last executing test programs: 8.386913204s ago: executing program 0 (id=14998): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x3, 0x0, 0x0, 0x41100}, 0x94) (async) close(0x3) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000018000"/28], 0x48) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8.337113492s ago: executing program 0 (id=15000): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x88f}, [@call={0x85, 0x0, 0x0, 0x61}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}]}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0x22, 0x0, &(0x7f0000000600)="c8bb4e7dbde79f730088650008007c11feebc9a80520cdd0258d0e758fa5267122cb", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getpeername$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c) 5.31934538s ago: executing program 1 (id=15015): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a000004903a094a73797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d1030000400000000e0a010200000000000000000a0000000900010073797a31000000000900020073797a310000000014000380100000800c00018002000100d1460000140000001100010000000000000000000100000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 5.159868621s ago: executing program 1 (id=15017): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) socket(0xa, 0xa, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, 0x0) socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x30000000}) r4 = socket(0x1, 0x80802, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r1, &(0x7f0000000100)={0xa000001c}) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000004a00030000000000000000000a0080", @ANYRES32=0x0, @ANYBLOB="0080"], 0x24}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f00000000c0)={0x10000001}) epoll_pwait(r5, &(0x7f0000000080)=[{}], 0x1, 0x80000000, 0x0, 0x0) close(r5) shutdown(r4, 0x0) close(r3) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x3c, r8, 0x1, 0x0, 0xfffffffc, {}, [@ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x5}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x5}]}, 0x3c}}, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000002780)=""/4096, 0x1000}], 0x1, 0x5b3d2934, 0xfffffff8) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r11], 0x1c}}, 0x0) 2.102049329s ago: executing program 4 (id=15025): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x400, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {}, {0x6, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40022}, 0x2000400c) 1.983131889s ago: executing program 1 (id=15026): r0 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'nr0\x00', 0x2}) ioctl$BTRFS_IOC_DEFRAG(r0, 0x50009402, 0x0) (async) sendmsg$sock(r0, &(0x7f0000000380)={&(0x7f0000000040)=@l2={0x1f, 0x4, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfffd, 0x1}, 0x80, &(0x7f0000000280)=[{&(0x7f00000000c0)="c57369ac72386c66ffdf39d6e72dc0c5c4ac72e2e7076ce71e5669b2943256bf950f593eac0294629ea4ae6f02fe612b67c5e6795583aba3b7e4da83e4c20738c766d99c2580b719af4c62b3b0a896927580e315710ce4b8f8", 0x59}, {&(0x7f0000000140)="b57d9fdb25c0b75f698171d4a193f703bfd2c96d659e830a43d639d2afb2084a535e2604e4f036a56789eca4832eaeb008270752ce93e5dc5fbc65742277d8cb5eea59c37ff4defd56235149c7749432136f1e03e78b29d8fa3d8dd7d0ccc877fb34fcc50f6553f51a980bfda56884aa4d1360481e08780eb9af0182f1d1e123afb949b1e8186bb6ab3d45d682e6c3", 0x8f}, {&(0x7f0000000200)="7e1b066993f64c2f7619ed2f2e3c0cf4bd87e6ecc91c0f8436f2c540f32185257d3f1b5fab9b27619c4aaeaebbeffa1a5a63171fc003ebaf7d78aa7c6b920a8e041eb2faf018be365a887bd4318602ac26c361ef641f67b3fe883624caaee75ba2e36e27e8", 0x65}], 0x3, &(0x7f00000002c0)=[@txtime={{0x18, 0x1, 0x3d, 0x8}}, @txtime={{0x18, 0x1, 0x3d, 0x10000}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18}}, @mark={{0x14, 0x1, 0x24, 0x3}}], 0x90}, 0x180) r1 = accept4(r0, &(0x7f0000000400)=@qipcrtr, &(0x7f0000000480)=0x80, 0x40000) syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), r1) (async) r2 = socket$packet(0x11, 0x2, 0x300) (async) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000004c0), &(0x7f0000000500)=0x4) (async) r3 = getpid() (async) r4 = getuid() r5 = getgid() setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000540)={r3, r4, r5}, 0xc) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000580)={'wg1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000680)={'sit0\x00', &(0x7f00000005c0)={'tunl0\x00', r6, 0x700, 0x1, 0x6, 0xe0000000, {{0x20, 0x4, 0x1, 0x7, 0x80, 0x67, 0x0, 0x5, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x3a}, @private=0xa010101, {[@noop, @timestamp_addr={0x44, 0x1c, 0xfb, 0x1, 0x4, [{@local}, {@empty, 0x7}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}]}, @generic={0x86, 0x7, "aff8775859"}, @rr={0x7, 0xb, 0x43, [@multicast2, @local]}, @timestamp_addr={0x44, 0x3c, 0xcc, 0x1, 0x0, [{@private=0xa010100, 0x9}, {@empty, 0x40}, {@remote, 0xa0}, {@empty, 0xee1}, {@private=0xa010101, 0x3}, {@multicast2, 0x80000000}, {@local, 0x5}]}]}}}}}) r8 = socket$unix(0x1, 0x5, 0x0) r9 = accept$unix(r8, 0x0, &(0x7f00000006c0)) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xf, 0x4, 0x7f, 0x2, 0x2000, 0x1, 0x8001, '\x00', r6, 0xffffffffffffffff, 0x0, 0x4, 0x2}, 0x50) (async) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r2, 0xf507, 0x0) (async) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), r1) (async) getsockopt$PNPIPE_IFINDEX(r9, 0x113, 0x2, &(0x7f0000000800)=0x0, &(0x7f0000000840)=0x4) sendmsg$ETHTOOL_MSG_RINGS_GET(r1, &(0x7f0000000a80)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000a40)={&(0x7f0000000880)={0x1ac, r11, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @HEADER={0x74, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) r13 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ppoll(&(0x7f0000000ac0)=[{r1, 0x8011}, {r2, 0x2}, {r2, 0x2001}, {0xffffffffffffffff, 0x21}, {r1, 0x30f0}, {r1, 0x460}, {r0, 0x200}, {r13, 0x1001}, {r0, 0x80}], 0x9, &(0x7f0000000b40), &(0x7f0000000b80)={[0x6]}, 0x8) (async) r14 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000ec0)={0x6, 0x2c, &(0x7f0000000bc0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf4f, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r10}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r10}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x40}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @map_val={0x18, 0x8, 0x2, 0x0, r10, 0x0, 0x0, 0x0, 0xc}, @map_idx={0x18, 0x7, 0x5, 0x0, 0x10}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000d40)='GPL\x00', 0x9, 0x0, &(0x7f0000000d80), 0x41100, 0x31, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000dc0)={0x2, 0x4}, 0x8, 0x10, &(0x7f0000000e00)={0x4, 0x8, 0x1}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000e40)=[r10, r10, r10, r10, r10, r10, r10, r10], &(0x7f0000000e80)=[{0x3, 0x3, 0x6, 0x8}], 0x10, 0x7}, 0x94) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001280)={r2, 0xe0, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000fc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, &(0x7f0000001000)=[0x0, 0x0], &(0x7f0000001040)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xc5, &(0x7f0000001080)=[{}], 0x8, 0x10, &(0x7f00000010c0), &(0x7f0000001100), 0x8, 0x67, 0x8, 0x8, &(0x7f0000001140)}}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000f80)={@ifindex=r6, r14, 0x29, 0x70ccf58d33a55a72, 0x0, @void, @void, @void, @value=r15}, 0x20) r16 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$BTRFS_IOC_GET_DEV_STATS(r8, 0xc4089434, &(0x7f00000012c0)={0x0, 0x100000001, 0x0, [0x85f, 0x7, 0x3, 0x81, 0xffff], [0x6, 0x3, 0x7, 0xfffffffffffffffd, 0xfffffffffffffffb, 0x7f, 0x48, 0xfffffffffffffff9, 0xee, 0x3da1, 0x1, 0x323, 0x6, 0x9, 0x5, 0x100000001, 0xfffffffffffffff8, 0x31dc, 0x3, 0x2973, 0x11, 0x42, 0x40, 0x164e0000000000, 0x70, 0xfe9, 0x8, 0x3, 0x9, 0x80000000, 0x9, 0x7fffffffffffffff, 0x9, 0x5, 0x1, 0x7, 0x1000, 0x9, 0x0, 0x8000, 0x6, 0x1, 0xb9, 0x1, 0x5e, 0x1, 0xfffffffffffff0f5, 0x1, 0x5, 0x836, 0x4, 0xfffffffffffffff5, 0x633, 0x7, 0x200, 0x10000, 0x6, 0x469e, 0x1, 0x80000000, 0x5, 0x9, 0x8, 0x0, 0x400, 0x6, 0x1, 0xffffffffffff8000, 0x10000, 0xb, 0x3, 0xfffffffffffffffe, 0x9, 0x6, 0x4, 0x100000000, 0x7, 0x8388000000000, 0x7fff, 0x1, 0x1, 0x7, 0x2, 0x8000000000000001, 0x1, 0x5, 0xd66, 0x2, 0x48ed, 0x9, 0x6, 0x6, 0x6, 0x6, 0x3, 0x5, 0xffff, 0x0, 0xe, 0x200, 0x9, 0xf, 0x3, 0x4, 0x0, 0x7f3, 0xe2, 0xa, 0x3, 0x400, 0x6770798f, 0x4f1d, 0x4, 0xe, 0x2fc, 0x0, 0x4, 0x7, 0xffffffffffff2a00, 0x2, 0x5]}) ioctl$BTRFS_IOC_DEV_REPLACE(r16, 0xca289435, &(0x7f0000001700)={0x0, 0x80000000, @start={r17, 0x1, "2834fbe61501331541c8a912c6ca1518919b3ca33c0c46c178cb6a9826c8eeee898909997ba2518eac1725b8f8341d7aab722a2ebeca5ee91f8e47013eeeddaf1c99a96596bd0f84f358843b47fbff79ac1a7e01fab1db18143ae427d536d02be574cc7ca4267b3e8fb212fd6e80be3ae4b4b2ac2bdfad605f946c0ff5738d5b230443ff8e6a8d6a3fdf363e268d400f5aba2b8f8cc41884f84e9d3caccdc24d991bdd37231f792e43b7d6d71d9fca9bff69ab7bf4f983f635f3811a8696487043f97330d2286a045c696a7fdfc78066aa5916fe9ce6c2179632b8710449b2d49c919e4b5135962bb0104abc8222bbf716a84a7bc54bbfe33de1a9a9c9ea4357f8bb3083aea6ddfe79e33555ba9b2053c1b63af8b0f2082ac2bb04a9bef244d274d082f025cb9d90516e52cb82268a9d7bd43c7f3d059cf4c0efefcd75eed1a291c4f837fd38bfddf4f2d8ff3fff8f92cca9d17bd095ad5114014055438a573f62ef1df9a75837a7350368fbeaac837d6b1a5ac92866dd61b075ef69c0a817e8c93e2e976a5124861efd2824de7312fec1bee06ac810c0ca30ad2df6869fada8540409f5a1bb7780f7b8e29d6ad8433185bbf7a9eb407214ca38694abdcb1195140e9dcdb28c4407642e8dfa1e538917351d415ff1a4b437630a00bb0b9f9bff4927ab8226113a6dcb8a559c30b4c4fa67606d0352810f8935c77edcc6f211e99347db81fba74dd49082b5fdcf9a4d385021cbaf35a95856408b13f31b2565c0be12d7801d48385aa3e0fd626d777638c397e276fab316999cbd5b61174d640edb89e76302ad8108045f7e8f960a054504ab26e72fe49b2648ce1395bb027db7c7c78fe67c04abef1abd13061f59a2e8db9f925906ee19af72a09c8ec3d89a0c0675b4d56c79f58a79d52de89ddd23c35af46ded62c83b431565ff6712bb232f986b247728d795b322b4e874f1851959c2d30603a67cd38cbadbe0b7d43b0428a551389bd0677e01c7dd36d7cb7c06f549c6bac8ad60eca49cd13d836dabafac1b791ccfca7f0ff316994927494baff6ba75b738463e9632bc69c70169f3015e1645979022cbaf52400c9e9c7c908d10523ec2d07a7e9d83c7119d3b94170a9031c4519dd89fadb5bfab0bf3bb9c8c1019d5117467df5fcf8c5c5101ab1f4c13ca61e333ab90dfc7a9e67ade83d2447ab72504acafc291beeaae094879d962fd00342fd48d0de2140a7d23cd30dc553e6e01c040d9852f6eab1f67d2f8642b17b95e8fb824a37e6b1dc56c1eb54e7616e142f5f2da096eb67969a2a3d66f80b487522b6a2521a62f36ee653f66a24defd869e6f40dd529a9b5620a2cff49c57b48dfccae5bde24098f23d7ca6457b86f43ff1b6002adc82e77b647f680e264d034785d241ad2e70aa2c5f51cf780aa716afbe3e5e08a4940a0448fcfc6f6f303fb", "f3bebe8deb9e0732daac2487190def83d095e07a8ba9575c678d26a21ef00c755cbf8601b2540bbb8f1d2e40ad732443428cd711c0c0661692579cd537c5573785a14d2a59e1f882b5701ab473376535b5ba19158e28c240d194bbd8c192a6ff54fd9621419fabd8e2c612b31ecbe3647ee66422a01d703ff2969c14514582dd8811dfd24ea881d44a6e9defaf9cd48a6c3b3c1b287926846b195c519fc8a5f7a05c117316f7f839aedbb48460ae395b4ec148eefe49832041e35a14b7675063f9b8c54467c8692a86a232a01ada39d29c758d96a92cb29aa3fe64bee5f8d588daf8374203a49ee5d4a3a6bec4a165bfed5516fc70a22c07d71aaf43dc8e730bbd763e6cf589b98155e04fb5d601c711d5c74a7969cb56db6dded5cad951a9bfea4f96a858c18122d86e836f69d9b9bad5496423d3f0d879673fc94ab9ca43eec2517feeaa0ae8af61414d564beffd9e751bd4099421e36175b7ce31f90ac78801640d5a212dc43ed15ea50e178363217ef1805d33dedb40f0ed5644787069bc042c9c24ceab102cdc7ea6b5ea62b9e9bde7e16c2ea0a92df49781675192d0801a4b02e602a258aa56b0931476a47555b9311bfc211f40711311d9b5b88f82c76931d6526c2217b4fd9722c81677a729e928277163cf9b618eb2b9ebffaa935d751be1ab5c164a68e91a144500daeaaf9148aeb1aba648755454582e10f00c8be193854dead5e193a9250a87acc38380e1e720f3cfffb6b8cb1b5b9795a3af23effad0da9c4096ba33254e19c9f5b2ac6cb37d0e5f9fb802053c3eb7e8c7fdd38cbd5407e8c80cd0f912b034469db024790c9120323adaafa55445491ab648f15d33a9c0a89b53bd0e9a3ee83fe88d981de2de990478892cccf701c3fe23f9bfe105f333b23f9a6a5d1f2e04b79cb3ab48db3d5ce434c1a3837854de7b429a3e8b0b123a4d26225f9e0f4cf59eb6c8853b3460900ec5e2293f128855a71da4c95250525c9bccf8233825c4f8819cf300adcd547670dd62094b99ac740d9855303bc8fb7619e5a3e6d02ba16887d335ff98b2360924829ab682456bb30ea6d28a0ca3bbc4a9a4e0f65108d9b8dc4a4b5b4c2a8283976ef62376043ac1effc277d39a72b88bc38293d5afdbc7672ce764c997c907a064fdb3ab898e433119f7d8ca4a4f581b2fe848da5abfa02584d86eb29a2b9c4a915d0e4eaa9558dc3b9a96d9bb87886aaebbc308ff50a1c4ae2c71eb9a7ad138bfe77c09ce4641839e8a878e7b48a375a859b629a50676a9cb7decf094528c6238ab801a92769e8cffb8a76fcc8c9e767cde423e5d0cfa0cd78e00f5a5f15a65c318898166c4046ff663ec9e9488e82bed303b488e421a0d80a3e23bbd3ad863b760de8108f693c68ea58f82c49f1222181093e88f24f96d6c68212171c342916c313987e5293f3fb5754504a"}, [0x10001, 0x8d1, 0x7, 0x8, 0x2, 0xfffffffffffffff7, 0xfffffffffffff000, 0x9, 0x0, 0x9e8b, 0x2, 0xfffffffffffffffd, 0x7, 0x1000, 0x6, 0x2, 0x9, 0x5, 0x8, 0x3, 0x3ff, 0x3, 0x6, 0x32, 0x5, 0x948, 0x8, 0xe0e1, 0x3ff, 0x347, 0x2, 0x3, 0x1, 0xfffffffffffffffd, 0x400, 0x91ab, 0x8, 0x1, 0x8, 0xf2a4, 0x3, 0xfffffffffffffe01, 0x3, 0x2, 0x4, 0x460c, 0xfff, 0xa, 0x324, 0x6cb, 0x74, 0x3ff, 0x8, 0x5, 0x10001, 0xe8, 0x14a00000000000, 0x1, 0xe3, 0xc, 0x8, 0x3ff, 0xfffffffffffff801, 0xbc]}) (async) sendmsg$nl_netfilter(r16, &(0x7f0000002200)={&(0x7f0000002140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000021c0)={&(0x7f0000002180)={0x1c, 0x7, 0x2, 0x3, 0x70bd2b, 0x25dfdbfb, {0x5, 0x0, 0x6}, [@typed={0x8, 0xc7, 0x0, 0x0, @pid=r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040811}, 0x0) 1.914913695s ago: executing program 4 (id=15028): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}, @call={0x85, 0x0, 0x0, 0xf}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r9], 0x5c}}, 0x40) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x4c}}, 0x884) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r8, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x20, 0x140d, 0x300, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4840}, 0x24000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r11, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x25, 0x0, 0xd4}, {0x28, 0x0, 0x81, 0x1}]}) sendmsg$netlink(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)}, 0x24040080) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001fc0)={0x1c, 0x55, 0x1, 0x70bd27, 0x0, {0x7}, [@nested={0x8, 0x15a, 0x0, 0x1, [@nested={0x4, 0x1}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8084}, 0x0) 1.792276298s ago: executing program 1 (id=15030): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x2, 0x3e0, 0x1f8, 0x2f8, 0x1f8, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'vxcan1\x00', 'nr0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac, @broadcast}}}, {{@arp={@remote, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg\x00', 'vcan0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "dcbc4f0fcafe5fd600342efa7968d220b64d039e8a81d171eeb2e9630554"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) (async) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000001000)=@mangle={'mangle\x00', 0x44, 0x6, 0x390, 0x1c8, 0x260, 0x98, 0x0, 0x130, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x6, 0x0, {[{{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@loopback, @local, 0x0, 0x0, 'wg2\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x4}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1d, 0x6, 0x8001}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0xfc}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000300)={'wpan0\x00', 0x0}) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x0, 0x300) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYRESOCT=r5, @ANYRES16=r2, @ANYBLOB="01002dbd7000ffdbdf251500000008000300", @ANYRES32=r5, @ANYBLOB="08002a000a0000001c002b8008000100020000"], 0x40}, 0x1, 0x0, 0x0, 0x2004c015}, 0x810) (async) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="20002bbd7000ffdbdf251d00000010002f800c0002000203aaaaaaaaaaaad2efb07f296132e36387141db0227b3fd28b08929dbb841872038acab0c233deb679e7971683af238fbf20466e345cc4dadf515a476b642e20c27e46d4220db4df9d46c371f5d1df41cec0061e29c183bb7db3eaf932c0eca950b893c1c0cbc3407f1531320015863389d9c20556966b634efa5fa4905ec168eab5da2a7e1d742dd7"], 0x24}, 0x1, 0x0, 0x0, 0x11}, 0x4000) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) (async, rerun: 64) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x268, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x23c, 0x4, 0x0, 0x1, [{0x238, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x228, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_INFO={0x214, 0x3, "d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772a8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbaddefdaa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37d651f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa8034b8b3b6680ad138be47652a3e77981187d2921cebfc1639aa280e3d38dba9b1af49ceded79c78a2d656b3a3e946e17e6257def6679f70f11aa01a2d906aecf4dbc7d1a332a8932ed719ce7eecb5450f49a5764f944b3f6b637502ddba609c6e45dcfad1db7c7dda3e2c755ddcf27132985442e9b8df16f96c82e72e3e2491856d0775"}, @NFTA_MATCH_NAME={0x8, 0x1, 'bpf\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x290}}, 0x4048010) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="200000003f008636e9d8000000000000030000000400fd0008000800615e262fb0c84fa7d68b45233649aacc0715f6ca609c54df296eefc553e6cee11cda76044544a8f592ad90d08283c04a76dc8235717c1d89436308274bd6cd2e2cb1881656f5bfcb87127fcb1eb311d2d8e6b087f95bc5534327014b0ae0627a43f646a6b31607"], 0x20}}, 0x4004080) (async) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@ipv6_newaddr={0x48, 0x14, 0x9535393fea6295b5, 0x70bd2b, 0x25dfdbff, {0xa, 0x40, 0x42, 0xc8, r8}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_RT_PRIORITY={0x8, 0x9, 0x8}, @IFA_ADDRESS={0x14, 0x1, @mcast1}]}, 0x48}}, 0x400c0c0) 1.634832589s ago: executing program 0 (id=15001): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0xf, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000680)='GPL\x00', 0x5, 0x2a, &(0x7f0000000780)=""/42, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x70, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2, 0x0, 0x10}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_LABELS={0xc, 0x16, 0x1, 0x0, [0x2, 0x3]}]}, 0x70}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x40, 0x0, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x4211]}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004881}, 0x200088a0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r0, 0x0, 0x25, 0x15, @val=@netkit={@void, @value=r0}}, 0x1c) 1.535668271s ago: executing program 1 (id=15031): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000000900)={0x13c, 0x0, 0x1, 0x201, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x3}, @CTA_TUPLE_ORIG={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2002}, @CTA_TUPLE_ORIG={0xb4, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @private=0xa010102}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @empty}}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r3 = socket$inet(0x2, 0x80001, 0x84) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9f"], 0x0, 0x45, 0x0, 0x1}, 0x28) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x78}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x1}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x84, &(0x7f0000000440)={r5, @in={{0x2, 0x4e21, @empty}}, 0xfffc, 0x86}, &(0x7f0000000500)=0x90) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x80800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r8 = socket$inet6(0xa, 0x80002, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r9, 0x6, 0xd, &(0x7f0000000080)='>', 0x1) setsockopt$inet6_int(r9, 0x29, 0x5, 0x0, 0x0) sendmsg$sock(r8, &(0x7f0000000780)={&(0x7f0000000300)=@in6={0xa, 0x4e26, 0x403, @ipv4={'\x00', '\xff\xff', @remote}, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000000700)=[@mark={{0x10, 0x1, 0x25, 0xfffffffb}}], 0x10}, 0x4c040) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x6}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb8}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0010000000ba8000001201", 0x2e}], 0x1}, 0x0) 1.513978842s ago: executing program 0 (id=15032): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="04000000ffffffffffffaaaaaaaaaaaa8100000086dd60b79a5600442900fe8000000000000000000000000000aaff45"], 0x82) r3 = socket$inet(0x2, 0x3, 0x8) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000010c0)=@raw={'raw\x00', 0x8, 0x3, 0x310, 0x0, 0xe138, 0x198, 0x1c0, 0x198, 0x278, 0x358, 0x358, 0x278, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, '\x00', 'veth0_to_bond\x00', {}, {}, 0x21}, 0x0, 0x158, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0004000000000000000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0xc}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0xfffffffd, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xfffd, 0x0, 0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x370) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x40, 0x1, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0x7}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004800}, 0x20000000) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x1, 0x0) (async) pipe(&(0x7f0000000080)) (async) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffff9, 0x0, 0xfd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async, rerun: 64) splice(r6, 0x0, r7, 0x0, 0x1, 0x4) (async, rerun: 64) recvmmsg$unix(r5, &(0x7f0000002880)=[{{0x0, 0x0, 0x0}}], 0x1, 0xa102, 0x0) write(r5, 0x0, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) 1.43734479s ago: executing program 3 (id=15033): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000007ae6aa5400"], 0xb8}}, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) (async, rerun: 64) r2 = socket(0x10, 0x803, 0x0) (rerun: 64) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x437, 0x0, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x5570b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5, 0x18, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48800}, 0x0) (async, rerun: 64) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a000007080002400000000209000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) (async, rerun: 64) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async, rerun: 64) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f00000002c0)='cgroup.stat\x00', 0x275a, 0xfffe) preadv(r7, &(0x7f00000009c0)=[{&(0x7f0000000300)=""/157, 0x9d}, {&(0x7f00000006c0)=""/150, 0x96}], 0x2, 0x0, 0x0) (async) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="34020000", @ANYRES16=r4, @ANYBLOB="050000000000000000003f00000008000300", @ANYRES32=r5, @ANYBLOB="6c005e80080003000300000008000200a609000008000600c0dc00000800090005000000080007009801000020"], 0x234}}, 0x0) (async) setsockopt$SO_BINDTODEVICE_wg(r2, 0x1, 0x19, &(0x7f0000000340)='wg1\x00', 