last executing test programs: 3.234322709s ago: executing program 1 (id=2655): getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000080)={0xffffffffffffffff, 0x9, 0x0, "8811fea72e3e7fefaead9dcf1253d80b"}) (async) r1 = socket$inet(0x2, 0x6, 0x9) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f00000000c0)={0x9, {{0x2, 0x4e23, @loopback}}, 0x0, 0x3, [{{0x2, 0x4e24, @loopback}}, {{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x24}}}, {{0x2, 0x4e21, @multicast1}}]}, 0x210) shutdown(r1, 0x1) (async) r2 = socket$packet(0x11, 0x2, 0x300) getsockopt$inet_mreqsrc(r1, 0x0, 0x28, &(0x7f0000000300)={@empty, @loopback, @loopback}, &(0x7f0000000340)=0xc) (async) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000380)={0x0, 0x69, "1cd6c00cf8da2fdf6099699b27757b550b3a5aa563fb5ff724321a1de4a676ea35042b481b060e63f3a21539299f912da08447d98187bec5ab58130b6a292c39b5a5c7a477d72ac2641ab5c16533be3ea32602664fb6f44feb64a5f38eabeb0857f5908c74217f0d2d"}, &(0x7f0000000400)=0x71) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000440)={r3, 0xfc01, 0xbd4, 0x6, 0x1, 0x7}, &(0x7f0000000480)=0x14) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000004c0)={r2}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000500)=[@in6={0xa, 0x4e23, 0xa, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}], 0x1c) (async) unshare(0x2000000) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r5) sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x78, r6, 0x100, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "d09404c8a994ba497c95ba53085b907d96edf7119ed9b5c5104b1a"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x38, 0x1403, 0x100, 0x70bd2a, 0x25dfdbfc, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x880}, 0x40000) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f00000007c0)={'broute\x00', 0x0, 0x0, 0x0, [0x2f71, 0x2, 0x6, 0x1, 0x3ff, 0x3]}, &(0x7f0000000840)=0x78) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r5, &(0x7f0000000980)={&(0x7f0000000880), 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x58, 0x140b, 0x400, 0x70bd27, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x5}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x4}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x80) (async) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f00000009c0)={r4, 0x25}, &(0x7f0000000a00)=0x8) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a40)={'vcan0\x00'}) (async) recvmmsg(r2, &(0x7f0000000d00)=[{{&(0x7f0000000a80)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000b00)=""/126, 0x7e}, {&(0x7f0000000b80)=""/175, 0xaf}], 0x2, &(0x7f0000000c80)=""/79, 0x4f}, 0x10001}], 0x1, 0x0, &(0x7f0000000d40)={0x77359400}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000d80)={'bridge_slave_1\x00'}) (async) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000e00), r5) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r5, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x34, r8, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0xa}, @ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000090}, 0x40000) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f40), r5) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x28, r9, 0x200, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x1, 0x13}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x84}, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000001040)={r7, 0x8000}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f00000010c0)={0xffff, 0x1, 0x8, 0x27a456ff, 0x3, 0xf8bd, 0x3, 0x0, r4}, &(0x7f0000001100)=0x20) (async) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000001140)={0x7f, 0x94cc, 0x6, 0x1, 0xccf, 0x2, 0x1000, 0x1, r10}, &(0x7f0000001180)=0x20) (async) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r5, 0x84, 0x16, &(0x7f00000011c0)={0x2, [0x9, 0x7]}, &(0x7f0000001200)=0x8) 3.231994355s ago: executing program 4 (id=2656): setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000080)=0x200, 0x4) (async) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000004b40)=[{{&(0x7f0000001140)={0xa, 0x4e23, 0x10, @private2, 0x4}, 0x1c, &(0x7f00000013c0)=[{&(0x7f00000016c0)="99", 0x1}], 0x1}}, {{&(0x7f0000000000)={0xa, 0x4e24, 0x6, @local, 0x80}, 0x1c, &(0x7f00000015c0)}}], 0x2, 0x4000090) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) shutdown(r0, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)={0x20, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000061117c0000000000850000000100000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) 3.138178859s ago: executing program 4 (id=2657): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x58, 0x10, 0x1, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x41814, 0x42121}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_ISOLATED={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 3.014577616s ago: executing program 1 (id=2659): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xb, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x21}]}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000080000000008000000000000007110000000000000000000e1e2c61d73"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1600000000000000080000000200010000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000051237c0844cbc1ca82784f4568c4286c6c68c772d53b688057811c2f0eb967042edf3c5a1a0e9bd60104354d5732f58a3a1163f6214e255efd9b2a9178bf556c7dfa2774f349b768f3ec9224695b763eedcfed3c78b8dbecdfdd0c75cad6c00e6b97bbac8aef35120b5a0acee9e9c78ecf9f4a56c8634c4752d03abe1f3bea4f16d5e3bc6c01cc3d985d6de5ea4f6f9a218ee7a998e9249616099d108a6b94559bdac78381358f63dc68ee2a7ea44c909bee0130e525e22f6c15c90c9510736062aa968c39b6f349a4ae7343916dd4bf3e460c11a024ecfc6c9225bc42e847"], 0x48) accept4(0xffffffffffffffff, &(0x7f0000000400)=@alg, &(0x7f0000000700)=0x80, 0x800) bpf$TOKEN_CREATE(0x24, &(0x7f00000003c0)={0x0, r0}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@bloom_filter={0x1e, 0x0, 0xfffffc9c, 0x7fff, 0x400, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x3, 0x9}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000002c0)={&(0x7f0000000080)="d1518ddf9eb4a17304594efe64b0d61b794fb7e368c556da1e882d4f485c305f8501d1e5de8745977ef65c4af1afc19a0b7db1a13423d8136ea91427f94886e3e45b05b5619360d20f2743fa96acabe1bbb53d606d3b2d678fa6254eeac1", &(0x7f0000000000)=""/58, &(0x7f0000000140)="cd830950fd1ff9241e1eacab65bd732e16be76ff332730499e115bc2371577ec34d860cadb91e16b36c05595cdcc839d90890f03822cad4e854bad2cf063177e106c6561bc9bec4854b5ee41facd793872cc24bbfd217a2f9e78487f0316a62bc98cd01aa8f936440a6796cf3db7d1e8a3a731a42bf1706844a1591135b262b17ca72a250b55875df84c8d6700b64ba48ae2549e3b8f1d51c1667a9c36ccda03ef27549fc7f1a50ab7e2330655043bc77197b09658d53372c8103ff08df47c0e", &(0x7f0000000340)="c669508542c9e8e9f22ec5cbbb334fb36b4077627ca3f22f107711ed202d5857227ae217b2623954583e695e89bb47826daeb5a891f4dbeddbb027b18e09f277784ab1ed", 0x0, r1}, 0x38) 2.834123076s ago: executing program 4 (id=2662): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x45, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0, 0x7}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffd}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3}, @call={0x85, 0x0, 0x0, 0x84}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000280)='syzkaller\x00', 0x200, 0xb8, &(0x7f00000002c0)=""/184, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000003c0)={0x2, 0x8, 0x1000, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000400)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0x1], 0x0, 0x10, 0x6}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000000)='ext4_ext_rm_leaf\x00', r0, 0x0, 0x80000001}, 0x18) write(r0, &(0x7f0000000540)="db646141771b9c17922d3cf1c4d606500a26a9c6709b0b45140a55317f3b6653288c0b0f55ea8156d1baf0d82cfe9975f0b28aa1e7e5c9d5724d611b5a2d95d969d2bd5f5c685237d78eac125840117696b3ec91b1b4af6f75aaef27d9f51056b35fcfb2179e4707b6281c569ee7c27e553bb2e209818796ce46e964f65db74398665f2b135332911f8df64f72defe9ca6fad50d7586d18107d5cebace99efb309f04eaa9ec905faecc6ff91ba495098fafb63dae9", 0xb5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000640)={'erspan0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x20, 0x0, 0xfffffffc, 0x4, {{0x6, 0x4, 0x2, 0xc, 0x18, 0x68, 0x0, 0x3, 0x4, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop]}}}}}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000680)={{{@in6, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@private}}, &(0x7f0000000780)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000007c0)={{{@in6=@mcast1, @in6=@mcast1, 0x4e20, 0x5, 0x4e23, 0x7, 0xa, 0x20, 0xa0, 0x32, r3, r4}, {0x2, 0x8001, 0x9, 0x8000000000000000, 0x7000000000000, 0xb, 0x6, 0x7}, {0xfffffffffffffffd, 0x2, 0xda, 0x2}, 0x2, 0x6e6bb0, 0x0, 0x1, 0x3, 0x3}, {{@in=@remote, 0x4d6, 0x33}, 0x2, @in=@remote, 0x3507, 0x4, 0x0, 0x8, 0x0, 0x8, 0x101}}, 0xe8) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000900), r1) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r6, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, r7, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048081}, 0x4008080) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000a00)) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r8, 0x84, 0x21, &(0x7f0000000a40), &(0x7f0000000a80)=0x4) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b00), r6) sendmsg$TIPC_NL_PEER_REMOVE(r6, &(0x7f0000000d40)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000b40)={0x1a4, r9, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x58, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfb3d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}]}, @TIPC_NLA_NODE={0x78, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x6f, 0x3, "97c78806700d50cf84ea280591778a58878e525b2fa109519b1bdf8554ce5e66350111d7ece6e4da968ccb55393974657f36c778546ef6e39c618077bc222da8151edc3db2456b16915192b1e1bc6db39eae74d1c6192a3b021f8c370fb370724045c2c0fd65c2442a2074"}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_NODE={0xc0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "8a2e482afd6e50ae3349a1001e547941369b0c8d"}}, @TIPC_NLA_NODE_ID={0x16, 0x3, "8fad1f8a7b40a6d3da8d429e6863cc10389b"}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "a8d43697af5dc2fa486af34b51527ac098a46a5ab85c749104f44feba4b3298ba1"}}, @TIPC_NLA_NODE_ID={0x19, 0x3, "519b55ed18df305d67b6c09b1347c07c902a168334"}]}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x4000004}, 0x20000004) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000d80)={0x0, {{0xa, 0x4e24, 0x7, @mcast2, 0xfffffff6}}, {{0xa, 0x4e21, 0x5, @dev={0xfe, 0x80, '\x00', 0x3f}, 0x4}}}, 0x108) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000ec0)={@in6={{0xa, 0x4e21, 0x10000, @empty, 0x3d}}, 0x0, 0x0, 0x32, 0x0, "61325bd498a3a386e563d9644a5d25cb6ade18b5ddd18e2c4eca5b670989b6136e20ad195fd0f7a70b371822129e8c006c7d2dd4f45180085fbadb67c0008d160af593113f82299097a1fb212c356e74"}, 0xd8) listen(r8, 0x6) setsockopt$sock_int(r5, 0x1, 0x2b, &(0x7f0000000fc0)=0x6, 0x4) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f00000010c0)={'sit0\x00', &(0x7f0000001000)={@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0xa0, 0x0, [{@remote}, {@remote}, {@multicast2}, {@initdev}, {@initdev}, {@broadcast}, {@private}, {@private}, {@dev}, {@multicast2}]}}) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000001100)=0x5, 0x4) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000001300)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000012c0)={&(0x7f0000001180)={0x118, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x52a6}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK={0xc0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x62cf4d47}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2b73}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb8f2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000c) recvfrom$inet6(r5, &(0x7f0000001340)=""/209, 0xd1, 0x2100, &(0x7f0000001440)={0xa, 0x4e22, 0x3, @mcast2, 0x5}, 0x1c) r10 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r5, &(0x7f0000001480)={0x10}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000014c0)={'geneve1\x00', @local}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r6, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x44, r7, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x578}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x7}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x801}, 0xc2ae08a0d1f226e5) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000001640)=0x1, 0x4) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r8, 0x84, 0x20, &(0x7f0000001680)=0x7ff, 0x4) 2.824731169s ago: executing program 1 (id=2663): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a040000040000000800000002000000007b5abd1a629f5385c5478ba7000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_REG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r2, 0x4c466994d56c53cd}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYRES32=r1], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(blake2b-160-generic)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$inet(r4, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)='K', 0x1}], 0x1}}], 0x1, 0x8000) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000001c0), 0x3) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x80, 0x711, 0x9, 0x9, {{0x1a, 0x4, 0x1, 0x3b, 0x68, 0x68, 0x0, 0x7, 0x4, 0x0, @loopback, @multicast2, {[@cipso={0x86, 0x53, 0xffffffffffffffff, [{0x0, 0xc, "20cd0920f747991b3b3c"}, {0x5, 0x10, "ccd63c279b097345563dbeaec7a8"}, {0x1, 0x9, "e2b77202358430"}, {0x5, 0x3, "db"}, {0x2, 0x10, "0b5df67f3e5308c10b8ae433b798"}, {0x5, 0xc, "98ce3a32a6fa92e36edb"}, {0x1, 0x9, "13a26e7db26d15"}]}]}}}}}) bind$xdp(r5, &(0x7f0000000080)={0x2c, 0x1, r6, 0xa}, 0x10) 2.709100849s ago: executing program 4 (id=2664): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x30, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)={0x4c, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x7ffb}, @from_mac, @broadcast, @from_mac, {0x5, 0x9}}, @a_msdu}}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x888e}, @NL80211_ATTR_MAC={0xa}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x44800) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r8, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r2, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0xc65, 0x7a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$NFC_CMD_GET_SE(r9, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r10, 0x1, 0x70bd27, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}}, 0x44040) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="cf042bbd700000dcdf251200000008000300", @ANYRES32=r12, @ANYBLOB="0a00060008021100000100000600120006000000050074000300000006001201010000001800"], 0x68}}, 0x0) 2.595035648s ago: executing program 2 (id=2666): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, 0x7, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xfffffff8}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000800) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x17, &(0x7f0000000080)=0x1, 0x4) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) 2.552799057s ago: executing program 0 (id=2668): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x18) r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000140)={0x0, 0xdd, "a149cce913ac944098fded15c029cb12244a52fd75b880ed2686aecd48c7c23e8c54050ec752d2fea95e647ae62161a2b25773baf397b46501c3b709453ca3a7bb04afe76f2d5bdf2a93ab3db27c853d08941e7cb54964e0e120cd8171c14e66663bd33969e1d4993b427322b5b3a707153bfa56bd9e57c2fb003a5047a54e0689d88f0ab198d1f4ddb95db4df21e7ca59e1e2105dbf4923667a8cc7d2cff26f871386c3689e11b149dd126233200c4e76e5cc8680e1fee2e727565ec9bd7b1e5b9724b3bf1c03665a89bdc4543e940ff70b8e17b89c001b3fd63694be"}, &(0x7f00000000c0)=0xe5) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000440)={r3, @in6={{0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x10}}}, 0x84) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000340)={"908363d22079de6abe8f859279687f02", 0x0, 0x0, {0x9, 0x5}, {0x0, 0x9}, 0x3, [0x8001, 0x7, 0x5, 0x9, 0x2, 0x5, 0x6, 0x100000001, 0x100, 0x616e, 0x7, 0xffffffffffffffff, 0x3, 0x3, 0x8d, 0x1]}) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x44}}, 0x0) 2.485859943s ago: executing program 4 (id=2669): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e23, 0x40, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x7}}, 0x0, 0x0, 0x6, 0x0, "09be2271b78506e6dd938d324c415acd403a4480fd1afa34432bcdfa64d957e93efafd27ad06a6f589dc643f167cf0fcd370239aac93f6ded3c5032c96ead0cdc68474d402ab73e482db7ec1e0a57489"}, 0xd8) shutdown(r0, 0x2) r1 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf7}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6006}]}]}], {0x14}}, 0x90}}, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000400)={0x3, 0xbf, "630272f92ca40fc9cf6a775501c0688b0ad933bded5da64042c7397e58b98bcd226b3da9b5c0b784c25cdd04fcabb802c5f48d79fd60fced6d00069d4357a7515f3a7d7b4a0710d30e41f939a43b81b8a0a96d8b9dd3e758c15d27e912f3c649b69914ea1acc976406dc942fb7e0922e673492a2a99a6ed881e94f79b4058c7dc16f872adeb2412572a8088d46b8c6a8b1c25a1c00e76314ab66c750319ed1a804216fe4279ae30012815563b14bb42d249fab03d32a43d336791ff87404bc"}) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, 0x0}}], 0x1, 0x20080058) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) syz_emit_ethernet(0x66, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008100000086dd6076cd8a0028000020010000000000000000000000000000ff0200000000000000000000000000010004000000000000071800000000040000d704"], 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9b}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0xfffff000, 0xe, 0x0, &(0x7f0000001700)="61df7100c80400d5721ff59fe864", 0x0, 0x2, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r5, &(0x7f0000000140)='l', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={0xffffffffffffffff, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x6, &(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x39, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000500), &(0x7f0000000540), 0x8, 0xf8, 0x8, 0x8, &(0x7f0000000700)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000208efb513400000000000000000000000000fcff00"/33], 0x48) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={@map=r7, 0x26, 0x0, 0xf51, &(0x7f0000001440)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4050000000000007110ae0000000000060000000000000095000000000000001f3d4eb3edc86c04e323b24d9426e5339e162b4915ca4c92ec3a4a3935b6d581c304908f84d3f0e99ac4402141407b980e454bd575dd0dc0f1a682f6ba574e0700000000000000515ec25d0b1f1c8c9cd8eb72385ad6136789dcd5a694d3cfb4cec510d0d4d980e649aa4492032c5888f5f9b246b9f5117cb89f3ff246280a1ab186bbd42370e30e9a2028d82bd071a329b281c4393e1e8ce723f67552961cd23f056542399289825a0d3e13b1401cda214d8f87ba4e8a5fff7be68fe15f3c1df84f2086f79ab69bbb072848357dc3bbc144cca554fdf459a2b6dd58c29bafe29a5b1d630a94c14753a1b0d26203185b5735d393c9a6367767ff9f9edf5e6e7e94aefd0d49ad707a4a7027185086a66c0a321f386bc40caed35d63967e3809ad3187a72972c5c22c085f0a481e7ce9458e8c21647d100c9fc91eb8fe87d05e6545dcbe6cd28444fcdaac12f6469abc71af781f79c7aeafcdcadda97413e2539860ae46370405f742edd486fc26697c52d18f7adeaf79101b3da624ef12673df25d15d6f3f0be93636d8ea88eaafe20257812496258c87d3e97c35fbf3967e1ae86639489758fa8759006669c0d7ed1710d80bf8424e190cb78e36dd7e2e01034991761ff243405d75021155bf4e831208f0a845897ac198e36dc9e0928727ea3a6dc3f2f64aa4007cf52c41ffff9c7a51dc635d7d34f509725530e2f1d1f5ba90c325591f90c354764997bd47abcab66966d683c392ea96668506002589df1c948237f1533f3157fec94ebf2ce6347f6516a"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, r6}, 0x94) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1c, &(0x7f0000000100), &(0x7f0000000180)=0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000840)={{}, &(0x7f00000007c0), &(0x7f0000000800)='%-010d \x00'}, 0x20) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x50) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) socket(0x2a, 0x2, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r8, 0x0, 0x20000000) 2.408410155s ago: executing program 1 (id=2670): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000400)=0x140, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x5, 0x25, 0x0, &(0x7f0000000000)="259a53f271a76d2608004c6588a80a38667d2f15", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 2.407260997s ago: executing program 2 (id=2671): getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@dev, 0x0}, &(0x7f0000000080)=0x14) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007313000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff31a8fd3c0fd8b7ff831028e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a83469620c6e74e1f46132559c4f8700a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a920099c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3ba18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62c49d15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc82300000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) (async, rerun: 64) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (rerun: 64) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) (async) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000080)=r1) (async, rerun: 32) close(r2) (async, rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@delqdisc={0x8c, 0x25, 0x200, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r0, {0x0, 0x7}, {0xe}, {0xe, 0x4}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}, @TCA_STAB={0x50, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x7f, 0x3ff, 0x4, 0x1, 0xd489, 0x200, 0x1}}, {0x6, 0x2, [0x3ff]}}, {{0x1c, 0x1, {0x6b, 0x6, 0x7fff, 0x6, 0x2, 0x5, 0x6, 0x3}}, {0xa, 0x2, [0x400, 0x0, 0x101]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}, @TCA_RATE={0x6, 0x5, {0x3, 