last executing test programs: 6.830047327s ago: executing program 4 (id=3838): r0 = socket(0xa, 0x3, 0x3a) getsockopt$nfc_llcp(r0, 0x3a, 0x1, 0x0, 0x20000000) recvmsg(0xffffffffffffffff, 0x0, 0x40000020) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000100), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000400)={'syztnl2\x00', 0x0, 0x7, 0x8, 0xf49f, 0x9, {{0x38, 0x4, 0x0, 0x3b, 0xe0, 0x65, 0x0, 0x10, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x25}, @multicast2, {[@ssrr={0x89, 0x23, 0x58, [@local, @rand_addr=0x64010101, @multicast1, @dev={0xac, 0x14, 0x14, 0x3f}, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @dev={0xac, 0x14, 0x14, 0xf}, @remote]}, @ssrr={0x89, 0x17, 0xb, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @rand_addr=0x64010100, @remote]}, @rr={0x7, 0xb, 0xe6, [@local, @remote]}, @timestamp_addr={0x44, 0x2c, 0xd4, 0x1, 0x9, [{@local, 0x7}, {@multicast1, 0x8}, {@rand_addr=0x64010102, 0x7}, {@loopback, 0x4}, {@rand_addr=0x64010102, 0x3}]}, @ssrr={0x89, 0x1b, 0xb, [@private=0xa010100, @loopback, @loopback, @dev={0xac, 0x14, 0x14, 0x12}, @dev={0xac, 0x14, 0x14, 0x28}, @loopback]}, @timestamp_prespec={0x44, 0xc, 0x73, 0x3, 0x3, [{@rand_addr=0x64010102, 0x8000}]}, @lsrr={0x83, 0x13, 0x6d, [@broadcast, @broadcast, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x2f}]}, @lsrr={0x83, 0xf, 0x5f, [@multicast1, @local, @multicast1]}, @generic={0x7, 0x10, "4d88f48d50e54bd9038eeb18df88"}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000240)={'gretap0\x00', &(0x7f0000000600)={'tunl0\x00', r3, 0x1, 0x8086, 0xa, 0x9, {{0x35, 0x4, 0x0, 0x4, 0xd4, 0x65, 0x0, 0x93, 0x4, 0x0, @remote, @rand_addr=0x64010102, {[@timestamp_addr={0x44, 0x2c, 0x93, 0x1, 0x1, [{@remote, 0x4}, {@private=0xa010100}, {@multicast2, 0x1c1}, {@multicast2, 0x2}, {@local, 0x3}]}, @timestamp={0x44, 0x18, 0x2b, 0x0, 0xb, [0x0, 0x2824, 0x8, 0x8, 0xb9]}, @timestamp={0x44, 0xc, 0x4a, 0x0, 0xb, [0x1, 0x80000000]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x2b, 0xad, [@multicast2, @multicast1, @remote, @loopback, @local, @broadcast, @broadcast, @dev={0xac, 0x14, 0x14, 0x25}, @multicast2, @remote]}, @noop, @generic={0x930a259cf4b63d7c, 0x9, "9e4246c181ecda"}, @end, @timestamp_prespec={0x44, 0x34, 0xf4, 0x3, 0x9, [{@local, 0x4}, {@local, 0xfff}, {@local, 0x7}, {@multicast1, 0x8}, {@loopback, 0x7fffffff}, {@empty, 0x401}]}]}}}}}) sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000000880)={0x1e0, r5, 0x201, 0x70bd27, 0x25dfdbfb, {}, [{{0x8, 0x1, r6}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r7}, {0x140, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff5a}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x7, 0x8, 0x4, 0x7}, {0xfff7, 0x10, 0x6, 0x203c}]}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}]}, 0x1e0}, 0x1, 0x0, 0x0, 0x800}, 0x40880) r8 = socket(0x848000000015, 0x805, 0x0) setsockopt$RDS_FREE_MR(r8, 0x114, 0x3, &(0x7f00000005c0), 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010025bd7000ffdbdf2500000000", @ANYRES32=r10], 0x20}}, 0x8080) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001000010027bd70000000000000000000", @ANYRES32=r2, @ANYBLOB="004100000000000014002b8008000100", @ANYRES32], 0x34}}, 0x4008000) 4.158817693s ago: executing program 4 (id=3844): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000016c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000065c0000000c0a01020000000000000000070000000900020073797a31000000000900010073797a3000000000300003802c000080090003400000000020000b801c0001800a0001"], 0xe0}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) unshare(0x22020600) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2, 0x50, r2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaace3500590a7f08084512001c00000002005f0400040000005eb440679dcd3aaa467ea00e000000235249ac0000089078332e0600000000000000129d7c05a6eba4b7335de4f0f64f"], 0x0) syz_emit_ethernet(0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000ffffffe2ffff0800450200260000e002831190780000000000000000004dd7a70000000000000000000000a00000"], 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000680)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x6, [@var={0x3, 0x0, 0x0, 0xe, 0x1, 0x1}]}, {0x0, [0x2e, 0x5f, 0x5f, 0x2e]}}, 0x0, 0x2e, 0x0, 0x1, 0x41}, 0x28) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r3, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 3.880033201s ago: executing program 4 (id=3848): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x48, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xe4}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x526}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x300}}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x70}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f00000002c0)=@ethtool_modinfo}) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt(r7, 0x0, 0x82, 0x0, 0x0) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r8, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r9, &(0x7f0000000040)=[{{0x0, 0xfffffffffffffe4a, 0x0}}], 0x32d, 0x40012000, 0x0) setsockopt$sock_int(r9, 0x1, 0x2e, &(0x7f0000000080)=0x55b6, 0x4) r10 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000200)=0x1, 0x12) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x66, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000006180)={0x0, 0x0, &(0x7f0000006140)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16, @ANYBLOB="110026bd7000fddbdf2507002600"/26, @ANYRES32, @ANYBLOB="0c009900fb"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x20004014) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r11, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r11, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) 3.803611451s ago: executing program 3 (id=3849): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.freeze\x00', 0x0, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a5ef3", 0x5) (async) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f00000002c0)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfee4}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) (async) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 3.623677988s ago: executing program 4 (id=3851): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x62040400) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x10000, @empty}, 0x1c) shutdown(r7, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000780)={0x0, 0xef}, 0x1, 0x0, 0x0, 0x4044081}, 0x4085) r8 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r9 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000a00)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0c00000002fffffff8ffffffdcf6000004800000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="01000000040000000100"/20, @ANYRES32=r9, @ANYBLOB="0000f4082469dd498d2460ceeb5fa7931241eb07fade79965b69b08a1a98b629b912dce5feae081e875032e29e1402ec3ff3414e82c802ab8636c8e51a9615668403ab3e27ffc0968b751e6d4b79539ef34274cd6da5fb97c69fed9a9f508e88c3ae630a23b13086bed50f31f633e5cd000aaec1660e6a151aa86629f1135b798eedb52e21619d1a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000000380)={{r4, &(0x7f00000000c0)='\x00\x00\a\xe4\x0f\x9b\x1e\xe3\x87\xc7\xae\xf0\xab\x0e\xca\x06zS\xba\xc9>p\x83\x13\x13\xe0\xa2y\x8f\f>[1\xc7\xdc\x8d\xf6\xd7\xfe\xe6\tI\xe1\xfd\x96!s\xf3', 0x430202, &(0x7f0000000280)={@_ha_fsid={[0x4, 0xffffd2f8]}, {0x3, 0x80, 0xb, 0x5}}, 0x7, 0x0, &(0x7f0000000140)=0x9e9}, 0x0, &(0x7f00000005c0)}) bind$alg(r10, &(0x7f00000006c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(morus1280-sse2)\x00'}, 0x58) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r11 = accept(r5, 0x0, 0x0) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYRES16=r1], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) socket$rds(0x15, 0x5, 0x0) recvfrom(r6, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4112, 0x0, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYRES16=r0], &(0x7f0000000180)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1b, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r12, 0x0, 0xb, 0x0, &(0x7f0000000900)="e02742e8680d85ff978276", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.594142016s ago: executing program 3 (id=3852): bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={0x1, &(0x7f0000000100)="878d25543aa40740089dfacab9d0a7fcb2080980199779034537f5d835cb91e2aea7044f738d4a0812b4ff9eb190d0ce850950435f303f0385eebd74ff07c1"}, 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x7afc5, 0x11a20}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_PROTOCOL(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x3c, 0x1, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40891}, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r2, &(0x7f0000000180)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e21, 0x9212, @mcast2, 0x7}}, 0x24) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_DEL(r5, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0b1600000000000000004a0000000800b800000000000e0001"], 0x3c}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WIPHY(r5, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x30, r6, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x4d}, @val={0x8}, @val={0xc, 0x99, {0x6, 0xf}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x20040000}, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x16cc53b969ee2671, 0x3, 0x6, 0x10, 0x45, @dev={0xfe, 0x80, '\x00', 0x44}, @loopback, 0x0, 0x80, 0x5, 0xfff}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f00000003c0)={'syztnl0\x00', &(0x7f0000000300)={'ip_vti0\x00', r7, 0x7800, 0x7, 0x4, 0x1, {{0x1f, 0x4, 0x3, 0x0, 0x7c, 0x66, 0x0, 0x6, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @dev={0xac, 0x14, 0x14, 0x33}, {[@timestamp_addr={0x44, 0x4c, 0xee, 0x1, 0xd, [{@empty, 0x39}, {@multicast2, 0xfffffffa}, {@private=0xa010100, 0x3}, {@multicast2, 0x2}, {@multicast1, 0xff}, {@broadcast, 0x7}, {@empty, 0xffffff2b}, {@local, 0x1}, {@loopback, 0x8001}]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x4e, [@loopback, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @local]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) 3.043182242s ago: executing program 3 (id=3856): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a80)=@bpf_ext={0x1c, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="29e2a82d5684a68904000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000820000009500000000000000"], &(0x7f0000000580)='syzkaller\x00', 0x7cd4c342, 0x66, &(0x7f00000008c0)=""/102, 0x40f00, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000940)={0x0, 0x1}, 0x8, 0x10, 0x0, 0x0, 0xae00, 0xffffffffffffffff, 0x2, &(0x7f0000000a00)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000a40)=[{0x5, 0x3}, {0x3, 0x5, 0x1, 0x1}], 0x10, 0xb}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x80000, 0x8001) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) close(0x3) (async) close(0x3) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) (async) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000800)={r5, @in={{0x2, 0x4e24, @multicast2}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000100)={0x0, 0x8, 0x4}, 0x8) write$cgroup_int(r2, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f00000003c0)={0x0, 0x8}, &(0x7f0000000400)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000440)={r6, 0x7}, &(0x7f0000000480)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000001fc0)=ANY=[@ANYBLOB="1802000009000000000000000000f102180100002020642500000000002020207b5af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000900000085000000060000008500000011000000950000000000ef00"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) (async) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000001fc0)=ANY=[@ANYBLOB="1802000009000000000000000000f102180100002020642500000000002020207b5af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000900000085000000060000008500000011000000950000000000ef00"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0x0, &(0x7f0000000100)="e1ff46bd3bf574b7c1f6f585862b", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002840)={0x14, 0x3c, 0x301, 0x70bd29, 0xfffffffc, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0xc000084) (async) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002840)={0x14, 0x3c, 0x301, 0x70bd29, 0xfffffffc, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0xc000084) tee(r8, r8, 0x1, 0x1) (async) tee(r8, r8, 0x1, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x4, 0x20}, 0xc) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000004c0)={0x0, 0x9f, "62f513f0b2425d04b317260e1959a5c653a5eb4227c3db3a9ea53c7b34394ca37282bbd23b654c64db3f1585089ef2acff12997dbb53e49d2155c309cd61db19fe809de96efe3ea21a385a365b571de515e7731ebf35074d0e11b9b5a935f862d8eef6ecdf58898be30981f04abdf8bc07d0610d7b6ddf1370181098a40a655846e945329a85942ff2619d67cafdbc8ad35fd8f1ac1cff915af1b5be143098"}, &(0x7f00000005c0)=0xa7) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x7}, 0x8) (async) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x7}, 0x8) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r10, 0x29, 0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="660a000018000300000001000000060000009500"/40], &(0x7f0000000000)='GPL\x00'}, 0x94) 2.692211789s ago: executing program 3 (id=3860): r0 = socket$netlink(0x10, 0x3, 0x7) r1 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x100000011, @multicast2, 0x0, 0x0, 'sh\x00', 0x16, 0x5, 0x39}, 0x2c) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="0300000030000200200012800b000100697036746e6c000010000280050009"], 0x48}, 0x1, 0x0, 0x0, 0x20040001}, 0x8000) 2.10797427s ago: executing program 3 (id=3864): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x298, 0x168, 0x0, 0x0, 0x298, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x200}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'dvmrp0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x2, 0x0, 0x2, 0x4, 0x3, 0x3]}}}]}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x7ffffff7, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x1f8, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xf, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x1c4, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x5}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0xfff2}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_MATCHALL_ACT={0x1a0, 0x2, [@m_skbedit={0x19c, 0xe, 0x0, 0x0, {{0xc}, {0x44, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x80000000, 0x5, 0xffffffffffffffff, 0x3, 0x9}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x5, 0xfff3}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x4, 0xfff3}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x8, 0xfff1}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7ff}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x50e}]}, {0x12e, 0x6, "4451f677e1feba51f0ca076c35676af75510a35c3d1e76db91483b29378a9cfebc4ed602044c88774ebdcbd0ed1f7310995da0083efed73507077b89810dedf1b67e1c1badbf9e8b900b002ecef17a2ea5c73360f8a897e11737dcda0ad682cd350316e08cc8a826d1d79a13fc418d5bd3050ac647d68e12b466599ed69f1310238abe5b9305ecffbd2b1ed2fce86d9c3b9eb8f9e1100512e5a1189b13a7ff228e8406cf99dd8ce188963afa61448301d4679a7455cb4cc71c80269ad91971ca232d8353d7ab4b941c0267cb1078a4ffff0000000000009ae7520e78872c4d562d25bed7a4d553a422d2e35d37e5d18a9166927778334aad916032033c0497c266bdab8b56f9b07580c68b8ce082fa186ae0695c96103a57a3dfacf967a0321ae95d49138b151f327860"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x1f8}, 0x1, 0x0, 0x0, 0x10}, 0x0) bind$bt_sco(r4, &(0x7f0000000080)={0x1f, @none}, 0x8) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) r7 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x61d0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r7, 0x541b, &(0x7f0000000100)) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000480)=ANY=[@ANYBLOB="070000000100ff7fd50b6c00ff0704001000a81b53051304dfcf6e1e85b1c0595107b8656a7b3a32454e7fc74e1cf187c56f65e2717b33bff9db316fc52e68f6ff94caf5f02481d1b80fdc07d0d30fd3fd016359319b965379c63326410d0ebb2b1bf7f3bd21bcd911fa347d816722c992e7a3892b5dcb1dafd685968edc9c898a1f7a4559afa016e1e053db32a249cbe593bec80a4deeddc6ef5a917a9aa7ff51a87578b1c900a66f0369601ebf24"], 0x12) setsockopt$inet_tcp_int(r3, 0x6, 0x19, 0x0, 0x0) bind$inet(r3, &(0x7f0000000400)={0x2, 0x4e24, @empty}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)}}], 0x1, 0x20008000) recvmsg(r3, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000200)=""/112, 0x70}], 0x1}, 0x123) shutdown(r3, 0x1) r8 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000540)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r8, &(0x7f0000000600)={'full', 0x20, 0x4, 0x20, 0x5}, 0x2f) 1.98013378s ago: executing program 2 (id=3865): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e24, 0xffffffff, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={r4, 0x0, 0x8}, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x30, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x9}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x4044081}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c00000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="bf000000000000003c001a8038000580"], 0x5c}}, 0x8000) 1.716418895s ago: executing program 2 (id=3868): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000600)=0xdfa, 0x4) 1.415096935s ago: executing program 2 (id=3869): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000002ac0)={'syztnl0\x00', &(0x7f0000002a40)={'syztnl1\x00', 0x0, 0x4, 0x2, 0x8, 0x9, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x10, 0xe, 0x8}}) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0xfd67, &(0x7f0000001400), 0x1}}], 0x4000210, 0x10002, 0x0) pselect6(0x40, &(0x7f0000000000)={0x4, 0x2, 0x5e8a, 0x81, 0x9, 0x4, 0x1, 0x3ff}, 0x0, &(0x7f00000000c0)={0x8, 0x2, 0xffffffffffffffff, 0xc, 0x9, 0x1, 0x6, 0x9}, &(0x7f0000000140), 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0xffffe000) mmap(&(0x7f0000707000/0x2000)=nil, 0x2000, 0x3, 0x12, r2, 0xc3ceb000) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r1, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000840)={0x9, 0x2000, 0x3, 0x40, 0xc, 0x6, 0xffff, 0x7}, 0x20) sendmsg$inet_sctp(r4, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881) 1.308375675s ago: executing program 0 (id=3870): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x3}, 0x3, 0x0, 0x3, 0x3, 0xb, 0x2}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x8b32, &(0x7f0000000040)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'batadv0\x00', &(0x7f00000001c0)=@ethtool_gstrings={0x1b, 0x3}}) socket$igmp(0x2, 0x3, 0x2) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x3}, 0x3, 0x0, 0x3, 0x3, 0xb, 0x2}, 0x20) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl(r1, 0x8b32, &(0x7f0000000040)) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'batadv0\x00', &(0x7f00000001c0)=@ethtool_gstrings={0x1b, 0x3}}) (async) 1.123850051s ago: executing program 0 (id=3872): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x44}}, 0x0) (async, rerun: 32) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff01000e0000000000000000000000010c00068005000100000000004700028005000100010000000600034000000000060005"], 0xe4}, 0x1, 0x0, 0x0, 0x26060810}, 0x0) (rerun: 32) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @my=0x0}, 0x10) (async) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x48, r1, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c1937}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x48}}, 0x20000000) 1.076231319s ago: executing program 1 (id=3873): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000008c0)=ANY=[@ANYBLOB="e00000001200090500000000000000000800bb0000000000c500008008000000", @ANYBLOB="110000003a5d5d"], 0xe0}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}}, 0x0) writev(r1, &(0x7f0000000040), 0x2) sendmmsg$inet6(r0, &(0x7f0000000e40)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x61, @private0, 0x3}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f00000000c0)={0xa, 0x4ea0, 0x10, @private0, 0x9}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000000)="95", 0x1}], 0x1}}], 0x2, 0x931766f6319eed40) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000005c0)={0x0, 0x3}, 0x8) 949.305174ms ago: executing program 1 (id=3874): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000006a000100fefdffffffdbef25000000150000000008"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x801) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r4, &(0x7f00000009c0), 0x9) r5 = openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) (async) r6 = gettid() write$cgroup_pid(r5, &(0x7f0000000c40)=r6, 0x12) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) recvmsg$unix(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r9, &(0x7f0000000200)=0x1, 0x12) (async) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001040)=ANY=[@ANYBLOB="400000000d0a010892779ff2cfd865ab8b9c849144ebd0ee00000000000000000a0000010900020073797a31000000000900010073797a310000000014000380"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) (async) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r11, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="03000000", @ANYRES16=r10, @ANYBLOB="c39203100400000000008900000008000300", @ANYRES32=r12, @ANYBLOB="20001d801c0000800500060001000000060005000e00000005000700c0000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 871.46486ms ago: executing program 3 (id=3875): writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)='T', 0x1}], 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a58000000060a010400000000000000000a0000010900010073797a31000000002c0004802800018007000100637400001c0002800500030001000000080002400000000208000140000000090900020073797a32"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000240)="fb90c853a7", 0x5}], 0x1, 0x1) close(r2) socket$tipc(0x1e, 0x2, 0x0) splice(r1, 0x0, r2, 0x0, 0xfffd, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000040)={r4, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000000)={r4, 0x1, 0x0, @local}, 0x10) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000080)={r4, 0x1, 0x6, @multicast}, 0x10) unshare(0x8040600) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000ffffffff00000000000001008500000007000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000001700000095"], 0x0, 0x9, 0x0, 0x0, 0x0, 0xf3, '\x00', r4, 0x0, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r5, 0x5, 0xe, 0x0, &(0x7f00000001c0)="0101000871a7832e6b7303c3cd59", 0x0, 0xd03, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) r6 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x60, @mcast2, 0x0, 0x3}, 0x20) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r8, 0x5452, &(0x7f0000000100)=0x66) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r8, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x38, 0x1411, 0x8, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x9a}, 0x0) write(r9, &(0x7f0000000340), 0x11000) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a58000000060a010400000016000000000a0000050900020073797a32000000002c000480180001800d00010073796e70726f7879000000000400028010000180090001006d617371000000000900010073797a31"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) 683.798388ms ago: executing program 1 (id=3876): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf250501f2800f0018007d3a2e9c5b050023277d0000140001a3a05fdc6598c664bc78927b0af5b2ecfe31f9d4d7a5e2113478f19e3ea0371e45908242078c648c644aa292d9e52d10b7d363df450ed37694f5d246f3c9678108900e3c0459bc7e920cfab15fec51604c54d46aa4476f98a03fa67b328de34c00f16998ab8df99be8"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x4000040) 602.506148ms ago: executing program 0 (id=3877): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000002600)={{0xffffffffffffffff, &(0x7f0000000000)='*#\x00', 0x40, &(0x7f0000000040)={@_ha_fsid={[0x7, 0x1]}, {0x8, 0x4, 0x204, 0x235}}, 0x82, &(0x7f0000000080), &(0x7f00000000c0)=0x4}, 0x6, &(0x7f0000002540)=[{0x2, 0x3, &(0x7f0000000100)='/.