0x4) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="480400001000100006000000fbdbdf25fc0100000000000000000000000000010a0101010000000000000000000000004e2400014e2000000a00800089000000", @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="0a010102000000000000000000000000000004d53c000000fc0100000000000000000000000000010300000000000000ffffffffffffffff09000000000000000000000000000000000000000000010002000000000000000800000000000000010000000000000000000000000000006d64aa0d00000000040000000000000000000001000000700000000200000026bd70000035000002000206410000000000000014000d000000000000000000000000000000000044010500ac1414aa000000000000000000000000000004d4330000000a00000000000000000000000000000000000000ff340000000103007f0600000000000000000000fe8000000000000000000000000000bb000004d33c00000002000000ac14140d000000000000000000000000003500000400bb002f0000000400000004000000ffffffff000000000000000000000000000004d52b00000002000000e0000001000000000000000000000000003500000001070001000000c9020000750f0000ac1414bb000000000000000000000000000004d62b0000000a00003700ac14142100000000000000000000000003350000060234000fbccd2cdc30000001000000fe8800000000000000000000000000010000ffffffffffffffff00007f000001000000000000000000000000063500000202080007000000080000005a500000b20003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000005003000084dbac810a632d07db8c6d14a40f2954565d2b97d6aec97f7428d746013573cf36440ad0379918c676100f053393e6528fc16624b703bd94946927195ff3a7a2eeccd17282f1006bcfc2a4944996432a39640f83661632551810c9c994f4f2b17bb45789e9ada0fa79e20000100103006c7a6a680000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000000000400600009bad3c20b136fb314109e19bc5705b436f75edd13c3b41d1ae81fb72b57953d64c45411566f3b865f0074359dc1f11de8cc112e59cd8a597ad4c651acab57c3a418f29e7692bc373d56743af8ea6543694d91d35f0223990fcba7ec9d942ecb934cafe04b227d696b7dbf11ebeed19b3cdbb15cb6cb6d14d2a2a9064feacbba5258f02d71916387aa30c528de1f676d291b3a932ef04b42f89b812953ce25804400920dce0606c58b84db98274429dbc593454b278cdae95c96fffa98dad6f51b8e9e24d86ba53091c00040001004e244e220000fe80000000000000000000000000003f050019000500000010000a0025bd700027bd70000400000008001f0003000000f26c98b60841e4b563cad95f1a4edc374c7f9c22beab1260d69962eca1a16e00d3e810115532a015ce57860675f9f0c3d74048c8a4f6d3d67bd09531e0ec7d592203f5feb9ed8ed11cff497e61b2f783b95e0d090b82fbc3b9e8c7a694b2338c7c4a7f4785205c12de1948"], 0x448}}, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_HARDIF(r8, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x44, r9, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffc}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r10}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c000}, 0x40090) (async) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0), &(0x7f0000000400)=0x4) 1.372032191s ago: executing program 2 (id=15034): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000740)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000001fe8000000000000000000000000000bb00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000009a5ab6e10c00000000000000040000000000000000000000000000000000000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008000000000000000001000000000000004400050000000000000000000000000000000000000000003c00000002000000ffffffff0002000000000000000000000600000004"], 0xfc}}, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x5}, 0x1c) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r6, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x3284b164842c97f7, 0x8014) connect$llc(r6, &(0x7f0000000240)={0x1a, 0x33a, 0x3, 0xc, 0x5, 0x7, @local}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r1, @ANYRESOCT=r0, @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.262440643s ago: executing program 3 (id=15035): r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x38, 0x0, &(0x7f0000000080)) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$key(0xf, 0x3, 0x2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000065c0), r3) sendmsg$NLBL_MGMT_C_LISTDEF(r3, &(0x7f0000006700)={0x0, 0x0, &(0x7f00000066c0)={&(0x7f0000006600)={0x14, r4, 0xe25, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x38, r4, 0x8, 0x70bd25, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x8, 0x1, '+*:\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c811}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000004200)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000061182c000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x29, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$key(r2, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x2, 0x0, 0x9, 0xa, 0x0, 0x1, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x8, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @loopback}}]}, 0x50}}, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, "aeb81d8ee3a82d67eea9e5bdf2247481041a5b9cddbc936efc471c56ae3d5f6945d296a285858a891a3b4e7bff572ef69992da867f406182d70f47773434b8349435f2ad628d62a3b45bb98872fb1900"}, 0xd8) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r1, 0x40189429, &(0x7f0000000180)={0x0, 0x679a, 0x8}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b40)=@newsa={0x180, 0x10, 0x1, 0x70bd26, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x4, 0x0, 0x400, 0x40}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffffffffffff}, {0x5680000000}, {0x10, 0x9, 0x2}, 0x0, 0x0, 0x2, 0x3}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}}}, @algo_crypt={0x48, 0x2, {{'ctr(cast6)\x00'}}}]}, 0x180}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000140)=0x90) write$tun(r6, &(0x7f0000000240)=ANY=[@ANYBLOB="e7c8543bcf4c64bd5de303d6"], 0xfdef) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f00000001c0)={0x7, 0x7, 0x4}, &(0x7f0000000280)=0x28) 1.261719092s ago: executing program 1 (id=15036): r0 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x14, 0x80000) getsockopt$packet_buf(r0, 0x107, 0x16, &(0x7f0000000080)=""/140, &(0x7f0000000140)=0x8c) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000300)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8, &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x21, &(0x7f00000003c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0x7d, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) recvfrom$packet(r0, &(0x7f0000000200)=""/225, 0xe1, 0x40000121, &(0x7f0000000600)={0x11, 0xf8, r2, 0x1, 0x0, 0x6, @random="0ec353971e5a"}, 0x14) recvfrom(r0, &(0x7f0000000640)=""/55, 0x37, 0x2, &(0x7f0000000680)=@x25, 0x80) r3 = accept4(r0, &(0x7f0000000700)=@xdp, &(0x7f0000000780)=0x80, 0x80000) sendmsg$NFNL_MSG_ACCT_DEL(r3, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x64, 0x3, 0x7, 0x5, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x7}, @NFACCT_FLAGS={0x8}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0xffffffff}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_FLAGS={0x8}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x1}, @NFACCT_FILTER={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x8080}, 0x24024014) socket$nl_route(0x10, 0x3, 0x0) r4 = accept4(r3, &(0x7f0000000900)=@tipc=@name, &(0x7f0000000980)=0x80, 0x80000) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000a00), r3) sendmsg$TIPC_CMD_GET_NETID(r4, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x1c, r5, 0x100, 0x70bd25, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000004) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r4, 0x28, 0x6, &(0x7f0000000b00), 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r6, &(0x7f0000000cc0)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000b80)={0xc8, 0x15, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_OBJ_USERDATA={0x60, 0x8, "70f2a1400e7e81a7d5c409e9c84a1ec2cb80c83421279f64fa526ecda15dc741d8dcff71a75c7f9874ac0dac3db5c1499d79ec15101bc967bade79dd88abb649d1ca121b3b33fec52c5f6f0556c6d3ec17e426f7d6ba2c538b84342c"}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0xc8}, 0x1, 0x0, 0x0, 0x1}, 0x8004) connect$inet(r4, &(0x7f0000000d00)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3b}}, 0x10) setsockopt$netlink_NETLINK_RX_RING(r3, 0x10e, 0x6, &(0x7f0000000d40)={0x1ff, 0x7, 0x3, 0x3}, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000dc0), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000e00)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r4, &(0x7f0000000f00)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e40)={0x7c, r7, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x40) r9 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000f40)={r1}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000012c0)={r9, 0x0, 0xd6, 0x15, &(0x7f0000000f80)="e44ab74b472c80c0a56a610a68fb449d38b94463bff822fc90da2b2ba50b4b44fa0bfad57783f96a3e90b555287239a54bc6f7839154838e00d2bd93d4e595569f26623bf3f6f05d02e8ce5b4ae5c2789e2a3537f5b1de6e97183b2c186859da07ecfcf2eb6c6e423f1eeb0b35e147511bc5d3a92867d4ef0b880af296b544d481ca0d5d3592bbeecfc54a37438c1a6375c1e74dc04db68ff19b5b6d3b233122664d715b564fcc1f9276504c2602602013f94faddf8cf678a6e366b3e308c653cda497a9204e07dcab433682370674fcd1927d6028a3", &(0x7f0000001080)=""/21, 0xffff6dc5, 0x0, 0xce, 0xda, &(0x7f00000010c0)="c7ac4627335cf7b6e71a56adae26facdf84f7f593035e6a673b12935b95112bdeef20cf255b3890cf99e7bd4a97717ba4d824794918246305fd1ffc98c45c998ec82ddb02b1443c340e64874bac830dcbc68dbe002dc7c5b60deafdc8ca4451319160e35814a6b94f8fab99917a2cf5935346d865ec479d6c46e1836fab752431c8df78432a4718c2d4c1cb04d843fd398ebfb8cafa68d63f5a62263b3792b7beb8ba664790cca3304ad72edf12c3fba7ebc3acffb6e9155cf8732d8dde9ba99a9a3e9a38f90dbb61e5612f15799", &(0x7f00000011c0)="c94d7da84b92f347fb424f29987e91612f8dedb762bdbd4291268961056bead979c77db39e6ecab603a4608ac2dc2575904f247d972618d34b236fd1684af8f2d9a3b4db91c592277cc3f1931cd3ad68ac0fea9db81f881c74eb4397e8ab94733e24d282eb78ef8949892270c931ea3444b381fbbd64e7ee662a4571ed3fd4814c7462cae28ab6bd6efcf9c3791442a7544f724dbc3a1c6acd304511d0b4af745421f0f47b28cedbcfde045162eafbdaf6d9d8e8682c751b61a7d17b5e764a65191ed2b05e4a7cd7724728aa22fbc3cd03298c4205ceff9c9bf1", 0x5, 0x0, 0x6}, 0x50) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r9, 0x8002f515, &(0x7f0000001340)) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r10, &(0x7f0000001480)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001440)={&(0x7f00000013c0)={0x80, 0xd, 0xa, 0x447d63234b0e859a, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x58, 0x3, 0x0, 0x1, [{0x4}, {0x50, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_USERDATA={0xf, 0x6, 0x1, 0x0, "b271e02dbe9ac4116b1a05"}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @lookup={{0xb}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xbb16}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, 0x80}}, 0x8044) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001580)={&(0x7f00000014c0), 0xc, &(0x7f0000001540)={&(0x7f0000001500)={0x30, 0x2, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x10) sendmsg$AUDIT_MAKE_EQUIV(r4, &(0x7f0000001680)={&(0x7f00000015c0), 0xc, &(0x7f0000001640)={&(0x7f0000001600)={0x28, 0x3f7, 0x400, 0x70bd27, 0x25dfdbfd, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001780)={'veth0_vlan\x00', &(0x7f00000016c0)=@ethtool_rx_ntuple={0x35, {0x8, @tcp_ip4_spec={@local, @local, 0x4e20, 0x4e20, 0x7}, @esp_ip4_spec={@loopback, @broadcast, 0x9da, 0x1}, 0x4, 0x7, 0x3, 0x3, 0xffffffffffffffff}}}) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000001f00)={0x0, 0x0, &(0x7f0000001e00)=[{&(0x7f00000017c0)="42dd50d163aedf247d50398454c1ef9305afc6f36bafbaa0104c39c8bd7f22b9d79ad242b801e2c653c9621c6d106cf6791351ac52517b31a38528bf1587f271609d20561978af41a6942c71a9dff95e19aa7a051da60c7c1b31e8a3dbcbfc0f91894f424fbe79b8fda388eb5a7ca8888645c7251b604b43f14a86138d49e08d02fb7e8aabbe1517424ccbf0cd1f48d75453cd7ef2e9215bfeebbedff6b3120c4657008dcf4c26fc85d6c00271a7586d0c532f3d0c23947a03369bb5d15afaa773006d2d6ee94507c787ce249f", 0xcd}, {&(0x7f00000018c0)="5ad6539001abb66d7cf7c8e50b569ada3ebb8c16a53aaeca47c5b54d8110f5cc678f61cf44d2abbcf19689e770b5f2fc6d2e7d61a6d26be7bf9cc211f7457c7a3e220a0e6b28c04b3e8278f24c47097f5047f1c25310900c94619dd5f00cef6348b3dbda3c5450cc2e5ccf849bd095871119e44381d84ad6d72b68db3bc05bfe59e708dd5c9a4024e96556c5e479f315093968c113aeccbbfcc4664b50a95ffff829addce5f23fc02fa1200f0ec7d24c1102ade45c9982d5ae4c79209fd4640bc1194075ed7802df612940ed7b303f30d8452ecc361e92058767aa1f0ed4ff8a8bd4f74ab1655ad509486361dc1b2a4cd14773b593763cf698ea4dc933b78a", 0xff}, {&(0x7f00000019c0)="61c6296859e2756ed816fb30dc93abdd046fae331d5f268eeedf5c26b496a4bf0adbc21646637e6987934aa284fad08566d988feb34300edf1cb98f2cde454bc31ed8e739813fa3bf7630399a1648449dd3ea8d0394f5fa41a93f20f7da139a507c51fe2425e17e970acb4ab82e806def906bdb0b81e6a33d2a05d1ed87b2cf095daaae6ae66ad", 0x87}, {&(0x7f0000001a80)="62038e9ddba9b96c8b3cbfbd7423eaaa87d30df9c5d02cd470cd4fdd07368c23cb72623699ca6c65ddc7b8938a91be8e207abd4c6062afff36d7cb265bd70b8fa79246c5a8e16f59ed9dbaa8738d9aeacc758f58da534b4b73439aae376f0a85ea0be391", 0x64}, {&(0x7f0000001b00)="46092b1d58789134bedd85a4b191986c8e16deb92d41", 0x16}, {&(0x7f0000001b40)}, {&(0x7f0000001b80)="8d7446120c853e809b2f405fa536440731e6785bf759d08f1b4be46de4936e32fbeea44dd928e812cc3a3f6cf93aa20f914d00c373fd1c78b6799ca3c225929941e5c1ea", 0x44}, {&(0x7f0000001c00)="7b609ac85f9714ed98fc3bd7dadfe95e3db646278926ea8ce9bb5cc6bbacffcdac8a24cc37f2bda978e97868ad3dd8686caab4f41a43554f1a46a9a9513cad15ce6d027027d0a9de7dcdc0e5b824944b87fe40ec1636f190535e40b69380e500dae33fa50b7d2fbbd6abea74a5a8b92e94e7ef5a16595eb602cf6544a630d880aea351c4b2474f03909facb1beccf42dc1a30ec9537f64c08a989243155ffa40fe97729dbb5b2e490adcbac0b6fc3948ec4dfa99a14286b0d1b5b33e7dc92899b36779ba3e9daf771f05a6b4bb0085881de1c570", 0xd4}, {&(0x7f0000001d00)="7574e07715459215ecd61683f6047cb992f8bdcfe5effe3f82be1c149ea0491565efe0d8c1b656e9391311a0c765d77ab00c61c84688130830b7f0ce73de5ac7f08143d94047891207be63443406e64c9e238e7b67a17ec346312bf4ab5f829441a4486fdf41353c8bac6d98a5c0b33522346e02da97e0af4528c8a8fad32a694b4301179e2460f4cd9be6a25b8008466f328c03487bb262275ff1cdaf52bf28b2a3dd89e37b6358724cfe1ac1fa737737312fbffb1f501786e75bb92a28144bdda06b49651d4a08b3eb35c7f874da5272b94f68be17", 0xd6}], 0x9, &(0x7f0000001ec0)=[@txtime={{0x18}}, @mark={{0x14, 0x1, 0x24, 0x3}}], 0x30}, 0x55) 1.154741415s ago: executing program 2 (id=15038): mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000002, 0x42073, 0xffffffffffffffff, 0xaba00000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000b40)=@newlink={0x38, 0x10, 0xffffff1f, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0x782e}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8, 0x4, 0x2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x800) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000300)=ANY=[@ANYRES32=r0, @ANYRES32, @ANYBLOB="02"], 0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x4001, 0x3, 0x438, 0x0, 0x700001b, 0x148, 0x0, 0x148, 0x3a0, 0x206, 0x240, 0x3a0, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0x2c8, 0x2f0, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0x3}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00', {0x1000}}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x5, 0xff, {0x9184}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x498) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1b, &(0x7f0000000080)=0x10000, 0x4) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6001010000641100fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e200e220064907802006dd80100000004001000628e0960f6d6d3f6ee6d6b84b345dccac643e7df3e526ff07833b291322d4a74882ed6741e7632daeaec0c95f2ad129beed06de9271c8e4ea8b5ec7448ddd6a3215990e1b896120966af96b22cf049f0"], 0x0) 1.110485402s ago: executing program 4 (id=15039): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010010c"], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x16) sendmmsg(r1, &(0x7f0000000000), 0x400000000000235, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)) socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r3) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x4}, {&(0x7f0000000300)='l3', 0x7fffef80}, {&(0x7f0000000780)="5b06c70461fab92b3d952a0a0b5eca7d6b21f62c4f56ea9109a00b742eab4a7fdac90ab7c51a813cc4d693127d10c4e7234944e9410ad19c43ca9751c1b97aca344e5bf77fde23184af0b7e160e7a9a681f6391270dedc2978f7d1b9a913801beaa52e1eedf0ae71021e0d40864fc63603f1d6d94f55d23fb15eebc780292ee4be48a9036dcb83345a4285e043439e95b3f23b6edf199cea092725d6f7fab0f975cc42bd279f5de21d08a38091edbb34b32c6cd53373651fd3343aa6b228a996d957c556694dc3a26b68b38093a92eb192aa973bda1b51c61b6cc2b49a54550085e8d8270d889cefe65f62c975815b1b1208ed"}], 0x3f}], 0x1, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="200027bd7000fc16c93d5f43dd52b952b13e75d23a1015732c50c38c55b2", @ANYRES32=0x0, @ANYBLOB="0c00990000000000720000"], 0x28}, 0x1, 0x0, 0x0, 0x20040080}, 0x8004) accept4$llc(r5, 0x0, 0x0, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r6, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x9, 0x30, 0x66, 0x0, 0x4, 0x1, 0x0, @rand_addr=0x64010101, @local}, @redirect={0x5, 0x3, 0x0, @private=0xa010101, {0x5, 0x4, 0x1, 0x8, 0x1, 0x65, 0x401, 0x8, 0x1, 0x0, @rand_addr=0x64010102, @multicast1}}}}}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r5) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) 1.038057918s ago: executing program 0 (id=15040): socket$inet_udp(0x2, 0x2, 0x0) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000180)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)={0x2004}) close(0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYRES32], 0x114}], 0x1, 0x0, 0x5a}, 0x24044010) recvmmsg(r4, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0}, 0x7fffffff}, {{&(0x7f0000000300)=@qipcrtr, 0x80, &(0x7f0000000100), 0x0, &(0x7f0000000440)=""/138, 0x8a}, 0x101}], 0x2, 0x14022, 0x0) r5 = syz_open_procfs$namespace(0x0, &(0x7f00000002c0)='ns/time_for_children\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0xa873, r5, 0x767e4000) r6 = socket(0x27, 0x6, 0x2) getpeername$packet(r6, 0x0, &(0x7f0000000240)=0x2e) socket$kcm(0x2, 0x2, 0x84) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_extract_tcp_res(&(0x7f00000000c0)={0x41424344}, 0xfffffff7, 0x2) r12 = socket$unix(0x1, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r12, 0x1, 0x1d, &(0x7f0000000080)=0x7, 0x4) close(0x3) r13 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004200)={&(0x7f0000000640)=ANY=[@ANYBLOB="39149f2d5f0001002abd7000fbdbdf2518000000c51ae849a0fa35c13ad62cdcf167bd6aa490bacdb09be910e12517356af0aeafa46b04fa4be4311ee3ba2aab7fec8a839b2ba0139065bf88bfee1f4f9dae1171b78c442255b112e43732d274cf2bea4846251956cdc9e1228d1939b397d04d9b92fb322236ce07a87d653e420245dee945e4295f905fa9683cf9815d4bb3d1258e6d141d0d55a76727ec259e375c142f8f20c42a6031bb5f3a817743ee40b9b9461336f6d57844433f8f9d7fd3fdec7d2388a29df3e2ab1524489ab7494a1aa09dd8dcf74ceabc7a31a8e9469cf328564e1b54c5c5c878ef756054437bd07c9f9f0a4d3fa66d9ae69fda87d3a78021f4fbed1830d8c639308cb39380b5f5232cff8f70bc1ef41ad1d73e3cd35ff494db6ccda1e232bc54012bf92aaf14d5442485224a3eb9f191d4348cd4d94104febd24407e57661c5b28bf511872033cb00d4d3a3b96f831d2ae55469c056d38e49fe7ae7000"], 0x14}}, 0x0) write$tun(r10, &(0x7f0000000500)=ANY=[@ANYBLOB="000314b90600ea000d00430b069078ac141430e0000001940401000101440c0a91ac14143b0000000914bb00000000440c157010009404000000004e244e21000000000000679321fda0981b6198203349e7589367cf2cde22593f84581909dff81f1684f801727105c26859a7c782d257e5d249063b8b1cac54f652d9e6e0e5cdbfc5cf5a2eceea328bdfb99121d218303ef05eebf19610ef0666a7c549c077102a06f225fe5414c4020052cdf92be8ec58f3c2438ca7c53db71a4e422104f8bf4227d3efada0dd372ec8c12ee7f9921216c29eb2c2041044fdaf601a74af64e9b3fb38fa513b55df449d0136", @ANYRES32=0x41424344, @ANYRES32=r11, @ANYBLOB="e0400cf6907800040402fe06e2d4c3d9080a0000000500000009fe10f9894cfb2f6c73b4e695729e889c0000f58d326dbc996ab62106a6c10b8f3e34"], 0x9e) sendmsg$NL80211_CMD_SET_CQM(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32=r8, @ANYBLOB="41809630edca9b8dc2cb21468710ef4c22464c0c000000ca0ac319feacea"], 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) 903.217859ms ago: executing program 2 (id=15041): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000540)=ANY=[@ANYBLOB="185b00000c00000000000000000080000000000000000000000000000000000018120000e365e0d1ee50581dac", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000183100000100"/48], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x6) listen(r3, 0x2) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket(0x10, 0x803, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r6) getsockname$packet(0xffffffffffffffff, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) connect$netlink(r6, &(0x7f0000000400)=@unspec, 0xc) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="380000001000370400"/20, @ANYRES32=r7, @ANYBLOB="190803000000000018001f800e00010077697265677561726400000004000280b97465845dd2c8169cdd95dd099b1613169317555e7c035782ab83860a8371c51da6253830e7482f5e590b3211a4fdb41d4e554ca2cb2e2a52868164fd80e574b8c2c1bf684c03f2cf6a05656b9fec5b5f6c7d9d8509acf90778140f6c9f7168ad81e22182541416ab7c1d8e9871f4618a6487ecafa812235fbc62f04198b97e88a318f06072f43eb8b6370691b0c372b722711758e9951892e62d43575c9c4ceb6e82d11f21e549a842396265e0e93a17095675aeaf1d186dc2eb268f402b50634ace3a0d4e45fea1e2c0af4afdf6"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg$inet(r4, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) r8 = socket(0x10, 0x803, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000280)={0x41424344, 0x41424344}, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e000000a1f9d51b8c1eae1a0100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r10 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000780)=@base={0xa, 0x16, 0x800, 0x7f}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000013c0)={r10, 0x0, 0xfffffffffffffffc}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f00000003c0)={{r10}, &(0x7f0000000340), 0x0}, 0x20) syz_extract_tcp_res$synack(&(0x7f00000002c0)={0x41424344, 0x41424344}, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000140)=[@in6={0xa, 0x4e22, 0x0, @private0, 0x800007fb}, @in6={0xa, 0xe22, 0x2, @remote, 0xf6}], 0x38) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={0xfffffffffffffffc}, 0x1, 0x0, 0x0, 0x40c8084}, 0x0) syz_emit_ethernet(0x185, &(0x7f0000000dc0)=ANY=[@ANYBLOB="e10931d8640a00000000000086dd68490b7d014f06fefe8000000000000000000000000000192001000000000000000000000000000087140000000000000710000000030200ff0f0200000000000000072800000000080100000800000000000000000001000000000005000000000000000200000000000000075418a33ad8d93d03de723bcca05af653deb4252d43f8bebe376fcf19f3eb71367913e8d59506f1a79641e361ed8f2d292a585be7dc98245c03cf5a889f40d418831520dbb0cabfb2e6fbf884ab76eccd8f8ec2bee7320a6ec3d7a2311dc910fe8000000000000000000000000000aa041102002f0005c0480000004e214e20", @ANYRES32=r9, @ANYRES32=r11, @ANYBLOB="d0c2010090780008fe05f9896e080a00010001fffffffe080a0000007f000000050204a719fe9ab61a3ad58d2e26b353d20514fb7a768ad61bc56262dc80c0b5b09e369093357c4adf1f3ed5a5255bdf0ce3be3db1355b5d47f8ddea5f6ad3145181323e569d572762078b62cc9ecafee83debd4bea494e3346db718b0c2825a8c528bc91a3e30c52c948ea239e3bcd68dfe9a87e14c9ee7002fdc8be4f2fc8367579665624b3e4b8c284a184bbf64bf9747e01b164e2ff7612eb17ca4e7000000000000000000000000000000391972faceeeb80903b0cd6fdf8869fab2b5584e3daf9d3b802fae5560901916426d8db6a30e03186de7d3b27a8a48b5e2ed334ccb1bc84c0d8cf379c01716112ccde179958bf70115495c546f8090d0de77aa8fe18f4b1e53f7f48c360fabb6f25ffb3709e9a6aeba6eb736ff6af309a417d39865281acb9d5411957f4b7f6db7d46e0193470d6f8fc591dc945e7a76da9d34d8762c962597b74d"], 0x0) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r12, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000002200010000007000fedbdf25b8d634fcc4adc23ef8cc14c9"], 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x20000080) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x5d, 0x4}, 0x6) 892.142795ms ago: executing program 3 (id=15042): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000851000000200000085007dff3f000000950000000000000095"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x400, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x8001) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a0000", 0xe, 0xc0841, &(0x7f00000001c0)={0x11, 0x1c, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1d, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000c100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lsm, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r5 = socket$kcm(0x10, 0x2, 