last executing test programs: 7.254719966s ago: executing program 0 (id=4153): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x6, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x18, 0x0, 0x2, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@CTA_EXPECT_TUPLE={0x4}]}, 0x18}}, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/mnt\x00') close(r3) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r4, 0x0, 0xffffffbfffff8000, 0x8) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={0x68, r8, 0x5eae78d9c54e9d3f, 0x0, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_SEC_KEY={0x4c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "403a050c5baee2004ef2b6d713459a7a"}, @NL802154_KEY_ATTR_ID={0x2c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x20, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}]}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x9}]}]}, 0x68}}, 0x0) close(r6) r10 = socket$inet_tcp(0x2, 0x1, 0x0) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) r12 = accept$alg(r11, 0x0, 0x0) sendmmsg$alg(r12, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000140)='{', 0x1}], 0x1, 0x0, 0x0, 0x4048170}], 0x1, 0x24048825) r13 = accept(r12, 0x0, 0x0) recvmsg$can_j1939(r13, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x1003) connect$qrtr(r13, &(0x7f0000000000)={0x2a, 0x1}, 0xc) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000200)={'syz_tun\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="1802000000000000000000007a000000850000007d00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcae, 0x0, 0x0}, 0x80) r14 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r14, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) 6.187277239s ago: executing program 1 (id=4164): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x4001, 0x3, 0x2d8, 0x0, 0x700001b, 0x148, 0x160, 0x148, 0x240, 0x206, 0x240, 0x240, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @rand_addr, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x1}, 0x1ea, 0x118, 0x90, 0x0, {0x390, 0x8f00}, [@common=@unspec=@physdev={{0x68}, {'veth0_macvtap\x00', {0xff}, 'pimreg0\x00', {0xff}, 0x2, 0x4}}, @common=@set={{0x40}, {{0x0, [0x5, 0x4, 0x7, 0x0, 0x1], 0x1, 0x6}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0xc, 0x8, 0x7, '\x00', {0x3}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@common=@icmp={{0x28}, {0x0, "190b"}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xd4, 'syz1\x00', {0x9e2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x338) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x23, &(0x7f0000000240)=0x100, 0x4) syz_emit_ethernet(0x8a, &(0x7f0000000240)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x54, 0x3a, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, {[], @pkt_toobig={0x3, 0x2, 0x0, 0x0, {0x0, 0x6, "d80002", 0x0, 0x11, 0x0, @local, @mcast2, [@dstopts={0x0, 0x2, '\x00', [@ra={0x5, 0x2f}, @hao={0xc9, 0x10, @mcast1}]}], "2b58959e"}}}}}}}, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) socket(0x2, 0x3, 0xff) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r5]}, 0x94) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newtfilter={0xd8, 0x2c, 0x8, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xb, 0x3}, {0x5, 0xb}, {0x5, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x98, 0x2, [@TCA_BASIC_POLICE={0x88, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0x8, 0x401, 0xc, 0x7ff, {0x7, 0x1, 0x85, 0x81, 0x9e, 0x40}, {0x8, 0x1, 0x2, 0x0, 0xe, 0x5}, 0x5, 0x401, 0x2}}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1}, @TCA_POLICE_RESULT={0x8, 0x5, 0x4}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1ff}, @TCA_POLICE_RESULT={0x8, 0x5, 0xce37}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfffffffffffffff8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x2}, @TCA_POLICE_RESULT={0x8, 0x5, 0xff60}]}, @TCA_BASIC_POLICE={0xc, 0x4, [@TCA_POLICE_RESULT={0x8, 0x5, 0x10001}]}]}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_CHAIN={0x8, 0xb, 0x8}]}, 0xd8}}, 0x24008814) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c00000013000100000000000000000807000000", @ANYRES32=r4, @ANYBLOB="86000000000000000c001a8004000480"], 0x2c}, 0x1, 0x0, 0x0, 0x40000c0}, 0x840) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) 5.90659598s ago: executing program 4 (id=4171): bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0400000004000000040000000700040004000000", @ANYRES32, @ANYRES32, @ANYRES8, @ANYRES32=0x0, @ANYBLOB="000000000100"/28], 0x50) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, r0, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffff800}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x57}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x48010}, 0x20000000) 5.781452043s ago: executing program 4 (id=4172): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYRESDEC=r0, @ANYRES32, @ANYBLOB="80007f0a0a0002000180c2"], 0x34}, 0x1, 0x0, 0x0, 0x10000840}, 0x4044004) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="340000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r3], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) r4 = socket(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) close(r1) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r8) r9 = socket$unix(0x1, 0x3, 0x0) close(r9) r10 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r10, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) setsockopt$XDP_TX_RING(r10, 0x11b, 0x3, &(0x7f0000002d40)=0x1, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r10, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r10, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r10, &(0x7f00000003c0)={0x2c, 0x18, r12}, 0x10) setsockopt$sock_int(r9, 0x1, 0x2e, &(0x7f0000000040)=0xffff, 0x4) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 5.350768382s ago: executing program 1 (id=4174): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000003feffff720a00fef8ffffff71a4f1ff0000000071302000000000001d400500000000004704000001ed000007030000030000001d44000000000000620a00ff040400007203020100200000b500f7ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3380d28e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51bf900000000000000d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93020000000000000080e69db384ac7eeedcf2ba3a9508f9d6aba582a896a9f1e096df6ecea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6032399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0xffffffffffffff20}, 0x48) r1 = socket$l2tp(0x2, 0x2, 0x73) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000008c0)) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000009c0), r2) sendmsg$NLBL_MGMT_C_REMOVE(r2, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a00)={0x1c, r3, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8405d22596f37403}, 0x4054) r4 = socket(0xa, 0x3, 0xff) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6}]}, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="02000000040000000800000001", @ANYRES32=r5], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES8=r7, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r8, 0x5, 0xe, 0x0, &(0x7f0000000440)="469dc2d34ae2b7000017645f7e00", 0x0, 0xcfd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) close(0xffffffffffffffff) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0x9}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}, @TCA_CAKE_ATM={0x8, 0x4, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r11, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r13 = epoll_create1(0x80000) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x20000014}) sendto$packet(r11, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$NLBL_MGMT_C_LISTALL(r0, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x64, r3, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xffffffffffffffff}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x1, 0x0}}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x4c000) 4.147011224s ago: executing program 0 (id=4176): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xffffffff}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x10, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10004}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r3, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x0, 0x4f62b68f6fa20884}, {0xc, 0xb}, {0xa, 0xffe0}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x80000000}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c080) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_POWER_SAVE(r9, &(0x7f0000000740)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0x1c, r10, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @void}}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0x20040000) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r14) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r14, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.645383947s ago: executing program 1 (id=4177): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000100180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) connect$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) (async) shutdown(0xffffffffffffffff, 0x1) (async) recvmsg(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x700) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000280)={0x6c, @loopback, 0x4e22, 0x2, 'fo\x00', 0x39, 0x7fffffff, 0x73}, 0x2c) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={0xa4, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_MASTER={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x98}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_MASK={0x3c, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x89}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x44, 0x3, @dev={0xfe, 0x80, '\x00', 0x2a}}, {0x14, 0x4, @loopback}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x21}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0xa4}}, 0x4) (async) write$cgroup_subtree(r0, &(0x7f0000000880)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000006800010000001000fdffff7f00000000000000000c00020001000000150000000c000c800630c600050000000600030001"], 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000500), r3) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'batadv0\x00', &(0x7f0000000000)=@ethtool_stats}) (async) sendmsg$NFC_CMD_SE_IO(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000fcdbdf251b00000008000100", @ANYRES32, @ANYBLOB="0800150001000000040019"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000140)=0x0) (async) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x11, 0x19, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_idx={0x18, 0x5, 0x5, 0x0, 0x4}, @map_val={0x18, 0x4, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0xf86d}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @alu={0x7, 0x1, 0xa, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000006c0)='GPL\x00', 0x0, 0xb4, &(0x7f0000000700)=""/180, 0x40f00, 0x30, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000007c0)={0x2, 0x2}, 0x8, 0x10, &(0x7f0000000800)={0x0, 0x6, 0x3, 0x6}, 0x10, 0x0, 0x0, 0x7, &(0x7f00000008c0)=[r0, r0, r0, r0, r0, r0, r0], &(0x7f0000000900)=[{0x5, 0x4, 0x1}, {0x2, 0x3, 0x10, 0x9}, {0x5, 0x1, 0xb, 0x6}, {0x0, 0x3, 0x2, 0x6}, {0x1, 0x5, 0x9}, {0x2, 0x2, 0x10, 0x1}, {0x0, 0x1, 0xf, 0x4}], 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000027c0)={r7, 0x0, 0x1000, 0x21, &(0x7f0000001640)="cb359f47b79a01d88940e8ffef8f782c277d656f9658d39865bc2d9bc2915ca07b4a1361fdc4d87874659900e799e9d24e963b2ba56d00758522d17c099222d363cb3d6dddf0a7ffb202e9122f68c903945e7cc4c32e0cb36b39a482ddf3fe25212870d0a5f799b79a21cebb0deaadfad38387b2953bce0a08e43378c65ccade6d865266493d518dc14542064e1c5f2ce4f554d30033707896532ab387c496bb4618a24dc4c93695be735a02cb7cc8e34432f4c401c970fb2777d8b1c68bef450d0a9db964b3cc97116d004cf15f1517ed844e3d6302e8ba382f4072a7dd49e5f41a5a68e602a4a90be5f3223e0f707b3f6dac0c2b5e23dd74dee9674fa37df42b7f975e28cee85459497475976673e0a21193a0f2a1c1ee04c6c46b5922116726beda1da2851d5e88e714f328db87860da9a4b82251df7845886284d8e23cc9e916d445e09ab4906186b01fded8ce0dfa5c1af37807aabec5329726a31576167751315c12c57616ee27d46492c63463f4b167e73bfd6270ccd948f342424ef72067037e0ce3a0b400d4b7c7fc1f7ba9d578a303d04ec3e4f239bd55a5ef7ab371a4e22001ec9bb6842c4072c4c54dff4921bfe9cfe147a490654836e3fceb3a18e30dda23ef33714897133e6ce993a9f31f1b9fa321daa417f3295d3e959658ed01468eeada889e2ca941c72d3a1908de2b5ad681c6d2664ff709526b335db9251132af60acdeed0c04f168439721dcb35a837938b282722b5e472c6fbc9015eeaaf8ecf1c4a02ee29024b76e0dc03bd890a485b0ae831cf8fb774ff8cd2215267dffe8ae4969b96d2127edc727a7c6a4c50fa211fee32abf7aaa629b0b239a4299a3d28d7ae033ffae3287b61c419e93dcc1c7b5e55edcd31cc296f5ef66b0ae071365ab1375d7d666da2f8d2b159d8d5c93a8eb0d5926d6d250c0591ff2de7513e580f3774d76e7db4becbd6ff30f12ed69a54e0da007ef28af1d65c3ea6f27b9f165e06898e1c65e20552191f7bebe9f96a315f2f93b557c10d99a36c70030458664dcf5af9ce95afa77799dc27b4d42d547c25a521ef1565dc98bc3f55f2180791ea0b75c90d9aaf9d4cf3316a2eb19d53478d0a80565e5b6b8f432dc2ee65113e72d044a94e02caa398b85d47d9a3ce75cefd97fd95d2202cc94b7f2b55632f88b8754588e02ec1db55f69496283d28a2a46d126dd9856887791441bd3453b243771fa533c7333f041c90fecc5acd53996744f68e4f9c3198ba9c883675c6efa634cd243e6c4e70feb717d75745953c036b68b8cbb6038eab212c9f4feb362a27443a09ebbac87f22e98282cec3a8f065e889e3613a87f02ef0133856a6043497b6ac5248f2ec48c41e39a26df208fa12d6243d965ba0e5263986f881826c11da387b5a6fa0f0c430df815e09d79d34857b2a0daa1d5a6af9f67f45133202f62d6335e11d64a31c8218fd9c23f81e06a4800e75cecf622e0ddd1bb6d2f86f9f3f924ab42f09d782322a187dcd04e02f0b70908a962880a89e8ce21ddc27fe1cbd2367778ab839fea2f07adc0d0e0b10979525abaa7850b3f88e9bd226e73b581ead724bf33e28abecc0eb220cf2ec9b45ceaf46c7e9abb5f60fe5925da70a4c22b5b147d4b751e7a87986a045bf801f4aa11cfef3ce23b3708b894929bf1593b6f7f2044f9dd8726b2d9ba8f98c4c304b37226ca5d3556ea8e3abbc36e86de6194d968d135c1db06b90b43d11947210bfe60c9a2f8abf15a82304a4ad5e633f44c41d81bafcb943edf8ead0d1575b96a09b0e0db7dcc60cd9d2cebf455b05f543ccf0016c17d20936c0e5a03632189d5b1e4d46500fff94f2ee47a48eaf972454bb199c8224a1777016ec87a2bce1c9c09eb1ee6986dae52be5868880c16d567cdacb8a493bc82810386909c2b0454288d2d88956901e06975f3fd0de1515acfa930aeea94517fe00ebb00600e8849eafaba7f2a25199842b3ffebe1072041b0e16135884caa44f4eae6d3d6bf175701b104daeedb6e77eb0e3f8a1f5a8ef08d7cfe695ef12800f1967102f6156d7b838141a5fedd4f66feb7f6f58ed5d4e9fa76aec5633e902698b39d26816f44bf74d6e4424dcbf9db66b0818fab2e88428558d0a4b066dfbbdcccffa6bea428a66aaad8cd947be8b64750a983acc177172dada94f9b8805bf8f65c658d72ee4b7bddcda0613bf407f0f95a094c463a76a054076096394c48c3b33c80b5969799aa0a88f8afe83319c7a1071f6e0a0edebc023bf9118f6a4b0bc4bd4380501df5f2c196e865a7a396c22e9f7d8c4bd5b672b5beb3e5fe09bca02f84fb63c8ec1bba2d0908c9ae1b6325cb1ca292fe6087c420ea6fd70c89d3cbae33adbbc2f0a11f8bae90a971056342dc30cc49555a0e22937287c86717a58a7f2bcff5bff0c976adfd6b911e4fc6888da5394716acbef655aa600d9e0670e320d6917c5bc9e8845e46a1a44fdf9f087960dc301f11406ebd0eb618dc2ea7363ff1a86eba3307cec9728bfe192a116c394619241affd6315eaca1dc771020f69200b381c71847ccaa0d374acd1dfef4dc92189c75d0c464b9744ac3bd59a47391bd871ae0c85b369650918010e851f0e6c7d13e13f9d6de7e181aa3aca18707c09bd7f0c555a57f471049b0fe556724ee936c88eb560339cfb198548d79bcdd93143fa3ce5463018102f513e5ed9ebf8e67298a035010706546958afe5f82e34ca7a4455fd03a4852d2c8d95dd77f0fb134bc3e7d20571dfa5728e9d5493d837b454a9ef9aaac87057c0bde68752e3ce9befc9e0ad5adc409b8dc14e6263dc7644dab3a3f9b4b6e920dad126f279a9c131f94b1ee5fd4f6aa719f367ee42eedb6d6ae382184915b7f0aad93dfb3ad582a28a39e07994bdf8eb0186b10a9292ad359757a8af2b81e5578fc9fa17d801c65f16990ef05a7ef3786637b23df877a3ebf0a2f90b1d811d2fd9927835b001f7bbaa83a0364e0a0b3a0ab97ee1c962ec0e123cb809e60718bfaf162522815fc1258c6a40846c87049ec09f2314a4e5d714420ef7726c1e1076022d458857aa6279c5085ee3504b708f1992e603eb151ec1f2cb011ad0a1af95de67dce081723ea5c15be442e9c3c844bf45833a8e333bd04c51c4c732318b4d2ccc08d7c0b5c22f8c18664b02d5245c95209d825254dc1d512c57a269fdacd02827a20594bf8e406e0a9aab75f6c4901d4a99c42f338dfc0cb57a29f7f60953b1b104be2270b1e731ff3922fb734de06c314bb753e2c83ea2e639ed10fe9ccea5126aad721b6d00c908c2749e91db8b5768a961250a0e3076db55ac78a0635e93aa34ac2d7f0eb0aef1940d1108510891675462a9130111419527d0b33ba233faec4b20f88df74da053ecb66dfbf1e3dc76872832ea80cc5da8dbc4013728d8136c700204f1aff89e096b04b9b8b655233e02dfcf90c63bea7314e496b9b17aa71ba16c22f9829cd5d30a9e87b78231401832f451fd7bfc24cdb13e9ade34ccdfcf2ad9acdc1c7299da0625fbce2da4d374a4a3a499e6052ac8fdad7c1be554aed47f776d4b3b4eb6f16158a970511529d70c9a33c88a0885c3089d50fb24f11db22711b42a47d8bff488809ad69b7ce14f0597975a240591219ae4eb6bca0e9d53b89e9b227db707839393c9509a298ff374ce8ae96048b46c01762a88b1b55c7e5a220be73b077b95c153fce2477d51fb99779b08ed78943009dd23c9f8fce2ce628f382bb68b4b220ebb8dab26a3b9abf6deb3a5c28ea548031737525381acd78d602af84997656c993642f4b08e0fc6a9687aa8dd9f9b97148985d6e88fe79b73b2e1c64b70bf8baa62efa1f3bc3326fd6bce0e0794d88dddf0a6a0773247663bb3531222086665511ec69f7df46c03e4cfbf83f15e80904d73430b442fd218fdfb4e0712ac0d89ac4df8edaaffe794d76a8d8c0d2d19b70b32fa59062f7d06b88e0d726e4b636906f161183fe436a0ecb644f0fb942a84bcbab12524c748ea27c54c5989b01ef76c9db90fc75f2e3bd60bf2783fcee35f25fd907521c25132f9088e182ace524e17776def18cf00f642895698e448bdf6beb8490536f92e55babce74cf01e78ce53055071a9652d2e86b67101695972840f1fba2a7accb5245869f920a58b9667bca1a813ddaaea5539b36a3829c072bb1912d6a65244394472d6e889588b902fa52691d6de7af73bfe1cc6e2d88d06e65b5d9d91d5eea87f46f5f8c55ba8e8c4444aec988354a9cf8e6d9ed4de80b142295255ee789061dc06e9c16e7c8f68eb94072cf960686dd4f8cc8c1443fd20226d4307aa67511b8800f9630f28e201245693e97d8b4648b0fa098c896e931914a7a0d096e51fb4607a99926162946f30a9b888dfcaf73ced8dcc5e325fb4791ca5e8b89e647634adb343562dc6f6c045b8cf6de18a4b9a5ecc2cd11820af925aec677292e036812807f6b49e71a33d4576588fe581184834ec51160b52813f13b23f701a7f47b9e6cc22d8efb871dd0518d87054530ac029f3e35259695af897dde72a5ac93a294578449ba640a556340e15f51d24a43fd2bc0ddfd502edbc9a0dc9ef8ad3c1485acb36477d6e23af15a2e909c4348f999f5dfa9aba5301f1ebdb7b9d3f192f2b362fb866e86b44ed4a786c47067c88560b4580919e0d18277c741add15894703e187da93d8850288ca845ce5fb669b7818f3cf086ba30070df14fd3361afd2ac83644e1baf91d5f86a326e404d8b52229830391d84c0e225bca4edc3cd0f9c1039e8dbd471de6c3d256a9dd5629e4b0a0b1740d0635be0adcc78b2297311085152edd99e3f648418984c4e80b17616d66ede4ce6b0329b28f9ff287eb3adca0270f939aba0bc7079acb06b4f387aad838ff1be9a18bd9cd10202a94d9217a53cb93281fb7d28bba8100f4bd64329c9306bcfcedc7feffe9c14ed581b2b1653f9f98fa35acff37abb109f5d3a98f001efce103c38b1d7e0a8be345c138390e9b4f209571a4046ea68ae8d848f7bea038564ea9af190a8deff065d4f12994ab6ccc9e12d0aea2a9e47cda206f1bc8f808301fd4dbd6c658ce9e42822eebae90f1abf0deb9464148cc4b4290195b7b558a23bf10222fa30431821bd885cb8ddec2f2882f1a8991328cebac3d1e724357d70080675f0176ffe8fab6871483db4b9d40b057b50f8465d040460612fb4b959b84c5c79620dd37d99c0391ce466d12b77500871ad4844a1ccd1b1870848abe9b8903c586b0a55358d1e94680ab3aeae5a36d347ec600e7ee289d2708bd8deb10308e503991b2cba16957781ddb679aaf13761836c4d232c43136d7c3d9d445f87e64ba5afad50338e6d4f1078b9dfa9e7bbf1e92cf023b4e6c096a5b1678e5012a7d55cb1849a3e824695b8de58b51349fea885403235fe120d1c526d373e8a8989d7c1030cd8e63954969191c47dd7db4f3845cb2b8f14a18bce31e7224982af78b9a8a6e8650578a030c641aee6e08fd2f357ea8e3e1d8e918d048fd94034f774a91390b5b13ba543d4a1e6706c385ef7e29a4e7619f7c913074d6caed82cd1c7da0de7f4f8b63c190193c3de8765dd1c9a7828f4e2cbe7cb2e796a6fb8f4c4a78a25f56e2b695e70be755417e4bb23a16c10ca4a77925af7bc6acaa9feb9ba7277a3ab4840bc4a5a3cfbe39de12f04f0e28442fd9f455363e3f83354cd5019d08348339fe94b26423beb30ea6846cf811ff6466b1ecadf3ed99f48f3676339d8798b02e98df5b7e96ae437c80dca094428d0d9da40434e91916c", &(0x7f0000002640)=""/33, 