0x3}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="662700000000000024001280090001007866726d0000000014000280040003"], 0x44}}, 0x0) 2.406460197s ago: executing program 3 (id=2672): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, r1, 0x2, 0x2000, 0x100002, {}, [@NL80211_ATTR_TXQ_QUANTUM={0x8, 0x10c, 0x85}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20085}, 0x2000c000) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r3}, @void}}}, 0x28}, 0x1, 0x6c00}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r5, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r5, 0x84, 0x5, &(0x7f00000001c0)={r7, @in6={{0xa, 0x4e24, 0x5, @rand_addr=' \x01\x00', 0x82e}}}, 0x84) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r8, 0x6, 0x1, 0x0, &(0x7f00000000c0)=0x9) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000003, 0x41071, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(r4, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f0000000000)) 2.298438565s ago: executing program 0 (id=2673): r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x1d, 0x0, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021100011800c000100636f756e746572009c0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000700003806c000080080003400000000260000b80440001800c000100636f756e74657200340002800c0002400000000000001e3c0c00014000000000000000500c00024000000000000100000c000140000000000000000018"], 0x130}, 0x1, 0x0, 0x0, 0x8000}, 0x8880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r5, {0xa, 0xffff}, {}, {0xfff3, 0xe}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x6}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d38}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x200008c2) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 2.062402829s ago: executing program 2 (id=2674): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r1}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000180)={0x10, 0x0, 0x25dfdc03, 0x2ffffffff}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x723f978a9ad04442}}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x400000000000003}]}], {0x14}}, 0xfffffffffffffde5}, 0x1, 0x0, 0x0, 0x20044815}, 0x0) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0x28, r6, 0xd20c73549ed264cd, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x6c}]}, 0x28}, 0x1, 0x0, 0x0, 0x811}, 0x40084) r9 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f00000005c0)={'ip6_vti0\x00', &(0x7f0000000580)=@ethtool_stats}) 2.055455117s ago: executing program 1 (id=2675): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="8fedcb791f6f9875f37538e486dd6317ce81ea032c"], 0xfdef) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000a40)=ANY=[@ANYBLOB="50040000f303080027bd7000fddbdf2505000000000000001e00000000000080050000000000000008000000000000180c000000000800000500000000000038ff030000fbffffff0800000001000000ae2500000e05000006000000ba00000006000000d20500000200000003000000030000000400000000800000090000000c00000001000000ff000000d800000002000000050000000080ffff040000002098000006000000ffff00000800000000080000160700000300000008000000010000800000000000000000f7ffffff0400000007000000f6ffffff0d0000000100000003000000010000004a250d45feffffff050000000c000000ffffff7f0100000000000000000000000200000007000000060000000000000006000000d30900000700000009000000000800000300000006000000f79900000200000005000000018000000000010009000000080000000000008009000000ff7f0000020000000f0000008000000006000000030000000001000008000000113a00000500000006000000018000000900000009000000018000000200000092000000ff0f0000000000006500000006000000080000000a00000009000000c9290000080000007f000000000200000f000000020000000000000000000000c309000018c30000080000000180000006000000090000000030000006000000030000009e00000010000000070000000900000000010000000000800900000002000000070000000300000000000100000000000400000042000000ff000000dd00000004000000db763856030000002c0a00000e00000008000000800000000b6e9af8030000000a0000001000000007000000ff0f000000000080ff010000000000000000001800010000da0a0000020000000000000081000000f8ffffff01000000594800000900000041a700000900000002000000010000000c0000000000008000f0ffff070000000800000002000000060000000080000039620000000000000300000001000000750000000200000007000000ffffff7f0200000005000000040000007f0000008a0600001f0000000200000040000000a98700000d000000fbffffff0c000000030000000100000008000000000000000500000055c400007b0b000000000080060000000180ffff010000000300000001000000070000000a000000a7bb000007000000000400008f0000003b00000005000000ff0000000a000000f7ffffff6b000000090000000800000003000000000000a000040000ed0e00000300000009000000f9ffffffff0000008c0000000700000069000000a0000000cb1a00000100000002000000ff030000500600000100000008000000000000000100000080000000faffffff070000000600000009000000560300003e000000d3ea0000670000007f0000000200000004000000530000002e0000002b5d7d002f6465762f6e65742f74756e002f6465762f6e65742f74756e002d00002f6465762f6e65742f74756e0000007a96e681a61a062ebeb26333969ea1e257b386eec1c9bdd89b7520d6ef8c787eb61aaa009222ec0bff45f34a9657a317c7f6c1b5db27d09ef37a0cf4dbc5a762d20a81914da420a0f591e44013a5a40dc00c77ca0f688d64a69e7399c58daa92f0473eff6feab7947178c45fd4c3576b4e1675562b3346a878ce72c0e763c80ded7f7382f410e212263ec8c63b16611b08e6313173a9e7d34a3894fe8085ecbf49d72f025c7488b455a12da141b15ad7db70b980314e258bd0be68fc6bbb4dcc0c79fdfdc08d04f42d1aba97ebbd267711858f1c2a9219f733f99b289c54f9d72a7e486c"], 0x450}}, 0x4001) (async) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000a40)=ANY=[@ANYBLOB="50040000f303080027bd7000fddbdf2505000000000000001e00000000000080050000000000000008000000000000180c000000000800000500000000000038ff030000fbffffff0800000001000000ae2500000e05000006000000ba00000006000000d20500000200000003000000030000000400000000800000090000000c00000001000000ff000000d800000002000000050000000080ffff040000002098000006000000ffff00000800000000080000160700000300000008000000010000800000000000000000f7ffffff0400000007000000f6ffffff0d0000000100000003000000010000004a250d45feffffff050000000c000000ffffff7f0100000000000000000000000200000007000000060000000000000006000000d30900000700000009000000000800000300000006000000f79900000200000005000000018000000000010009000000080000000000008009000000ff7f0000020000000f0000008000000006000000030000000001000008000000113a00000500000006000000018000000900000009000000018000000200000092000000ff0f0000000000006500000006000000080000000a00000009000000c9290000080000007f000000000200000f000000020000000000000000000000c309000018c30000080000000180000006000000090000000030000006000000030000009e00000010000000070000000900000000010000000000800900000002000000070000000300000000000100000000000400000042000000ff000000dd00000004000000db763856030000002c0a00000e00000008000000800000000b6e9af8030000000a0000001000000007000000ff0f000000000080ff010000000000000000001800010000da0a0000020000000000000081000000f8ffffff01000000594800000900000041a700000900000002000000010000000c0000000000008000f0ffff070000000800000002000000060000000080000039620000000000000300000001000000750000000200000007000000ffffff7f0200000005000000040000007f0000008a0600001f0000000200000040000000a98700000d000000fbffffff0c000000030000000100000008000000000000000500000055c400007b0b000000000080060000000180ffff010000000300000001000000070000000a000000a7bb000007000000000400008f0000003b00000005000000ff0000000a000000f7ffffff6b000000090000000800000003000000000000a000040000ed0e00000300000009000000f9ffffffff0000008c0000000700000069000000a0000000cb1a00000100000002000000ff030000500600000100000008000000000000000100000080000000faffffff070000000600000009000000560300003e000000d3ea0000670000007f0000000200000004000000530000002e0000002b5d7d002f6465762f6e65742f74756e002f6465762f6e65742f74756e002d00002f6465762f6e65742f74756e0000007a96e681a61a062ebeb26333969ea1e257b386eec1c9bdd89b7520d6ef8c787eb61aaa009222ec0bff45f34a9657a317c7f6c1b5db27d09ef37a0cf4dbc5a762d20a81914da420a0f591e44013a5a40dc00c77ca0f688d64a69e7399c58daa92f0473eff6feab7947178c45fd4c3576b4e1675562b3346a878ce72c0e763c80ded7f7382f410e212263ec8c63b16611b08e6313173a9e7d34a3894fe8085ecbf49d72f025c7488b455a12da141b15ad7db70b980314e258bd0be68fc6bbb4dcc0c79fdfdc08d04f42d1aba97ebbd267711858f1c2a9219f733f99b289c54f9d72a7e486c"], 0x450}}, 0x4001) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$cgroup_subtree(r1, &(0x7f0000000580)=ANY=[], 0x36) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x7, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}}, 0x14}}, 0x8004) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_NEWSETELEM={0x58, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x2c, 0x3, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xd9d}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xec}}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000680001060000000000000000020014475eb3f6c9daeeb0e3"], 0x1c}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000680001060000000000000000020014475eb3f6c9daeeb0e3"], 0x1c}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) 2.043289558s ago: executing program 0 (id=2676): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4050000000000007110580000000000060000000000000095000000000000001f3d4eb3edc86c04e323b24d9426e5339e162b4915ca4c92ec3a4a3935b6d581c304908f84d3f0e99ac4402141407b980e454bd575dd0dc0f1a682f6ba574e0700000000000000515ec25d0b1f1c8c9cd8eb72385ad6136789dcd5a694d3cfb4cec510d0d4d980e649aa4492032c5888f5f9b246b9f5117cb89f3ff246280a1ab186bbd42370e30e9a2028d82bd071a329b281c4393e1e8ce723f67552961cd23f056542399289825a0d3e13b1401cda214d8f87ba4e8a5fff7be68fe15f3c1df84f2086f79ab69bbb072848357dc3bbc144cca554fdf459a2b6dd58c29bafe29a5b1d630a94c14753a1b0d26203185b5735d393c9a6367767ff9f9edf5e6e7e94aefd0d49ad707a4a7027185086a66c0a321f386bc40caed35d63967e3809ad3187a72972c5c22c085f0a481e7ce9458e8c21647d100c9fc91eb8fe87d05e6545dcbe6cd28444fcdaac12f6469abc71af781f79c7aeafcdcadda97413e2539860ae46370405f742edd486fc26697c52d18f7adeaf79101b3da624ef12673df25d15d6f3f0be93636d8ea88eaafe20257812496258c87d3e97c35fbf3967e1ae86639489758fa8759006669c0d7ed1710d80bf8424e190cb78e36dd7e2e01034991761ff243405d75021155bf4e831208f0a845897ac198e36dc9e0928727ea3a6dc3f2f64aa4007cf52c41ffff9c7a51dc635d7d34f509725530e2f1d1f5ba90c325591f90c354764997bd47abcab66966d683c392ea96668506002589df1c948237f1533f3157fec94ebf2ce6347f6516a"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r2 = socket$netlink(0x10, 0x3, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r3, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x400448ca, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1503, 0x4}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x13a, 0x13a, 0x3, [@datasec={0x6, 0x8, 0x0, 0xf, 0x1, [{0x5, 0x80, 0xff}, {0x2, 0x8b, 0xe}, {0x3, 0x6, 0x1}, {0x3, 0xcd, 0x9}, {0x1, 0x5, 0x800}, {0x5, 0x7, 0x401}, {0x3, 0x8, 0xfd}, {0x1, 0xfffffffa, 0x1}], "ea"}, @datasec={0x2, 0x7, 0x0, 0xf, 0x1, [{0x4, 0x18d, 0x10}, {0x5, 0x6, 0xf8f}, {0x3, 0x3ff, 0x7f}, {0x3, 0x3, 0x1}, {0x2, 0x5, 0x4}, {0x1, 0xfffffffa, 0x6}, {0x1, 0x401, 0xfd8d}], "8b"}, @struct={0x3, 0x2, 0x0, 0x4, 0x1, 0x6, [{0x10, 0x0, 0x1000}, {0xe, 0x2, 0xf}]}, @const={0xd, 0x0, 0x0, 0xa, 0x5}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x5, 0x4}}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0x1, 0x4}, {0x5, 0x4}, {0xc, 0x1}]}]}, {0x0, [0x5f]}}, &(0x7f0000000b00)=""/4096, 0x157, 0x1000, 0x0, 0x8, 0x10000}, 0x28) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000004c0)={0x1, 0xffffffffffffffff}, 0x4) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, {{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {0x85, 0x0, 0x0, 0x44}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x6}}}, &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.self_freezing\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r10, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0xa, &(0x7f0000000180)=@raw=[@ldst={0x2, 0x1, 0x6, 0x7, 0x8, 0x0, 0x4}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x4}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffff000}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @map_fd={0x18, 0x7, 0x1, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000000040)='syzkaller\x00', 0x173, 0x74, &(0x7f0000000200)=""/116, 0x40f00, 0x0, '\x00', 0x0, 0x25, r7, 0x8, &(0x7f0000000440)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000480)={0x4, 0x5, 0xfffffff7, 0x716}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000500)=[r8, r9, r10], &(0x7f0000000540)=[{0x5, 0x3, 0xd, 0x9}, {0x8, 0x4, 0x2, 0x9}, {0x1, 0x4, 0xf, 0x1}], 0x10, 0x66da}, 0x94) 1.972934706s ago: executing program 2 (id=2677): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r0, 0x80286722, &(0x7f0000000080)={&(0x7f0000000140)=""/181, 0xb5, 0x7, 0xa0}) socket(0x400000000010, 0x3, 0x0) (async) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {}, {0x11, 0x10}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x80040000}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048084}, 0x2008c014) 1.735673323s ago: executing program 0 (id=2678): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x4506, @private0={0xfc, 0x0, '\x00', 0x1}, 0x5}, 0x1c) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) 1.701216961s ago: executing program 0 (id=2679): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x6e}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) (async, rerun: 32) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 32) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000001cc0), &(0x7f0000001d00)=0x8) (async, rerun: 32) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (rerun: 32) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r2 = socket$unix(0x1, 0x1, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c40)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0x2, 0xb}, {0x9, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) 1.589470124s ago: executing program 4 (id=2680): r0 = socket(0x2a, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x2, 0x6, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_sa={0x2, 0x1, 0x4, 0x0, 0x0, 0x0, 0x4}]}, 0x20}}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000006300)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000390000000000000000000000850000004100000085000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r5, r3, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) syz_emit_ethernet(0xfdef, &(0x7f0000000580)=ANY=[], 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000008c0)=ANY=[@ANYBLOB="540100001800010000000000000000001d0100001500030000000000000000008ca5be073cff296e040000001e0106000000fe000071ec6d721744cd5200080000f8cfcad4c4ec6511ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281f1519cd7c32c2bf7563b9452575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0df766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243523f5de7b347f3b740e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c005c8d586b2a88d81866930fca15c8a95d29e5b2ea00000800050091"], 0x154}}, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f00000000c0)='rpc_stats_latency\x00', r7, 0x0, 0xf}, 0x18) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f00000000c0)='rpc_stats_latency\x00', 0xffffffffffffffff, 0x0, 0xf}, 0x18) 1.434411549s ago: executing program 3 (id=2681): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) (async) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x8b}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) (async, rerun: 64) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) (async) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) (async) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NFT_MSG_GETFLOWTABLE(r3, &(0x7f0000000340)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x98, 0x17, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK={0x58, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ipvlan1\x00'}, {0x14, 0x1, 'nr0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8001}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, 0x98}, 0x1, 0x0, 0x0, 0x8010}, 0x0) 1.354775653s ago: executing program 3 (id=2682): r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="620ac4ff00000000711053000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x90) sendto$inet6(r0, &(0x7f0000001400)="0d0ad7c36d6617110e434332d6ac582208222cfb7c37ce1148f448455bc37f5f70c92774dcb201629979039d7c8943b207e5bdf9ab8eed9ace110469c51f4f211dd9fad815eb5b273ac04e1edc679bcdf0a0d24482de5454be9003cb80714a95e136bb704ee58e707d1e69b3c3a1c2c37f9c0402e14abdeb32086a49aff25e5c0f0131d59b4783316b9fa2c71c51ce76942d5f519145c9e3bf0d4182b4a62970b2ce81d35a7afc8384b387b8e21f2051d90d92323a710cabe5275d335b64453e759251a140de480541d8dd7662a14296a59eba99b95bfdf5b22992c323865b471d13ad79867e2692fd4eece299a81e2b33336b6801f51c2ae8d73e4df90c9bd70cd535b72cbdf67754acdc44b3780450308d9c5527c3314eb7b2cc38b61e96403a30a8ba0c8a357aa04d3c62bc51bcf55cf214f44a909b29c30c18c3a43c86472612086664a80f2aa8490e58352732acb96eb46deab42895d1957a6029ad86e7a5ced6bde89c158aaee721954beeebe5973059007f7dd5459029af6d3f1d73d35f07d19b7cedfc80d1d7ef37f8b113f564afd0f093202929fef43e788619ca522c7f679dd2f27949d879b4dab46581a0e054b4ed1db37e43f528748b56ec5a54b7af198d4ae551046f7814fe3a5cbc1cc7cb6655fc198939b049f3c02443148c588e34d6ebef81096b4e48f468016d2bde0828664c0874d71e2d88b3bc04079d4a504255a83c3f07a4f1c3e5a4c66f55f36e51e344392487c8299d8d1bfb568780c0d57df48990cb5d6b35c3f7445f80312186d8598faf61072d4eefc961fb5a7e72b971c8f94a8346effd27362cee8d72a98b55e317de280d2d63ee83ca7140b7913122d402c536d914c8510c81d08f0ad1c952f5b7ad5e7ef72d7c58cb4d5bafbea535b381df6ebe94c62cf782cf7ab81c017c296a88ca91d641b45748d230cf5e87e5dbee4764ea4d131ae022e6bbf3ffc3ea7b3f264737d9db44354bfffa63d79bc403", 0x2c5, 0x6d91fb6102dc910c, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000240)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd6000000000303a0020010000000000000000000000000001ff020000000000000000000100000001010390787f00000060e1f588000700ffff010000000000000000000000000001ff020000000000000000000000000001"], 0x0) sendmmsg(r0, &(0x7f0000009b40)=[{{0x0, 0x0, &(0x7f00000001c0)}}], 0x1, 0x4061) 1.299086029s ago: executing program 3 (id=2683): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000180)=@req={0x0, 0xff}, 0x10) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'ip6tnl0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000180)={0x40, r2, 0x1, 0x70bd26, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x9, 0x74}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}]]}, 0x40}}, 0x20000000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r6, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000001}, @NBD_ATTR_BACKEND_IDENTIFIER={0x6, 0xa, '*{'}, @NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '\\'}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c045}, 0x20000004) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000001440)={'bridge0\x00', 0x0}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r8, 0x84, 0x11, &(0x7f0000001300)={0x0, 0x6e2}, &(0x7f0000001340)=0x8) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028006000200300000001400060000000000000000000000ffff7f00000108000a00", @ANYRESOCT], 0x5c}}, 0x0) 86.448638ms ago: executing program 3 (id=2684): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x8001, @dev={0xfe, 0x80, '\x00', 0x38}, 0x8001}]}, &(0x7f0000000040)=0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000b, 0x200000005c831, 0xffffffffffffffff, 0x18ba3000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0xa, 0x3, 0x87) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$IPSET_CMD_PROTOCOL(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00b0b61a6d0102000000000000000000000305000100070000000500010007000000290be9900700000000af523c100252e658076465ab1c28b9db"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4000010) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000015"], 0xb8}}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x20, 0x10}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x1}]}}}]}, 0x3c}}, 0x20000000) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) shutdown(r0, 0x2) 82.33766ms ago: executing program 2 (id=2685): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=@newqdisc={0x54, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x24, 0x2, [@TCA_CODEL_TARGET={0x8, 0x1, 0x8000}, @TCA_CODEL_LIMIT={0x8, 0x2, 0xb}, @TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x3}, @TCA_CODEL_ECN={0x8}]}}]}, 0x54}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000100000000000300000000000007000000", @ANYRES32], 0x2c}}, 0x0) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e000102"], 0x1c}}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000007cc0)=@generic={&(0x7f0000007c80)='.