0x0) close(r5) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848160000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x80054) 551.304872ms ago: executing program 3 (id=15043): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000340)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404}], [@TCA_POLICE_RATE={0x404}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x8}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) 474.415974ms ago: executing program 3 (id=15044): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) close(r2) r4 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffd, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000080)=0x4, 0x4) syz_emit_ethernet(0x5e, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'pimreg0\x00'}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x40800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r8, 0x117, 0x5, 0x0, 0xf5ca) setsockopt$inet_tcp_int(r7, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r7, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r7, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)="5338a3848b25e258a25f9dae13edecbd5949e59be176d3787678", 0x1a}], 0x1}}], 0x1, 0x20008000) recvmsg(r7, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000200)=""/112, 0x70}, {0x0}], 0x2}, 0x123) shutdown(r7, 0x1) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x50}}, 0x20000000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0xb, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x40001, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0xa4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4e}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000002c0), r9) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r9, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000000000047400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a7330000800020000000000080007002609090914000600626f6e64300000000000000000000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x0) write(r0, 0x0, 0x0) 473.773865ms ago: executing program 2 (id=15045): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000480), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002dc0)=ANY=[@ANYBLOB="7c010000", @ANYRES16=r1, @ANYBLOB="07020000000000000000020000002c01088044b3078008000600b300000008000500ff00000008000600e10000000800050040ef116808000600cd00000008000600af00000008000500f712f706080006009600000034000780080006003c00004f08000500e2f05c100800050012c61f100800060066000000080005007118862e08000600fd0000001c00078008000500a156eb25080005000b608179080006007f0000003c000780080006009100000008000500a06e96730800060094000000080005004baa1d3f0800050038560852080005009889fe5708000600180000004400078008000600570000000800060059000000080006005a0000000800060097000000080006008300000008000500b252a030080006005000000008000600410000001400078008000500d9a9bc2c0800050075190a492c00048005000300010000000500030000000000050003000100000005000300000000000500030001000000080001"], 0x17c}, 0x1, 0x0, 0x0, 0x20008000}, 0x40480d4) r2 = socket$netlink(0x10, 0x3, 0x13) syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="010029bd7000ffdbdf250f000000140007800800020000000100080004"], 0x2c}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) 379.188727ms ago: executing program 4 (id=15046): socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 32) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 32) close(0x4) (async, rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001800dd8d000000ba7e9698ed1fbfa80e000000000002"], 0x3c}}, 0x0) (async, rerun: 32) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x27}, 0x62) (async) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000440)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000480)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000004c0)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x3c, 0x0, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x4048045) bind$bt_hci(r2, &(0x7f0000000000)={0x27}, 0x74) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000fc0)={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) (async, rerun: 32) unshare(0x2020400) (rerun: 32) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$netrom_NETROM_T4(r7, 0x103, 0x4, 0x0, &(0x7f00000000c0)) (async) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 32) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$IPCTNL_MSG_CT_GET(r9, 0x0, 0x0) (async) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) (async) listen(r8, 0x0) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r10, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r11 = accept(r8, 0x0, 0x0) recvmsg$qrtr(r11, &(0x7f0000000700)={&(0x7f00000000c0), 0xc, &(0x7f0000000680)=[{&(0x7f0000000140)=""/153, 0x99}, {&(0x7f0000000240)=""/201, 0xc9}, {&(0x7f0000000340)=""/193, 0xc1}, {&(0x7f0000000500)=""/103, 0x67}, {0x0}], 0x5, &(0x7f0000003240)=[{0x70, 0x0, 0x0, ""/96}, {0x1010, 0x0, 0x0, ""/4096}, {0xa8, 0x0, 0x0, ""/149}, {0xa0, 0x0, 0x0, ""/144}], 0x11c8, 0x10040}, 0x38, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r10) 219.397249ms ago: executing program 4 (id=15047): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a090400000000000000000200000040000480100001800c0001006e6f747261636b002c0001800e000100696d6d656469617465000000180002800c00028005000100c402000008000140000000080900010073797a30000000000900020073797a320000000014000000110001"], 0x94}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="140900001000010000000000000000000300000a20000000080a01010000000000000000020000090900010073797a300000000014000000050a0000000000000000e7ff02000008140000001100010000000000000000000700000a"], 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x8084) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000140000001c0007800c00030005000000faffffff0b000400"], 0x30}}, 0x80080) socket$inet6_sctp(0xa, 0x1, 0x84) 218.029624ms ago: executing program 2 (id=15048): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="b4000000000000007910000000000000c300e4ff50000000950074000000000007cd68541c8ecf9531b5304b5cc21956f2bc86279e6ad8df17d9770ecf3cf86fc3e24813c30a62be8343fd64d83b7a67d4fe75024d408c8c6efad5de675dd7c2fd4bc5150ac10908d8ed5d462d8b3d226984e301c5303515a91caae004c5b15d99b0603e513689df039b1b3be2397b3e4ceded9089bc2e15d40b2051974e6b2478ae72cf47bee3a056433e3c9ec50f965cb28a3e9ed5f403cb7753bb80134316c458ef5fc56add28eb81da659d42e1efe216f3f7fe157783ba79e1b2d5f2212e804de42b27f23214bebff612b6287d969b02d2f8c9fa6eb8da5fb47c68478a3972a3760cab8ed724a951c4e98eb2fcf27e92142b602215c964"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195}, 0x48) socket$netlink(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x87) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000000)=@newsa={0xf8, 0x10, 0x1, 0x70bd28, 0x25dfdbff, {{@in=@remote, @in=@loopback, 0x4e23, 0x0, 0x2000, 0x8000, 0x0, 0x20, 0x0, 0xc}, {@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x20, 0x6c}, @in6=@dev={0xfe, 0x80, '\x00', 0x23}, {0xfffffffffffffffe, 0x0, 0x0, 0x800000000000001, 0x10000000002c8, 0x6, 0x4000000000000}, {0x1fffffffffff, 0x8, 0x0, 0x1000000004}, {0x0, 0x5}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x1}, [@XFRMA_SET_MARK={0x8, 0x1d, 0x400}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4075}, 0x4800) socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x24004000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000080), &(0x7f0000000240)=r4}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000b80)={r4, r6, 0x25, 0x4, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x45bb}}, 0x30) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) epoll_create(0x1) 79.787825ms ago: executing program 2 (id=15049): r0 = socket$rxrpc(0x21, 0x2, 0xa) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$SIOCNRDECOBS(r1, 0x89e2) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x6, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000000)={0x3, &(0x7f0000000500)=[{0x28, 0x5, 0x0, 0xfffff034}, {0x50, 0x8, 0x0, 0x100}, {0x6, 0x9, 0x0, 0x10001}]}, 0x10) syz_emit_ethernet(0x7a, &(0x7f00000003c0)={@local, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "92c01f", 0x44, 0x2f, 0x0, @remote, @loopback={0x57}, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57}}}}}}}, 0x0) bind$rxrpc(r0, &(0x7f00000005c0)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x80, @broadcast}}, 0x24) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000000c0)={'wg0\x00', 0x0}) bind$packet(r2, &(0x7f0000000180)={0x11, 0x2, r4, 0x1, 0xd4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}}, 0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x88, 0x30, 0xb, 0x5, 0x0, {}, [{0x74, 0x1, [@m_ct={0x70, 0x1, 0x0, 0x0, {{0x7}, {0x48, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x2a, 0x1, {0x80000001, 0x1, 0x0, 0x4, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @local}, @TCA_CT_NAT_PORT_MIN={0x6, 0xd, 0x4e24}, @TCA_CT_NAT_PORT_MAX={0x6, 0xe, 0x4e22}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0xf646d5f7286d7fdb}, 0x40) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e1209002100ff000401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6dcd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x20044094) 72.946866ms ago: executing program 0 (id=15050): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00'}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = socket(0x10, 0x3, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x6c}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r3, @ANYBLOB="1400010000400000000000000000000000000000140002"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r4, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x3, &(0x7f0000000200)=0x860, 0x45) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711207000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 3.285082ms ago: executing program 4 (id=15051): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x0, 0x2, 0x9, 0x64, 0x4f, 0x4, 0x0, 0xa, 0x2a, 0xb, 0x3, 0x9, 0x75, 0x8}, 0xe) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x18, 0x0, &(0x7f0000000300)) r2 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x14, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b}, [@printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x80}, {0x85, 0x0, 0x0, 0x2d}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r3}, 0xc) 0s ago: executing program 3 (id=15052): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x17c, 0x19, 0x1, 0x70bd26, 0x25dfdbfe, {{@in=@multicast2, @in=@rand_addr=0x64010100, 0x0, 0x6, 0x0, 0x0, 0xa, 0x0, 0x0, 0x3c}, {0x0, 0x4, 0x1000000, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x10}, {0x6, 0x1000000c99, 0x800, 0x2dd}, 0x0, 0x0, 0x0, 0x1, 0x1, 0x2}, [@tmpl={0xc4, 0x5, [{{@in=@local, 0x4d3, 0x2b}, 0x0, @in6=@remote, 0x0, 0x0, 0x0, 0xff, 0x7}, {{@in6=@local, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, {{@in6=@remote, 0x0, 0x3c}, 0x2, @in=@private=0xa010101, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x278b6a28}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x24008004}, 0x40044) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x64, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x38, 0x3, 0x0, 0x1, [{0x3, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPIRATION={0x54, 0x5, 0x1, 0x0, 0x49}, @NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @objref={{0xb}, @void}}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7f6}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xd0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) kernel console output (not intermixed with test programs): with an inconsistent configuration, please check. [ 1496.880166][T26931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13638'. [ 1496.934671][T26921] tipc: Enabling of bearer rejected, failed to enable media [ 1497.163937][T26947] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13647'. [ 1497.353686][T26957] bridge0: entered promiscuous mode [ 1497.361448][T26957] bridge0: entered allmulticast mode [ 1497.368527][T26948] lo speed is unknown, defaulting to 1000 [ 1497.461556][T26970] netlink: 'syz.3.13650': attribute type 1 has an invalid length. [ 1497.894326][T26948] ªªªªª9 speed is unknown, defaulting to 1000 [ 1497.955612][T26986] lo speed is unknown, defaulting to 1000 [ 1498.045403][T26991] lec:lec_start_xmit: lec0:No lecd attached [ 1498.289061][T26994] lo speed is unknown, defaulting to 1000 [ 1498.625890][T26986] ªªªªª9 speed is unknown, defaulting to 1000 [ 1498.629395][T26948] ªªªªª9 speed is unknown, defaulting to 1000 [ 1499.155240][T26994] ªªªªª9 speed is unknown, defaulting to 1000 [ 1499.353756][T26986] ªªªªª9 speed is unknown, defaulting to 1000 [ 1499.416140][T26994] ªªªªª9 speed is unknown, defaulting to 1000 [ 1499.515110][T27044] __nla_validate_parse: 3 callbacks suppressed [ 1499.515129][T27044] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13669'. [ 1499.819047][T27045] udevd[27045]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1499.898287][T26648] udevd[26648]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1499.919048][T26648] udevd[26648]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1499.932917][T26648] udevd[26648]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1500.859608][T27076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13677'. [ 1500.998415][T27078] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1501.063385][T27078] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1501.084230][T27078] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 1501.234794][T27096] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13684'. [ 1501.270567][T27098] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13685'. [ 1501.317825][T27100] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13686'. [ 1501.399624][T27106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1501.435349][T27108] lo speed is unknown, defaulting to 1000 [ 1501.685786][T27108] ªªªªª9 speed is unknown, defaulting to 1000 [ 1501.871789][T27135] x_tables: duplicate entry at hook 2 [ 1502.079570][T27108] ªªªªª9 speed is unknown, defaulting to 1000 [ 1502.483067][T27159] netem: change failed [ 1502.613012][T27161] lo speed is unknown, defaulting to 1000 [ 1502.789732][T27171] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13708'. [ 1502.864882][T27175] tipc: Enabling of bearer rejected, already enabled [ 1502.903255][T27174] tipc: Enabling of bearer rejected, already enabled [ 1503.115416][T27161] ªªªªª9 speed is unknown, defaulting to 1000 [ 1503.136074][T27186] lo speed is unknown, defaulting to 1000 [ 1503.346208][T27190] netlink: 'syz.0.13714': attribute type 58 has an invalid length. [ 1503.359195][T27190] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13714'. [ 1503.371894][T27161] ªªªªª9 speed is unknown, defaulting to 1000 [ 1503.455150][T27186] ªªªªª9 speed is unknown, defaulting to 1000 [ 1503.511193][T27195] netlink: 40 bytes leftover after parsing attributes in process `syz.0.13715'. [ 1503.730808][T27199] pim6reg1: entered allmulticast mode [ 1503.747723][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5700 ms [ 1503.755784][ C1] lec:lec_tx_timeout: lec0 [ 1503.760604][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1503.801171][T27186] ªªªªª9 speed is unknown, defaulting to 1000 [ 1504.153022][T27211] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13719'. [ 1504.303657][T27216] netlink: 20 bytes leftover after parsing attributes in process `syz.4.13721'. [ 1504.367469][T27220] netlink: 'syz.0.13722': attribute type 1 has an invalid length. [ 1505.168159][T27220] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 1505.770461][T27238] lo speed is unknown, defaulting to 1000 [ 1505.981405][T27264] __nla_validate_parse: 1 callbacks suppressed [ 1505.981426][T27264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13733'. [ 1506.426376][T27238] ªªªªª9 speed is unknown, defaulting to 1000 [ 1506.433215][T27265] lo speed is unknown, defaulting to 1000 [ 1506.587266][T27277] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13736'. [ 1506.879367][T27264] lo speed is unknown, defaulting to 1000 [ 1507.009438][T27265] ªªªªª9 speed is unknown, defaulting to 1000 [ 1507.016353][T27238] ªªªªª9 speed is unknown, defaulting to 1000 [ 1507.237797][T27293] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13743'. [ 1507.239149][T27297] 8021q: VLANs not supported on nlmon0 [ 1507.715172][T27264] ªªªªª9 speed is unknown, defaulting to 1000 [ 1507.953660][ T5826] block nbd15: Receive control failed (result -32) [ 1508.042595][T27264] ªªªªª9 speed is unknown, defaulting to 1000 [ 1508.178640][T27265] ªªªªª9 speed is unknown, defaulting to 1000 [ 1508.243665][T27325] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13751'. [ 1508.258881][T27326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13750'. [ 1508.767433][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1508.775508][ C1] lec:lec_tx_timeout: lec0 [ 1508.864802][T27345] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13758'. [ 1509.026321][T27355] netlink: 228 bytes leftover after parsing attributes in process `syz.2.13762'. [ 1509.043918][T27351] netlink: 'syz.4.13758': attribute type 21 has an invalid length. [ 1509.486616][T27377] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13765'. [ 1509.508343][T27373] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13765'. [ 1509.554721][T27384] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13765'. [ 1509.732300][T27389] netlink: 'syz.4.13769': attribute type 1 has an invalid length. [ 1509.741876][T27394] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1509.762721][T27394] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1509.804231][T27394] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1510.155445][T27415] sctp: [Deprecated]: syz.1.13776 (pid 27415) Use of int in max_burst socket option deprecated. [ 1510.155445][T27415] Use struct sctp_assoc_value instead [ 1510.182182][ T798] syzkaller1: tun_net_xmit 90 [ 1510.228277][T27412] syzkaller0: entered promiscuous mode [ 1510.233811][T27412] syzkaller0: entered allmulticast mode [ 1510.679356][T27444] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1510.837351][ T798] IPVS: starting estimator thread 0... [ 1510.844418][T27452] IPVS: ip_vs_add_dest(): server weight less than zero [ 1510.928581][T27453] IPVS: using max 27 ests per chain, 64800 per kthread [ 1511.398589][T27494] netlink: 'syz.4.13798': attribute type 58 has an invalid length. [ 1511.453371][T27505] Cannot find add_set index 2 as target [ 1511.492565][T27505] tipc: Enabling of bearer rejected, already enabled [ 1511.541091][T27507] netlink: 'syz.1.13802': attribute type 10 has an invalid length. [ 1511.555934][T27507] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 1511.565965][T27507] team0: Failed to send options change via netlink (err -105) [ 1511.573990][T27507] team0: Port device dummy0 added [ 1511.585706][T27507] netlink: 'syz.1.13802': attribute type 10 has an invalid length. [ 1511.638076][T27514] __nla_validate_parse: 4 callbacks suppressed [ 1511.638094][T27514] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13804'. [ 1511.670351][T27514] netlink: 'syz.3.13804': attribute type 1 has an invalid length. [ 1511.708795][T27512] gtp0: entered promiscuous mode [ 1511.715299][T27507] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 1511.725545][T27512] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13804'. [ 1511.738072][T27507] team0: Failed to send options change via netlink (err -105) [ 1511.746710][T27507] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 1511.756693][T27507] team0: Port device dummy0 removed [ 1511.769287][T27507] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1511.875582][T27520] netlink: 'syz.0.13806': attribute type 33 has an invalid length. [ 1511.884202][T27520] netlink: 152 bytes leftover after parsing attributes in process `syz.0.13806'. [ 1511.914638][T27518] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13805'. [ 1511.987576][T27524] netlink: 48 bytes leftover after parsing attributes in process `syz.1.13808'. [ 1512.072503][T27524] lo speed is unknown, defaulting to 1000 [ 1512.390136][T27548] netlink: 'syz.2.13815': attribute type 14 has an invalid length. [ 1512.419747][T27535] lo speed is unknown, defaulting to 1000 [ 1512.420894][T27524] ªªªªª9 speed is unknown, defaulting to 1000 [ 1512.437808][T27549] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13812'. [ 1512.447056][T27549] openvswitch: netlink: Flow key attr not present in new flow. [ 1512.637890][T27558] netlink: 'syz.4.13819': attribute type 2 has an invalid length. [ 1512.941226][T27524] ªªªªª9 speed is unknown, defaulting to 1000 [ 1512.981756][T27535] ªªªªª9 speed is unknown, defaulting to 1000 [ 1513.187973][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1513.413305][T27535] ªªªªª9 speed is unknown, defaulting to 1000 [ 1513.543088][T27599] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13831'. [ 1513.837567][T27606] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13832'. [ 1513.846716][T27606] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1513.853981][T27606] IPv6: NLM_F_CREATE should be set when creating new route [ 1513.861238][T27606] IPv6: NLM_F_CREATE should be set when creating new route [ 1513.901236][T27606] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13832'. [ 1513.939186][T27606] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1514.114489][T27613] delete_channel: no stack [ 1514.190620][T27615] netlink: 'syz.4.13837': attribute type 10 has an invalid length. [ 1514.200860][T27615] netlink: 228 bytes leftover after parsing attributes in process `syz.4.13837'. [ 1514.442007][T27621] lo speed is unknown, defaulting to 1000 [ 1515.365616][T27620] lo speed is unknown, defaulting to 1000 [ 1515.438769][T27621] ªªªªª9 speed is unknown, defaulting to 1000 [ 1515.705523][T27689] bond0: Caught tx_queue_len zero misconfig [ 1515.995117][T27621] ªªªªª9 speed is unknown, defaulting to 1000 [ 1516.181404][T27667] lo speed is unknown, defaulting to 1000 [ 1516.181418][T27620] ªªªªª9 speed is unknown, defaulting to 1000 [ 1516.512004][T27691] lo speed is unknown, defaulting to 1000 [ 1516.558549][T27718] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1516.697165][T27691] ªªªªª9 speed is unknown, defaulting to 1000 [ 1516.749761][T27723] __nla_validate_parse: 1 callbacks suppressed [ 1516.749778][T27723] netlink: 20 bytes leftover after parsing attributes in process `syz.1.13861'. [ 1516.771650][T27723] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13861'. [ 1516.962010][T27620] ªªªªª9 speed is unknown, defaulting to 1000 [ 1516.982248][T27667] ªªªªª9 speed is unknown, defaulting to 1000 [ 1516.994566][T27691] ªªªªª9 speed is unknown, defaulting to 1000 [ 1517.028217][T27737] dvmrp0: entered allmulticast mode [ 1517.443720][T27667] ªªªªª9 speed is unknown, defaulting to 1000 [ 1517.770765][T27756] netlink: 36 bytes leftover after parsing attributes in process `syz.3.13872'. [ 1517.940669][T27759] netlink: 'syz.1.13873': attribute type 1 has an invalid length. [ 1517.967164][T27759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13873'. [ 1517.992961][T27759] netlink: 364 bytes leftover after parsing attributes in process `syz.1.13873'. [ 1518.008498][T27759] netlink: 88 bytes leftover after parsing attributes in process `syz.1.13873'. [ 1518.017901][T27759] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13873'. [ 1518.081265][ T79] IPVS: starting estimator thread 0... [ 1518.175884][T27768] 8021q: VLANs not supported on ip6tnl0 [ 1518.181544][T27766] IPVS: using max 29 ests per chain, 69600 per kthread [ 