_fn+0x16c/0x300 [ 837.188418][T32380] process_scheduled_works+0xa8e/0x14e0 [ 837.194480][T32380] worker_thread+0xa47/0xfb0 [ 837.199589][T32380] kthread+0x388/0x470 [ 837.204169][T32380] ret_from_fork+0x514/0xb70 [ 837.209269][T32380] ret_from_fork_asm+0x1a/0x30 [ 837.214546][T32380] [ 837.214546][T32380] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 837.221752][T32380] __mutex_lock+0x19d/0x1550 [ 837.226851][T32380] nbd_queue_rq+0xc1/0x1150 [ 837.231868][T32380] blk_mq_dispatch_rq_list+0x499/0x1990 [ 837.237933][T32380] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 837.244777][T32380] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 837.251268][T32380] blk_mq_run_work_fn+0x16c/0x300 [ 837.256812][T32380] process_scheduled_works+0xa8e/0x14e0 [ 837.262892][T32380] worker_thread+0xa47/0xfb0 [ 837.268010][T32380] kthread+0x388/0x470 [ 837.272598][T32380] ret_from_fork+0x514/0xb70 [ 837.277707][T32380] ret_from_fork_asm+0x1a/0x30 [ 837.282996][T32380] [ 837.282996][T32380] -> #1 (set->srcu){.+.+}-{0:0}: [ 837.290119][T32380] __synchronize_srcu+0xc9/0x2f0 [ 837.295578][T32380] elevator_switch+0x1e8/0x7b0 [ 837.300866][T32380] elevator_change+0x2fa/0x480 [ 837.306156][T32380] elevator_set_default+0x375/0x440 [ 837.311882][T32380] blk_register_queue+0x3f3/0x4e0 [ 837.317425][T32380] __add_disk+0x6cb/0xe30 [ 837.322269][T32380] add_disk_fwnode+0xfb/0x4b0 [ 837.327458][T32380] nbd_dev_add+0x733/0xb60 [ 837.332393][T32380] nbd_init+0x15f/0x1e0 [ 837.337067][T32380] do_one_initcall+0x250/0x870 [ 837.342354][T32380] do_initcall_level+0x10a/0x1a0 [ 837.347818][T32380] do_initcalls+0x59/0xa0 [ 837.352686][T32380] kernel_init_freeable+0x29d/0x3e0 [ 837.358410][T32380] kernel_init+0x1d/0x1d0 [ 837.363257][T32380] ret_from_fork+0x514/0xb70 [ 837.368365][T32380] ret_from_fork_asm+0x1a/0x30 [ 837.373650][T32380] [ 837.373650][T32380] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 837.381477][T32380] __lock_acquire+0x1520/0x2cf0 [ 837.386846][T32380] lock_acquire+0x106/0x350 [ 837.391870][T32380] __mutex_lock+0x19d/0x1550 [ 837.396976][T32380] elevator_change+0x1af/0x480 [ 837.402260][T32380] elevator_set_none+0xb5/0x140 [ 837.407628][T32380] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 837.413946][T32380] nbd_start_device+0x189/0xb30 [ 837.419307][T32380] nbd_genl_connect+0x1597/0x1c10 [ 837.424930][T32380] genl_family_rcv_msg_doit+0x233/0x340 [ 837.430997][T32380] genl_rcv_msg+0x614/0x7a0 [ 837.436014][T32380] netlink_rcv_skb+0x226/0x4a0 [ 837.441291][T32380] genl_rcv+0x28/0x40 [ 837.445786][T32380] netlink_unicast+0x7bb/0x940 [ 837.451061][T32380] netlink_sendmsg+0x813/0xb40 [ 837.456343][T32380] sock_sendmsg_nosec+0x13a/0x180 [ 837.461892][T32380] ____sys_sendmsg+0x54e/0x850 [ 837.467172][T32380] ___sys_sendmsg+0x2a5/0x360 [ 837.472361][T32380] __x64_sys_sendmsg+0x1b1/0x290 [ 837.477813][T32380] do_syscall_64+0x174/0x580 [ 837.482917][T32380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.489323][T32380] [ 837.489323][T32380] other info that might help us debug this: [ 837.489323][T32380] [ 837.499538][T32380] Chain exists of: [ 837.499538][T32380] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#53 [ 837.499538][T32380] [ 837.513273][T32380] Possible unsafe locking scenario: [ 837.513273][T32380] [ 837.520711][T32380] CPU0 CPU1 [ 837.526063][T32380] ---- ---- [ 837.531429][T32380] lock(&q->q_usage_counter(io)#53); [ 837.536805][T32380] lock(fs_reclaim); [ 837.543299][T32380] lock(&q->q_usage_counter(io)#53); [ 837.551186][T32380] lock(&q->elevator_lock); [ 837.555774][T32380] [ 837.555774][T32380] *** DEADLOCK *** [ 837.555774][T32380] [ 837.563903][T32380] 6 locks held by syz.3.6962/32380: [ 837.569086][T32380] #0: ffffffff8fe5b2e8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 837.577279][T32380] #1: ffffffff8fe5b120 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 837.586257][T32380] #2: ffff888027b3a1c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xab/0x19f0 [ 837.597660][T32380] #3: ffff888027b3a0d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbe/0x19f0 [ 837.608640][T32380] #4: ffff888027a725a0 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 837.619264][T32380] #5: ffff888027a725d8 (&q->q_usage_counter(queue)#37){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 837.630153][T32380] [ 837.630153][T32380] stack backtrace: [ 837.636039][T32380] CPU: 0 UID: 0 PID: 32380 Comm: syz.3.6962 Not tainted syzkaller #0 PREEMPT(full) [ 837.636060][T32380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 837.636073][T32380] Call Trace: [ 837.636085][T32380] [ 