0x3b, 0x0, 0xd2, 0x33, &(0x7f0000002680)="130065377e838a3783182c3190f68793f7d8b2d02a81c56ca6eb8b71f6a20c37d3d6e8e2b5770cfd75b9d0d4e9ecd2cdb30624bf422bb26c45796ce5e8936c3d23ebe0a09ed98f0dfdd9a2b3feba54f908484ac55e75f1f03a5b459f06b30203dcf136f60755bef3ebdfb36f71fb80bd6b661a964a783729a1ce1fbd725937faeda5548b32485ce81d469932be0997f9232142a69a8a9555c329165c273949063dc36804a77f62d3c4bfedc79bf1a645c1abbc6bb09cf6997c606a4592157b38068c80c75f047f44a0214131917840b51dd8", &(0x7f0000002780)="dbd420d60bda8b019ba0abe874a7e452f7a2c2990d2066ec1168707e8959f5bd157910d3ef48c2ec069456d9c6126e2375b213", 0x1, 0x0, 0xc7e}, 0x50) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000180)=0x0) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000200)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r4, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008815}, 0x40000) (async) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$sock_ifreq(r10, 0x8949, &(0x7f0000000080)={'dummy0\x00', @ifru_flags=0x4000}) 2.64491563s ago: executing program 4 (id=4178): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl1\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x0, 0x0, 0xf9, 0x1, 0x50, @loopback, @loopback={0x0, 0xffff888101827518}, 0x80f, 0x20, 0x1, 0xfffffff8}}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaa2986dd6f42b16b00003200fc010000000000000000000000000000ff020000000000000000000000000001530c3bc6ac19e646be1409999ff4bf8015528be5945048790e60cdeb0820f640c74d09aa7d36802e5eabaa6003aa7d765872536f9dfa2d1e29f90c1d24cf3ccea0930f2e32e3e5cc6ea53060ec7d858b80abd69c435aea4e1582521201ff9d3b13a442a26edfb8059eac3b6fe36442c08e17730e9d9b6065328e380fc0cf3863f7da5b90cfb9311012bbd37ac09d6e9223bf79191164508328dd313532fd7ba7e42160e64efcadfbb250112fe5a5775fcaca2b083707fa6116bef2cf6dd6e6000000000000000000"], 0x3a) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000540)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, 0x1, 0x2, [{{0xa, 0x0, 0x0, @private1}}, {{0xa, 0x0, 0x0, @private1}}]}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010828bd7000feffffff00000000", @ANYRES32=0x0, @ANYBLOB="10000000042004060000000000000000", @ANYRES32=r3, @ANYBLOB="0800040000000000b06d9825", @ANYRES32, @ANYBLOB="08001b"], 0x44}, 0x1, 0x0, 0x0, 0x20}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_sset_info={0x37, 0x9, 0x10000}}) 2.383912598s ago: executing program 0 (id=4180): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = socket(0x3, 0x80805, 0xfffffffc) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007b080000000000007b8af8ff000000009408000000001700638af0ff000000001fa900000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000001000000b703000008000000850000006900000095"], &(0x7f00000000c0)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000400)=@assoc_value={r4, 0x5}, 0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @loopback, 0x7}, 0x1c) listen(r0, 0xfffffffc) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r1) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x4, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc4}, 0x20000030) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, r7, 0x7, 0x2, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}}, 0x0) 2.380200799s ago: executing program 2 (id=4181): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x42, 0x40, 0xc2, 0x1}, 0x48) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') bind$alg(0xffffffffffffffff, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x13, &(0x7f0000000400)=ANY=[@ANYBLOB="180000008b000000000000008000b40018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000fffe00008500000086000000bf092000000000005509010000000080950000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7020000000a00008500000086000000bf91000000000000b7020000030000008500000084000000b70000000005000095"], &(0x7f0000000000)='GPL\x00', 0xb, 0xfed, &(0x7f0000000780)=""/4077, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) preadv(r1, 0x0, 0x0, 0x3, 0xffffffff) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)="cb423a11b33192d673ba4c831a9adca48ca7eb0d2f073f36dfc3a94144bfd9d81639fd65ac4e557e12e7b0d2dfea051a7b440ade19d879e209596bf44477ecf6370e0133e541ef9f9e3631dde33dabf7842deb7a72c3ffe0f611062628683e3db2c685af", &(0x7f0000000640), 0x1003, r0}, 0x38) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)="af", 0x0, 0x2, r0}, 0x38) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x42, 0x40, 0xc2, 0x1}, 0x48) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') (async) bind$alg(0xffffffffffffffff, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x13, &(0x7f0000000400)=ANY=[@ANYBLOB="180000008b000000000000008000b40018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000fffe00008500000086000000bf092000000000005509010000000080950000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7020000000a00008500000086000000bf91000000000000b7020000030000008500000084000000b70000000005000095"], &(0x7f0000000000)='GPL\x00', 0xb, 0xfed, &(0x7f0000000780)=""/4077, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) (async) preadv(r1, 0x0, 0x0, 0x3, 0xffffffff) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)="cb423a11b33192d673ba4c831a9adca48ca7eb0d2f073f36dfc3a94144bfd9d81639fd65ac4e557e12e7b0d2dfea051a7b440ade19d879e209596bf44477ecf6370e0133e541ef9f9e3631dde33dabf7842deb7a72c3ffe0f611062628683e3db2c685af", &(0x7f0000000640), 0x1003, r0}, 0x38) (async) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)="af", 0x0, 0x2, r0}, 0x38) (async) 2.348218572s ago: executing program 1 (id=4182): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="180000002f00090028bd70000000000004000000040010"], 0x18}}, 0x20000004) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1000, 0x89}, 0x50) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000380)=@filter={'filter\x00', 0x42, 0x4, 0x311, 0xffffffff, 0x1d8, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {0xff}}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@private=0xa010101, @multicast2, 0xff, 0x0, 'netpci0\x00', 'team_slave_1\x00'}, 0x287, 0xe0, 0x140, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x4}}, @common=@unspec=@limit={{0x48}, {0xfffffffa, 0xb, 0x0, 0x0, 0x0, 0xfffffffc}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x1278]}, {0xffff, [0x5]}}}}, {{@ip={@dev, @remote, 0x0, 0xff000000, 'veth1_to_team\x00', 'veth1_to_batadv\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x0, 0x3, 0x1, 0x2, 0x0, 0x5], 0x1, 0x4}, {0xffffffffffffffff, [0x7, 0x4, 0x4, 0x5], 0x6, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a0) getsockopt$inet_opts(r2, 0x0, 0x16, &(0x7f0000000b40)=""/206, &(0x7f0000000240)=0x54) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={0x0, &(0x7f0000000980)=""/103, &(0x7f00000025c0), &(0x7f0000000600), 0x80, r1, 0x0, 0x7}, 0x38) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x200, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc04, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x9, [@struct={0x4, 0x1, 0x0, 0x4, 0x1, 0x7, [{0x1, 0x3, 0x9}]}, @int={0x5, 0x0, 0x0, 0x1, 0x5, 0x20}, @typedef={0x7, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x61, 0x0, 0x30, 0x2e, 0x61, 0x61, 0x61]}}, 0x0, 0x55}, 0x28) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f0000000440)="80", 0x1, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r7, 0x1, 0xd8, 0x6, @broadcast}, 0x14) ioctl$OCFS2_IOC_MOVE_EXT(r0, 0x40406f06, &(0x7f0000000140)={0x33, 0x4, 0x7, 0x4}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) close(0x3) r9 = socket(0x8, 0x800, 0xdf5) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="ac0100000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc02000000000000000000000000000014000400fe8000000000000000000000000000aa0c0002800500010000000000080007400000000044000f800800034000000006080002400000000108000340000000ce08000240000000030800034058696a8c0800024000000001080001400000000008000140000000040c000680080002000000000010000d80080001006401010004000380140018"], 0x1ac}, 0x1, 0x0, 0x0, 0x40}, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r0) sendmsg$MPTCP_PM_CMD_REMOVE(r9, &(0x7f00000007c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x28, r11, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6f9a800}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0x28}}, 0x20000004) 1.999431972s ago: executing program 3 (id=4184): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000000)=0x5, 0x4) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x100000}, 0xfffffffffffffd6f) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000005d40), r2) sendmsg$IEEE802154_ASSOCIATE_REQ(r2, &(0x7f0000005e00)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010025bd7000f5574a6500062dee0c0009673ca24261d5c108000c0009000200aaaaaaaaaaaa05000700090000000c0009000203aaaaaaaaaaaa98ef8d7c5cbd284d6b02607b044b98aa501867acb1af7c1d6f93515c5748344ca2ecf12eca3a"], 0x40}, 0x1, 0x0, 0x0, 0x240148c4}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r5, 0x0, 0x11, &(0x7f0000005500)="a1962ead", 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}, 0x1, 0x0, 0x0, 0x24004000}, 0xb14aaedb21672184) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB=' \x00'/20, @ANYRES32=r8], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x80) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYRESOCT, @ANYRESOCT=r7, @ANYRESHEX=r0], 0x24}}, 0x0) r9 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_PIM(r9, 0x29, 0xcf, &(0x7f0000000100), 0x4) setsockopt$sock_int(r4, 0x1, 0x9, &(0x7f0000000300)=0xfff, 0xfffffffffffffd9a) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYRES8=r11, @ANYRESHEX=r4, @ANYRES16=0x0], 0x48}, 0x1, 0x0, 0x0, 0x24004801}, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) 1.878730161s ago: executing program 2 (id=4185): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(0x0, r0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)={0x64, r1, 0x1, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x48, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xfffffe1e, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0x100}}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}]}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) 1.807507998s ago: executing program 4 (id=4186): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2d, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x102, 0xf2, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @fd=r2}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@mcast2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43f9621dc08c029d16080600000000000000f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x18, 0x1c, &(0x7f0000000500)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x100b8, 0x0, 0x0, 0x0, 0x4000}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x0, 0xb0e4}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xa0}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000001140)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) 1.682057092s ago: executing program 0 (id=4187): r0 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010105, 0x4e20, 0x3, 'wlc\x00', 0x30, 0x660f5380, 0x1c}, 0x2c) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x30}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x24, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0xe, 0x0, 0x0, @binary}, @nested={0xc, 0x9, 0x0, 0x1, [@typed={0x8, 0xae, 0x0, 0x0, @fd=r1}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 1.658554261s ago: executing program 3 (id=4188): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x4, 0xffffffff, 0xfffffff8, 0xd}, 0x54) (async, rerun: 64) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000002200e92d29bd70000476fc29fa2eb7f1ac00000000000200"], 0x1c}}, 0x4040014) (rerun: 64) ioctl$EXT4_IOC_GETFSUUID(r0, 0x8008662c, &(0x7f0000000040)) (async) socket$packet(0x11, 0xa, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x12, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x10440, 0x115}}}}}}]}, 0x48}}, 0x0) (async, rerun: 64) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) (rerun: 64) syz_genetlink_get_family_id$devlink(&(0x7f0000000900), r2) (async) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x44, 0x0, 0xf03, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0xfffffffffffffff6}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG, @TIPC_NLA_CON_FLAG={0x8}]}]}]}, 0x44}}, 0x0) (async) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000980)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000940)={&(0x7f00000006c0)={0x20c, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffff0}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x101}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0xec, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x45a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x26eb}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}]}, @TIPC_NLA_LINK={0xb4, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}]}, 0x20c}, 0x1, 0x0, 0x0, 0x4080}, 0x48800) (async) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r4) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x3c, r5, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}]}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x44) (async, rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0xc, [@var={0xa, 0x0, 0x0, 0x11, 0x4, 0xffffffff}, @const={0x0, 0x0, 0x0, 0x2, 0x3}, @restrict={0x0, 0x0, 0x0, 0xb, 0x2}, @var={0x2, 0x0, 0x0, 0xe, 0x1}]}, {0x0, [0x0, 0x4f, 0x5f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x5c}, 0x28) (rerun: 64) syz_emit_ethernet(0x2a, &(0x7f0000000340)={@empty, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3e, 0x1c, 0x0, 0xe000, 0x2, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) 1.450900968s ago: executing program 2 (id=4189): socket$inet_mptcp(0x2, 0x1, 0x106) epoll_create(0xea3) socket$nl_generic(0x10, 0x3, 0x10) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000900000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x8}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000007c0)={0x114, 0x3e, 0x301, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @pid}, @generic='\x00\x00\x00\x00\x00\x00\x00', @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb47d96219c08c029d1608a487f26fbe816b89f7cb81bff81a8b7a82565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875cf0d972df9e99f07976773f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fdc2f4393c05a007d12b505a84dfdb98d568175b62421d726d1e5331e1ddfd4d", @nested={0x0, 0xe6, 0x0, 0x1, [@nested={0x0, 0x11b, 0x0, 0x1, [@typed={0x0, 0x51, 0x0, 0x0, @ipv6=@mcast2}, @generic="2065f286e4792c1799c3d879d5f960a7a08df3c22ed92317a3dabd87012e3366766abb21d43b0034074af7d05671c75d528b5138a8def3ebe2258e2183dc49c4da3374def48ba3a672787862b16f30f74bf90c0e04f0612363d22c780c60511008653cdfd4fe45e0815b210deff945129c6a0aa456a13823e98540f68db3dfdb53eaf10f3117e621d01d4accee2db3fb2a549b2b563963d77eae4e99423c752df91df3bc91d3bbd98bdc3b73bcfef84375c2365dcff575089c736051cc2247cacae80dbdf00dd190f431761a9eaa85dc2d8bd1739c1bf0844846c16afc1d93ac809ffdb530496343cbcfa45890eaad9eddd01863fe908e140944", @typed={0x0, 0x7a, 0x0, 0x0, @uid}, @nested={0x0, 0xfc}, @typed={0x0, 0x98, 0x0, 0x0, @uid}]}, @generic="beaf34711da237f36f734eb63f945aa88e3569e319881a90339f5127869cafd1b7000a65b0b0cbcb3ff758475eb29bd5d98f4f959045c50eae0e13269f54fcf9afea28c4a9455fc864c0b2ee67fecacea152f75cefef78a2a2c58c887229bc967ba5fa337a78da603add763b3d10b921884d983fdf8e64c462e8c3799e9349e84d5389384e29e55e58636e8a15ddb3c0d36babbb7e31d901ae4645a74f824e8ca023a68ff563f6513d9d3397a02455c7db6d4277a24456ee9e7ec125", @generic="c763c37e3aa08e039dd1273188557041c5b7a91d7f38afb424f29bd3bb053b46999193bd055966961c23644cac0d0749bf32de2afac603dc99748e5bc5c5924dadf52e49bf3a0a061385fe9df674f64dd28ac8b80e8519f8188f054be725b57b713900ee74212920bd964e74b3bd", @typed={0x0, 0x33, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @nested={0x0, 0x151, 0x0, 0x1, [@typed={0x0, 0xc9, 0x0, 0x0, @u32=0x3}, @nested={0x0, 0xbc}, @generic="84c854ad0c4f738171ae1ad928061b80d2b256d8ecad41b06c8259a743cfef882835143b86fee55af1b290680d4d6ec6e0b3857c790f23c55c3d7550121f69fcea34873c3402612adf8a15b5c10d4918215ae70086cdd850f12f086dcddca72d6c4dcc", @nested={0x0, 0x9f}, @typed={0x0, 0x104, 0x0, 0x0, @fd}, @typed={0x0, 0xc6, 0x0, 0x0, @str='[*\x00'}, @typed={0x0, 0xa2, 0x0, 0x0, @fd}, @typed={0x0, 0xc3, 0x0, 0x0, @u32=0x80000000}, @nested={0x0, 0xd6}]}, @nested={0x0, 0x2e, 0x0, 0x1, [@typed={0x0, 0x4b, 0x0, 0x0, @u64=0xa}, @nested={0x0, 0xdb}, @generic="74dae68f5db3db3c801f777d40d7fa8025b70dd5243e59a8fdf2f0504c11a7ed7252d44743a615df3b2d02cc8548b772f9587df4852ccc12fcba5bc0411caafa38de"]}]}]}]}, 0x13a}], 0x1}, 0x0) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000340)=ANY=[@ANYBLOB="18080000070000000000000007000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006d00000000000000180000000000040000000000000000001f82d9509ce76723cb06abcf72beda5033b6ad65268c15e653fe7b8cca2e14014cb2a37ca28763ffe37ea7baf05798a5bb16ed4a2d44de51386fbe4c90ae43b094aac89d89b9081b7896c8d730586fac94f82e10d95c54a94dc90b38b2b4243299539a45a7ee04d0b638721882540122e9a3d0a4434ddd95"], &(0x7f0000000000)='GPL\x00'}, 0x94) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r3}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000073113d00000020008510000002000000850000000700000095000000000000009500a50500200000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.318331956s ago: executing program 4 (id=4190): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42, 0x0) close(r1) socket$inet(0x2, 0x3, 0x1) ioctl$TUNSETLINK(r1, 0x400454cd, 0x312) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x16, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000001000000000000000000000071124f000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0xd42c142798a188e2, 