1518.254677][T27768] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13875'. [ 1518.581054][T27781] netlink: 68 bytes leftover after parsing attributes in process `syz.1.13880'. [ 1518.592975][T27781] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13880'. [ 1518.717933][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5530 ms [ 1518.725964][ C1] lec:lec_tx_timeout: lec0 [ 1518.731085][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1519.899613][T27850] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1519.931511][ T30] audit: type=1107 audit(1770417210.532:27): pid=27849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 1520.014421][T27845] gretap1: entered promiscuous mode [ 1520.051962][T27858] xt_hashlimit: size too large, truncated to 1048576 [ 1520.131402][T27860] bridge_slave_0 (unregistering): left allmulticast mode [ 1520.139390][T27860] bridge_slave_0 (unregistering): left promiscuous mode [ 1520.146434][T27860] bridge0: port 1(bridge_slave_0) entered disabled state [ 1520.504801][T27865] netlink: 'syz.1.13901': attribute type 6 has an invalid length. [ 1520.709327][T27876] xt_hashlimit: size too large, truncated to 1048576 [ 1520.795124][T27889] netlink: 'syz.4.13907': attribute type 4 has an invalid length. [ 1521.076630][T27906] bridge6: entered promiscuous mode [ 1521.142487][T27906] team_slave_1: Caught tx_queue_len zero misconfig [ 1521.525431][T27931] IPVS: set_ctl: invalid protocol: 137 172.20.20.28:20003 [ 1521.558166][T27930] IPVS: set_ctl: invalid protocol: 137 172.20.20.28:20003 [ 1521.572611][T27927] lo speed is unknown, defaulting to 1000 [ 1521.904723][T27940] __nla_validate_parse: 14 callbacks suppressed [ 1521.904744][T27940] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13922'. [ 1522.203358][T27951] netem: invalid attributes len -1 [ 1522.217962][T27951] netem: change failed [ 1522.237220][T27951] netlink: 28 bytes leftover after parsing attributes in process `syz.4.13923'. [ 1522.278223][T27951] netlink: 28 bytes leftover after parsing attributes in process `syz.4.13923'. [ 1522.360869][T27927] ªªªªª9 speed is unknown, defaulting to 1000 [ 1522.360869][T27943] lo speed is unknown, defaulting to 1000 [ 1522.502751][T27961] netlink: 'syz.4.13926': attribute type 7 has an invalid length. [ 1522.721093][T27928] netlink: 'syz.0.13918': attribute type 4 has an invalid length. [ 1522.759519][T27973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13929'. [ 1522.768724][T27973] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13929'. [ 1522.806265][T27973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13929'. [ 1522.816159][T10014] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1522.868397][T10014] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1522.876625][T10014] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1522.882959][T27973] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13929'. [ 1522.920185][T10014] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1523.021056][T27927] ªªªªª9 speed is unknown, defaulting to 1000 [ 1523.207789][T27983] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13932'. [ 1523.304621][T27943] ªªªªª9 speed is unknown, defaulting to 1000 [ 1523.365135][T27986] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13932'. [ 1523.407609][T27986] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13932'. [ 1523.456588][T27983] lo speed is unknown, defaulting to 1000 [ 1523.747977][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 1523.756068][ C1] lec:lec_tx_timeout: lec0 [ 1523.988038][T27943] ªªªªª9 speed is unknown, defaulting to 1000 [ 1524.072823][T27983] ªªªªª9 speed is unknown, defaulting to 1000 [ 1524.662633][T27983] ªªªªª9 speed is unknown, defaulting to 1000 [ 1524.731060][T28007] PKCS7: Unknown OID: [4] (bad) [ 1524.736029][T28007] PKCS7: Only support pkcs7_signedData type [ 1525.232728][T28024] sctp: [Deprecated]: syz.1.13939 (pid 28024) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1525.232728][T28024] Use struct sctp_sack_info instead [ 1526.434111][T28066] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.980883][T28066] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1527.039740][T28088] lo speed is unknown, defaulting to 1000 [ 1527.149999][T28066] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1527.390188][T28066] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1527.464930][T28088] ªªªªª9 speed is unknown, defaulting to 1000 [ 1527.471867][T28123] __nla_validate_parse: 5 callbacks suppressed [ 1527.471882][T28123] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13967'. [ 1527.624688][ T9997] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1527.704052][T10014] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1527.736040][T10014] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1527.789245][T22289] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1527.868645][T28088] ªªªªª9 speed is unknown, defaulting to 1000 [ 1528.308577][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1528.519182][T28159] netlink: 'syz.1.13976': attribute type 10 has an invalid length. [ 1528.590372][T28162] xt_policy: output policy not valid in PREROUTING and INPUT [ 1528.630804][T28159] syz_tun: entered promiscuous mode [ 1528.642819][T28159] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1528.677454][T28158] mac80211_hwsim hwsim178 syzkaller0: entered promiscuous mode [ 1528.697501][T28158] mac80211_hwsim hwsim178 syzkaller0: entered allmulticast mode [ 1528.713582][T28163] tipc: Enabling of bearer rejected, already enabled [ 1528.748744][T28155] lo speed is unknown, defaulting to 1000 [ 1528.891932][T28170] netlink: 76 bytes leftover after parsing attributes in process `syz.4.13978'. [ 1528.934189][T28170] netlink: 'syz.4.13978': attribute type 11 has an invalid length. [ 1528.951663][T28170] netlink: 199828 bytes leftover after parsing attributes in process `syz.4.13978'. [ 1529.161649][T28189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13984'. [ 1529.186752][T28189] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1529.215806][T28184] lo speed is unknown, defaulting to 1000 [ 1529.215816][T28155] ªªªªª9 speed is unknown, defaulting to 1000 [ 1529.564958][T28199] netlink: 20 bytes leftover after parsing attributes in process `syz.1.13986'. [ 1529.643942][T28186] lo speed is unknown, defaulting to 1000 [ 1529.654709][T28184] ªªªªª9 speed is unknown, defaulting to 1000 [ 1529.654716][T28155] ªªªªª9 speed is unknown, defaulting to 1000 [ 1530.069894][T28205] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13989'. [ 1530.085467][T28206] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13989'. [ 1530.101759][T28208] FAULT_INJECTION: forcing a failure. [ 1530.101759][T28208] name failslab, interval 1, probability 0, space 0, times 0 [ 1530.116206][T28208] CPU: 0 UID: 0 PID: 28208 Comm: syz.2.13990 Not tainted syzkaller #0 PREEMPT(full) [ 1530.116230][T28208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1530.116242][T28208] Call Trace: [ 1530.116250][T28208] [ 1530.116258][T28208] dump_stack_lvl+0xe8/0x150 [ 1530.116285][T28208] should_fail_ex+0x412/0x560 [ 1530.116312][T28208] should_failslab+0xa8/0x100 [ 1530.116333][T28208] __kmalloc_noprof+0xde/0x7e0 [ 1530.116352][T28208] ? bpf_test_init+0x9f/0x150 [ 1530.116376][T28208] bpf_test_init+0x9f/0x150 [ 1530.116399][T28208] bpf_prog_test_run_xdp+0x529/0x1160 [ 1530.116434][T28208] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1530.116459][T28208] ? __fget_files+0x2a/0x420 [ 1530.116483][T28208] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1530.116504][T28208] bpf_prog_test_run+0x2c7/0x340 [ 1530.116527][T28208] __sys_bpf+0x5cb/0x920 [ 1530.116547][T28208] ? __pfx___sys_bpf+0x10/0x10 [ 1530.116580][T28208] ? ksys_write+0x242/0x270 [ 1530.116605][T28208] ? __pfx_ksys_write+0x10/0x10 [ 1530.116636][T28208] __x64_sys_bpf+0x7c/0x90 [ 1530.116677][T28208] do_syscall_64+0xe2/0xf80 [ 1530.116700][T28208] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1530.116717][T28208] ? trace_irq_disable+0x37/0x100 [ 1530.116733][T28208] ? clear_bhb_loop+0x60/0xb0 [ 1530.116754][T28208] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1530.116771][T28208] RIP: 0033:0x7f510f39aeb9 [ 1530.116788][T28208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1530.116808][T28208] RSP: 002b:00007f5110310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1530.116828][T28208] RAX: ffffffffffffffda RBX: 00007f510f615fa0 RCX: 00007f510f39aeb9 [ 1530.116841][T28208] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1530.116853][T28208] RBP: 00007f5110310090 R08: 0000000000000000 R09: 0000000000000000 [ 1530.116865][T28208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1530.116875][T28208] R13: 00007f510f616038 R14: 00007f510f615fa0 R15: 00007ffe2d1af328 [ 1530.116906][T28208] [ 1530.393898][T28205] macvtap1: entered promiscuous mode [ 1530.411359][T28205] mac80211_hwsim hwsim200 wlan1: entered promiscuous mode [ 1530.473227][T28206] macvtap2: entered promiscuous mode [ 1530.485150][T28184] ªªªªª9 speed is unknown, defaulting to 1000 [ 1530.504857][T28186] ªªªªª9 speed is unknown, defaulting to 1000 [ 1530.542921][T28188] lo speed is unknown, defaulting to 1000 [ 1530.666923][T28221] netlink: 64 bytes leftover after parsing attributes in process `syz.3.13992'. [ 1530.683818][T28226] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 1530.718463][ T5826] block nbd0: Receive control failed (result -32) [ 1530.728959][T28221] block nbd0: reconnected socket [ 1530.729064][T28223] gre0: entered promiscuous mode [ 1530.756070][T28223] gre0: entered allmulticast mode [ 1530.979468][T28223] block nbd1: server does not support multiple connections per device. [ 1530.989620][T28240] netlink: 44 bytes leftover after parsing attributes in process `syz.3.13996'. [ 1530.996203][T28223] block nbd1: shutting down sockets [ 1531.012852][T10014] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1531.026730][T10014] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1531.071032][T10014] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1531.250534][T28250] netlink: 'syz.3.13999': attribute type 1 has an invalid length. [ 1531.330413][T28255] netlink: 36 bytes leftover after parsing attributes in process `syz.3.13999'. [ 1531.380272][T28249] bond4: option all_slaves_active: invalid value (5) [ 1531.390094][T28249] bond4 (unregistering): Released all slaves [ 1531.525378][T28246] syzkaller0: entered promiscuous mode [ 1531.538425][T28246] syzkaller0: entered allmulticast mode [ 1531.550130][T28250] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 1531.556927][T28260] FAULT_INJECTION: forcing a failure. [ 1531.556927][T28260] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1531.590584][T28260] CPU: 0 UID: 0 PID: 28260 Comm: syz.1.14001 Not tainted syzkaller #0 PREEMPT(full) [ 1531.590610][T28260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1531.590621][T28260] Call Trace: [ 1531.590629][T28260] [ 1531.590637][T28260] dump_stack_lvl+0xe8/0x150 [ 1531.590664][T28260] should_fail_ex+0x412/0x560 [ 1531.590690][T28260] _copy_from_user+0x2d/0xb0 [ 1531.590721][T28260] bpf_test_init+0xd8/0x150 [ 1531.590745][T28260] bpf_prog_test_run_xdp+0x529/0x1160 [ 1531.590780][T28260] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1531.590805][T28260] ? __fget_files+0x2a/0x420 [ 1531.590829][T28260] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1531.590849][T28260] bpf_prog_test_run+0x2c7/0x340 [ 1531.590872][T28260] __sys_bpf+0x5cb/0x920 [ 1531.590892][T28260] ? __pfx___sys_bpf+0x10/0x10 [ 1531.590925][T28260] ? ksys_write+0x242/0x270 [ 1531.590950][T28260] ? __pfx_ksys_write+0x10/0x10 [ 1531.590981][T28260] __x64_sys_bpf+0x7c/0x90 [ 1531.591005][T28260] do_syscall_64+0xe2/0xf80 [ 1531.591027][T28260] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.591043][T28260] ? trace_irq_disable+0x37/0x100 [ 1531.591060][T28260] ? clear_bhb_loop+0x60/0xb0 [ 1531.591081][T28260] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.591098][T28260] RIP: 0033:0x7ffb4399aeb9 [ 1531.591115][T28260] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1531.591129][T28260] RSP: 002b:00007ffb4478e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1531.591148][T28260] RAX: ffffffffffffffda RBX: 00007ffb43c15fa0 RCX: 00007ffb4399aeb9 [ 1531.591162][T28260] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1531.591173][T28260] RBP: 00007ffb4478e090 R08: 0000000000000000 R09: 0000000000000000 [ 1531.591184][T28260] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1531.591194][T28260] R13: 00007ffb43c16038 R14: 00007ffb43c15fa0 R15: 00007fff2864ec68 [ 1531.591225][T28260] [ 1531.806494][T28188] ªªªªª9 speed is unknown, defaulting to 1000 [ 1531.813236][T28186] ªªªªª9 speed is unknown, defaulting to 1000 [ 1533.750708][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5440 ms [ 1533.758752][ C1] lec:lec_tx_timeout: lec0 [ 1533.763827][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1533.881116][T28272] tipc: Enabling of bearer rejected, already enabled [ 1533.890532][T28188] ªªªªª9 speed is unknown, defaulting to 1000 [ 1533.902685][T28276] mac80211_hwsim hwsim183 syzkaller0: Caught tx_queue_len zero misconfig [ 1534.103544][T28285] netlink: 32 bytes leftover after parsing attributes in process `syz.3.14006'. [ 1534.602630][T28306] FAULT_INJECTION: forcing a failure. [ 1534.602630][T28306] name failslab, interval 1, probability 0, space 0, times 0 [ 1534.631655][T28309] netlink: 256 bytes leftover after parsing attributes in process `syz.0.14013'. [ 1534.647033][T28306] CPU: 0 UID: 0 PID: 28306 Comm: syz.1.14012 Not tainted syzkaller #0 PREEMPT(full) [ 1534.647061][T28306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1534.647071][T28306] Call Trace: [ 1534.647077][T28306] [ 1534.647085][T28306] dump_stack_lvl+0xe8/0x150 [ 1534.647110][T28306] should_fail_ex+0x412/0x560 [ 1534.647136][T28306] should_failslab+0xa8/0x100 [ 1534.647155][T28306] __kvmalloc_node_noprof+0x166/0x8d0 [ 1534.647175][T28306] ? bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 1534.647200][T28306] bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 1534.647223][T28306] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1534.647256][T28306] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 1534.647285][T28306] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1534.647325][T28306] ? 0xffffffffa020364c [ 1534.647340][T28306] ? 0xffffffffa0203698 [ 1534.647354][T28306] ? 0xffffffffa0203958 [ 1534.647371][T28306] ? 0xffffffffa0203bbc [ 1534.647407][T28306] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1534.647438][T28306] ? _copy_from_user+0x94/0xb0 [ 1534.647462][T28306] ? bpf_test_init+0x113/0x150 [ 1534.647479][T28306] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1534.647501][T28306] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1534.647537][T28306] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1534.647561][T28306] ? __fget_files+0x2a/0x420 [ 1534.647594][T28306] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1534.647615][T28306] bpf_prog_test_run+0x2c7/0x340 [ 1534.647638][T28306] __sys_bpf+0x5cb/0x920 [ 1534.647657][T28306] ? __pfx___sys_bpf+0x10/0x10 [ 1534.647686][T28306] ? ksys_write+0x242/0x270 [ 1534.647711][T28306] ? __pfx_ksys_write+0x10/0x10 [ 1534.647738][T28306] __x64_sys_bpf+0x7c/0x90 [ 1534.647763][T28306] do_syscall_64+0xe2/0xf80 [ 1534.647785][T28306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1534.647802][T28306] ? clear_bhb_loop+0x60/0xb0 [ 1534.647820][T28306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1534.647832][T28306] RIP: 0033:0x7ffb4399aeb9 [ 1534.647846][T28306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1534.647858][T28306] RSP: 002b:00007ffb4478e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1534.647873][T28306] RAX: ffffffffffffffda RBX: 00007ffb43c15fa0 RCX: 00007ffb4399aeb9 [ 1534.647884][T28306] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1534.647893][T28306] RBP: 00007ffb4478e090 R08: 0000000000000000 R09: 0000000000000000 [ 1534.647901][T28306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1534.647909][T28306] R13: 00007ffb43c16038 R14: 00007ffb43c15fa0 R15: 00007fff2864ec68 [ 1534.647932][T28306] [ 1535.046923][T28322] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14016'. [ 1535.376423][T28326] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.14017'. [ 1535.901108][ T9986] bond3 (unregistering): (slave bridge6): Releasing active interface [ 1536.051206][ T9986] bond4 (unregistering): (slave bridge10): Releasing backup interface [ 1536.136761][ T9986] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1536.145970][ T9986] bond_slave_0: left promiscuous mode [ 1536.153453][ T9986] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1536.164375][ T9986] bond_slave_1: left promiscuous mode [ 1536.172047][ T9986] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1536.181587][ T9986] bridge_slave_1: left promiscuous mode [ 1536.188768][ T9986] bond0 (unregistering): Released all slaves [ 1536.198506][ T9986] bond1 (unregistering): Released all slaves [ 1536.211283][ T9986] bond2 (unregistering): Released all slaves [ 1536.223153][ T9986] bond3 (unregistering): Released all slaves [ 1536.235859][ T9986] bond4 (unregistering): Released all slaves [ 1536.271362][T28316] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14011'. [ 1536.281231][T28323] sch_fq: defrate 4294967293 ignored. [ 1536.457000][T28341] netlink: 'syz.2.14020': attribute type 1 has an invalid length. [ 1536.489189][ T9986] æÿîÿ: left promiscuous mode [ 1536.522696][T28342] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14020'. [ 1536.553600][T28342] netlink: 'syz.2.14020': attribute type 12 has an invalid length. [ 1536.570355][T28342] netlink: 'syz.2.14020': attribute type 5 has an invalid length. [ 1536.583739][T28342] netlink: 'syz.2.14020': attribute type 2 has an invalid length. [ 1536.594225][T28342] netlink: 'syz.2.14020': attribute type 7 has an invalid length. [ 1536.612005][T28342] netlink: 108 bytes leftover after parsing attributes in process `syz.2.14020'. [ 1536.726372][T28341] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1536.737201][T28315] lo speed is unknown, defaulting to 1000 [ 1536.737214][ T9986] : left promiscuous mode [ 1536.828433][T28350] macsec1: entered promiscuous mode [ 1536.848771][T28350] macsec1: entered allmulticast mode [ 1536.853901][T28358] IPVS: set_ctl: invalid protocol: 50 172.30.0.3:20004 [ 1536.864255][T28350] dummy0: entered allmulticast mode [ 1536.897997][T28350] dummy0: left allmulticast mode [ 1536.995749][T28344] macsec1: entered promiscuous mode [ 1537.005490][T28344] macsec1: entered allmulticast mode [ 1537.021747][T28344] dummy0: entered allmulticast mode [ 1537.061549][T28344] dummy0: left allmulticast mode [ 1537.083080][ T9986] tipc: Left network mode [ 1537.244080][T28362] bridge0: port 3(veth1_to_hsr) entered disabled state [ 1537.251187][T28362] bridge0: port 2(bridge_slave_1) entered disabled state [ 1537.258720][T28362] bridge0: port 1(bridge_slave_0) entered disabled state [ 1537.522763][T28362] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1537.556547][T28362] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1537.825513][T28362] batman_adv: batadv0: Interface deactivated: gretap1 [ 1537.843336][T28362] gretap2: left allmulticast mode [ 1537.887841][T28315] ªªªªª9 speed is unknown, defaulting to 1000 [ 1537.888727][T28345] lo speed is unknown, defaulting to 1000 [ 1537.960768][ T9994] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1537.990286][ T9994] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1537.999228][ T9994] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1538.032354][ T9994] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1538.042099][T28375] FAULT_INJECTION: forcing a failure. [ 1538.042099][T28375] name failslab, interval 1, probability 0, space 0, times 0 [ 1538.077563][T28375] CPU: 0 UID: 0 PID: 28375 Comm: syz.2.14026 Not tainted syzkaller #0 PREEMPT(full) [ 1538.077587][T28375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1538.077598][T28375] Call Trace: [ 1538.077606][T28375] [ 1538.077614][T28375] dump_stack_lvl+0xe8/0x150 [ 1538.077640][T28375] should_fail_ex+0x412/0x560 [ 1538.077665][T28375] should_failslab+0xa8/0x100 [ 1538.077686][T28375] __kvmalloc_node_noprof+0x166/0x8d0 [ 1538.077706][T28375] ? bpf_test_run_xdp_live+0x223/0x1cf0 [ 1538.077732][T28375] bpf_test_run_xdp_live+0x223/0x1cf0 [ 1538.077758][T28375] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1538.077790][T28375] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 1538.077812][T28375] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1538.077836][T28375] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1538.077877][T28375] ? 0xffffffffa020364c [ 1538.077891][T28375] ? 0xffffffffa0203698 [ 1538.077904][T28375] ? 0xffffffffa0203948 [ 1538.077916][T28375] ? 