\x00', 0x0, 0x10}, 0x18) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, r1, 0x20, 0x2000, 0x2, {}, [@NL80211_ATTR_WIPHY_RETRY_SHORT={0x5, 0x3d, 0x3}, @NL80211_ATTR_TXQ_LIMIT={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000084}, 0x2000c000) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f00000000c0)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a5976ac6acd41fd8"}}, 0x48}}, 0x0) sendmsg$can_bcm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="010000008db879e2b2fa56da00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x38}}, 0x20000000) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}, 0x1, 0x6c00}, 0x0) 67.21884ms ago: executing program 1 (id=2686): r0 = socket$inet6(0xa, 0x805, 0x0) r1 = socket(0x1e, 0x4, 0xfffffffa) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0xc, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000cc0), r3) (async) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000cc0), r3) sendmsg$NLBL_MGMT_C_ADD(r3, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000002600)=ANY=[@ANYBLOB="300000087f703b4b47800bb3b33aac0a488766abfa6a02649bd3427c977814b5b56358ca3efc4fb2ea42f75683f900230e18f501d8681b0801a497540a79d31f8b0805affa0180308aefdbd7af5539ca987c5037fe5191eb922ec628d885c268da7e43748f94512df6d4fb79fee164549bcbb3e61bf28b73b8b9ce07495c2e758faf783c731c4a1e32549316dda4b5bd740cd96f0735f6289e6aa221a5e55a7ea59121585787cd954e946783d5c93293363a4cd15ad28e19537dfdce54d22bfc3de5a5f769e60962c4032938f950059a47aae1f28c77c38191942062f2b84581bb96e143d27600c76905e196b5adbfa8d579a2edf2adea5ec8673956e2148e465a8e6dfd0b6c96f1593c8edb2890541b5e624999fa11c8cc066da9e824738c49c71142e694bfdbdbc7d7aea625cf7918a73d6391d0cc", @ANYRES64, @ANYRESOCT=r0], 0x30}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}]}, &(0x7f0000000180)=0x10) recvfrom$inet6(r0, &(0x7f0000001100)=""/62, 0x3e, 0x0, &(0x7f0000001140)={0xa, 0x4e21, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5a6b}, 0x1c) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000006807a45801000000000000000a0000000000020004000400"], 0x1c}}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000006807a45801000000000000000a0000000000020004000400"], 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x271f, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r9, 0x8914, &(0x7f0000000000)) (async) ioctl$sock_netdev_private(r9, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r8, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xfffd, 'syz0\x00', @default, 0xfffffdb8, 0x2, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) socket(0x22, 0x2, 0x59) ioctl$sock_netrom_SIOCADDRT(r5, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x10000, 'syz0\x00', @null, 0xfffffdb6, 0x2, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) (async) ioctl$sock_netrom_SIOCADDRT(r5, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x10000, 'syz0\x00', @null, 0xfffffdb6, 0x2, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_netrom_SIOCADDRT(r5, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x10001, 'syz1\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000001080)=0x8) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={r10, 0x0, 0x0}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) socket$inet(0x2b, 0x1, 0x1000) (async) socket$inet(0x2b, 0x1, 0x1000) 7.829032ms ago: executing program 0 (id=2687): unshare(0x22020e00) unshare(0x2a020400) 3.286316ms ago: executing program 2 (id=2688): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x2, 0xa, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001a80)=@newlink={0x34, 0x10, 0x439, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r4, 0x0, 0x110d1}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc, 0x5, {0xfffffffc, 0x2}}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8041}, 0x40000880) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x24, r2, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x5b}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x24}}, 0x14) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f0000000140)=[{0x87}, {0x6}]}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000010000000000010000000000000001410000001c001700000000000000006574683a7379a4bee846fe4814f3348345"], 0x38}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r9, 0x8937, &(0x7f0000000000)={'veth0_vlan\x00', @random="010000201000"}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="23000000100000000000000000000000000000004ef62ba4cbf85d303c02eeb78a6e1da254ce4baa9befe7cb9110e0b6802eb24eeef58b6eb65cfa435144d44316c8a2b1df4c21f25c65de7c85c88a007ec37c2a68178fa3b0", @ANYRES32=r6, @ANYBLOB="000000000000000014001a8008000280040001800800028004000180"], 0x34}, 0x1, 0x2}, 0x0) 0s ago: executing program 3 (id=2689): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e21, 0x4, @empty, 0x100}, 0x1c) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newlink={0x60, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5, 0x5, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}, @IFLA_BROADCAST={0xa, 0x2, @broadcast}, @IFLA_BROADCAST={0xa, 0x2, @broadcast}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@bloom_filter={0x1e, 0x0, 0x9, 0x6a, 0x0, 0x1}, 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000440)={r3, 0x0, &(0x7f0000000400)=""/55}, 0x20) r4 = socket(0x10, 0x3, 0x0) preadv(r4, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000200)=@srh={0x2c, 0x6, 0x4, 0x3, 0x7, 0x70, 0x9, [@mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}]}, 0x38) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={&(0x7f0000000140), 0xc, &(0x7f0000000180)={&(0x7f0000000b40)=@newtclass={0xc48, 0x28, 0x400, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x7, 0x3}, {0x6, 0x8}, {0xa}}, [@tclass_kind_options=@c_htb={{0x8}, {0xc1c, 0x2, [@TCA_HTB_CEIL64={0xc, 0x7, 0x3ff}, @TCA_HTB_CTAB={0x404, 0x3, [0x4, 0x5, 0x3, 0xc58, 0x85, 0x8b11, 0x0, 0x3, 0x10000, 0xa8f, 0x283, 0x6, 0xa, 0xffffffff, 0x8c1, 0x0, 0x3, 0xc1ec0000, 0x47f, 0x8080, 0x5, 0x100, 0x9, 0x1000, 0x0, 0x1, 0xffff, 0xb4d8, 0x0, 0xa, 0x0, 0x100, 0x2, 0xffffffff, 0x2, 0x80, 0x8000, 0x8e, 0x0, 0x4, 0xb3, 0x1, 0x613c, 0x10, 0x8000, 0x1, 0x1, 0xa, 0xa, 0x96f5, 0xd, 0x78d, 0xab03, 0x6, 0x7, 0xa28, 0x7, 0x7, 0x3, 0xa849, 0x1, 0x9, 0x8, 0x8, 0x28000000, 0x3, 0x2, 0x81, 0x0, 0x9, 0x2, 0x2, 0x4, 0x7, 0x9, 0x80, 0x0, 0x7, 0x9, 0x8, 0x2, 0x3, 0x3, 0x2b00000, 0x6, 0x9168, 0x9, 0x7fffffff, 0x2, 0x9, 0xb, 0x2, 0xe, 0x4, 0x81, 0x3, 0x2, 0x200, 0x1, 0x1, 0x913, 0xf5, 0x0, 0x3, 0x5, 0x2, 0x200, 0x3, 0x1000, 0x9, 0x2, 0x81, 0xf, 0x3, 0x8, 0xfffeffff, 0x6, 0x1, 0x7, 0x7, 0x1, 0xfffffff9, 0x4779, 0x2, 0xe4b, 0xb78, 0x8, 0x6, 0x1, 0x9, 0x7, 0x9, 0x7d, 0x8, 0x7, 0x2eca, 0x7fffffff, 0x1, 0x4, 0xde, 0x7, 0x5, 0x7fffffff, 0x4, 0x10, 0x80000000, 0x3, 0xc, 0xfffffc08, 0xb, 0x10000, 0x5, 0x8, 0x7, 0x3f4, 0x7, 0x46, 0x80, 0x2, 0x5, 0x7, 0x10, 0x4, 0x0, 0xf26, 0x2, 0x7f, 0x5, 0x1, 0xefd, 0x7e5b, 0x8, 0xfffeffff, 0x4, 0x7, 0x6, 0x401, 0x4288, 0x101, 0x7, 0x3, 0x8, 0x4, 0xa1, 0x2a5d, 0x67, 0x68000000, 0x7ff, 0x14, 0xfffffffc, 0x17d, 0xfffffffc, 0x5, 0xfffffff9, 0x3, 0xfffffffa, 0xfff, 0x4, 0xfffffe01, 0x6, 0x6887, 0x3, 0x10000, 0x1, 0x3, 0x10000, 0x4, 0x2, 0xfffffff9, 0xfff, 0x2, 0x1, 0x8, 0x6, 0x10000, 0x6, 0x7bbb, 0x6, 0x400, 0x11, 0x357f5c60, 0x9, 0x7bfc, 0x2, 0x10, 0x564c, 0xbf, 0xfffffff7, 0x3, 0x3, 0x3, 0x2, 0x8, 0x8001, 0x7ff, 0x1800000, 0x7, 0x6, 0x6, 0x3ff, 0x0, 0x5, 0x81, 0xfffffffc, 0x9, 0xe, 0x7, 0x80, 0xa000, 0x9, 0x3, 0x7, 0x100, 0x6, 0x7fffffff, 0x3]}, @TCA_HTB_RTAB={0x404, 0x4, [0xfffffff8, 0x3, 0xfffffb8a, 0x1, 0x9, 0x10000, 0x7, 0x81, 0x6, 0x9, 0x9, 0x3, 0x4, 0x4, 0xfffffcd8, 0x2, 0x3, 0x8f, 0x7, 0xffffffff, 0x5, 0xe8, 0x73, 0x7273, 0x468, 0x5, 0x1, 0x401, 0x4, 0x1, 0x4, 0x7, 0x10001, 0x3, 0xe4, 0x80000001, 0x2, 0x200, 0x0, 0x2, 0x3, 0x7, 0x81, 0x7, 0x3, 0x1, 0x0, 0x10, 0x6, 0x1, 0x8, 0x9, 0xc0d, 0x0, 0x3ff, 0xd, 0xb389, 0x8001, 0x0, 0x80, 0x1e000, 0x0, 0xfffffe58, 0x5, 0x0, 0x7, 0x3, 0xc0000000, 0x1, 0x0, 0x7ff, 0x4cee0f59, 0x7, 0x401, 0x5, 0x3, 0x12, 0xffffff81, 0x8, 0x80, 0x9, 0x1, 0x362b, 0x7, 0xd73, 0x5, 0xbf, 0x6eaf, 0x7, 0x0, 0xb, 0x6000000, 0x9, 0xf2, 0x80000000, 0x3, 0x2f, 0x2, 0x8001, 0x7fffffff, 0x7, 0x4, 0xffff, 0x10000, 0x1b7, 0x7, 0x80, 0x1, 0x3, 0x4, 0x8, 0x24853f2, 0xffffffff, 0x2, 0x7, 0x53, 0x26, 0x2, 0x6, 0x5, 0x1a, 0x6, 0x5, 0x0, 0x3, 0xffffffff, 0x733, 0x0, 0x3, 0x3, 0x10000, 0x0, 0x0, 0xe, 0x7fffffff, 0x3ff, 0x7fff, 0x1, 0x0, 0x5, 0x0, 0x10, 0x7, 0x3ff, 0x80, 0x30000000, 0x0, 0xffffffff, 0x0, 0xfffff53a, 0x8, 0xb, 0x10, 0x2, 0x6, 0xd, 0x9, 0x8, 0x3, 0x5bda, 0x2, 0x3ff, 0x80000000, 0x7, 0x9, 0x6, 0x39b4, 0x1, 0x7ff, 0x0, 0x78a, 0x1, 0x8001, 0x6, 0x8, 0x6, 0x2, 0x78, 0x2, 0x8, 0xd, 0x1, 0x2, 0x5, 0xba60, 0x4, 0xfffffffa, 0x8, 0x7, 0x8, 0x9, 0x1f16, 0xb, 0x702abab0, 0x1400, 0x4, 0x7, 0x7, 0xd, 0x7, 0x3, 0x3f, 0xffff, 0xfffffff9, 0x8, 0x4, 0x9, 0x0, 0x3, 0x7, 0x3ff, 0x3, 0x8, 0x80, 0x9, 0x1, 0x5, 0x4, 0x7, 0xffff, 0x0, 0x3, 0x8, 0x5, 0xcf82, 0x1, 0x5, 0xd, 0x7fff, 0x5, 0x9, 0x0, 0x5, 0x393b, 0x81, 0x83, 0x3, 0x6, 0x100, 0xffffffff, 0x3, 0x1, 0x4742, 0x6, 0x1, 0x9, 0x1, 0x34, 0xc, 0x800, 0x9, 0x0, 0xff, 0x7, 0x2, 0x3]}, @TCA_HTB_RTAB={0x404, 0x4, [0x10, 0x7f, 0x12000, 0x215d07e4, 0x5, 0x2, 0x33, 0x8, 0xdf8, 0x9, 0x9, 0x8, 0x9f5, 0xfffffffc, 0xfffffffe, 0x2, 0x4, 0x9, 0x1, 0xc4a8, 0x4, 0x852e, 0x81, 0x8, 0x267e, 0xca3c, 0xfffffff7, 0x8, 0x1, 0x3, 0x8001, 0x9, 0x2, 0x1, 0x10001, 0xf2cd, 0x101, 0xd, 0x8, 0x400, 0xfffffff8, 0x8001, 0x7ff, 0x3, 0xf, 0x8, 0x3, 0x8, 0x80000000, 0xe17d, 0x3, 0x81, 0x9, 0x1, 0x7ff, 0x7, 0x5, 0xffffffff, 0xff, 0x5, 0x5, 0x1, 0x2, 0x2b, 0x8, 0x6, 0x4, 0xb, 0xabec, 0xb, 0x2, 0x1000, 0xffffffff, 0xd5a, 0x1, 0x6, 0x1fb, 0x4, 0x6, 0x0, 0x3, 0x81, 0x93, 0x6, 0x1, 0x8000, 0x4, 0x434f, 0x2, 0x1, 0x2, 0x6, 0x3, 0x1ff, 0x5, 0x6, 0x9, 0x7fff, 0x7f0, 0x5, 0x3, 0xfff, 0x2, 0x7, 0x4, 0x7, 0x100, 0xfff, 0x4, 0x7, 0x7fff, 0x7, 0x81, 0x4, 0x4, 0xfffffffb, 0x9, 0x7, 0x3, 0x7fffffff, 0x0, 0x1, 0x81, 0x5, 0x0, 0x6, 0xc, 0x6, 0x8, 0x2, 0x40000000, 0x64838d9c, 0x3, 0x8, 0x4, 0x9, 0x8000, 0x1, 0x5, 0x8, 0x7050, 0x9, 0x4, 0xfe3, 0x20000, 0x1d, 0x401, 0x4, 0x30, 0x2, 0xc, 0x7, 0x83b0, 0x1ff, 0x10000, 0xfff, 0x1000000, 0x3, 0x54, 0x2, 0x6, 0x3, 0x3, 0x5, 0x5, 0xffffff81, 0x1000, 0xfc3, 0x2, 0x18, 0x0, 0x3, 0x20000, 0x0, 0xc536, 0x7f, 0x7, 0x3, 0x3, 0x101, 0xfffffff8, 0x2, 0x6d, 0x5, 0xfffffffa, 0x4, 0x2, 0x5, 0xfffffffe, 0xb6b, 0x7fff, 0x1, 0x10001, 0x3, 0x401, 0x7, 0xffffffff, 0x0, 0x3, 0x2d32, 0x80, 0xfff, 0x80000000, 0x5, 0x9, 0x1788d6ec, 0x800, 0x5, 0x8, 0x10000, 0x2, 0x5, 0x4, 0x9, 0x0, 0x1, 0x6, 0x7, 0xf, 0x8dde, 0x7, 0x333b8000, 0x7, 0x2, 0x8, 0x5, 0x8, 0x7, 0xf217, 0x6, 0x3, 0x537, 0x81, 0x4443ef30, 0x0, 0x1, 0xced2, 0x0, 0xfffffffb, 0x7fff, 0x1, 0x8, 0x9, 0x5e2, 0x0, 0xb, 0x4, 0x7ff, 0x8, 0x8, 0x200, 0x1, 0x6, 0x0, 0xb, 0x2]}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) kernel console output (not intermixed with test programs): kaller0> [ 109.950196][ T6784] GUP no longer grows the stack in syz.1.242 (6784): 200000006000-200000008000 (200000005000) [ 109.983032][ T6784] CPU: 0 UID: 0 PID: 6784 Comm: syz.1.242 Not tainted syzkaller #0 PREEMPT(full) [ 109.983062][ T6784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 109.983083][ T6784] Call Trace: [ 109.983092][ T6784] [ 109.983101][ T6784] dump_stack_lvl+0x189/0x250 [ 109.983139][ T6784] ? __pfx_dump_stack_lvl+0x10/0x10 [ 109.983174][ T6784] ? __pfx__printk+0x10/0x10 [ 109.983199][ T6784] ? find_vma+0xe7/0x160 [ 109.983241][ T6784] __get_user_pages+0x24d0/0x2ce0 [ 109.983265][ T6784] ? __lock_acquire+0xab9/0xd20 [ 109.983324][ T6784] ? __gup_longterm_locked+0xc68/0x1660 [ 109.983359][ T6784] __gup_longterm_locked+0xde9/0x1660 [ 109.983400][ T6784] ? sanity_check_pinned_pages+0x123a/0x1300 [ 109.983434][ T6784] gup_fast_fallback+0x1e6a/0x2010 [ 109.983496][ T6784] ? __pfx_gup_fast_fallback+0x10/0x10 [ 109.983537][ T6784] ? pin_user_pages_fast+0x4d/0xb0 [ 109.983565][ T6784] iov_iter_extract_pages+0x35a/0x5e0 [ 109.983603][ T6784] extract_iter_to_sg+0xe46/0x24e0 [ 109.983640][ T6784] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 109.983663][ T6784] ? __local_bh_enable_ip+0x12d/0x1c0 [ 109.983683][ T6784] ? lockdep_hardirqs_on+0x9c/0x150 [ 109.983707][ T6784] ? __local_bh_enable_ip+0x12d/0x1c0 [ 109.983727][ T6784] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 109.983755][ T6784] ? __asan_memset+0x22/0x50 [ 109.983781][ T6784] hash_sendmsg+0x4f4/0x11d0 [ 109.983853][ T6784] ? __pfx_hash_sendmsg+0x10/0x10 [ 109.983884][ T6784] __sock_sendmsg+0x219/0x270 [ 109.983921][ T6784] ____sys_sendmsg+0x52d/0x830 [ 109.983955][ T6784] ? __pfx_____sys_sendmsg+0x10/0x10 [ 109.983993][ T6784] ? import_iovec+0x74/0xa0 [ 109.984024][ T6784] ___sys_sendmsg+0x21f/0x2a0 [ 109.984054][ T6784] ? __pfx____sys_sendmsg+0x10/0x10 [ 109.984121][ T6784] ? __fget_files+0x2a/0x420 [ 109.984139][ T6784] ? __fget_files+0x3a0/0x420 [ 109.984179][ T6784] __sys_sendmmsg+0x227/0x430 [ 109.984212][ T6784] ? __pfx___sys_sendmmsg+0x10/0x10 [ 109.984236][ T6784] ? do_futex+0x333/0x420 [ 109.984271][ T6784] ? fd_install+0x97/0x540 [ 109.984318][ T6784] ? __pfx___se_sys_futex+0x10/0x10 [ 109.984346][ T6784] ? rcu_is_watching+0x15/0xb0 [ 109.984373][ T6784] __x64_sys_sendmmsg+0xa0/0xc0 [ 109.984402][ T6784] do_syscall_64+0xfa/0x3b0 [ 109.984425][ T6784] ? lockdep_hardirqs_on+0x9c/0x150 [ 109.984445][ T6784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.984466][ T6784] ? clear_bhb_loop+0x60/0xb0 [ 109.984491][ T6784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.984511][ T6784] RIP: 0033:0x7fcd8698eec9 [ 109.984539][ T6784] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 109.984556][ T6784] RSP: 002b:00007fcd87872038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 109.984578][ T6784] RAX: ffffffffffffffda RBX: 00007fcd86be6090 RCX: 00007fcd8698eec9 [ 109.984593][ T6784] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000007 [ 109.984605][ T6784] RBP: 00007fcd86a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 109.984617][ T6784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.984629][ T6784] R13: 00007fcd86be6128 R14: 00007fcd86be6090 R15: 00007ffe010ae398 [ 109.984661][ T6784] [ 110.387105][ T6790] netlink: 108 bytes leftover after parsing attributes in process `syz.3.245'. [ 110.396304][ T6790] netlink: 8 bytes leftover after parsing attributes in process `syz.3.245'. [ 110.548567][ T6797] netlink: 36 bytes leftover after parsing attributes in process `syz.3.247'. [ 110.730718][ T5880] tipc: Node number set to 949694433 [ 110.883078][ T5186] Bluetooth: hci4: command 0x0405 tx timeout [ 111.590733][ T6774] tipc: Disabling bearer [ 111.853615][ T6822] netlink: 808 bytes leftover after parsing attributes in process `syz.0.253'. [ 111.954167][ T6826] dvmrp0: entered allmulticast mode [ 112.156989][ T6826] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 112.891502][ T6880] trusted_key: syz.2.268 sent an empty control message without MSG_MORE. [ 113.262808][ T6910] Unsupported ieee802154 address type: 0 [ 114.547655][ T6914] bridge2: entered promiscuous mode [ 114.554109][ T6914] bridge2: entered allmulticast mode [ 114.656887][ T6932] tipc: Enabling of bearer rejected, failed to enable media [ 114.753579][ T6942] sctp: [Deprecated]: syz.2.284 (pid 6942) Use of struct sctp_assoc_value in delayed_ack socket option. [ 114.753579][ T6942] Use struct sctp_sack_info instead [ 114.850203][ T6945] openvswitch: netlink: IPv6 tunnel dst address is zero [ 114.950315][ T6954] netlink: 'syz.2.288': attribute type 8 has an invalid length. [ 115.004687][ T6953] sctp: [Deprecated]: syz.0.289 (pid 6953) Use of struct sctp_assoc_value in delayed_ack socket option. [ 115.004687][ T6953] Use struct sctp_sack_info instead [ 115.041463][ T6958] veth0: entered promiscuous mode [ 115.073960][ T6963] __nla_validate_parse: 6 callbacks suppressed [ 115.073979][ T6963] netlink: 8 bytes leftover after parsing attributes in process `syz.3.290'. [ 115.082846][ T6961] sctp: [Deprecated]: syz.0.289 (pid 6961) Use of struct sctp_assoc_value in delayed_ack socket option. [ 115.082846][ T6961] Use struct sctp_sack_info instead [ 115.106852][ T6963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.290'. [ 115.126098][ T6958] batadv_slave_1: entered promiscuous mode [ 115.143386][ T6958] batman_adv: batadv0: Adding interface: macsec2 [ 115.176423][ T6958] batman_adv: batadv0: The MTU of interface macsec2 is too small (1468) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 115.228881][ T6958] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 115.260750][ T6958] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.313186][ T6958] batman_adv: batadv0: Interface activated: macsec2 [ 115.349874][ T6957] veth0: left promiscuous mode [ 115.579002][ T6987] netlink: 20 bytes leftover after parsing attributes in process `syz.2.296'. [ 115.663279][ T6992] netlink: 36 bytes leftover after parsing attributes in process `syz.0.298'. [ 115.714821][ T6992] Bluetooth: MGMT ver 1.23 [ 115.926259][ T7001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.300'. [ 116.162626][ T7008] sctp: [Deprecated]: syz.0.302 (pid 7008) Use of struct sctp_assoc_value in delayed_ack socket option. [ 116.162626][ T7008] Use struct sctp_sack_info instead [ 116.185440][ T7008] sctp: [Deprecated]: syz.0.302 (pid 7008) Use of int in maxseg socket option. [ 116.185440][ T7008] Use struct sctp_assoc_value instead [ 116.275645][ T7015] netlink: 'syz.3.305': attribute type 2 has an invalid length. [ 116.296003][ T7015] netem: change failed [ 116.305030][ T7015] netlink: 28 bytes leftover after parsing attributes in process `syz.3.305'. [ 116.500346][ T7028] netlink: 'syz.1.310': attribute type 2 has an invalid length. [ 116.515299][ T7028] netlink: 4 bytes leftover after parsing attributes in process `syz.1.310'. [ 116.608442][ T7032] netlink: 4 bytes leftover after parsing attributes in process `syz.2.311'. [ 116.608791][ T7034] netlink: 159784 bytes leftover after parsing attributes in process `syz.1.313'. [ 116.640760][ T7032] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 116.648302][ T7032] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 116.665797][ T7032] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 116.691244][ T7032] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 116.798986][ T7044] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 116.866442][ T7046] tipc: Enabled bearer , priority 10 [ 116.876830][ T7046] tipc: Enabling of bearer rejected, already enabled [ 117.469164][ T7075] netlink: 16 bytes leftover after parsing attributes in process `syz.0.325'. [ 117.791518][ T7101] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 117.834361][ T7101] batman_adv: batadv0: Interface deactivated: macsec2 [ 117.858494][ T7101] batman_adv: batadv0: Removing interface: macsec2 [ 117.874109][ T7101] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 138.154393][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.161118][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 140.310554][ T7134] netlink: 'syz.3.342': attribute type 1 has an invalid length. [ 140.450039][ T7133] netlink: 'syz.4.343': attribute type 2 has an invalid length. [ 140.476338][ T7134] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 140.524548][ T7142] __nla_validate_parse: 1 callbacks suppressed [ 140.524568][ T7142] netlink: 12 bytes leftover after parsing attributes in process `syz.4.343'. [ 140.605199][ T7132] vxcan1 speed is unknown, defaulting to 1000 [ 140.628128][ T7145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.344'. [ 140.907983][ T7154] netlink: 'syz.0.347': attribute type 8 has an invalid length. [ 140.927582][ T7157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.349'. [ 141.243689][ T7167] siw: device registration error -23 [ 141.363217][ T7173] netlink: 'syz.4.353': attribute type 1 has an invalid length. [ 141.385505][ T7173] netlink: 'syz.4.353': attribute type 1 has an invalid length. [ 141.417268][ T7169] netlink: 56 bytes leftover after parsing attributes in process `syz.4.353'. [ 141.453386][ T7173] netlink: 'syz.4.353': attribute type 1 has an invalid length. [ 141.463147][ T7173] netlink: 'syz.4.353': attribute type 2 has an invalid length. [ 141.472509][ T7173] netlink: 76 bytes leftover after parsing attributes in process `syz.4.353'. [ 141.538706][ T7181] netlink: 'syz.3.355': attribute type 21 has an invalid length. [ 141.633050][ T7185] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 141.767015][ T7188] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 142.012760][ T7206] netlink: 'syz.1.362': attribute type 24 has an invalid length. [ 142.066889][ T7207] can: request_module (can-proto-0) failed. [ 142.257235][ T7226] netlink: zone id is out of range [ 142.303215][ T7229] netlink: 72 bytes leftover after parsing attributes in process `syz.3.367'. [ 142.371485][ T7233] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.369'. [ 142.919458][ T7250] netlink: 12 bytes leftover after parsing attributes in process `syz.4.374'. [ 143.346350][ T7278] netlink: 8 bytes leftover after parsing attributes in process `syz.3.384'. [ 143.434068][ T7287] netlink: 'syz.4.386': attribute type 1 has an invalid length. [ 143.503019][ T7287] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 143.525907][ T7287] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 143.536859][ T7287] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 143.736251][ T7300] netlink: 24 bytes leftover after parsing attributes in process `syz.4.389'. [ 143.855719][ T7304] Illegal XDP return value 1499740658 on prog (id 67) dev N/A, expect packet loss! [ 143.865472][ T7305] batadv0: entered promiscuous mode [ 143.875106][ T7305] batadv0: entered allmulticast mode [ 143.881478][ T7305] bridge0: port 3(batadv0) entered blocking state [ 143.888324][ T7305] bridge0: port 3(batadv0) entered disabled state [ 143.902132][ T7305] bridge0: port 3(batadv0) entered blocking state [ 143.908966][ T7305] bridge0: port 3(batadv0) entered forwarding state [ 144.052951][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 144.062863][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 144.278864][ T7325] openvswitch: netlink: Message has 5 unknown bytes. [ 145.005451][ T7355] netlink: zone id is out of range [ 145.013620][ T7355] netlink: zone id is out of range [ 145.018918][ T7355] netlink: zone id is out of range [ 145.026666][ T7355] netlink: zone id is out of range [ 145.037380][ T7355] netlink: zone id is out of range [ 145.047925][ T7355] netlink: zone id is out of range [ 145.542197][ T7382] __nla_validate_parse: 74 callbacks suppressed [ 145.542218][ T7382] netlink: 56 bytes leftover after parsing attributes in process `syz.2.422'. [ 145.563849][ T7384] netlink: 48 bytes leftover after parsing attributes in process `syz.4.423'. [ 146.120240][ T7417] netlink: 12 bytes leftover after parsing attributes in process `syz.4.431'. [ 146.207467][ T7420] validate_nla: 6 callbacks suppressed [ 146.207487][ T7420] netlink: 'syz.1.433': attribute type 10 has an invalid length. [ 146.260129][ T7420] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.284249][ T7420] bond0: (slave team0): Enslaving as an active interface with an up link [ 146.299198][ T7424] netlink: 8 bytes leftover