-/&$[,}($\x00', &(0x7f0000000140)="648f35791d35bab5bea39673404cf68a5a05a98286e79a2069b4f9a6950dc080a1f1839f23b01ee9ebdaaa09c90edb8ece5cae735ce2ee781e3238ad6596b72769387006908ac1", 0x47, 0x12}, {0x2, 0x8000, &(0x7f00000001c0)='}-\x88.+^:]$](&\x00', &(0x7f0000000200)="5c50e3dae10004cab6cbdd19761e923f1cd485cc9a5bea702847245f457c7026031fd44425f70190fe4c76e9dd793c5ddca06cac727f3761b8d3c64212ccc2ecf9ff4869178d2ef4cf", 0x49, 0x30}, {0x3, 0x5, &(0x7f0000000280)='*$],\x00', &(0x7f00000002c0)="ae3df875178def606d18ce344bc05263a580cba842da8fd139373ae67908d58565ebeaa5cb03c814af8d5792a74b4c54d7b203945f5f008170241e86f99a3e9f6e578af1edb00893ff9b787142a484785df1ec6731e686480d7e9b493295278ef9180baf07e32149b8086cd68716ed74aa954ffeb3628b544a79f7baec03d8a01a17188ba11adb10123aecaa5c3f7f38255c1061bfc3746b2712f5cb75ce1cb5088bfa02d0f28ac5d99b4d0e64c6808bb1571c9e44a8470a0aebc92f3f123ab4558a2d19ddcfb10612e066b974a0253a47966d07554f1d3ea27a8c77f44537b6e0caaf94b5f574fa41b7b36de6806307767b5fc486e6bb94e4ffa81f89f6ad5c2278b9ad86fd0b6f2cef37ce3e74972d4ddaed05938ca3109b24cfeebb5e02587402a0f98075006042f219f22eb02f178578016506b1d0dc7060ea3643b14967b51d9f14291813c94a446dac69842802f95e339914aea7b04da1073bd5b8d0f4784c3850f76760a47ec83359edc80968dbf0a265b5b165a7305329d58a80bd83826a15f1f03602ae056963e294970da2aff6a5e6e74f8e37f200b20bdd94ece4cfdd847a9930ca04f5e8263cb750cc38c809d1b2c2324302b571df7a4721a8b1bfc68c50bda3928da8a84751e4887cf4b81d221f621f899047b33978e5386022061ae7446393eaf07db2c4e9c7d82018b7e495665f930feb18d3f7cf416c4dfd6361ec880cab4500105425ac3f5d3ad2542409b7fafce6e9e8694c136eab200aac843ba6d859cfb6dc5e11c9ed04c81ae5a3f66f7faca58cc09c7acc5a3b162026f4223b2d75116b8980fd1ac5ed29e3e1b2f3f1d2412dd1b7ad3f858c2000d640f1d34a26040e14c91cd653fc271b757443f57b2a87389adcb8aeac62c34e6f53c5956e697dc6153487e5d121d6d4953685ff7450f1b872d223ef5d7dd2367bf93ae89396f0e38dd36a71f5af610d4ad6bc44b6612079d783913258d1dfdfc651d4b9d995e37bfc0b21476791359653460ec53fb348f7dd06a0623455bd29970bd0a8c33a3d2f9cca345e96b76571867f177ba708d7fe1103727d39b8e38d29a4b1e66558ea58e98665e25b96c2f8ff547f00303053b650ecda8365be7911905c823ee687ac03f9c94f22c1b494e668a01a8b91f6f598713169d5060f25baa8e49537ac65f3a6e644740a614dbe438c9c85b9a921e809f56b32a08610724a4b5b9a5f7aeedeb05ac0ef7c7efa234d4db12ef667d6c914aa39980b91b2ff809078143c75f02ae77b8cf5aadd5d92dad3e8542b9b20395a37761fbe28826b3e89b2d59a298d64ba03b740d058e1a5d42fda2cd3fc413ea1302edaa647ad7f5585960e0c3c1ec2c4f7a0b7eb2021da47bbb6f43a6f8afb8aab4f34f7d1e74fb819be5bffb576b5f7fd466a82f6cb625fd98db1b69012c875229d7d3f3b2ba3494163049114d8d2dcf4fa29af3589841c56337664a8989cec0d5b66e02a7d3f74b7c5e1d0bdd4c3e15ef8332c68ed3b6dcaad7ea2a005113c4aad03c707f914b7ed82885fef24e0e51523f5539dde2f3d718c7afb974075dfbeb93b434cce9abba6ee880ec55467e91a4a91dfdfe44a449e7064525a77d5c899c30d03ea2a1b2dfad2edd4cec1a680f1084b62f8967a1965336f84bc2195b7a81807c1051873b200c80b90581132a5e3b773398315ab4e1f3ca6c66c6bbb3672b0f7c65c78e17c1521ae77f90050526a4d042ea36ec9f5cac88b8a37c3575ca0b04f644de36f4a9a804b62a3ed5111bf33340518a8bce4ee9fbdd050a62f28c92135c700c802dd591376444d81f555488d0e73ee9d38ed1ffda8baf33451aa5f852c818015694a6d2aed4ffa8c1398f72ea2cd725f1492bac68a218405cca0e8fe5a68812516d3789a5642ddde35ad077f0b9a7e6c6b9b3604fd3068c622f1e888a12e0b816c59e22373e05482985f65249c97da0fc79a1026eeb93f190ab7d5f5cdf69d58f6daa121ae4bd9067acf92e9e5ceb77f1083ce155e7ecac35917b15bde51711e5023fefa6b1ce9b0c87bfb1c22680ec35c004f8681b4b1411b28111657f949f65ff6aab99c21b54b1c15f7612d75c080c62f2d4318154ec315fa8c025896e0a2ee596ede05017a62abd2e9965b2cc1e0bd4332eface783dd478887dff15c8784e64597c439e65eb56032e00af18ea8a69d31b886e672858b222684233356216ef2bd842e0ae5d8b5f9494a16704ca25b5c240161645cdaf617bfe82c2574b5c1182d5016c540973afcc9e752815134e385ef612a51e755a553574a85be46c522b6adff3a9612083aa316ec1238d7b8909dc28d58871c78f06ea6bacc05c71519837e5ff1f6ac8d02fa69b0092136e3d9c5c08820c34e50ea42c57c95b0edc7cc36fd0656744da2aaa96f3ba7ae7b2fa15bc1af78f6035c5f8f863537606e37a97f03efd7954709192a3572a2f537dd933bfe670f0bf6988a13b5d80464179fdbadc0011b18e6d6f4430602d765512c5bbc548dde62c222101953ebf05761453592be0b3d7f04f9b6822b40fa18757233d306823e8aa65219ebd2e3d7d04e078a22b35366fde073d5de8c748951d7c4ea64bc8610b942a82f119afa9a7bbe3011a5f7a54cc407492b07d7f31c313e1d71a607cc0ee716e7c662c6eb1c19821a36c1de03d76e9f694afb9ce559f8ade4fd10d6aaa7f5894759e5029b1993b8ec22db0bed7aa781a88b8966d45d9a772629ac3d45ea127ab259a3e2670b71a25cfaac3e5bdf62a02d86984944872f2f5a33676d020486dc14c49c92f8ddd5b9fd9cfa3ee523584a85f4bef5abd2ce3b7efe438f29dd91d46013d1ff2a4098938fd46edc1f155ae5fc125aa59fbed21c96b05f7cd55f99e3aa300cf561e128d66f7d7eba4ff8fa4c72ea8b15700d596624a236e2458df1314614de934197f4616bd1297ebf1e5f3ff16e2ee234104d91cecdb950f76b7b4ba488d06b8fcc203279b344d29b8c1133a45402fa3055c73d9eed54d7e7513448e490b38fb6e579b9c204b73ecb06f545cb47f943d1ddaac228b8677964ea49f42b8c7180c018af1a1cd6bb9405b58dcd3f40a330190c6636144947dc6d51d68278bf4b7192fad150393e57fc530b2baab4af238a34e95ca686e2ea0e68acc7b74680dee2cf03cef45211e066a799168f17b7db89a430b58e4a9b5f87966c3fd03bf49a78c2b099e455017da380208a1fd65b7d81094c767c6c5594f6fce264abcf3fd7d63b4fac9ae8cdae65d24aad3b8e54a0489c105d5877cb3f2e3345fb56ab0271c14cd07c900fa3a525badad4fa4b704a503637ced2f5a6cf918dcb14f8ca052406e79928ec6c7c8ebb6b0f525240e78fd342f51d4d8e3608d1b1fd4f3444bea7edeb88b60c7331ac601567562dfe67bcf489ce5aebec960a397d55ac475eb71adc1ba12cb24c4b6bbbdf62cabdca0919e50912f07405809342a5bef736fd50db9dca94ca9647ba41ec29325920ad7f973e8ec439efc1df46240a3b21127117750fa74e6b76dc47c0ede5d74b3002411dc33cc7b0b2f262e88b0e9d235de8fcba76a238e9a2b125a74c013eeee85cc55a6fd55c28bf0d013ec28e939b3c797a3de48c7beed3771993efd65f83913267891c5e6b7f06cd503ab0695927c1002be6982672ca5af5720924518b90804b6af71c931b0cfa8e5232cf034bae340e1c707491ceca5ea66383eea6e8b0110b25abc3c5b9b5be9ccbf8631b05f2fc834cddf0b46bcb8dca0cf057caab4ac21fcfd318fb44eedbaea913f1ed06989c41ddfbfe8b7e30c6bc1614c958dc959eb58c9a4fec6832fa7f069c62265bad6e459a75a9b229456a2849532ecfb7f29c8a004b0bf391d168839c92283e5d7b3eb1610e4d23077efbf3791e112a0080ed5a6a5b46ec5210932e44c125d72fcb77bc74c2dedcece2cd89aef7ed409b6b629e8c2cd382086efeecf801149ed8c066a8a737ed6aa7ad61fe65fe92cdb93e50eb9d0472cee92174b56127fc9c9d17c912104a581f2d60d118aeb7e24a80e93e79dbb48bc9db0114f554f9a090915ccb74e6e3b9cd2cff61fc0bf6b3f08d6b848f8b9e7ac1084b37b33a5a7fd10a948051e3fbe71271549e8c4a31cbaec84180512394790112c44258093b239dc502f6c4909120e978d5fe7e54cfcdcbc201e40d8b2d31355a50256d8ca7a2956dd560a4d99381e814549f770dc1087278aeed56d46eb79ed077d3a0301b042c1eeb365a32ee3693a99e449930fda78f948b7aa66d55981b7ef36a92fdb39b67d747dea4754776e818045ddf9affa187a2ec9680d65acbf0cc60e74d1df09cac38d168b37929f7674d9eb6b82de42a47f7f86ee63fe6c5b2a3966e41448a09cdefccaf6860acabc1395ffdbc764f0dd3e8cd1a0b2fd38620d0e05233003ac67f6dded23b335256c3b37db2399ca0fbdf7f79b890cf56b816f5ec0d623ace84478ccae4ffcd702bf5afdbc251472a30df549bc6e7daff5a52927821eec6fb9b25d58942ab37bbbaeccb6cb9b4622d8caf2d464e60bbad243cf5726350b124d31979f610017e00bfffffb9f689f07a4d8a457fe085509c593b9dd3f16b7071dd0d6475313a33c52323695d41e09087e5b076e00b062e4ae97b82854deeac21ebae2831cd57a16be1164b45af81a6c70b78fd75fc6b3fc433de1b1384637bfc25fd35113231f67f0cf535368831a14cc0549ed45b69fe851d8839b522534a552288c236aacff58c09cd309f8ae85f56b4094edc2619c3a798fdd1cd8e417d9c273c9f5f8a8ecd0eaf72029d6a002aee7a61ead07c5e6706d55f31b169aa3bb13ed4a0e62260c8bdc060c356eb7361cd9b3d85dcb58103403e14162491247943c6cdf61eadd732331f88b26390d0a6a9461b0e13031d60c28596ede0620dae03be1e0bf8bb3543757b513b566e6f4765156184fe869b9ff8c1c74a366c30e4704c581fc5d0c38137afca8f3b5f3c9d3b1fa54ee5c654cfadc735e7acb64a1bb424abb36da59c974f3361508004a2bd7aecadaf0c3f5984d2a03c6671b23c28485c794d5d1ad5ffc0ac4833bb8a9125836f9dab2368079fad1ddc6c09d6b84da679df40d42f8d573519c6267e4f5250f1e5b7143cdc17248da788c09b31879bfabd8c502c819b603a90b1022fac29411e24ca2935e060e899fe7bd3eaeb87f1c79ab3335383f6885e6e23fde769978e66f936cd0ecc61468d7063f6329730fd6a9b8a0a3444162eaf01787413e007738617ae9b1029ddaab954ef680597910a6c29b4f9e04f3670b78538149f19ffaeaae23e97c4898a8bfc8c703e49b9a93dcbaca12b68fd540ccaed71a20d87b35a1450a1f4e6adabc2dc894142b12a26373860f42f9191fd108a9a92a1a0611978a86352f102cd6149bc8b28d4b4d1b6c6919365a3bf0dbe5943d2a0f55dfaa3b676d3a2f82de36a7258fb491c2526fa030291d412dc5d9ccdc2d0873aade967403357f0c04bda5dd740b19b4c746cfc733b9f0de9e1937d8306a4f3cd701cd74fa772ba024c98c05f9419abc486922825661b59db5b67d6dff58e34b25c1c8cd4b21b38878fbc827ba5e7a8d8203bb4edb1efbb6c77dec1ed505ba003811bf786b273e967304e08bdc6add34503555ea39bc3b60d269ff7ec5a2c568cd206c17f85ce1384763eb63c4616b7e97e4955b1ec7e8224b92451484c5c4fc729bc1a77d909317de0ea01944bdf0496333100f720e246bfa2bde0dee1643ca5d381d1d07d536f0832aff1c09520877204ae101c37c66f4bac3711d6c40dc77f4324181bdcf217", 0x1000, 0x8}, {0x2, 0x72f8, &(0x7f00000012c0)='\\/$^\x00', &(0x7f0000001300)="312c4994f7b833f0f8041b65de0a5d65e772ad0ba2021c50162a7660e84f1a293a185024420b6480ac4520ab20c0181c2297800bdd4c674f18b7ab9504c77d43630683fdd1fb3e881569334d915b0db61d13b8956c0e2627738ba6d26903f8498f034f95d81c3c3408b6f1433ec416e8cbaf424e78af02f22c967cc865ececed868790ead6ff41785af78919380267086cc615ab69149f5315d8bbaa234b91f11b6bdfb8b053825f59ba8512641366c2f618b096c35318763ba4870ecf7e57e980679932d1cd413c648c3ef9314d4f57681fa846ce34278c04", 0xd9}, {0x1, 0x9, &(0x7f0000001400)='+\xed@+*\x00', &(0x7f0000001440)="2b5e15e8f364a4c3d81573b4412b63663cafa299fc9717d7714bd742b7e4269959950971ac7fb7d00c2ac6312e383377b6ee06ddbc09c68c0f28e7945c23c437685e2363bcf34e19edfc8694f07c54f9728e4a1bba3c6917a3dadf30c954840ca927f0559c8a3d51a7e814f5546930b8829324e7c746e053e58cc71209f488a68d580b575e64fe4010aea82a445bfa3d36951a52fd9822414854c3667c1f1f885c5d042fa9a552c091238ae86cfd534234da07028aaa668fc36fb308bb3a59b3d49d56df6cf9fccc43b4cab4df5e6a08566dd5df404ac5dca4f6e16cc1c5895ea047fee4110c0cb6c38e0ea566bffeb8b271e1b54939819917592680106ab2fd75cd54643cedf9fbfe6a6214b357a823e15c5f0d09d6ab646695f55296a6670839be8172174f062009203d97d7d76b999d07a526a872ef037c443c9df63cffb3bada0621b9ae212ab76ad59db068419b99f63d38678ce5b6e1df6128b61307da75d452803e621d23f0d50729c4c00cb8fca22c0bbb7a949bb68e5ac100f66b4d0899bd9a47b095fa7c1fa517374b00ed263a9e2b037f24165d3346293621a8618c4e4dc5e7015f9f85ab5a47634e1a5d1171c6377c3a015f77ae37427dd80c7a6aa765add5f3ae5fd85272039e935795e8dd544723aabd12b40f640d02570d6dfb820451a7a537b2ca2a7e715797c5cbd6fb3e87fe4a0e74be30552451d0d39d0bc8499d606c84138a32c40538c0be345ccf87d977a00160bdf58313aa76aac09a1d01e71bd854024de6fd8f856774a8449e4abf6c499c56787240e5dea60c9226a16360251dd023d7b40749ff2b8810eca83deae936cca18c36d24d423d166cfaafde309c0b4fbecc5593a35319794489186d4e1856398e6ec717be0deb5a654d0613d88a734ba1c67dbf88fa346e223b0e7679a40d3da42264b4023bfb83684b4a9d5b1f51981212e3c837a68b1a1befd76907025018037965db239ce75ac48501c663c2ba8ca8478ca48cacae908e0d8e8e2df3b54693eba0657bf72739e4eef335b2ab21ebcec15d3aa868fc94440215d401eac9e67f068d91fb9176202128db2ae82d500aa0984918c122a412087712cbd448c6fb48823e3b7f40917493d1b2aff3d2736c441588a96271157f012e6ffd4131e1b5f9f82e52bf540ec514ef43835ccb780060e48617a6a5dc5ebf040857ac99a7b7e87cfe3418b4b228fedd400d79d8e332cb0cee4a85a4ea60f8c859bce807476fb654c2a8294abb22b3020b8b859e1e7642aeac5fef967985f76df22cbb4b7a76c7e5021ab6c5f9e728fd42302f28c538f50ff802646a7c971d5f898205e705087af1740c7e4aae6590ef4158a869207409d8818e9fe4a89f5766b10c82de56554236a24ea48218fb9927cb28d6de89afc3b391b79cc7f714601e8c1f3832d0384801078670c9115d219250dbbc0349686c2b61d5f449abd43192ef13a7232eb0814fcf8c95992e1e7cafddc0a0c7f725d49af541d91397275c7025fad39e908621547996acba7f827a8332c1a4e769947f2376a0aa571ad99b0f2ecb81a6daedbe903aab6877787a69884da5b7181eba421a40046cd972e685cd641a841ad944f0c08f01f5fc4faafb15c940d8c15b4abd9c52512d90be6366514ccaf7cf3b75eeb5ee923d95a30cab99d15251d91c9d4e7ced4c1ae14d09d3d13a2d1a66f566c42ce24544a280e991cc3eba1e1036c3d4d084185f98c4f2efa85d8f70fea2aee3d0f0409c8b3e0eed5e798a97f529f81cbff62b48d8f03a37a79e45cce41b2dd2276793f3984a6060aabce73f8acae24b2cca3f2cfbe42c4df9fc57de0c1c4de2d1068571dca46f59325952d561afd6f80ef35c38432abd2c0a3e0bb4560e8a1174007038014d7c1550a5d8a6f4895e477e8e21ffa84fc385905834ab6ecde89b0cb5713121773c02763a17f8d2b17b8507a8fbcd0d8980f27c5322ee7d14663d8056c044fe4d05b8377c57ecf8871e59796af2730b7c50d86a120b72ba765442ebef11a63c55d353aad5a99670cf9b5a75cd95371af46310b3f17debf89104194cb00600cc0a4be714deb405fe98c173b37668ea2e0378b1ea8926c16680ed189678ad621aba77f4fa34e22e8f75e55d8f2fdfd71610367cdf8b35d6116bf1de1edaacf042c0193879d8cd6d921c103dca29ccfd702f67bfe92cc1ce449345d3bf38488ada61751b8e51a4c1fe8025266460a66a197cfcd50b3fdb302cb7f20d9b5c98df513fc3e4f73315e93d06d23ea22c9d383015ae9aa170de0b762dd15f4f04ffeb10067155d56b1438f5d73a13fce1a9bbddf5a9cef189e13b268233cb55943e95fb2c0630d03cf4e9e5a3e90132c130d4dc25aa76de314ff67d7fa873d20f16acf28df6d40b2cb7f2db4ff578b98c9968c016f1e38275564f705d8e2c9420360caf955deb5e59a89609b3d31f5a501ddf73b28f194b2e63cedf42898102b56c6439d9fe8e7b2b62e71db03d896ae7a53d207e21c941c42bb26904639b4b216d757a22bbd04d32dc0ef2afba6dcb6af48e3e4b93ea73a6f23463f9e13c1f106d6e7d59c034fea44bd20507671557d898e04ecc501d781ec1a264ac64f516a4fd32a828695b4f95d7d15924d3b203c6a471d08c766a823c00f9046bd8f9a5351f35829176585689af69d65878fd2a8e31fbd03d536a512d4a215442b90b1a825386604c4fdc28445e42eafd7b41bfb1cc82bfb858106fdbf04af870b45d01a3fa3122583afb1cb6d7447fdbc62601f40ebefbb513872d40d725bfc4ea022d2bbdbae0fc18681d9a6d2801ece296d490ee43962f87da3f804726ab70f054751b951c2d796bc796a31b5c55fe9b02ecf42877e08ab268a0869e1d5d72f329797b8de293f4d2cb9eeb5a9b81045ed968e1588869de336fc1cb1ed59ff7c8061ed16bc0998a32a8c927acf1cc246c95b387fa9c71f60babbd2465b252f220fd8d043ab29bc6c14b515b4c50174a09f325f57c1342dfa448e6846ce93d4b02f18cb0b7e631e9c4ef4350aa921615a8a32371339065ea5060851858f3fc1b2b383572180b5c4559e2bbf5ee48a279691e6bc1ec6d025c225b1b04758afadd0a169d57901dc1829d4f4484c42e50caae578a9edb2a47d0f3dc6cfac24e72503b162b01e01ec56d0ae8f24178cdfcfad8e7e4d7e79ab089cb0af1fed593ab34b7382a1325ea709c605717336a2cc994712315a6ef7241d7ef49f9e59998dbfd716e1102a11a05d75ebd9458787a6c53eaadb513e44ef885d75440f53bcbf91030f3fa9eee081dc6c991c869622889731723573bb1de7329a37ed62cf58b3355a66e4a20ec34756f8486d7200c8262907c8ae533425b31bc90030f7d0eb5557be55514936af736feaff27bc3925e99f7b8ce5c803ef532c5d4379636840d8cf852c8b491dfb0e9251e4e04d0ea5efb64318210cd5367d8ad63d2007d9852f5066f7fc268f394956bb771f0f3d5cfafce8f0ddd41c860a938ed208b447ec99929c4538caad45ebbbe2849661b6498a6eb4e65a45cfcb05c18d75c163d63cc10b605f369375d47e70065f34f5041c090277576e9f795e5a2c8adcf32087d629c7ef273c610d711ca7cd30b00d12a1873a22472621fc19ccf195e8bfe6c7d383e565518d973cec44b11edf4eeae1e3cb7dca60583e8e28437a4a1091110900d9879c78d3eed57de57def03921f2884a89cf5892637298ccbe28d8250d763d6af456baf6057315d64f03872fee6a1990bab4544d376d1bd3d5696d70bd9999325662fed6a0c741d77f656d9e5f42275131f88d054fae2d51a7f4d1dc7369833d501b61be874b80ee2d9af8b52d4dceb09cfff994743f7c35743ab49ef65cdd121ab1c01cbe9428fa4a6e28317135d794df42cce7c5bf3a39480c1eae61bf0f61b3d22384d7bd6859f6b5fa92520485054679d470b455a460a40a5b81f7c4db3b9d9b3e13ce7a1457684017f153f736ce2d4ad57d11a23b1fe2bd593f06c21f9c69afb85073433e860ada0151cd763a7a32173d3af0c00d7e4d161bdff2c341ca706f14d019a9d2522098fcb83c7c3d59a2099cdd332e5f99b64727e91fbb8a6448fa3e6994048d9da41ce66d7d85f0a9bddf046f09eac20e5c2658c825293512a0eba74eec2575389a9ffb36da1fc122a56d85551251a6b40023e344ca55cd5ba7d867d8263be3a3c02b7ba9fc7fece6cdcda647f2caa6b2abbe9d08323c02232c81550e28de36b234232d2f6189bb7609d2801c9cfc8a5abf1fa6be67f543638d310a8078a570245f675b237e4c1d0bc5e55434522b2441065a87fb0feb577b0bb5f897d9a7ea3acb5c7c4c75cd948b0a2da91b5597dabe905661a336d1c1cff7f19e6127e500f7dd0a07c05b6b5ac588b8145dad70f39a9ee137188e30434a31370aa6714e08f57fb20a6a303484d2f1e6e6fec7ae8f751bce672fc0badfd9d8947d63ed0b402a16895327ba49d4fe066d6da08855a15db602a8e4dafabe2f0013f8dde3d7ae0d1f491b47764366edee46f12b37ceaaaddd3ba80c476b2d599c6cfac4436a2ffe92f15c0536539f572bff6acb4abe08a1cb9950881f3ae9e13c88c3acbb08a1f6b633ee8c724cccbdd781cf8c7b43b20b1ba294eac8fabb11d907a920e4ddd40abf2dbd05018f47755c1a37592fa5f617193044cf8d02896e2727a3dc80d31952dbff0fb548de9cf47a054a6dd655dd5e7580fa72a952dfae3cca4967af7d91252db887d2d90d66a011c4d96321621f4904fcb8697f6acc0e97ac3cec1a16c9ea4f99748a1c143589c405a8bffc15aeacffda33022f0c70216e2ffab478dc06f7b633bfbb26f6880c24ad118e05282a22e870c859e9dae63eadbebde0e3c7dcab38b853755a1475f0463d4de89df156fc243b290e0bb80dd65c03170ad40a21ca45daf4e48984c4cf6338492df3a304e545bada7bc1c1b8e8516968ffcfd75cacbeb106cd0e0fe4a7c040f7cc967d16fd1d0efb13b6a75e6ca97ed0bbb2f07c4daa16d86f0a8a1c607f5e5dbb728a92d52da371885aceeaee4dc3f25d951249b64394d9404e79e8573bcd6e96a72685c511790742f14a01c876cf13724c0c071182a2b05cfb64c9e981bde6e5633ad85144d377efc81c70f4d11b44510992867eb15f1f37b59d7691f3ece08f173f57cf44d6948475748f413fbc9d8266e7507a097c27a8cfc3977a4e174b4f4b539b964e17d6f68de7c680fec30f39740620082df03123c444a06ff6c11c6a51d7617a8c6fd1e2a69d5fa62851e4be37a5e6d5ae2fa659428f8bffbd4201dfb964803c99ac09b49f685e9c63e09c373833cd1a6f98e195c595bfbe55be0af155713513af6795e0c8cc3ee4bab81edba4458b3646385572561c954db29aaa07895c9d5a88522320da37e3b8cd7923a125a28925c689a9a8dbfa2516eeb78e3d1c9eb41450941df87b385a24dfff7a299f481d3bf8ff06798ebd08d949455c8fb6fe1823b4178c7856b776a2f12adecbc33844987f01d9787e0f91cc0e087574f7ffaa9faff52eac393f0b9db897c96062319233cf548bdc6211680a47892974d74446c5fa04eed0fbaf72d444987efacddc78c84fd6eab003f487d844d727319b934f2404e659b18e9053381b33ae37801ac2b01400f9edf7dc2723acd110e1d4e552e6b0e232d566b3b0f92fb7f77abcbf5b366f58682fab2874834a756fa2606356b68b37f2cb6facd36d7d139feeb8311c6dcc03dcf0f53ebd852107a1bbccfa41af717046602a64f3f150caa57e11aa27e3347c37ac", 0x1000, 0x2}, {0x3, 0x1, &(0x7f0000002440)='\x00', &(0x7f0000002480)="5e15784a73c656612b085fdf1b65d7cc10a7b5453a4af312bc21ed29b15819000f7f324bc23a8d8696037318f5014fe55056560d713bf189334769fede9001660b8741b6ee3488367d262297476b272e7087e7f6a4add6967c2763d9deda5bfc7580df56c867aa60ea34c598f3912b7ee234a52ebd9bc7c5b2cc74e859f4892930c322120183231e0f4e05224624fcc2c577d8ea0687a8856f61861d66df4a5477c8255f5b62d78b0199fd2dff107a0742cd5756aa4e", 0xb6, 0xc}]}) setsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f0000002680)=0x5, 0x4) (async) setsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, &(0x7f00000026c0)=0x1, 0x4) (async) ioctl$XFS_IOC_FSBULKSTAT(r0, 0xc0205865, &(0x7f0000002e40)={&(0x7f0000002700)=0x8, 0x9, &(0x7f0000002740)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000002e00)}) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000002e80), r1) (async) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000002ec0)={r0, r0, 0x1, 0x0, @val=@tracing={0xffffffffffffffff, 0x100000001}}, 0x20) ioctl$XFS_IOC_FSBULKSTAT(r2, 0xc0205865, &(0x7f0000003340)={&(0x7f0000002f00)=0x3, 0x80, &(0x7f0000002f40)=[{}, {}, {}, {}, {}], &(0x7f0000003300)}) sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f0000003480)={&(0x7f0000003380)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000003440)={&(0x7f00000033c0)={0x44, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x4084) (async) write$cgroup_subtree(r0, &(0x7f00000034c0)={[{0x2d, 'net'}]}, 0x5) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000003540), r0) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000003640)={&(0x7f0000003500)={0x10, 0x0, 0x0, 0x8800831}, 0xc, &(0x7f0000003600)={&(0x7f0000003580)={0x44, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xdc}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041085}, 0x0) r4 = getuid() setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000003680)={{{@in=@local, @in6=@mcast2, 0x4e24, 0x0, 0x4e21, 0xb, 0xa, 0x20, 0xa0, 0x2c, 0x0, r4}, {0x8001, 0x1, 0x8, 0xa6, 0x9, 0x4, 0x5000000000000, 0x9ef2}, {0xffffffffffffffff, 0x7, 0x9, 0x10000}, 0x2, 0x6e6bb9, 0x2, 0x1}, {{@in6=@local, 0x4d3, 0x6c}, 0x2, @in6=@mcast1, 0x3503, 0x0, 0x0, 0x3, 0x3, 0x6, 0xffffff0f}}, 0xe8) (async) recvmmsg(r0, &(0x7f0000006140)=[{{&(0x7f0000003780)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000003980)=[{&(0x7f0000003800)=""/199, 0xc7}, {&(0x7f0000003900)=""/71, 0x47}], 0x2, &(0x7f00000039c0)=""/222, 0xde}, 0x1}, {{0x0, 0x0, &(0x7f0000003cc0)=[{&(0x7f0000003ac0)=""/36, 0x24}, {&(0x7f0000003b00)=""/60, 0x3c}, {&(0x7f0000003b40)=""/171, 0xab}, {&(0x7f0000003c00)=""/135, 0x87}], 0x4, &(0x7f0000003d00)=""/22, 0x16}, 0x4}, {{&(0x7f0000003d40)=@tipc, 0x80, &(0x7f0000004240)=[{&(0x7f0000003dc0)=""/159, 0x9f}, {&(0x7f0000003e80)=""/137, 0x89}, {&(0x7f0000003f40)=""/14, 0xe}, {&(0x7f0000003f80)=""/84, 0x54}, {&(0x7f0000004000)=""/48, 0x30}, {&(0x7f0000004040)=""/75, 0x4b}, {&(0x7f00000040c0)=""/138, 0x8a}, {&(0x7f0000004180)=""/72, 0x48}, {&(0x7f0000004200)=""/38, 0x26}], 0x9, &(0x7f0000004300)=""/151, 0x97}, 0x2}, {{&(0x7f00000043c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000004500)=[{&(0x7f0000004440)=""/159, 0x9f}], 0x1, &(0x7f0000004540)=""/14, 0xe}, 0x5}, {{0x0, 0x0, &(0x7f00000057c0)=[{&(0x7f0000004580)=""/4096, 0x1000}, {&(0x7f0000005580)=""/211, 0xd3}, {&(0x7f0000005680)=""/75, 0x4b}, {&(0x7f0000005700)=""/184, 0xb8}], 0x4, &(0x7f0000005800)=""/203, 0xcb}, 0xe02}, {{0x0, 0x0, &(0x7f0000005a00)=[{&(0x7f0000005900)=""/220, 0xdc}], 0x1}, 0x2}, {{&(0x7f0000005a40)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}}, 0x80, &(0x7f0000006040)=[{&(0x7f0000005ac0)=""/69, 0x45}, {&(0x7f0000005b40)=""/221, 0xdd}, {&(0x7f0000005c40)=""/210, 0xd2}, {&(0x7f0000005d40)=""/148, 0x94}, {&(0x7f0000005e00)=""/34, 0x22}, {&(0x7f0000005e40)=""/194, 0xc2}, {&(0x7f0000005f40)=""/138, 0x8a}, {&(0x7f0000006000)=""/8, 0x8}], 0x8, &(0x7f00000060c0)=""/117, 0x75}, 0x2}], 0x7, 0x40000202, &(0x7f0000006300)={0x0, 0x3938700}) ioctl$FAT_IOCTL_GET_VOLUME_ID(r5, 0x80047213, &(0x7f0000006340)) (async) getsockopt$packet_buf(r5, 0x107, 0x5, &(0x7f0000006380)=""/78, &(0x7f0000006400)=0x4e) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f0000006440)={0xfffffffffffff4a2, 0x3, 0x0, 0x4, 0x6, 0x0, [{0x1, 0x10001, 0x0, '\x00', 0x8}, {0xffffffffffffff0c, 0x4a, 0x5, '\x00', 0x508}, {0x7, 0x3, 0x100, '\x00', 0x2280}, {0x4, 0x2, 0x7, '\x00', 0x88d}, {0x8, 0x5, 0x10, '\x00', 0x90c}, {0x7, 0xfff, 0x8, '\x00', 0x4}]}) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000065c0)) (async) socket$alg(0x26, 0x5, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000006700)={&(0x7f0000006600)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000066c0)={&(0x7f0000006640)={0x50, 0x140f, 0x2, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x7, 0x45, 'cm\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000006780), r5) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000067c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f00000068c0)={&(0x7f0000006740)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000006880)={&(0x7f0000006800)={0x4c, r6, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40804}, 0x4000000) (async) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000006900)={0x3c, 0x3, '\x00', [@enc_lim={0x4, 0x1, 0x3}, @jumbo={0xc2, 0x4, 0x81}, @pad1, @generic={0x8, 0x9, "31c78b44ded584773e"}, @enc_lim={0x4, 0x1, 0xb}]}, 0x28) (async) ioctl$sock_inet6_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000006940)={@loopback, 0x11, r7}) getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000006980)={{{@in6=@mcast2, @in=@dev}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f0000006a80)=0xe8) (async) ioctl$XFS_IOC_GETBMAP(r2, 0xc0205826, &(0x7f0000006ac0)={0xfffffffffffffff1, 0x10001, 0x9, 0x800, 0x5}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000006bc0)={&(0x7f0000006b00), 0xc, &(0x7f0000006b80)={&(0x7f0000006b40)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x2, 