0xffffffffa0203bbc [ 1538.077952][T28375] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1538.077981][T28375] ? _copy_from_user+0x94/0xb0 [ 1538.078004][T28375] ? bpf_test_init+0x113/0x150 [ 1538.078020][T28375] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1538.078038][T28375] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1538.078070][T28375] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1538.078093][T28375] ? __fget_files+0x2a/0x420 [ 1538.078117][T28375] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1538.078137][T28375] bpf_prog_test_run+0x2c7/0x340 [ 1538.078158][T28375] __sys_bpf+0x5cb/0x920 [ 1538.078178][T28375] ? __pfx___sys_bpf+0x10/0x10 [ 1538.078208][T28375] ? ksys_write+0x242/0x270 [ 1538.078232][T28375] ? __pfx_ksys_write+0x10/0x10 [ 1538.078261][T28375] __x64_sys_bpf+0x7c/0x90 [ 1538.078284][T28375] do_syscall_64+0xe2/0xf80 [ 1538.078304][T28375] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1538.078320][T28375] ? trace_irq_disable+0x37/0x100 [ 1538.078335][T28375] ? clear_bhb_loop+0x60/0xb0 [ 1538.078354][T28375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1538.078371][T28375] RIP: 0033:0x7f510f39aeb9 [ 1538.078386][T28375] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1538.078400][T28375] RSP: 002b:00007f5110310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1538.078418][T28375] RAX: ffffffffffffffda RBX: 00007f510f615fa0 RCX: 00007f510f39aeb9 [ 1538.078431][T28375] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1538.078443][T28375] RBP: 00007f5110310090 R08: 0000000000000000 R09: 0000000000000000 [ 1538.078454][T28375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1538.078465][T28375] R13: 00007f510f616038 R14: 00007f510f615fa0 R15: 00007ffe2d1af328 [ 1538.078493][T28375] [ 1538.575197][T28376] lo speed is unknown, defaulting to 1000 [ 1538.701799][T28391] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14031'. [ 1538.777423][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1538.785469][ C1] lec:lec_tx_timeout: lec0 [ 1538.839465][T28345] ªªªªª9 speed is unknown, defaulting to 1000 [ 1538.848395][T28315] ªªªªª9 speed is unknown, defaulting to 1000 [ 1539.047266][T28373] lo speed is unknown, defaulting to 1000 [ 1539.199534][T28345] ªªªªª9 speed is unknown, defaulting to 1000 [ 1539.207881][T28376] ªªªªª9 speed is unknown, defaulting to 1000 [ 1539.344176][T28411] syzkaller0: entered promiscuous mode [ 1539.357556][T28411] syzkaller0: entered allmulticast mode [ 1539.578493][T28376] ªªªªª9 speed is unknown, defaulting to 1000 [ 1539.625475][T28373] ªªªªª9 speed is unknown, defaulting to 1000 [ 1539.733666][T28396] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1540.086411][T28373] ªªªªª9 speed is unknown, defaulting to 1000 [ 1540.319128][T28418] netlink: 'syz.2.14038': attribute type 1 has an invalid length. [ 1540.336655][T28418] netlink: 224 bytes leftover after parsing attributes in process `syz.2.14038'. [ 1541.070289][ T9986] hsr_slave_0: left promiscuous mode [ 1541.099762][ T9986] hsr_slave_1: left promiscuous mode [ 1541.130320][ T9986] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1541.560560][T28438] delete_channel: no stack [ 1541.631467][T28441] netlink: 104 bytes leftover after parsing attributes in process `syz.2.14044'. [ 1541.799264][T28439] lo speed is unknown, defaulting to 1000 [ 1542.133564][ T9986] IPVS: stop unused estimator thread 0... [ 1542.198711][T28460] netlink: 16 bytes leftover after parsing attributes in process `syz.3.14048'. [ 1542.341718][T28439] ªªªªª9 speed is unknown, defaulting to 1000 [ 1542.442642][T28465] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1542.453816][T28465] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14049'. [ 1542.666350][T28474] netlink: 'syz.3.14052': attribute type 10 has an invalid length. [ 1542.671890][T28476] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14053'. [ 1542.686166][T28476] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1542.716761][T28474] team0: Port device dummy0 added [ 1542.724523][T28474] netlink: 'syz.3.14052': attribute type 10 has an invalid length. [ 1542.780848][T28474] team0: Port device dummy0 removed [ 1542.790535][T28474] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1542.925078][T28487] openvswitch: netlink: IPv6 tunnel dst address is zero [ 1542.958094][T28439] ªªªªª9 speed is unknown, defaulting to 1000 [ 1543.060765][T28490] batadv_slave_1: entered promiscuous mode [ 1543.079800][T28489] batadv_slave_1: left promiscuous mode [ 1543.224821][T28493] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14057'. [ 1543.252898][T28493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14057'. [ 1543.284242][T28495] netlink: 'syz.0.14057': attribute type 4 has an invalid length. [ 1543.427615][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1543.640706][T28498] netlink: 36 bytes leftover after parsing attributes in process `syz.0.14058'. [ 1543.657927][T28498] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14058'. [ 1543.690368][T28506] netlink: 76 bytes leftover after parsing attributes in process `syz.3.14061'. [ 1544.002135][T28528] GUP no longer grows the stack in syz.3.14066 (28528): 200000003000-20000000a000 (200000001000) [ 1544.013660][T28528] CPU: 1 UID: 0 PID: 28528 Comm: syz.3.14066 Not tainted syzkaller #0 PREEMPT(full) [ 1544.013688][T28528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1544.013702][T28528] Call Trace: [ 1544.013710][T28528] [ 1544.013719][T28528] dump_stack_lvl+0xe8/0x150 [ 1544.013751][T28528] __get_user_pages+0x2453/0x29d0 [ 1544.013802][T28528] ? __gup_longterm_locked+0xc4e/0x1630 [ 1544.013830][T28528] ? down_read_killable+0x1bb/0x340 [ 1544.013849][T28528] ? try_get_folio+0xec/0x650 [ 1544.013880][T28528] __gup_longterm_locked+0xdcf/0x1630 [ 1544.013932][T28528] gup_fast_fallback+0x1d82/0x22e0 [ 1544.013992][T28528] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1544.014021][T28528] ? is_valid_gup_args+0x11f/0x200 [ 1544.014050][T28528] ? get_user_pages_fast+0x4d/0xb0 [ 1544.014078][T28528] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 1544.014114][T28528] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1544.014144][T28528] iov_iter_get_pages2+0x5e/0xa0 [ 1544.014176][T28528] __se_sys_vmsplice+0x7b3/0x1490 [ 1544.014227][T28528] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 1544.014251][T28528] ? __pfx_futex_wait+0x10/0x10 [ 1544.014284][T28528] ? lockdep_hardirqs_on+0x7a/0x110 [ 1544.014368][T28528] do_syscall_64+0xe2/0xf80 [ 1544.014395][T28528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.014415][T28528] ? trace_irq_disable+0x37/0x100 [ 1544.014434][T28528] ? clear_bhb_loop+0x60/0xb0 [ 1544.014458][T28528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.014477][T28528] RIP: 0033:0x7f927d59aeb9 [ 1544.014495][T28528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1544.014512][T28528] RSP: 002b:00007f927e3b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 1544.014534][T28528] RAX: ffffffffffffffda RBX: 00007f927d815fa0 RCX: 00007f927d59aeb9 [ 1544.014549][T28528] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 1544.014565][T28528] RBP: 00007f927d608c1f R08: 0000000000000000 R09: 0000000000000000 [ 1544.014579][T28528] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1544.014591][T28528] R13: 00007f927d816038 R14: 00007f927d815fa0 R15: 00007ffc1837a548 [ 1544.014625][T28528] [ 1544.344340][T28536] vlan3: entered promiscuous mode [ 1544.932675][T28558] syzkaller0: entered promiscuous mode [ 1544.938417][T28558] syzkaller0: entered allmulticast mode [ 1545.244591][T28570] lo speed is unknown, defaulting to 1000 [ 1545.252629][T28568] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1545.479471][T28592] netlink: 'syz.0.14082': attribute type 1 has an invalid length. [ 1545.513064][T28592] nbd: error processing sock list [ 1545.518026][T28595] __nla_validate_parse: 2 callbacks suppressed [ 1545.518042][T28595] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14083'. [ 1545.569386][T28595] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14083'. [ 1545.602986][ T30] audit: type=1800 audit(1770417236.202:28): pid=28551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.14073" name="memory.events" dev="tmpfs" ino=1836 res=0 errno=0 [ 1545.816459][T28606] tipc: Enabled bearer , priority 0 [ 1545.824286][T28608] netlink: 64 bytes leftover after parsing attributes in process `syz.1.14087'. [ 1545.824854][T28606] syzkaller0: entered promiscuous mode [ 1545.845661][T28606] syzkaller0: entered allmulticast mode [ 1545.868685][T28570] ªªªªª9 speed is unknown, defaulting to 1000 [ 1545.949308][T28606] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14086'. [ 1546.023067][T28605] tipc: Resetting bearer [ 1546.079284][T28605] tipc: Disabling bearer [ 1546.153558][T28570] ªªªªª9 speed is unknown, defaulting to 1000 [ 1546.263049][T28621] lo speed is unknown, defaulting to 1000 [ 1546.579753][T28641] IPVS: set_ctl: invalid protocol: 3 172.20.20.45:20000 [ 1546.675248][T28621] ªªªªª9 speed is unknown, defaulting to 1000 [ 1547.104463][T28667] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14101'. [ 1547.117664][T28667] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14101'. [ 1547.178413][T28621] ªªªªª9 speed is unknown, defaulting to 1000 [ 1547.355841][T28669] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14102'. [ 1547.392066][T28674] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14104'. [ 1547.644305][T28688] netlink: 296 bytes leftover after parsing attributes in process `syz.1.14109'. [ 1547.684047][T28690] syzkaller0: entered promiscuous mode [ 1547.693099][T28690] syzkaller0: entered allmulticast mode [ 1547.823324][T28698] netlink: 'syz.1.14111': attribute type 1 has an invalid length. [ 1548.101576][T28710] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14112'. [ 1548.222866][T28702] bond4: (slave geneve0): making interface the new active one [ 1548.231006][T28702] bond4: (slave geneve0): Enslaving as an active interface with an up link [ 1548.329335][ T9989] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1548.337781][ T9989] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1548.460729][ T9989] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1548.498927][T28722] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1548.507748][ T9989] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1548.583254][T28730] netlink: 'syz.2.14118': attribute type 8 has an invalid length. [ 1548.597904][ T79] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1548.609539][T28730] netlink: 'syz.2.14118': attribute type 1 has an invalid length. [ 1548.666074][T28735] pim6reg: entered allmulticast mode [ 1548.698064][T28735] bond0: (slave dummy0): Releasing backup interface [ 1548.705789][T28737] netlink: 'syz.0.14120': attribute type 1 has an invalid length. [ 1548.717430][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5290 ms [ 1548.725469][ C1] lec:lec_tx_timeout: lec0 [ 1548.730526][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1548.732088][T28735] batman_adv: batadv0: Adding interface: dummy0 [ 1548.745757][T28735] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 1548.773337][T28735] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 1548.804386][T10005] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1548.817013][T28742] netlink: 'syz.1.14122': attribute type 15 has an invalid length. [ 1548.881047][T28737] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1549.127278][T28770] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1549.170933][T28775] syzkaller0: entered promiscuous mode [ 1549.183469][T28775] syzkaller0: entered allmulticast mode [ 1549.588031][ T5945] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1549.737674][T28806] netlink: 'syz.4.14141': attribute type 21 has an invalid length. [ 1549.830500][ T9990] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1549.840687][ T9990] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1550.171688][T28837] netlink: 'syz.3.14149': attribute type 1 has an invalid length. [ 1550.201904][T28837] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1550.240010][T28837] bond8: (slave geneve3): making interface the new active one [ 1550.252734][T28837] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 1550.324154][T28847] lo speed is unknown, defaulting to 1000 [ 1550.556803][T27498] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1550.582300][T28847] ªªªªª9 speed is unknown, defaulting to 1000 [ 1550.692906][T28847] ªªªªª9 speed is unknown, defaulting to 1000 [ 1550.720935][T28813] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1550.999532][ T30] audit: type=1800 audit(1770417241.592:29): pid=28872 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.14157" name="memory.events" dev="tmpfs" ino=2190 res=0 errno=0 [ 1551.021531][ T30] audit: type=1804 audit(1770417241.622:30): pid=28872 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.14157" name="memory.events" dev="tmpfs" ino=2190 res=1 errno=0 [ 1551.054280][T28872] __nla_validate_parse: 11 callbacks suppressed [ 1551.054300][T28872] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14157'. [ 1551.228045][T28882] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14162'. [ 1551.240119][T28883] netlink: 56 bytes leftover after parsing attributes in process `syz.2.14161'. [ 1551.255937][T28882] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14162'. [ 1551.423620][T28900] netlink: 'syz.0.14165': attribute type 5 has an invalid length. [ 1551.452474][T28900] netlink: 3581 bytes leftover after parsing attributes in process `syz.0.14165'. [ 1551.749323][T28920] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14173'. [ 1552.036626][T28937] netlink: 'syz.3.14178': attribute type 1 has an invalid length. [ 1552.225373][T28952] syzkaller0: entered promiscuous mode [ 1552.234384][T28952] syzkaller0: entered allmulticast mode [ 1552.265148][T28952] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14183'. [ 1552.278247][T28952] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14183'. [ 1552.453583][T28970] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14187'. [ 1552.536028][T28965] syzkaller0: entered promiscuous mode [ 1552.543808][T28965] syzkaller0: entered allmulticast mode [ 1552.690468][T28984] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14192'. [ 1552.727094][T28984] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1552.874381][T28995] lo speed is unknown, defaulting to 1000 [ 1552.919907][T28999] netlink: 'syz.4.14194': attribute type 10 has an invalid length. [ 1553.082270][T29004] tipc: Enabling of bearer rejected, failed to enable media [ 1553.093618][T28995] ªªªªª9 speed is unknown, defaulting to 1000 [ 1553.594741][T29023] bond10: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1553.633402][T29023] bond10 (unregistering): Released all slaves [ 1553.707333][T29044] xt_ecn: cannot match TCP bits for non-tcp packets [ 1553.747714][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 1553.755785][ C1] lec:lec_tx_timeout: lec0 [ 1553.795336][T28995] ªªªªª9 speed is unknown, defaulting to 1000 [ 1553.970662][T29055] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 1554.147688][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1555.363669][T29124] syzkaller0: entered promiscuous mode [ 1555.377277][T29124] syzkaller0: entered allmulticast mode [ 1555.598442][T29146] openvswitch: netlink: IP tunnel dst address not specified [ 1555.846482][T29163] netlink: 'syz.1.14241': attribute type 5 has an invalid length. [ 1556.314238][T29186] __nla_validate_parse: 7 callbacks suppressed [ 1556.314259][T29186] netlink: 32 bytes leftover after parsing attributes in process `syz.2.14248'. [ 1556.331853][T29186] netlink: 35 bytes leftover after parsing attributes in process `syz.2.14248'. [ 1556.497285][T29203] sctp: [Deprecated]: syz.0.14249 (pid 29203) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1556.497285][T29203] Use struct sctp_sack_info instead [ 1556.517543][T29202] syzkaller1: entered promiscuous mode [ 1556.523040][T29202] syzkaller1: entered allmulticast mode [ 1556.734444][T29219] netlink: 'syz.4.14257': attribute type 11 has an invalid length. [ 1556.746327][T29219] netlink: 140 bytes leftover after parsing attributes in process `syz.4.14257'. [ 1556.828388][T29224] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14260'. [ 1557.161583][T29249] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14267'. [ 1557.182005][T29249] lo: Caught tx_queue_len zero misconfig [ 1557.302945][T29257] lo speed is unknown, defaulting to 1000 [ 1557.471268][T29269] netlink: 'syz.0.14273': attribute type 1 has an invalid length. [ 1557.517882][T29272] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14274'. [ 1557.561513][T29276] netlink: 'syz.2.14275': attribute type 32 has an invalid length. [ 1557.617549][T29276] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14275'. [ 1557.665528][T29282] mac80211_hwsim hwsim183 syzkaller0: left promiscuous mode [ 1557.673069][T29282] mac80211_hwsim hwsim183 syzkaller0: left allmulticast mode [ 1557.694627][T29276] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14275'. [ 1557.706990][T29282] tipc: Resetting bearer [ 1557.828864][T29276] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1557.849911][T29287] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1557.884175][T29294] tipc: Failed to remove unknown binding: 66,1,1/1169082902:2501332021/2501332023 [ 1557.929101][T29292] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14275'. [ 1557.962041][T29257] ªªªªª9 speed is unknown, defaulting to 1000 [ 1558.019190][T29294] netlink: 'syz.3.14279': attribute type 1 has an invalid length. [ 1558.316913][T29294] bond10: entered promiscuous mode [ 1558.333308][T29294] bond10: entered allmulticast mode [ 1558.375166][T29294] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1558.444024][T29304] macvlan1: entered promiscuous mode [ 1558.458586][T29304] macvlan1: entered allmulticast mode [ 1558.484098][T29304] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 1558.548156][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1559.249111][T29257] ªªªªª9 speed is unknown, defaulting to 1000 [ 1559.478308][T29345] syzkaller0: entered promiscuous mode [ 1559.485952][T29345] syzkaller0: entered allmulticast mode [ 1559.581889][T29360] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14288'. [ 1559.626051][T29345] tipc: Enabled bearer , priority 0 [ 1559.663551][T29343] tipc: Resetting bearer [ 1559.715367][T29343] tipc: Disabling bearer [ 1560.037156][T29378] netlink: 'syz.3.14291': attribute type 6 has an invalid length. [ 1560.133610][T29377] lo speed is unknown, defaulting to 1000 [ 1560.521837][T29403] xt_bpf: check failed: parse error [ 1560.523080][T29404] ip6tnl0: Caught tx_queue_len zero misconfig [ 1560.693550][T29377] ªªªªª9 speed is unknown, defaulting to 1000 [ 1560.912835][T29418] lo speed is unknown, defaulting to 1000 [ 1561.263783][T29437] netlink: 'syz.2.14311': attribute type 10 has an invalid length. [ 1561.276246][T29377] ªªªªª9 speed is unknown, defaulting to 1000 [ 1561.285513][T29441] IPVS: stopping backup sync thread 22331 ... [ 1561.289500][T29437] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1561.302804][T29437] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1561.313539][T29437] hsr0: entered promiscuous mode [ 1561.321027][T29437] bridge0: port 4(hsr0) entered blocking state [ 1561.327892][T29437] bridge0: port 4(hsr0) entered disabled state [ 1561.334948][T29437] hsr0: entered allmulticast mode [ 1561.341689][T29437] hsr_slave_0: entered allmulticast mode [ 1561.348353][T29437] hsr_slave_1: entered allmulticast mode [ 1561.372449][T29426] lo speed is unknown, defaulting to 1000 [ 1561.409397][T29418] ªªªªª9 speed is unknown, defaulting to 1000 [ 1561.444099][T29444] __nla_validate_parse: 8 callbacks suppressed [ 1561.444116][T29444] netlink: 5604 bytes leftover after parsing attributes in process `syz.0.14314'. [ 1562.117568][T29426] ªªªªª9 speed is unknown, defaulting to 1000 [ 1562.134998][T29418] ªªªªª9 speed is unknown, defaulting to 1000 [ 1562.536948][T29426] ªªªªª9 speed is unknown, defaulting to 1000 [ 1562.672390][ T30] audit: type=1800 audit(1770417253.272:31): pid=29483 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.14324" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1490 res=0 errno=0 [ 1562.696059][T29484] netlink: 64 bytes leftover after parsing attributes in process `syz.4.14323'. [ 1562.962404][T29487] syzkaller1: entered promiscuous mode [ 1562.977579][T29487] syzkaller1: entered allmulticast mode [ 1563.107619][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1563.561735][T29505] lo speed is unknown, defaulting to 1000 [ 1563.747711][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5200 ms [ 1563.755751][ C1] lec:lec_tx_timeout: lec0 [ 1563.760747][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1563.976649][T29523] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14335'. [ 1564.161319][T29505] ªªªªª9 speed is unknown, defaulting to 1000 [ 1564.333039][T29532] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14339'. [ 1564.378356][T29532] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14339'. [ 1564.435912][T29532] vlan1: entered allmulticast mode [ 1564.457850][T29532] team0: entered allmulticast mode [ 1564.577960][T29505] ªªªªª9 speed is unknown, defaulting to 1000 [ 1564.654351][T29548] syzkaller0: entered promiscuous mode [ 1564.658105][T29552] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14344'. [ 1564.660075][T29548] syzkaller0: entered allmulticast mode [ 1564.677046][T29551] syzkaller1: entered promiscuous mode [ 1564.683013][T29551] syzkaller1: entered allmulticast mode [ 1564.958693][T29558] netlink: 'syz.1.14346': attribute type 3 has an invalid length. [ 1564.984149][T29558] netlink: 'syz.1.14346': attribute type 3 has an invalid length. [ 1565.574464][T29568] lo speed is unknown, defaulting to 1000 [ 1565.857760][T29578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1565.880177][T29578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1565.908111][T29578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1565.945847][T29578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1566.023625][T29583] netlink: 'syz.0.14355': attribute type 13 has an invalid length. [ 1566.375438][T29568] ªªªªª9 speed is unknown, defaulting to 1000 [ 1566.831063][T29568] ªªªªª9 speed is unknown, defaulting to 1000 [ 1566.972079][T29613] __nla_validate_parse: 63 callbacks suppressed [ 1566.972101][T29613] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14366'. [ 1567.035246][T29613] netlink: 121 bytes leftover after parsing attributes in process `syz.3.14366'. [ 1567.394109][T29626] mac80211_hwsim hwsim183 syzkaller0: entered promiscuous mode [ 1567.404432][T29626] mac80211_hwsim hwsim183 syzkaller0: entered allmulticast mode [ 1567.511994][T29629] netlink: 'syz.3.14371': attribute type 1 has an invalid length. [ 1567.581594][T29631] netlink: 'syz.3.14372': attribute type 1 has an invalid length. [ 1567.890281][T29637] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14373'. [ 1567.924607][T29637] syzkaller0: entered allmulticast mode [ 1567.956669][T29639] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.14375'. [ 1567.980349][T29637] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14373'. [ 1568.242315][T29652] lo speed is unknown, defaulting to 1000 [ 1568.486254][T29652] ªªªªª9 speed is unknown, defaulting to 1000 [ 1568.599581][T29672] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14385'. [ 1568.675633][T29652] ªªªªª9 speed is unknown, defaulting to 1000 [ 1568.767450][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1568.775507][ C1] lec:lec_tx_timeout: lec0 [ 1568.863491][T29684] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14388'. [ 1568.873375][T29684] netlink: 48 bytes leftover after parsing attributes in process `syz.0.14388'. [ 1568.884126][T29684] netlink: 'syz.0.14388': attribute type 1 has an invalid length. [ 1569.553908][T29732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14400'. [ 1569.626777][T29732] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14400'. [ 1569.641310][T29732] tipc: Enabling of bearer rejected, failed to enable media [ 1569.821029][T29744] FAULT_INJECTION: forcing a failure. [ 1569.821029][T29744] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1569.879810][T29744] CPU: 0 UID: 0 PID: 29744 Comm: syz.0.14404 Not tainted syzkaller #0 PREEMPT(full) [ 1569.879856][T29744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1569.879878][T29744] Call Trace: [ 1569.879894][T29744] [ 1569.879902][T29744] dump_stack_lvl+0xe8/0x150 [ 1569.879928][T29744] should_fail_ex+0x412/0x560 [ 1569.879953][T29744] _copy_to_user+0x31/0xb0 [ 1569.879979][T29744] simple_read_from_buffer+0xe1/0x170 [ 1569.880003][T29744] proc_fail_nth_read+0x1bb/0x230 [ 1569.880029][T29744] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1569.880056][T29744] ? rw_verify_area+0x2a6/0x4d0 [ 1569.880076][T29744] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1569.880099][T29744] vfs_read+0x20c/0xa70 [ 1569.880119][T29744] ? fdget_pos+0x246/0x320 [ 1569.880141][T29744] ? __pfx___mutex_lock+0x10/0x10 [ 1569.880164][T29744] ? __pfx_vfs_read+0x10/0x10 [ 1569.880188][T29744] ? __fget_files+0x2a/0x420 [ 1569.880210][T29744] ? __fget_files+0x3a0/0x420 [ 1569.880227][T29744] ? __fget_files+0x2a/0x420 [ 1569.880253][T29744] ksys_read+0x150/0x270 [ 1569.880278][T29744] ? __pfx_ksys_read+0x10/0x10 [ 1569.880309][T29744] do_syscall_64+0xe2/0xf80 [ 1569.880330][T29744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1569.880345][T29744] ? trace_irq_disable+0x37/0x100 [ 1569.880370][T29744] ? clear_bhb_loop+0x60/0xb0 [ 1569.880390][T29744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1569.880406][T29744] RIP: 0033:0x7f015135b78e [ 1569.880422][T29744] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1569.880436][T29744] RSP: 002b:00007f01522ebfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1569.880454][T29744] RAX: ffffffffffffffda RBX: 00007f01522ec6c0 RCX: 00007f015135b78e [ 1569.880467][T29744] RDX: 000000000000000f RSI: 00007f01522ec0a0 RDI: 0000000000000004 [ 1569.880478][T29744] RBP: 00007f01522ec090 R08: 0000000000000000 R09: 0000000000000000 [ 1569.880488][T29744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1569.880498][T29744] R13: 00007f0151616038 R14: 00007f0151615fa0 R15: 00007ffda1f149d8 [ 1569.880529][T29744] [ 1570.278674][T29762] netlink: 'syz.2.14409': attribute type 10 has an invalid length. [ 1570.314037][T29761] syzkaller0: entered promiscuous mode [ 1570.320435][T29761] syzkaller0: entered allmulticast mode [ 1570.445843][T29765] lo speed is unknown, defaulting to 1000 [ 1570.965548][T29806] netlink: 'syz.1.14427': attribute type 21 has an invalid length. [ 1570.998634][T29765] ªªªªª9 speed is unknown, defaulting to 1000 [ 1571.505778][T29839] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1571.548112][T29765] ªªªªª9 speed is unknown, defaulting to 1000 [ 1571.574793][T29841] FAULT_INJECTION: forcing a failure. [ 1571.574793][T29841] name failslab, interval 1, probability 0, space 0, times 0 [ 1571.587478][T29841] CPU: 0 UID: 0 PID: 29841 Comm: syz.1.14439 Not tainted syzkaller #0 PREEMPT(full) [ 1571.587502][T29841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1571.587513][T29841] Call Trace: [ 1571.587521][T29841] [ 1571.587529][T29841] dump_stack_lvl+0xe8/0x150 [ 1571.587555][T29841] should_fail_ex+0x412/0x560 [ 1571.587581][T29841] should_failslab+0xa8/0x100 [ 1571.587602][T29841] kmem_cache_alloc_bulk_noprof+0x8c/0x740 [ 1571.587626][T29841] ? pfn_valid+0x125/0x4c0 [ 1571.587649][T29841] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 1571.587687][T29841] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 1571.587719][T29841] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1571.587759][T29841] ? 