after parsing attributes in process `syz.4.435'. [ 146.321964][ T7424] netlink: 68 bytes leftover after parsing attributes in process `syz.4.435'. [ 146.358395][ T7427] vlan2: entered promiscuous mode [ 146.758938][ T7449] unsupported nla_type 52263 [ 147.006063][ T7450] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 147.077391][ T7447] wg2: entered promiscuous mode [ 147.087870][ T7447] wg2: entered allmulticast mode [ 147.510702][ T5874] Bluetooth: hci4: command 0x0405 tx timeout [ 147.772182][ T7472] netlink: 12 bytes leftover after parsing attributes in process `syz.3.449'. [ 149.365894][ T7522] netlink: 256 bytes leftover after parsing attributes in process `syz.4.464'. [ 149.500384][ T7528] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 149.607117][ T7532] netlink: 'syz.1.466': attribute type 33 has an invalid length. [ 149.712753][ T7539] netlink: 36 bytes leftover after parsing attributes in process `syz.1.468'. [ 149.896092][ T7544] netlink: 'syz.4.469': attribute type 12 has an invalid length. [ 149.991656][ T7549] team0: Device gtp0 is of different type [ 150.385654][ T7565] net_ratelimit: 12 callbacks suppressed [ 150.385679][ T7565] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 150.418278][ T7566] geneve2: entered promiscuous mode [ 150.423817][ T7566] geneve2: entered allmulticast mode [ 150.442296][ T13] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 150.468533][ T13] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 150.502322][ T13] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 150.523098][ T13] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 150.977798][ T7579] team0: Device gtp0 is of different type [ 151.888377][ T7428] Set syz1 is full, maxelem 65536 reached [ 177.097195][ T5868] IPVS: starting estimator thread 0... [ 177.195875][ T7623] netlink: 8 bytes leftover after parsing attributes in process `syz.3.494'. [ 177.205027][ T7619] IPVS: using max 27 ests per chain, 64800 per kthread [ 177.230766][ T7623] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 177.239314][ T7624] dvmrp0: entered allmulticast mode [ 177.244989][ T7623] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 177.586997][ T7647] netlink: 16 bytes leftover after parsing attributes in process `syz.1.502'. [ 177.689423][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.729062][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.745473][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.763753][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.774377][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.791021][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.804071][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 177.825176][ T7655] netlink: 48 bytes leftover after parsing attributes in process `syz.3.504'. [ 178.078257][ T7674] team_slave_0: entered allmulticast mode [ 178.399977][ T7694] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 178.405221][ T7697] Set syz1 is full, maxelem 65536 reached [ 178.486568][ T7701] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 178.635060][ T7707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 178.676264][ T7717] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 178.746653][ T7720] openvswitch: netlink: Actions may not be safe on all matching packets [ 179.026644][ T7737] netlink: 'syz.2.532': attribute type 10 has an invalid length. [ 179.042620][ T5186] Bluetooth: hci4: command 0x0405 tx timeout [ 179.070539][ T7737] team0: Port device geneve0 added [ 179.317118][ T7754] x_tables: ip_tables: udp match: only valid for protocol 17 [ 179.673667][ T7781] openvswitch: netlink: IP tunnel TTL not specified. [ 180.066074][ T7782] infiniband syz1: set down [ 180.077043][ T7782] infiniband syz1: added macvlan0 [ 180.104696][ T7810] vxcan1 speed is unknown, defaulting to 1000 [ 180.169829][ T7782] RDS/IB: syz1: added [ 180.178223][ T7782] smc: adding ib device syz1 with port count 1 [ 180.186403][ T7782] smc: ib device syz1 port 1 has pnetid [ 180.855388][ T7849] openvswitch: netlink: IPv4 frag type 255 is out of range max 2 [ 181.215639][ T7862] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 181.235887][ T7862] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 181.260130][ T7862] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 181.903563][ T7889] netlink: 'syz.2.576': attribute type 1 has an invalid length. [ 182.028851][ T7890] 8021q: adding VLAN 0 to HW filter on device bond2 [ 182.038358][ T7890] bond1: (slave bond2): making interface the new active one [ 182.047515][ T7890] bond1: (slave bond2): Enslaving as an active interface with an up link [ 182.097724][ T7889] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 182.140270][ T7890] 8021q: adding VLAN 0 to HW filter on device bond1 [ 182.156471][ T7899] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 182.415864][ T7914] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 182.703085][ T7926] __nla_validate_parse: 68 callbacks suppressed [ 182.703106][ T7926] netlink: 4 bytes leftover after parsing attributes in process `syz.0.585'. [ 182.704454][ T7923] netlink: 24 bytes leftover after parsing attributes in process `syz.3.583'. [ 182.868280][ T7932] netlink: 'syz.2.586': attribute type 1 has an invalid length. [ 182.878263][ T7923] netlink: 4 bytes leftover after parsing attributes in process `syz.3.583'. [ 183.007557][ T7932] netlink: 4 bytes leftover after parsing attributes in process `syz.2.586'. [ 183.109872][ T7937] bond3: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 183.139528][ T7937] bond3: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 183.154689][ T7937] bond3: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 183.265256][ T7947] bridge0: port 3(ipvlan2) entered blocking state [ 183.272233][ T7947] bridge0: port 3(ipvlan2) entered disabled state [ 183.278982][ T7947] ipvlan2: entered allmulticast mode [ 183.312621][ T7947] bridge0: entered allmulticast mode [ 183.343030][ T7947] ipvlan2: left allmulticast mode [ 183.348212][ T7947] bridge0: left allmulticast mode [ 183.563823][ T7966] netlink: 900 bytes leftover after parsing attributes in process `syz.0.599'. [ 183.577432][ T7966] netlink: 44 bytes leftover after parsing attributes in process `syz.0.599'. [ 183.820276][ T7975] netlink: 56 bytes leftover after parsing attributes in process `syz.0.602'. [ 183.841281][ T7975] netlink: 24 bytes leftover after parsing attributes in process `syz.0.602'. [ 184.486161][ T8018] netlink: 8 bytes leftover after parsing attributes in process `syz.3.615'. [ 185.005613][ T8054] tipc: Enabling of bearer rejected, already enabled [ 185.009372][ T8056] netlink: 88 bytes leftover after parsing attributes in process `syz.4.627'. [ 185.040517][ T8054] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 185.084067][ T8054] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 185.116019][ T8054] tipc: Resetting bearer [ 185.153519][ T8054] tipc: Resetting bearer [ 185.294427][ T8073] nbd: must specify a device to reconfigure [ 185.305749][ T8069] team0: Device ip6gre1 is of different type [ 185.445758][ T3478] tipc: Resetting bearer [ 185.558882][ T8087] netlink: 'syz.4.636': attribute type 10 has an invalid length. [ 185.641893][ T8087] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 186.042992][ T8119] tipc: Enabled bearer , priority 0 [ 186.147335][ T8118] tipc: Disabling bearer [ 186.369785][ T8139] netlink: 'syz.4.656': attribute type 21 has an invalid length. [ 186.934468][ T8170] netlink: 'syz.4.665': attribute type 1 has an invalid length. [ 186.986008][ T8170] 8021q: adding VLAN 0 to HW filter on device bond2 [ 187.058654][ T8170] bond2: (slave gretap2): making interface the new active one [ 187.094643][ T8170] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 187.104058][ T8173] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 187.134008][ T8174] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 187.321779][ T8195] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 187.607485][ T8212] tipc: Enabled bearer , priority 0 [ 187.619255][ T8212] syzkaller0: entered promiscuous mode [ 187.635040][ T8212] syzkaller0: entered allmulticast mode [ 187.763602][ T8216] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 187.824577][ T8219] netlink: 'syz.3.678': attribute type 4 has an invalid length. [ 187.861537][ T8216] tipc: Resetting bearer [ 187.950332][ T8231] __nla_validate_parse: 44 callbacks suppressed [ 187.950354][ T8231] netlink: 32 bytes leftover after parsing attributes in process `syz.0.682'. [ 188.095046][ T8239] netlink: 20 bytes leftover after parsing attributes in process `syz.0.684'. [ 188.296232][ T8251] xt_limit: Overflow, try lower: 271964/0 [ 188.380265][ T8254] netlink: 9 bytes leftover after parsing attributes in process `syz.0.690'. [ 188.393191][ T8210] tipc: Resetting bearer [ 188.438562][ T8210] tipc: Disabling bearer [ 188.499339][ T8264] netlink: 4 bytes leftover after parsing attributes in process `syz.3.693'. [ 188.613960][ T8273] netlink: 56 bytes leftover after parsing attributes in process `syz.1.695'. [ 188.625727][ T8271] netlink: 36 bytes leftover after parsing attributes in process `syz.1.695'. [ 189.006472][ T8285] netlink: 'syz.3.697': attribute type 1 has an invalid length. [ 189.037825][ T8285] netlink: 'syz.3.697': attribute type 1 has an invalid length. [ 189.116820][ T8288] netlink: 'syz.1.699': attribute type 1 has an invalid length. [ 189.157690][ T8288] netlink: 152 bytes leftover after parsing attributes in process `syz.1.699'. [ 189.373497][ T8312] syzkaller0: entered promiscuous mode [ 189.379232][ T8312] syzkaller0: entered allmulticast mode [ 189.395377][ T37] syzkaller0: tun_net_xmit 70 [ 192.880360][ T8342] netlink: 72 bytes leftover after parsing attributes in process `syz.1.714'. [ 192.918385][ T8346] netlink: 'syz.3.713': attribute type 2 has an invalid length. [ 193.239963][ T8371] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 193.544366][ T8390] netlink: 32 bytes leftover after parsing attributes in process `syz.1.726'. [ 193.993258][ T8411] netlink: 'syz.3.732': attribute type 1 has an invalid length. [ 194.003652][ T8411] netlink: 28 bytes leftover after parsing attributes in process `syz.3.732'. [ 194.134546][ T8413] tipc: Started in network mode [ 194.139594][ T8413] tipc: Node identity 9a43ee0228d7, cluster identity 4711 [ 194.147547][ T8413] tipc: Enabled bearer , priority 0 [ 194.162155][ T8413] syzkaller0: entered promiscuous mode [ 194.167882][ T8413] syzkaller0: entered allmulticast mode [ 194.177497][ T8413] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 194.199152][ T8413] tipc: Resetting bearer [ 194.209505][ T8412] tipc: Resetting bearer [ 194.224871][ T8412] tipc: Disabling bearer [ 194.298306][ T8415] netlink: 16 bytes leftover after parsing attributes in process `syz.2.734'. [ 194.422915][ T8427] tipc: Started in network mode [ 194.444632][ T8427] tipc: Node identity ac14140f, cluster identity 4711 [ 194.469636][ T8427] tipc: New replicast peer: 255.255.255.255 [ 194.484085][ T8427] tipc: Enabled bearer , priority 10 [ 194.504380][ T8431] netlink: 'syz.3.739': attribute type 4 has an invalid length. [ 194.635343][ T8438] netlink: 'syz.1.741': attribute type 3 has an invalid length. [ 194.699689][ T8438] netlink: 'syz.1.741': attribute type 3 has an invalid length. [ 194.907785][ T8456] netlink: 8 bytes leftover after parsing attributes in process `syz.4.745'. [ 195.039008][ T8464] sit0: entered promiscuous mode [ 195.055585][ T8464] sit0: left allmulticast mode [ 195.061654][ T8464] netlink: 'syz.2.748': attribute type 1 has an invalid length. [ 195.069472][ T8464] netlink: 1 bytes leftover after parsing attributes in process `syz.2.748'. [ 195.180338][ T8464] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.351386][ T8480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.753'. [ 195.357736][ T8464] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.399355][ T8475] netlink: 36 bytes leftover after parsing attributes in process `syz.3.751'. [ 195.425209][ T8480] netlink: 68 bytes leftover after parsing attributes in process `syz.4.753'. [ 195.425543][ T8475] netlink: 'syz.3.751': attribute type 5 has an invalid length. [ 195.534273][ T8464] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.609769][ T10] tipc: Node number set to 2886997007 [ 195.652411][ T8464] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.849212][ T8490] tipc: Enabled bearer , priority 0 [ 195.885851][ T3478] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.943262][ T3478] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.004900][ T8504] netlink: 24 bytes leftover after parsing attributes in process `syz.4.762'. [ 196.015854][ T3478] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.019972][ T8505] netlink: 'syz.0.761': attribute type 32 has an invalid length. [ 196.034720][ T8490] tipc: Resetting bearer [ 196.045307][ T8504] netlink: 'syz.4.762': attribute type 2 has an invalid length. [ 196.059658][ T8504] netlink: 12 bytes leftover after parsing attributes in process `syz.4.762'. [ 196.097343][ T3478] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.128803][ T8504] veth0_macvtap: left promiscuous mode [ 196.265266][ T8490] tipc: Disabling bearer [ 197.523473][ T8566] bridge0: port 3(batadv0) entered disabled state [ 197.595007][ T8566] bridge_slave_1: left allmulticast mode [ 197.621131][ T8566] bridge_slave_1: left promiscuous mode [ 197.628905][ T8566] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.652571][ T8566] bridge_slave_0: left allmulticast mode [ 197.664391][ T8566] bridge_slave_0: left promiscuous mode [ 197.678123][ T8566] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.778760][ T8583] netlink: 'syz.1.780': attribute type 83 has an invalid length. [ 197.849201][ T8557] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 198.330903][ T8609] netlink: 'syz.3.789': attribute type 1 has an invalid length. [ 198.589061][ T8597] batadv0: left promiscuous mode [ 198.663203][ T8597] wg2: left promiscuous mode [ 198.829614][ T8597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 198.865440][ T8597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 199.029196][ T8626] __nla_validate_parse: 9 callbacks suppressed [ 199.029217][ T8626] netlink: 28 bytes leftover after parsing attributes in process `syz.2.790'. [ 199.048906][ T8626] netlink: 12 bytes leftover after parsing attributes in process `syz.2.790'. [ 199.067603][ T8627] netlink: 28 bytes leftover after parsing attributes in process `syz.2.790'. [ 199.078635][ T8627] netlink: 12 bytes leftover after parsing attributes in process `syz.2.790'. [ 199.299576][ T8597] gretap1: left promiscuous mode [ 199.365838][ T8608] netlink: 92 bytes leftover after parsing attributes in process `syz.1.788'. [ 199.537575][ T5975] vxcan1 speed is unknown, defaulting to 1000 [ 199.537605][ T3478] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.553764][ T5975] syz2: Port: 1 Link DOWN [ 199.580444][ T5975] vxcan1 speed is unknown, defaulting to 1000 [ 199.601784][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.615658][ T3478] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.642744][ T3478] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.658096][ T3478] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.822095][ T8656] tipc: Enabled bearer , priority 0 [ 199.903432][ T8658] syzkaller0: entered promiscuous mode [ 199.908981][ T8658] syzkaller0: entered allmulticast mode [ 199.937437][ T8660] netlink: 20 bytes leftover after parsing attributes in process `syz.4.799'. [ 199.954689][ T8658] tipc: Resetting bearer [ 199.960281][ T8666] netlink: 36 bytes leftover after parsing attributes in process `syz.3.801'. [ 199.973142][ T8655] tipc: Resetting bearer [ 199.995813][ T8655] tipc: Disabling bearer [ 200.436536][ T8691] netlink: 24 bytes leftover after parsing attributes in process `syz.2.810'. [ 200.458527][ T8691] netlink: 'syz.2.810': attribute type 3 has an invalid length. [ 200.467171][ T8691] netlink: 32 bytes leftover after parsing attributes in process `syz.2.810'. [ 200.637149][ T8701] netlink: 'syz.2.811': attribute type 12 has an invalid length. [ 200.660139][ T8701] netlink: 'syz.2.811': attribute type 29 has an invalid length. [ 200.670076][ T8701] netlink: 148 bytes leftover after parsing attributes in process `syz.2.811'. [ 200.685498][ T8701] netlink: 'syz.2.811': attribute type 2 has an invalid length. [ 200.695948][ T8701] netlink: 'syz.2.811': attribute type 3 has an invalid length. [ 200.865570][ T8713] netlink: 'syz.1.815': attribute type 1 has an invalid length. [ 200.990026][ T8713] 8021q: adding VLAN 0 to HW filter on device bond2 [ 201.045727][ T8727] macvtap1: entered promiscuous mode [ 201.052779][ T8727] vlan0: entered promiscuous mode [ 201.058249][ T8727] macvtap1: entered allmulticast mode [ 201.065021][ T8727] vlan0: entered allmulticast mode [ 201.071759][ T8727] veth0_vlan: entered allmulticast mode [ 201.104210][ T8727] macvtap2: entered promiscuous mode [ 201.109699][ T8727] macvtap2: entered allmulticast mode [ 201.341631][ T8744] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 201.618168][ T8754] bridge_slave_1: left allmulticast mode [ 201.626153][ T8754] bridge_slave_1: left promiscuous mode [ 201.633190][ T8754] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.650197][ T8754] bridge_slave_0: left allmulticast mode [ 201.658162][ T8754] bridge_slave_0: left promiscuous mode [ 201.665604][ T8754] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.883991][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805b6b4800: rx timeout, send abort [ 201.895287][ C1] vxcan1: j1939_xtp_rx_abort_one: 0xffff88805b6b4800: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 202.988979][ T8813] tipc: Enabling of bearer rejected, already enabled [ 203.143669][ T8818] 8021q: adding VLAN 0 to HW filter on device bond3 [ 203.436370][ T8831] vxcan1 speed is unknown, defaulting to 1000 [ 203.439312][ T8836] batadv_slave_0: entered promiscuous mode [ 203.540788][ T8836] batadv_slave_0: left promiscuous mode [ 203.969982][ T37] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 204.016432][ T37] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 204.055483][ T37] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 204.081816][ T37] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 204.419457][ T8882] __nla_validate_parse: 11 callbacks suppressed [ 204.419478][ T8882] netlink: 20 bytes leftover after parsing attributes in process `syz.4.862'. [ 204.729192][ T8891] netlink: 16 bytes leftover after parsing attributes in process `syz.4.864'. [ 205.603613][ T8934] netlink: 4 bytes leftover after parsing attributes in process `syz.4.879'. [ 205.626226][ T8937] netlink: 4 bytes leftover after parsing attributes in process `syz.0.878'. [ 205.655831][ T8936] netlink: 20 bytes leftover after parsing attributes in process `syz.0.878'. [ 205.769963][ T8940] netlink: 'syz.4.879': attribute type 5 has an invalid length. [ 205.953267][ T8952] netlink: 'syz.2.883': attribute type 10 has an invalid length. [ 205.979088][ T8952] netlink: 4 bytes leftover after parsing attributes in process `syz.2.883'. [ 206.229609][ T8968] netlink: 8 bytes leftover after parsing attributes in process `syz.2.887'. [ 206.281189][ T8964] netlink: 'syz.2.887': attribute type 4 has an invalid length. [ 206.352474][ T8972] netlink: 14544 bytes leftover after parsing attributes in process `syz.0.889'. [ 206.531211][ T8983] tipc: Enabling of bearer rejected, already enabled [ 206.632671][ T8983] netlink: 12 bytes leftover after parsing attributes in process `syz.2.893'. [ 206.705682][ T8983] 8021q: adding VLAN 0 to HW filter on device bond4 [ 207.579606][ T9061] netlink: 4 bytes leftover after parsing attributes in process `syz.4.912'. [ 208.034540][ T9086] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 208.037511][ T8621] IPVS: starting estimator thread 0... [ 208.150671][ T9098] IPVS: using max 24 ests per chain, 57600 per kthread [ 208.303634][ T9107] IPVS: set_ctl: invalid protocol: 29 10.1.1.1:20000 [ 208.327471][ T9109] lo: entered allmulticast mode [ 208.537840][ T9122] lo: left allmulticast mode [ 208.660182][ T9124] tipc: Resetting bearer [ 208.668011][ T9124] tipc: Resetting bearer [ 208.697905][ T9124] gretap0: entered promiscuous mode [ 208.707729][ T9132] netlink: 'syz.4.934': attribute type 1 has an invalid length. [ 208.773927][ T9133] veth3: entered promiscuous mode [ 209.088581][ T9145] veth3: entered allmulticast mode [ 209.135482][ T9147] team1: entered promiscuous mode [ 209.143044][ T9147] team1: entered allmulticast mode [ 209.670883][ T9167] unknown channel width for channel at 909000KHz? [ 209.771196][ T9173] netlink: 'syz.1.947': attribute type 1 has an invalid length. [ 209.827914][ T9174] netlink: 'syz.1.947': attribute type 1 has an invalid length. [ 209.934468][ T9177] netlink: 'syz.4.949': attribute type 1 has an invalid length. [ 210.409551][ T9177] veth5: entered promiscuous mode [ 210.441902][ T9195] __nla_validate_parse: 9 callbacks suppressed [ 210.441925][ T9195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.951'. [ 210.603379][ T9200] netlink: 104 bytes leftover after parsing attributes in process `syz.4.953'. [ 210.826027][ T9205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.955'. [ 210.849425][ T9205] bridge_slave_1: left allmulticast mode [ 210.889699][ T9205] bridge_slave_1: left promiscuous mode [ 210.917085][ T9205] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.945079][ T9212] netlink: 12 bytes leftover after parsing attributes in process `syz.4.956'. [ 210.961818][ T9212] netlink: 12 bytes leftover after parsing attributes in process `syz.4.956'. [ 210.993777][ T9205] bridge_slave_0: left allmulticast mode [ 211.016469][ T9205] bridge_slave_0: left