0x18}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000006d40)={r0, &(0x7f0000006c00)="6b12f54afd8f088acecaf097ff5aa571b1a56f7156d3653396a47d495a8e9d5fd4e4715423879a50c682ff3866d61fb71a959ce99983789cb3912ddc355a6a21049ef3d1b70f8a3fb9c97c57e00cec89a42cf613f82e2670aab6c7d2d64efebaf46a8905a2ee7398bb6c42ce5158c73d8107c2b02bdd8b607cba7ffd6cc846fe7b88916bb5bed2b0cf2ba760c1a98584dc1b907ad517666b3ae2af1242c9cfd96ae57776c4e1af932d9ff3b192c77081bdb5afe20f2b0623af9e1ce09c8250dc7413b50333cff1068b7948fc8578425f96495376b1c5278bbd82cfb42c11d9fc39853a7551cdfe4589cdf8b4825726d0c88b6add2a146b27fd1cb85a97", &(0x7f0000006d00)=@udp=r5, 0x5}, 0x20) 550.361455ms ago: executing program 1 (id=3878): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x3a0ffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xb0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40440c4) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010004b0429bd7000000000007a000000", @ANYRES32=0x0, @ANYRESDEC=r0, @ANYRES64=r0, @ANYRESDEC=r1, @ANYRESHEX=r1, @ANYBLOB="cf29445d43ec73c0143e0a39cc519e80bbbdaa2222bbdda881e6c412ccc19fa9eea73699a7853644789734825f85175122142e484939908dda24e305c7f8629a63ef3ea9b1ddb956206226d5949ddaf2bb62093e9c8c944dd6459c37c99a4d4502510217a2695eef4c5ae84b", @ANYRES8=r1], 0x50}}, 0x20000000) 487.620447ms ago: executing program 0 (id=3879): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e1c, 0x4000b, @ipv4={'\x00', '\xff\xff', @local}, 0xffff}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000240)={0x2, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x18, 0x31, 0x2, 0xb, 0x0, 0x0, 0x25dfdbfd, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x300, @multicast1}}, @sadb_address={0x3, 0x12, 0x3c, 0x80, 0x0, @in={0x2, 0x4e20, @remote}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x1, @broadcast}}]}, 0x58}}, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r3, &(0x7f0000000200)={0xa, 0x4e20, 0x4000b, @ipv4={'\x00', '\xff\xff', @empty}, 0x80ad}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000000)=0x6, 0xa) bind$inet6(r4, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x10000}, 0x1c) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000200000000000000000808"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0x0, 0x0, 0x0, 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) unshare(0x2a000000) unshare(0x22020400) close(0x3) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x4000b, @empty, 0x80ad}, 0x1c) r6 = socket(0x10, 0x803, 0x0) write(r6, &(0x7f0000000240)="aefc00001a0025f00385bc04fef7681d0a0b49ff708800008002280008020200ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) r7 = socket(0xa, 0x3, 0x3a) getsockopt$MRT6(r7, 0x29, 0xd0, 0x0, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmsg$RDMA_NLDEV_CMD_GET(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[], 0x38}}, 0x0) recvmsg(r9, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)=""/23, 0x17}], 0x1}, 0x142) socket$nl_route(0x10, 0x3, 0x0) 486.641538ms ago: executing program 4 (id=3880): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f00000001c0)={{r0, &(0x7f0000000040)='^\x00', 0x10000, &(0x7f0000000100)={@_ha_fsid={[0x1, 0xf22]}, {0x3, 0x4, 0x69, 0x5}}, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x2}, {[0x3f, 0x4, 0xfffffff7, 0xfffffffb]}, 0x458d, 0x1000, &(0x7f0000000340)=""/4096}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'team_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000700001002abd7000fbdbdf2507000000", @ANYRES32=r1, @ANYBLOB="0cf901807500000000000000000001800500060006000000"], 0x30}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) 415.938963ms ago: executing program 2 (id=3881): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0x5, &(0x7f0000000500)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x3, 0x3}]}]}, 0xfc}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x1c, r3, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x404c000}, 0x4004040) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x80489439, &(0x7f0000000100)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x74, 0x74, 0x8, [@func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x5, 0x1}, {0x5, 0x4}, {0x9, 0x5}, {0x2}]}, @func={0xd, 0x0, 0x0, 0xc, 0x1}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x3, 0x1}}, @enum={0xf, 0x1, 0x0, 0x6, 0x4, [{0x9, 0xd}]}, @int={0xd, 0x0, 0x0, 0x1, 0x0, 0xd, 0x0, 0x66, 0x4}]}, {0x0, [0x10, 0x2e, 0x30, 0x61, 0x2e, 0x30]}}, &(0x7f0000000940)=""/4096, 0x94, 0x1000, 0x0, 0xa}, 0x28) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x50, 0x21, 0x300, 0x0, 0xfffffffe, {{@in6=@mcast1, @in=@private=0xa010101, 0xfffa, 0x0, 0x0, 0x0, 0xa, 0x20, 0x80}, 0x2}}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 371.776455ms ago: executing program 0 (id=3882): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000006c0)="1400000016000b63d25a80f77311d12022508ec9a280c1877fb9494b3efd6422b3a1471c070000000000000036a8ec7284e9dfa4b143947091460dfed9682a69b7bf85496a94ac7112c28b08d44b0045d1fcb429e2ec1e9c50e35076de3005251d18ff1c7cc04617871e6bf72833bbcb401f3b770a565f40920055535cd3bf29b167a87d03372f25f602f6d4241d514230dbedc2fbf390266b0d031f00977dc116e966d4b0c2106b8febbfc97038253fc92255723d706166950fa8", 0xbb}], 0x1}, 0x20000080) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x48, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x48}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x6, 0x5, 0xba34}}}}]}, 0x44}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x80, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x8001, 0x3151, 0x401, 0x6, 0xaa3c}, 0x7f, 0x1, 0x6, 0x3, 0x7, 0x14, 0xa, 0xc, 0x6, 0x7f, {0x6, 0x407c, 0x1, 0x4, 0x2b72, 0x2}}}}, @TCA_RATE={0x6, 0x5, {0x0, 0x3}}]}, 0x80}, 0x1, 0x0, 0x0, 0x400dc}, 0x20000000) syz_emit_ethernet(0x42, &(0x7f0000000100)={@remote, @local, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x4, @empty, @loopback, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}, &(0x7f0000000000)={0x1, 0x2, [0x0, 0xa64, 0x857, 0xcb4]}) r10 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) sendto(r12, 0x0, 0x0, 0x240048c4, 0x0, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) close(0xffffffffffffffff) 227.599591ms ago: executing program 2 (id=3883): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}}, 0x1c) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000800000000000000000850000004100000085000000d000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xf, 0x0, &(0x7f0000000280)="a3bceb4791a2976f36f19d3133f8e3", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000020000000000000000000000850000002f000000180100002020752500000000002020207b1af8ff00000000bfa101000000000007010000f8ff1cffb702000008000000b70300000400000085000000b400000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) (async) getsockopt$inet6_int(r4, 0x29, 0x4c, 0x0, &(0x7f0000000080)) (async) write$cgroup_int(r3, &(0x7f0000000140), 0xfffffdef) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1f, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000030000000000000012000000850000009300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x211}, 0x94) (async) getsockopt$sock_buf(r2, 0x1, 0x37, &(0x7f0000001180)=""/163, &(0x7f0000001240)=0xa3) 226.736968ms ago: executing program 1 (id=3884): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r2) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xa, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_MAX_P={0x8, 0x4, 0xc}, @TCA_GRED_LIMIT={0x8, 0x5, 0x3}, @TCA_GRED_DPS={0x10, 0x3, {0x9, 0x4, 0x1, 0x6}}, @TCA_GRED_MAX_P={0x8, 0x4, 0xfffffffc}, @TCA_GRED_DPS={0xfffffffffffffff1, 0x3, {0x8, 0xe, 0x1, 0x1}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000fbdbdf250f00000005002f000100000008003a000a00000008000300", @ANYRES32=r3, @ANYBLOB="050030"], 0x34}, 0x1, 0x0, 0x0, 0x48000}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r8 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r8, &(0x7f0000000000)={0x10, @short}, 0x2) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x6}, @IFLA_BR_NF_CALL_ARPTABLES={0x5}, @IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x54}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 226.053559ms ago: executing program 4 (id=3885): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x1000008, 0x12, r1, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000040)=0x204, 0x4) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r1, 0x913e0000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d1000/0xb000)=nil, 0xb000, 0x0, 0x11, r2, 0x1000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba9432}) readv(r3, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000180)=""/101, 0x65}], 0x2) r4 = socket$kcm(0x2, 0xa, 0x2) r5 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r0, 0x5431000) 137.746914ms ago: executing program 2 (id=3886): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYRES8=r0, @ANYRES16=r0, @ANYRES16=r0, @ANYRESDEC=r0, @ANYRES16=r0, @ANYBLOB="175209490bab582b8b358e701e9c163753a72db58cc3b4fee37a3311cdda7372d131d0563f1e6e615d5dcb661c6d8f3147892002ffe7960830543855ef4a1cee8ace9cd9d1d147e9d5746bf5a5d22ebd6cbce785f7af622f36375f1219a91f3fa547dc061ec8d126c04f33db4804d2860fc0d94615cc78c13f1afc89d9f6395c8f48a40e29396af60acdf080e60031c0c6df9f802d52533efdf0a12922d1ec6ef68345fdf85e56f9d1dabbcd4a89d9195b351eeb956437ba140f1373bf264d4e"], &(0x7f0000000440)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x40d, 0x70bd2d, 0x1ffffff9, {0x0, 0x0, 0x0, r4, 0x60046}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}, @IFLA_BOND_XMIT_HASH_POLICY={0x5, 0xe, 0x2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r5 = socket(0x11, 0x3, 0x0) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000840)={@empty, @loopback, @ipv4={'\x00', '\xff\xff', @empty}, 0x5, 0x8, 0x2, 0x0, 0x3, 0x400148}) sendmsg$nl_route(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001085f0000000000003a33a9e4fc", @ANYRES32=0x0, @ANYBLOB="00000000e300020008000a00", @ANYRES32=r4, @ANYBLOB="08001b"], 0x30}}, 0x40040c1) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6}, @IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x777}]}}}]}, 0x40}}, 0x240080c0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x70}, [@ldst={0x6, 0x0, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001fc0)={0x1c, 0x55, 0x1, 0x70bd27, 0x0, {0x7}, [@nested={0x8, 0x15a, 0x0, 0x1, [@nested={0x4, 0x1}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8084}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000005c0)={'batadv0\x00', 0x200}) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000010000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000170a017d6800000000000000000200801a99c2199d"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x850) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl2\x00', &(0x7f0000000300)={'ip6_vti0\x00', 0x0, 0x4, 0x54, 0x2, 0x3f8, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, 0x20, 0x10, 0x4, 0x4}}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001140)={0x24, 0x40, 0x107, 0x70bd26, 0x0, {0x4, 0x7c}, [@nested={0xc, 0x1c2, 0x0, 0x1, [@typed={0x8, 0x9, 0x0, 0x0, @uid}]}, @nested={0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048081}, 0xc000) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc0}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@gettfilter={0x34, 0x2e, 0x10, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x4}, {0x3, 0xc}, {0xe, 0xd}}, [{0x8, 0xb, 0x3}, {0x8, 0xb, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r12, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="000200bd7000fddbdf2501000000060028000400001805003000000000000600280002000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4008000) 33.627201ms ago: executing program 1 (id=3887): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000240)=0x4, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0xffffffff}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x3) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0xa7ba) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r9) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r10, &(0x7f00000002c0)=ANY=[@ANYRESHEX=0x0], 0xfb5) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) 0s ago: executing program 0 (id=3888): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) (async) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='nv', 0x2) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) accept$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r3, 0xfffff000, 0xe, 0x0, &(0x7f0000000100)="d3afb44c087361df712bc884fed5", 0x0, 0x2ef8, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, 0x0, 0x0, 0x931766f6319eed40) shutdown(r4, 0x1) (async) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000040)={0x0, 0x8, 0xb}, 0x8) (async) sendmmsg$inet6(r0, &(0x7f0000003180)=[{{0x0, 0x0, &(0x7f0000002680)=[{&(0x7f0000001340)='\'', 0x7ab8}], 0x1}}], 0x1, 0x0) r5 = socket(0x0, 0x0, 0x4) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) (async) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendmsg$inet(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40) (async) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000019600)=ANY=[@ANYBLOB="9feb01001800007538000000000000000000000005000000002e005f00"], &(0x7f0000000480), 0x1d, 0x0, 0x0, 0x5, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r6, @ANYRES32=r2, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000001000000000000000e00000000000000", @ANYRES32=r6, @ANYBLOB='\x00\x00\x00\x00'], 0x50) (async) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r7 = socket(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c783, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x1c}}, @TCA_CHOKE_STAB={0x104, 0x2, "1c1f15f3c5e23d27d29a00dd397b5c11d4cf201c1a0619fc314514ab71788e4079fdbe4f2a0d60b83a7d04c1d709981110401e5e10685abbad9b6f18e303e902c77244658a099a36fa486760c4941ea7df64250af29a4935de5d244f0549d93679b3d4fb358c2076bc6b1c9735ff8243f088e67455ba14975d12e5903ceeb7a23d62ecb5253ad444ef726b58a00f13f22ccc84cc06c9912b621c3ddc5f3229dc84c0880b5c6faefe33413b34a146e592fc15ae234dac030f05bb99eab08dfd2cb5659c6fc21fb7da6c380165ddde4659e75538dc864a53f691e1d785d6e6f73a03abf2120bce67e2d50075fd811b3e03a1cc2d66335bdee19738a0c1fb79b77d"}]}}]}, 0x14c}}, 0x20000004) (async) getsockopt(r5, 0x200000000114, 0x2715, &(0x7f0000000580)=""/102393, &(0x7f0000000400)=0x18ff9) (async) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r10, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000004c0)=0x8) kernel console output (not intermixed with test programs): ] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 384.268727][T16372] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 384.632814][T16418] sctp: [Deprecated]: syz.1.2649 (pid 16418) Use of int in max_burst socket option. [ 384.632814][T16418] Use struct sctp_assoc_value instead [ 384.821668][T16427] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2652'. [ 384.869826][T16419] tipc: Resetting bearer [ 385.135900][T16438] syzkaller0: entered promiscuous mode [ 385.170298][T16438] syzkaller0: entered allmulticast mode [ 385.293367][T16447] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2658'. [ 385.303239][ T1147] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 385.313807][ T1147] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 385.328232][ T5845] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 385.500016][T16465] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2664'. [ 385.538308][ T5845] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 385.676955][T16475] netlink: 'syz.4.2667': attribute type 1 has an invalid length. [ 385.732708][T16475] bond3: entered promiscuous mode [ 385.738539][T16475] 8021q: adding VLAN 0 to HW filter on device bond3 [ 385.747424][T16477] netlink: 'syz.0.2668': attribute type 4 has an invalid length. [ 385.774472][T16482] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2670'. [ 385.806202][T16475] bond3: (slave bridge6): making interface the new active one [ 385.814993][T16475] bridge6: entered promiscuous mode [ 385.824337][T16475] bridge6: left promiscuous mode [ 385.874671][T16486] bond8: (slave 26=a): Releasing backup interface [ 385.892709][T16486] bond8: (slave 26=a): last VLAN challenged slave left bond - VLAN blocking is removed [ 385.910450][T16486] bond0: (slave batadv0): Releasing backup interface [ 385.923421][T16486] bridge_slave_0: left allmulticast mode [ 385.930539][T16486] bridge_slave_0: left promiscuous mode [ 385.937077][T16486] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.951889][T16486] bridge_slave_1: left allmulticast mode [ 385.958076][T16486] bridge_slave_1: left promiscuous mode [ 385.964063][T16486] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.977515][T16486] bond0: (slave bond_slave_0): Releasing backup interface [ 385.988794][T16486] bond0: (slave bond_slave_1): Releasing backup interface [ 385.998910][T16486] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 386.009503][T16486] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 386.023505][T16486] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 386.044471][T16500] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2671'. [ 386.055450][T16501] xt_hashlimit: size too large, truncated to 1048576 [ 386.073462][T16483] bond3: (slave bridge6): making interface the new active one [ 386.078700][T16501] xt_hashlimit: invalid interval [ 386.081795][T16483] bridge6: entered promiscuous mode [ 386.106877][T16502] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2671'. [ 386.176407][T16505] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2671'. [ 386.214199][T16483] bridge6: left promiscuous mode [ 386.287167][T16488] syzkaller0: entered promiscuous mode [ 386.293287][T16488] syzkaller0: entered allmulticast mode [ 386.348053][ T5914] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 386.370367][T16497] geneve4: entered promiscuous mode [ 386.683221][T16526] netlink: 'syz.4.2679': attribute type 3 has an invalid length. [ 386.695533][T16521] netlink: 'syz.1.2678': attribute type 4 has an invalid length. [ 386.702282][T16526] netlink: 666 bytes leftover after parsing attributes in process `syz.4.2679'. [ 386.708631][T16523] netlink: 'syz.1.2678': attribute type 4 has an invalid length. [ 386.752779][T16526] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2679'. [ 386.977025][T16544] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.2682'. [ 387.029622][T16550] rdma_rxe: rxe_newlink: failed to add bond0 [ 387.046145][T16551] netlink: 'syz.1.2684': attribute type 3 has an invalid length. [ 387.068737][T16544] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2682'. [ 387.267138][T16544] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 387.292137][T16544] bond0 (unregistering): Released all slaves [ 387.409673][T16562] bond4: option all_slaves_active: invalid value (13) [ 387.426640][T16562] bond4 (unregistering): Released all slaves [ 387.482445][T16577] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2690'. [ 387.765104][T16596] netlink: 'syz.0.2694': attribute type 6 has an invalid length. [ 388.067810][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 388.075944][ C0] lec:lec_tx_timeout: lec0 [ 388.215482][T16596] A٨ speed is unknown, defaulting to 1000 [ 388.224397][T16596] wg1 speed is unknown, defaulting to 1000 [ 388.558522][T16620] netlink: 'syz.1.2700': attribute type 5 has an invalid length. [ 389.128421][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 389.209626][T16642] netlink: 'syz.3.2709': attribute type 32 has an invalid length. [ 389.519417][T16651] A٨ speed is unknown, defaulting to 1000 [ 389.565128][T16651] wg1 speed is unknown, defaulting to 1000 [ 389.838734][T16657] netlink: 'syz.2.2711': attribute type 1 has an invalid length. [ 389.852956][T16660] netlink: 'syz.3.2713': attribute type 3 has an invalid length. [ 389.863323][T16657] netlink: 'syz.2.2711': attribute type 2 has an invalid length. [ 389.895167][T16660] syzkaller1: entered promiscuous mode [ 389.908290][T16660] syzkaller1: entered allmulticast mode [ 390.734474][T16701] tipc: Enabling of bearer rejected, already enabled [ 390.804195][T16703] __nla_validate_parse: 2 callbacks suppressed [ 390.804219][T16703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2722'. [ 390.911254][T16705] A٨ speed is unknown, defaulting to 1000 [ 390.929308][T16707] netlink: 1327 bytes leftover after parsing attributes in process `syz.1.2723'. [ 390.938819][T16705] wg1 speed is unknown, defaulting to 1000 [ 390.940820][T16707] netlink: 'syz.1.2723': attribute type 1 has an invalid length. [ 390.955681][T16707] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2723'. [ 390.965102][T16707] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2723'. [ 390.976321][T16707] netlink: 'syz.1.2723': attribute type 1 has an invalid length. [ 390.987084][T16707] netlink: 'syz.1.2723': attribute type 8 has an invalid length. [ 390.995425][T16707] netlink: 606 bytes leftover after parsing attributes in process `syz.1.2723'. [ 391.135807][T16714] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 391.366289][T16720] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 392.216771][T16755] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2737'. [ 392.235612][T16757] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2738'. [ 392.455154][T16765] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2740'. [ 392.535280][T16767] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2741'. [ 392.629295][T16768] bridge4: port 1(veth17) entered blocking state [ 392.646240][T16768] bridge4: port 1(veth17) entered disabled state [ 392.669502][T16768] veth17: entered allmulticast mode [ 392.686359][T16768] veth17: entered promiscuous mode [ 392.711414][T16769] bridge4: port 2(veth0_to_bond) entered blocking state [ 392.731765][T16769] bridge4: port 2(veth0_to_bond) entered disabled state [ 392.754125][T16769] veth0_to_bond: entered promiscuous mode [ 392.915686][T16785] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2745'. [ 392.995135][T16787] netlink: 'syz.1.2747': attribute type 2 has an invalid length. [ 393.003618][T16787] netlink: 'syz.1.2747': attribute type 1 has an invalid length. [ 393.014942][T16787] netlink: 'syz.1.2747': attribute type 1 has an invalid length. [ 393.742185][T16808] A٨ speed is unknown, defaulting to 1000 [ 393.791927][T16808] wg1 speed is unknown, defaulting to 1000 [ 394.217211][ T5842] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 394.227345][ T5842] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 394.250474][ T5842] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 394.268106][ T5842] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 394.276873][ T5842] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 394.314562][T16820] FAULT_INJECTION: forcing a failure. [ 394.314562][T16820] name failslab, interval 1, probability 0, space 0, times 1 [ 394.421443][T16820] CPU: 1 UID: 0 PID: 16820 Comm: syz.3.2757 Not tainted syzkaller #0 PREEMPT(full) [ 394.421474][T16820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 394.421492][T16820] Call Trace: [ 394.421501][T16820] [ 394.421511][T16820] dump_stack_lvl+0xe8/0x150 [ 394.421550][T16820] should_fail_ex+0x412/0x560 [ 394.421633][T16820] should_failslab+0xa8/0x100 [ 394.421664][T16820] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 394.421688][T16820] ? __alloc_skb+0x186/0x7d0 [ 394.421712][T16820] ? __alloc_skb+0x1d0/0x7d0 [ 394.421733][T16820] ? __local_bh_enable_ip+0xd0/0x130 [ 394.421768][T16820] __alloc_skb+0x1d0/0x7d0 [ 394.421798][T16820] alloc_skb_with_frags+0xca/0x890 [ 394.421850][T16820] sock_alloc_send_pskb+0x878/0x990 [ 394.421901][T16820] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 394.421944][T16820] ? iov_iter_advance+0x8b/0x1c0 [ 394.421968][T16820] tun_get_user+0x92d/0x3dd0 [ 394.422007][T16820] ? aa_file_perm+0x192/0x15e0 [ 394.422034][T16820] ? aa_file_perm+0x50e/0x15e0 [ 