0xffffffffa02030d4 [ 1571.587773][T29841] ? 0xffffffffa0203698 [ 1571.587787][T29841] ? 0xffffffffa0203bbc [ 1571.587825][T29841] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1571.587854][T29841] ? _copy_from_user+0x94/0xb0 [ 1571.587876][T29841] ? bpf_test_init+0x113/0x150 [ 1571.587892][T29841] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1571.587913][T29841] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1571.587947][T29841] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1571.587970][T29841] ? __fget_files+0x2a/0x420 [ 1571.587994][T29841] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1571.588015][T29841] bpf_prog_test_run+0x2c7/0x340 [ 1571.588038][T29841] __sys_bpf+0x5cb/0x920 [ 1571.588055][T29841] ? __pfx___sys_bpf+0x10/0x10 [ 1571.588087][T29841] ? ksys_write+0x242/0x270 [ 1571.588112][T29841] ? __pfx_ksys_write+0x10/0x10 [ 1571.588142][T29841] __x64_sys_bpf+0x7c/0x90 [ 1571.588165][T29841] do_syscall_64+0xe2/0xf80 [ 1571.588186][T29841] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1571.588202][T29841] ? trace_irq_disable+0x37/0x100 [ 1571.588218][T29841] ? clear_bhb_loop+0x60/0xb0 [ 1571.588238][T29841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1571.588254][T29841] RIP: 0033:0x7ffb4399aeb9 [ 1571.588269][T29841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1571.588283][T29841] RSP: 002b:00007ffb4478e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1571.588307][T29841] RAX: ffffffffffffffda RBX: 00007ffb43c15fa0 RCX: 00007ffb4399aeb9 [ 1571.588320][T29841] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1571.588332][T29841] RBP: 00007ffb4478e090 R08: 0000000000000000 R09: 0000000000000000 [ 1571.588342][T29841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1571.588351][T29841] R13: 00007ffb43c16038 R14: 00007ffb43c15fa0 R15: 00007fff2864ec68 [ 1571.588379][T29841] [ 1572.005237][T29858] xt_hashlimit: size too large, truncated to 1048576 [ 1572.290437][T29868] __nla_validate_parse: 13 callbacks suppressed [ 1572.290457][T29868] netlink: 92 bytes leftover after parsing attributes in process `syz.2.14446'. [ 1572.355434][T29868] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14446'. [ 1572.365847][T29872] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14448'. [ 1572.431764][T29870] netlink: 148 bytes leftover after parsing attributes in process `syz.4.14447'. [ 1572.622960][T29879] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14450'. [ 1572.640733][T29883] netlink: 60 bytes leftover after parsing attributes in process `syz.2.14452'. [ 1572.693680][T29883] netlink: 35 bytes leftover after parsing attributes in process `syz.2.14452'. [ 1572.764688][T29888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1572.784737][T29885] netlink: 1088 bytes leftover after parsing attributes in process `syz.1.14451'. [ 1572.801577][T29884] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14450'. [ 1572.863751][T29883] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14452'. [ 1572.877669][T29883] tipc: Enabling of bearer rejected, failed to enable media [ 1573.102211][T29895] FAULT_INJECTION: forcing a failure. [ 1573.102211][T29895] name failslab, interval 1, probability 0, space 0, times 0 [ 1573.114875][T29895] CPU: 1 UID: 0 PID: 29895 Comm: syz.2.14455 Not tainted syzkaller #0 PREEMPT(full) [ 1573.114899][T29895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1573.114910][T29895] Call Trace: [ 1573.114918][T29895] [ 1573.114926][T29895] dump_stack_lvl+0xe8/0x150 [ 1573.114949][T29895] should_fail_ex+0x412/0x560 [ 1573.114965][T29895] should_failslab+0xa8/0x100 [ 1573.114977][T29895] kmem_cache_alloc_bulk_noprof+0x8c/0x740 [ 1573.114992][T29895] ? pfn_valid+0x125/0x4c0 [ 1573.115006][T29895] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 1573.115027][T29895] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 1573.115043][T29895] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1573.115065][T29895] ? 0xffffffffa02030c8 [ 1573.115073][T29895] ? 0xffffffffa0203698 [ 1573.115080][T29895] ? 0xffffffffa0203bbc [ 1573.115101][T29895] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1573.115117][T29895] ? _copy_from_user+0x94/0xb0 [ 1573.115133][T29895] ? bpf_test_init+0x113/0x150 [ 1573.115143][T29895] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1573.115155][T29895] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1573.115181][T29895] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1573.115197][T29895] ? __fget_files+0x2a/0x420 [ 1573.115211][T29895] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1573.115223][T29895] bpf_prog_test_run+0x2c7/0x340 [ 1573.115236][T29895] __sys_bpf+0x5cb/0x920 [ 1573.115247][T29895] ? __pfx___sys_bpf+0x10/0x10 [ 1573.115264][T29895] ? ksys_write+0x242/0x270 [ 1573.115280][T29895] ? __pfx_ksys_write+0x10/0x10 [ 1573.115298][T29895] __x64_sys_bpf+0x7c/0x90 [ 1573.115313][T29895] do_syscall_64+0xe2/0xf80 [ 1573.115329][T29895] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1573.115338][T29895] ? trace_irq_disable+0x37/0x100 [ 1573.115348][T29895] ? clear_bhb_loop+0x60/0xb0 [ 1573.115360][T29895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1573.115369][T29895] RIP: 0033:0x7f510f39aeb9 [ 1573.115379][T29895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1573.115388][T29895] RSP: 002b:00007f5110310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1573.115400][T29895] RAX: ffffffffffffffda RBX: 00007f510f615fa0 RCX: 00007f510f39aeb9 [ 1573.115407][T29895] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1573.115420][T29895] RBP: 00007f5110310090 R08: 0000000000000000 R09: 0000000000000000 [ 1573.115427][T29895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1573.115432][T29895] R13: 00007f510f616038 R14: 00007f510f615fa0 R15: 00007ffe2d1af328 [ 1573.115448][T29895] [ 1573.456759][T29897] IPv6: NLM_F_CREATE should be specified when creating new route [ 1573.505069][ T9981] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1573.546440][ T9981] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1573.581045][ T9981] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1573.627635][ T9981] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1573.667561][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1573.687080][ T9981] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1573.699639][ T9981] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1573.715709][ T9981] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1573.726484][ T9981] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1574.019701][T29917] lo speed is unknown, defaulting to 1000 [ 1574.107535][T29932] netlink: 'syz.4.14467': attribute type 6 has an invalid length. [ 1574.116240][T29929] netlink: 'syz.4.14467': attribute type 9 has an invalid length. [ 1574.211745][T29939] netlink: 'syz.0.14469': attribute type 21 has an invalid length. [ 1574.328041][T29945] A link change request failed with some changes committed already. Interface veth0_to_batadv may have been left with an inconsistent configuration, please check. [ 1574.354651][T29948] netlink: 'syz.0.14476': attribute type 5 has an invalid length. [ 1574.415866][T29946] syzkaller1: entered promiscuous mode [ 1574.427099][T29946] syzkaller1: entered allmulticast mode [ 1574.444651][T29917] ªªªªª9 speed is unknown, defaulting to 1000 [ 1574.585699][T29960] netlink: 'syz.4.14474': attribute type 10 has an invalid length. [ 1574.696733][T29917] ªªªªª9 speed is unknown, defaulting to 1000 [ 1574.736437][T29966] netlink: 'syz.3.14473': attribute type 1 has an invalid length. [ 1575.623400][T29973] lo speed is unknown, defaulting to 1000 [ 1576.042766][T29973] ªªªªª9 speed is unknown, defaulting to 1000 [ 1576.169477][T30007] netlink: 'syz.0.14490': attribute type 2 has an invalid length. [ 1576.200196][T30011] IPv6: NLM_F_CREATE should be specified when creating new route [ 1576.229217][T30006] x_tables: duplicate underflow at hook 2 [ 1576.239058][T30011] ksmbd: Daemon and kernel module version mismatch. ksmbd: 167, kernel module: 1. User-space ksmbd should terminate. [ 1576.239968][T30010] netlink: 'syz.3.14491': attribute type 10 has an invalid length. [ 1576.364111][T29973] ªªªªª9 speed is unknown, defaulting to 1000 [ 1576.795332][T30032] vlan4: entered promiscuous mode [ 1576.832955][T30041] sch_tbf: burst 240 is lower than device lo mtu (11337746) ! [ 1577.021910][T30055] netlink: 'syz.0.14505': attribute type 9 has an invalid length. [ 1577.083646][T30053] tipc: Enabling of bearer rejected, already enabled [ 1577.944526][T30098] lo speed is unknown, defaulting to 1000 [ 1578.047770][T30107] syzkaller0: entered allmulticast mode [ 1578.162650][T30111] netlink: 'syz.3.14524': attribute type 2 has an invalid length. [ 1578.202236][T30098] ªªªªª9 speed is unknown, defaulting to 1000 [ 1578.376120][T30120] smc: net device geneve0 erased user defined pnetid SYZ0 [ 1578.445895][T30117] __nla_validate_parse: 16 callbacks suppressed [ 1578.445914][T30117] netlink: 52 bytes leftover after parsing attributes in process `syz.1.14526'. [ 1578.484999][T30117] netlink: 76 bytes leftover after parsing attributes in process `syz.1.14526'. [ 1578.510773][T30117] netlink: 52 bytes leftover after parsing attributes in process `syz.1.14526'. [ 1578.512373][T30098] ªªªªª9 speed is unknown, defaulting to 1000 [ 1578.709120][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5040 ms [ 1578.717153][ C1] lec:lec_tx_timeout: lec0 [ 1578.721926][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1578.976935][T30153] lo speed is unknown, defaulting to 1000 [ 1579.001468][T30158] netlink: 'syz.0.14535': attribute type 1 has an invalid length. [ 1579.381258][T30169] FAULT_INJECTION: forcing a failure. [ 1579.381258][T30169] name failslab, interval 1, probability 0, space 0, times 0 [ 1579.394290][T30169] CPU: 1 UID: 0 PID: 30169 Comm: syz.2.14538 Not tainted syzkaller #0 PREEMPT(full) [ 1579.394314][T30169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1579.394325][T30169] Call Trace: [ 1579.394333][T30169] [ 1579.394342][T30169] dump_stack_lvl+0xe8/0x150 [ 1579.394369][T30169] should_fail_ex+0x412/0x560 [ 1579.394395][T30169] should_failslab+0xa8/0x100 [ 1579.394416][T30169] kmem_cache_alloc_bulk_noprof+0x8c/0x740 [ 1579.394440][T30169] ? pfn_valid+0x125/0x4c0 [ 1579.394465][T30169] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 1579.394504][T30169] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 1579.394533][T30169] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1579.394575][T30169] ? 0xffffffffa02030cc [ 1579.394590][T30169] ? 0xffffffffa0203698 [ 1579.394604][T30169] ? 0xffffffffa0203bbc [ 1579.394643][T30169] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1579.394674][T30169] ? _copy_from_user+0x94/0xb0 [ 1579.394698][T30169] ? bpf_test_init+0x113/0x150 [ 1579.394715][T30169] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1579.394738][T30169] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1579.394772][T30169] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1579.394798][T30169] ? __fget_files+0x2a/0x420 [ 1579.394821][T30169] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1579.394841][T30169] bpf_prog_test_run+0x2c7/0x340 [ 1579.394864][T30169] __sys_bpf+0x5cb/0x920 [ 1579.394884][T30169] ? __pfx___sys_bpf+0x10/0x10 [ 1579.394918][T30169] ? ksys_write+0x242/0x270 [ 1579.394943][T30169] ? __pfx_ksys_write+0x10/0x10 [ 1579.394974][T30169] __x64_sys_bpf+0x7c/0x90 [ 1579.394998][T30169] do_syscall_64+0xe2/0xf80 [ 1579.395020][T30169] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.395037][T30169] ? trace_irq_disable+0x37/0x100 [ 1579.395053][T30169] ? clear_bhb_loop+0x60/0xb0 [ 1579.395080][T30169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.395097][T30169] RIP: 0033:0x7f510f39aeb9 [ 1579.395113][T30169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1579.395128][T30169] RSP: 002b:00007f5110310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1579.395147][T30169] RAX: ffffffffffffffda RBX: 00007f510f615fa0 RCX: 00007f510f39aeb9 [ 1579.395160][T30169] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1579.395172][T30169] RBP: 00007f5110310090 R08: 0000000000000000 R09: 0000000000000000 [ 1579.395183][T30169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1579.395194][T30169] R13: 00007f510f616038 R14: 00007f510f615fa0 R15: 00007ffe2d1af328 [ 1579.395224][T30169] [ 1580.050727][T30184] netlink: 104 bytes leftover after parsing attributes in process `syz.0.14544'. [ 1580.080282][T30153] ªªªªª9 speed is unknown, defaulting to 1000 [ 1580.092736][T30182] lo speed is unknown, defaulting to 1000 [ 1580.369534][T30197] netlink: 'syz.2.14548': attribute type 6 has an invalid length. [ 1580.378312][T30196] syzkaller0: left promiscuous mode [ 1580.397560][T30196] syzkaller0: left allmulticast mode [ 1580.512934][T30191] lo speed is unknown, defaulting to 1000 [ 1580.577658][T30153] ªªªªª9 speed is unknown, defaulting to 1000 [ 1580.644162][T30182] ªªªªª9 speed is unknown, defaulting to 1000 [ 1580.906189][T30207] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14552'. [ 1580.974014][T30191] ªªªªª9 speed is unknown, defaulting to 1000 [ 1580.974042][T30182] ªªªªª9 speed is unknown, defaulting to 1000 [ 1581.045745][T30207] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14552'. [ 1581.232803][T30210] tipc: Resetting bearer [ 1581.389081][T30210] mac80211_hwsim hwsim200 wlan1: left promiscuous mode [ 1581.398524][T30217] xt_CONNSECMARK: invalid mode: 253 [ 1581.404357][T30216] netlink: 80 bytes leftover after parsing attributes in process `syz.0.14554'. [ 1581.532111][ T9981] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1581.549224][T30191] ªªªªª9 speed is unknown, defaulting to 1000 [ 1581.567826][ T9981] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1581.576289][ T9981] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1581.675723][ T9981] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1582.120986][T30233] syzkaller0: entered promiscuous mode [ 1582.126533][T30233] syzkaller0: entered allmulticast mode [ 1582.431734][T30241] syzkaller1: entered promiscuous mode [ 1582.437322][T30241] syzkaller1: entered allmulticast mode [ 1582.453350][T30243] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14564'. [ 1582.491048][T30234] lo speed is unknown, defaulting to 1000 [ 1582.699601][T30251] tap0: tun_chr_ioctl cmd 2148553947 [ 1583.056261][T30234] ªªªªª9 speed is unknown, defaulting to 1000 [ 1583.122953][T30272] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14572'. [ 1583.155086][T30272] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14572'. [ 1583.469501][T30282] netlink: 'syz.2.14577': attribute type 1 has an invalid length. [ 1583.477648][T30282] netlink: 'syz.2.14577': attribute type 2 has an invalid length. [ 1583.522253][T30234] ªªªªª9 speed is unknown, defaulting to 1000 [ 1583.607897][T30300] netlink: 'syz.3.14582': attribute type 10 has an invalid length. [ 1583.615838][T30300] __nla_validate_parse: 1 callbacks suppressed [ 1583.615853][T30300] netlink: 228 bytes leftover after parsing attributes in process `syz.3.14582'. [ 1583.635967][T30304] netlink: 'syz.0.14584': attribute type 9 has an invalid length. [ 1583.688902][T30304] netlink: 'syz.0.14584': attribute type 11 has an invalid length. [ 1583.707515][T30304] netlink: 'syz.0.14584': attribute type 12 has an invalid length. [ 1583.715562][T30304] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.14584'. [ 1583.725979][T30304] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14584'. [ 1583.754351][T30308] syzkaller0: entered promiscuous mode [ 1583.758208][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 1583.760385][T30308] syzkaller0: entered allmulticast mode [ 1583.767837][ C1] lec:lec_tx_timeout: lec0 [ 1583.825349][T30310] syzkaller0: entered promiscuous mode [ 1583.838430][T30310] syzkaller0: entered allmulticast mode [ 1584.018727][T30317] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14589'. [ 1584.056606][T30319] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14587'. [ 1584.408027][ T9989] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.443588][ T9989] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.485292][ T9989] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.493961][ T9989] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.542021][T30348] FAULT_INJECTION: forcing a failure. [ 1584.542021][T30348] name failslab, interval 1, probability 0, space 0, times 0 [ 1584.554713][T30348] CPU: 1 UID: 0 PID: 30348 Comm: syz.4.14598 Not tainted syzkaller #0 PREEMPT(full) [ 1584.554746][T30348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1584.554756][T30348] Call Trace: [ 1584.554764][T30348] [ 1584.554772][T30348] dump_stack_lvl+0xe8/0x150 [ 1584.554800][T30348] should_fail_ex+0x412/0x560 [ 1584.554826][T30348] should_failslab+0xa8/0x100 [ 1584.554848][T30348] kmem_cache_alloc_bulk_noprof+0x8c/0x740 [ 1584.554872][T30348] ? pfn_valid+0x125/0x4c0 [ 1584.554897][T30348] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 1584.554932][T30348] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 1584.554957][T30348] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1584.554997][T30348] ? 0xffffffffa02030d8 [ 1584.555012][T30348] ? 0xffffffffa0203698 [ 1584.555025][T30348] ? 0xffffffffa0203bbc [ 1584.555062][T30348] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1584.555091][T30348] ? _copy_from_user+0x94/0xb0 [ 1584.555116][T30348] ? bpf_test_init+0x113/0x150 [ 1584.555131][T30348] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1584.555152][T30348] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1584.555185][T30348] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1584.555210][T30348] ? __fget_files+0x2a/0x420 [ 1584.555233][T30348] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1584.555254][T30348] bpf_prog_test_run+0x2c7/0x340 [ 1584.555275][T30348] __sys_bpf+0x5cb/0x920 [ 1584.555294][T30348] ? __pfx___sys_bpf+0x10/0x10 [ 1584.555323][T30348] ? ksys_write+0x242/0x270 [ 1584.555347][T30348] ? __pfx_ksys_write+0x10/0x10 [ 1584.555377][T30348] __x64_sys_bpf+0x7c/0x90 [ 1584.555401][T30348] do_syscall_64+0xe2/0xf80 [ 1584.555423][T30348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1584.555439][T30348] ? trace_irq_disable+0x37/0x100 [ 1584.555456][T30348] ? clear_bhb_loop+0x60/0xb0 [ 1584.555475][T30348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1584.555493][T30348] RIP: 0033:0x7f009079aeb9 [ 1584.555507][T30348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1584.555521][T30348] RSP: 002b:00007f0091574028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1584.555541][T30348] RAX: ffffffffffffffda RBX: 00007f0090a15fa0 RCX: 00007f009079aeb9 [ 1584.555552][T30348] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1584.555564][T30348] RBP: 00007f0091574090 R08: 0000000000000000 R09: 0000000000000000 [ 1584.555573][T30348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1584.555584][T30348] R13: 00007f0090a16038 R14: 00007f0090a15fa0 R15: 00007ffda9337208 [ 1584.555613][T30348] [ 1584.977582][T30358] netlink: 16 bytes leftover after parsing attributes in process `syz.4.14600'. [ 1585.215079][T30372] tipc: Resetting bearer [ 1585.466993][T30401] netlink: 'syz.0.14611': attribute type 16 has an invalid length. [ 1585.479522][T30401] netlink: 'syz.0.14611': attribute type 17 has an invalid length. [ 1585.480693][T30400] netlink: 80 bytes leftover after parsing attributes in process `syz.4.14612'. [ 1585.609861][T30401] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1585.626516][T30401] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1585.721967][T30418] netlink: 'syz.2.14616': attribute type 1 has an invalid length. [ 1585.732178][T30419] FAULT_INJECTION: forcing a failure. [ 1585.732178][T30419] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1585.782177][T30419] CPU: 0 UID: 0 PID: 30419 Comm: syz.0.14617 Not tainted syzkaller #0 PREEMPT(full) [ 1585.782202][T30419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1585.782213][T30419] Call Trace: [ 1585.782221][T30419] [ 1585.782229][T30419] dump_stack_lvl+0xe8/0x150 [ 1585.782257][T30419] should_fail_ex+0x412/0x560 [ 1585.782283][T30419] _copy_from_user+0x2d/0xb0 [ 1585.782309][T30419] __sys_bpf+0x229/0x920 [ 1585.782330][T30419] ? __pfx___sys_bpf+0x10/0x10 [ 1585.782364][T30419] ? ksys_write+0x242/0x270 [ 1585.782399][T30419] ? __pfx_ksys_write+0x10/0x10 [ 1585.782429][T30419] __x64_sys_bpf+0x7c/0x90 [ 1585.782454][T30419] do_syscall_64+0xe2/0xf80 [ 1585.782477][T30419] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1585.782494][T30419] ? trace_irq_disable+0x37/0x100 [ 1585.782512][T30419] ? clear_bhb_loop+0x60/0xb0 [ 1585.782533][T30419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1585.782550][T30419] RIP: 0033:0x7f015139aeb9 [ 1585.782567][T30419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1585.782583][T30419] RSP: 002b:00007f01522ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1585.782602][T30419] RAX: ffffffffffffffda RBX: 00007f0151615fa0 RCX: 00007f015139aeb9 [ 1585.782616][T30419] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 1585.782627][T30419] RBP: 00007f01522ec090 R08: 0000000000000000 R09: 0000000000000000 [ 1585.782639][T30419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1585.782650][T30419] R13: 00007f0151616038 R14: 00007f0151615fa0 R15: 00007ffda1f149d8 [ 1585.782681][T30419] [ 1585.815668][T30426] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14616'. [ 1586.097127][T30441] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14625'. [ 1586.106685][T30441] netlink: 39 bytes leftover after parsing attributes in process `syz.4.14625'. [ 1586.422006][T30465] FAULT_INJECTION: forcing a failure. [ 1586.422006][T30465] name failslab, interval 1, probability 0, space 