0x1, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400003}, 0x94) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b23000d"], 0xffdd) 1.1358099s ago: executing program 3 (id=4191): pipe(&(0x7f0000000180)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=ANY=[@ANYBLOB="5401000010000100feffffbf00010000000000000000b600000000000000000000000000000000000000ffffac1414bb000103944e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fe8000000000000000000000000000aa000000000000000001000000000000000200000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000060000000000000006000000000000001f00000000000000ff0100000000000000000000fcffffff000000002abd7000043500000a0000fd2000000000000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c000400fdff4e224e2000"/268], 0x154}, 0x1, 0x0, 0x0, 0x8801}, 0x10) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, 0x8032, 0xffffffffffffffff, 0x8884d000) 1.098939226s ago: executing program 1 (id=4192): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000800", @ANYRES32, @ANYBLOB="0000002f1398f9de8d17d4515749ef5d00000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x13, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@newlink={0x50, 0x10, 0x403, 0x70bd25, 0x4, {0x0, 0x0, 0x0, 0x0, 0x500, 0x8000}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_STATS_PER_PORT={0x5, 0x2d, 0x1}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x2}, @IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x2f, 0x42, 0x5, 0x5, 0x6, @mcast1, @mcast2, 0x8, 0x40, 0x40a798d3, 0x7}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000005c0)={'syztnl2\x00', &(0x7f00000004c0)={'erspan0\x00', r4, 0x10, 0x7800, 0xffff, 0x45b, {{0x33, 0x4, 0x1, 0x8, 0xcc, 0x65, 0x0, 0x0, 0x4, 0x0, @rand_addr=0x64010102, @loopback, {[@cipso={0x86, 0x11, 0x7ffffffffffffffc, [{0x7, 0xb, "114f2bc2c5c799ef08"}]}, @cipso={0x86, 0x47, 0x3, [{0x5, 0x9, "842bca88acdec6"}, {0x7, 0xd, "1e013325d9ddb18dc71f15"}, {0x5, 0x9, "ccb3579a14de32"}, {0x7, 0x9, "75cedcb9b99afd"}, {0x2, 0x6, "11a3e7d8"}, {0x0, 0xe, "24d2f94b3dcdfb5b172deb40"}, {0x2, 0x5, "c06fcb"}]}, @cipso={0x86, 0x2a, 0x3, [{0x7, 0x5, "da6610"}, {0x1, 0x2}, {0x6, 0xb, "dcd843b7cac5d11bb2"}, {0x7, 0xe, "d3dba52143cb3897885742bc"}, {0x2, 0x4, "98e3"}]}, @timestamp={0x44, 0x1c, 0xfa, 0x0, 0x6, [0x1, 0x9, 0x7, 0x1ff, 0x8, 0x2]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0xc, 0xa8, 0x3, 0x5, [{@multicast1, 0x3}]}, @generic={0x86, 0x8, "b79d2755c7f5"}]}}}}}) 1.058893647s ago: executing program 2 (id=4193): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) (async) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r2, 0x114, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="8361"], 0x2) ioctl$XFS_IOC_SCRUBV_METADATA(r2, 0xc0285840, &(0x7f0000000140)={0x0, 0x10, 0x4, 0x0, 0x4, 0x0, 0x0, &(0x7f0000000100)}) (async) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) (async, rerun: 32) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000), 0x0) (async, rerun: 32) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000080)) (async) ioctl$PPPIOCSMRU1(r3, 0x40047452, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r5, &(0x7f0000000100)={&(0x7f0000000000)=@in6={0xa, 0x4e20, 0x5, @mcast1, 0x3ff}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[], 0xf}, 0x4) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 981.721857ms ago: executing program 0 (id=4194): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000080)=0x8, 0x4) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write(r1, &(0x7f0000001300)='-', 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) unshare(0x20000400) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff6}, [@call={0x85, 0x0, 0x0, 0x36}]}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r3, 0x0, 0xe, 0x0, &(0x7f0000000280)="f7edad000000000000000000179e", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={r4, 0x64, 0xfffffffffffffffd}, 0x33) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x1b9, &(0x7f00000003c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaa05000000000000002d9201833afffe8000000000000000000000000000bbff0200000000000000000000000000018600907800000000030000007f000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af180200000200000000000000000000001818fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978000906aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f80889"], 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @mcast2, 0x3}, 0x1c) sendmsg(r2, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0x7, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x4, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) r7 = socket(0x1, 0x2, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f670600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1b172191d359645fae2d074ea5724ab77ea04fe507938b1213cdd4a92860e59808689382734d24b3123dd40c6d612c8a19948cd257748b1e7324adddbe61d51013f7d6b313c6df7b7b29678d70fc94dcc3e99e2472e78968ed94e7a54988656e8fff6b1d9b9993c71edd5cc10a2bea8d94d751b77fa7c48c712af35a9ffe670e8fa451942f48741119496bc30137e1202aed6bb5cd5c2d0256d049e4a335e2ea5545e5624be2391c37c0a2ae3bbb5b58778b85424bcdb84358359b2cb2782fc0e82f17b12d641ce6a72ab0ac794f878140897703bebe4420115d26675f27598841965fa91088252"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r9, &(0x7f0000000500)="64da80cca3dc0ebb464eb3c607cc5fb4e054546aee0e3bbed5d399a5b89f2b5789b6877b231ff99424973444ab0025b6c428d2be76773e218a9ee0026c00081ac6ab0b6ea465f2f65006e0c2a7601129bf29eabc32dc0f0ed276b82466c8beece694cc8259f288c7ef154b6c34b9bbb6e04be82b47ceaacac255d3ee7c3a5059c7b82808d3f8c1f7ec5200"/148, &(0x7f0000000480)=@buf="95c213bafa2d9ea4d311843316579a0bb0628bc8bfe2f13a5ceef5c25197863e7396c37cfd809256819b53ded9d983a1e2380d5c1b0cd29f20ab2a906dc82fbbf7d954855efab5d5ab1894e062588793438d9e89a1edef2bbedb69bcd7b5c2f373e2420442f99cea1eadb43c", 0x4}, 0x20) bind$unix(r7, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000001680)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0x40, r10, 0x1, 0x204, 0x2, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_TX_RATES={0x24, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x20, 0x4, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x7f, 0xa000, 0x6, 0x8, 0xffff, 0x4, 0x5, 0x5]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c890}, 0x14) 895.30707ms ago: executing program 3 (id=4195): bpf$BPF_LINK_CREATE(0x8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x3c, 0x0, @val=@tracing={0x0, 0x2}}, 0x20) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1700000015000101edff45623f8df4272d"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 678.117427ms ago: executing program 4 (id=4196): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f0000000140)) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000d40)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="208000000000000008001b0000000000b698e076dce542a770460f13be2da51d664fd4dcbecfff0980fe18320bb8e0f5701770efd4a7a4ccdf230d31e7fba28fb1e5a457ba23b550370967a974737ee4f69848beab0fdc127cfd7e76600e1186fe32af0ea190f2a999e9fce6540264412e522f63860eb95b13840dcc6b4e4b957e47c416829f00"/149], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$BTRFS_IOC_DEV_REPLACE(r1, 0xca289435, &(0x7f0000000300)={0x2, 0x0, @status={[0x8, 0x8000, 0x4, 0x6, 0x9]}, [0x8f2b, 0x6, 0x2, 0x3, 0x7fffffffffffffff, 0x8, 0x0, 0xb, 0x1, 0x2, 0x7, 0x2, 0x3, 0x2, 0x8, 0x4, 0x8000000000000001, 0x5, 0xfffffffffffffffc, 0x10000, 0x4b8, 0xfffffffefffffffe, 0x10001, 0x7fe, 0x2, 0xfffffffffffff6c4, 0x8001, 0xfffffffffffffff4, 0x10000, 0x4f5, 0x0, 0x4, 0xfaa, 0x600000000000000, 0x0, 0x5, 0xfffffffffffffd1d, 0x8c0e, 0x1, 0x6, 0x9, 0x8, 0x1, 0x10, 0xffffffff, 0xfffffffffffffff9, 0x76, 0x74, 0x6, 0xe, 0x0, 0x8, 0x7, 0x100000001, 0x6, 0x1, 0x3, 0x2, 0x10, 0x2, 0x2, 0x1, 0x3, 0x5]}) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$kcm(0x11, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@newtfilter={0x84, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x6, 0x7, 0xffffffff}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r7) r8 = openat$cgroup_procs(r1, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) pread64(r8, &(0x7f0000002840)=""/4096, 0x1000, 0x4) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_int(r9, &(0x7f0000000080)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) sendfile(r10, r10, 0x0, 0x2000000000000002) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x0, 0xc940}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8}, @IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_AD_LACP_ACTIVE={0x5, 0x1d, 0x5}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x45844}, 0x0) 562.058184ms ago: executing program 2 (id=4197): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3], 0x90}}, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r5, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x40004}, 0x40c4) 560.533021ms ago: executing program 3 (id=4198): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x11, 0x0, &(0x7f0000000080)="dc188619b95d02ff4284860188a86a4e08", 0x0, 0x8001ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r3 = socket$kcm(0xa, 0x922000000003, 0x11) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000150900010073797a30000000000900020073797a32000000"], 0x94}}, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x3, @loopback, 0x1, 0xfffffffe}, 0x80, 0x0}, 0x0) (async) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x3, @loopback, 0x1, 0xfffffffe}, 0x80, 0x0}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x4008014) (async) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x4008014) syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), r0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) write$cgroup_type(0xffffffffffffffff, &(0x7f0000001780), 0x9) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x18, 0x10, &(0x7f0000000340)=ANY=[@ANYBLOB="18080000000000000000000000000000010000005db81d63e405000000d73a5fc2bc8ff04f2f6ca96bd0105f6361f922a52a960100000000000000d745ffcb", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000550901000000000095000000000000009405080010000000bf98000000000000560800000000000085000000b4000000b7000000000000009500000000000000"], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x475, 0x4, 0x3}, 0x1c) (async) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x475, 0x4, 0x3}, 0x1c) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7810, 0x7, 0x1, 0x1, 0x1fd, 0x1, 0x5}, 0x1c) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x4003, 0x2, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmsg$unix(r9, &(0x7f0000000100)={0x0, 0x1d, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r9, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) recvmsg$unix(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000700)=""/4080, 0xff0}], 0x1}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=r5, @ANYBLOB="ffffff7f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="040000000200"/28], 0x50) (async) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=r5, @ANYBLOB="ffffff7f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="040000000200"/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r10}, &(0x7f0000000080), &(0x7f00000000c0)=r6}, 0x20) 335.207451ms ago: executing program 0 (id=4199): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x12dd00, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r3 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000100)=ANY=[@ANYBLOB="1e00000000000000000000000020000000000000", @ANYRES32, @ANYBLOB="00000000000000000200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000300)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000003b80)="a66554178426362975b882a7d6b43fe537b6b0036a966a05363793ec2f6830cc5b81e514b9cbe4c27c3f3a581556b832100a4233e3e80fda14dd84611893300a863a8a6f6d8e0c7633e168ad7e25d4bd14ba6812101488e9444165b8100d576a996fec019ae11a03498329bcbacd0e8a206bd0de0c7e09f64a57d56974599f09aa148b4224dcffe1b5a1e55bbc1fdae8bf2f72437cf399c4cda11554b21158e3ddb00ddb71a1bd1daa50d631b027238397d692214223af1d685e7a3318da65c9233eba674ff72097411ef3ee19b892b1b36eeb925a6698f4d455b02163a3504ee6accffad7aaf9d19763d886272559ef0501594ea23d45a43e13bba05d7d332750ce5d9d3b37d234f46464fcc5f495e0fae02a24efd67db315c92f9483196bd38b38b3675bc0de5873f9d7b01ee5c564f5573b474e3c9f3b955929d9112007049e4245d68b93f365a90d35c837cc13999f2d6a23be87786e4234d74b1160669c7962b3b413201192565fb93252c153dd735e280e01d13dc34468f67684a4308c7dbe07687e0f56fa54f44b0141895ad75781ca026d813e8c17794b9d87d97136d29aced71b1f526dfab6301b78f1deab7949c97cce6616f4afd46a331e2fb54342dd1964c70a2717f4239c9e5157ac93c42d05f230da440a9227f0f82ee95cc79ca2d3da3f889b37f85f50d75711a910a57d213edb4b981cde33e01ec960885f31511ed7f8e01ddd36d76e1b1e40e81cd21ef9c34134400fdd94e34e5d77f4b7ca3612663e0f6b364be4a9dc775f3b12386ec04960524a9a5e6879e50db657c89a7dc7ec1f919ba8c77e926538599e7969868a5ef3e92817a3402c13de0efcb9fef445ee49f4b0ed26c5dbadff51459d5229661e4b7d2548c9ea4ce89b828daf5f5873e1d9e693ba037fc00ccc3dd74096c0f1ea508ee96ad7d85664947193e011e2f037917af7716d7f27cac25c9785f13baddfeba40997af5f6f4029cf5b781b654a635ee8696078d99025012cbad5af13bc26e2d100726fc98c11f8f16057a8506f29cf30bcf9ab7883ad1708d11bf70ee54fced84c69d90eb302e8aff586c0b25893e09868426cb4649145ede32035c47360fba7fe863cb00b86f583090c5b8d8549ba62cb822ed182fc07f029a826b5c86dccd603408bfc060c80c8ae21be086998f45923e1fe36eea10a66a55cc9f3cb6a296535dabc831fefe26b80ee47c723c596c51e1d7c073df20874eef79a291934c4c6a7c6b656595fc76b25d0d50590c1df29d59842a19a6acd60e783069aa01c0ccd0a7d5cf7ef1c5bfae1747770e9c21d792129132d590da18e30a70a330e7b05aebf09e93aa545ca382a29f810e8a4efc0fffd3660f76892c2027daccfd743734c359bacaec86e4f15ca31b83894b67b3a3539cb5567bbcacd9a52c9b8d87252ddab0acd3b4fbe21997754874d1c0dbdd373f7150b87893fa4b6c5e6016f2146471f092a2cf4c75b6ed08a2f27f9f68d1817d7e782c0fa3026fd4e283b6b23bff2a9d84f5cdea217ce396080b623fe6d5da91fcab0e563b8c54af99007f6680efc9fdcd35d1d2ad8539ee04744e38c750114de55b80192c5d6aee8cbc34a47426bb22a9e3e2fcb87530c418a65fad7d5fbb15f569a69fc2cb92dad8f574330fdf2aa6033d1be037d5e3e964ff01329c43401bc86a72025288100ce86c053b922e9a7a692912bca4dabfc0e3a8966a65c96d3a420809c2d600928546a4ea26ff7100081f3ca8a70c64b3a4fc33b3e2546ff4a43502d448f2c0b274a244d32c955b02d897b1c53a2724ff886a1ccc91ea3a22dbd1f5f3f2e33db9ac9aae458a27e2a529ac2d8671f0e30df63a5d1a579b8f5a68f4a53fb4f3f76d41bee8e10635606f2a7fde9af7bd0df3ab9750b0c6c962fbc36e9474e3efac01ea98a4fe6e0f819d62dcde2b9b77fb0d430495ee042d1e70a52debb0d13b09906f77327dd4ccfe2b6796f9aa5e5b2fa9b2249c66b49cd7e1cbdb194c239d7e2e0928a45c8c55904cd345c5d8b92a5526ff51b5c2e477089eeb16cb3996c243c66a82f4349370ac26bef5d900ec582f274cc38b0258993de6cc79574fdacb895721fd4d04f84c4d89e109629f48a24fb3241882f154a35ae6659e0bb35af409c51cb11a26413be88a1e5ae1e8d2b1333a6c80c42c654f269dd875aa7f19517f62b8e031f11bdb11bafcf4b4f06496142579f77", 0x621}], 0x4}}], 0x1, 0x4000001) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000040)='highspeed', 0x6) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xff0, 0x1, 0x0, 0xe}, &(0x7f00000003c0)=0x40) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0x5, 0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0xa}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=@newqdisc={0x160, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x0, 0xf}, {0x1, 0xb}, {0xd, 0xb}}, [@TCA_STAB={0x13c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x7, 0xd16, 0x1, 0x1, 0x8, 0x8, 0x8}}, {0x14, 0x2, [0x2, 0x3e, 0x1, 0x2, 0x40, 0xe9, 0x3e38, 0x1fe]}}, {{0x1c, 0x1, {0x9, 0x0, 0x9, 0x0, 0x1, 0x5, 0x3, 0x5}}, {0xe, 0x2, [0x1000, 0x578a, 0x39cd, 0xf8, 0xfe]}}, {{0x1c, 0x1, {0x0, 0x8, 0x828, 0x1, 0x1, 0x5, 0x80000000, 0xa}}, {0x18, 0x2, [0x7, 0x6443, 0x7fff, 0x5f, 0x0, 0x3, 0x8001, 0x5, 0xf9f, 0x2]}}, {{0x1c, 0x1, {0xd9, 0x1, 0x2, 0x0, 0x2, 0x6, 0x6, 0x1}}, {0x6, 0x2, [0x200]}}, {{0x1c, 0x1, {0x4, 0x6, 0xa4f9, 0x9b09, 0x2, 0x18f, 0x5377, 0x7}}, {0x12, 0x2, [0x4, 0x7ff, 0x7, 0x5078, 0x1, 0x8001, 0x2]}}, {{0x1c, 0x1, {0x0, 0x0, 0x401, 0x2, 0x0, 0x40e0, 0x7, 0x3}}, {0xa, 0x2, [0x2, 0x9, 0xc35c]}}, {{0x1c, 0x1, {0x9, 0x2, 0x5, 0xffff4b8b, 0x0, 0x4, 0x2, 0x6}}, {0x10, 0x2, [0xff, 0x2, 0x7, 0x101, 0x6fa, 0x6]}}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x8021}, 0x24044090) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYRES8=r4, @ANYRES32=0x0, @ANYBLOB="c30c426a00000027340a00280012800a00010076786c616e00000018000280"], 0x48}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f00000001c0)={0x2, 0x10, @remote}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="a905000000007464000100000000000000e5c06417e436a106993e1e5ad8311dabcd25ca", 0x24}, {0x0}], 0x2}}], 0x3fffffffffffdf1, 0x0) socket$packet(0x11, 0x2, 0x300) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3000023, 0x13, r3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r10 = accept$alg(r4, 0x0, 0x0) sendmmsg$alg(r10, &(0x7f0000000800), 0x0, 0x48080) recvmmsg(r10, &(0x7f000000a040)=[{{0x0, 0x0, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/147, 0x93}], 0x1}}, {{0x0, 0x0, &(0x7f0000004b00)=[{&(0x7f0000003640)=""/4096, 0x1000}], 0x1}}], 0x2, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) 333.063787ms ago: executing program 1 (id=4200): unshare(0x22020400) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x44, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}, [@nested={0x2e, 0x11, 0x0, 0x1, [@generic="e796bd6dd42541affac6ff415af85ab494e09d498fc605baa5fe20e0f8a725f9f47392b70f555def59af"]}]}, 0x44}, 0x1, 0x0, 0x0, 0x42804}, 0x84) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x24000000}, 0x20008004) 21.174911ms ago: executing program 3 (id=4201): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e00000001300100000000000000000007374726565626f673531322d67656e65726963"], 0xe0}}, 0x0) sendmsg$nl_crypto(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="f0000000120003"], 0xf0}, 0x1, 0x0, 0x0, 0x200000c5}, 0x4050) 0s ago: executing program 2 (id=4202): getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x800, 0x20}, &(0x7f00000003c0)=0xc) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x70bd28, 0x25dfdbff, {}, [@FOU_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4010852}, 0x80) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) write$tun(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000001011ff00000000000100070000000000000000ff0200000000000000000000000000014f194e20"], 0xfdef) kernel console output (not intermixed with test programs): 2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.181689][T10696] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.238023][T17601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 546.324953][T17865] bond11: option