394.422054][T16820] ? __pfx_tun_get_user+0x10/0x10 [ 394.422076][T16820] ? aa_file_perm+0x192/0x15e0 [ 394.422103][T16820] ? __lock_acquire+0x6b5/0x2cf0 [ 394.422144][T16820] ? ref_tracker_alloc+0x35c/0x4c0 [ 394.422179][T16820] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 394.422219][T16820] ? tun_get+0x1c/0x2f0 [ 394.422249][T16820] ? tun_get+0x1c/0x2f0 [ 394.422272][T16820] ? tun_get+0x1c/0x2f0 [ 394.422305][T16820] tun_chr_write_iter+0x113/0x200 [ 394.422333][T16820] vfs_write+0x61d/0xb90 [ 394.422367][T16820] ? __pfx_vfs_write+0x10/0x10 [ 394.422402][T16820] ? __fget_files+0x2a/0x420 [ 394.422445][T16820] ksys_write+0x150/0x270 [ 394.422472][T16820] ? __pfx_ksys_write+0x10/0x10 [ 394.422508][T16820] do_syscall_64+0x14d/0xf80 [ 394.422538][T16820] ? trace_irq_disable+0x3b/0x150 [ 394.422557][T16820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.422587][T16820] ? clear_bhb_loop+0x40/0x90 [ 394.422614][T16820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.422640][T16820] RIP: 0033:0x7f4b8f99c799 [ 394.422660][T16820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.422679][T16820] RSP: 002b:00007f4b907c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 394.422702][T16820] RAX: ffffffffffffffda RBX: 00007f4b8fc16090 RCX: 00007f4b8f99c799 [ 394.422718][T16820] RDX: 0000000000000c41 RSI: 00002000000003c0 RDI: 0000000000000003 [ 394.422732][T16820] RBP: 00007f4b907c8090 R08: 0000000000000000 R09: 0000000000000000 [ 394.422746][T16820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.422758][T16820] R13: 00007f4b8fc16128 R14: 00007f4b8fc16090 R15: 00007ffed2b2ec68 [ 394.422793][T16820] [ 394.813823][T16829] tipc: Resetting bearer [ 394.857956][T14574] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 394.983932][T16822] A٨ speed is unknown, defaulting to 1000 [ 395.026263][T16822] wg1 speed is unknown, defaulting to 1000 [ 395.045592][T16833] tipc: Enabled bearer , priority 0 [ 395.079893][T16833] syzkaller0: entered promiscuous mode [ 395.085476][T16833] syzkaller0: entered allmulticast mode [ 395.138817][T16833] tipc: Resetting bearer [ 395.168843][T16831] tipc: Resetting bearer [ 395.235906][T16831] tipc: Disabling bearer [ 395.266463][T16846] netlink: 'syz.4.2763': attribute type 7 has an invalid length. [ 395.328320][T16848] IPv6: Can't replace route, no match found [ 395.335022][T16848] IPv6: Can't replace route, no match found [ 395.368850][T16848] netlink: 'syz.4.2763': attribute type 7 has an invalid length. [ 395.432040][T16853] bridge_slave_1: left allmulticast mode [ 395.439658][T16846] netlink: 'syz.4.2763': attribute type 7 has an invalid length. [ 395.447961][T16853] bridge_slave_1: left promiscuous mode [ 395.453922][T16853] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.471779][T16853] bridge_slave_0: left allmulticast mode [ 395.494370][T16853] bridge_slave_0: left promiscuous mode [ 395.512551][T16853] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.528319][T14574] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 395.614008][T16858] syzkaller1: entered promiscuous mode [ 395.619732][T16858] syzkaller1: entered allmulticast mode [ 395.896490][T16873] netlink: 'syz.3.2769': attribute type 10 has an invalid length. [ 395.904681][T16873] __nla_validate_parse: 7 callbacks suppressed [ 395.904701][T16873] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2769'. [ 395.925418][T16874] netlink: 'syz.3.2769': attribute type 10 has an invalid length. [ 395.941544][T16874] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2769'. [ 396.117015][T16822] chnl_net:caif_netlink_parms(): no params data found [ 396.328192][ T5837] Bluetooth: hci5: command tx timeout [ 396.380013][T16887] syzkaller1: entered promiscuous mode [ 396.385559][T16887] syzkaller1: entered allmulticast mode [ 396.453628][T16822] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.550852][T16822] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.560868][T16822] bridge_slave_0: entered allmulticast mode [ 396.569180][T16822] bridge_slave_0: entered promiscuous mode [ 396.578170][T16822] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.585350][T16822] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.596780][T16822] bridge_slave_1: entered allmulticast mode [ 396.604858][T16822] bridge_slave_1: entered promiscuous mode [ 396.666654][T16822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.670808][T16904] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2777'. [ 396.685475][T16822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 396.863920][T16906] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2777'. [ 396.882104][T16822] team0: Port device team_slave_0 added [ 396.893168][T16822] team0: Port device team_slave_1 added [ 396.958811][T16822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 396.970770][T16822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.000748][T16822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.014855][T16822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.022290][T16822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.056998][T16822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.130386][T16919] openvswitch: netlink: Tunnel attr 336 out of range max 16 [ 397.180084][T16921] openvswitch: netlink: Tunnel attr 336 out of range max 16 [ 397.217543][T16822] hsr_slave_0: entered promiscuous mode [ 397.239444][T16822] hsr_slave_1: entered promiscuous mode [ 397.288011][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 397.504393][T16930] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2785'. [ 397.551201][T16930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2785'. [ 397.685838][T16938] netlink: 'syz.1.2787': attribute type 7 has an invalid length. [ 397.696682][T16938] netlink: 209840 bytes leftover after parsing attributes in process `syz.1.2787'. [ 397.737500][T16938] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 398.147348][T16822] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 398.192819][T16822] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 398.226143][T16822] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 398.228535][T16957] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2794'. [ 398.253682][T16822] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 398.341927][T16960] syzkaller0: entered promiscuous mode [ 398.347465][T16960] syzkaller0: entered allmulticast mode [ 398.412029][ T5837] Bluetooth: hci5: command tx timeout [ 398.994471][T16993] netlink: 'syz.3.2799': attribute type 9 has an invalid length. [ 399.003118][T16993] netlink: 184972 bytes leftover after parsing attributes in process `syz.3.2799'. [ 400.303560][T17001] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2802'. [ 400.367003][T16822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 400.430474][T17008] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 400.445816][T16822] 8021q: adding VLAN 0 to HW filter on device team0 [ 400.476406][ T171] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.483661][ T171] bridge0: port 1(bridge_slave_0) entered forwarding state [ 400.491577][ T5837] Bluetooth: hci5: command tx timeout [ 400.578027][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.585266][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 400.843352][T17021] Can't find ip_set type hash:is,port,net [ 401.134803][T17049] __nla_validate_parse: 8 callbacks suppressed [ 401.134825][T17049] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2812'. [ 401.171465][T16822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 401.331746][T16822] veth0_vlan: entered promiscuous mode [ 401.373041][T16822] veth1_vlan: entered promiscuous mode [ 401.418659][T17056] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2815'. [ 401.446210][T16822] veth0_macvtap: entered promiscuous mode [ 401.511007][T16822] veth1_macvtap: entered promiscuous mode [ 401.564531][T17046] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2815'. [ 401.611597][T16822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.755311][T16822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.875795][T17046] syz_tun (unregistering): left allmulticast mode [ 401.897277][ T1357] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.907379][ T1357] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.933036][ T1357] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.004010][ T1357] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.088701][T17067] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.2819'. [ 402.109163][T17067] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 402.139734][ T1357] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.151173][ T1357] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.257687][ T171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.287348][ T171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.445497][T17084] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2824'. [ 402.475103][T17084] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2824'. [ 402.495150][T17084] netlink: 'syz.4.2824': attribute type 14 has an invalid length. [ 402.565560][T17088] syzkaller1: entered promiscuous mode [ 402.572599][ T5837] Bluetooth: hci5: command tx timeout [ 402.597225][T17088] syzkaller1: entered allmulticast mode [ 402.767359][T17102] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2828'. [ 402.909928][T17110] tipc: Enabling of bearer rejected, failed to enable media [ 402.944077][T17114] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.2832'. [ 402.955929][T17114] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 402.980884][T17111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2829'. [ 402.989984][T17111] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2829'. [ 403.021361][T17116] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 403.047119][T17119] pimreg: entered allmulticast mode [ 403.060138][T17119] bridge_slave_1: Caught tx_queue_len zero misconfig [ 403.748869][T17145] netlink: 'syz.2.2840': attribute type 1 has an invalid length. [ 403.757253][T17145] netlink: 'syz.2.2840': attribute type 1 has an invalid length. [ 403.840303][T17145] x_tables: duplicate underflow at hook 2 [ 404.275223][T17177] netlink: 'syz.4.2850': attribute type 7 has an invalid length. [ 404.305403][T17177] netlink: 'syz.4.2850': attribute type 8 has an invalid length. [ 404.525740][ T5842] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 404.537093][ T5842] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 404.554274][ T5842] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 404.580495][ T5842] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 404.604027][ T5842] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 404.621030][T17191] netem: change failed [ 404.815685][ T5842] Bluetooth: hci5: command tx timeout [ 405.204187][T17187] A٨ speed is unknown, defaulting to 1000 [ 405.235774][T17187] wg1 speed is unknown, defaulting to 1000 [ 405.290826][T17201] ip6gretap1: entered allmulticast mode [ 405.453869][ T8194] lec:lec_start_xmit: lec0:No lecd attached [ 405.515636][T14574] IPVS: starting estimator thread 0... [ 405.629967][T17220] IPVS: using max 25 ests per chain, 60000 per kthread [ 405.728319][T17224] netlink: 'syz.4.2864': attribute type 58 has an invalid length. [ 405.789843][T17234] tipc: Enabling of bearer rejected, already enabled [ 406.214590][T17251] __nla_validate_parse: 13 callbacks suppressed [ 406.214611][T17251] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2870'. [ 406.344130][T17259] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 406.377163][T17259] syzkaller1: linktype set to 805 [ 406.487648][T17259] delete_channel: no stack [ 406.526009][T17187] chnl_net:caif_netlink_parms(): no params data found [ 406.704083][T17282] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2876'. [ 406.729528][ T5842] Bluetooth: hci1: command tx timeout [ 406.808946][T17187] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.816288][T17187] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.825780][T17187] bridge_slave_0: entered allmulticast mode [ 406.834224][T17187] bridge_slave_0: entered promiscuous mode [ 406.846297][T17187] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.854989][T17187] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.863026][T17187] bridge_slave_1: entered allmulticast mode [ 406.870784][T17187] bridge_slave_1: entered promiscuous mode [ 406.934624][T17187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 406.948206][T17187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 406.998657][T17187] team0: Port device team_slave_0 added [ 407.010204][T17187] team0: Port device team_slave_1 added [ 407.044039][T17290] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.2878'. [ 407.054500][T17290] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 407.069953][T17290] netlink: 'syz.4.2878': attribute type 1 has an invalid length. [ 407.090874][T17187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 407.101990][T17187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.128867][T17187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 407.142149][T17293] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2878'. [ 407.173961][T17290] 8021q: adding VLAN 0 to HW filter on device bond4 [ 407.199230][T17187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 407.206235][T17187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.240498][T17187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 407.282300][T17290] bond4: (slave ip6gretap1): making interface the new active one [ 407.291238][T17290] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 407.300896][T17292] tipc: Enabled bearer , priority 0 [ 407.350363][T17292] syzkaller0: entered promiscuous mode [ 407.356011][T17297] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2880'. [ 407.366954][T17292] syzkaller0: entered allmulticast mode [ 407.390235][T17297] netlink: 'syz.1.2880': attribute type 1 has an invalid length. [ 407.426322][T17187] hsr_slave_0: entered promiscuous mode [ 407.433762][T17187] hsr_slave_1: entered promiscuous mode [ 407.452814][T17187] debugfs: 'hsr0' already exists in 'hsr' [ 407.468223][T17187] Cannot create hsr debugfs directory [ 407.526027][T17295] tipc: Resetting bearer [ 407.553191][T17300] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2881'. [ 407.582016][T17300] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2881'. [ 407.664072][T17291] tipc: Resetting bearer [ 407.705911][T17291] tipc: Disabling bearer [ 407.799949][T17306] A٨ speed is unknown, defaulting to 1000 [ 407.864738][T17306] wg1 speed is unknown, defaulting to 1000 [ 407.921348][T17314] syzkaller0: entered promiscuous mode [ 407.926916][T17314] syzkaller0: entered allmulticast mode [ 408.101719][T17187] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 408.178916][T17330] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2889'. [ 408.217630][T17333] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.2890'. [ 408.241409][T17333] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 408.281832][T17333] netlink: 'syz.0.2890': attribute type 1 has an invalid length. [ 408.333992][T17336] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2890'. [ 408.452093][T17333] 8021q: adding VLAN 0 to HW filter on device bond9 [ 408.479699][T17187] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 408.540389][T17340] bond9: (slave ip6gretap0): making interface the new active one [ 408.552192][T17340] bond9: (slave ip6gretap0): Enslaving as an active interface with an up link [ 408.630366][T17187] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 408.685110][T17347] lo: entered allmulticast mode [ 408.690795][T17347] lo: left allmulticast mode [ 408.718529][T17187] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 408.810245][ T5842] Bluetooth: hci1: command tx timeout [ 409.311433][T17187] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 409.343708][T17187] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 409.387467][T17187] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 409.446519][T17187] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 409.542421][T17383] netlink: 'syz.2.2900': attribute type 10 has an invalid length. [ 409.592922][T17384] netlink: 'syz.2.2900': attribute type 10 has an invalid length. [ 409.632335][T17383] team0: Port device dummy0 added [ 409.720472][T17384] team0: Port device dummy0 removed [ 409.761260][T17384] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 409.840265][T17396] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 409.853118][T17394] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 409.874240][T17396] netlink: 'syz.4.2903': attribute type 1 has an invalid length. [ 409.934256][T17396] 8021q: adding VLAN 0 to HW filter on device bond5 [ 410.014329][T17187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.071765][T17187] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.105393][ T1147] bridge0: port 1(bridge_slave_0) entered blocking state [ 410.112624][ T1147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 410.205152][ T171] bridge0: port 2(bridge_slave_1) entered blocking state [ 410.212442][ T171] bridge0: port 2(bridge_slave_1) entered forwarding state [ 410.231344][T17413] netlink: 'syz.4.2908': attribute type 1 has an invalid length. [ 410.309039][T17413] 8021q: adding VLAN 0 to HW filter on device bond6 [ 410.374351][T17413] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 410.386213][T17413] bond6: (slave batadv1): making interface the new active one [ 410.401172][T17413] bond6: (slave batadv1): Enslaving as an active interface with an up link [ 410.501314][T17413] bond6 (unregistering): (slave batadv1): Releasing active interface [ 410.544747][T17413] bond6 (unregistering): Released all slaves [ 410.804949][T17439] netlink: 'syz.1.2912': attribute type 1 has an invalid length. [ 410.887963][ T5842] Bluetooth: hci1: command tx timeout [ 410.973478][T17443] bond10: entered promiscuous mode [ 410.993341][T17443] 8021q: adding VLAN 0 to HW filter on device bond10 [ 411.028733][T17443] bond10 (unregistering): Released all slaves [ 411.047876][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5590 ms [ 411.056012][ C0] lec:lec_tx_timeout: lec0 [ 411.078798][T17456] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 411.095566][T17456] netlink: 'syz.1.2917': attribute type 1 has an invalid length. [ 411.106721][T17447] netlink: 'syz.4.2916': attribute type 6 has an invalid length. [ 411.115185][T17448] netlink: 'syz.4.2916': attribute type 6 has an invalid length. [ 411.195726][T17456] 8021q: adding VLAN 0 to HW filter on device bond11 [ 411.245289][T17187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 411.354356][T17466] netlink: 'syz.0.2919': attribute type 11 has an invalid length. [ 411.461766][T17187] veth0_vlan: entered promiscuous mode [ 411.492846][T17481] netlink: 'syz.1.2924': attribute type 1 has an invalid length. [ 411.612535][T17478] A٨ speed is unknown, defaulting to 1000 [ 411.668541][T17481] __nla_validate_parse: 13 callbacks suppressed [ 411.668564][T17481] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2924'. [ 411.755293][T17485] bond12: (slave veth13): Enslaving as an active interface with a down link [ 411.792220][T17187] veth1_vlan: entered promiscuous mode [ 411.859017][T17496] bond12: (slave veth15): Enslaving as an active interface with a down link [ 411.882717][T17507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2928'. [ 411.905235][T17478] wg1 speed is unknown, defaulting to 1000 [ 411.926983][T17507] gtp2: entered promiscuous mode [ 411.948353][T17507] gtp2: entered allmulticast mode [ 412.065399][T17187] veth0_macvtap: entered promiscuous mode [ 412.170427][T17518] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.2931'. [ 412.180371][T17518] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 412.196900][T17518] netlink: 'syz.1.2931': attribute type 1 has an invalid length. [ 412.216022][T17187] veth1_macvtap: entered promiscuous mode [ 412.249537][T17520] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2931'. [ 412.346441][T17518] 8021q: adding VLAN 0 to HW filter on device bond13 [ 412.444743][T17525] 8021q: adding VLAN 0 to HW filter on device bond6 [ 412.500037][T17526] bond6: (slave veth15): Enslaving as an active interface with a down link [ 412.670184][T17528] bond6: (slave dummy0): making interface the new active one [ 412.683130][T17528] dummy0: entered promiscuous mode [ 412.692959][T17528] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 412.736364][T17187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 412.849648][T17187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 412.899031][ T73] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.933676][ T73] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.950421][ T73] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.967985][ T5842] Bluetooth: hci1: command tx timeout [ 412.979120][ T1147] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.224438][T17537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 413.235877][ T84] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.256053][ T84] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.288438][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 413.436732][ T84] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.445891][ T84] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.480822][T17542] Bluetooth: MGMT ver 1.23 [ 413.540314][T17540] syzkaller0: entered promiscuous mode [ 413.545862][T17540] syzkaller0: entered allmulticast mode [ 413.923271][T17564] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.2942'. [ 413.955977][T17564] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 414.001831][T17564] 8021q: adding VLAN 0 to HW filter on device bond10 [ 414.013165][T17564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2942'. [ 414.045045][T17568] block nbd0: not configured, cannot reconfigure [ 414.153721][T17576] veth0: Caught tx_queue_len zero misconfig [ 414.285313][T17581] A٨ speed is unknown, defaulting to 1000 [ 414.373041][T17581] wg1 speed is unknown, defaulting to 1000 [ 414.380407][T17585] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 414.698018][T17596] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2950'. [ 414.744957][T17596] IPVS: set_ctl: invalid protocol: 12 172.30.1.2:20004 [ 414.985693][T17599] validate_nla: 2 callbacks suppressed [ 414.985715][T17599] netlink: 'syz.1.2951': attribute type 8 has an invalid length. [ 415.063388][T17604] netlink: 'syz.4.2954': attribute type 1 has an invalid length. [ 415.348268][T17609] A٨ speed is unknown, defaulting to 1000 [ 415.373722][T17609] wg1 speed is unknown, defaulting to 1000 [ 415.476372][T17618] A٨ speed is unknown, defaulting to 1000 [ 415.530070][ T5837] Bluetooth: hci2: command 0x0406 tx timeout [ 415.536211][ T5842] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 415.576093][T17629] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2958'. [ 415.834493][T17634] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2960'. [ 416.028809][T17618] wg1 speed is unknown, defaulting to 1000 [ 416.109250][T17644] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 416.451652][T17655] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2965'. [ 416.509502][T17655] team0: Port device team_slave_0 removed [ 416.538736][T17660] batman_adv: batadv0: Adding interface: ipvlan2 [ 416.550178][T17660] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 416.583527][T17660] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 416.596352][T17660] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 416.610376][T17660] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 