promiscuous mode [ 211.047186][ T9205] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.284469][ T9206] bridge_slave_0: left allmulticast mode [ 211.290254][ T9206] bridge_slave_0: left promiscuous mode [ 211.299614][ T9206] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.546738][ T9206] bridge_slave_1: left allmulticast mode [ 211.558140][ T9206] bridge_slave_1: left promiscuous mode [ 211.566769][ T9206] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.615969][ T9206] bond0: (slave bond_slave_0): Releasing backup interface [ 211.642424][ T9206] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 211.910999][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 211.911481][ T5867] Bluetooth: hci1: command 0x0406 tx timeout [ 211.917107][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 212.223655][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.271610][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.300567][ T972] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 212.310088][ T972] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 213.519636][ T9294] netlink: 576 bytes leftover after parsing attributes in process `syz.1.978'. [ 213.552087][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.4.974'. [ 213.581131][ T9286] netlink: 24 bytes leftover after parsing attributes in process `syz.4.974'. [ 213.786689][ T9306] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 213.842564][ T9308] tipc: Enabled bearer , priority 0 [ 213.864537][ T9308] syzkaller0: entered promiscuous mode [ 213.881159][ T9308] syzkaller0: entered allmulticast mode [ 213.903945][ T9308] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 213.945894][ T9308] tipc: Resetting bearer [ 213.965446][ T9307] tipc: Resetting bearer [ 213.991239][ T9307] tipc: Disabling bearer [ 214.153860][ T9318] netlink: 20 bytes leftover after parsing attributes in process `syz.2.985'. [ 214.429875][ T9325] netlink: 8 bytes leftover after parsing attributes in process `syz.1.988'. [ 214.769317][ T9331] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 215.527097][ T9351] __nla_validate_parse: 2 callbacks suppressed [ 215.527116][ T9351] netlink: 4 bytes leftover after parsing attributes in process `syz.0.999'. [ 215.841294][ T9367] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1001'. [ 215.889406][ T9369] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1003'. [ 215.904409][ T9369] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1003'. [ 216.455317][ T9400] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1014'. [ 216.537089][ T9152] Set syz1 is full, maxelem 65536 reached [ 217.033877][ T9428] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1022'. [ 217.165552][ T9431] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1024'. [ 217.273984][ T9442] netlink: 4104 bytes leftover after parsing attributes in process `syz.2.1026'. [ 217.318729][ T9442] openvswitch: netlink: Flow key attr not present in new flow. [ 217.484787][ T9451] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1030'. [ 217.566067][ T9457] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1032'. [ 218.463799][ T9508] bond0: (slave bond_slave_0): Releasing backup interface [ 218.503394][ T9508] bond0: (slave bond_slave_1): Releasing backup interface [ 218.534231][ T9508] team0: Port device team_slave_0 removed [ 218.559054][ T9508] team0: Port device team_slave_1 removed [ 218.573089][ T9508] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 218.582353][ T9508] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 218.593994][ T9508] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 218.605857][ T9508] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.629349][ T9508] batman_adv: batadv0: Removing interface: veth3 [ 218.664914][ T9521] netlink: 'syz.1.1048': attribute type 1 has an invalid length. [ 218.681296][ T9513] team0: Mode changed to "broadcast" [ 218.785390][ T9521] 8021q: adding VLAN 0 to HW filter on device bond4 [ 218.850767][ T9518] bond4: (slave geneve2): making interface the new active one [ 218.867223][ T9518] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 219.058673][ T9543] netlink: 'syz.4.1057': attribute type 29 has an invalid length. [ 219.071028][ T9548] netlink: 'syz.4.1057': attribute type 29 has an invalid length. [ 219.314634][ T9557] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 219.338743][ T9555] netlink: 'syz.3.1059': attribute type 2 has an invalid length. [ 219.369809][ T9562] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 219.393045][ T9562] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 219.650123][ T9574] bridge0: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 219.741628][ T9576] bridge0: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 219.921819][ T9593] vlan3: entered allmulticast mode [ 219.927016][ T9593] hsr0: entered allmulticast mode [ 219.957629][ T9593] hsr_slave_0: entered allmulticast mode [ 219.967412][ T9593] hsr_slave_1: entered allmulticast mode [ 219.988820][ T9596] netlink: 'syz.4.1074': attribute type 29 has an invalid length. [ 220.006675][ T9596] netlink: 'syz.4.1074': attribute type 29 has an invalid length. [ 220.029024][ T9596] netlink: 'syz.4.1074': attribute type 29 has an invalid length. [ 220.386814][ T9621] pim6reg: entered allmulticast mode [ 220.583993][ T9635] netlink: 'syz.3.1087': attribute type 1 has an invalid length. [ 220.618054][ T9635] __nla_validate_parse: 16 callbacks suppressed [ 220.618075][ T9635] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1087'. [ 220.857466][ T9644] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1090'. [ 220.883268][ T9642] : renamed from hsr0 (while UP) [ 220.962812][ T9644] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1090'. [ 221.543423][ T9680] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1101'. [ 221.558112][ T9680] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1101'. [ 221.575376][ T9680] netlink: 'syz.0.1101': attribute type 7 has an invalid length. [ 221.817751][ T9700] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 222.102891][ T9718] netlink: 'syz.3.1113': attribute type 1 has an invalid length. [ 222.291963][ T9731] nbd: error processing sock list [ 222.298620][ T9731] block nbd0: shutting down sockets [ 222.313773][ T9736] vxcan1 speed is unknown, defaulting to 1000 [ 222.591874][ T9744] : entered promiscuous mode [ 222.736481][ T9746] netdevsim netdevsim1: Direct firmware load for /. failed with error -2 [ 222.759561][ T9746] netdevsim netdevsim1: Falling back to sysfs fallback for: /. [ 223.029997][ T9738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1115'. [ 223.377319][ T9774] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1129'. [ 224.087931][ T9808] validate_nla: 2 callbacks suppressed [ 224.087949][ T9808] netlink: 'syz.3.1138': attribute type 16 has an invalid length. [ 224.128847][ T9808] netlink: 'syz.3.1138': attribute type 17 has an invalid length. [ 224.165475][ T9807] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.182163][ T9807] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.266590][ T9823] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1142'. [ 224.282124][ T9808] gre0: left promiscuous mode [ 224.473910][ T9808] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 224.736517][ T9839] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1146'. [ 224.748040][ T9837] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1146'. [ 224.758311][ T9840] openvswitch: netlink: nsh attribute has 13 unknown bytes. [ 224.773303][ T9840] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.075053][ T9849] vxcan1 speed is unknown, defaulting to 1000 [ 225.412212][ T9870] syz.3.1155: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 225.457244][ T9870] CPU: 1 UID: 0 PID: 9870 Comm: syz.3.1155 Not tainted syzkaller #0 PREEMPT(full) [ 225.457273][ T9870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 225.457287][ T9870] Call Trace: [ 225.457295][ T9870] [ 225.457304][ T9870] dump_stack_lvl+0x189/0x250 [ 225.457344][ T9870] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 225.457375][ T9870] ? __pfx_dump_stack_lvl+0x10/0x10 [ 225.457401][ T9870] ? __pfx__printk+0x10/0x10 [ 225.457431][ T9870] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 225.457456][ T9870] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 225.457489][ T9870] warn_alloc+0x214/0x310 [ 225.457523][ T9870] ? stack_depot_save_flags+0x40/0x860 [ 225.457559][ T9870] ? __pfx_warn_alloc+0x10/0x10 [ 225.457593][ T9870] ? kasan_save_track+0x4f/0x80 [ 225.457619][ T9870] ? xskq_create+0x56/0x170 [ 225.457638][ T9870] ? xsk_init_queue+0xb0/0x110 [ 225.457654][ T9870] ? xsk_setsockopt+0x4dc/0x8d0 [ 225.457682][ T9870] ? do_sock_setsockopt+0x179/0x1b0 [ 225.457704][ T9870] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 225.457726][ T9870] ? do_syscall_64+0xfa/0x3b0 [ 225.457747][ T9870] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.457776][ T9870] __vmalloc_node_range_noprof+0x125/0x12f0 [ 225.457840][ T9870] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 225.457882][ T9870] ? __kasan_kmalloc+0x93/0xb0 [ 225.457915][ T9870] vmalloc_user_noprof+0xad/0xf0 [ 225.457957][ T9870] ? xskq_create+0xbf/0x170 [ 225.457977][ T9870] xskq_create+0xbf/0x170 [ 225.458000][ T9870] xsk_init_queue+0xb0/0x110 [ 225.458022][ T9870] xsk_setsockopt+0x4dc/0x8d0 [ 225.458057][ T9870] ? __pfx_xsk_setsockopt+0x10/0x10 [ 225.458089][ T9870] ? __pfx_aa_sk_perm+0x10/0x10 [ 225.458126][ T9870] ? aa_sock_opt_perm+0xff/0x1b0 [ 225.458151][ T9870] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 225.458175][ T9870] ? __pfx_xsk_setsockopt+0x10/0x10 [ 225.458208][ T9870] do_sock_setsockopt+0x179/0x1b0 [ 225.458240][ T9870] __x64_sys_setsockopt+0x13f/0x1b0 [ 225.458276][ T9870] do_syscall_64+0xfa/0x3b0 [ 225.458298][ T9870] ? lockdep_hardirqs_on+0x9c/0x150 [ 225.458320][ T9870] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.458346][ T9870] ? clear_bhb_loop+0x60/0xb0 [ 225.458372][ T9870] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.458393][ T9870] RIP: 0033:0x7f87d898eec9 [ 225.458424][ T9870] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 225.458442][ T9870] RSP: 002b:00007f87d97d0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 225.458466][ T9870] RAX: ffffffffffffffda RBX: 00007f87d8be5fa0 RCX: 00007f87d898eec9 [ 225.458481][ T9870] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 225.458493][ T9870] RBP: 00007f87d8a11f91 R08: 0000000000000004 R09: 0000000000000000 [ 225.458506][ T9870] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.458518][ T9870] R13: 00007f87d8be6038 R14: 00007f87d8be5fa0 R15: 00007ffc4a5add48 [ 225.458553][ T9870] [ 225.776425][ T9870] Mem-Info: [ 225.779620][ T9870] active_anon:4758 inactive_anon:0 isolated_anon:0 [ 225.779620][ T9870] active_file:2948 inactive_file:39912 isolated_file:0 [ 225.779620][ T9870] unevictable:768 dirty:112 writeback:0 [ 225.779620][ T9870] slab_reclaimable:11961 slab_unreclaimable:106577 [ 225.779620][ T9870] mapped:29061 shmem:1357 pagetables:1105 [ 225.779620][ T9870] sec_pagetables:0 bounce:0 [ 225.779620][ T9870] kernel_misc_reclaimable:0 [ 225.779620][ T9870] free:1314810 free_pcp:15254 free_cma:0 [ 225.826173][ T9870] Node 0 active_anon:19032kB inactive_anon:0kB active_file:11792kB inactive_file:159444kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116244kB dirty:448kB writeback:0kB shmem:3892kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12764kB pagetables:4304kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 225.862331][ T9870] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 225.893865][ T9870] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 225.924454][ T9870] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 225.931332][ T9870] Node 0 DMA32 free:1353656kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:18984kB inactive_anon:0kB active_file:11792kB inactive_file:157868kB unevictable:1536kB writepending:448kB present:3129332kB managed:2557412kB mlocked:0kB bounce:0kB free_pcp:43204kB local_pcp:22432kB free_cma:0kB [ 225.964977][ T9870] lowmem_reserve[]: 0 0 1 1 1 [ 225.970789][ T9870] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 226.001194][ T9870] lowmem_reserve[]: 0 0 0 0 0 [ 226.005972][ T9870] Node 1 Normal free:3890212kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17124kB local_pcp:7680kB free_cma:0kB [ 226.038680][ T9870] lowmem_reserve[]: 0 0 0 0 0 [ 226.044117][ T9870] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 226.059107][ T9870] Node 0 DMA32: 463*4kB (M) 317*8kB (UM) 236*16kB (UME) 624*32kB (UME) 324*64kB (UME) 107*128kB (UME) 23*256kB (UME) 4*512kB (ME) 3*1024kB (M) 7*2048kB (UME) 309*4096kB (M) = 1353572kB [ 226.079725][ T9870] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 226.097478][ T9870] Node 1 Normal: 175*4kB (UME) 45*8kB (UME) 46*16kB (UME) 103*32kB (UME) 35*64kB (UME) 5*128kB (UME) 3*256kB (ME) 3*512kB (ME) 3*1024kB (UME) 1*2048kB (E) 946*4096kB (M) = 3890212kB [ 226.161601][ T9870] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 226.191181][ T9870] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 226.205855][ T9878] __nla_validate_parse: 6 callbacks suppressed [ 226.205876][ T9878] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1158'. [ 226.233511][ T9870] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 226.303061][ T9870] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 226.334316][ T9870] 44215 total pagecache pages [ 226.339065][ T9870] 0 pages in swap cache [ 226.350075][ T9870] Free swap = 124996kB [ 226.356780][ T9870] Total swap = 124996kB [ 226.362502][ T9870] 2097051 pages RAM [ 226.366348][ T9870] 0 pages HighMem/MovableOnly [ 226.381686][ T9886] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1161'. [ 226.437461][ T9870] 425672 pages reserved [ 226.451339][ T9870] 0 pages cma reserved [ 226.641422][ T9899] netlink: 'syz.3.1166': attribute type 1 has an invalid length. [ 226.684099][ T9902] netlink: 'syz.4.1167': attribute type 1 has an invalid length. [ 226.699948][ T9902] netlink: 'syz.4.1167': attribute type 2 has an invalid length. [ 226.734956][ T9902] netlink: 11 bytes leftover after parsing attributes in process `syz.4.1167'. [ 226.762298][ T9902] netlink: 11 bytes leftover after parsing attributes in process `syz.4.1167'. [ 226.812029][ T9902] batadv0: left allmulticast mode [ 226.818565][ T9902] wg2: left allmulticast mode [ 226.890143][ T9902] bond0: (slave bond_slave_0): Releasing backup interface [ 226.929156][ T9902] bond0: (slave bond_slave_1): Releasing backup interface [ 226.948279][ T9902] team0: Port device team_slave_0 removed [ 226.964059][ T9902] team0: Port device team_slave_1 removed [ 226.971145][ T9902] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 226.981990][ T9902] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 227.003208][ T9902] bond0: (slave netdevsim0): Releasing backup interface [ 227.014700][ T9902] gretap1: left allmulticast mode [ 227.032750][ T9902] bond2: (slave gretap2): Releasing active interface [ 227.047195][ T9902] veth3: left promiscuous mode [ 227.055320][ T9902] veth5: left promiscuous mode [ 227.262906][ T9928] IPv6: NLM_F_REPLACE set, but no existing node found! [ 228.587978][ T9978] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1187'. [ 228.687373][ T9986] openvswitch: netlink: Flow actions attr not present in new flow. [ 228.764879][ T9991] netlink: 'syz.4.1191': attribute type 1 has an invalid length. [ 228.860152][ T9991] 8021q: adding VLAN 0 to HW filter on device bond4 [ 228.949841][ T9997] 8021q: adding VLAN 0 to HW filter on device bond4 [ 228.986749][ T9997] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 229.038620][ T9997] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 229.110070][T10011] vxcan1 speed is unknown, defaulting to 1000 [ 229.275557][T10021] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1199'. [ 229.488316][T10035] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1207'. [ 229.526798][T10035] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1207'. [ 229.632963][T10039] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1208'. [ 229.653473][T10043] veth1_to_bond: entered allmulticast mode [ 229.702302][T10043] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1210'. [ 229.879274][T10043] bond0: (slave bond_slave_1): Releasing backup interface [ 229.957973][T10043] veth1_to_bond (unregistering): left allmulticast mode [ 230.090028][T10062] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 230.275591][T10034] netlink: 'syz.1.1206': attribute type 2 has an invalid length. [ 230.745914][T10095] IPVS: set_ctl: invalid protocol: 4 224.0.0.1:20001 [ 231.059619][T10116] IPVS: Unknown mcast interface: syzkaller0 [ 231.268403][T10132] sctp: [Deprecated]: syz.1.1240 (pid 10132) Use of struct sctp_assoc_value in delayed_ack socket option. [ 231.268403][T10132] Use struct sctp_sack_info instead [ 231.312330][T10131] __nla_validate_parse: 3 callbacks suppressed [ 231.312350][T10131] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1239'. [ 231.544494][T10145] netlink: 'syz.2.1246': attribute type 4 has an invalid length. [ 231.562714][T10147] vlan2: entered allmulticast mode [ 231.567896][T10147] bond0: entered allmulticast mode [ 231.588189][T10147] bond_slave_0: entered allmulticast mode [ 231.601485][T10147] bond_slave_1: entered allmulticast mode [ 231.607281][T10147] team0: entered allmulticast mode [ 231.613534][T10147] team_slave_0: entered allmulticast mode [ 231.619527][T10147] team_slave_1: entered allmulticast mode [ 231.621689][T10151] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1246'. [ 231.645960][T10154] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1246'. [ 231.682170][T10147] netlink: 212312 bytes leftover after parsing attributes in process `syz.1.1244'. [ 231.848440][T10163] netlink: 'syz.1.1251': attribute type 13 has an invalid length. [ 231.864392][T10163] veth0_macvtap: left promiscuous mode [ 231.880324][T10163] macvtap0: entered allmulticast mode [ 231.946112][T10163] macvtap0: refused to change device tx_queue_len [ 232.065527][T10174] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1254'. [ 232.303819][T10188] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1260'. [ 232.344460][T10188] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1260'. [ 232.574521][T10201] netlink: 'syz.3.1261': attribute type 6 has an invalid length. [ 232.619686][T10201] netlink: 'syz.3.1261': attribute type 6 has an invalid length. [ 232.769523][T10204] netlink: 'syz.4.1264': attribute type 5 has an invalid length. [ 232.941610][T10207] openvswitch: netlink: IP tunnel dst address not specified [ 232.955712][T10209] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1266'. [ 233.322790][T10229] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1270'. [ 233.493311][T10235] nbd: must specify a device to reconfigure [ 233.672513][T10239] tipc: Enabling of bearer rejected, already enabled [ 233.908484][T10257] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1278'. [ 234.079803][T10263] bond0: invalid ARP target 0.0.0.0 specified for addition [ 234.087949][T10263] bond0: option arp_ip_target: invalid value (0) [ 234.132182][T10266] netlink: 'syz.0.1281': attribute type 10 has an invalid length. [ 234.218564][T10274] Unsupported ieee802154 address type: 0 [ 234.245032][T10266] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 234.606297][T10295] can: request_module (can-proto-0) failed. [ 234.648224][T10303] batadv0: entered promiscuous mode [ 234.666531][T10303] bond0: entered promiscuous mode [ 234.683565][T10303] hsr1: Slave A (batadv0) is not up; please bring it up to get a fully working HSR network [ 234.717576][T10303] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 234.744037][T10303] hsr1: entered allmulticast mode [ 234.765207][T10303] batadv0: entered allmulticast mode [ 234.792133][T10303] bond0: entered allmulticast mode [ 234.814653][T10303] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 235.196917][T10334] syzkaller0: entered promiscuous mode [ 235.209908][T10341] netlink: 'syz.1.1299': attribute type 1 has an invalid length. [ 235.217007][T10334] syzkaller0: entered allmulticast mode [ 235.352285][T10352] netlink: 'syz.0.1303': attribute type 30 has an invalid length. [ 236.928006][T10352] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 236.929870][T10354] netlink: 'syz.3.1304': attribute type 29 has an invalid length. [ 237.202680][T10393] __nla_validate_parse: 5 callbacks suppressed [ 237.202698][T10393] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1312'. [ 237.217427][T10392] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1311'. [ 237.340147][T10404] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 237.352921][T10406] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1314'. [ 237.422643][T10410] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1314'. [ 237.616504][T10421] x_tables: ip6_tables: MASQUERADE target: only valid in nat table, not syz1 [ 237.696684][T10421] netlink: 'syz.4.1315': attribute type 23 has an invalid length. [ 237.844463][T10436] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1319'. [ 238.129272][T10450] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1320'. [ 238.172500][T10450] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1320'. [ 238.665258][T10434] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 238.719727][T10434] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 238.855019][T10434] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 238.885102][T10434] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 238.960647][T10434] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 238.966623][T10434] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 