fail_over_mac: invalid value (127) [ 546.339581][T17865] bond11 (unregistering): Released all slaves [ 546.539559][T17601] veth0_vlan: entered promiscuous mode [ 546.557726][T17601] veth1_vlan: entered promiscuous mode [ 546.633444][T17878] tipc: Enabled bearer , priority 0 [ 546.647397][T17601] veth0_macvtap: entered promiscuous mode [ 546.676848][T17601] veth1_macvtap: entered promiscuous mode [ 546.723347][T17877] tipc: Disabling bearer [ 546.774819][T17882] netlink: 'syz.1.2999': attribute type 1 has an invalid length. [ 546.846802][T17601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 546.908799][T17601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 546.966888][T10696] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.005030][T10696] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.037742][T10696] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.068208][T17892] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 547.088161][T10696] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 547.856387][T10702] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 547.888331][T10702] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 548.043756][T10702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 548.071249][T10702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 548.076502][T17912] veth0: entered promiscuous mode [ 548.156749][T17916] __nla_validate_parse: 14 callbacks suppressed [ 548.156770][T17916] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3007'. [ 548.225853][T17910] veth0: left promiscuous mode [ 548.317822][T17921] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3010'. [ 548.396455][T17916] bridge0: port 2(bridge_slave_1) entered disabled state [ 548.404257][T17916] bridge0: port 1(bridge_slave_0) entered disabled state [ 548.468033][T17938] netlink: 'syz.4.3010': attribute type 2 has an invalid length. [ 548.478218][T17938] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3010'. [ 548.529355][T17916] veth0_to_bridge: left allmulticast mode [ 548.594052][T17916] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 548.616204][T17916] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 548.787623][T17916] batman_adv: batadv0: Interface deactivated: gretap1 [ 548.821458][T10696] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 548.833932][T10696] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.850251][T10696] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 548.865078][T10696] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.918038][T10696] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 548.955092][T10696] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.999611][T10696] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 549.040501][T10696] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.093180][T17946] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3012'. [ 549.127274][T17951] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3014'. [ 549.312987][T17958] tc action pedit offset must be on 32 bit boundaries [ 549.526436][ T5623] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 549.551285][ T5623] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 549.561322][ T5623] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 549.576031][ T5623] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 549.584309][ T5623] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 549.739097][T17966] syzkaller0: entered promiscuous mode [ 549.770947][T17966] syzkaller0: entered allmulticast mode [ 550.049347][T17976] netlink: 'syz.1.3021': attribute type 5 has an invalid length. [ 550.132347][T17985] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3023'. [ 550.143513][T17983] vlan2: entered allmulticast mode [ 550.161095][T17983] bond0: entered allmulticast mode [ 550.177298][T17983] bond_slave_0: entered allmulticast mode [ 550.189227][T17983] bond_slave_1: entered allmulticast mode [ 550.202153][T17987] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3023'. [ 550.388369][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.417791][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.609546][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.624952][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.747715][T18008] 8021q: VLANs not supported on ip6gre0 [ 550.782491][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.812606][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.961185][T17962] xfrm0 speed is unknown, defaulting to 1000 [ 551.002354][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 551.048893][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.274741][T18020] netlink: 164 bytes leftover after parsing attributes in process `syz.4.3032'. [ 551.306408][T18020] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3032'. [ 551.610772][ T5632] Bluetooth: hci1: command tx timeout [ 551.649126][T18038] netlink: 'syz.0.3037': attribute type 2 has an invalid length. [ 551.657470][T18038] netlink: 'syz.0.3037': attribute type 1 has an invalid length. [ 551.739848][T18041] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3038'. [ 551.924736][T17962] lo speed is unknown, defaulting to 1000 [ 552.320894][ T12] pim6reg: left allmulticast mode [ 552.379434][ T12] batman_adv: batadv0: Interface deactivated: gretap1 [ 552.756950][T18082] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 553.279196][T10696] smc: removing ib device syz0 [ 553.370161][ T12] batman_adv: batadv0: Removing interface: gretap1 [ 553.390515][T10696] smbdirect: ib_dev[syz0] removed [ 553.653262][ T12] bond5 (unregistering): (slave bridge5): Releasing backup interface [ 553.662664][ T12] bridge5 (unregistering): left promiscuous mode [ 553.669268][ T12] bridge5 (unregistering): left allmulticast mode [ 553.690094][ T5632] Bluetooth: hci1: command tx timeout [ 553.759307][ T12] team0: Port device bridge9 removed [ 553.853508][ T12] .` (unregistering): Released all slaves [ 553.877694][ T12] bond1 (unregistering): Released all slaves [ 553.925598][ T12] bond2 (unregistering): Released all slaves [ 554.015278][ T12] bond3 (unregistering): (slave veth11): Releasing backup interface [ 554.029566][ T12] bond3 (unregistering): Released all slaves [ 554.086893][ T12] bond4 (unregistering): (slave veth0_to_bond): Releasing active interface [ 554.097524][ T12] veth0_to_bond: left allmulticast mode [ 554.107128][ T12] bond4 (unregistering): Released all slaves [ 554.152390][ T12] bond5 (unregistering): Released all slaves [ 554.205055][ T12] bond6 (unregistering): Released all slaves [ 554.261215][ T12] bond0 (unregistering): (slave bond7): Releasing backup interface [ 554.276128][ T12] bond0 (unregistering): Released all slaves [ 554.325703][ T12] bond7 (unregistering): Released all slaves [ 555.482847][T18079] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 555.553837][T18079] gtp2: left allmulticast mode [ 555.593150][T18079] veth5: left allmulticast mode [ 555.610329][T18079] bridge2: left allmulticast mode [ 555.681257][T18079] bond8: left allmulticast mode [ 555.720435][T15710] xfrm0 speed is unknown, defaulting to 1000 [ 555.729788][T15710] syz0: Port: 1 Link DOWN [ 555.734574][T18099] __nla_validate_parse: 1 callbacks suppressed [ 555.734590][T18099] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3048'. [ 555.770909][ T5632] Bluetooth: hci1: command tx timeout [ 555.822252][ T5280] 8021q: adding VLAN 0 to HW filter on device eth1 [ 556.022794][ T5716] lo speed is unknown, defaulting to 1000 [ 556.034624][ T5716] syz2: Port: 1 Link DOWN [ 556.047143][T10701] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 556.078124][T10701] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.197788][T10701] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 556.231487][T10701] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.364842][T10701] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 556.374864][T10701] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.387784][T10701] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 556.400339][T10701] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.833241][ T12] : left promiscuous mode [ 556.986845][T18157] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3059'. [ 557.031117][T18158] xt_hashlimit: size too large, truncated to 1048576 [ 557.062303][ T12] tipc: Disabling bearer [ 557.114425][ T12] tipc: Disabling bearer [ 557.137723][ T12] tipc: Left network mode [ 557.138547][T18161] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3060'. [ 557.851506][ T5632] Bluetooth: hci1: command tx timeout [ 558.274224][T17962] bridge0: port 1(bridge_slave_0) entered blocking state [ 558.317519][T17962] bridge0: port 1(bridge_slave_0) entered disabled state [ 558.347875][T17962] bridge_slave_0: entered allmulticast mode [ 558.373019][T17962] bridge_slave_0: entered promiscuous mode [ 558.395470][T17962] bridge0: port 2(bridge_slave_1) entered blocking state [ 558.412100][T17962] bridge0: port 2(bridge_slave_1) entered disabled state [ 558.437808][T17962] bridge_slave_1: entered allmulticast mode [ 558.462463][T17962] bridge_slave_1: entered promiscuous mode [ 558.478271][ T5280] 8021q: adding VLAN 0 to HW filter on device eth2 [ 558.663355][T17962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 559.241098][T17962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 559.377299][T18240] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3078'. [ 559.408832][T18240] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3078'. [ 559.465861][T18243] openvswitch: netlink: Flow actions attr not present in new flow. [ 559.478417][T17962] team0: Port device team_slave_0 added [ 559.499420][T18246] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3080'. [ 559.504507][T17962] team0: Port device team_slave_1 added [ 559.609089][T18251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3080'. [ 559.781871][T18258] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3082'. [ 559.877260][T17962] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 559.916256][T17962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 559.948796][T18265] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3082'. [ 559.985951][T17962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 560.182043][T18254] syzkaller1: entered promiscuous mode [ 560.187626][T18254] syzkaller1: entered allmulticast mode [ 560.202863][T17962] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 560.220158][T17962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 560.279993][T17962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 560.799482][T17962] hsr_slave_0: entered promiscuous mode [ 560.823247][T17962] hsr_slave_1: entered promiscuous mode [ 560.839042][T17962] debugfs: 'hsr0' already exists in 'hsr' [ 560.855090][T17962] Cannot create hsr debugfs directory [ 560.906576][ T5280] 8021q: adding VLAN 0 to HW filter on device eth3 [ 561.052914][T18295] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3088'. [ 561.104925][ T12] hsr_slave_0: left promiscuous mode [ 561.121006][ T12] hsr_slave_1: left promiscuous mode [ 561.147301][ T12] veth1_macvtap: left promiscuous mode [ 561.159429][ T12] veth0_macvtap: left promiscuous mode [ 561.168288][ T12] veth1_vlan: left promiscuous mode [ 561.174580][ T12] veth0_vlan: left promiscuous mode [ 562.274471][T18310] gtp0: entered promiscuous mode [ 562.279457][T18310] gtp0: entered allmulticast mode [ 562.288973][T18310] team0: Device gtp0 is of different type [ 562.811699][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 563.197481][T18342] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3097'. [ 563.468617][T18352] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 563.503195][T18342] 8021q: adding VLAN 0 to HW filter on device bond0 [ 563.513161][T18342] 8021q: adding VLAN 0 to HW filter on device team0 [ 563.528752][T18342] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 563.634617][T18342] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 563.661072][T18342] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 563.691250][T18342] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 563.720044][T18342] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 563.755647][T18342] veth1_vlan: left promiscuous mode [ 563.772655][T18342] veth0_vlan: left promiscuous mode [ 563.784332][T18342] veth0_vlan: entered promiscuous mode [ 563.796157][T18342] veth1_vlan: entered promiscuous mode [ 563.816612][T18342] veth1_macvtap: left promiscuous mode [ 563.833537][T18342] veth0_macvtap: left promiscuous mode [ 563.845191][T18342] veth0_macvtap: entered promiscuous mode [ 563.863508][T18342] veth1_macvtap: entered promiscuous mode [ 563.878479][T18342] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 563.890613][T18342] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 563.899105][T18342] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 563.908145][T18342] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 563.932138][T18342] batman_adv: batadv0: Interface activated: gretap1 [ 563.941690][T18342] 8021q: adding VLAN 0 to HW filter on device bond1 [ 563.965989][T10694] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.973285][T10694] bridge0: port 1(bridge_slave_0) entered forwarding state [ 564.003274][T10694] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.010510][T10694] bridge0: port 2(bridge_slave_1) entered forwarding state [ 564.132579][T18359] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 564.132853][T10681] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.177934][T10681] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.195949][ T12] IPVS: stop unused estimator thread 0... [ 564.220100][T10681] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.240990][T10681] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.262866][T10681] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.280239][T10681] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.315457][T10681] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 564.361791][T10681] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.579724][T18401] tipc: Enabling of bearer rejected, failed to enable media [ 565.909482][T17962] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 565.962416][T17962] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 565.991600][T17962] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 566.027406][T17962] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 566.045809][T17962] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 566.068549][T17962] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 566.101475][T17962] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 566.116616][T17962] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 566.124625][T18433] netlink: 'syz.0.3113': attribute type 1 has an invalid length. [ 566.205285][T18433] 8021q: adding VLAN 0 to HW filter on device bond2 [ 566.545110][T17962] 8021q: adding VLAN 0 to HW filter on device bond0 [ 566.594993][T18457] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3115'. [ 566.638552][T17962] 8021q: adding VLAN 0 to HW filter on device team0 [ 566.672860][T18462] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3116'. [ 566.696945][ T8758] bridge0: port 1(bridge_slave_0) entered blocking state [ 566.704192][ T8758] bridge0: port 1(bridge_slave_0) entered forwarding state [ 566.763278][ T8758] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.770532][ T8758] bridge0: port 2(bridge_slave_1) entered forwarding state [ 567.172192][T18471] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3118'. [ 567.704637][T18499] nbd: couldn't find a device at index 3 [ 568.664620][T17962] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 568.786126][T18537] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3129'. [ 568.812404][T17962] veth0_vlan: entered promiscuous mode [ 568.848026][T17962] veth1_vlan: entered promiscuous mode [ 568.877823][T18536] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3129'. [ 569.124328][T18541] vlan0: entered promiscuous mode [ 569.152569][T18541] vlan0: entered allmulticast mode [ 569.175232][T18541] veth0_vlan: entered allmulticast mode [ 569.225632][T17962] veth0_macvtap: entered promiscuous mode [ 569.265625][T18548] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3131'. [ 569.332579][T17962] veth1_macvtap: entered promiscuous mode [ 569.434681][T17962] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 569.483694][T17962] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 569.554119][ T8758] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.585848][ T8758] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.625453][ T8758] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.673375][ T8758] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.701519][T18571] netlink: 232 bytes leftover after parsing attributes in process `syz.1.3138'. [ 569.716473][T18569] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3137'. [ 569.727161][T18573] netlink: 'syz.1.3138': attribute type 2 has an invalid length. [ 570.077841][T10702] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.119555][T10702] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.223264][T18598] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3142'. [ 570.267482][T10702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.294820][T10702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.493967][T18606] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3145'. [ 570.716606][T18616] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 570.778976][T18606] team0: entered promiscuous mode [ 570.809125][T18606] team_slave_0: entered promiscuous mode [ 570.828851][T18606] team_slave_1: entered promiscuous mode [ 570.844165][T18606] team0: entered allmulticast mode [ 570.852836][T18606] team_slave_0: entered allmulticast mode [ 570.861969][T18606] team_slave_1: entered allmulticast mode [ 570.876328][T18606] 8021q: adding VLAN 0 to HW filter on device team0 [ 570.889617][T18606] bond3: (slave team0): Enslaving as an active interface with an up link [ 571.204423][T18647] x_tables: duplicate underflow at hook 3 [ 571.212637][T18646] FAULT_INJECTION: forcing a failure. [ 571.212637][T18646] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.268274][T18646] CPU: 0 UID: 0 PID: 18646 Comm: syz.0.3149 Not tainted syzkaller #0 PREEMPT(full) [ 571.268303][T18646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 571.268317][T18646] Call Trace: [ 571.268325][T18646] [ 571.268333][T18646] dump_stack_lvl+0xe8/0x150 [ 571.268372][T18646] should_fail_ex+0x40c/0x560 [ 571.268402][T18646] _copy_from_user+0x2d/0xb0 [ 571.268436][T18646] do_sys_poll+0x258/0x1110 [ 571.268482][T18646] ? __lock_acquire+0x683/0x2cf0 [ 571.268512][T18646] ? __pfx_do_sys_poll+0x10/0x10 [ 571.268546][T18646] ? aa_file_perm+0x18b/0x15f0 [ 571.268682][T18646] ? set_user_sigmask+0xcd/0x1c0 [ 571.268708][T18646] ? __pfx_set_user_sigmask+0x10/0x10 [ 571.268735][T18646] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 571.268778][T18646] __se_sys_ppoll+0x209/0x2b0 [ 571.268804][T18646] ? fput+0xa0/0xd0 [ 571.268834][T18646] ? __pfx___se_sys_ppoll+0x10/0x10 [ 571.268861][T18646] ? __pfx_ksys_write+0x10/0x10 [ 571.268902][T18646] ? __x64_sys_ppoll+0x20/0xc0 [ 571.268927][T18646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.268952][T18646] do_syscall_64+0x174/0x580 [ 571.268982][T18646] ? trace_irq_disable+0x3b/0x140 [ 571.269009][T18646] ? clear_bhb_loop+0x40/0x90 [ 571.269037][T18646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.269060][T18646] RIP: 0033:0x7f20dfd9de59 [ 571.269080][T18646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.269100][T18646] RSP: 002b:00007f20e0d05028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 571.269131][T18646] RAX: ffffffffffffffda RBX: 00007f20e0025fa0 RCX: 00007f20dfd9de59 [ 571.269147][T18646] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000200000000280 [ 571.269160][T18646] RBP: 00007f20e0d05090 R08: 0000000000000000 R09: 0000000000000000 [ 571.269173][T18646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 571.269186][T18646] R13: 00007f20e0026038 R14: 00007f20e0025fa0 R15: 00007fffc13c3078 [ 571.269221][T18646] [ 572.019853][T18677] IPv6: addrconf: prefix option has invalid lifetime [ 572.601422][T18687] bridge_slave_0: left allmulticast mode [ 572.607175][T18687] bridge_slave_0: left promiscuous mode [ 572.614306][T18687] bridge0: port 1(bridge_slave_0) entered disabled state [ 572.627024][T18687] bridge_slave_1: left allmulticast mode [ 572.633369][T18687] bridge_slave_1: left promiscuous mode [ 572.639110][T18687] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.651421][T18687] bond0: (slave bond_slave_0): Releasing backup interface [ 572.665983][T18687] bond0: (slave bond_slave_1): Releasing backup interface [ 572.682010][T18687] team0: Port device team_slave_0 removed [ 572.693592][T18687] team0: Port device team_slave_1 removed [ 572.701522][T18687] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 572.708946][T18687] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 572.718047][T18687] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 572.726610][T18687] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 572.738947][T18687] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 572.843273][T18689] xt_hashlimit: max too large, truncated to 1048576 [ 573.831747][T18631] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 574.259794][T18706] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 574.307737][T18705] __nla_validate_parse: 1 callbacks suppressed [ 574.307756][T18705] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3161'. [ 574.370335][T18705] openvswitch: netlink: Missing key (keys=40, expected=80) [ 574.392745][T18706] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3162'. [ 574.439335][T18706] bond3: (slave team0): Releasing backup interface [ 574.458728][T18706] team_slave_0: left promiscuous mode [ 574.468579][T18706] team_slave_0: left allmulticast mode [ 574.489386][T18706] team0 (unregistering): Port device team_slave_0 removed [ 574.512857][T18713] netlink: 'syz.4.3164': attribute type 1 has an invalid length. [ 574.526605][T18713] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3164'. [ 574.535095][T18706] team_slave_1: left promiscuous mode [ 574.547415][T18713] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3164'. [ 574.564192][T18706] team_slave_1: left allmulticast mode [ 574.637919][T18706] team0 (unregistering): Port device team_slave_1 removed [ 574.669536][T18713] 8021q: VLANs not supported on sit0 [ 574.696620][T18718] .`: (slave netdevsim1): Releasing backup interface [ 574.708523][T18712] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3164'. [ 574.752343][T18718] bond10: (slave bridge3): Releasing active interface [ 574.760191][T18713] x_tables: duplicate underflow at hook 1 [ 575.003035][T18730] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3168'. [ 575.080543][T18727] xt_hashlimit: max too large, truncated to 1048576 [ 575.760580][T18762] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3172'. [ 576.034385][T18773] bond3: option primary_reselect: invalid value (6) [ 576.051393][T18773] bond3 (unregistering): Released all slaves [ 576.147247][T18775] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3175'. [ 576.167317][T18775] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3175'. [ 576.181898][T18775] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3175'. [ 576.324048][T18786] Bluetooth: MGMT ver 1.23 [ 576.443701][T18793] netlink: 'syz.2.3180': attribute type 14 has an invalid length. [ 614.008501][T18826] __nla_validate_parse: 2 callbacks suppressed [ 614.008521][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 614.038436][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 614.080842][T18833] bridge_slave_1: left allmulticast mode [ 614.119015][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 614.136758][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 614.144165][T18833] bridge_slave_1: left promiscuous mode [ 614.198838][T18833] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.257320][T18833] bridge_slave_0: left allmulticast mode [ 614.286767][T18833] bridge_slave_0: left promiscuous mode [ 614.308702][T18833] bridge0: port 1(bridge_slave_0) entered disabled state [ 614.426130][T18842] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3191'. [ 614.451615][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 614.472725][T18842] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3191'. [ 614.489170][T18826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3190'. [ 614.516245][T18842] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3191'. [ 614.537832][T18842] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3191'. [ 615.297486][T18874] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 615.465884][T10701] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.485287][T10701] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.505553][T10701] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.524757][T10701] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.905718][T18910] syzkaller0: entered promiscuous mode [ 615.912226][T18910] syzkaller0: entered allmulticast mode [ 615.923106][T18910] syzkaller1: entered promiscuous mode [ 615.928752][T18910] syzkaller1: entered allmulticast mode [ 617.082860][T18943] raw_sendmsg: syz.1.3217 forgot to set AF_INET. Fix it! [ 617.288589][T18947] netlink: 'syz.4.3218': attribute type 5 has an invalid length. [ 617.455324][T18960] netlink: 'syz.4.3218': attribute type 1 has an invalid length. [ 618.525946][T18985] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 618.536812][T18985] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 620.082840][T18950] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 620.323421][T19011] netlink: 'syz.3.3235': attribute type 1 has an invalid length. [ 620.431863][T19011] 8021q: adding VLAN 0 to HW filter on device bond3 [ 620.443168][T19012] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 620.461959][T19018] macvlan2: entered promiscuous mode [ 620.467558][T19018] macvlan2: entered allmulticast mode [ 620.474011][T19018] bond3: entered promiscuous mode [ 620.477393][T19010] __nla_validate_parse: 82 callbacks suppressed [ 620.477451][T19010] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3234'. [ 620.479677][T19018] veth0_to_bond: entered promiscuous mode [ 620.502999][T19018] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 620.512354][T19018] bond3: left promiscuous mode [ 620.513434][T19010] netlink: 'syz.2.3234': attribute type 2 has an invalid length. [ 620.524223][T19018] veth0_to_bond: left promiscuous mode [ 620.533031][T19010] openvswitch: netlink: IPv4 tun info is not correct [ 620.625046][T19011] macvlan2: entered promiscuous mode [ 620.658649][T19011] macvlan2: entered allmulticast mode [ 620.687577][T19011] bond3: entered promiscuous mode [ 620.705053][T19011] veth0_to_bond: entered promiscuous mode [ 620.721643][T19011] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 620.742292][T19011] bond3: left promiscuous mode [ 620.757651][T19011] veth0_to_bond: left promiscuous mode [ 620.881294][T19011] macvlan2: entered promiscuous mode [ 620.887991][T19011] macvlan2: entered allmulticast mode [ 620.895918][T19011] bond3: entered promiscuous mode [ 620.902853][T19011] veth0_to_bond: entered promiscuous mode [ 620.909804][T19011] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 620.918581][T19011] bond3: left promiscuous mode [ 620.924003][T19011] veth0_to_bond: left promiscuous mode [ 620.959831][T19037] bond4: option packets_per_slave: invalid value (1048582) [ 620.975723][T19037] bond4: option packets_per_slave: allowed values 0 - 65535 [ 620.987653][T19037] bond4 (unregistering): Released all slaves [ 621.023485][T19011] macvlan2: entered promiscuous mode [ 621.028928][T19011] macvlan2: entered allmulticast mode [ 621.043504][T19011] bond3: entered promiscuous mode [ 621.051328][T19011] veth0_to_bond: entered promiscuous mode [ 621.058388][T19011] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 621.087858][T19011] bond3: left promiscuous mode [ 621.103361][T19011] veth0_to_bond: left promiscuous mode [ 621.218298][ T5632] Bluetooth: hci5: command 0x0406 tx timeout [ 621.307231][T19038] tipc: Started in network mode [ 621.324493][T19038] tipc: Node identity 06000000000000005114, cluster identity 4711 [ 621.585746][T19068] netlink: 'syz.3.3247': attribute type 1 has an invalid length. [ 623.697901][T19068] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 623.727063][T19077] vlan2: entered allmulticast mode [ 623.759994][T19077] veth0_to_bond: entered allmulticast mode [ 623.783362][T19081] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 623.828464][T19083] ip6erspan0: entered allmulticast mode [ 624.026616][T19108] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 624.045172][T19106] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.3258'. [ 624.062785][T19104] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3256'. [ 624.090675][T19104] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3256'. [ 624.321334][T19123] tipc: Enabling of bearer rejected, failed to enable media [ 624.462908][T19130] syzkaller1: entered promiscuous mode [ 624.475154][T19130] syzkaller1: entered allmulticast mode [ 624.505828][T19130] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 624.712966][T19139] lo speed is unknown, defaulting to 1000 [ 624.884320][T19149] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3270'. [ 624.942446][T19149] IPVS: length: 24 != 49176 [ 624.953679][T19149] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3270'. [ 624.987215][T19149] netlink: 'syz.4.3270': attribute type 11 has an invalid length. [ 625.805436][T19183] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3280'. [ 625.867703][T19183] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3280'. [ 625.938033][T19192] netlink: 144 bytes leftover after parsing attributes in process `syz.4.3281'. [ 626.888823][T19231] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3292'. [ 626.942267][T19225] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3291'. [ 626.959241][T19231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3292'. [ 626.986683][T19231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3292'. [ 627.414376][T19248] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3298'. [ 627.603214][T19257] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3301'. [ 628.299151][T19293] netlink: 'syz.3.3309': attribute type 30 has an invalid length. [ 628.365470][T19293] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3309'. [ 629.369183][T19352] netlink: 'syz.3.3322': attribute type 29 has an invalid length. [ 629.894369][ T9] IPVS: starting estimator thread 0... [ 629.902266][T19386] IPVS: ip_vs_edit_dest(): server weight less than zero [ 629.932836][T19386] netlink: 'syz.4.3331': attribute type 15 has an invalid length. [ 630.011262][T19387] IPVS: using max 26 ests per chain, 62400 per kthread [ 630.315510][T19405] x_tables: ip_tables: TCPMSS target: only valid for protocol 6 [ 630.374220][T19406] x_tables: unsorted entry at hook 2 [ 630.428572][T19400] xt_hashlimit: size too large, truncated to 1048576 [ 630.994345][T19423] 8021q: adding VLAN 0 to HW filter on device bond11 [ 631.687536][T19452] __nla_validate_parse: 11 callbacks suppressed [ 631.687557][T19452] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3350'. [ 631.754713][T19461] netlink: 'syz.4.3350': attribute type 4 has an invalid length. [ 631.783198][T19464] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3352'. [ 631.795021][T19461] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3350'. [ 631.939210][T19452] lo speed is unknown, defaulting to 1000 [ 632.137032][T19476] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3357'. [ 633.090885][T19514] lo speed is unknown, defaulting to 1000 [ 633.142555][T19517] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3370'. [ 633.167413][T19517] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3370'. [ 633.305023][T19523] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3370'. [ 633.387197][ T30] audit: type=1804 audit(1783724387.591:12): pid=19525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.3372" name="/newroot/141/cgroup.controllers" dev="tmpfs" ino=746 res=1 errno=0 [ 633.461470][ T30] audit: type=1800 audit(1783724387.591:13): pid=19525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3372" name="cgroup.controllers" dev="tmpfs" ino=746 res=0 errno=0 [ 633.557783][T19525] netlink: 'syz.0.3372': attribute type 15 has an invalid length. [ 634.062195][T19514] netlink: 'syz.1.3369': attribute type 25 has an invalid length. [ 634.278677][T19550] netlink: 5952 bytes leftover after parsing attributes in process `syz.4.3377'. [ 634.351778][T19550] netlink: 5952 bytes leftover after parsing attributes in process `syz.4.3377'. [ 634.548694][T19560] netlink: 'syz.2.3378': attribute type 12 has an invalid length. [ 634.665886][T19569] netlink: 'syz.3.3382': attribute type 3 has an invalid length. [ 634.674532][T19556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3378'. [ 635.257521][T19595] netlink: 'syz.4.3390': attribute type 8 has an invalid length. [ 635.478885][T19602] netlink: 'syz.3.3391': attribute type 6 has an invalid length. [ 635.990776][T19620] bond4: option miimon: invalid value (18446744073709551615) [ 635.998250][T19620] bond4: option miimon: allowed values 0 - 2147483647 [ 636.006916][T19620] bond4 (unregistering): Released all slaves [ 638.092742][T19585] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 638.365156][T19639] __nla_validate_parse: 5 callbacks suppressed [ 638.365177][T19639] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3401'. [ 638.366074][T19640] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3402'. [ 638.505932][T19646] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3403'. [ 638.537564][T19646] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3403'. [ 638.587179][T19646] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3403'. [ 638.829629][T19663] openvswitch: netlink: IP tunnel dst address not specified [ 638.925371][T19674] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3409'. [ 639.030438][T19674] netlink: 'syz.3.3409': attribute type 1 has an invalid length. [ 639.164211][T19682] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3411'. [ 639.275485][T19667] netlink: 'syz.3.3409': attribute type 3 has an invalid length. [ 639.326661][T19667] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3409'. [ 639.562407][T19696] syzkaller0: entered promiscuous mode [ 639.587596][T19696] syzkaller0: entered allmulticast mode [ 639.655973][T19701] mac80211_hwsim hwsim31 syzkaller0: entered promiscuous mode [ 639.658717][T19696] netlink: 26 bytes leftover after parsing attributes in process `syz.4.3416'. [ 639.716764][T19701] mac80211_hwsim hwsim31 syzkaller0: entered allmulticast mode [ 640.177609][T19721] netlink: 'syz.2.3424': attribute type 3 has an invalid length. [ 640.275342][T19724] netlink: 'syz.4.3426': attribute type 5 has an invalid length. [ 640.529666][T19728] bond12: option miimon: invalid value (18446744073709551615) [ 640.558843][T19728] bond12: option miimon: allowed values 0 - 2147483647 [ 640.593336][T19728] bond12 (unregistering): Released all slaves [ 640.696786][T19744] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 641.008174][T19752] netlink: 'syz.2.3433': attribute type 1 has an invalid length. [ 641.198248][T19770] IPVS: length: 15 != 8 [ 641.237078][T19766] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3438'. [ 641.360882][T19761] vlan2: entered allmulticast mode [ 641.366202][T19761] bond1: entered allmulticast mode [ 641.410941][T19773] tun0: tun_chr_ioctl cmd 1074025681 [ 641.673885][T19778] syzkaller0: entered promiscuous mode [ 641.674814][T19787] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 0, id = 0 [ 641.710804][T19778] syzkaller0: entered allmulticast mode [ 641.881713][T19796] FAULT_INJECTION: forcing a failure. [ 641.881713][T19796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 641.937165][T19796] CPU: 0 UID: 0 PID: 19796 Comm: syz.1.3443 Not tainted syzkaller #0 PREEMPT(full) [ 641.937194][T19796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 641.937208][T19796] Call Trace: [ 641.937216][T19796] [ 641.937224][T19796] dump_stack_lvl+0xe8/0x150 [ 641.937261][T19796] should_fail_ex+0x40c/0x560 [ 641.937291][T19796] _copy_from_user+0x2d/0xb0 [ 641.937321][T19796] ___sys_sendmsg+0x1c6/0x360 [ 641.937352][T19796] ? __lock_acquire+0x683/0x2cf0 [ 641.937386][T19796] ? __pfx____sys_sendmsg+0x10/0x10 [ 641.937473][T19796] ? __fget_files+0x2a/0x420 [ 641.937498][T19796] ? __fget_files+0x3a2/0x420 [ 641.937534][T19796] __x64_sys_sendmsg+0x1b1/0x290 [ 641.937586][T19796] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 641.937637][T19796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.937660][T19796] do_syscall_64+0x174/0x580 [ 641.937689][T19796] ? trace_irq_disable+0x3b/0x140 [ 641.937725][T19796] ? clear_bhb_loop+0x40/0x90 [ 641.937749][T19796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.937769][T19796] RIP: 