416.632629][T17612] rdma_rxe: rxe_newlink: failed to add gre0 [ 416.944165][T17665] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2966'. [ 417.301951][T17682] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2971'. [ 417.360744][T17685] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2973'. [ 417.489759][T17688] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2972'. [ 417.544212][T17686] A٨ speed is unknown, defaulting to 1000 [ 417.582402][T17686] wg1 speed is unknown, defaulting to 1000 [ 417.606127][T17688] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2972'. [ 418.070136][T17714] A٨ speed is unknown, defaulting to 1000 [ 418.112156][T17718] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2979'. [ 418.134847][T17714] wg1 speed is unknown, defaulting to 1000 [ 418.137634][T17716] syzkaller0: entered promiscuous mode [ 418.147681][T17716] syzkaller0: entered allmulticast mode [ 418.157951][T17721] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2981'. [ 418.262651][T17718] bond7: entered promiscuous mode [ 418.268767][T17718] 8021q: adding VLAN 0 to HW filter on device bond7 [ 418.302605][T17712] 8021q: adding VLAN 0 to HW filter on device bond7 [ 418.313640][T17712] bond7: (slave vti0): The slave device specified does not support setting the MAC address [ 418.326245][T17712] bond7: (slave vti0): Error -95 calling set_mac_address [ 418.763387][T17732] geneve2: entered promiscuous mode [ 418.772535][T17732] geneve2: entered allmulticast mode [ 419.077985][T17762] openvswitch: netlink: IP tunnel attribute has 5 unknown bytes. [ 419.400203][T17775] netlink: 'syz.0.2992': attribute type 5 has an invalid length. [ 419.452195][T17779] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2992'. [ 419.691650][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 419.703955][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 419.713154][ T5837] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 419.721963][ T5837] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 419.733424][ T5837] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 419.889801][T17782] A٨ speed is unknown, defaulting to 1000 [ 419.900397][T17782] wg1 speed is unknown, defaulting to 1000 [ 420.304872][T17791] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2997'. [ 420.891553][T17782] chnl_net:caif_netlink_parms(): no params data found [ 421.010394][T17833] tc action pedit 'at' offset 6 out of bounds [ 421.056964][T17829] A٨ speed is unknown, defaulting to 1000 [ 421.105327][T17829] wg1 speed is unknown, defaulting to 1000 [ 421.145903][T17782] bridge0: port 1(bridge_slave_0) entered blocking state [ 421.166211][T17782] bridge0: port 1(bridge_slave_0) entered disabled state [ 421.190430][T17782] bridge_slave_0: entered allmulticast mode [ 421.213146][T17782] bridge_slave_0: entered promiscuous mode [ 421.235200][T17782] bridge0: port 2(bridge_slave_1) entered blocking state [ 421.254966][T17782] bridge0: port 2(bridge_slave_1) entered disabled state [ 421.273655][T17782] bridge_slave_1: entered allmulticast mode [ 421.296302][T17782] bridge_slave_1: entered promiscuous mode [ 421.489378][T17782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 421.568299][T17782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.683420][T17782] team0: Port device team_slave_0 added [ 421.736955][T17839] A٨ speed is unknown, defaulting to 1000 [ 421.750642][T17782] team0: Port device team_slave_1 added [ 421.848971][ T5842] Bluetooth: hci3: command tx timeout [ 421.875333][T17782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 421.894629][T17782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 421.993609][T17782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 422.057179][T17782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 422.104011][T17782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.214484][T17782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 422.318594][T17839] wg1 speed is unknown, defaulting to 1000 [ 422.457324][T17852] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.3011'. [ 422.480903][T17852] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 422.501610][T17782] hsr_slave_0: entered promiscuous mode [ 422.512363][T17782] hsr_slave_1: entered promiscuous mode [ 422.521188][T17782] debugfs: 'hsr0' already exists in 'hsr' [ 422.527138][T17782] Cannot create hsr debugfs directory [ 422.538602][T17852] netlink: 'syz.4.3011': attribute type 1 has an invalid length. [ 422.607154][T17852] 8021q: adding VLAN 0 to HW filter on device bond8 [ 422.616148][T17855] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3011'. [ 422.988907][T17866] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3014'. [ 423.013601][T17866] netlink: 'syz.3.3014': attribute type 20 has an invalid length. [ 423.022773][T17866] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3014'. [ 423.098722][T17862] siw: device registration error -23 [ 423.325030][T17875] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3016'. [ 423.518893][T17884] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3017'. [ 423.590888][T17885] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3017'. [ 423.726405][T17889] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3019'. [ 423.929521][ T5842] Bluetooth: hci3: command tx timeout [ 424.022751][T17895] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.3022'. [ 424.032464][T17895] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 424.047215][T17895] netlink: 'syz.4.3022': attribute type 1 has an invalid length. [ 424.103867][T17895] 8021q: adding VLAN 0 to HW filter on device bond9 [ 424.124484][T17897] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3023'. [ 424.157892][T17900] openvswitch: netlink: EtherType 50a is less than min 600 [ 424.391998][T17909] netlink: 'syz.0.3027': attribute type 39 has an invalid length. [ 424.401092][T17911] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 424.446660][T17782] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 424.631209][T17782] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 424.655990][T17782] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 424.681615][T17782] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 424.872400][T17935] netlink: 'syz.0.3031': attribute type 5 has an invalid length. [ 425.083262][T17782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 425.096712][T17948] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 425.144774][T17948] netlink: 'syz.3.3035': attribute type 1 has an invalid length. [ 425.153281][T17782] 8021q: adding VLAN 0 to HW filter on device team0 [ 425.180932][ T84] bridge0: port 1(bridge_slave_0) entered blocking state [ 425.188141][ T84] bridge0: port 1(bridge_slave_0) entered forwarding state [ 425.269541][ T1357] bridge0: port 2(bridge_slave_1) entered blocking state [ 425.276705][ T1357] bridge0: port 2(bridge_slave_1) entered forwarding state [ 425.410600][ T84] dummy0: left promiscuous mode [ 425.511556][T17962] A٨ speed is unknown, defaulting to 1000 [ 425.541809][T17962] wg1 speed is unknown, defaulting to 1000 [ 425.595185][T17966] bridge1: entered promiscuous mode [ 425.603694][T17966] bridge1: entered allmulticast mode [ 425.616171][T17966] team0: Failed to send port change of device bridge1 via netlink (err -105) [ 425.629957][T17966] team0: Failed to send options change via netlink (err -105) [ 425.637626][T17966] team0: Port device bridge1 added [ 425.907296][T17782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 426.008377][ T5842] Bluetooth: hci3: command tx timeout [ 426.034514][T17979] A٨ speed is unknown, defaulting to 1000 [ 426.055986][T17986] netlink: 'syz.2.3045': attribute type 1 has an invalid length. [ 426.076810][T17980] A٨ speed is unknown, defaulting to 1000 [ 426.114217][T17979] wg1 speed is unknown, defaulting to 1000 [ 426.263637][T17782] veth0_vlan: entered promiscuous mode [ 426.298259][T17782] veth1_vlan: entered promiscuous mode [ 426.380649][T17782] veth0_macvtap: entered promiscuous mode [ 426.392651][T17782] veth1_macvtap: entered promiscuous mode [ 426.527162][T17782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 426.601195][T17999] netlink: 'syz.0.3048': attribute type 1 has an invalid length. [ 426.633810][T17782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 426.728917][T17999] 8021q: adding VLAN 0 to HW filter on device bond11 [ 426.751556][ T1147] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.768397][ T1147] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.777273][ T1147] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.798705][ T1147] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.982292][T17980] wg1 speed is unknown, defaulting to 1000 [ 427.012700][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.040266][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.148102][T18010] syzkaller1: entered promiscuous mode [ 427.169153][T18010] syzkaller1: entered allmulticast mode [ 427.197709][ T171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.229623][ T171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.795175][T18034] __nla_validate_parse: 9 callbacks suppressed [ 427.795196][T18034] netlink: 160 bytes leftover after parsing attributes in process `syz.1.3058'. [ 428.075855][ T5837] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 428.088767][ T5837] Bluetooth: hci3: command tx timeout [ 428.094477][ T5149] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 428.103481][ T5149] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 428.111876][ T5149] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 428.120589][ T5149] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 428.431105][T18059] veth0_virt_wifi: Caught tx_queue_len zero misconfig [ 428.451785][T18059] netem: incorrect ge model size [ 428.463964][T18059] netem: change failed [ 428.734923][T18049] A٨ speed is unknown, defaulting to 1000 [ 428.752465][T18049] wg1 speed is unknown, defaulting to 1000 [ 429.127531][T18056] A٨ speed is unknown, defaulting to 1000 [ 429.181779][T18056] wg1 speed is unknown, defaulting to 1000 [ 429.745409][T18049] chnl_net:caif_netlink_parms(): no params data found [ 429.913843][T18111] netlink: 'syz.3.3079': attribute type 1 has an invalid length. [ 429.965011][T18111] netlink: 'syz.3.3079': attribute type 2 has an invalid length. [ 429.973091][T18111] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3079'. [ 430.062847][T18120] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3080'. [ 430.079550][T18049] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.087531][T18049] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.096947][T18120] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3080'. [ 430.110455][T18049] bridge_slave_0: entered allmulticast mode [ 430.119503][T18049] bridge_slave_0: entered promiscuous mode [ 430.206643][T18049] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.218626][T18049] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.226355][T18049] bridge_slave_1: entered allmulticast mode [ 430.236348][T18049] bridge_slave_1: entered promiscuous mode [ 430.251524][ T5149] Bluetooth: hci0: command tx timeout [ 430.263494][T18122] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3081'. [ 430.368897][T18049] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.498893][T18049] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 430.732828][T18135] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3084'. [ 430.758352][T18135] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 430.772691][T18049] team0: Port device team_slave_0 added [ 430.824234][T18049] team0: Port device team_slave_1 added [ 430.962381][T18138] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3085'. [ 430.983526][T18138] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3085'. [ 431.009721][T18049] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 431.016732][T18049] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 431.063421][T18049] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 431.087628][T18049] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 431.094772][T18049] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 431.165504][T18049] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 431.367499][T18049] hsr_slave_0: entered promiscuous mode [ 431.400059][T18049] hsr_slave_1: entered promiscuous mode [ 431.411455][T18049] debugfs: 'hsr0' already exists in 'hsr' [ 431.417267][T18049] Cannot create hsr debugfs directory [ 431.505607][T18164] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3091'. [ 431.557952][T18164] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3091'. [ 431.797468][T18164] veth5: entered promiscuous mode [ 432.012611][T18049] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.131183][T18183] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 432.155745][T18183] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 432.200159][T18049] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.266110][T18187] Cannot find set identified by id 65534 to match [ 432.286240][T18049] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.329915][ T5149] Bluetooth: hci0: command tx timeout [ 432.380438][T18187] tap0: tun_chr_ioctl cmd 1074025681 [ 432.561302][T18049] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.770396][T18210] bond0: entered promiscuous mode [ 432.775520][T18210] bond_slave_0: entered promiscuous mode [ 432.812932][T18210] bond_slave_1: entered promiscuous mode [ 432.831713][T18210] dummy0: entered promiscuous mode [ 432.840818][T18218] __nla_validate_parse: 1 callbacks suppressed [ 432.840837][T18218] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3104'. [ 432.861943][T18210] gretap0: entered promiscuous mode [ 432.873248][T18210] debugfs: 'hsr1' already exists in 'hsr' [ 432.891461][T18210] Cannot create hsr debugfs directory [ 432.903542][T18210] hsr1: entered promiscuous mode [ 433.075320][T18049] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 433.105098][T18049] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 433.151889][T18049] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 433.173570][T18049] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 433.443344][T18049] 8021q: adding VLAN 0 to HW filter on device bond0 [ 433.518525][T18049] 8021q: adding VLAN 0 to HW filter on device team0 [ 433.543802][T18245] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3111'. [ 433.557472][ T73] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.564726][ T73] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.594693][T18245] netlink: 'syz.3.3111': attribute type 3 has an invalid length. [ 433.665927][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.673141][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 433.740371][T18257] dvmrp0: entered allmulticast mode [ 433.809204][T18264] netlink: 876 bytes leftover after parsing attributes in process `syz.0.3119'. [ 433.825924][T18264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3119'. [ 434.406361][T18049] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 434.413895][ T5149] Bluetooth: hci0: command tx timeout [ 434.689195][T18312] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 435.254571][T18049] veth0_vlan: entered promiscuous mode [ 435.284611][T18049] veth1_vlan: entered promiscuous mode [ 435.383961][T18049] veth0_macvtap: entered promiscuous mode [ 435.409887][T18049] veth1_macvtap: entered promiscuous mode [ 435.547146][T18049] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 435.601729][T18049] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 435.720711][ T1370] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.733704][T18333] netlink: 'syz.1.3133': attribute type 1 has an invalid length. [ 435.749624][T18333] netlink: 'syz.1.3133': attribute type 2 has an invalid length. [ 435.750337][ T1370] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.821158][ T1370] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.842019][ T1370] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.872317][T18348] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 436.056054][ T171] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.103154][ T171] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.192851][T18355] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3139'. [ 436.219111][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.226997][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.499221][ T5842] Bluetooth: hci0: command tx timeout [ 436.567024][T18364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3142'. [ 436.576322][T18364] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3142'. [ 436.585416][T18364] netlink: 'syz.1.3142': attribute type 6 has an invalid length. [ 436.593342][T18364] netlink: 'syz.1.3142': attribute type 5 has an invalid length. [ 436.611731][T18364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3142'. [ 436.621690][ T1357] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.645318][T18364] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3142'. [ 436.680970][ T1357] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.701035][T18364] netlink: 'syz.1.3142': attribute type 6 has an invalid length. [ 436.746505][ T1357] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.759266][T18364] netlink: 'syz.1.3142': attribute type 5 has an invalid length. [ 436.772013][ T1357] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.935703][T18375] macsec1: entered promiscuous mode [ 436.951982][T18375] macsec1: entered allmulticast mode [ 437.000183][T18380] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 437.134399][T18387] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 437.295676][T18397] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 3 [ 437.305706][T18401] tipc: Failed to remove unknown binding: 66,1,1/0:1406078950/1406078952 [ 437.327654][T18401] tipc: Failed to remove unknown binding: 66,1,1/0:1406078950/1406078952 [ 437.342893][T18401] tipc: Failed to remove unknown binding: 66,1,1/0:1406078950/1406078952 [ 437.379607][T18404] tc_dump_action: action bad kind [ 437.551443][T18410] netlink: 'syz.4.3156': attribute type 1 has an invalid length. [ 437.580501][T18410] netlink: 'syz.4.3156': attribute type 2 has an invalid length. [ 437.723145][T18416] wg1: entered promiscuous mode [ 437.750254][T18416] wg1: entered allmulticast mode [ 437.998995][T18428] __nla_validate_parse: 3 callbacks suppressed [ 437.999017][T18428] netlink: 212340 bytes leftover after parsing attributes in process `syz.2.3164'. [ 438.050681][T18428] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 438.061176][ T5149] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 438.092187][ T5149] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 438.103680][ T5149] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 438.117585][ T5149] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 438.125962][ T5149] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 438.181100][T18430] A٨ speed is unknown, defaulting to 1000 [ 438.189608][T18430] wg1 speed is unknown, defaulting to 1000 [ 438.506698][T18444] wg1: entered promiscuous mode [ 438.512037][T18444] wg1: entered allmulticast mode [ 438.728119][T18445] A٨ speed is unknown, defaulting to 1000 [ 438.786673][T18457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3172'. [ 438.838034][T18459] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3172'. [ 438.862253][T18445] wg1 speed is unknown, defaulting to 1000 [ 439.127516][T18467] netlink: 212340 bytes leftover after parsing attributes in process `syz.2.3175'. [ 439.138335][T18467] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 439.152966][T18468] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3174'. [ 439.169305][T18470] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3176'. [ 439.335283][T18475] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3177'. [ 439.365678][T18430] chnl_net:caif_netlink_parms(): no params data found [ 439.755283][T18486] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 439.951884][T18430] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.968097][T18430] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.975740][T18430] bridge_slave_0: entered allmulticast mode [ 439.984633][T18430] bridge_slave_0: entered promiscuous mode [ 439.999487][T18491] A٨ speed is unknown, defaulting to 1000 [ 440.006282][T18430] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.016548][T18430] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.036125][T18430] bridge_slave_1: entered allmulticast mode [ 440.046764][T18430] bridge_slave_1: entered promiscuous mode [ 440.064775][T18491] wg1 speed is unknown, defaulting to 1000 [ 440.173666][ T5842] Bluetooth: hci4: command tx timeout [ 440.201523][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 440.231780][T18430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 440.253266][T18430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 440.334029][T18430] team0: Port device team_slave_0 added [ 440.547075][T18518] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.3186'. [ 440.568816][T18518] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 440.598470][ T1357] bond3 (unregistering): (slave ip6gretap1): Releasing active interface [ 440.604523][T18518] netlink: 'syz.4.3186': attribute type 1 has an invalid length. [ 440.748235][ T1357] batman_adv: batadv0: Removing interface: vlan2 [ 441.033567][ T1357] bond4 (unregistering): (slave bridge5): Releasing backup interface [ 441.042272][ T1357] bridge5 (unregistering): left promiscuous mode [ 441.249871][ T1357] bond0 (unregistering): Released all slaves [ 441.261226][ T1357] bond1 (unregistering): Released all slaves [ 441.281701][ T1357] bond2 (unregistering): Released all slaves [ 441.305237][ T1357] bond3 (unregistering): Released all slaves [ 441.321533][ T1357] bond4 (unregistering): Released all slaves [ 441.350502][ T1357] bond5 (unregistering): Released all slaves [ 441.369601][ T1357] bond6 (unregistering): Released all slaves [ 441.385136][ T1357] bond7 (unregistering): Released all slaves [ 441.400836][ T1357] bond8 (unregistering): Released all slaves [ 441.415580][ T1357] bond9 (unregistering): Released all slaves [ 441.442655][ T1357] bond10 (unregistering): Released all slaves [ 441.463763][ T1357] bond11 (unregistering): Released all slaves [ 441.481736][ T1357] bond12 (unregistering): (slave veth13): Releasing active interface [ 441.492608][ T1357] bond12 (unregistering): (slave veth15): Releasing active interface [ 441.506227][ T1357] bond12 (unregistering): Released all slaves [ 441.523463][ T1357] bond13 (unregistering): Released all slaves [ 441.546464][T18430] team0: Port device team_slave_1 added [ 441.649719][T18430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 441.656725][T18430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.699725][T18430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 441.717039][T18430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 441.724536][T18430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.767172][T18430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 441.814469][T18529] openvswitch: netlink: Message has 8 unknown bytes. [ 441.822696][T18525] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3189'. [ 441.848710][T18528] netlink: 248 bytes leftover after parsing attributes in process `syz.4.3190'. [ 441.861349][T18529] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 441.873734][T18528] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 441.879390][ T1357] l24): left promiscuous mode [ 442.011914][ T1346] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.058579][ T1357] tipc: Disabling bearer [ 442.078760][ T1357] tipc: Left network mode [ 442.185868][ T1346] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.219348][ T1346] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.248683][ T5149] Bluetooth: hci4: command tx timeout [ 442.269952][T18430] hsr_slave_0: entered promiscuous mode [ 442.276963][T18430] hsr_slave_1: entered promiscuous mode [ 442.284041][T18430] debugfs: 'hsr0' already exists in 'hsr' [ 442.290411][T18430] Cannot create hsr debugfs directory [ 442.298387][T18534] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 442.512979][ T171] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.674609][T18546] syzkaller0: entered promiscuous mode [ 442.712550][T18546] syzkaller0: entered allmulticast mode [ 443.002535][T18568] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 443.064349][T18568] netlink: 'syz.3.3199': attribute type 1 has an invalid length. [ 443.147007][T18568] 8021q: adding VLAN 0 to HW filter on device bond1 [ 443.283500][T18430] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.445737][T18430] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.546409][T18596] RDS: rds_bind could not find a transport for fc02::, load rds_tcp or rds_rdma? [ 443.580820][T18430] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.642689][T18602] netlink: 'syz.3.3207': attribute type 1 has an invalid length. [ 443.667326][T18602] __nla_validate_parse: 8 callbacks suppressed [ 443.667347][T18602] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3207'. [ 443.676921][T18598] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3207'. [ 443.695546][T18602] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3207'. [ 443.704993][T18602] netlink: 658 bytes leftover after parsing attributes in process `syz.3.3207'. [ 443.748173][T18598] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3207'. [ 443.789534][T18430] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.817717][T18609] netlink: 92 bytes leftover after parsing attributes in process `syz.1.3209'. [ 443.917329][T14544] IPVS: starting estimator thread 0... [ 444.018780][T18618] IPVS: using max 33 ests per chain, 79200 per kthread [ 444.031646][T18622] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.3212'. [ 444.079660][T18622] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 444.115957][T18622] netlink: 'syz.1.3212': attribute type 1 has an invalid length. [ 444.269413][T18622] 8021q: adding VLAN 0 to HW filter on device bond1 [ 444.330857][ T5149] Bluetooth: hci4: command tx timeout [ 444.549260][T18634] Bluetooth: MGMT ver 1.23 [ 444.601883][T18647] netlink: 'syz.1.3219': attribute type 10 has an invalid length. [ 444.782135][T18647] team0 (unregistering): Port device team_slave_0 removed [ 444.822280][T18647] team0 (unregistering): Port device team_slave_1 removed [ 444.883723][T18652] veth1_macvtap: left promiscuous mode [ 444.897141][T18652] macsec0: entered promiscuous mode [ 444.913840][T18652] macsec0: entered allmulticast mode [ 444.936714][T18430] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 445.094758][T18662] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3222'. [ 445.189238][T18664] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3223'. [ 445.207906][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 445.216080][ C0] lec:lec_tx_timeout: lec0 [ 445.264922][T18655] veth1_macvtap: renamed from veth0_vlan [ 445.274470][T18430] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 445.288915][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 445.353116][T18668] netlink: 'syz.2.3224': attribute type 1 has an invalid length. [ 445.365849][T18430] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 445.411334][T18430] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 445.422471][T18674] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3224'. [ 445.523776][T18668] bond2: entered promiscuous mode [ 445.529508][T18668] 8021q: adding VLAN 0 to HW filter on device bond2 [ 445.576434][ T1357] hsr_slave_0: left promiscuous mode [ 446.217469][T18674] bond2: entered allmulticast mode [ 446.260765][T18683] bond2: (slave bridge2): making interface the new active one [ 446.269021][T18683] bridge2: entered promiscuous mode [ 446.274575][T18683] bridge2: entered allmulticast mode [ 446.283770][T18683] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 446.309881][T18693] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 446.408506][ T5149] Bluetooth: hci4: command tx timeout [ 446.554749][T18716] netlink: 'syz.1.3233': attribute type 1 has an invalid length. [ 446.699120][T18430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.746903][T18430] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.759373][ T1357] IPVS: stop unused estimator thread 0... [ 446.823537][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.830875][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.874903][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.882137][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 447.522401][T18765] syzkaller1: entered promiscuous mode [ 447.548490][T18765] syzkaller1: entered allmulticast mode [ 447.601392][T18767] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 447.634767][T18765] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 447.685232][T18430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 447.696807][T18767] 8021q: VLANs not supported on ip6_vti0 [ 447.737595][T18777] netlink: 'syz.3.3244': attribute type 1 has an invalid length. [ 447.907062][T18430] veth0_vlan: entered promiscuous mode [ 447.990825][T18430] veth1_vlan: entered promiscuous mode [ 448.081312][T18430] veth0_macvtap: entered promiscuous mode [ 448.126629][T18430] veth1_macvtap: entered promiscuous mode [ 448.179569][ T5493] veth1_macvtap: left promiscuous mode [ 448.211922][ T5493] veth1_macvtap: entered promiscuous mode [ 448.245594][T18430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 448.273159][T18430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 448.360014][ T171] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.370529][ T171] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.404922][ T171] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.452922][ T171] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.489941][ T5149] Bluetooth: hci4: command tx timeout [ 448.703308][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.741356][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 448.804282][T18801] syzkaller0: entered promiscuous mode [ 448.822023][T18801] syzkaller0: entered allmulticast mode [ 448.905564][ T1357] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 448.929899][ T1357] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 449.159336][T18814] block nbd0: server does not support multiple connections per device. [ 449.180232][T18814] block nbd0: shutting down sockets [ 449.302250][T18825] netlink: 'syz.3.3256': attribute type 30 has an invalid length. [ 449.323082][T18820] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 449.335890][T18825] __nla_validate_parse: 7 callbacks suppressed [ 449.335910][T18825] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3256'. [ 449.446739][T18825] bond2: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 449.501892][T18825] bond2 (unregistering): Released all slaves [ 449.812049][T18847] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3260'. [ 450.434930][T18879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3268'. [ 450.456668][T18879] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3268'. [ 450.501908][T18885] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3271'. [ 450.513894][T18888] netlink: 'syz.1.3270': attribute type 8 has an invalid length. [ 450.572500][T18879] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3268'. [ 450.583038][T18889] netlink: 'syz.1.3270': attribute type 8 has an invalid length. [ 450.859158][T18908] netlink: 'syz.2.3275': attribute type 11 has an invalid length. [ 450.867573][T18903] gretap0: entered promiscuous mode [ 450.887359][T18903] vlan2: entered promiscuous mode [ 450.916877][T18899] A٨ speed is unknown, defaulting to 1000 [ 450.923970][T18909] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3276'. [ 450.988330][T18899] wg1 speed is unknown, defaulting to 1000 [ 451.050413][T18895] A٨ speed is unknown, defaulting to 1000 [ 451.634490][T18895] wg1 speed is unknown, defaulting to 1000 [ 451.652065][T18938] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3281'. [ 451.733597][T18940] netlink: 276 bytes leftover after parsing attributes in process `syz.3.3283'. [ 451.759231][T18940] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3283'. [ 451.805668][T18940] netlink: 'syz.3.3283': attribute type 10 has an invalid length. [ 451.880628][T18940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 451.911859][T18940] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 452.307640][T18969] netlink: 'syz.2.3291': attribute type 1 has an invalid length. [ 452.696660][T18951] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 452.905005][T18988] lo: entered allmulticast mode [ 452.980057][T18999] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 453.415559][T19012] lo: entered promiscuous mode [ 453.426757][T19011] lo: left promiscuous mode [ 453.887059][T19029] netlink: 'syz.4.3307': attribute type 29 has an invalid length. [ 454.008547][ T5149] Bluetooth: hci0: command 0x0401 tx timeout [ 454.624902][T19074] netem: change failed [ 454.841104][T19078] __nla_validate_parse: 7 callbacks suppressed [ 454.841120][T19078] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3320'. [ 456.128430][T19004] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 456.369227][T19093] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3324'. [ 456.435128][T19093] geneve2: entered promiscuous mode [ 456.544484][T19100] IPv6: addrconf: prefix option has invalid lifetime [ 456.632967][T19088] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3323'. [ 456.995922][T19124] A٨ speed is unknown, defaulting to 1000 [ 457.014519][T19124] wg1 speed is unknown, defaulting to 1000 [ 457.372085][T19143] pim6reg99999999: entered allmulticast mode [ 457.739658][T19161] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3345'. [ 457.785041][T19158] netlink: 'syz.4.3342': attribute type 1 has an invalid length. [ 457.880599][T19154] netlink: 'syz.3.3343': attribute type 11 has an invalid length. [ 457.890353][T19158] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 457.916432][T19172] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3347'. [ 458.045001][T19169] A٨ speed is unknown, defaulting to 1000 [ 458.065879][T19169] wg1 speed is unknown, defaulting to 1000 [ 458.275846][T19176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3348'. [ 458.317609][T19176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3348'. [ 458.840346][T19189] Cannot find del_set index 1536 as target [ 458.866083][T19189] netlink: 'syz.4.3352': attribute type 39 has an invalid length. [ 458.961342][T19193] netlink: 'syz.3.3354': attribute type 1 has an invalid length. [ 458.990875][T19193] netlink: 'syz.3.3354': attribute type 2 has an invalid length. [ 459.007896][T19193] netlink: 'syz.3.3354': attribute type 1 has an invalid length. [ 459.021054][T19193] netlink: 'syz.3.3354': attribute type 1 has an invalid length. [ 459.030130][T19193] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3354'. [ 459.040088][T19193] netlink: 658 bytes leftover after parsing attributes in process `syz.3.3354'. [ 459.153502][T19193] bond2: option tlb_dynamic_lb: invalid value (5) [ 459.165127][T19193] bond2 (unregistering): Released all slaves [ 459.188858][T19199] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3355'. [ 459.441033][T19202] netlink: 'syz.4.3357': attribute type 4 has an invalid length. [ 459.552471][T19202] bond1: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 459.571842][T19202] bond1 (unregistering): Released all slaves [ 459.852179][T19224] __nla_validate_parse: 4 callbacks suppressed [ 459.852200][T19224] netlink: 180 bytes leftover after parsing attributes in process `syz.0.3364'. [ 459.888572][T19224] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3364'. [ 459.946905][T19228] bond2: option primary_reselect: invalid value (4) [ 459.980973][T19228] bond2 (unregistering): Released all slaves [ 460.332995][T19252] A٨ speed is unknown, defaulting to 1000 [ 460.352402][T19252] wg1 speed is unknown, defaulting to 1000 [ 460.432872][T19258] IPv6: addrconf: prefix option has invalid lifetime [ 460.847614][T19276] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3377'. [ 460.860211][T19281] netlink: 'syz.1.3378': attribute type 62 has an invalid length. [ 461.136028][T19297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3380'. [ 461.623899][T19324] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3386'. [ 461.820518][T19325] vlan2: entered allmulticast mode [ 461.878018][T19325] bridge3: entered allmulticast mode [ 462.246528][T19348] ipt_rpfilter: unknown options [ 462.673811][T19366] bridge1: entered promiscuous mode [ 462.686193][T19366] bridge1: entered allmulticast mode [ 462.896414][T19376] IPVS: set_ctl: invalid protocol: 55274 127.0.0.1:20004 [ 463.409742][T19395] bond2: entered promiscuous mode [ 463.414847][T19395] bond2: entered allmulticast mode [ 463.485896][T19409] netlink: 'syz.0.3405': attribute type 4 has an invalid length. [ 463.501548][T19395] 8021q: adding VLAN 0 to HW filter on device bond2 [ 463.535151][T19396] syzkaller0: entered promiscuous mode [ 463.551314][T19396] syzkaller0: entered allmulticast mode [ 463.885786][T19435] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3408'. [ 463.915076][T19427] bond3: entered promiscuous mode [ 463.946580][T19435] vcan1: entered promiscuous mode [ 463.964961][T19435] vcan1: entered allmulticast mode [ 463.984004][T19420] A٨ speed is unknown, defaulting to 1000 [ 464.031939][T19420] wg1 speed is unknown, defaulting to 1000 [ 464.656729][T19456] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.3414'. [ 464.684058][T19456] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 464.712862][T19460] netlink: 'syz.3.3414': attribute type 1 has an invalid length. [ 464.915523][T19467] macvtap1: entered promiscuous mode [ 464.948568][T19467] macvtap1: entered allmulticast mode [ 464.959790][T19467] veth1_vlan: entered allmulticast mode [ 464.989602][T19469] Cannot find set identified by id 0 to match [ 465.081712][T19476] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3419'. [ 465.153108][T19474] syzkaller0: entered promiscuous mode [ 465.161479][T19474] syzkaller0: entered allmulticast mode [ 465.409881][T19493] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 465.431098][T19493] pim6reg1: entered promiscuous mode [ 465.437590][T19493] pim6reg1: entered allmulticast mode [ 465.538916][T19495] netlink: 212340 bytes leftover after parsing attributes in process `syz.2.3426'. [ 465.568263][T19495] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 465.846042][T19503] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3427'. [ 465.957132][T19519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3431'. [ 465.970022][T19519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3431'. [ 466.175104][T19527] Bluetooth: MGMT ver 1.23 [ 466.240201][T19534] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bridge, syncid = 2, id = 0 [ 466.439727][T19544] netlink: 'syz.1.3439': attribute type 1 has an invalid length. [ 466.549188][T19544] bond3: entered promiscuous mode [ 466.554679][T19544] 8021q: adding VLAN 0 to HW filter on device bond3 [ 466.672766][T19560] rdma_op ffff88805753f1f0 conn xmit_rdma 0000000000000000 [ 466.856713][T19567] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 466.887487][T19569] gre1: entered allmulticast mode [ 466.908024][ T29] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 467.135771][T19585] IPv6: addrconf: prefix option has invalid lifetime [ 467.165120][T19529] xt_CT: No such helper "syz0" [ 467.207164][T19589] netlink: 'syz.1.3451': attribute type 3 has an invalid length. [ 467.224165][T19589] openvswitch: netlink: Missing key (keys=40, expected=80) [ 467.328346][ T29] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 467.436579][T19601] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.3454'. [ 467.446185][T19601] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 467.508227][T19607] netlink: 'syz.0.3456': attribute type 11 has an invalid length. [ 467.554311][T19607] netlink: 'syz.0.3456': attribute type 23 has an invalid length. [ 467.554613][T19609] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 467.587157][T19607] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3456'. [ 467.900301][T19623] A٨ speed is unknown, defaulting to 1000 [ 467.907099][T19627] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 467.969714][T19623] wg1 speed is unknown, defaulting to 1000 [ 467.970800][T19627] netlink: 252 bytes leftover after parsing attributes in process `syz.4.3460'. [ 467.976395][ T1139] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 468.037461][T19627] openvswitch: netlink: Flow actions attr not present in new flow. [ 468.049540][T19636] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3463'. [ 468.063493][T19636] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3463'. [ 468.473575][T19655] netlink: 'syz.2.3465': attribute type 13 has an invalid length. [ 468.820235][T19663] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 468.848866][T19663] netlink: 'syz.4.3468': attribute type 1 has an invalid length. [ 469.048252][T19663] 8021q: adding VLAN 0 to HW filter on device bond1 [ 469.064095][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 469.102530][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 469.150084][ T8194] lec:lec_start_xmit: lec0:No lecd attached [ 469.498967][ T9] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 469.713615][T19688] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 469.723299][T19690] team0: entered promiscuous mode [ 469.730834][T19688] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 469.743954][T19690] team_slave_0: entered promiscuous mode [ 469.762409][T19690] team_slave_1: entered promiscuous mode [ 470.062860][T19701] A٨ speed is unknown, defaulting to 1000 [ 470.083950][T19701] wg1 speed is unknown, defaulting to 1000 [ 470.184587][T19712] __nla_validate_parse: 8 callbacks suppressed [ 470.184610][T19712] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.3482'. [ 470.239900][T19712] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 470.292072][T19712] netlink: 'syz.3.3482': attribute type 1 has an invalid length. [ 470.420508][T19712] 8021q: adding VLAN 0 to HW filter on device bond4 [ 470.428874][T19721] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 470.503344][T19720] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 470.816672][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 470.915663][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 470.944361][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 470.985316][T19736] syzkaller1: entered promiscuous mode [ 470.992801][T19736] syzkaller1: entered allmulticast mode [ 471.000816][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 471.021373][T19727] A٨ speed is unknown, defaulting to 1000 [ 471.038341][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 471.060372][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 471.094511][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 471.115615][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3484'. [ 471.353460][T19727] wg1 speed is unknown, defaulting to 1000 [ 471.558783][T19744] syz.3.3489: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 471.643182][T19744] CPU: 0 UID: 0 PID: 19744 Comm: syz.3.3489 Not tainted syzkaller #0 PREEMPT(full) [ 471.643217][T19744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 471.643232][T19744] Call Trace: [ 471.643241][T19744] [ 471.643252][T19744] dump_stack_lvl+0xe8/0x150 [ 471.643291][T19744] warn_alloc+0x249/0x340 [ 471.643320][T19744] ? stack_trace_save+0xa9/0x100 [ 471.643349][T19744] ? __pfx_warn_alloc+0x10/0x10 [ 471.643384][T19744] ? kasan_save_track+0x4f/0x80 [ 471.643408][T19744] ? kasan_save_track+0x3e/0x80 [ 471.643430][T19744] ? __kasan_kmalloc+0x93/0xb0 [ 471.643455][T19744] ? __kmalloc_cache_noprof+0x31c/0x660 [ 471.643479][T19744] ? xskq_create+0x56/0x170 [ 471.643507][T19744] ? xsk_setsockopt+0x54c/0x990 [ 471.643531][T19744] ? do_sock_setsockopt+0x17c/0x1b0 [ 471.643558][T19744] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 471.643583][T19744] ? do_syscall_64+0x14d/0xf80 [ 471.643619][T19744] __vmalloc_node_range_noprof+0x132/0x1730 [ 471.643690][T19744] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 471.643725][T19744] ? __kasan_kmalloc+0x93/0xb0 [ 471.643758][T19744] vmalloc_user_noprof+0xad/0xe0 [ 471.643784][T19744] ? xskq_create+0xbf/0x170 [ 471.643814][T19744] xskq_create+0xbf/0x170 [ 471.643845][T19744] xsk_init_queue+0x8a/0xe0 [ 471.643876][T19744] xsk_setsockopt+0x54c/0x990 [ 471.643904][T19744] ? __pfx_xsk_setsockopt+0x10/0x10 [ 471.643938][T19744] ? __pfx_aa_sk_perm+0x10/0x10 [ 471.643973][T19744] ? aa_sock_opt_perm+0xff/0x1a0 [ 471.644009][T19744] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 471.644034][T19744] ? __pfx_xsk_setsockopt+0x10/0x10 [ 471.644060][T19744] do_sock_setsockopt+0x17c/0x1b0 [ 471.644091][T19744] __x64_sys_setsockopt+0x13d/0x1b0 [ 471.644125][T19744] do_syscall_64+0x14d/0xf80 [ 471.644155][T19744] ? trace_irq_disable+0x3b/0x150 [ 471.644180][T19744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.644209][T19744] ? clear_bhb_loop+0x40/0x90 [ 471.644236][T19744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.644258][T19744] RIP: 0033:0x7f22c6f9c799 [ 471.644278][T19744] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.644297][T19744] RSP: 002b:00007f22c7e1c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 471.644320][T19744] RAX: ffffffffffffffda RBX: 00007f22c7216180 RCX: 00007f22c6f9c799 [ 471.644337][T19744] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 471.644350][T19744] RBP: 00007f22c7032c99 R08: 0000000000000004 R09: 0000000000000000 [ 471.644368][T19744] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 471.644382][T19744] R13: 00007f22c7216218 R14: 00007f22c7216180 R15: 00007ffd248acc28 [ 471.644419][T19744] [ 471.644517][T19744] Mem-Info: [ 471.983227][T19744] active_anon:10468 inactive_anon:0 isolated_anon:0 [ 471.983227][T19744] active_file:2983 inactive_file:40372 isolated_file:0 [ 471.983227][T19744] unevictable:768 dirty:103 writeback:0 [ 471.983227][T19744] slab_reclaimable:13140 slab_unreclaimable:126165 [ 471.983227][T19744] mapped:38817 shmem:4962 pagetables:1770 [ 471.983227][T19744] sec_pagetables:0 bounce:0 [ 471.983227][T19744] kernel_misc_reclaimable:0 [ 471.983227][T19744] free:1275056 free_pcp:24051 free_cma:0 [ 472.110525][T19744] Node 0 active_anon:43312kB inactive_anon:0kB active_file:11932kB inactive_file:161288kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:112580kB dirty:424kB writeback:0kB shmem:19584kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16252kB pagetables:6968kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 472.187918][T19744] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:32768kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 472.249031][T19744] Node 0 DMA free:11264kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 472.297812][T19744] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 472.303672][T19744] Node 0 DMA32 free:1226468kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:37612kB inactive_anon:0kB active_file:11932kB inactive_file:161288kB