239.072171][T10434] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 239.088697][T10498] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1334'. [ 239.091213][T10434] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 240.190212][T10504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 240.309126][T10504] macvtap0: left allmulticast mode [ 240.398293][T10504] ip6erspan0: left promiscuous mode [ 240.404599][T10504] ip6erspan0: left allmulticast mode [ 240.438369][T10504] vlan2: left allmulticast mode [ 240.443965][T10504] bond0: left allmulticast mode [ 240.449026][T10504] bond_slave_0: left allmulticast mode [ 240.456158][T10504] bond_slave_1: left allmulticast mode [ 240.462954][T10504] team0: left allmulticast mode [ 240.467927][T10504] team_slave_0: left allmulticast mode [ 240.474742][T10504] team_slave_1: left allmulticast mode [ 240.602581][T10434] tipc: Resetting bearer [ 240.718535][ T3517] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.947945][ T3517] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.998230][ T3517] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.020699][ T3517] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.121010][T10561] netlink: 'syz.0.1350': attribute type 1 has an invalid length. [ 241.141478][T10561] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1350'. [ 241.238647][T10568] team0: Device wireguard0 is of different type [ 241.524329][T10583] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1358'. [ 241.952701][T10612] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 242.043753][T10613] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 242.269252][T10625] __nla_validate_parse: 2 callbacks suppressed [ 242.269274][T10625] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1366'. [ 242.475175][T10638] ip6tnl0: mtu greater than device maximum [ 242.716182][T10658] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1374'. [ 243.004972][T10672] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1377'. [ 243.068411][T10677] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1379'. [ 243.255344][T10684] IPv6: sit1: Disabled Multicast RS [ 243.267272][T10684] sit1: entered allmulticast mode [ 243.386732][T10693] tipc: Enabled bearer , priority 0 [ 243.518794][T10694] tipc: Disabling bearer [ 243.677981][T10702] A link change request failed with some changes committed already. Interface bond2 may have been left with an inconsistent configuration, please check. [ 244.122272][T10736] tipc: Enabled bearer , priority 0 [ 244.178063][T10736] syzkaller0: entered promiscuous mode [ 244.210503][T10736] syzkaller0: entered allmulticast mode [ 244.437014][T10755] tipc: Resetting bearer [ 244.466566][T10732] tipc: Resetting bearer [ 244.536075][T10732] tipc: Disabling bearer [ 244.549371][T10765] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1398'. [ 244.608431][T10765] vlan2: entered allmulticast mode [ 244.623816][T10765] gretap0: entered allmulticast mode [ 245.507322][T10815] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 245.639121][T10809] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1409'. [ 245.646313][T10823] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1412'. [ 245.697256][T10826] netlink: 'syz.3.1411': attribute type 4 has an invalid length. [ 245.741920][T10826] netlink: 'syz.3.1411': attribute type 4 has an invalid length. [ 246.285962][ T3478] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.309255][ T3478] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.342428][ T3478] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.390922][ T3478] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.399372][ T3478] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.462106][ T3478] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.483022][ T3478] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.505412][ T3478] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.783586][T10875] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1422'. [ 246.828171][T10875] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1422'. [ 247.179025][T10891] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1425'. [ 248.598350][T10891] IPv6: sit1: Disabled Multicast RS [ 248.617195][T10891] sit1: entered allmulticast mode [ 248.862757][T10910] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1431'. [ 249.264909][T10941] macvtap1: entered promiscuous mode [ 249.271858][T10941] vlan0: entered promiscuous mode [ 249.277550][T10941] macvtap1: entered allmulticast mode [ 249.284221][T10941] vlan0: entered allmulticast mode [ 249.289636][T10941] veth0_vlan: entered allmulticast mode [ 249.303769][T10943] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1440'. [ 249.317944][T10941] macvtap2: entered promiscuous mode [ 249.324079][T10941] macvtap2: entered allmulticast mode [ 249.339857][T10943] netlink: 'syz.3.1440': attribute type 4 has an invalid length. [ 249.377767][T10945] netlink: 'syz.2.1437': attribute type 8 has an invalid length. [ 249.396973][T10941] pim6reg1: entered promiscuous mode [ 249.402882][T10941] pim6reg1: entered allmulticast mode [ 250.336457][T10980] openvswitch: netlink: Tunnel attr 3 has unexpected len 0 expected 1 [ 250.346407][T10984] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1455'. [ 250.368006][ T5945] IPVS: starting estimator thread 0... [ 250.460599][T10990] IPVS: using max 25 ests per chain, 60000 per kthread [ 250.490305][T10995] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1458'. [ 250.510113][T10995] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1458'. [ 250.520941][T10995] IPv6: Can't replace route, no match found [ 250.584547][T10996] tipc: Enabling of bearer rejected, already enabled [ 250.747548][T11007] tipc: Enabling not permitted [ 250.765400][T11007] tipc: Enabling of bearer rejected, failed to enable media [ 251.212640][T11040] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1469'. [ 251.245299][T11040] netlink: 'syz.4.1469': attribute type 1 has an invalid length. [ 251.266595][T11040] netlink: 'syz.4.1469': attribute type 2 has an invalid length. [ 251.384398][T11050] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1470'. [ 251.685702][T11069] netlink: 'syz.2.1477': attribute type 15 has an invalid length. [ 251.700209][T11069] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1477'. [ 251.851334][T11080] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1481'. [ 251.865072][T11078] netlink: 'syz.1.1479': attribute type 6 has an invalid length. [ 251.886221][T11078] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1479'. [ 251.925822][T11083] netlink: 'syz.2.1482': attribute type 3 has an invalid length. [ 252.077240][T11093] gretap0: entered promiscuous mode [ 252.136895][T11094] 0{X: renamed from gretap0 [ 252.146044][T11094] 0{X: left promiscuous mode [ 252.209973][T11094] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 252.235887][T11103] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 252.468955][T11113] tipc: Enabling of bearer rejected, already enabled [ 252.496725][T11116] netlink: 'syz.4.1491': attribute type 83 has an invalid length. [ 252.574480][T11120] ieee802154 phy1 wpan1: encryption failed: -126 [ 252.828122][T11139] openvswitch: netlink: Missing key (keys=40, expected=80) [ 252.889957][T11142] openvswitch: netlink: Missing key (keys=40, expected=80) [ 252.914902][T11139] openvswitch: netlink: Multiple metadata blocks provided [ 253.204478][T11164] netlink: 'syz.4.1508': attribute type 3 has an invalid length. [ 253.784570][T11193] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 254.060245][T11213] netlink: 'syz.4.1520': attribute type 2 has an invalid length. [ 254.074074][T11213] __nla_validate_parse: 5 callbacks suppressed [ 254.074094][T11213] netlink: 172 bytes leftover after parsing attributes in process `syz.4.1520'. [ 254.285063][T11231] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1524'. [ 254.565129][T11246] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1527'. [ 254.626659][T11252] netlink: 'syz.4.1527': attribute type 1 has an invalid length. [ 254.667497][T11252] netlink: 212 bytes leftover after parsing attributes in process `syz.4.1527'. [ 254.778357][T11252] netlink: 'syz.4.1527': attribute type 1 has an invalid length. [ 254.844441][T11258] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1532'. [ 254.916786][T11265] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1533'. [ 255.015863][T11269] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1535'. [ 255.108478][T11273] netlink: 'syz.2.1536': attribute type 1 has an invalid length. [ 255.148359][T11273] 8021q: adding VLAN 0 to HW filter on device bond5 [ 255.218400][T11273] bond5: (slave gretap2): making interface the new active one [ 255.257184][T11273] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 255.336886][T11288] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1540'. [ 255.442281][T11290] netlink: 'syz.1.1541': attribute type 10 has an invalid length. [ 255.474152][T11290] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1541'. [ 255.501163][T11290] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 255.519967][T11290] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 255.545820][T11290] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 255.582033][T11294] netlink: 'syz.2.1542': attribute type 1 has an invalid length. [ 255.664911][T11296] netlink: 'syz.3.1544': attribute type 4 has an invalid length. [ 256.316050][T11318] netdevsim netdevsim0: Firmware load for '..' refused, path contains '..' component [ 256.332577][T11320] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1553'. [ 257.888143][T11369] netlink: 'syz.3.1565': attribute type 14 has an invalid length. [ 257.957136][T11369] netlink: 'syz.3.1565': attribute type 14 has an invalid length. [ 257.975210][T11369] netlink: 'syz.3.1565': attribute type 1 has an invalid length. [ 258.058991][T11383] tipc: New replicast peer: 255.255.255.255 [ 258.087725][T11383] tipc: Enabled bearer , priority 10 [ 258.156037][T11390] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 258.751430][T11428] netlink: 'syz.2.1585': attribute type 1 has an invalid length. [ 259.012069][T11449] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (32767) [ 259.032155][T11449] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 259.146865][T11453] __nla_validate_parse: 11 callbacks suppressed [ 259.146884][T11453] netlink: 81 bytes leftover after parsing attributes in process `syz.4.1593'. [ 259.219412][T11464] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1595'. [ 259.266453][T11464] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1595'. [ 259.570783][T11481] 8021q: adding VLAN 0 to HW filter on device bond5 [ 259.656000][T11489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1603'. [ 259.725769][T11493] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 260.188805][T11517] netlink: 7 bytes leftover after parsing attributes in process `syz.4.1615'. [ 260.215758][T11523] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1617'. [ 260.256854][T11523] 8021q: VLANs not supported on gre0 [ 260.434401][T11533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1618'. [ 260.481352][T11542] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1619'. [ 260.895360][T11564] vxcan1 speed is unknown, defaulting to 1000 [ 261.034930][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.126749][T11571] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1626'. [ 261.139018][T11552] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1624'. [ 261.728544][T11597] validate_nla: 1 callbacks suppressed [ 261.728565][T11597] netlink: 'syz.1.1635': attribute type 3 has an invalid length. [ 288.113564][T11618] syz.4.1643 (11618) used greatest stack depth: 17384 bytes left [ 288.282671][T11641] __nla_validate_parse: 1 callbacks suppressed [ 288.282692][T11641] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1644'. [ 288.835305][T11671] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1657'. [ 288.847312][T11671] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1657'. [ 288.857223][T11671] netlink: 'syz.3.1657': attribute type 5 has an invalid length. [ 288.865826][T11671] netlink: 43 bytes leftover after parsing attributes in process `syz.3.1657'. [ 288.989902][T11676] tipc: Enabling of bearer rejected, already enabled [ 289.295081][T11692] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 289.379681][T11700] netlink: 'syz.2.1669': attribute type 11 has an invalid length. [ 289.452791][T11704] netlink: 'syz.4.1671': attribute type 21 has an invalid length. [ 289.483223][T11704] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1671'. [ 289.498408][T11704] netlink: 'syz.4.1671': attribute type 5 has an invalid length. [ 289.530828][T11704] netlink: 3 bytes leftover after parsing attributes in process `syz.4.1671'. [ 289.557294][T11709] netlink: 'syz.1.1674': attribute type 29 has an invalid length. [ 289.569522][T11715] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1672'. [ 289.611815][T11712] netlink: 'syz.1.1674': attribute type 29 has an invalid length. [ 289.641646][T11709] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1674'. [ 290.033777][T11743] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1683'. [ 290.047925][T11743] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1683'. [ 290.198582][T11753] xt_l2tp: unknown flags: 10 [ 290.390872][T11764] sctp: [Deprecated]: syz.4.1689 (pid 11764) Use of int in max_burst socket option. [ 290.390872][T11764] Use struct sctp_assoc_value instead [ 290.774243][T11787] netlink: 'syz.4.1697': attribute type 1 has an invalid length. [ 290.783946][T11793] openvswitch: netlink: IPv4 tunnel dst address is zero [ 290.802523][T11787] netlink: 'syz.4.1697': attribute type 1 has an invalid length. [ 290.822332][T11787] netlink: 'syz.4.1697': attribute type 6 has an invalid length. [ 291.133868][T11813] veth1_to_bond: entered allmulticast mode [ 291.169526][T11813] bond0: (slave bond_slave_1): Releasing backup interface [ 291.245236][T11813] veth1_to_bond (unregistering): left allmulticast mode [ 291.646478][T11846] netlink: 'syz.1.1716': attribute type 1 has an invalid length. [ 291.692938][T11846] 8021q: adding VLAN 0 to HW filter on device bond5 [ 291.805524][T11860] openvswitch: netlink: IP tunnel dst address not specified [ 292.045323][ T30] audit: type=1107 audit(1758843907.832:5): pid=11868 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='[-:,K8%XݟA`?;o' [ 292.301924][T11885] nbd: must specify at least one socket [ 292.398297][T11890] openvswitch: netlink: Flow actions attr not present in new flow. [ 292.493531][T11892] bond0: (slave wlan1): Opening slave failed [ 292.596291][T11896] batadv0: entered promiscuous mode [ 292.605679][T11896] batadv0: entered allmulticast mode [ 292.616863][T11896] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 293.198539][T11936] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 293.629288][T11956] __nla_validate_parse: 22 callbacks suppressed [ 293.629309][T11956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1748'. [ 293.663923][T11956] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1748'. [ 293.683356][T11958] tipc: Enabled bearer , priority 10 [ 294.082549][T11983] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1758'. [ 294.102005][T11984] validate_nla: 8 callbacks suppressed [ 294.102027][T11984] netlink: 'syz.3.1759': attribute type 2 has an invalid length. [ 294.127064][T11984] netlink: 'syz.3.1759': attribute type 9 has an invalid length. [ 294.154089][T11984] netlink: 'syz.3.1759': attribute type 6 has an invalid length. [ 294.171640][T11984] netlink: 'syz.3.1759': attribute type 7 has an invalid length. [ 294.191130][T11984] netlink: 'syz.3.1759': attribute type 8 has an invalid length. [ 294.207949][T11990] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1758'. [ 294.220674][T11990] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1758'. [ 294.279024][T11988] netlink: 332 bytes leftover after parsing attributes in process `syz.2.1758'. [ 294.477067][T12029] delete_channel: no stack [ 294.584635][T12044] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1767'. [ 294.598656][T12044] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1767'. [ 294.631296][T12044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1767'. [ 294.822513][T12056] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1771'. [ 295.801778][T12103] IPVS: set_ctl: invalid protocol: 59 172.20.20.187:20004 [ 296.176484][T12123] nftables ruleset with unbound chain [ 296.297739][T12129] dvmrp0: entered allmulticast mode [ 296.504691][T12137] can: request_module (can-proto-5) failed. [ 296.514746][T12136] can: request_module (can-proto-5) failed. [ 296.961798][T12173] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 297.331533][T12196] syzkaller1: entered promiscuous mode [ 297.337434][T12196] syzkaller1: entered allmulticast mode [ 298.468893][T12265] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 298.482428][T12265] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.654679][T12272] __nla_validate_parse: 9 callbacks suppressed [ 298.654700][T12272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1841'. [ 298.755565][T12275] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1841'. [ 298.816978][T12272] 8021q: adding VLAN 0 to HW filter on device bond6 [ 298.992212][T12256] infiniband syz!: set down [ 298.998245][T12256] infiniband syz!: added team_slave_0 [ 299.023833][T12256] syz!: rxe_create_cq: returned err = -12 [ 299.040233][T12256] infiniband syz!: Couldn't create ib_mad CQ [ 299.046624][T12256] infiniband syz!: Couldn't open port 1 [ 299.069930][T12286] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1846'. [ 299.112064][T12256] RDS/IB: syz!: added [ 299.116827][T12256] smc: adding ib device syz! with port count 1 [ 299.129701][T12256] smc: ib device syz! port 1 has pnetid [ 299.157379][T12286] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1846'. [ 299.185903][T12286] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1846'. [ 299.201163][T12286] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1846'. [ 299.213090][T12286] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1846'. [ 299.407578][T12294] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1848'. [ 299.503211][T12299] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1851'. [ 299.556599][T12301] : entered promiscuous mode [ 299.968979][T12329] netlink: 'syz.1.1861': attribute type 10 has an invalid length. [ 300.015370][T12329] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 300.047730][T12334] netlink: 'syz.0.1863': attribute type 9 has an invalid length. [ 300.254048][T12345] netlink: 'syz.0.1866': attribute type 13 has an invalid length. [ 300.256356][T12341] tipc: Enabling of bearer rejected, already enabled [ 300.411523][T12352] netlink: 4128 bytes leftover after parsing attributes in process `syz.1.1867'. [ 300.817612][T12366] netlink: 'syz.2.1869': attribute type 7 has an invalid length. [ 300.865133][T12366] netlink: 'syz.2.1869': attribute type 8 has an invalid length. [ 301.486739][T12401] sctp: [Deprecated]: syz.2.1883 (pid 12401) Use of int in maxseg socket option. [ 301.486739][T12401] Use struct sctp_assoc_value instead [ 301.829929][T12417] openvswitch: netlink: Key 10 has unexpected len 2 expected 4 [ 302.212336][T12435] netlink: 'syz.1.1894': attribute type 33 has an invalid length. [ 302.751315][T12454] tipc: Enabled bearer , priority 0 [ 302.777226][T12454] syzkaller0: entered promiscuous mode [ 302.795290][T12454] syzkaller0: entered allmulticast mode [ 302.808407][T12462] netlink: 'syz.3.1902': attribute type 1 has an invalid length. [ 302.821808][T12454] tipc: Resetting bearer [ 302.831764][T12453] tipc: Resetting bearer [ 302.847258][T12453] tipc: Disabling bearer [ 303.080303][T12475] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 303.193782][T12482] netlink: 'syz.0.1908': attribute type 1 has an invalid length. [ 303.231645][T12468] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 303.240748][T12482] netlink: 'syz.0.1908': attribute type 3 has an invalid length. [ 303.253169][T12482] netlink: 'syz.0.1908': attribute type 235 has an invalid length. [ 303.514796][T12493] tipc: Enabled bearer , priority 0 [ 303.640093][T12493] syzkaller0: entered promiscuous mode [ 303.646468][T12493] syzkaller0: entered allmulticast mode [ 303.652874][T12493] tipc: Resetting bearer [ 303.815897][T12033] tipc: Resetting bearer [ 303.824184][T12492] tipc: Resetting bearer [ 303.906721][T12509] __nla_validate_parse: 18 callbacks suppressed [ 303.906741][T12509] netlink: 784 bytes leftover after parsing attributes in process `syz.3.1915'. [ 305.426015][T12492] tipc: Disabling bearer [ 305.805552][T12557] xt_HMARK: proto mask must be zero with L3 mode [ 306.293211][T12591] batman_adv: batadv0: Adding interface: macsec3 [ 306.299764][T12591] batman_adv: batadv0: The MTU of interface macsec3 is too small (1468) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1560. [ 306.366225][T12591] batman_adv: batadv0: Interface activated: macsec3 [ 306.458319][T12601] validate_nla: 4 callbacks suppressed [ 306.458341][T12601] netlink: 'syz.2.1937': attribute type 21 has an invalid length. [ 306.496337][T12601] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1937'. [ 306.527690][T12608] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1939'. [ 306.542300][T12604] lo: Caught tx_queue_len zero misconfig [ 306.785089][T12620] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1945'. [ 306.900258][T12629] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1946'. [ 307.114116][T12007] bond0: (slave bridge_slave_1): link status definitely down, disabling slave [ 307.166110][T12007] bond0: now running without any active interface! [ 