0033:0x7fe69b99de59 [ 641.937806][T19796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 641.937825][T19796] RSP: 002b:00007fe69c8e7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 641.937847][T19796] RAX: ffffffffffffffda RBX: 00007fe69bc25fa0 RCX: 00007fe69b99de59 [ 641.937862][T19796] RDX: 0000000004080040 RSI: 00002000000006c0 RDI: 0000000000000003 [ 641.937876][T19796] RBP: 00007fe69c8e7090 R08: 0000000000000000 R09: 0000000000000000 [ 641.937889][T19796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 641.937901][T19796] R13: 00007fe69bc26038 R14: 00007fe69bc25fa0 R15: 00007ffe827824b8 [ 641.937934][T19796] [ 642.354600][T19800] bond4: option miimon: invalid value (18446744073709551615) [ 642.375338][T19800] bond4: option miimon: allowed values 0 - 2147483647 [ 642.392390][T19800] bond4 (unregistering): Released all slaves [ 642.468777][T19814] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 642.501510][T19813] syzkaller1: entered promiscuous mode [ 642.513605][T19813] syzkaller1: entered allmulticast mode [ 643.077469][T19829] batman_adv: batadv0: Adding interface: vlan3 [ 643.106903][T19829] batman_adv: batadv0: The MTU of interface vlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 643.200493][T19829] batman_adv: batadv0: Not using interface vlan3 (retrying later): interface not active [ 643.431315][T19843] __nla_validate_parse: 8 callbacks suppressed [ 643.431338][T19843] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3457'. [ 643.477760][T19843] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 644.238020][T19861] netlink: 'syz.3.3462': attribute type 1 has an invalid length. [ 644.276656][T19861] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.3462'. [ 644.329052][T19859] lo speed is unknown, defaulting to 1000 [ 644.403743][T17606] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 644.418693][T17606] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 644.427417][T17606] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 644.437707][T17606] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 644.448499][T17606] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 644.650045][T17606] Bluetooth: hci1: command 0x0405 tx timeout [ 644.988854][T19889] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 645.708631][T10681] batman_adv: batadv0: Interface deactivated: vlan2 [ 645.718842][T10681] batman_adv: batadv0: Removing interface: vlan2 [ 645.767476][T10681] bond2 (unregistering): (slave bridge3): Releasing backup interface [ 645.778839][T10681] bridge3 (unregistering): left promiscuous mode [ 645.785431][T10681] bridge3 (unregistering): left allmulticast mode [ 645.815028][T10681] bond0 (unregistering): Released all slaves [ 645.832103][T10681] bond1 (unregistering): Released all slaves [ 645.852234][T10681] bond2 (unregistering): Released all slaves [ 645.879531][T10681] bond3 (unregistering): Released all slaves [ 645.903807][T10681] bond4 (unregistering): (slave bond5): Releasing backup interface [ 645.914432][T10681] bond4 (unregistering): Released all slaves [ 645.934565][T10681] bond5 (unregistering): Released all slaves [ 645.951482][T10681] bond6 (unregistering): Released all slaves [ 646.003812][T19896] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 646.015412][T19900] tipc: Enabled bearer , priority 0 [ 646.103178][T19897] syzkaller0: entered promiscuous mode [ 646.135717][T19897] syzkaller0: entered allmulticast mode [ 646.171688][T19901] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 646.179546][T19901] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 646.300759][T10681] tipc: Disabling bearer [ 646.315447][T10681] tipc: Left network mode [ 646.394248][T19901] tipc: Resetting bearer [ 646.479066][T19921] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 646.489191][T10681] IPVS: stopping backup sync thread 9885 ... [ 646.507439][T19901] tipc: Disabling bearer [ 646.512761][T17606] Bluetooth: hci4: command tx timeout [ 646.531584][T19911] lo speed is unknown, defaulting to 1000 [ 646.845603][T19931] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 646.878203][T19936] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3472'. [ 647.181075][T19864] lo speed is unknown, defaulting to 1000 [ 647.354959][T10681] hsr_slave_0: left promiscuous mode [ 647.384368][T10681] hsr_slave_1: left promiscuous mode [ 647.420669][T10681] batman_adv: batadv0: Interface deactivated: macsec1 [ 647.435273][T10681] batman_adv: batadv0: Removing interface: macsec1 [ 647.618285][T10681] veth1_macvtap: left promiscuous mode [ 647.635217][T10681] veth0_macvtap: left promiscuous mode [ 647.648269][T10681] veth1_vlan: left promiscuous mode [ 647.656097][T10681] veth0_vlan: left promiscuous mode [ 647.702022][T19961] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 647.808889][T19961] netlink: 'syz.2.3479': attribute type 2 has an invalid length. [ 648.078698][T19970] netlink: 'syz.2.3481': attribute type 2 has an invalid length. [ 648.088232][T19970] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3481'. [ 648.570115][T17606] Bluetooth: hci4: command tx timeout [ 648.641580][T19975] bond3: option miimon: invalid value (18446744073709551615) [ 648.649217][T19975] bond3: option miimon: allowed values 0 - 2147483647 [ 648.662394][T19975] bond3 (unregistering): Released all slaves [ 648.775796][T19977] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3483'. [ 648.785219][T19977] tipc: Enabling of bearer rejected, failed to enable media [ 649.046699][T20001] lo speed is unknown, defaulting to 1000 [ 649.388368][T20003] netlink: 280 bytes leftover after parsing attributes in process `syz.4.3487'. [ 649.524421][T19864] bridge0: port 1(bridge_slave_0) entered blocking state [ 649.548184][T19864] bridge0: port 1(bridge_slave_0) entered disabled state [ 649.560083][T19864] bridge_slave_0: entered allmulticast mode [ 649.568453][T19864] bridge_slave_0: entered promiscuous mode [ 649.580837][T19864] bridge0: port 2(bridge_slave_1) entered blocking state [ 649.588144][T19864] bridge0: port 2(bridge_slave_1) entered disabled state [ 649.595845][T19864] bridge_slave_1: entered allmulticast mode [ 649.604063][T19864] bridge_slave_1: entered promiscuous mode [ 649.773677][T19864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 649.803220][T19864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 649.958973][T19864] team0: Port device team_slave_0 added [ 649.997080][T19864] team0: Port device team_slave_1 added [ 650.019508][T10681] IPVS: stop unused estimator thread 0... [ 650.063682][ T30] audit: type=1804 audit(1783724404.271:14): pid=20027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.3492" name="/newroot/121/cgroup.controllers" dev="tmpfs" ino=641 res=1 errno=0 [ 650.122968][ T30] audit: type=1800 audit(1783724404.271:15): pid=20027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3492" name="cgroup.controllers" dev="tmpfs" ino=641 res=0 errno=0 [ 650.149812][T20025] syzkaller0: entered promiscuous mode [ 650.155768][T20025] syzkaller0: entered allmulticast mode [ 650.167359][T19864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 650.183447][T19864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 650.219345][T19864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 650.238677][T19864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 650.246122][T19864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 650.279317][T19864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 650.356282][T20032] x_tables: duplicate underflow at hook 2 [ 650.651833][T17606] Bluetooth: hci4: command tx timeout [ 650.784144][T20042] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3496'. [ 650.847082][T19864] hsr_slave_0: entered promiscuous mode [ 650.858110][T19864] hsr_slave_1: entered promiscuous mode [ 650.874232][T19864] debugfs: 'hsr0' already exists in 'hsr' [ 650.893284][T19864] Cannot create hsr debugfs directory [ 650.914657][T20047] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3496'. [ 651.002267][T20041] lo speed is unknown, defaulting to 1000 [ 651.195881][T20054] ip6erspan1: entered allmulticast mode [ 651.625988][T20074] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3500'. [ 651.810096][T20063] lo speed is unknown, defaulting to 1000 [ 652.269099][T20096] netlink: 'syz.3.3505': attribute type 21 has an invalid length. [ 652.299372][T20095] netlink: 'syz.3.3505': attribute type 21 has an invalid length. [ 652.307598][T20095] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3505'. [ 652.316954][T20096] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3505'. [ 652.344343][T20098] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3506'. [ 652.455409][T20095] netlink: 'syz.3.3505': attribute type 4 has an invalid length. [ 652.466138][T20095] netlink: 'syz.3.3505': attribute type 5 has an invalid length. [ 652.477285][T20095] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3505'. [ 652.488934][T20096] netlink: 'syz.3.3505': attribute type 4 has an invalid length. [ 652.498496][T20096] netlink: 'syz.3.3505': attribute type 5 has an invalid length. [ 652.509944][T20096] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3505'. [ 652.730190][T17606] Bluetooth: hci4: command tx timeout [ 652.755676][T20105] 8021q: adding VLAN 0 to HW filter on device bond3 [ 652.784302][T20105] batman_adv: batadv0: Interface activated: vlan3 [ 653.056344][T20119] syzkaller0: entered promiscuous mode [ 653.075427][T20119] syzkaller0: entered allmulticast mode [ 653.525972][T20136] mac80211_hwsim hwsim31 syzkaller0: left promiscuous mode [ 653.534308][T20136] mac80211_hwsim hwsim31 syzkaller0: left allmulticast mode [ 653.548819][T19864] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 653.562248][T19864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 653.572738][T19864] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 653.594303][T19864] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 653.651959][T20141] bond4: option miimon: invalid value (18446744073709551615) [ 653.661242][T20141] bond4: option miimon: allowed values 0 - 2147483647 [ 653.670612][T20141] bond4 (unregistering): Released all slaves [ 653.704995][T19864] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 653.716309][T19864] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 653.724818][T19864] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 653.754058][T19864] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 653.999025][T19864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 654.019166][T20158] __nla_validate_parse: 1 callbacks suppressed [ 654.019187][T20158] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3521'. [ 654.077764][T19864] 8021q: adding VLAN 0 to HW filter on device team0 [ 654.111777][T10701] bridge0: port 1(bridge_slave_0) entered blocking state [ 654.119024][T10701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 654.146476][T20160] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3522'. [ 654.153791][T10701] bridge0: port 2(bridge_slave_1) entered blocking state [ 654.162612][T10701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 654.408639][T20167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3524'. [ 654.527018][T20170] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 654.791666][T20181] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3528'. [ 655.023986][T20191] vlan2: entered allmulticast mode [ 655.029332][T20191] bond0: entered allmulticast mode [ 655.328717][T20199] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3532'. [ 655.422372][T20202] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3533'. [ 655.526335][T19864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 655.619256][T19864] veth0_vlan: entered promiscuous mode [ 655.638895][T19864] veth1_vlan: entered promiscuous mode [ 655.686018][T19864] veth0_macvtap: entered promiscuous mode [ 655.698479][T19864] veth1_macvtap: entered promiscuous mode [ 655.724241][T19864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 655.763455][T19864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 655.814291][T10701] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.843497][T10701] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.927832][T10701] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 655.952201][T10701] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 656.133222][T20220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3537'. [ 658.523943][T10697] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.556261][T10697] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.624181][T20238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3540'. [ 658.649849][T10698] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.665338][T10698] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.963240][T20250] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3546'. [ 659.151462][T20258] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3547'. [ 659.237285][ T24] IPVS: starting estimator thread 0... [ 659.330018][T20267] IPVS: using max 27 ests per chain, 64800 per kthread [ 659.481919][T20286] netlink: 'syz.3.3552': attribute type 4 has an invalid length. [ 659.501897][T20288] netlink: 'syz.3.3552': attribute type 4 has an invalid length. [ 659.559126][T20286] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3552'. [ 659.729610][T20296] netlink: 'syz.2.3554': attribute type 1 has an invalid length. [ 659.738963][T20296] netlink: 'syz.2.3554': attribute type 4 has an invalid length. [ 659.747231][T20296] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.3554'. [ 659.757676][T20296] netlink: 'syz.2.3554': attribute type 1 has an invalid length. [ 659.765742][T20296] netlink: 'syz.2.3554': attribute type 4 has an invalid length. [ 659.778717][T20296] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.3554'. [ 660.064128][T20275] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 660.812591][T20339] bond1 (unregistering): Released all slaves [ 661.074326][T20346] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3570'. [ 661.206320][T20333] bond0: (slave wlan0): Enslaving as an active interface with an up link [ 661.397874][T20355] mac80211_hwsim hwsim28 syzkaller0: entered promiscuous mode [ 661.415459][T20355] mac80211_hwsim hwsim28 syzkaller0: entered allmulticast mode [ 661.484134][T20355] tipc: Started in network mode [ 661.503917][T20355] tipc: Node identity 080211, cluster identity 4711 [ 661.512373][T20355] tipc: Enabled bearer , priority 0 [ 661.539572][T20355] tipc: Resetting bearer [ 661.818168][T20365] bond4: down delay (3) is not a multiple of miimon (100), value rounded to 0 ms [ 661.862717][T20365] bond4: peer notification delay (6) is not a multiple of miimon (100), value rounded to 0 ms [ 661.888811][T20365] bond4: entered allmulticast mode [ 661.896683][T20365] 8021q: adding VLAN 0 to HW filter on device bond4 [ 661.924664][T20369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3575'. [ 661.968280][T20375] faux_driver regulatory: loading /lib/firmware/regulatory.db.p7s failed with error -4 [ 661.999005][T20375] faux_driver regulatory: Direct firmware load for regulatory.db.p7s failed with error -4 [ 662.031494][T20375] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db.p7s [ 662.172514][T17606] Bluetooth: hci3: command 0x0406 tx timeout [ 662.444842][T20407] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3582'. [ 662.530014][ T9] tipc: Node number set to 134353152 [ 662.663589][T20414] bond4: option ad_select: invalid value (34) [ 662.675412][T20414] bond4 (unregistering): Released all slaves [ 663.009401][T20425] netlink: 'syz.3.3587': attribute type 2 has an invalid length. [ 663.146969][T20428] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3588'. [ 663.164047][T20428] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3588'. [ 663.456780][T20446] netlink: 'syz.1.3592': attribute type 9 has an invalid length. [ 663.482750][T20444] syzkaller0: entered promiscuous mode [ 663.494741][T20444] syzkaller0: entered allmulticast mode [ 663.508279][T20444] netlink: 'syz.0.3591': attribute type 13 has an invalid length. [ 663.518696][T20444] netlink: 'syz.0.3591': attribute type 17 has an invalid length. [ 663.625658][T20444] veth0_to_bridge: left promiscuous mode [ 663.723006][T20444] vlan0: left promiscuous mode [ 663.728160][T20444] vlan0: left allmulticast mode [ 663.734797][T20444] veth0_vlan: left allmulticast mode [ 663.822423][T20444] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 663.840481][T20444] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 663.892223][T20466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3596'. [ 663.972418][T20444] ip6erspan0: left allmulticast mode [ 663.995014][T20444] bond4: left allmulticast mode [ 664.004264][T20444] syzkaller0: left promiscuous mode [ 664.009560][T20444] syzkaller0: left allmulticast mode [ 664.432183][T20487] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3600'. [ 664.681731][T20500] bond0: Error: CAN devices cannot be enslaved [ 664.716487][T20494] syzkaller0: entered promiscuous mode [ 664.748863][T20494] syzkaller0: entered allmulticast mode [ 664.796702][T10701] nci: nci_rx_work: unknown MT 0x6 [ 664.943662][T20518] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3603'. [ 664.996200][T20522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3607'. [ 665.351994][T20534] bridge5: the hash_elasticity option has been deprecated and is always 16 [ 665.381260][T20534] bridge5: entered allmulticast mode [ 665.480658][T20542] bridge0: port 1(veth0_virt_wifi) entered blocking state [ 665.496231][T20542] bridge0: port 1(veth0_virt_wifi) entered disabled state [ 665.506166][T20542] veth0_virt_wifi: entered allmulticast mode [ 665.520745][T20542] veth0_virt_wifi: entered promiscuous mode [ 665.530388][T20545] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3611'. [ 665.541447][T20545] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3611'. [ 666.946135][T20566] xt_TCPMSS: Only works on TCP SYN packets [ 667.643161][T20498] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 667.914496][T20581] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3620'. [ 667.984495][T20584] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3621'. [ 668.063819][T20589] netlink: 280 bytes leftover after parsing attributes in process `syz.0.3622'. [ 668.435412][T20603] tipc: Enabled bearer , priority 0 [ 668.453459][T20600] syzkaller0: entered promiscuous mode [ 668.466067][T20600] syzkaller0: entered allmulticast mode [ 668.514465][T20607] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3627'. [ 