837.636096][T32380] dump_stack_lvl+0xe8/0x150 [ 837.636121][T32380] print_circular_bug+0x2e1/0x300 [ 837.636145][T32380] check_noncircular+0x12e/0x150 [ 837.636169][T32380] __lock_acquire+0x1520/0x2cf0 [ 837.636195][T32380] ? elevator_change+0x1af/0x480 [ 837.636219][T32380] lock_acquire+0x106/0x350 [ 837.636235][T32380] ? elevator_change+0x1af/0x480 [ 837.636264][T32380] __mutex_lock+0x19d/0x1550 [ 837.636280][T32380] ? elevator_change+0x1af/0x480 [ 837.636304][T32380] ? rcu_is_watching+0x15/0xb0 [ 837.636328][T32380] ? elevator_change+0x1af/0x480 [ 837.636352][T32380] ? __pfx___mutex_lock+0x10/0x10 [ 837.636366][T32380] ? enable_work+0x17f/0x230 [ 837.636385][T32380] ? lockdep_hardirqs_on+0x7a/0x110 [ 837.636411][T32380] ? __cancel_work_sync+0xf7/0x110 [ 837.636428][T32380] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 837.636447][T32380] elevator_change+0x1af/0x480 [ 837.636473][T32380] elevator_set_none+0xb5/0x140 [ 837.636498][T32380] ? __pfx_elevator_set_none+0x10/0x10 [ 837.636524][T32380] ? xa_load+0x1db/0x210 [ 837.636543][T32380] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 837.636563][T32380] ? kernfs_add_one+0x480/0x5e0 [ 837.636585][T32380] ? nbd_start_device+0x17d/0xb30 [ 837.636613][T32380] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 837.636635][T32380] ? sysfs_add_file_mode_ns+0x258/0x300 [ 837.636662][T32380] nbd_start_device+0x189/0xb30 [ 837.636684][T32380] ? device_create_file+0xf4/0x1b0 [ 837.636703][T32380] nbd_genl_connect+0x1597/0x1c10 [ 837.636725][T32380] ? __pfx_nbd_genl_connect+0x10/0x10 [ 837.636744][T32380] ? rcu_is_watching+0x15/0xb0 [ 837.636762][T32380] ? trace_kmalloc+0x2a/0xf0 [ 837.636789][T32380] ? __kmalloc_noprof+0x396/0x720 [ 837.636814][T32380] ? __nla_parse+0x40/0x60 [ 837.636840][T32380] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 837.636866][T32380] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 837.636895][T32380] genl_family_rcv_msg_doit+0x233/0x340 [ 837.636923][T32380] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 837.636951][T32380] ? __lock_acquire+0x683/0x2cf0 [ 837.636972][T32380] genl_rcv_msg+0x614/0x7a0 [ 837.636997][T32380] ? __pfx_genl_rcv_msg+0x10/0x10 [ 837.637020][T32380] ? __pfx_nbd_genl_connect+0x10/0x10 [ 837.637044][T32380] netlink_rcv_skb+0x226/0x4a0 [ 837.637063][T32380] ? __pfx_genl_rcv_msg+0x10/0x10 [ 837.637087][T32380] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 837.637113][T32380] ? down_read+0x2be/0x330 [ 837.637131][T32380] genl_rcv+0x28/0x40 [ 837.637153][T32380] netlink_unicast+0x7bb/0x940 [ 837.637175][T32380] netlink_sendmsg+0x813/0xb40 [ 837.637196][T32380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 837.637218][T32380] ? aa_sock_msg_perm+0xf1/0x1b0 [ 837.637241][T32380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 837.637258][T32380] sock_sendmsg_nosec+0x13a/0x180 [ 837.637284][T32380] ____sys_sendmsg+0x54e/0x850 [ 837.637305][T32380] ? __pfx_____sys_sendmsg+0x10/0x10 [ 837.637326][T32380] ? import_iovec+0x73/0xa0 [ 837.637346][T32380] ___sys_sendmsg+0x2a5/0x360 [ 837.637362][T32380] ? __lock_acquire+0x683/0x2cf0 [ 837.637381][T32380] ? __pfx____sys_sendmsg+0x10/0x10 [ 837.637413][T32380] ? __fget_files+0x2a/0x420 [ 837.637430][T32380] ? __fget_files+0x3a2/0x420 [ 837.637450][T32380] __x64_sys_sendmsg+0x1b1/0x290 [ 837.637468][T32380] ? net_tx_action+0x5bb/0xc30 [ 837.637493][T32380] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 837.637515][T32380] ? handle_softirqs+0x70f/0x840 [ 837.637543][T32380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.637561][T32380] do_syscall_64+0x174/0x580 [ 837.637578][T32380] ? clear_bhb_loop+0x40/0x90 [ 837.637598][T32380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.637621][T32380] RIP: 0033:0x7f0e4099ce59 [ 837.637642][T32380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 837.637657][T32380] RSP: 002b:00007f0e41861028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 837.637677][T32380] RAX: ffffffffffffffda RBX: 00007f0e40c16360 RCX: 00007f0e4099ce59 [ 837.637691][T32380] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 837.637703][T32380] RBP: 00007f0e40a32e6f R08: 0000000000000000 R09: 0000000000000000 [ 837.637714][T32380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 837.637725][T32380] R13: 00007f0e40c163f8 R14: 00007f0e40c16360 R15: 00007ffe2efdbf08 [ 837.637745][T32380] [ 838.188954][ T4942] block nbd4: Receive control failed (result -107) [ 838.235128][T32380] nbd4: detected capacity change from 0 to 63 [ 838.295625][ T5623] block nbd4: Receive control failed (result -104)