0, times 0 [ 1586.455027][T30465] CPU: 1 UID: 0 PID: 30465 Comm: syz.3.14632 Not tainted syzkaller #0 PREEMPT(full) [ 1586.455052][T30465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1586.455064][T30465] Call Trace: [ 1586.455071][T30465] [ 1586.455079][T30465] dump_stack_lvl+0xe8/0x150 [ 1586.455106][T30465] should_fail_ex+0x412/0x560 [ 1586.455132][T30465] should_failslab+0xa8/0x100 [ 1586.455153][T30465] __kmalloc_noprof+0xde/0x7e0 [ 1586.455171][T30465] ? bpf_test_init+0x9f/0x150 [ 1586.455195][T30465] bpf_test_init+0x9f/0x150 [ 1586.455218][T30465] bpf_prog_test_run_skb+0x36f/0x1c90 [ 1586.455249][T30465] ? __fget_files+0x2a/0x420 [ 1586.455268][T30465] ? __fget_files+0x3a0/0x420 [ 1586.455285][T30465] ? __fget_files+0x2a/0x420 [ 1586.455308][T30465] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1586.455329][T30465] bpf_prog_test_run+0x2c7/0x340 [ 1586.455352][T30465] __sys_bpf+0x5cb/0x920 [ 1586.455372][T30465] ? __pfx___sys_bpf+0x10/0x10 [ 1586.455404][T30465] ? ksys_write+0x242/0x270 [ 1586.455429][T30465] ? __pfx_ksys_write+0x10/0x10 [ 1586.455458][T30465] __x64_sys_bpf+0x7c/0x90 [ 1586.455482][T30465] do_syscall_64+0xe2/0xf80 [ 1586.455505][T30465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1586.455521][T30465] ? trace_irq_disable+0x37/0x100 [ 1586.455538][T30465] ? clear_bhb_loop+0x60/0xb0 [ 1586.455558][T30465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1586.455575][T30465] RIP: 0033:0x7f927d59aeb9 [ 1586.455592][T30465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1586.455607][T30465] RSP: 002b:00007f927e3b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1586.455627][T30465] RAX: ffffffffffffffda RBX: 00007f927d815fa0 RCX: 00007f927d59aeb9 [ 1586.455647][T30465] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 1586.455659][T30465] RBP: 00007f927e3b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1586.455670][T30465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1586.455681][T30465] R13: 00007f927d816038 R14: 00007f927d815fa0 R15: 00007ffc1837a548 [ 1586.455711][T30465] [ 1586.737597][T30469] xfrm0: Caught tx_queue_len zero misconfig [ 1586.772408][T30469] bridge8: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1586.913532][T30486] 0ªX¹¦À: renamed from caif0 [ 1586.938221][T30486] 0ªX¹¦À: entered allmulticast mode [ 1586.943488][T30486] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 1586.963114][T30487] 1ªX¹¦À: renamed from 60ªX¹¦À [ 1586.989176][T30487] A link change request failed with some changes committed already. Interface 61ªX¹¦À may have been left with an inconsistent configuration, please check. [ 1587.032850][T30494] netlink: 'syz.3.14644': attribute type 10 has an invalid length. [ 1587.054472][T30494] bond0: (slave wlan1): Opening slave failed [ 1587.490126][T30525] lo speed is unknown, defaulting to 1000 [ 1587.711684][T30525] ªªªªª9 speed is unknown, defaulting to 1000 [ 1587.883563][T30530] syzkaller0: entered promiscuous mode [ 1587.889411][T30530] syzkaller0: entered allmulticast mode [ 1587.941413][T30532] lo speed is unknown, defaulting to 1000 [ 1588.209494][T30525] ªªªªª9 speed is unknown, defaulting to 1000 [ 1588.331798][T30551] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1588.353371][T30532] ªªªªª9 speed is unknown, defaulting to 1000 [ 1588.652266][T30568] __nla_validate_parse: 8 callbacks suppressed [ 1588.652284][T30568] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14673'. [ 1588.683438][T30570] validate_nla: 3 callbacks suppressed [ 1588.683456][T30570] netlink: 'syz.3.14672': attribute type 83 has an invalid length. [ 1588.721234][T30570] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14672'. [ 1588.737314][T30570] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14672'. [ 1588.788898][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1588.918551][T30532] ªªªªª9 speed is unknown, defaulting to 1000 [ 1589.919932][T30622] atomic_op ffff88804694b998 conn xmit_atomic 0000000000000000 [ 1590.279619][T30651] syzkaller0: entered promiscuous mode [ 1590.292126][T30651] syzkaller0: entered allmulticast mode [ 1590.574293][T30667] netlink: 140 bytes leftover after parsing attributes in process `syz.0.14705'. [ 1590.684501][T30678] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14709'. [ 1590.715381][T30673] lo speed is unknown, defaulting to 1000 [ 1590.812210][T30683] netlink: 36 bytes leftover after parsing attributes in process `syz.0.14711'. [ 1590.828551][T30685] netlink: 1004 bytes leftover after parsing attributes in process `syz.4.14712'. [ 1590.838500][T30685] gre0: left promiscuous mode [ 1590.843194][T30685] gre0: left allmulticast mode [ 1590.880965][T30683] netlink: 'syz.0.14711': attribute type 1 has an invalid length. [ 1590.888966][T30683] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.14711'. [ 1590.934437][T30690] netlink: 'syz.3.14714': attribute type 3 has an invalid length. [ 1590.945508][T30690] netlink: 3 bytes leftover after parsing attributes in process `syz.3.14714'. [ 1590.959701][T30690] netlink: 40 bytes leftover after parsing attributes in process `syz.3.14714'. [ 1591.086015][ T30] audit: type=1107 audit(1770417281.682:32): pid=30692 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=' [ 1591.086015][ T30] ' [ 1591.167697][T30673] ªªªªª9 speed is unknown, defaulting to 1000 [ 1591.418160][T30673] ªªªªª9 speed is unknown, defaulting to 1000 [ 1591.708435][T30727] xfrm2: entered allmulticast mode [ 1592.129566][T30747] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 1592.573811][T30754] netlink: 'syz.0.14733': attribute type 1 has an invalid length. [ 1593.587953][T24162] Bluetooth: hci4: command 0x0406 tx timeout [ 1593.793546][T30819] IPv6: addrconf: prefix option has invalid lifetime [ 1593.800621][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1593.808645][ C1] lec:lec_tx_timeout: lec0 [ 1593.827613][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1593.966198][T30822] __nla_validate_parse: 13 callbacks suppressed [ 1593.966217][T30822] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14752'. [ 1593.978374][T30827] lo speed is unknown, defaulting to 1000 [ 1593.983790][T30822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1594.023064][T30822] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1594.085613][T30831] netlink: 20 bytes leftover after parsing attributes in process `syz.0.14755'. [ 1594.100339][T30831] nbd: must specify a device to reconfigure [ 1594.227358][T30835] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14757'. [ 1594.265530][T30835] openvswitch: netlink: Key type 148 is out of range max 32 [ 1594.271014][T30839] syzkaller0: entered promiscuous mode [ 1594.297654][T30839] syzkaller0: entered allmulticast mode [ 1594.309534][T30827] ªªªªª9 speed is unknown, defaulting to 1000 [ 1594.630053][T30852] netlink: 'syz.2.14762': attribute type 1 has an invalid length. [ 1594.772255][T30853] bond4: (slave gretap3): making interface the new active one [ 1594.784351][T30870] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14765'. [ 1594.794309][T30853] bond4: (slave gretap3): Enslaving as an active interface with an up link [ 1594.808179][T30827] ªªªªª9 speed is unknown, defaulting to 1000 [ 1594.848469][T30873] openvswitch: netlink: IP tunnel dst address not specified [ 1594.973698][T30877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14769'. [ 1595.085991][T30883] IPVS: set_ctl: invalid protocol: 4 0.0.0.0:20004 [ 1595.171871][T30883] : renamed from bond_slave_0 [ 1595.299791][T30890] netlink: 40 bytes leftover after parsing attributes in process `syz.1.14771'. [ 1595.326266][T30890] netlink: 40 bytes leftover after parsing attributes in process `syz.1.14771'. [ 1595.367528][T30890] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1595.437513][T30884] netlink: 260 bytes leftover after parsing attributes in process `syz.2.14769'. [ 1595.464460][T30894] netlink: 212048 bytes leftover after parsing attributes in process `syz.4.14772'. [ 1595.873539][T30891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14768'. [ 1595.886060][T30891] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1595.956222][T30909] bond5: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 1596.031874][T30909] bond5 (unregistering): Released all slaves [ 1596.132482][T30915] netlink: 'syz.4.14776': attribute type 3 has an invalid length. [ 1596.151832][T30915] netlink: 'syz.4.14776': attribute type 1 has an invalid length. [ 1596.199695][T30911] vxcan1: entered promiscuous mode [ 1596.664602][T30937] netlink: 'syz.2.14781': attribute type 15 has an invalid length. [ 1596.713799][T30950] netlink: 'syz.0.14785': attribute type 9 has an invalid length. [ 1596.722385][T30950] netlink: 'syz.0.14785': attribute type 10 has an invalid length. [ 1596.786909][T30948] gtp0: entered promiscuous mode [ 1596.797711][T30948] gtp0: entered allmulticast mode [ 1596.807189][ T9990] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1596.828000][ T9990] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1596.867987][ T9990] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1596.896693][ T9990] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1597.010603][T30960] lo speed is unknown, defaulting to 1000 [ 1597.026228][T30956] netlink: 'syz.2.14788': attribute type 11 has an invalid length. [ 1597.287738][T30978] bridge4: entered promiscuous mode [ 1597.293068][T30978] bridge4: entered allmulticast mode [ 1597.473267][T30960] ªªªªª9 speed is unknown, defaulting to 1000 [ 1597.669550][T30960] ªªªªª9 speed is unknown, defaulting to 1000 [ 1597.953011][T30995] netlink: 'syz.2.14796': attribute type 1 has an invalid length. [ 1597.983260][T30991] syzkaller0: entered promiscuous mode [ 1598.001449][T30991] syzkaller0: entered allmulticast mode [ 1598.025417][T30991] 0: reclassify loop, rule prio 0, protocol 700 [ 1598.061646][T30993] lo speed is unknown, defaulting to 1000 [ 1598.100781][T30998] bond5: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1598.128777][T30998] bond5: (slave vxcan5): Error -95 calling set_mac_address [ 1598.411189][T30993] ªªªªª9 speed is unknown, defaulting to 1000 [ 1598.735077][T30993] ªªªªª9 speed is unknown, defaulting to 1000 [ 1598.837533][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1598.845616][ C1] lec:lec_tx_timeout: lec0 [ 1598.868159][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1598.970510][T31029] __nla_validate_parse: 9 callbacks suppressed [ 1598.970530][T31029] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14804'. [ 1599.061379][T31031] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14805'. [ 1599.099531][T31029] netlink: 'syz.0.14804': attribute type 4 has an invalid length. [ 1599.130945][T31027] lo speed is unknown, defaulting to 1000 [ 1599.356637][T31038] netlink: 'syz.1.14807': attribute type 1 has an invalid length. [ 1599.413169][T31037] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1599.452914][T31027] ªªªªª9 speed is unknown, defaulting to 1000 [ 1599.838477][T31027] ªªªªª9 speed is unknown, defaulting to 1000 [ 1600.989265][T31069] lo speed is unknown, defaulting to 1000 [ 1601.203487][ T30] audit: type=1804 audit(1770417291.802:33): pid=31084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.14817" name="/newroot/558/cgroup.controllers" dev="tmpfs" ino=2853 res=1 errno=0 [ 1601.263723][ T30] audit: type=1800 audit(1770417291.802:34): pid=31084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.14817" name="cgroup.controllers" dev="tmpfs" ino=2853 res=0 errno=0 [ 1601.673036][T31069] ªªªªª9 speed is unknown, defaulting to 1000 [ 1602.039349][T31069] ªªªªª9 speed is unknown, defaulting to 1000 [ 1602.477064][T31122] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1602.595302][T31045] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1602.986482][T31149] netlink: 'syz.4.14832': attribute type 3 has an invalid length. [ 1603.008428][T31149] netlink: 'syz.4.14832': attribute type 3 has an invalid length. [ 1603.024753][T31152] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1603.069149][T31152] batadv1: entered allmulticast mode [ 1603.094368][T31152] team0: Port device batadv1 added [ 1603.346648][T31175] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14838'. [ 1603.378425][T31169] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14838'. [ 1603.406410][T31177] netlink: 'syz.4.14840': attribute type 32 has an invalid length. [ 1603.415066][T31177] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14840'. [ 1603.603148][T31177] bond5: Setting coupled_control to off (0) [ 1603.763804][T31199] syzkaller0: entered promiscuous mode [ 1603.780012][T31199] syzkaller0: entered allmulticast mode [ 1603.877467][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1603.885527][ C1] lec:lec_tx_timeout: lec0 [ 1603.890278][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 1603.914289][T31199] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1604.332849][T31217] bridge0: left promiscuous mode [ 1604.343836][T31217] bridge0: entered promiscuous mode [ 1604.399882][T31217] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1604.426965][T31217] 8021q: adding VLAN 0 to HW filter on device team0 [ 1604.433000][T31237] netlink: 1496 bytes leftover after parsing attributes in process `syz.4.14853'. [ 1604.636343][T31217] 1ªX¹¦À: left allmulticast mode [ 1604.642291][T31217] A link change request failed with some changes committed already. Interface 61ªX¹¦À may have been left with an inconsistent configuration, please check. [ 1605.365344][T31284] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14862'. [ 1605.385407][T31292] openvswitch: netlink: Message has 4 unknown bytes. [ 1605.398008][T31284] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14862'. [ 1605.599087][T31300] netlink: 44 bytes leftover after parsing attributes in process `syz.2.14868'. [ 1605.626214][T31300] netlink: 44 bytes leftover after parsing attributes in process `syz.2.14868'. [ 1605.742203][T31307] lo speed is unknown, defaulting to 1000 [ 1605.782642][T31311] xt_hashlimit: size too large, truncated to 1048576 [ 1605.919822][T24162] block nbd1: Receive control failed (result -32) [ 1606.156069][T31319] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14873'. [ 1606.165234][T31319] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14873'. [ 1606.203758][T31319] netlink: 'syz.4.14873': attribute type 1 has an invalid length. [ 1606.211807][T31319] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14873'. [ 1606.234341][T31326] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14875'. [ 1606.493181][T31307] ªªªªª9 speed is unknown, defaulting to 1000 [ 1606.843557][T31342] syzkaller0: entered promiscuous mode [ 1606.890814][T31342] syzkaller0: entered allmulticast mode [ 1606.952716][T31353] xt_hashlimit: size too large, truncated to 1048576 [ 1607.276034][ T1301] aoe: packet could not be sent on lec0. consider increasing tx_queue_len [ 1608.901900][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1608.909935][ C1] lec:lec_tx_timeout: lec0 [ 1609.061637][T31381] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14889'. [ 1609.116224][T31307] ªªªªª9 speed is unknown, defaulting to 1000 [ 1609.122524][T31362] tipc: Enabling of bearer rejected, already enabled [ 1609.385095][T31390] netlink: 'syz.3.14891': attribute type 11 has an invalid length. [ 1609.479395][T31388] bond6: entered promiscuous mode [ 1609.503590][T31390] __nla_validate_parse: 2 callbacks suppressed [ 1609.503609][T31390] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14891'. [ 1609.786635][ T9990] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1609.829231][ T9990] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1609.861727][ T9990] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1609.878957][T31411] ip6t_srh: unknown srh match flags 4000 [ 1610.186403][T31427] lo speed is unknown, defaulting to 1000 [ 1610.350641][ T5826] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1610.371154][ T5826] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1610.396762][ T5826] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1610.406477][ T5826] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1610.417610][ T5826] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1610.462841][T31440] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14905'. [ 1610.485506][T31440] netlink: 20 bytes leftover after parsing attributes in process `syz.0.14905'. [ 1610.495293][T31440] netlink: 20 bytes leftover after parsing attributes in process `syz.0.14905'. [ 1610.573976][T31447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14907'. [ 1610.780089][T31427] ªªªªª9 speed is unknown, defaulting to 1000 [ 1610.787175][T31435] lo speed is unknown, defaulting to 1000 [ 1610.860211][T31454] netlink: 'syz.2.14908': attribute type 10 has an invalid length. [ 1610.889506][T31454] team0: Cannot enslave team device to itself [ 1610.913225][T31454] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14908'. [ 1610.937137][T31454] netlink: 165 bytes leftover after parsing attributes in process `syz.2.14908'. [ 1611.339155][T31427] ªªªªª9 speed is unknown, defaulting to 1000 [ 1611.361170][T31435] ªªªªª9 speed is unknown, defaulting to 1000 [ 1611.705683][T31491] netlink: 'syz.0.14918': attribute type 11 has an invalid length. [ 1611.706219][T31490] netlink: 'syz.2.14919': attribute type 29 has an invalid length. [ 1611.740711][T31491] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.14918'. [ 1611.745700][T31435] ªªªªª9 speed is unknown, defaulting to 1000 [ 1611.757999][T31490] netlink: 'syz.2.14919': attribute type 29 has an invalid length. [ 1611.771872][T31491] netlink: ct family unspecified [ 1611.778294][T31490] netlink: 500 bytes leftover after parsing attributes in process `syz.2.14919'. [ 1612.274406][T31507] xt_connbytes: Forcing CT accounting to be enabled [ 1612.304537][T31507] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1612.467867][T24162] Bluetooth: hci3: command tx timeout [ 1612.478264][T31519] sctp: [Deprecated]: syz.1.14929 (pid 31519) Use of int in max_burst socket option deprecated. [ 1612.478264][T31519] Use struct sctp_assoc_value instead [ 1612.547285][T31512] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1612.558617][T31512] vlan2: left promiscuous mode [ 1612.563510][T31512] vlan2: left allmulticast mode [ 1612.568790][T31512] geneve1: left allmulticast mode [ 1612.574972][T31512] bond5: left promiscuous mode [ 1612.579837][T31512] bridge9: left promiscuous mode [ 1612.584880][T31512] bond5: left allmulticast mode [ 1612.589971][T31512] bridge9: left allmulticast mode [ 1612.597973][T31512] bridge12: left allmulticast mode [ 1612.603314][T31512] ip6gre1: left promiscuous mode [ 1612.608788][T31512] ip6gre1: left allmulticast mode [ 1612.614115][T31512] bond6: left promiscuous mode [ 1612.619374][T31512] geneve2: left promiscuous mode [ 1612.624915][T31512] bond9: left promiscuous mode [ 1612.630028][T31512] bridge14: left promiscuous mode [ 1612.635147][T31512] bond9: left allmulticast mode [ 1612.640320][T31512] bridge14: left allmulticast mode [ 1612.654882][T31512] gtp0: left promiscuous mode [ 1612.659767][T31512] gtp0: left allmulticast mode [ 1612.825202][T31435] chnl_net:caif_netlink_parms(): no params data found [ 1612.940038][T31531] ipvlan4: entered promiscuous mode [ 1612.965571][T31535] sctp: [Deprecated]: syz.3.14934 (pid 31535) Use of int in max_burst socket option. [ 1612.965571][T31535] Use struct sctp_assoc_value instead [ 1613.034644][T31435] bridge0: port 1(bridge_slave_0) entered blocking state [ 1613.043826][T31435] bridge0: port 1(bridge_slave_0) entered disabled state [ 1613.051359][T31435] bridge_slave_0: entered allmulticast mode [ 1613.059455][T31435] bridge_slave_0: entered promiscuous mode [ 1613.071553][T31435] bridge0: port 2(bridge_slave_1) entered blocking state [ 1613.098139][T31435] bridge0: port 2(bridge_slave_1) entered disabled state [ 1613.105560][T31435] bridge_slave_1: entered allmulticast mode [ 1613.113912][T31435] bridge_slave_1: entered promiscuous mode [ 1613.176511][T31546] netlink: 36 bytes leftover after parsing attributes in process `syz.2.14937'. [ 1613.192052][T31435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1613.239872][T31435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1613.283222][T31435] team0: Port device team_slave_0 added [ 1613.293642][T31435] team0: Port device team_slave_1 added [ 1613.390689][T31435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1613.392904][T31557] netlink: 'syz.2.14940': attribute type 1 has an invalid length. [ 1613.447678][T31435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1613.516366][T31435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1613.551836][T31435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1613.592370][T31435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1613.621038][T31435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1613.721435][T31569] lo speed is unknown, defaulting to 1000 [ 1613.792205][T31583] SET target dimension over the limit! [ 1613.802347][T31571] netlink: 'syz.3.14944': attribute type 11 has an invalid length. [ 1613.816943][T31435] hsr_slave_0: entered promiscuous mode [ 1613.825518][T31435] hsr_slave_1: entered promiscuous mode [ 1613.836144][T31435] debugfs: 'hsr0' already exists in 'hsr' [ 1613.842852][T31435] Cannot create hsr debugfs directory [ 1614.041745][T31587] pim6reg1: entered promiscuous mode [ 1614.051207][T31587] pim6reg1: entered allmulticast mode [ 1614.058021][T31569] ªªªªª9 speed is unknown, defaulting to 1000 [ 1614.058070][T31579] lo speed is unknown, defaulting to 1000 [ 1614.074871][T31435] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1614.097781][T31435] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1614.116037][T31435] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1614.127052][T31435] netdevsim netdevsim4 eth3 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1614.243589][T31435] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1614.254926][T31435] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1614.267129][T31435] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1614.337554][T31435] netdevsim netdevsim4 eth2 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1614.379470][T31569] ªªªªª9 speed is unknown, defaulting to 1000 [ 1614.437212][T31435] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1614.448616][T31435] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1614.459378][T31435] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1614.471032][T31435] netdevsim netdevsim4 eth1 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1614.484498][T31579] ªªªªª9 speed is unknown, defaulting to 1000 [ 1614.552612][T24162] Bluetooth: hci3: command tx timeout [ 1614.582400][T31435] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1614.592638][T31435] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1614.604072][T31435] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1614.664853][T31435] netdevsim netdevsim4 eth0 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1614.802941][T31579] ªªªªª9 speed is unknown, defaulting to 1000 [ 1615.161130][T31435] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1615.174412][T31435] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1615.198783][T31435] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1615.228937][T31435] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1615.329240][T31607] __nla_validate_parse: 1 callbacks suppressed [ 1615.329260][T31607] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14954'. [ 