308.035854][T12659] netlink: 'syz.4.1957': attribute type 4 has an invalid length. [ 308.124512][T12665] netlink: 'syz.0.1960': attribute type 2 has an invalid length. [ 308.281900][T12668] : renamed from erspan0 [ 308.426658][T12682] netlink: 'syz.4.1966': attribute type 1 has an invalid length. [ 308.521160][T12682] bond6: entered promiscuous mode [ 308.526772][T12682] 8021q: adding VLAN 0 to HW filter on device bond6 [ 308.622878][T12689] 8021q: adding VLAN 0 to HW filter on device bond6 [ 308.636205][T12697] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1970'. [ 308.646772][T12697] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1970'. [ 308.651247][T12689] bond6: (slave wireguard0): The slave device specified does not support setting the MAC address [ 308.657007][T12697] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1970'. [ 308.680528][T12697] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1970'. [ 308.695333][T12697] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1970'. [ 308.720631][T12689] bond6: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 308.764168][T12689] bond6: (slave wireguard0): making interface the new active one [ 308.778481][T12689] wireguard0: entered promiscuous mode [ 308.790089][T12689] bond6: (slave wireguard0): Enslaving as an active interface with an up link [ 308.829419][T12703] (unnamed net_device) (uninitialized): down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 308.864073][T12698] netlink: 'syz.2.1970': attribute type 1 has an invalid length. [ 308.933477][T12713] __nla_validate_parse: 62 callbacks suppressed [ 308.933498][T12713] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1973'. [ 309.223427][T12732] xt_l2tp: wrong L2TP version: 0 [ 309.247327][T12732] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 309.473412][T12743] netlink: 'syz.1.1981': attribute type 1 has an invalid length. [ 309.539709][T12749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1977'. [ 309.584042][T12753] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1984'. [ 309.622084][T12751] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1985'. [ 309.718398][T12743] 8021q: adding VLAN 0 to HW filter on device bond7 [ 309.727224][T12743] bond6: (slave bond7): making interface the new active one [ 309.737986][T12743] bond6: (slave bond7): Enslaving as an active interface with an up link [ 309.774573][T12758] bond6: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 309.787357][T12758] bond6: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 309.867453][T12761] : entered promiscuous mode [ 309.958956][T12761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.982896][T12761] 8021q: adding VLAN 0 to HW filter on device team0 [ 310.009658][T12761] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 310.189838][T12774] tipc: Bearer : already 2 bearers with priority 10 [ 310.230887][T12774] tipc: Bearer : trying with adjusted priority [ 310.238043][T12774] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 310.248748][T12777] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1989'. [ 310.275094][T12779] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1992'. [ 310.284519][T12777] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1989'. [ 310.302877][T12782] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1991'. [ 310.357543][T12786] netlink: 'syz.4.1993': attribute type 1 has an invalid length. [ 310.389910][T12786] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1993'. [ 310.487045][T12791] dvmrp0: entered allmulticast mode [ 310.520505][T12791] dvmrp0: left allmulticast mode [ 310.696865][T12814] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2001'. [ 310.733579][T12812] netlink: 'syz.4.1999': attribute type 8 has an invalid length. [ 310.736019][T12814] 8021q: adding VLAN 0 to HW filter on device bond8 [ 310.768115][T12818] netlink: 'syz.0.2002': attribute type 2 has an invalid length. [ 310.779240][T12814] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 310.921180][T12822] tipc: Enabled bearer , priority 0 [ 310.928627][T12822] syzkaller0: entered promiscuous mode [ 310.935383][T12822] syzkaller0: entered allmulticast mode [ 311.085786][T12821] tipc: Resetting bearer [ 311.145416][T12821] tipc: Disabling bearer [ 311.314419][T12842] Bluetooth: hci1: Opcode 0x0401 failed: -22 [ 311.449186][T12846] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 311.480494][T12846] openvswitch: netlink: Duplicate key (type 0). [ 311.545834][T12852] tipc: Enabled bearer , priority 0 [ 311.592594][T12852] syzkaller0: entered promiscuous mode [ 311.608981][T12852] syzkaller0: entered allmulticast mode [ 311.698115][T12858] batman_adv: batadv0: Interface deactivated: macsec3 [ 311.750185][T12858] batman_adv: batadv0: Removing interface: macsec3 [ 311.855359][T12852] tipc: Resetting bearer [ 311.923563][T12850] tipc: Resetting bearer [ 311.994015][T12850] tipc: Disabling bearer [ 312.709284][T12926] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 313.090792][T12955] netlink: 'syz.0.2044': attribute type 1 has an invalid length. [ 313.199042][T12957] 8021q: adding VLAN 0 to HW filter on device bond3 [ 313.226809][T12963] pimreg: entered allmulticast mode [ 313.287652][T12966] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 313.300144][T12966] netlink: 'syz.4.2048': attribute type 10 has an invalid length. [ 313.336404][T12966] bridge_slave_1: entered promiscuous mode [ 313.360564][ T5876] Bluetooth: hci1: command tx timeout [ 313.386562][T12966] bridge_slave_1: entered allmulticast mode [ 313.639306][T12979] pimreg: entered allmulticast mode [ 314.040150][T13004] __nla_validate_parse: 16 callbacks suppressed [ 314.040171][T13004] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2058'. [ 314.078747][T13008] sctp: [Deprecated]: syz.2.2060 (pid 13008) Use of struct sctp_assoc_value in delayed_ack socket option. [ 314.078747][T13008] Use struct sctp_sack_info instead [ 314.134927][T13004] netlink: 'syz.0.2058': attribute type 11 has an invalid length. [ 314.143166][T13004] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2058'. [ 314.208162][T13013] tc_dump_action: action bad kind [ 314.242695][T13016] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2062'. [ 314.389210][T13025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2066'. [ 314.407283][T13028] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2065'. [ 314.423982][T13028] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2065'. [ 314.541664][T13037] netlink: 'syz.0.2068': attribute type 4 has an invalid length. [ 314.550697][T13037] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2068'. [ 314.555840][T13040] tipc: Enabled bearer , priority 0 [ 314.628487][T13044] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 314.668537][T13044] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 314.732449][T13040] tipc: Resetting bearer [ 314.832090][T13039] tipc: Disabling bearer [ 315.207237][T13080] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 315.234877][T13080] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 315.246397][T13080] gretap3: entered promiscuous mode [ 315.251913][T13080] gretap3: entered allmulticast mode [ 315.312851][T13086] syzkaller1: entered promiscuous mode [ 315.318407][T13086] syzkaller1: entered allmulticast mode [ 315.363851][T13086] openvswitch: netlink: Actions may not be safe on all matching packets [ 315.376509][T13086] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2082'. [ 315.388169][T13086] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2082'. [ 315.468624][T13098] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2087'. [ 315.487573][T13100] IPVS: length: 197 != 8 [ 315.623699][T13103] geneve3: entered promiscuous mode [ 315.629119][T13103] geneve3: entered allmulticast mode [ 315.651629][T13106] netlink: 'syz.0.2090': attribute type 11 has an invalid length. [ 315.665905][T12025] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 19999 - 0 [ 315.685260][T12025] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 19999 - 0 [ 315.703438][T12025] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 19999 - 0 [ 315.714338][T12025] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 19999 - 0 [ 315.760172][T13103] : entered promiscuous mode [ 316.389707][T13155] vlan3: entered allmulticast mode [ 316.395619][T13155] hsr0: entered allmulticast mode [ 316.402261][T13155] hsr_slave_0: entered allmulticast mode [ 316.408515][T13155] hsr_slave_1: entered allmulticast mode [ 316.613852][T13170] openvswitch: netlink: nsh attr 8196 is out of range max 3 [ 316.622309][T13169] openvswitch: netlink: nsh attr 8196 is out of range max 3 [ 316.630050][T13169] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 316.652973][T13170] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 316.746163][T13177] netlink: 'syz.0.2117': attribute type 1 has an invalid length. [ 317.430775][T13216] vxcan1 speed is unknown, defaulting to 1000 [ 317.769230][T13240] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 317.882755][T13246] lo: entered promiscuous mode [ 317.897710][T13246] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 318.680024][T13290] netlink: zone id is out of range [ 318.686555][T13290] netlink: get zone limit has 8 unknown bytes [ 319.109328][T13313] __nla_validate_parse: 23 callbacks suppressed [ 319.109349][T13313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2159'. [ 319.870517][T13339] netlink: 'syz.3.2167': attribute type 21 has an invalid length. [ 319.881331][T13339] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2167'. [ 319.918887][T13339] netlink: 'syz.3.2167': attribute type 5 has an invalid length. [ 319.959461][T13339] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2167'. [ 320.044168][T13342] sctp: [Deprecated]: syz.0.2169 (pid 13342) Use of int in max_burst socket option. [ 320.044168][T13342] Use struct sctp_assoc_value instead [ 320.281426][T13352] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2172'. [ 320.299516][T13352] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2172'. [ 320.586371][T13368] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2180'. [ 320.636455][T13372] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2182'. [ 320.650714][T13368] openvswitch: netlink: Flow key attr not present in new flow. [ 320.734413][T13376] netlink: 'syz.0.2183': attribute type 1 has an invalid length. [ 320.744996][T13376] netlink: 172 bytes leftover after parsing attributes in process `syz.0.2183'. [ 320.775407][T13376] netlink: 'syz.0.2183': attribute type 10 has an invalid length. [ 320.831127][T13382] sctp: [Deprecated]: syz.1.2185 (pid 13382) Use of int in maxseg socket option. [ 320.831127][T13382] Use struct sctp_assoc_value instead [ 320.866553][T13385] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2186'. [ 321.039987][T13394] 8021q: VLANs not supported on ip_vti0 [ 321.248493][T13409] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2192'. [ 321.257404][T13405] unknown channel width for channel at 909000KHz? [ 321.297375][T13400] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.392592][T13400] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.454293][T13417] FAULT_INJECTION: forcing a failure. [ 321.454293][T13417] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 321.512170][T13417] CPU: 1 UID: 0 PID: 13417 Comm: syz.2.2197 Not tainted syzkaller #0 PREEMPT(full) [ 321.512199][T13417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 321.512223][T13417] Call Trace: [ 321.512231][T13417] [ 321.512241][T13417] dump_stack_lvl+0x189/0x250 [ 321.512272][T13417] ? __pfx____ratelimit+0x10/0x10 [ 321.512294][T13417] ? __pfx_dump_stack_lvl+0x10/0x10 [ 321.512318][T13417] ? __pfx__printk+0x10/0x10 [ 321.512345][T13417] ? __might_fault+0xb0/0x130 [ 321.512384][T13417] should_fail_ex+0x414/0x560 [ 321.512418][T13417] _copy_from_user+0x2d/0xb0 [ 321.512445][T13417] ___sys_sendmsg+0x158/0x2a0 [ 321.512475][T13417] ? __pfx____sys_sendmsg+0x10/0x10 [ 321.512545][T13417] ? __fget_files+0x2a/0x420 [ 321.512563][T13417] ? __fget_files+0x3a0/0x420 [ 321.512599][T13417] __sys_sendmmsg+0x227/0x430 [ 321.512631][T13417] ? __pfx___sys_sendmmsg+0x10/0x10 [ 321.512654][T13417] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 321.512707][T13417] ? ksys_write+0x22a/0x250 [ 321.512736][T13417] ? __pfx_ksys_write+0x10/0x10 [ 321.512760][T13417] ? rcu_is_watching+0x15/0xb0 [ 321.512788][T13417] __x64_sys_sendmmsg+0xa0/0xc0 [ 321.512816][T13417] do_syscall_64+0xfa/0x3b0 [ 321.512837][T13417] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.512858][T13417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.512878][T13417] ? clear_bhb_loop+0x60/0xb0 [ 321.512902][T13417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.512922][T13417] RIP: 0033:0x7f40b058eec9 [ 321.512958][T13417] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 321.512976][T13417] RSP: 002b:00007f40b1416038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 321.512999][T13417] RAX: ffffffffffffffda RBX: 00007f40b07e5fa0 RCX: 00007f40b058eec9 [ 321.513014][T13417] RDX: 0000000000000001 RSI: 0000200000000b00 RDI: 0000000000000003 [ 321.513027][T13417] RBP: 00007f40b1416090 R08: 0000000000000000 R09: 0000000000000000 [ 321.513040][T13417] R10: 0000000020080058 R11: 0000000000000246 R12: 0000000000000001 [ 321.513052][T13417] R13: 00007f40b07e6038 R14: 00007f40b07e5fa0 R15: 00007ffcf6aa8bb8 [ 321.513086][T13417] [ 322.054703][T13449] netlink: 'syz.0.2206': attribute type 1 has an invalid length. [ 322.286378][T13458] veth0: entered promiscuous mode [ 322.315362][T13457] veth0: left promiscuous mode [ 322.429990][T13464] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144 [ 322.475845][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.531526][T13470] netlink: 'syz.3.2216': attribute type 1 has an invalid length. [ 322.629057][T13470] 8021q: adding VLAN 0 to HW filter on device bond7 [ 322.965615][T13509] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 323.051999][T13515] Bluetooth: MGMT ver 1.23 [ 323.145746][T13520] netlink: 'syz.3.2235': attribute type 14 has an invalid length. [ 323.158168][T13520] netlink: 'syz.3.2235': attribute type 13 has an invalid length. [ 323.378600][T13537] netlink: 'syz.0.2239': attribute type 19 has an invalid length. [ 323.389886][T13537] netlink: 'syz.0.2239': attribute type 19 has an invalid length. [ 323.494915][T13544] sch_fq: defrate 0 ignored. [ 323.541698][T13549] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 324.044403][T13578] nbd: illegal input index 1048576 [ 324.065241][T13578] nbd: illegal input index 1048576 [ 324.183240][T13589] __nla_validate_parse: 29 callbacks suppressed [ 324.185130][T13589] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2255'. [ 324.202430][T13591] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2254'. [ 324.235427][T13590] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2253'. [ 324.454400][T13601] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 324.593929][T13607] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2259'. [ 324.608692][T13607] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2259'. [ 324.799883][T13618] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2261'. [ 324.827202][T13617] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2262'. [ 325.316710][T13649] FAULT_INJECTION: forcing a failure. [ 325.316710][T13649] name failslab, interval 1, probability 0, space 0, times 1 [ 325.342507][T13649] CPU: 0 UID: 0 PID: 13649 Comm: syz.1.2271 Not tainted syzkaller #0 PREEMPT(full) [ 325.342537][T13649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 325.342549][T13649] Call Trace: [ 325.342558][T13649] [ 325.342567][T13649] dump_stack_lvl+0x189/0x250 [ 325.342597][T13649] ? __pfx____ratelimit+0x10/0x10 [ 325.342619][T13649] ? __pfx_dump_stack_lvl+0x10/0x10 [ 325.342644][T13649] ? __pfx__printk+0x10/0x10 [ 325.342678][T13649] ? __pfx___might_resched+0x10/0x10 [ 325.342697][T13649] ? fs_reclaim_acquire+0x7d/0x100 [ 325.342722][T13649] should_fail_ex+0x414/0x560 [ 325.342758][T13649] should_failslab+0xa8/0x100 [ 325.342790][T13649] __kmalloc_cache_noprof+0x70/0x3d0 [ 325.342818][T13649] ? tcp_sendmsg_fastopen+0x1de/0x5e0 [ 325.342854][T13649] tcp_sendmsg_fastopen+0x1de/0x5e0 [ 325.342892][T13649] tcp_sendmsg_locked+0x4d9b/0x5620 [ 325.342927][T13649] ? tcp_sendmsg_locked+0x551/0x5620 [ 325.342965][T13649] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 325.343027][T13649] ? __lock_acquire+0xab9/0xd20 [ 325.343071][T13649] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 325.343099][T13649] ? __local_bh_enable_ip+0x12d/0x1c0 [ 325.343124][T13649] ? __local_bh_enable_ip+0x12d/0x1c0 [ 325.343158][T13649] tcp_sendmsg+0x2f/0x50 [ 325.343188][T13649] __sock_sendmsg+0xe5/0x270 [ 325.343230][T13649] ____sys_sendmsg+0x52d/0x830 [ 325.343262][T13649] ? __pfx_____sys_sendmsg+0x10/0x10 [ 325.343297][T13649] ? import_iovec+0x74/0xa0 [ 325.343328][T13649] ___sys_sendmsg+0x21f/0x2a0 [ 325.343357][T13649] ? __pfx____sys_sendmsg+0x10/0x10 [ 325.343422][T13649] ? __fget_files+0x2a/0x420 [ 325.343440][T13649] ? __fget_files+0x3a0/0x420 [ 325.343469][T13649] __sys_sendmmsg+0x227/0x430 [ 325.343507][T13649] ? __pfx___sys_sendmmsg+0x10/0x10 [ 325.343530][T13649] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 325.343583][T13649] ? ksys_write+0x22a/0x250 [ 325.343612][T13649] ? __pfx_ksys_write+0x10/0x10 [ 325.343636][T13649] ? rcu_is_watching+0x15/0xb0 [ 325.343665][T13649] __x64_sys_sendmmsg+0xa0/0xc0 [ 325.343693][T13649] do_syscall_64+0xfa/0x3b0 [ 325.343715][T13649] ? lockdep_hardirqs_on+0x9c/0x150 [ 325.343736][T13649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.343755][T13649] ? clear_bhb_loop+0x60/0xb0 [ 325.343779][T13649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.343798][T13649] RIP: 0033:0x7fcd8698eec9 [ 325.343816][T13649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 325.343833][T13649] RSP: 002b:00007fcd87893038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 325.343853][T13649] RAX: ffffffffffffffda RBX: 00007fcd86be5fa0 RCX: 00007fcd8698eec9 [ 325.343868][T13649] RDX: 0000000000000001 RSI: 0000200000000b00 RDI: 0000000000000003 [ 325.343880][T13649] RBP: 00007fcd87893090 R08: 0000000000000000 R09: 0000000000000000 [ 325.343891][T13649] R10: 0000000020080058 R11: 0000000000000246 R12: 0000000000000001 [ 325.343903][T13649] R13: 00007fcd86be6038 R14: 00007fcd86be5fa0 R15: 00007ffe010ae398 [ 325.343935][T13649] [ 325.854909][T13664] netlink: 146780 bytes leftover after parsing attributes in process `syz.0.2274'. [ 325.867363][T13664] validate_nla: 5 callbacks suppressed [ 325.867382][T13664] netlink: 'syz.0.2274': attribute type 58 has an invalid length. [ 325.885213][T13664] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2274'. [ 326.322579][T13680] lo: entered allmulticast mode [ 326.379360][T13679] lo: left allmulticast mode [ 326.592007][T13701] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2288'. [ 326.616866][T13694] IPVS: set_ctl: invalid protocol: 4 224.0.0.1:20001 [ 326.652223][T13694] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 326.680995][T13699] vxcan1 speed is unknown, defaulting to 1000 [ 326.681012][T13701] netlink: 'syz.3.2288': attribute type 12 has an invalid length. [ 326.778204][T13710] syzkaller1: entered promiscuous mode [ 326.786429][T13710] syzkaller1: entered allmulticast mode [ 326.799025][T13710] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 326.823412][T13710] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 326.823898][T13715] xt_HMARK: spi-set and port-set can't be combined [ 326.832090][T13710] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 326.847826][T13716] nftables ruleset with unbound set [ 326.855993][T13710] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 327.118619][T13727] netlink: 'syz.3.2294': attribute type 1 has an invalid length. [ 327.247944][T13729] veth1_to_bond: entered allmulticast mode [ 327.318720][T13729] bond0: (slave bond_slave_1): Releasing backup interface [ 327.369531][T13729] veth1_to_bond (unregistering): left allmulticast mode [ 327.704930][T13738] netlink: 'syz.2.2298': attribute type 11 has an invalid length. [ 328.108330][T13766] geneve3: entered promiscuous mode [ 328.368905][T13777] netlink: 'syz.3.2309': attribute type 10 has an invalid length. [ 328.389820][T13777] bond0: (slave wlan1): Opening slave failed [ 328.449197][T13785] vlan3: entered promiscuous mode [ 328.484244][T13785] vlan3: entered allmulticast mode [ 328.561236][T13789] netlink: 'syz.4.2313': attribute type 4 has an invalid length. [ 328.695817][T13796] openvswitch: netlink: EtherType 50a is less than min 600 [ 328.777644][T13796] xfrm1: entered promiscuous mode [ 328.783305][T13796] xfrm1: entered allmulticast mode [ 329.359459][T13824] netlink: 'syz.2.2327': attribute type 142 has an invalid length. [ 329.414289][T13828] __nla_validate_parse: 10 callbacks suppressed [ 329.414312][T13828] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 329.444554][T13828] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 329.520194][T13832] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2329'. [ 329.529751][T13829] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 329.529827][T13832] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2329'. [ 329.560175][T13829] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 329.959389][T13865] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2338'. [ 330.018284][T13867] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2339'. [ 330.034608][T13867] netlink: 'syz.4.2339': attribute type 3 has an invalid length. [ 330.145196][T13872] netlink: 248 bytes leftover after parsing attributes in process `syz.0.2340'. [ 330.264282][T13876] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2342'. [ 330.290116][T13876] batadv0 (unregistering): left promiscuous mode [ 330.366052][T13886] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !寿$ULvyڇv[Dwz [ 330.566035][T13892] openvswitch: netlink: Message has 5 unknown bytes. [ 330.678180][T13900] block nbd0: Unsupported socket: shutdown callout must be supported. [ 330.742972][T13900] rdma_rxe: rxe_newlink: failed to add bond0 [ 330.848165][T13911] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 331.087555][T13926] team0: Device gtp0 is up. Set it down before adding it as a team port [ 331.174092][T13940] netlink: 'syz.2.2363': attribute type 1 has an invalid length. [ 332.704139][T14015] xt_l2tp: missing protocol rule (udp|l2tpip) [ 332.723635][T14019] openvswitch: netlink: nsh attr 8196 is out of range max 3 [ 332.784616][T14019] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 332.974771][T14028] netlink: 'syz.1.2390': attribute type 12 has an invalid length. [ 333.197970][T12020] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.215854][T12020] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.224587][ T44] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.712807][ T5945] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.916603][T14089] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 334.230694][ T5945] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 334.887158][T14146] netlink: 'syz.1.2422': attribute type 8 has an invalid length. [ 334.966387][T14146] __nla_validate_parse: 15 callbacks suppressed [ 334.966408][T14146] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2422'. [ 335.005191][T14146] bond0: entered promiscuous mode [ 335.010596][T14146] bond_slave_0: entered promiscuous mode [ 335.016668][T14146] team0: entered promiscuous mode [ 335.025533][T14146] team_slave_0: entered promiscuous mode [ 335.034760][T14146] team_slave_1: entered promiscuous mode [ 335.041652][T14146] bridge_slave_1: entered promiscuous mode [ 335.048887][T14146] bond0: left promiscuous mode [ 335.053926][T14146] bond_slave_0: left promiscuous mode [ 335.059668][T14146] team0: left promiscuous mode [ 335.065725][T14146] team_slave_0: left promiscuous mode [ 335.071924][T14146] team_slave_1: left promiscuous mode [ 335.077698][T14146] bridge_slave_1: left promiscuous mode [ 335.155982][T14156] netlink: 'syz.0.2426': attribute type 1 has an invalid length. [ 335.170247][T14156] netlink: 'syz.0.2426': attribute type 4 has an invalid length. [ 335.179472][T14156] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.2426'. [ 335.185206][T14157] netlink: 'syz.0.2426': attribute type 1 has an invalid length. [ 335.198047][T14157] netlink: 'syz.0.2426': attribute type 4 has an invalid length. [ 335.209585][T14157] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.2426'. [ 335.243860][T14157] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2426'. [ 335.258136][T14156] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2426'. [ 335.308386][T14162] netlink: 'syz.3.2427': attribute type 4 has an invalid length. [ 335.328800][T14162] netlink: 'syz.3.2427': attribute type 4 has an invalid length. [ 335.344677][T14164] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2428'. [ 335.368399][T14162] netlink: 'syz.3.2427': attribute type 4 has an invalid length. [ 335.513810][T14174] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 336.534587][T14237] validate_nla: 1 callbacks suppressed [ 336.534607][T14237] netlink: 'syz.4.2449': attribute type 4 has an invalid length. [ 336.751276][T14246] netlink: 176 bytes leftover after parsing attributes in process `syz.3.2453'. [ 336.783521][T14246] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2453'. [ 336.831290][T14249] netlink: 176 bytes leftover after parsing attributes in process `syz.3.2453'. [ 336.844532][T14249] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2453'. [ 337.114580][T14266] openvswitch: netlink: Flow actions attr not present in new flow. [ 337.129296][T14268] openvswitch: netlink: Flow actions attr not present in new flow. [ 337.181086][T14264] IPv4: Oversized IP packet from 127.202.26.0 [ 337.280537][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 337.470306][T14288] netlink: 'syz.3.2466': attribute type 2 has an invalid length. [ 337.487294][T14288] netlink: 'syz.3.2466': attribute type 1 has an invalid length. [ 338.356527][T14330] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 338.462070][T14343] Bluetooth: MGMT ver 1.23 [ 338.798815][T14356] nbd: couldn't find a device at index -373156329 [ 338.842921][T14369] tipc: Bearer : already 2 bearers with priority 10 [ 338.857828][T14369] tipc: Bearer : trying with adjusted priority [ 338.866654][T14369] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 339.066938][T14380] netlink: 'syz.4.2488': attribute type 2 has an invalid length. [ 339.100178][T14383] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 339.387755][T14402] pim6reg: left allmulticast mode [ 339.515500][T14410] netlink: 'syz.2.2500': attribute type 1 has an invalid length. [ 339.539875][T14410] geneve3: entered promiscuous mode [ 339.555782][T14410] geneve3: entered allmulticast mode [ 339.566235][T12031] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 339.597563][T12031] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 339.606969][T12031] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 339.619777][T14413] IPv6: sit2: Disabled Multicast RS [ 339.963485][T12026] smc: removing ib device syz1 [ 340.008774][T14437] netlink: 'syz.4.2508': attribute type 10 has an invalid length. [ 340.067525][T14432] netlink: 'syz.0.2506': attribute type 14 has an invalid length. [ 340.087278][T14437] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 340.919758][T14453] __nla_validate_parse: 15 callbacks suppressed [ 340.919778][T14453] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2512'. [ 340.930017][T14452] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2513'. [ 341.053114][T14410] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 341.178325][T14455] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 341.296669][T14410] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 341.422370][T14410] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 341.693360][T14473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2517'. [ 341.706984][T12030] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 341.720000][T12030] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 341.748626][T12030] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 341.773365][T12002] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 341.954213][T14485] netlink: 'syz.1.2520': attribute type 2 has an invalid length. [ 342.191914][T14498] tipc: Enabled bearer , priority 0 [ 342.285985][T14500] tipc: Disabling bearer [ 342.589632][T14520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2531'. [ 342.634546][T14525] veth11: entered promiscuous mode [ 342.643248][T14526] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2533'. [ 342.738059][T14526] bond7: entered allmulticast mode [ 342.768973][T14533] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 342.791151][T14530] IPVS: stopping master sync thread 14533 ... [ 342.802919][T14532] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2535'. [ 342.828368][T14530] netlink: 'syz.0.2534': attribute type 11 has an invalid length. [ 342.855079][T14530] netlink: 'syz.0.2534': attribute type 11 has an invalid length. [ 342.868815][T14530] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2534'. [ 342.882468][T14539] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2534'. [ 342.922039][T14541] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2538'. [ 343.182549][T14560] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2543'. [ 344.325587][T14618] netlink: 'syz.1.2561': attribute type 8 has an invalid length. [ 344.482889][T14628] lo: Caught tx_queue_len zero misconfig [ 344.636100][T14636] netlink: 'syz.1.2567': attribute type 1 has an invalid length. [ 344.644501][T14636] netlink: 'syz.1.2567': attribute type 1 has an invalid length. [ 344.802798][T14642] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 344.921722][T14651] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 344.973066][T14654] netlink: 'syz.0.2574': attribute type 3 has an invalid length. [ 345.038246][T14659] tipc: Enabled bearer , priority 0 [ 345.162393][T14659] syzkaller0: entered promiscuous mode [ 345.168013][T14659] syzkaller0: entered allmulticast mode [ 345.178460][T14659] tipc: Resetting bearer [ 345.188099][T14658] tipc: Resetting bearer [ 345.377284][T14677] netlink: 'syz.4.2582': attribute type 12 has an invalid length. [ 345.388121][T14677] netlink: 'syz.4.2582': attribute type 11 has an invalid length. [ 345.520533][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 346.753196][T14658] tipc: Disabling bearer [ 347.037006][T14709] netlink: 'syz.1.2590': attribute type 1 has an invalid length. [ 347.082021][T14709] __nla_validate_parse: 6 callbacks suppressed [ 347.082041][T14709] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2590'. [ 347.174692][T14720] tipc: Enabled bearer , priority 0 [ 347.200446][T14719] netlink: 'syz.1.2590': attribute type 11 has an invalid length. [ 347.208322][T14719] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2590'. [ 347.291029][T14728] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2594'. [ 347.307311][T14718] syzkaller0: entered promiscuous mode [ 347.313775][T14718] syzkaller0: entered allmulticast mode [ 347.320177][T14718] tipc: Resetting bearer [ 347.374941][T14725] bond9: entered promiscuous mode [ 347.380043][T14725] bond9: entered allmulticast mode [ 347.387218][T14725] 8021q: adding VLAN 0 to HW filter on device bond9 [ 347.569917][T14721] tipc: Enabling of bearer rejected, already enabled [ 347.616218][T14721] tipc: Resetting bearer [ 347.706551][T14741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2596'. [ 348.004055][T14760] netlink: 'syz.2.2600': attribute type 83 has an invalid length. [ 349.245575][T14721] tipc: Disabling bearer [ 349.289176][T14757] team0: Port device geneve4 added [ 349.296327][T12026] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20003 - 0 [ 349.344658][T12026] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20003 - 0 [ 349.371279][T12026] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20003 - 0 [ 349.380232][T12026] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20003 - 0 [ 349.402593][T14766] netlink: 'syz.4.2604': attribute type 24 has an invalid length. [ 349.432114][T14766] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2604'. [ 349.699795][T14790] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 349.723449][T14790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2610'. [ 349.736809][T14790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2610'. [ 349.750243][T14790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2610'. [ 349.906807][T14797] netlink: 'syz.0.2612': attribute type 28 has an invalid length. [ 349.926899][T14797] netlink: 'syz.0.2612': attribute type 3 has an invalid length. [ 349.940810][T14797] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2612'. [ 349.955130][T14799] netlink: 'syz.4.2613': attribute type 4 has an invalid length. [ 349.973078][T14797] batadv0: left allmulticast mode [ 350.393668][T14823] netlink: 'syz.1.2616': attribute type 83 has an invalid length. [ 350.735338][T14836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2619'. [ 350.848860][T14844] bridge0: port 1(ipvlan0) entered blocking state [ 350.856338][T14844] bridge0: port 1(ipvlan0) entered disabled state [ 350.866262][T14844] ipvlan0: entered allmulticast mode [ 350.872728][T14844] bridge0: entered allmulticast mode [ 350.879937][T14844] ipvlan0: left allmulticast mode [ 350.885112][T14844] bridge0: left allmulticast mode [ 350.911730][T14846] netlink: 'syz.1.2623': attribute type 1 has an invalid length. [ 350.919805][T14846] netlink: 'syz.1.2623': attribute type 1 has an invalid length. [ 351.153379][T14863] netlink: 'syz.4.2628': attribute type 32 has an invalid length. [ 351.577701][T14884] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 351.634300][T14884] team0: Caught tx_queue_len zero misconfig [ 351.692028][T14889] tipc: Enabled bearer , priority 0 [ 351.790520][T14889] tipc: Disabling bearer [ 351.949733][T14905] bridge_slave_0: left allmulticast mode [ 351.989552][T14905] bridge_slave_0: left promiscuous mode [ 351.997488][T14905] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.168259][T14905] bridge_slave_1: left allmulticast mode [ 352.178146][T14905] bridge_slave_1: left promiscuous mode [ 352.188894][T14905] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.207478][T14905] bond0: (slave bond_slave_0): Releasing backup interface [ 352.234210][T14905] team0: Port device team_slave_0 removed [ 352.254918][T14905] team0: Port device team_slave_1 removed [ 352.279110][T14927] validate_nla: 2 callbacks suppressed [ 352.279131][T14927] netlink: 'syz.4.2644': attribute type 2 has an invalid length. [ 352.280623][T14905] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 352.321458][T14905] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 352.333436][T14905] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 352.344214][T14905] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 352.392852][T14905] A link change request failed with some changes committed already. Interface bond2 may have been left with an inconsistent configuration, please check. [ 352.428439][T14931] __nla_validate_parse: 5 callbacks suppressed [ 352.428461][T14931] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.2645'. [ 352.822768][T14956] xfrm2: entered allmulticast mode [ 352.905614][T14960] veth0: entered promiscuous mode [ 352.961493][T14960] 8021q: adding VLAN 0 to HW filter on device bond9 [ 353.002302][T14960] bond9: (slave ip6gretap2): Enslaving as an active interface with an up link [ 353.068707][T14960] veth0: left promiscuous mode [ 353.230265][T14986] tipc: Enabled bearer , priority 0 [ 353.291965][T14990] syzkaller1: entered promiscuous mode [ 353.316450][T14990] syzkaller1: entered allmulticast mode [ 353.389742][T14986] tipc: Disabling bearer [ 353.557966][T15005] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2664'. [ 353.803226][T15018] 8021q: adding VLAN 0 to HW filter on device bond6 [ 353.841331][T15028] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2672'. [ 353.992161][T15039] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2673'. [ 354.012094][T15036] can: request_module (can-proto-0) failed. [ 354.018169][T15039] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2673'. [ 354.119425][T15041] ip6erspan0: entered promiscuous mode [ 354.217087][T15048] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2675'. [ 356.093244][T15081] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2685'. [ 356.208907][T15084] [ 356.211303][T15084] ====================================================== [ 356.218345][T15084] WARNING: possible circular locking dependency detected [ 356.225484][T15084] syzkaller #0 Not tainted [ 356.229921][T15084] ------------------------------------------------------ [ 356.236971][T15084] syz.1.2686/15084 is trying to acquire lock: [ 356.243038][T15084] ffffffff8f68f758 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 356.252359][T15084] [ 356.252359][T15084] but task is already holding lock: [ 356.259729][T15084] ffff88802e404670 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0xcce/0x2570 [ 356.269062][T15084] [ 356.269062][T15084] which lock already depends on the new lock. [ 356.269062][T15084] [ 356.279559][T15084] [ 356.279559][T15084] the existing dependency chain (in reverse order) is: [ 356.288588][T15084] [ 356.288588][T15084] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 356.296637][T15084] lock_acquire+0x120/0x360 [ 356.301681][T15084] _raw_spin_lock_bh+0x36/0x50 [ 356.306986][T15084] nr_rt_ioctl+0x193/0xd50 [ 356.312019][T15084] sock_do_ioctl+0xdc/0x300 [ 356.317055][T15084] sock_ioctl+0x576/0x790 [ 356.321918][T15084] __se_sys_ioctl+0xfc/0x170 [ 356.327034][T15084] do_syscall_64+0xfa/0x3b0 [ 356.332068][T15084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.338576][T15084] [ 356.338576][T15084] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 356.346399][T15084] lock_acquire+0x120/0x360 [ 356.351431][T15084] _raw_spin_lock_bh+0x36/0x50 [ 356.356731][T15084] nr_rt_device_down+0xa9/0x720 [ 356.362109][T15084] nr_device_event+0x137/0x150 [ 356.367398][T15084] notifier_call_chain+0x1b3/0x3e0 [ 356.373081][T15084] __dev_notify_flags+0x18d/0x2e0 [ 356.378632][T15084] netif_change_flags+0xe8/0x1a0 [ 356.384184][T15084] dev_change_flags+0x130/0x260 [ 356.389566][T15084] dev_ioctl+0x7b4/0x1150 [ 356.394440][T15084] sock_do_ioctl+0x22c/0x300 [ 356.399568][T15084] sock_ioctl+0x576/0x790 [ 356.404433][T15084] __se_sys_ioctl+0xfc/0x170 [ 356.409592][T15084] do_syscall_64+0xfa/0x3b0 [ 356.414621][T15084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.421060][T15084] [ 356.421060][T15084] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 356.428979][T15084] validate_chain+0xb9b/0x2140 [ 356.434275][T15084] __lock_acquire+0xab9/0xd20 [ 356.439486][T15084] lock_acquire+0x120/0x360 [ 356.444521][T15084] _raw_spin_lock_bh+0x36/0x50 [ 356.449819][T15084] nr_remove_neigh+0x25/0xe0 [ 356.454937][T15084] nr_add_node+0x1d9f/0x2570 [ 356.460069][T15084] nr_rt_ioctl+0xc12/0xd50 [ 356.465112][T15084] sock_do_ioctl+0xdc/0x300 [ 356.470156][T15084] sock_ioctl+0x576/0x790 [ 356.475015][T15084] __se_sys_ioctl+0xfc/0x170 [ 356.480136][T15084] do_syscall_64+0xfa/0x3b0 [ 356.485176][T15084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.491683][T15084] [ 356.491683][T15084] other info that might help us debug this: [ 356.491683][T15084] [ 356.501937][T15084] Chain exists of: [ 356.501937][T15084] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 356.501937][T15084] [ 356.515776][T15084] Possible unsafe locking scenario: [ 356.515776][T15084] [ 356.523234][T15084] CPU0 CPU1 [ 356.528605][T15084] ---- ---- [ 356.533967][T15084] lock(&nr_node->node_lock); [ 356.538739][T15084] lock(nr_node_list_lock); [ 356.545867][T15084] lock(&nr_node->node_lock); [ 356.553185][T15084] lock(nr_neigh_list_lock); [ 356.557880][T15084] [ 356.557880][T15084] *** DEADLOCK *** [ 356.557880][T15084] [ 356.566021][T15084] 1 lock held by syz.1.2686/15084: [ 356.571149][T15084] #0: ffff88802e404670 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0xcce/0x2570 [ 356.580914][T15084] [ 356.580914][T15084] stack backtrace: [ 356.586804][T15084] CPU: 0 UID: 0 PID: 15084 Comm: syz.1.2686 Not tainted syzkaller #0 PREEMPT(full) [ 356.586825][T15084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 356.586835][T15084] Call Trace: [ 356.586843][T15084] [ 356.586851][T15084] dump_stack_lvl+0x189/0x250 [ 356.586874][T15084] ? __pfx_dump_stack_lvl+0x10/0x10 [ 356.586893][T15084] ? __pfx__printk+0x10/0x10 [ 356.586914][T15084] ? stack_trace_save+0x9c/0xe0 [ 356.586940][T15084] print_circular_bug+0x2ee/0x310 [ 356.586960][T15084] check_noncircular+0x134/0x160 [ 356.586981][T15084] validate_chain+0xb9b/0x2140 [ 356.586997][T15084] ? do_syscall_64+0xfa/0x3b0 [ 356.587026][T15084] __lock_acquire+0xab9/0xd20 [ 356.587058][T15084] ? nr_remove_neigh+0x25/0xe0 [ 356.587072][T15084] lock_acquire+0x120/0x360 [ 356.587094][T15084] ? nr_remove_neigh+0x25/0xe0 [ 356.587111][T15084] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 356.587132][T15084] ? nr_remove_neigh+0x25/0xe0 [ 356.587146][T15084] _raw_spin_lock_bh+0x36/0x50 [ 356.587170][T15084] ? nr_remove_neigh+0x25/0xe0 [ 356.587184][T15084] nr_remove_neigh+0x25/0xe0 [ 356.587199][T15084] nr_add_node+0x1d9f/0x2570 [ 356.587224][T15084] ? dev_get_by_name+0x21/0x200 [ 356.587247][T15084] ? dev_get_by_name+0x21/0x200 [ 356.587268][T15084] ? dev_get_by_name+0x21/0x200 [ 356.587290][T15084] ? nr_call_to_digi+0x136/0x1b0 [ 356.587314][T15084] nr_rt_ioctl+0xc12/0xd50 [ 356.587342][T15084] ? kasan_quarantine_put+0xdd/0x220 [ 356.587363][T15084] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 356.587391][T15084] ? apparmor_capable+0x137/0x1b0 [ 356.587415][T15084] ? capable+0x89/0xe0 [ 356.587431][T15084] ? nr_ioctl+0x1b1/0x3b0 [ 356.587451][T15084] sock_do_ioctl+0xdc/0x300 [ 356.587477][T15084] ? __pfx_sock_do_ioctl+0x10/0x10 [ 356.587499][T15084] ? __lock_acquire+0xab9/0xd20 [ 356.587529][T15084] sock_ioctl+0x576/0x790 [ 356.587553][T15084] ? __pfx_sock_ioctl+0x10/0x10 [ 356.587576][T15084] ? __fget_files+0x2a/0x420 [ 356.587589][T15084] ? __fget_files+0x3a0/0x420 [ 356.587602][T15084] ? __fget_files+0x2a/0x420 [ 356.587616][T15084] ? bpf_lsm_file_ioctl+0x9/0x20 [ 356.587637][T15084] ? __pfx_sock_ioctl+0x10/0x10 [ 356.587659][T15084] __se_sys_ioctl+0xfc/0x170 [ 356.587679][T15084] do_syscall_64+0xfa/0x3b0 [ 356.587697][T15084] ? lockdep_hardirqs_on+0x9c/0x150 [ 356.587712][T15084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.587728][T15084] ? clear_bhb_loop+0x60/0xb0 [ 356.587747][T15084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.587762][T15084] RIP: 0033:0x7fcd8698eec9 [ 356.587778][T15084] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 356.587792][T15084] RSP: 002b:00007fcd87893038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 356.587809][T15084] RAX: ffffffffffffffda RBX: 00007fcd86be5fa0 RCX: 00007fcd8698eec9 [ 356.587821][T15084] RDX: 0000200000000000 RSI: 000000000000890b RDI: 000000000000000a [ 356.587832][T15084] RBP: 00007fcd86a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 356.587842][T15084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 356.587851][T15084] R13: 00007fcd86be6038 R14: 00007fcd86be5fa0 R15: 00007ffe010ae398 [ 356.587870][T15084] [ 360.870614][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!