unevictable:5536kB writepending:424kB zspages:0kB present:3129332kB managed:2552352kB mlocked:4100kB bounce:0kB free_pcp:40192kB local_pcp:23596kB free_cma:0kB [ 472.378247][T19744] lowmem_reserve[]: 0 0 0 0 0 [ 472.386480][T19744] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:876kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 472.449001][T19744] lowmem_reserve[]: 0 0 0 0 0 [ 472.473521][T19744] Node 1 Normal free:3861504kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:56464kB local_pcp:32080kB free_cma:0kB [ 472.536956][T19766] ip6gre2: entered promiscuous mode [ 472.559282][T19744] lowmem_reserve[]: 0 0 0 0 0 [ 472.568050][T19744] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 2*4096kB (M) = 11264kB [ 472.600578][T19744] Node 0 DMA32: 4623*4kB (UME) 4896*8kB (UME) 2014*16kB (UM) 57*32kB (UME) 183*64kB (UME) 819*128kB (UME) 629*256kB (UME) 508*512kB (UME) 385*1024kB (UME) 101*2048kB (UM) 0*4096kB = 1230460kB [ 472.644002][T19744] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 472.667064][T19744] Node 1 Normal: 2*4kB (U) 3*8kB (UM) 4*16kB (UM) 11*32kB (UM) 9*64kB (UM) 4*128kB (UM) 4*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 2*2048kB (U) 940*4096kB (UM) = 3861504kB [ 472.687655][T19744] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 472.702122][T19744] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 472.720022][T19744] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 472.733130][T19744] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 472.743975][T19744] 45783 total pagecache pages [ 472.749280][T19775] netlink: 'syz.1.3496': attribute type 3 has an invalid length. [ 472.761140][T19744] 0 pages in swap cache [ 472.765613][T19744] Free swap = 124996kB [ 472.774828][T19744] Total swap = 124996kB [ 472.779581][T19744] 2097051 pages RAM [ 472.783711][T19744] 0 pages HighMem/MovableOnly [ 472.789995][T19744] 427129 pages reserved [ 472.794417][T19744] 0 pages cma reserved [ 472.888890][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 473.240196][T19779] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 473.257062][T19779] netlink: 'syz.0.3497': attribute type 1 has an invalid length. [ 473.289732][T19779] 8021q: adding VLAN 0 to HW filter on device bond1 [ 473.431670][T19783] xt_hashlimit: max too large, truncated to 1048576 [ 473.686499][T19790] A٨ speed is unknown, defaulting to 1000 [ 473.694985][T19790] wg1 speed is unknown, defaulting to 1000 [ 474.060019][T19740] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 474.157893][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 474.166046][ C0] lec:lec_tx_timeout: lec0 [ 474.214647][T19799] tipc: Invalid UDP bearer configuration [ 474.214704][T19799] tipc: Enabling of bearer rejected, failed to enable media [ 474.409596][T19799] netlink: 'syz.4.3501': attribute type 4 has an invalid length. [ 474.573089][T19808] A٨ speed is unknown, defaulting to 1000 [ 474.682503][T19808] wg1 speed is unknown, defaulting to 1000 [ 474.942515][T19824] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 474.962019][T19824] netlink: 'syz.1.3508': attribute type 1 has an invalid length. [ 475.024045][T19824] 8021q: adding VLAN 0 to HW filter on device bond4 [ 475.528876][T19856] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 475.639422][T19859] __nla_validate_parse: 20 callbacks suppressed [ 475.639447][T19859] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3514'. [ 477.224059][T19902] netlink: 212340 bytes leftover after parsing attributes in process `syz.2.3524'. [ 477.244381][T19902] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 477.260406][T19900] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3526'. [ 477.281024][T19907] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3526'. [ 477.300832][T19908] netlink: 'syz.2.3524': attribute type 1 has an invalid length. [ 477.387878][T19911] xt_TCPMSS: Only works on TCP SYN packets [ 477.404015][T19908] 8021q: adding VLAN 0 to HW filter on device bond3 [ 477.420485][T19911] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3527'. [ 477.431388][T19913] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3528'. [ 477.505383][T19913] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3528'. [ 477.544043][T19920] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3532'. [ 477.555984][T19918] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3528'. [ 477.569759][T19920] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3532'. [ 477.891911][T19938] A٨ speed is unknown, defaulting to 1000 [ 477.909637][T19938] wg1 speed is unknown, defaulting to 1000 [ 477.964346][T19946] netlink: 'syz.3.3537': attribute type 4 has an invalid length. [ 478.250969][T19952] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 478.306783][T19956] netlink: 'syz.4.3540': attribute type 1 has an invalid length. [ 478.396198][T19956] 8021q: adding VLAN 0 to HW filter on device bond2 [ 478.834891][T19968] netlink: 'syz.1.3543': attribute type 1 has an invalid length. [ 478.884223][T19970] A٨ speed is unknown, defaulting to 1000 [ 478.912011][T19970] wg1 speed is unknown, defaulting to 1000 [ 480.149186][T20004] netlink: 'syz.2.3551': attribute type 11 has an invalid length. [ 480.170017][T20005] netlink: 'syz.2.3551': attribute type 11 has an invalid length. [ 480.488624][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 480.575305][T20015] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 480.912837][T20037] netlink: 'syz.2.3560': attribute type 8 has an invalid length. [ 481.018675][T20043] FAULT_INJECTION: forcing a failure. [ 481.018675][T20043] name failslab, interval 1, probability 0, space 0, times 0 [ 481.063004][T20043] CPU: 0 UID: 0 PID: 20043 Comm: syz.4.3561 Not tainted syzkaller #0 PREEMPT(full) [ 481.063036][T20043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 481.063050][T20043] Call Trace: [ 481.063059][T20043] [ 481.063068][T20043] dump_stack_lvl+0xe8/0x150 [ 481.063106][T20043] should_fail_ex+0x412/0x560 [ 481.063153][T20043] should_failslab+0xa8/0x100 [ 481.063182][T20043] ? dst_alloc+0x105/0x170 [ 481.063212][T20043] kmem_cache_alloc_noprof+0x87/0x650 [ 481.063235][T20043] ? __pfx_find_exception+0x10/0x10 [ 481.063261][T20043] ? fib_lookup+0x76/0x440 [ 481.063288][T20043] dst_alloc+0x105/0x170 [ 481.063324][T20043] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 481.063351][T20043] ? ip_route_output_key_hash_rcu+0x1271/0x25d0 [ 481.063387][T20043] ? ip_route_output_key_hash+0xd8/0x2a0 [ 481.063416][T20043] ip_route_output_key_hash+0x18d/0x2a0 [ 481.063447][T20043] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 481.063479][T20043] ? tomoyo_check_inet_address+0x289/0x950 [ 481.063515][T20043] ? tomoyo_check_inet_address+0x6d6/0x950 [ 481.063550][T20043] ? tomoyo_check_inet_address+0x289/0x950 [ 481.063582][T20043] ? dst_release+0x72/0x1b0 [ 481.063616][T20043] __ip4_datagram_connect+0x8f4/0x1270 [ 481.063664][T20043] __ip6_datagram_connect+0x9f0/0x1150 [ 481.063700][T20043] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 481.063724][T20043] ? ip6_datagram_connect_v6_only+0x56/0xa0 [ 481.063751][T20043] ? __local_bh_enable_ip+0xd0/0x130 [ 481.063786][T20043] ip6_datagram_connect_v6_only+0x63/0xa0 [ 481.063813][T20043] __sys_connect+0x312/0x450 [ 481.063842][T20043] ? __pfx___sys_connect+0x10/0x10 [ 481.063881][T20043] ? __pfx_ksys_write+0x10/0x10 [ 481.063915][T20043] __x64_sys_connect+0x7a/0x90 [ 481.063941][T20043] do_syscall_64+0x14d/0xf80 [ 481.063972][T20043] ? trace_irq_disable+0x3b/0x150 [ 481.063991][T20043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.064013][T20043] ? clear_bhb_loop+0x40/0x90 [ 481.064041][T20043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.064062][T20043] RIP: 0033:0x7f3eb639c799 [ 481.064083][T20043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 481.064101][T20043] RSP: 002b:00007f3eb45f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 481.064133][T20043] RAX: ffffffffffffffda RBX: 00007f3eb6616090 RCX: 00007f3eb639c799 [ 481.064154][T20043] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000004 [ 481.064168][T20043] RBP: 00007f3eb45f6090 R08: 0000000000000000 R09: 0000000000000000 [ 481.064181][T20043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 481.064194][T20043] R13: 00007f3eb6616128 R14: 00007f3eb6616090 R15: 00007ffd464da5e8 [ 481.064230][T20043] [ 481.593507][T20058] __nla_validate_parse: 9 callbacks suppressed [ 481.593531][T20058] netlink: 16166 bytes leftover after parsing attributes in process `syz.3.3564'. [ 481.631770][T20060] netlink: 'syz.0.3566': attribute type 1 has an invalid length. [ 481.650144][T20060] netlink: 96 bytes leftover after parsing attributes in process `syz.0.3566'. [ 481.663029][T20060] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3566'. [ 481.672380][T20060] netlink: 658 bytes leftover after parsing attributes in process `syz.0.3566'. [ 482.160135][T20094] siw: device registration error -23 [ 482.448668][T20101] syzkaller1: entered promiscuous mode [ 482.468318][T20101] syzkaller1: entered allmulticast mode [ 482.619804][T20115] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3580'. [ 482.650108][T20115] netlink: 'syz.4.3580': attribute type 1 has an invalid length. [ 482.814227][T20115] 8021q: adding VLAN 0 to HW filter on device bond3 [ 482.879791][T20126] bond3: (slave gretap1): making interface the new active one [ 482.889036][T20126] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 484.072372][T20170] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3592'. [ 484.118351][T20170] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3592'. [ 484.157080][T20170] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3592'. [ 484.214876][T20177] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3594'. [ 484.574801][T20199] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3598'. [ 485.057138][T20228] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 485.120915][T20234] batadv_slave_0: entered promiscuous mode [ 485.211340][T20234] batadv_slave_0: left promiscuous mode [ 485.365749][T20249] pim6reg: entered allmulticast mode [ 485.703216][T20269] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 485.752248][T20269] netlink: 'syz.1.3613': attribute type 1 has an invalid length. [ 485.891910][T20269] 8021q: adding VLAN 0 to HW filter on device bond6 [ 486.220833][T20295] netlink: 'syz.1.3621': attribute type 1 has an invalid length. [ 486.284961][T20295] bond7: entered promiscuous mode [ 486.291835][T20295] 8021q: adding VLAN 0 to HW filter on device bond7 [ 486.320116][T20296] 8021q: adding VLAN 0 to HW filter on device bond7 [ 486.342851][T20296] bond7: (slave wireguard0): The slave device specified does not support setting the MAC address [ 486.355690][T20296] bond7: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 486.387617][T20296] bond7: (slave wireguard0): making interface the new active one [ 486.411015][T20296] wireguard0: entered promiscuous mode [ 486.423842][T20296] bond7: (slave wireguard0): Enslaving as an active interface with an up link [ 486.440203][T20306] netlink: 'syz.0.3624': attribute type 4 has an invalid length. [ 486.448943][T20306] netlink: 'syz.0.3624': attribute type 4 has an invalid length. [ 486.478839][T20313] x_tables: duplicate underflow at hook 3 [ 486.590738][T20317] nbd: must specify a device to reconfigure [ 487.101332][T20334] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.109111][T20334] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.172304][T20334] team0: left promiscuous mode [ 487.177202][T20334] team_slave_0: left promiscuous mode [ 487.221441][T20334] team_slave_1: left promiscuous mode [ 487.434098][T20334] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 487.474426][T20334] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 487.484216][T20358] netlink: 'syz.2.3638': attribute type 7 has an invalid length. [ 487.603972][T20334] macsec0: left promiscuous mode [ 487.616414][T20334] macsec0: left allmulticast mode [ 487.643970][T20334] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 487.687640][T20334] macsec1: left promiscuous mode [ 487.701515][T20334] macsec1: left allmulticast mode [ 487.758858][T20356] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 487.867616][T20356] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 487.907502][ T1357] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.923949][ T1357] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.001633][T20361] 8021q: adding VLAN 0 to HW filter on device bond0 [ 488.012105][T20361] 8021q: adding VLAN 0 to HW filter on device team0 [ 488.040441][T20361] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 488.122771][ T1357] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.157913][ T1357] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.204442][T20377] __nla_validate_parse: 7 callbacks suppressed [ 488.204460][T20377] netlink: 536 bytes leftover after parsing attributes in process `syz.1.3645'. [ 488.228574][T20376] netlink: 536 bytes leftover after parsing attributes in process `syz.1.3645'. [ 488.437084][T20384] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3648'. [ 488.675527][T20394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3652'. [ 488.701406][T20396] netlink: 'syz.3.3653': attribute type 1 has an invalid length. [ 488.721864][T20396] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3653'. [ 489.207643][T20413] A٨ speed is unknown, defaulting to 1000 [ 489.217328][T20413] wg1 speed is unknown, defaulting to 1000 [ 489.554313][T20417] A٨ speed is unknown, defaulting to 1000 [ 489.802254][T20425] IPVS: set_ctl: invalid protocol: 59 0.0.0.0:20003 [ 489.962777][T20417] wg1 speed is unknown, defaulting to 1000 [ 490.065360][T20432] syzkaller0: entered promiscuous mode [ 490.071401][T20432] syzkaller0: entered allmulticast mode [ 490.253265][T20415] A٨ speed is unknown, defaulting to 1000 [ 490.559694][T20415] wg1 speed is unknown, defaulting to 1000 [ 490.601655][T20451] geneve0: entered promiscuous mode [ 491.038029][T20474] netlink: 'syz.3.3670': attribute type 10 has an invalid length. [ 491.056188][T20453] A٨ speed is unknown, defaulting to 1000 [ 491.064713][T20474] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.073078][T20474] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.112097][T20477] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3670'. [ 491.135157][T20474] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.142484][T20474] bridge0: port 2(bridge_slave_1) entered forwarding state [ 491.150311][T20474] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.157511][T20474] bridge0: port 1(bridge_slave_0) entered forwarding state [ 491.172474][T20474] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 491.182753][T20453] wg1 speed is unknown, defaulting to 1000 [ 491.273217][T20477] bridge_slave_1: left allmulticast mode [ 491.290560][T20477] bridge_slave_1: left promiscuous mode [ 491.296569][T20477] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.372815][T20477] bridge_slave_0: left allmulticast mode [ 491.386843][T20477] bridge_slave_0: left promiscuous mode [ 491.404311][T20477] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.450970][T20477] bond0: (slave bridge0): Releasing backup interface [ 491.680232][T20487] dvmrp1: entered allmulticast mode [ 492.477633][T20521] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3678'. [ 492.676923][T20525] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.689136][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.696183][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.703123][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.710045][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.716882][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.723814][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.730884][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.737809][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 492.744676][T20526] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 493.263743][T20546] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3685'. [ 493.318450][T20546] netlink: 'syz.3.3685': attribute type 3 has an invalid length. [ 493.496539][T20551] tipc: Started in network mode [ 493.508641][T20551] tipc: Node identity d2be23d243ef, cluster identity 4711 [ 493.539713][T20551] tipc: Enabled bearer , priority 0 [ 493.691824][T20554] syzkaller0: entered promiscuous mode [ 493.706272][T20554] syzkaller0: entered allmulticast mode [ 493.726800][T20554] tipc: Resetting bearer [ 493.783571][T20550] tipc: Resetting bearer [ 493.801736][T20568] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3690'. [ 493.810779][ T73] nci: nci_data_exchange_complete: no rx callback, dropping rx data... [ 494.106777][T20573] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3691'. [ 494.527477][T20562] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 495.208041][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 495.905262][T20550] tipc: Disabling bearer [ 495.939570][T14548] tipc: Node number set to 2438013906 [ 496.032659][T20572] A٨ speed is unknown, defaulting to 1000 [ 496.070405][T20572] wg1 speed is unknown, defaulting to 1000 [ 496.133352][T20585] A٨ speed is unknown, defaulting to 1000 [ 496.247222][T20595] netlink: 'syz.2.3696': attribute type 1 has an invalid length. [ 496.412908][T20585] wg1 speed is unknown, defaulting to 1000 [ 496.424147][T20601] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3697'. [ 496.825635][T20610] netlink: 'syz.2.3700': attribute type 61 has an invalid length. [ 496.834983][T20610] netlink: 'syz.2.3700': attribute type 62 has an invalid length. [ 497.464578][T20628] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3703'. [ 497.540090][T20628] TCP: TCP_TX_DELAY enabled [ 497.715573][T20632] netlink: 'syz.3.3705': attribute type 1 has an invalid length. [ 497.730349][T20635] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 498.186083][T20656] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3712'. [ 498.365182][T20661] net_ratelimit: 55 callbacks suppressed [ 498.365206][T20661] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 498.681371][T20674] netlink: 'syz.3.3718': attribute type 1 has an invalid length. [ 498.725125][T20674] gretap1: entered allmulticast mode [ 498.749106][T20674] bond5: (slave gretap1): making interface the new active one [ 498.757630][T20674] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 498.805513][T20674] tipc: Started in network mode [ 498.822184][T20674] tipc: Node identity da01abf4bf18, cluster identity 4711 [ 498.830809][T20674] tipc: Enabled bearer , priority 0 [ 498.882728][T20674] syzkaller0: entered promiscuous mode [ 498.888649][T20674] syzkaller0: entered allmulticast mode [ 498.895495][T20674] tipc: Resetting bearer [ 498.923199][T20673] tipc: Resetting bearer [ 499.705179][T20702] netlink: 'syz.0.3725': attribute type 1 has an invalid length. [ 499.773342][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.792231][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.799300][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.806453][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.813733][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.820720][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.827631][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.834649][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.841575][T20703] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 499.853066][T20704] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3725'. [ 499.975411][T20705] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3725'. [ 499.984548][T20705] netlink: 348 bytes leftover after parsing attributes in process `syz.0.3725'. [ 499.993690][T20705] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3725'. [ 500.002908][T20705] netlink: 348 bytes leftover after parsing attributes in process `syz.0.3725'. [ 500.012998][T20705] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3725'. [ 501.637230][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 501.685055][T20673] tipc: Disabling bearer [ 501.703799][T20692] vlan2: entered promiscuous mode [ 501.709343][T20692] bridge0: entered promiscuous mode [ 501.729126][T20702] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 501.731287][T14574] tipc: Node number set to 1696181236 [ 502.031665][ T73] syzkaller0: tun_net_xmit 76 [ 502.037635][T20718] syzkaller0: create flow: hash 2724182086 index 1 [ 502.052656][ T73] syzkaller0: tun_net_xmit 48 [ 502.061275][T14548] syzkaller0: tun_net_xmit 76 [ 502.108267][T14574] syzkaller0: tun_net_xmit 76 [ 502.279867][T20727] tipc: Invalid UDP bearer configuration [ 502.279920][T20727] tipc: Enabling of bearer rejected, failed to enable media [ 502.308816][T14574] syzkaller0: tun_net_xmit 76 [ 502.368769][T20715] syzkaller0: delete flow: hash 2724182086 index 2 [ 502.660518][T20753] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 503.558932][T20779] xt_hashlimit: size too large, truncated to 1048576 [ 505.035742][T20785] xt_ipcomp: unknown flags 1D [ 505.127543][T20795] lo: left allmulticast mode [ 505.192642][T20788] A٨ speed is unknown, defaulting to 1000 [ 505.202596][T20788] wg1 speed is unknown, defaulting to 1000 [ 505.594374][T20817] netlink: 'syz.4.3750': attribute type 4 has an invalid length. [ 505.620628][T20817] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3750'. [ 505.631220][T20815] netlink: 'syz.3.3752': attribute type 1 has an invalid length. [ 505.694832][T20815] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3752'. [ 505.711004][T20817] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3750'. [ 505.813827][T20826] netlink: 'syz.1.3753': attribute type 1 has an invalid length. [ 505.864713][T20826] bond8: entered promiscuous mode [ 505.870883][T20831] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3755'. [ 505.871066][T20826] 8021q: adding VLAN 0 to HW filter on device bond8 [ 505.920753][T20796] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 505.931731][T20796] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 505.937543][T20831] macvtap1: entered promiscuous mode [ 505.946765][T20831] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 505.955075][T20831] macvtap1: entered allmulticast mode [ 505.960795][T20831] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 505.981009][T20834] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3755'. [ 505.991597][T20826] bond8: (slave bridge2): making interface the new active one [ 506.000436][T20826] bridge2: entered promiscuous mode [ 506.024950][T20826] bridge2: left promiscuous mode [ 506.126336][T20832] mac80211_hwsim hwsim32 ;: renamed from wlan0 [ 506.173563][T20834] macvtap2: entered promiscuous mode [ 506.179342][T20834] macvtap2: entered allmulticast mode [ 506.265348][T20840] A٨ speed is unknown, defaulting to 1000 [ 506.432363][T20840] wg1 speed is unknown, defaulting to 1000 [ 506.456531][T20857] tun0: tun_chr_ioctl cmd 1074812118 [ 506.986133][T20883] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3765'. [ 507.023645][T20873] tipc: Enabling of bearer rejected, failed to enable media [ 507.047899][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5420 ms [ 507.056605][ C0] lec:lec_tx_timeout: lec0 [ 507.665183][T20907] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3770'. [ 507.679066][T20909] netlink: 'syz.4.3768': attribute type 4 has an invalid length. [ 507.686857][T20909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3768'. [ 507.760972][T20911] netlink: 'syz.0.3771': attribute type 1 has an invalid length. [ 508.507896][T20941] xt_ecn: cannot match TCP bits for non-tcp packets [ 508.640696][T20941] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3777'. [ 