1615.792658][T31435] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1615.834485][T31435] 8021q: adding VLAN 0 to HW filter on device team0 [ 1615.888844][ T9981] bridge0: port 1(bridge_slave_0) entered blocking state [ 1615.896014][ T9981] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1615.907174][ T9981] bridge0: port 2(bridge_slave_1) entered blocking state [ 1615.914367][ T9981] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1616.033815][T31635] netlink: 'syz.3.14961': attribute type 1 has an invalid length. [ 1616.045059][T31635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14961'. [ 1616.054875][T31635] netlink: 364 bytes leftover after parsing attributes in process `syz.3.14961'. [ 1616.064500][T31635] netlink: 88 bytes leftover after parsing attributes in process `syz.3.14961'. [ 1616.089887][T31635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14961'. [ 1616.598546][T31435] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1616.631888][T24162] Bluetooth: hci3: command tx timeout [ 1617.177807][T31435] veth0_vlan: entered promiscuous mode [ 1617.227156][T31435] veth1_vlan: entered promiscuous mode [ 1617.304927][T31435] veth0_macvtap: entered promiscuous mode [ 1617.330192][T31435] veth1_macvtap: entered promiscuous mode [ 1617.367086][T31681] syz_tun: entered allmulticast mode [ 1617.409098][T31681] dvmrp6: entered allmulticast mode [ 1617.440813][T31681] tipc: Enabling of bearer rejected, already enabled [ 1617.466096][T31680] syz_tun: left allmulticast mode [ 1617.478554][T31435] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1617.496213][T31435] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1617.526536][T10011] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1617.538336][T10011] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1617.566474][T10011] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1617.579940][T10011] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1617.671762][T31697] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14978'. [ 1618.009262][T10011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1618.031750][T10011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1618.102771][T31713] xt_hashlimit: size too large, truncated to 1048576 [ 1618.136270][T31713] xt_hashlimit: invalid interval [ 1618.189848][ T9997] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1618.199694][ T9997] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1618.590758][T31741] netlink: 72 bytes leftover after parsing attributes in process `syz.2.14988'. [ 1618.709895][T24162] Bluetooth: hci3: command tx timeout [ 1618.725448][T31748] netlink: 16 bytes leftover after parsing attributes in process `syz.4.14991'. [ 1618.742891][T31748] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14991'. [ 1618.872998][T31754] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14993'. [ 1619.446715][ T5826] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1619.456813][ T5826] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1619.465653][ T5826] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1619.483095][ T5826] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1619.491523][ T5826] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1619.555384][T31786] lo speed is unknown, defaulting to 1000 [ 1619.664333][T31792] syzkaller0: entered promiscuous mode [ 1619.687769][T31792] syzkaller0: entered allmulticast mode [ 1619.808344][T31786] ªªªªª9 speed is unknown, defaulting to 1000 [ 1620.009077][T31786] ªªªªª9 speed is unknown, defaulting to 1000 [ 1620.176773][T31786] chnl_net:caif_netlink_parms(): no params data found [ 1620.330683][T31786] bridge0: port 1(bridge_slave_0) entered blocking state [ 1620.338002][T31786] bridge0: port 1(bridge_slave_0) entered disabled state [ 1620.345823][T31786] bridge_slave_0: entered allmulticast mode [ 1620.346105][T31810] netlink: 'syz.1.15007': attribute type 13 has an invalid length. [ 1620.353812][T31786] bridge_slave_0: entered promiscuous mode [ 1620.362940][T31810] netlink: 'syz.1.15007': attribute type 17 has an invalid length. [ 1620.369063][T31786] bridge0: port 2(bridge_slave_1) entered blocking state [ 1620.381685][T31786] bridge0: port 2(bridge_slave_1) entered disabled state [ 1620.389010][T31786] bridge_slave_1: entered allmulticast mode [ 1620.396061][T31786] bridge_slave_1: entered promiscuous mode [ 1620.407147][T31810] gre0: left promiscuous mode [ 1620.412047][T31810] gre0: left allmulticast mode [ 1620.437481][T31810] syz_tun: left promiscuous mode [ 1620.454572][T31810] bridge0: left allmulticast mode [ 1620.463900][T31810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1620.473477][T31810] 8021q: adding VLAN 0 to HW filter on device team0 [ 1620.484385][T31810] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1620.525675][T31786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1620.538103][T31786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1620.578931][T31786] team0: Port device team_slave_0 added [ 1620.587176][T31786] team0: Port device team_slave_1 added [ 1620.620476][T31786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1620.628283][T31786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1620.654565][T31786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1620.667917][T31813] __nla_validate_parse: 1 callbacks suppressed [ 1620.667933][T31813] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15008'. [ 1620.668216][T31786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1620.676147][T31813] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15008'. [ 1620.684173][T31786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1620.726218][T31813] netlink: 'syz.1.15008': attribute type 1 has an invalid length. [ 1620.738699][T31786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1620.783182][T31813] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15008'. [ 1620.793784][T31813] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 1620.796513][T31786] hsr_slave_0: entered promiscuous mode [ 1620.810243][T31786] hsr_slave_1: entered promiscuous mode [ 1620.816686][T31786] debugfs: 'hsr0' already exists in 'hsr' [ 1620.822563][T31786] Cannot create hsr debugfs directory [ 1621.588142][T24162] Bluetooth: hci5: command tx timeout [ 1621.988080][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1622.007747][T31760] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1622.054523][T31786] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1622.121213][T31786] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1622.168790][T31786] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1622.184083][T31829] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15012'. [ 1622.197742][T31829] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15012'. [ 1622.206788][T31829] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15012'. [ 1622.219148][T31833] netlink: 40 bytes leftover after parsing attributes in process `syz.1.15015'. [ 1622.255030][T31829] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15012'. [ 1622.278918][T31829] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15012'. [ 1622.298649][T31829] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15012'. [ 1622.316882][T31786] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1622.533823][T31859] lo speed is unknown, defaulting to 1000 [ 1622.599157][T31786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1622.621963][T31786] 8021q: adding VLAN 0 to HW filter on device team0 [ 1622.645147][ T9997] bridge0: port 1(bridge_slave_0) entered blocking state [ 1622.652348][ T9997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1622.694560][ T9994] bridge0: port 2(bridge_slave_1) entered blocking state [ 1622.701735][ T9994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1622.993751][T31859] ªªªªª9 speed is unknown, defaulting to 1000 [ 1623.001904][T31862] lo speed is unknown, defaulting to 1000 [ 1623.025273][T31786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1623.052002][T31860] syzkaller0: entered promiscuous mode [ 1623.064663][T31860] syzkaller0: entered allmulticast mode [ 1623.156899][T31786] veth0_vlan: entered promiscuous mode [ 1623.194624][T31786] veth1_vlan: entered promiscuous mode [ 1623.260279][T31786] veth0_macvtap: entered promiscuous mode [ 1623.302780][T31786] veth1_macvtap: entered promiscuous mode [ 1623.439161][T31786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1623.465045][T31786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1623.481951][T31862] ªªªªª9 speed is unknown, defaulting to 1000 [ 1623.488417][T10011] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1623.499471][T31859] ªªªªª9 speed is unknown, defaulting to 1000 [ 1623.520127][T10011] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1623.530927][T10011] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1623.563321][T10011] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1623.668967][T24162] Bluetooth: hci5: command tx timeout [ 1623.722602][T31862] ªªªªª9 speed is unknown, defaulting to 1000 [ 1625.319634][T31857] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1625.440678][T10011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1625.469073][T10011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1625.586687][T31898] netlink: 'syz.4.15028': attribute type 1 has an invalid length. [ 1625.620739][T31900] netlink: 'syz.3.15027': attribute type 3 has an invalid length. [ 1625.623868][T10005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1625.642870][T31900] netlink: 'syz.3.15027': attribute type 1 has an invalid length. [ 1625.646927][T10005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1625.713668][T31900] bond13: entered promiscuous mode [ 1625.719918][T31900] 8021q: adding VLAN 0 to HW filter on device bond13 [ 1625.747970][T24162] Bluetooth: hci5: command tx timeout [ 1625.813947][T31907] bond13: (slave bridge4): making interface the new active one [ 1625.830138][T31907] bridge4: entered promiscuous mode [ 1625.837148][T31907] bond13: (slave bridge4): Enslaving as an active interface with an up link [ 1625.929847][T31912] bond6: option mode: invalid value (254) [ 1625.946377][T31912] bond6 (unregistering): Released all slaves [ 1625.991571][T31925] netlink: 'syz.1.15031': attribute type 10 has an invalid length. [ 1626.022713][T31915] macvlan2: entered promiscuous mode [ 1626.028642][T31915] macvlan2: entered allmulticast mode [ 1626.128981][T31939] __nla_validate_parse: 1 callbacks suppressed [ 1626.128998][T31939] netlink: 20 bytes leftover after parsing attributes in process `syz.2.15034'. [ 1626.195812][T31939] vlan3: entered promiscuous mode [ 1626.385104][T31950] bridge0: port 1(bridge_slave_0) entered disabled state [ 1626.548632][ T5826] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1626.561098][ T5826] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1626.572033][ T5826] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1626.581878][ T5826] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1626.607886][ T5826] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1626.780081][T31956] lo speed is unknown, defaulting to 1000 [ 1626.797335][T31966] netlink: 'syz.2.15041': attribute type 31 has an invalid length. [ 1626.814659][T31966] netlink: 'syz.2.15041': attribute type 1 has an invalid length. [ 1626.909414][T21129] bond0: (slave syz_tun): Releasing backup interface [ 1626.957043][T31971] sctp: [Deprecated]: syz.3.15043 (pid 31971) Use of int in max_burst socket option. [ 1626.957043][T31971] Use struct sctp_assoc_value instead [ 1627.077873][T31975] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15045'. [ 1627.242598][T31956] ªªªªª9 speed is unknown, defaulting to 1000 [ 1627.340875][T31992] netlink: 'syz.4.15047': attribute type 4 has an invalid length. [ 1627.368821][T31987] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15044'. [ 1627.485813][T31996] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15050'. [ 1627.501629][T31998] [ 1627.503978][T31998] ====================================================== [ 1627.510988][T31998] WARNING: possible circular locking dependency detected [ 1627.518000][T31998] syzkaller #0 Not tainted [ 1627.522394][T31998] ------------------------------------------------------ [ 1627.529392][T31998] syz.2.15049/31998 is trying to acquire lock: [ 1627.535525][T31998] ffffffff8fb28318 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x40c/0xf90 [ 1627.544659][T31998] [ 1627.544659][T31998] but task is already holding lock: [ 1627.552004][T31998] ffff88809230b570 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x215/0xf90 [ 1627.561226][T31998] [ 1627.561226][T31998] which lock already depends on the new lock. [ 1627.561226][T31998] [ 1627.571616][T31998] [ 1627.571616][T31998] the existing dependency chain (in reverse order) is: [ 1627.580610][T31998] [ 1627.580610][T31998] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 1627.588588][T31998] _raw_spin_lock_bh+0x36/0x50 [ 1627.593866][T31998] nr_rt_ioctl+0x215/0xf90 [ 1627.598796][T31998] sock_do_ioctl+0x101/0x320 [ 1627.603893][T31998] sock_ioctl+0x5c6/0x7f0 [ 1627.608725][T31998] __se_sys_ioctl+0xfc/0x170 [ 1627.613828][T31998] do_syscall_64+0xe2/0xf80 [ 1627.618867][T31998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.625282][T31998] [ 1627.625282][T31998] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 1627.633102][T31998] _raw_spin_lock_bh+0x36/0x50 [ 1627.638387][T31998] nr_rt_device_down+0xbe/0x860 [ 1627.643751][T31998] nr_device_event+0x137/0x150 [ 1627.649026][T31998] notifier_call_chain+0x19d/0x3a0 [ 1627.654644][T31998] __dev_notify_flags+0x16d/0x310 [ 1627.660178][T31998] netif_change_flags+0xe8/0x1a0 [ 1627.665629][T31998] dev_change_flags+0x130/0x260 [ 1627.670985][T31998] dev_ioctl+0x7b4/0x1150 [ 1627.675824][T31998] sock_do_ioctl+0x23e/0x320 [ 1627.680923][T31998] sock_ioctl+0x5c6/0x7f0 [ 1627.685767][T31998] __se_sys_ioctl+0xfc/0x170 [ 1627.690888][T31998] do_syscall_64+0xe2/0xf80 [ 1627.695911][T31998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.702313][T31998] [ 1627.702313][T31998] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 1627.710215][T31998] __lock_acquire+0x15a5/0x2cf0 [ 1627.715583][T31998] lock_acquire+0x106/0x330 [ 1627.720599][T31998] _raw_spin_lock_bh+0x36/0x50 [ 1627.725872][T31998] nr_rt_ioctl+0x40c/0xf90 [ 1627.730799][T31998] sock_do_ioctl+0x101/0x320 [ 1627.735903][T31998] sock_ioctl+0x5c6/0x7f0 [ 1627.740735][T31998] __se_sys_ioctl+0xfc/0x170 [ 1627.745840][T31998] do_syscall_64+0xe2/0xf80 [ 1627.750853][T31998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.757252][T31998] [ 1627.757252][T31998] other info that might help us debug this: [ 1627.757252][T31998] [ 1627.767463][T31998] Chain exists of: [ 1627.767463][T31998] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 1627.767463][T31998] [ 1627.781274][T31998] Possible unsafe locking scenario: [ 1627.781274][T31998] [ 1627.788707][T31998] CPU0 CPU1 [ 1627.794056][T31998] ---- ---- [ 1627.799404][T31998] lock(&nr_node->node_lock); [ 1627.804161][T31998] lock(nr_node_list_lock); [ 1627.811256][T31998] lock(&nr_node->node_lock); [ 1627.818526][T31998] lock(nr_neigh_list_lock); [ 1627.823191][T31998] [ 1627.823191][T31998] *** DEADLOCK *** [ 1627.823191][T31998] [ 1627.831317][T31998] 2 locks held by syz.2.15049/31998: [ 1627.836579][T31998] #0: ffffffff8fb28378 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x15f/0xf90 [ 1627.846061][T31998] #1: ffff88809230b570 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x215/0xf90 [ 1627.855711][T31998] [ 1627.855711][T31998] stack backtrace: [ 1627.861585][T31998] CPU: 0 UID: 0 PID: 31998 Comm: syz.2.15049 Not tainted syzkaller #0 PREEMPT(full) [ 1627.861618][T31998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1627.861634][T31998] Call Trace: [ 1627.861640][T31998] [ 1627.861648][T31998] dump_stack_lvl+0xe8/0x150 [ 1627.861669][T31998] print_circular_bug+0x2e1/0x300 [ 1627.861688][T31998] check_noncircular+0x12e/0x150 [ 1627.861705][T31998] __lock_acquire+0x15a5/0x2cf0 [ 1627.861729][T31998] ? kasan_save_track+0x4f/0x80 [ 1627.861743][T31998] ? kasan_save_track+0x3e/0x80 [ 1627.861756][T31998] ? kasan_save_free_info+0x46/0x50 [ 1627.861775][T31998] ? __kasan_slab_free+0x5c/0x80 [ 1627.861789][T31998] ? kfree+0x1be/0x650 [ 1627.861807][T31998] ? tomoyo_path_number_perm+0x501/0x630 [ 1627.861828][T31998] ? security_file_ioctl+0xc3/0x2a0 [ 1627.861842][T31998] ? __se_sys_ioctl+0x47/0x170 [ 1627.861861][T31998] ? do_syscall_64+0xe2/0xf80 [ 1627.861880][T31998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.861898][T31998] ? nr_rt_ioctl+0x40c/0xf90 [ 1627.861918][T31998] lock_acquire+0x106/0x330 [ 1627.861936][T31998] ? nr_rt_ioctl+0x40c/0xf90 [ 1627.861958][T31998] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1627.861976][T31998] ? nr_rt_ioctl+0x40c/0xf90 [ 1627.861995][T31998] _raw_spin_lock_bh+0x36/0x50 [ 1627.862013][T31998] ? nr_rt_ioctl+0x40c/0xf90 [ 1627.862032][T31998] nr_rt_ioctl+0x40c/0xf90 [ 1627.862057][T31998] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 1627.862082][T31998] ? apparmor_capable+0x137/0x1a0 [ 1627.862106][T31998] ? capable+0x88/0xe0 [ 1627.862120][T31998] ? nr_ioctl+0x1b1/0x3b0 [ 1627.862139][T31998] sock_do_ioctl+0x101/0x320 [ 1627.862156][T31998] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1627.862169][T31998] ? do_futex+0x333/0x420 [ 1627.862195][T31998] sock_ioctl+0x5c6/0x7f0 [ 1627.862210][T31998] ? __pfx_sock_ioctl+0x10/0x10 [ 1627.862224][T31998] ? __fget_files+0x2a/0x420 [ 1627.862239][T31998] ? __fget_files+0x3a0/0x420 [ 1627.862254][T31998] ? __fget_files+0x2a/0x420 [ 1627.862272][T31998] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1627.862289][T31998] ? __pfx_sock_ioctl+0x10/0x10 [ 1627.862303][T31998] __se_sys_ioctl+0xfc/0x170 [ 1627.862323][T31998] do_syscall_64+0xe2/0xf80 [ 1627.862342][T31998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.862356][T31998] ? trace_irq_disable+0x37/0x100 [ 1627.862371][T31998] ? clear_bhb_loop+0x60/0xb0 [ 1627.862388][T31998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.862403][T31998] RIP: 0033:0x7f510f39aeb9 [ 1627.862417][T31998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1627.862432][T31998] RSP: 002b:00007f5110310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1627.862449][T31998] RAX: ffffffffffffffda RBX: 00007f510f615fa0 RCX: 00007f510f39aeb9 [ 1627.862461][T31998] RDX: 0000000000000000 RSI: 00000000000089e2 RDI: 0000000000000005 [ 1627.862471][T31998] RBP: 00007f510f408c1f R08: 0000000000000000 R09: 0000000000000000 [ 1627.862480][T31998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1627.862490][T31998] R13: 00007f510f616038 R14: 00007f510f615fa0 R15: 00007ffe2d1af328 [ 1627.862508][T31998] [ 1628.178114][T31956] ªªªªª9 speed is unknown, defaulting to 1000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1628.210944][ T5826] Bluetooth: hci5: command tx timeout [ 1628.217738][T32001] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15050'. [ 1628.265410][T31998] netlink: 'syz.2.15049': attribute type 33 has an invalid length. [ 1628.277605][T31998] netlink: 152 bytes leftover after parsing attributes in process `syz.2.15049'. [ 1628.708072][T24162] Bluetooth: hci2: command tx timeout [ 1628.718609][T11257] lec:lec_start_xmit: lec0:No lecd attached [ 1628.844758][ T9997] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1628.931349][ T9997] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1629.001651][ T9997] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1629.051840][ T9997] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1629.106207][ T9989] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 1629.131308][ T9994] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 1629.140481][ T9994] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 1629.155534][ T9989] netdevsim netdevsim4 eth4: set [1, 0] type 2 family 0 port 20000 - 0 [ 1629.164961][ T9997] bridge_slave_1: left allmulticast mode [ 1629.170941][ T9997] bridge_slave_1: left promiscuous mode [ 1629.176567][ T9997] bridge0: port 2(bridge_slave_1) entered disabled state [ 1629.185234][ T9997] bridge_slave_0: left allmulticast mode [ 1629.191627][ T9997] bridge_slave_0: left promiscuous mode [ 1629.197311][ T9997] bridge0: port 1(bridge_slave_0) entered disabled state [ 1629.272847][ T9997] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1629.283067][ T9997] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1629.292927][ T9997] bond0 (unregistering): Released all slaves [ 1629.632067][ T9997] hsr_slave_0: left promiscuous mode [ 1629.679483][ T9997] hsr_slave_1: left promiscuous mode [ 1629.685420][ T9997] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1629.692965][ T9997] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1629.701237][ T9997] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1629.708775][ T9997] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1629.728010][ T9997] veth1_macvtap: left promiscuous mode [ 1629.733540][ T9997] veth0_macvtap: left promiscuous mode [ 1629.739714][ T9997] veth1_vlan: left promiscuous mode [ 1629.744999][ T9997] veth0_vlan: left promiscuous mode [ 1629.905003][ T9997] team0 (unregistering): Port device team_slave_1 removed [ 1629.918080][ T9997] team0 (unregistering): Port device team_slave_0 removed [ 1630.256505][ T9997] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1630.303176][ T9997] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1630.354653][ T9997] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1630.426122][ T9997] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1630.488772][ T9994] netdevsim netdevsim0 eth5: set [1, 0] type 2 family 0 port 20000 - 0 [ 1630.515383][ T9994] netdevsim netdevsim0 eth6: set [1, 0] type 2 family 0 port 20000 - 0 [ 1630.530103][ T9994] netdevsim netdevsim0 eth7: set [1, 0] type 2 family 0 port 20000 - 0 [ 1630.539636][ T9994] netdevsim netdevsim0 eth8: set [1, 0] type 2 family 0 port 20000 - 0 [ 1630.549317][ T9997] bridge_slave_1: left allmulticast mode [ 1630.554968][ T9997] bridge_slave_1: left promiscuous mode [ 1630.561204][ T9997] bridge0: port 2(bridge_slave_1) entered disabled state [ 1630.571176][ T9997] bridge_slave_0: left allmulticast mode [ 1630.576813][ T9997] bridge_slave_0: left promiscuous mode [ 1630.582727][ T9997] bridge0: port 1(bridge_slave_0) entered disabled state [ 1630.681982][ T9997] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1630.692181][ T9997] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1630.701965][ T9997] bond0 (unregistering): Released all slaves [ 1631.160364][ T9997] hsr_slave_0: left promiscuous mode [ 1631.166338][ T9997] hsr_slave_1: left promiscuous mode [ 1631.173116][ T9997] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1631.180736][ T9997] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1631.189679][ T9997] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1631.197067][ T9997] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1631.216354][ T9997] veth1_macvtap: left promiscuous mode [ 1631.223758][ T9997] veth0_macvtap: left promiscuous mode [ 1631.231221][ T9997] veth1_vlan: left promiscuous mode [ 1631.236516][ T9997] veth0_vlan: left promiscuous mode [ 1631.426217][ T9997] team0 (unregistering): Port device team_slave_1 removed [ 1631.438849][ T9997] team0 (unregistering): Port device team_slave_0 removed [ 1633.747456][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 1633.755465][ C1] lec:lec_tx_timeout: lec0