510.202246][T20925] syzkaller0: entered promiscuous mode [ 510.210439][T20925] syzkaller0: entered allmulticast mode [ 510.360765][T20949] tipc: Started in network mode [ 510.372159][T20949] tipc: Node identity aaaaaaaaaa35, cluster identity 4711 [ 510.382493][T20949] tipc: Enabled bearer , priority 10 [ 510.418855][T20949] sctp: [Deprecated]: syz.1.3778 (pid 20949) Use of int in max_burst socket option. [ 510.418855][T20949] Use struct sctp_assoc_value instead [ 510.485364][T20961] ip6t_srh: unknown srh invflags BA61 [ 510.579041][T20964] net_ratelimit: 3322 callbacks suppressed [ 510.579063][T20964] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 510.613935][T20964] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3783'. [ 510.632588][T20964] tipc: Failed to remove unknown binding: 66,1,1/0:1381630125/1381630127 [ 510.796451][T20975] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3786'. [ 511.007057][T20984] netlink: 'syz.4.3788': attribute type 1 has an invalid length. [ 511.036960][T20977] A٨ speed is unknown, defaulting to 1000 [ 511.055828][T20984] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3788'. [ 511.079451][T20977] wg1 speed is unknown, defaulting to 1000 [ 511.359482][T20999] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3792'. [ 511.389245][T20999] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3792'. [ 511.417795][T20999] netlink: 'syz.4.3792': attribute type 1 has an invalid length. [ 511.493123][T21006] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3792'. [ 511.502763][T14547] tipc: Node number set to 10463914 [ 511.752205][T21013] erspan0: entered promiscuous mode [ 511.858221][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 511.897412][T21023] sctp: [Deprecated]: syz.3.3797 (pid 21023) Use of int in max_burst socket option. [ 511.897412][T21023] Use struct sctp_assoc_value instead [ 511.928695][T21022] sctp: [Deprecated]: syz.3.3797 (pid 21022) Use of int in max_burst socket option. [ 511.928695][T21022] Use struct sctp_assoc_value instead [ 511.970287][T21022] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.3797'. [ 511.980339][T21023] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.3797'. [ 512.327439][T21036] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3802'. [ 512.357573][T21036] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 512.364954][T21036] IPv6: NLM_F_CREATE should be set when creating new route [ 512.372304][T21036] IPv6: NLM_F_CREATE should be set when creating new route [ 512.783931][T21053] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3804'. [ 513.146060][T14548] IPVS: starting estimator thread 0... [ 513.156400][T21067] netlink: 'syz.1.3809': attribute type 1 has an invalid length. [ 513.237951][T21068] IPVS: using max 29 ests per chain, 69600 per kthread [ 513.331790][T21072] bond9: (slave gretap1): making interface the new active one [ 513.342191][T21072] bond9: (slave gretap1): Enslaving as an active interface with an up link [ 513.353609][T21077] netlink: 'syz.3.3811': attribute type 7 has an invalid length. [ 513.364048][T21077] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3811'. [ 513.555876][T21085] netlink: 'syz.1.3815': attribute type 1 has an invalid length. [ 513.707389][T21092] Cannot find del_set index 1 as target [ 514.142536][T21116] netlink: 'syz.3.3818': attribute type 4 has an invalid length. [ 514.215290][T21122] netlink: 'syz.3.3818': attribute type 4 has an invalid length. [ 514.813866][T21143] netlink: 'syz.3.3826': attribute type 1 has an invalid length. [ 514.951708][T21143] 8021q: adding VLAN 0 to HW filter on device bond7 [ 514.994837][T21162] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 515.007898][T21162] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 515.056056][T21167] netlink: 'syz.3.3826': attribute type 10 has an invalid length. [ 515.065465][T21154] bond7: (slave geneve2): making interface the new active one [ 515.080809][T21154] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 515.157371][T21166] tipc: Enabled bearer , priority 0 [ 515.249433][T21171] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 515.323413][T21166] syzkaller0: entered promiscuous mode [ 515.329673][T21166] syzkaller0: entered allmulticast mode [ 515.336223][T21166] tipc: Resetting bearer [ 515.394075][T21165] tipc: Resetting bearer [ 516.381667][T21229] __nla_validate_parse: 11 callbacks suppressed [ 516.381688][T21229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3840'. [ 516.400942][T21229] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3840'. [ 516.513903][T21202] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 518.057209][T21165] tipc: Disabling bearer [ 518.070858][T21209] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.092410][T21213] ip6_vti0: entered promiscuous mode [ 518.102969][T21213] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3838'. [ 518.115698][ T5493] veth0_macvtap: left promiscuous mode [ 518.209329][T21229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3840'. [ 518.229299][T21229] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3840'. [ 518.320793][T21250] netlink: 'syz.4.3844': attribute type 3 has an invalid length. [ 518.337973][T21250] netlink: 'syz.4.3844': attribute type 3 has an invalid length. [ 518.346759][T21250] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3844'. [ 518.364068][ T1370] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 518.376681][ T1370] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 518.432750][ T1370] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 518.454543][ T1370] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 518.565200][T21256] netlink: 'syz.4.3848': attribute type 4 has an invalid length. [ 518.830692][T21275] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3850'. [ 518.886735][T21281] netlink: 'syz.0.3850': attribute type 1 has an invalid length. [ 519.004168][T21288] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3852'. [ 519.025080][T21281] 8021q: adding VLAN 0 to HW filter on device bond2 [ 519.096633][T21284] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 519.116975][T21284] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 519.227356][T21283] A٨ speed is unknown, defaulting to 1000 [ 519.281471][T21283] wg1 speed is unknown, defaulting to 1000 [ 519.361743][T21299] Cannot find map_set index 2 as target [ 519.590843][T21308] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3854'. [ 519.820583][T21323] tc_dump_action: action bad kind [ 519.863380][T21323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3859'. [ 519.895845][T21323] nbd: must specify an index to disconnect [ 520.138534][T21327] IPVS: Scheduler module ip_vs_ not found [ 520.198942][T21329] bond0: (slave dummy0): Releasing backup interface [ 520.238271][T21329] dummy0 (unregistering): left promiscuous mode [ 520.312496][T21343] ve: renamed from gre0 [ 520.347472][T21343] dvmrp0: left allmulticast mode [ 520.379730][T21345] Cannot find set identified by id 3 to match [ 520.850002][T21360] bond11: option miimon: invalid value (18446744073709551607) [ 520.887917][T21360] bond11: option miimon: allowed values 0 - 2147483647 [ 520.924079][T21360] bond11 (unregistering): Released all slaves [ 521.595211][T21397] batadv_slave_0: entered promiscuous mode [ 521.629351][T21395] __nla_validate_parse: 2 callbacks suppressed [ 521.629372][T21395] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3874'. [ 521.728290][T21389] nbd0: detected capacity change from 0 to 127 [ 521.743743][T21401] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3876'. [ 521.754366][ T5149] block nbd0: Receive control failed (result -104) [ 521.755165][ T5842] block nbd0: Receive control failed (result -32) [ 521.922929][T21408] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3879'. [ 521.965356][T21413] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3880'. [ 522.001252][T21414] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3878'. [ 522.186204][T21421] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3884'. [ 522.215087][T21419] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3882'. [ 522.228631][T21421] netlink: 'syz.1.3884': attribute type 1 has an invalid length. [ 522.302901][T21421] bond11: (slave bridge2): making interface the new active one [ 522.311748][T21421] bond11: (slave bridge2): Enslaving as an active interface with an up link [ 522.424377][T21397] batadv_slave_0: left promiscuous mode [ 522.436492][T21431] batadv0: entered allmulticast mode [ 522.480352][T21431] openvswitch: netlink: Flow key attribute not present in set flow. [ 522.498984][ T1147] [ 522.501363][ T1147] ====================================================== [ 522.508404][ T1147] WARNING: possible circular locking dependency detected [ 522.515457][ T1147] syzkaller #0 Not tainted [ 522.519885][ T1147] ------------------------------------------------------ [ 522.526915][ T1147] kworker/u8:9/1147 is trying to acquire lock: [ 522.533075][ T1147] ffffffff8e85dae8 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x218/0x19c0 [ 522.542684][ T1147] [ 522.542684][ T1147] but task is already holding lock: [ 522.550067][ T1147] ffffffff8e5fcd08 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0x9ef/0x1e90 [ 522.559406][ T1147] [ 522.559406][ T1147] which lock already depends on the new lock. [ 522.559406][ T1147] [ 522.569836][ T1147] [ 522.569836][ T1147] the existing dependency chain (in reverse order) is: [ 522.578868][ T1147] [ 522.578868][ T1147] -> #9 (wq_pool_mutex){+.+.}-{4:4}: [ 522.586368][ T1147] __mutex_lock+0x19f/0x1300 [ 522.591508][ T1147] __alloc_workqueue+0x9ef/0x1e90 [ 522.597067][ T1147] alloc_workqueue_noprof+0xe3/0x210 [ 522.602884][ T1147] padata_alloc+0xc1/0x370 [ 522.607846][ T1147] pcrypt_init_padata+0x27/0x100 [ 522.613331][ T1147] pcrypt_init+0x60/0xc0 [ 522.618115][ T1147] do_one_initcall+0x250/0x8d0 [ 522.623424][ T1147] do_initcall_level+0x104/0x190 [ 522.628901][ T1147] do_initcalls+0x59/0xa0 [ 522.633766][ T1147] kernel_init_freeable+0x2a6/0x3e0 [ 522.639503][ T1147] kernel_init+0x1d/0x1d0 [ 522.644463][ T1147] ret_from_fork+0x51e/0xb90 [ 522.649614][ T1147] ret_from_fork_asm+0x1a/0x30 [ 522.654928][ T1147] [ 522.654928][ T1147] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 522.662689][ T1147] cpus_read_lock+0x42/0x160 [ 522.667838][ T1147] static_key_slow_inc+0x12/0x30 [ 522.673326][ T1147] setup_udp_tunnel_sock+0x2fd/0x510 [ 522.679159][ T1147] l2tp_tunnel_register+0xda0/0x1460 [ 522.685021][ T1147] pppol2tp_connect+0x8b7/0x17c0 [ 522.690517][ T1147] __sys_connect+0x312/0x450 [ 522.695665][ T1147] __x64_sys_connect+0x7a/0x90 [ 522.700987][ T1147] do_syscall_64+0x14d/0xf80 [ 522.706124][ T1147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.712561][ T1147] [ 522.712561][ T1147] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 522.720325][ T1147] lock_sock_nested+0x41/0x100 [ 522.725632][ T1147] inet_shutdown+0x6a/0x390 [ 522.730674][ T1147] nbd_mark_nsock_dead+0x2e9/0x560 [ 522.736335][ T1147] sock_shutdown+0x15e/0x260 [ 522.741568][ T1147] nbd_clear_sock+0x24/0x170 [ 522.746736][ T1147] nbd_config_put+0x2dd/0x580 [ 522.751965][ T1147] nbd_genl_connect+0x19d5/0x1cf0 [ 522.757545][ T1147] genl_family_rcv_msg_doit+0x22a/0x330 [ 522.763657][ T1147] genl_rcv_msg+0x61c/0x7a0 [ 522.768731][ T1147] netlink_rcv_skb+0x232/0x4b0 [ 522.774038][ T1147] genl_rcv+0x28/0x40 [ 522.778560][ T1147] netlink_unicast+0x80f/0x9b0 [ 522.783872][ T1147] netlink_sendmsg+0x813/0xb40 [ 522.789177][ T1147] ____sys_sendmsg+0x972/0x9f0 [ 522.794483][ T1147] ___sys_sendmsg+0x2a5/0x360 [ 522.799698][ T1147] __x64_sys_sendmsg+0x1bd/0x2a0 [ 522.805175][ T1147] do_syscall_64+0x14d/0xf80 [ 522.810314][ T1147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.816764][ T1147] [ 522.816764][ T1147] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 522.824435][ T1147] __mutex_lock+0x19f/0x1300 [ 522.829610][ T1147] nbd_queue_rq+0x37b/0x1100 [ 522.834771][ T1147] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 522.840884][ T1147] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 522.848038][ T1147] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 522.854567][ T1147] blk_mq_run_hw_queue+0x348/0x4f0 [ 522.860229][ T1147] blk_mq_dispatch_list+0xd16/0xe10 [ 522.865984][ T1147] blk_mq_flush_plug_list+0x48d/0x570 [ 522.871905][ T1147] __blk_flush_plug+0x3ed/0x4d0 [ 522.877310][ T1147] __submit_bio+0x28d/0x580 [ 522.882375][ T1147] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 522.888563][ T1147] block_read_full_folio+0x599/0x830 [ 522.894398][ T1147] filemap_read_folio+0x137/0x3b0 [ 522.899968][ T1147] do_read_cache_folio+0x358/0x590 [ 522.905628][ T1147] read_part_sector+0xb6/0x2b0 [ 522.910934][ T1147] adfspart_check_ICS+0xa5/0xa40 [ 522.916505][ T1147] bdev_disk_changed+0x7ba/0x1550 [ 522.922075][ T1147] blkdev_get_whole+0x380/0x510 [ 522.927489][ T1147] bdev_open+0x31e/0xd30 [ 522.932294][ T1147] blkdev_open+0x470/0x610 [ 522.937259][ T1147] do_dentry_open+0x785/0x14e0 [ 522.942612][ T1147] vfs_open+0x3b/0x340 [ 522.947228][ T1147] path_openat+0x2e08/0x3860 [ 522.952358][ T1147] do_file_open+0x23e/0x4a0 [ 522.957401][ T1147] do_sys_openat2+0x113/0x200 [ 522.962626][ T1147] __x64_sys_openat+0x138/0x170 [ 522.968024][ T1147] do_syscall_64+0x14d/0xf80 [ 522.973164][ T1147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.979591][ T1147] [ 522.979591][ T1147] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 522.986822][ T1147] __mutex_lock+0x19f/0x1300 [ 522.991957][ T1147] nbd_queue_rq+0xc6/0x1100 [ 522.997027][ T1147] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 523.003112][ T1147] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 523.009979][ T1147] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 523.016545][ T1147] blk_mq_run_hw_queue+0x348/0x4f0 [ 523.022196][ T1147] blk_mq_dispatch_list+0xd16/0xe10 [ 523.028031][ T1147] blk_mq_flush_plug_list+0x48d/0x570 [ 523.033956][ T1147] __blk_flush_plug+0x3ed/0x4d0 [ 523.039375][ T1147] __submit_bio+0x28d/0x580 [ 523.044421][ T1147] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 523.050616][ T1147] block_read_full_folio+0x599/0x830 [ 523.056445][ T1147] filemap_read_folio+0x137/0x3b0 [ 523.062110][ T1147] do_read_cache_folio+0x358/0x590 [ 523.067774][ T1147] read_part_sector+0xb6/0x2b0 [ 523.073122][ T1147] adfspart_check_ICS+0xa5/0xa40 [ 523.078722][ T1147] bdev_disk_changed+0x7ba/0x1550 [ 523.084364][ T1147] blkdev_get_whole+0x380/0x510 [ 523.089786][ T1147] bdev_open+0x31e/0xd30 [ 523.094584][ T1147] blkdev_open+0x470/0x610 [ 523.099561][ T1147] do_dentry_open+0x785/0x14e0 [ 523.104883][ T1147] vfs_open+0x3b/0x340 [ 523.109501][ T1147] path_openat+0x2e08/0x3860 [ 523.114638][ T1147] do_file_open+0x23e/0x4a0 [ 523.119679][ T1147] do_sys_openat2+0x113/0x200 [ 523.124910][ T1147] __x64_sys_openat+0x138/0x170 [ 523.130312][ T1147] do_syscall_64+0x14d/0xf80 [ 523.135460][ T1147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.141892][ T1147] [ 523.141892][ T1147] -> #4 (set->srcu){.+.+}-{0:0}: [ 523.149035][ T1147] __synchronize_srcu+0xca/0x300 [ 523.154518][ T1147] elevator_switch+0x1e8/0x7a0 [ 523.159823][ T1147] elevator_change+0x2cc/0x450 [ 523.165139][ T1147] elevator_set_default+0x36c/0x430 [ 523.170875][ T1147] blk_register_queue+0x366/0x430 [ 523.176513][ T1147] __add_disk+0x677/0xd50 [ 523.181394][ T1147] add_disk_fwnode+0xfb/0x480 [ 523.186612][ T1147] nbd_dev_add+0x72c/0xb50 [ 523.191568][ T1147] nbd_init+0x168/0x1f0 [ 523.196275][ T1147] do_one_initcall+0x250/0x8d0 [ 523.201605][ T1147] do_initcall_level+0x104/0x190 [ 523.207099][ T1147] do_initcalls+0x59/0xa0 [ 523.211975][ T1147] kernel_init_freeable+0x2a6/0x3e0 [ 523.217717][ T1147] kernel_init+0x1d/0x1d0 [ 523.222597][ T1147] ret_from_fork+0x51e/0xb90 [ 523.227841][ T1147] ret_from_fork_asm+0x1a/0x30 [ 523.233147][ T1147] [ 523.233147][ T1147] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 523.240985][ T1147] __mutex_lock+0x19f/0x1300 [ 523.246576][ T1147] elevator_change+0x1b3/0x450 [ 523.251900][ T1147] elevator_set_none+0xb5/0x140 [ 523.257301][ T1147] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 523.263654][ T1147] nbd_start_device+0x17f/0xb10 [ 523.269053][ T1147] nbd_genl_connect+0x165b/0x1cf0 [ 523.274622][ T1147] genl_family_rcv_msg_doit+0x22a/0x330 [ 523.280710][ T1147] genl_rcv_msg+0x61c/0x7a0 [ 523.285765][ T1147] netlink_rcv_skb+0x232/0x4b0 [ 523.291064][ T1147] genl_rcv+0x28/0x40 [ 523.295593][ T1147] netlink_unicast+0x80f/0x9b0 [ 523.300904][ T1147] netlink_sendmsg+0x813/0xb40 [ 523.306210][ T1147] ____sys_sendmsg+0x972/0x9f0 [ 523.311575][ T1147] ___sys_sendmsg+0x2a5/0x360 [ 523.316797][ T1147] __x64_sys_sendmsg+0x1bd/0x2a0 [ 523.322283][ T1147] do_syscall_64+0x14d/0xf80 [ 523.327420][ T1147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.333856][ T1147] [ 523.333856][ T1147] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 523.342489][ T1147] blk_alloc_queue+0x546/0x680 [ 523.347794][ T1147] __blk_mq_alloc_disk+0x197/0x390 [ 523.353486][ T1147] nbd_dev_add+0x499/0xb50 [ 523.358540][ T1147] nbd_init+0x168/0x1f0 [ 523.363262][ T1147] do_one_initcall+0x250/0x8d0 [ 523.368597][ T1147] do_initcall_level+0x104/0x190 [ 523.374088][ T1147] do_initcalls+0x59/0xa0 [ 523.378974][ T1147] kernel_init_freeable+0x2a6/0x3e0 [ 523.384756][ T1147] kernel_init+0x1d/0x1d0 [ 523.389629][ T1147] ret_from_fork+0x51e/0xb90 [ 523.394853][ T1147] ret_from_fork_asm+0x1a/0x30 [ 523.400168][ T1147] [ 523.400168][ T1147] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 523.407489][ T1147] fs_reclaim_acquire+0x71/0x100 [ 523.412977][ T1147] prepare_alloc_pages+0x152/0x650 [ 523.418635][ T1147] __alloc_frozen_pages_noprof+0x12f/0x380 [ 523.424997][ T1147] __alloc_pages_noprof+0xa/0x30 [ 523.430498][ T1147] pcpu_populate_chunk+0x182/0xb30 [ 523.436531][ T1147] pcpu_alloc_noprof+0xc6c/0x19c0 [ 523.442111][ T1147] xt_percpu_counter_alloc+0x161/0x220 [ 523.448127][ T1147] translate_table+0x1332/0x20b0 [ 523.453618][ T1147] ip6t_register_table+0x11b/0x800 [ 523.459291][ T1147] ip6table_security_table_init+0x41/0x70 [ 523.465654][ T1147] xt_find_table_lock+0x30c/0x3e0 [ 523.471254][ T1147] xt_request_find_table_lock+0x26/0x100 [ 523.477436][ T1147] do_ip6t_get_ctl+0x716/0x1230 [ 523.482827][ T1147] nf_getsockopt+0x26e/0x290 [ 523.488050][ T1147] ipv6_getsockopt+0x1fd/0x2b0 [ 523.493352][ T1147] do_sock_getsockopt+0x2d3/0x3f0 [ 523.499006][ T1147] __x64_sys_getsockopt+0x1a4/0x240 [ 523.504751][ T1147] do_syscall_64+0x14d/0xf80 [ 523.509973][ T1147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.516402][ T1147] [ 523.516402][ T1147] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 523.524334][ T1147] __lock_acquire+0x15a5/0x2cf0 [ 523.529741][ T1147] lock_acquire+0xf0/0x2e0 [ 523.534704][ T1147] __mutex_lock+0x19f/0x1300 [ 523.539857][ T1147] pcpu_alloc_noprof+0x218/0x19c0 [ 523.545453][ T1147] __alloc_workqueue+0xa81/0x1e90 [ 523.551032][ T1147] alloc_workqueue_noprof+0xe3/0x210 [ 523.556862][ T1147] __rds_conn_create+0x134b/0x22d0 [ 523.562613][ T1147] rds_conn_create+0x43/0x60 [ 523.567770][ T1147] rds_tcp_accept_one+0x46b/0xd50 [ 523.573363][ T1147] rds_tcp_accept_worker+0x1d/0x70 [ 523.579021][ T1147] process_scheduled_works+0xb6e/0x18c0 [ 523.585206][ T1147] worker_thread+0xa53/0xfc0 [ 523.590356][ T1147] kthread+0x388/0x470 [ 523.594975][ T1147] ret_from_fork+0x51e/0xb90 [ 523.600107][ T1147] ret_from_fork_asm+0x1a/0x30 [ 523.605485][ T1147] [ 523.605485][ T1147] other info that might help us debug this: [ 523.605485][ T1147] [ 523.615735][ T1147] Chain exists of: [ 523.615735][ T1147] pcpu_alloc_mutex --> cpu_hotplug_lock --> wq_pool_mutex [ 523.615735][ T1147] [ 523.628846][ T1147] Possible unsafe locking scenario: [ 523.628846][ T1147] [ 523.636344][ T1147] CPU0 CPU1 [ 523.641724][ T1147] ---- ---- [ 523.647106][ T1147] lock(wq_pool_mutex); [ 523.651458][ T1147] lock(cpu_hotplug_lock); [ 523.658506][ T1147] lock(wq_pool_mutex); [ 523.665295][ T1147] lock(pcpu_alloc_mutex); [ 523.669821][ T1147] [ 523.669821][ T1147] *** DEADLOCK *** [ 523.669821][ T1147] [ 523.678099][ T1147] 4 locks held by kworker/u8:9/1147: [ 523.683394][ T1147] #0: ffff888033469148 ((wq_completion)krdsd){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 523.694311][ T1147] #1: ffffc90004f4fc40 ((work_completion)(&rtn->rds_tcp_accept_w)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 523.707043][ T1147] #2: ffff88801e712668 (&rtn->rds_tcp_accept_lock){+.+.}-{4:4}, at: rds_tcp_accept_one+0xae/0xd50 [ 523.717778][ T1147] #3: ffffffff8e5fcd08 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0x9ef/0x1e90 [ 523.727560][ T1147] [ 523.727560][ T1147] stack backtrace: [ 523.733495][ T1147] CPU: 0 UID: 0 PID: 1147 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) [ 523.733516][ T1147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 523.733529][ T1147] Workqueue: krdsd rds_tcp_accept_worker [ 523.733553][ T1147] Call Trace: [ 523.733561][ T1147] [ 523.733570][ T1147] dump_stack_lvl+0xe8/0x150 [ 523.733596][ T1147] print_circular_bug+0x2e1/0x300 [ 523.733625][ T1147] check_noncircular+0x12e/0x150 [ 523.733655][ T1147] __lock_acquire+0x15a5/0x2cf0 [ 523.733691][ T1147] ? lockdep_unlock+0x5d/0xd0 [ 523.733714][ T1147] lock_acquire+0xf0/0x2e0 [ 523.733734][ T1147] ? pcpu_alloc_noprof+0x218/0x19c0 [ 523.733758][ T1147] __mutex_lock+0x19f/0x1300 [ 523.733785][ T1147] ? pcpu_alloc_noprof+0x218/0x19c0 [ 523.733803][ T1147] ? __mutex_trylock_common+0x158/0x260 [ 523.733830][ T1147] ? preempt_schedule_thunk+0x16/0x30 [ 523.733850][ T1147] ? preempt_schedule_common+0x82/0xd0 [ 523.733873][ T1147] ? preempt_schedule_thunk+0x16/0x30 [ 523.733890][ T1147] ? pcpu_alloc_noprof+0x218/0x19c0 [ 523.733910][ T1147] ? __pfx___mutex_lock+0x10/0x10 [ 523.733934][ T1147] ? __mutex_lock+0x32d/0x1300 [ 523.733964][ T1147] ? __alloc_workqueue+0x9ef/0x1e90 [ 523.733983][ T1147] pcpu_alloc_noprof+0x218/0x19c0 [ 523.734002][ T1147] ? rcu_is_watching+0x15/0xb0 [ 523.734027][ T1147] ? __kasan_kmalloc+0x93/0xb0 [ 523.734047][ T1147] ? __kmalloc_cache_node_noprof+0x3ef/0x6b0 [ 523.734071][ T1147] __alloc_workqueue+0xa81/0x1e90 [ 523.734094][ T1147] alloc_workqueue_noprof+0xe3/0x210 [ 523.734111][ T1147] ? pcpu_alloc+0x10/0x360 [ 523.734138][ T1147] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 523.734158][ T1147] ? mutex_init_lockep+0xf9/0x130 [ 523.734184][ T1147] __rds_conn_create+0x134b/0x22d0 [ 523.734205][ T1147] ? __rds_conn_create+0x2e4/0x22d0 [ 523.734231][ T1147] ? __pfx___rds_conn_create+0x10/0x10 [ 523.734251][ T1147] ? __ipv6_chk_addr_and_flags+0x686/0x7e0 [ 523.734274][ T1147] ? __ipv6_chk_addr_and_flags+0x187/0x7e0 [ 523.734301][ T1147] rds_conn_create+0x43/0x60 [ 523.734322][ T1147] rds_tcp_accept_one+0x46b/0xd50 [ 523.734346][ T1147] ? __pfx_rds_tcp_accept_one+0x10/0x10 [ 523.734372][ T1147] rds_tcp_accept_worker+0x1d/0x70 [ 523.734393][ T1147] ? process_scheduled_works+0xa8d/0x18c0 [ 523.734415][ T1147] process_scheduled_works+0xb6e/0x18c0 [ 523.734451][ T1147] ? __pfx_process_scheduled_works+0x10/0x10 [ 523.734476][ T1147] ? assign_work+0x3d5/0x5e0 [ 523.734500][ T1147] worker_thread+0xa53/0xfc0 [ 523.734534][ T1147] kthread+0x388/0x470 [ 523.734550][ T1147] ? __pfx_worker_thread+0x10/0x10 [ 523.734573][ T1147] ? __pfx_kthread+0x10/0x10 [ 523.734589][ T1147] ret_from_fork+0x51e/0xb90 [ 523.734613][ T1147] ? __pfx_ret_from_fork+0x10/0x10 [ 523.734635][ T1147] ? __switch_to+0xc7d/0x1450 [ 523.734656][ T1147] ? __pfx_kthread+0x10/0x10 [ 523.734672][ T1147] ret_from_fork_asm+0x1a/0x30 [ 523.734711][ T1147] [ 524.015991][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 529.287905][T21449] Bluetooth: hci1: command 0x0406 tx timeout [ 529.289169][T21448] Bluetooth: hci5: command 0x0406 tx timeout