668.535153][T20603] tipc: Resetting bearer [ 668.572081][T20607] 8021q: adding VLAN 0 to HW filter on device bond2 [ 668.655167][T20607] macvlan2: entered promiscuous mode [ 668.667517][T20614] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input8 [ 668.684916][T20616] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3629'. [ 668.704595][T20607] macvlan2: entered allmulticast mode [ 668.728416][T20607] bond2: entered promiscuous mode [ 668.759137][T20607] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 668.809702][T20607] bond2: left promiscuous mode [ 668.857346][T20599] tipc: Resetting bearer [ 668.911887][T20599] tipc: Disabling bearer [ 669.036650][T20625] syzkaller0: entered promiscuous mode [ 669.076946][T20625] syzkaller0: entered allmulticast mode [ 669.235341][T20643] validate_nla: 1 callbacks suppressed [ 669.235360][T20643] netlink: 'syz.0.3634': attribute type 1 has an invalid length. [ 669.385826][T20643] 8021q: adding VLAN 0 to HW filter on device bond5 [ 669.443339][T20648] bond3: option lacp_rate: invalid value (3) [ 669.452336][T20648] bond3 (unregistering): Released all slaves [ 669.500066][T20642] bond5: option tlb_dynamic_lb: unable to set because the bond device is up [ 669.754068][T20662] syzkaller1: entered promiscuous mode [ 669.762592][T20663] __nla_validate_parse: 1 callbacks suppressed [ 669.762608][T20663] netlink: 292 bytes leftover after parsing attributes in process `syz.2.3639'. [ 669.769961][T20662] syzkaller1: entered allmulticast mode [ 669.788098][T20664] netlink: 292 bytes leftover after parsing attributes in process `syz.2.3639'. [ 669.841030][T20667] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3640'. [ 669.859224][T20667] C: renamed from veth1_to_team (while UP) [ 669.872268][T20667] netlink: 'syz.0.3640': attribute type 1 has an invalid length. [ 669.881368][T20667] netlink: 116 bytes leftover after parsing attributes in process `syz.0.3640'. [ 669.891094][T20667] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 669.990553][T20670] netlink: 'syz.1.3642': attribute type 4 has an invalid length. [ 670.018481][T20670] netlink: 'syz.1.3642': attribute type 4 has an invalid length. [ 670.039650][T20672] FAULT_INJECTION: forcing a failure. [ 670.039650][T20672] name failslab, interval 1, probability 0, space 0, times 0 [ 670.074171][T20672] CPU: 0 UID: 0 PID: 20672 Comm: syz.3.3641 Not tainted syzkaller #0 PREEMPT(full) [ 670.074201][T20672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 670.074215][T20672] Call Trace: [ 670.074223][T20672] [ 670.074232][T20672] dump_stack_lvl+0xe8/0x150 [ 670.074271][T20672] should_fail_ex+0x40c/0x560 [ 670.074311][T20672] should_failslab+0xa8/0x100 [ 670.074345][T20672] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 670.074373][T20672] ? ep_ptable_queue_proc+0x5c/0x200 [ 670.074394][T20672] ? ep_ptable_queue_proc+0x5c/0x200 [ 670.074425][T20672] ep_ptable_queue_proc+0x5c/0x200 [ 670.074448][T20672] ? __pfx_ep_ptable_queue_proc+0x10/0x10 [ 670.074472][T20672] unix_dgram_poll+0x80/0x680 [ 670.074500][T20672] sock_poll+0x338/0x3f0 [ 670.074530][T20672] ? __pfx_sock_poll+0x10/0x10 [ 670.074552][T20672] ep_insert+0x11b4/0x1ac0 [ 670.074602][T20672] ? __pfx_ep_insert+0x10/0x10 [ 670.074634][T20672] ? __pfx___mutex_lock+0x10/0x10 [ 670.074672][T20672] ? __pfx_ep_ptable_queue_proc+0x10/0x10 [ 670.074709][T20672] do_epoll_ctl_file+0x8c2/0xee0 [ 670.074751][T20672] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 670.074786][T20672] ? __fget_files+0x3a2/0x420 [ 670.074817][T20672] ? __fget_files+0x2a/0x420 [ 670.074855][T20672] __se_sys_epoll_ctl+0x162/0x230 [ 670.074890][T20672] ? __pfx___se_sys_epoll_ctl+0x10/0x10 [ 670.074934][T20672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.074959][T20672] do_syscall_64+0x174/0x580 [ 670.074990][T20672] ? trace_irq_disable+0x3b/0x140 [ 670.075017][T20672] ? clear_bhb_loop+0x40/0x90 [ 670.075045][T20672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.075067][T20672] RIP: 0033:0x7f656199de59 [ 670.075086][T20672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 670.075106][T20672] RSP: 002b:00007f65627b3028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 670.075128][T20672] RAX: ffffffffffffffda RBX: 00007f6561c25fa0 RCX: 00007f656199de59 [ 670.075145][T20672] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 [ 670.075158][T20672] RBP: 00007f65627b3090 R08: 0000000000000000 R09: 0000000000000000 [ 670.075171][T20672] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 670.075185][T20672] R13: 00007f6561c26038 R14: 00007f6561c25fa0 R15: 00007ffedc814528 [ 670.075221][T20672] [ 670.377201][T20676] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3644'. [ 670.567330][T20687] syzkaller0: entered promiscuous mode [ 670.581015][T20687] syzkaller0: entered allmulticast mode [ 670.603992][T20688] tipc: Started in network mode [ 670.608965][T20688] tipc: Node identity aa9c8b14ade6, cluster identity 4711 [ 670.616973][T20688] tipc: Enabled bearer , priority 0 [ 670.652480][T20692] netlink: 'syz.2.3648': attribute type 9 has an invalid length. [ 670.673126][T20688] tipc: Resetting bearer [ 670.702766][T20688] tipc: Disabling bearer [ 670.717223][T20697] netlink: 'syz.4.3649': attribute type 1 has an invalid length. [ 670.846071][T20697] bond3: entered promiscuous mode [ 670.856183][T20697] 8021q: adding VLAN 0 to HW filter on device bond3 [ 670.863898][T20700] netlink: 'syz.0.3650': attribute type 4 has an invalid length. [ 670.871794][T20700] netlink: 3581 bytes leftover after parsing attributes in process `syz.0.3650'. [ 670.985165][T20703] 8021q: adding VLAN 0 to HW filter on device bond3 [ 671.008840][T20703] bond3: (slave xfrm1): The slave device specified does not support setting the MAC address [ 671.020256][T20703] bond3: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 671.054422][T20703] bond3: (slave xfrm1): making interface the new active one [ 671.076572][T20703] xfrm1: entered promiscuous mode [ 671.096578][T20703] bond3: (slave xfrm1): Enslaving as an active interface with an up link [ 671.118464][T20696] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3649'. [ 671.210768][T20711] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 671.322052][T20727] netlink: 'syz.4.3654': attribute type 1 has an invalid length. [ 671.467248][T20711] xt_hashlimit: max too large, truncated to 1048576 [ 671.495481][T20715] syzkaller0: entered promiscuous mode [ 671.511045][T20715] syzkaller0: entered allmulticast mode [ 674.486623][T20751] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 674.909421][T20770] lo speed is unknown, defaulting to 1000 [ 675.431889][T20795] syzkaller0: entered promiscuous mode [ 675.458770][T20795] syzkaller0: entered allmulticast mode [ 675.577277][T20802] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3671'. [ 675.874163][T20813] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3673'. [ 676.279291][T20814] lo speed is unknown, defaulting to 1000 [ 676.817195][T20829] netlink: 'syz.0.3678': attribute type 4 has an invalid length. [ 677.088456][T20842] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3682'. [ 677.253138][T20845] netlink: 'syz.2.3683': attribute type 21 has an invalid length. [ 677.263462][T20845] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3683'. [ 677.282985][T20845] netlink: 59 bytes leftover after parsing attributes in process `syz.2.3683'. [ 677.449345][T20829] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3678'. [ 677.483288][T20829] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3678'. [ 677.493160][T20829] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3678'. [ 677.517476][T20854] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3686'. [ 677.564374][T20852] lo speed is unknown, defaulting to 1000 [ 677.900879][T20861] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3688'. [ 677.942808][T20861] netlink: 'syz.4.3688': attribute type 6 has an invalid length. [ 677.985763][T20861] netlink: 'syz.4.3688': attribute type 6 has an invalid length. [ 678.719112][T20894] syzkaller1: entered promiscuous mode [ 678.750644][T20894] syzkaller1: entered allmulticast mode [ 679.251852][T20912] veth3: entered allmulticast mode [ 679.282074][T20912] bond4: (slave veth3): Enslaving as an active interface with an up link [ 679.320919][T20921] bond4 (unregistering): (slave veth3): Releasing backup interface [ 679.335589][T20921] bond4 (unregistering): Released all slaves [ 679.407188][T20929] tipc: Enabled bearer , priority 0 [ 679.435013][T20920] syzkaller0: entered promiscuous mode [ 679.460718][T20920] syzkaller0: entered allmulticast mode [ 679.477661][T20932] mac80211_hwsim hwsim28 syzkaller0: left promiscuous mode [ 679.491965][T20932] mac80211_hwsim hwsim28 syzkaller0: left allmulticast mode [ 679.501536][T20928] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 679.537800][T20918] tipc: Resetting bearer [ 679.636467][T20918] tipc: Disabling bearer [ 679.701970][T20942] macvlan2: entered promiscuous mode [ 679.707468][T20942] macvlan2: entered allmulticast mode [ 679.914546][T20949] mac80211_hwsim hwsim26 wlan0: entered promiscuous mode [ 679.978205][T20951] syz_tun: entered allmulticast mode [ 680.029589][T20954] netlink: 'syz.3.3718': attribute type 10 has an invalid length. [ 680.072525][T20954] geneve2: entered promiscuous mode [ 680.078303][T20954] geneve2: entered allmulticast mode [ 680.252405][T20959] 8021q: adding VLAN 0 to HW filter on device bond3 [ 680.399143][T20961] bond4: entered allmulticast mode [ 680.516027][T20971] tipc: Enabled bearer , priority 0 [ 680.664240][T20983] __nla_validate_parse: 16 callbacks suppressed [ 680.664261][T20983] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3726'. [ 680.772083][T20971] syzkaller0: entered promiscuous mode [ 680.779151][T20971] syzkaller0: entered allmulticast mode [ 680.787145][T20971] tipc: Resetting bearer [ 680.819103][T20970] tipc: Resetting bearer [ 680.855013][T20993] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3728'. [ 683.084386][T20970] tipc: Disabling bearer [ 683.255998][T21010] syzkaller1: entered promiscuous mode [ 683.262500][T21010] syzkaller1: entered allmulticast mode [ 683.336662][T21013] =v: renamed from veth0_to_bond (while UP) [ 683.399190][T21017] pim6reg1: entered promiscuous mode [ 683.415690][T21017] pim6reg1: entered allmulticast mode [ 683.687011][T21032] openvswitch: netlink: IP tunnel dst address not specified [ 683.703563][T21032] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3739'. [ 683.763012][T21032] syzkaller1: entered promiscuous mode [ 683.784184][T21032] syzkaller1: entered allmulticast mode [ 683.902485][T21036] netlink: 'syz.1.3740': attribute type 1 has an invalid length. [ 683.945822][T21036] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 684.004259][T21042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3741'. [ 684.063454][T21049] netlink: 'syz.1.3743': attribute type 1 has an invalid length. [ 684.078755][T21047] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3742'. [ 684.109757][T21047] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3742'. [ 684.221084][T21049] 8021q: adding VLAN 0 to HW filter on device bond1 [ 684.251511][T21051] bond1: (slave dummy0): making interface the new active one [ 684.261138][T21051] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 684.304514][T21059] : renamed from dummy0 (while UP) [ 684.318885][T21062] tipc: Enabling of bearer rejected, already enabled [ 684.365358][T21058] tipc: Enabling of bearer rejected, already enabled [ 684.391912][T21064] tipc: Enabled bearer , priority 0 [ 684.418150][T21058] mac80211_hwsim hwsim28 syzkaller0: entered promiscuous mode [ 684.434157][T21058] mac80211_hwsim hwsim28 syzkaller0: entered allmulticast mode [ 684.546271][T21065] syzkaller0: entered promiscuous mode [ 684.570100][T21065] syzkaller0: entered allmulticast mode [ 684.580821][T21065] tipc: Resetting bearer [ 684.595202][T21067] bond0: option arp_validate: invalid value (55553) [ 684.602471][T10694] bond0: (slave bond_slave_0): interface is now down [ 684.635478][T21070] netlink: 'syz.0.3747': attribute type 11 has an invalid length. [ 684.638917][T10694] bond0: (slave bond_slave_1): interface is now down [ 684.656385][T21070] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3747'. [ 684.671564][T10694] bond0: (slave bond_slave_0): interface is now down [ 684.679438][T21063] tipc: Resetting bearer [ 684.687250][T10694] bond0: (slave bond_slave_1): interface is now down [ 684.710343][T10694] bond0: (slave bond_slave_0): interface is now down [ 684.729361][T10694] bond0: (slave bond_slave_1): interface is now down [ 684.761545][T10694] bond0: (slave bond_slave_0): interface is now down [ 684.784539][T10694] bond0: (slave bond_slave_1): interface is now down [ 684.814760][T10694] bond0: (slave bond_slave_0): interface is now down [ 684.829307][T10694] bond0: (slave bond_slave_1): interface is now down [ 684.872390][ T12] bond0: (slave bond_slave_0): interface is now down [ 684.879750][ T12] bond0: (slave bond_slave_1): interface is now down [ 684.904446][ T12] bond0: (slave bond_slave_0): interface is now down [ 684.913705][ T12] bond0: (slave bond_slave_1): interface is now down [ 684.943596][T10701] bond0: (slave bond_slave_0): interface is now down [ 684.979758][T10701] bond0: (slave bond_slave_1): interface is now down [ 685.039264][T10701] bond0: (slave bond_slave_0): interface is now down [ 685.056330][T10701] bond0: (slave bond_slave_1): interface is now down [ 685.080329][T10701] bond0: (slave bond_slave_0): interface is now down [ 685.092635][T10701] bond0: (slave bond_slave_1): interface is now down [ 685.135997][T10701] bond0: (slave bond_slave_0): interface is now down [ 685.143055][T10701] bond0: (slave bond_slave_1): interface is now down [ 685.194830][T10701] bond0: (slave bond_slave_0): interface is now down [ 685.202479][T10701] bond0: (slave bond_slave_1): interface is now down [ 685.240173][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.247032][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.263689][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.270965][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.295683][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.302823][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.320262][ T8758] bond0: (slave bond_slave_0): interface is now down [ 685.327605][ T8758] bond0: (slave bond_slave_1): interface is now down [ 685.351697][ T8758] bond0: (slave bond_slave_0): interface is now down [ 685.359002][ T8758] bond0: (slave bond_slave_1): interface is now down [ 685.381957][T10694] bond0: (slave bond_slave_0): interface is now down [ 685.388865][T10694] bond0: (slave bond_slave_1): interface is now down [ 685.410415][T10694] bond0: (slave bond_slave_0): interface is now down [ 685.417850][T10694] bond0: (slave bond_slave_1): interface is now down [ 685.456348][T10694] bond0: (slave bond_slave_0): interface is now down [ 685.464087][T10694] bond0: (slave bond_slave_1): interface is now down [ 685.480237][ T8758] bond0: (slave bond_slave_0): interface is now down [ 685.487233][ T8758] bond0: (slave bond_slave_1): interface is now down [ 685.512420][T10699] bond0: (slave bond_slave_0): interface is now down [ 685.521389][T10699] bond0: (slave bond_slave_1): interface is now down [ 685.545448][T10699] bond0: (slave bond_slave_0): interface is now down [ 685.552709][T10699] bond0: (slave bond_slave_1): interface is now down [ 685.575561][T10694] bond0: (slave bond_slave_0): interface is now down [ 685.582745][T10694] bond0: (slave bond_slave_1): interface is now down [ 685.614244][ T8758] bond0: (slave bond_slave_0): interface is now down [ 685.622338][ T8758] bond0: (slave bond_slave_1): interface is now down [ 685.645308][T10699] bond0: (slave bond_slave_0): interface is now down [ 685.652572][T10699] bond0: (slave bond_slave_1): interface is now down [ 685.683580][T10694] bond0: (slave bond_slave_0): interface is now down [ 685.694208][ T1316] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 685.706705][T10694] bond0: (slave bond_slave_1): interface is now down [ 685.731784][T10699] bond0: (slave bond_slave_0): interface is now down [ 685.738582][T10699] bond0: (slave bond_slave_1): interface is now down [ 685.761936][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.768762][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.791807][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.798727][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.833061][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.840088][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.860095][T10698] bond0: (slave bond_slave_0): interface is now down [ 685.867068][T10698] bond0: (slave bond_slave_1): interface is now down [ 685.892541][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.899348][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.924697][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.933725][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.964668][ T12] bond0: (slave bond_slave_0): interface is now down [ 685.971633][ T12] bond0: (slave bond_slave_1): interface is now down [ 685.994347][T10698] bond0: (slave bond_slave_0): interface is now down [ 686.001578][T10698] bond0: (slave bond_slave_1): interface is now down [ 686.020243][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.029144][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.052737][ T12] bond0: (slave bond_slave_0): interface is now down [ 686.059727][ T12] bond0: (slave bond_slave_1): interface is now down [ 686.084003][ T12] bond0: (slave bond_slave_0): interface is now down [ 686.091930][ T12] bond0: (slave bond_slave_1): interface is now down [ 686.111397][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.118143][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.156591][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.163521][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.202771][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.209709][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.230458][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.237769][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.261550][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.268362][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.291308][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.298085][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.320620][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.327422][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.350436][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.357316][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.386354][T10698] bond0: (slave bond_slave_0): interface is now down [ 686.393551][T10698] bond0: (slave bond_slave_1): interface is now down [ 686.430889][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.438041][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.466514][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.473666][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.512438][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.519214][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.540408][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.547200][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.576566][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.583891][T10699] bond0: (slave bond_slave_1): interface is now down [ 686.610306][T10698] bond0: (slave bond_slave_0): interface is now down [ 686.617347][T10698] bond0: (slave bond_slave_1): interface is now down [ 686.656489][T10698] bond0: (slave bond_slave_0): interface is now down [ 686.665306][T10698] bond0: (slave bond_slave_1): interface is now down [ 686.694561][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.701756][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.724968][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.732311][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.755742][T10698] bond0: (slave bond_slave_0): interface is now down [ 686.763368][T10698] bond0: (slave bond_slave_1): interface is now down [ 686.793888][T10698] bond0: (slave bond_slave_0): interface is now down [ 686.800904][T10698] bond0: (slave bond_slave_1): interface is now down [ 686.823344][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.831752][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.861355][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.868149][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.890274][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.897053][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.920039][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.926787][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.956343][T10702] bond0: (slave bond_slave_0): interface is now down [ 686.963182][T10702] bond0: (slave bond_slave_1): interface is now down [ 686.990258][T10699] bond0: (slave bond_slave_0): interface is now down [ 686.997282][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.020167][T10702] bond0: (slave bond_slave_0): interface is now down [ 687.026997][T10702] bond0: (slave bond_slave_1): interface is now down [ 687.067148][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.082375][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.110091][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.117164][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.146710][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.154508][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.188167][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.195579][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.227007][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.234190][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.274850][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.281769][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.309996][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.316948][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.351903][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.360261][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.380008][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.386964][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.420094][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.431744][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.455164][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.462561][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.480355][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.487122][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.510286][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.517060][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.540156][ T12] bond0: (slave bond_slave_0): interface is now down [ 687.547482][ T12] bond0: (slave bond_slave_1): interface is now down [ 687.570867][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.577654][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.599974][T10698] bond0: (slave bond_slave_0): interface is now down [ 687.606862][T10698] bond0: (slave bond_slave_1): interface is now down [ 687.630084][T10698] bond0: (slave bond_slave_0): interface is now down [ 687.636920][T10698] bond0: (slave bond_slave_1): interface is now down [ 687.670103][T10697] bond0: (slave bond_slave_0): interface is now down [ 687.677060][T10697] bond0: (slave bond_slave_1): interface is now down [ 687.710155][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.716986][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.740121][T10697] bond0: (slave bond_slave_0): interface is now down [ 687.747063][T10697] bond0: (slave bond_slave_1): interface is now down [ 687.780323][T10697] bond0: (slave bond_slave_0): interface is now down [ 687.787213][T10697] bond0: (slave bond_slave_1): interface is now down [ 687.804026][T10697] bond0: (slave bond_slave_0): interface is now down [ 687.811013][T10697] bond0: (slave bond_slave_1): interface is now down [ 687.840261][T10697] bond0: (slave bond_slave_0): interface is now down [ 687.847132][T10697] bond0: (slave bond_slave_1): interface is now down [ 687.880057][T10698] bond0: (slave bond_slave_0): interface is now down [ 687.887006][T10698] bond0: (slave bond_slave_1): interface is now down [ 687.900084][T10698] bond0: (slave bond_slave_0): interface is now down [ 687.906838][T10698] bond0: (slave bond_slave_1): interface is now down [ 687.935859][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.942838][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.960013][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.966836][T10699] bond0: (slave bond_slave_1): interface is now down [ 687.990314][T10699] bond0: (slave bond_slave_0): interface is now down [ 687.997071][T10699] bond0: (slave bond_slave_1): interface is now down [ 688.020727][T10699] bond0: (slave bond_slave_0): interface is now down [ 688.048632][T10699] bond0: (slave bond_slave_1): interface is now down [ 688.073368][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.081867][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.100028][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.106789][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.133145][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.140815][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.164277][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.172981][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.206548][T10699] bond0: (slave bond_slave_0): interface is now down [ 688.213738][T10699] bond0: (slave bond_slave_1): interface is now down [ 688.245559][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.254920][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.287048][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.294465][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.319973][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.326716][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.351762][T10698] bond0: (slave bond_slave_0): interface is now down [ 688.358545][T10698] bond0: (slave bond_slave_1): interface is now down [ 688.395481][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.402775][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.420176][ T12] bond0: (slave bond_slave_0): interface is now down [ 688.426920][ T12] bond0: (slave bond_slave_1): interface is now down [ 688.456513][T10698] bond0: (slave bond_slave_0): interface is now down [ 688.463550][T10698] bond0: (slave bond_slave_1): interface is now down [ 688.479149][T21063] tipc: Disabling bearer [ 688.491846][T10699] bond0: (slave bond_slave_0): interface is now down [ 688.504262][T10699] bond0: (slave bond_slave_1): interface is now down [ 688.520660][T21076] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 688.540190][T10699] bond0: (slave bond_slave_0): interface is now down [ 688.557071][T10699] bond0: (slave bond_slave_1): interface is now down [ 688.590622][T10701] bond0: (slave bond_slave_0): interface is now down [ 688.626325][T10701] bond0: (slave bond_slave_1): interface is now down [ 688.668902][T10701] bond0: now running without any active interface! [ 689.228972][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.279385][T21136] xt_TCPMSS: Only works on TCP SYN packets [ 689.303727][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.318689][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.328274][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.338114][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.347547][T21140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3764'. [ 689.358199][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.367724][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.377433][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.390080][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3762'. [ 689.422669][T21144] siw: device registration error -23 [ 689.477843][T21144] sit0: entered promiscuous mode [ 689.495684][T21144] netlink: 'syz.4.3763': attribute type 1 has an invalid length. [ 690.406474][T21167] netlink: 'syz.0.3771': attribute type 13 has an invalid length. [ 690.415948][T21167] netlink: 'syz.0.3771': attribute type 17 has an invalid length. [ 690.452498][T21166] bridge0: port 2(bridge_slave_1) entered disabled state [ 690.460273][T21166] bridge0: port 1(bridge_slave_0) entered disabled state [ 690.523134][T21166] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 690.540643][T21166] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 690.623083][T21166] batman_adv: batadv0: Interface deactivated: gretap1 [ 690.657017][T21166] batman_adv: batadv0: Interface deactivated: vlan3 [ 690.721928][T21167] 8021q: adding VLAN 0 to HW filter on device bond0 [ 690.737605][T21167] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 690.763828][T21167] bridge0: port 1(bridge_slave_0) entered blocking state [ 690.771048][T21167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 690.782684][T21167] bridge0: port 2(bridge_slave_1) entered blocking state [ 690.789802][T21167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 690.808212][T21167] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 690.824628][T21167] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 690.845509][T21167] veth1_vlan: left promiscuous mode [ 690.852155][T21167] veth0_vlan: left promiscuous mode [ 690.859272][T21167] veth0_vlan: entered promiscuous mode [ 690.869785][T21167] veth1_vlan: entered promiscuous mode [ 690.882558][T21167] veth1_macvtap: left promiscuous mode [ 690.888912][T21167] veth0_macvtap: left promiscuous mode [ 690.898311][T21167] veth0_macvtap: entered promiscuous mode [ 690.907055][T21167] veth1_macvtap: entered promiscuous mode [ 690.919067][T21167] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 690.927962][T21167] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 690.936641][T21167] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 690.948787][T21167] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 690.961536][T21167] batman_adv: batadv0: Interface activated: gretap1 [ 690.968651][T21167] 8021q: adding VLAN 0 to HW filter on device bond1 [ 690.977997][T21167] 8021q: adding VLAN 0 to HW filter on device bond2 [ 690.986845][T21167] 8021q: adding VLAN 0 to HW filter on device bond3 [ 691.004214][T21167] batman_adv: batadv0: Interface activated: vlan3 [ 691.031705][ T5723] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 691.048365][T21167] 8021q: adding VLAN 0 to HW filter on device bond4 [ 691.064207][T21167] bridge5: left allmulticast mode [ 691.072572][T21167] 8021q: adding VLAN 0 to HW filter on device bond5 [ 691.142881][ T8758] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 691.153021][ T8758] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 691.270978][ T9] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 691.431532][ T5354] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 691.999336][T21114] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 692.221413][T21173] IPVS: Error connecting to the multicast addr [ 692.268897][T21180] xt_hashlimit: overflow, try lower: 6/0 [ 692.309683][T21186] IPVS: set_ctl: invalid protocol: 15917 10.115.117.98:28786 [ 692.393684][T21180] ip6gre1: entered promiscuous mode [ 692.426593][T21180] ip6gre1: entered allmulticast mode [ 692.613431][T21199] xt_l2tp: invalid flags combination: 0 [ 693.303978][T21241] netlink: 'syz.4.3789': attribute type 1 has an invalid length. [ 693.514168][T21247] bond4: (slave geneve2): making interface the new active one [ 693.529654][T21247] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 693.558106][T10697] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 693.589399][T10697] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 693.609520][T10697] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 693.647571][T10697] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 693.845940][T21245] smbdirect: ib_dev[syz2] removed [ 693.897431][T21269] syzkaller1: entered allmulticast mode [ 693.959666][T21272] sctp: [Deprecated]: syz.2.3795 (pid 21272) Use of int in max_burst socket option. [ 693.959666][T21272] Use struct sctp_assoc_value instead [ 693.975073][T21271] sctp: [Deprecated]: syz.2.3795 (pid 21271) Use of int in max_burst socket option. [ 693.975073][T21271] Use struct sctp_assoc_value instead [ 694.321545][T21289] __nla_validate_parse: 58 callbacks suppressed [ 694.321565][T21289] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3799'. [ 694.673766][T21304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3802'. [ 694.931175][T21311] tipc: Resetting bearer [ 694.960467][T21306] tipc: Enabled bearer , priority 0 [ 695.060409][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 695.160844][T21306] syzkaller0: entered promiscuous mode [ 695.176672][T21306] syzkaller0: entered allmulticast mode [ 695.186330][T21308] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 695.265435][T21335] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3808'. [ 695.318131][T21337] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3808'. [ 695.719116][T21345] openvswitch: netlink: IP tunnel dst address not specified [ 697.516707][T21329] tipc: Resetting bearer [ 697.523988][T21332] lo: entered promiscuous mode [ 697.529018][T21332] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 697.588647][T21303] tipc: Resetting bearer [ 697.697059][T21303] tipc: Disabling bearer [ 698.001927][T21370] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3815'. [ 698.022399][T21373] bond0: (slave wlan0): Error: Device is in use and cannot be enslaved [ 698.232075][T21387] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3821'. [ 698.262230][T21387] netlink: 'syz.1.3821': attribute type 1 has an invalid length. [ 698.286125][T21388] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3820'. [ 698.308123][T21387] geneve2: entered promiscuous mode [ 698.330711][T21388] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3820'. [ 698.463669][T21396] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3822'. [ 698.566053][T21403] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3824'. [ 698.954395][T21424] openvswitch: netlink: Tunnel attr 0 has unexpected len 232 expected 8 [ 699.172015][T21433] netlink: 'syz.1.3833': attribute type 8 has an invalid length. [ 699.197629][T21433] netlink: 'syz.1.3833': attribute type 9 has an invalid length. [ 699.412984][T21444] syz_tun: entered allmulticast mode [ 700.003992][T21467] bond5: option miimon: invalid value (18446744073709551615) [ 700.042049][T21467] bond5: option miimon: allowed values 0 - 2147483647 [ 700.082837][T21467] bond5 (unregistering): Released all slaves [ 700.154582][T21484] __nla_validate_parse: 3 callbacks suppressed [ 700.154601][T21484] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3848'. [ 700.218327][T21486] netlink: 'syz.2.3847': attribute type 4 has an invalid length. [ 700.275054][T21487] bond1: (slave ): Releasing active interface [ 700.282843][T21490] netlink: 'syz.2.3847': attribute type 4 has an invalid length. [ 700.369801][T21487] bridge_slave_0: left allmulticast mode [ 700.388988][T21487] bridge_slave_0: left promiscuous mode [ 700.420202][T21487] bridge0: port 1(bridge_slave_0) entered disabled state [ 700.478763][T21492] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3847'. [ 700.492553][T21487] bridge_slave_1: left allmulticast mode [ 700.521318][T21487] bridge_slave_1: left promiscuous mode [ 700.529078][T21500] xt_hashlimit: max too large, truncated to 1048576 [ 700.546503][T21499] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3852'. [ 700.561992][T21487] bridge0: port 2(bridge_slave_1) entered disabled state [ 700.601661][T21502] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3847'. [ 700.641712][T21487] bond0: (slave bond_slave_0): Releasing backup interface [ 700.687480][T21487] bond0: (slave bond_slave_1): Releasing backup interface [ 700.738567][T21487] team0: Port device team_slave_0 removed [ 700.769491][T21487] team0: Port device team_slave_1 removed [ 700.792087][T21487] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 700.813084][T21487] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 700.863610][T21487] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 700.881948][T21487] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 700.907916][T21487] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 701.697350][T21533] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3860'. [ 702.004417][T21530] gretap0: entered promiscuous mode [ 702.188392][T21548] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3863'. [ 702.198219][T21539] syzkaller0: entered promiscuous mode [ 702.211855][T21539] syzkaller0: entered allmulticast mode [ 702.738120][T21567] xt_hashlimit: max too large, truncated to 1048576 [ 702.973612][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 705.350243][T21566] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 705.732694][T21581] xt_hashlimit: size too large, truncated to 1048576 [ 705.739520][T21582] xt_hashlimit: size too large, truncated to 1048576 [ 706.458391][T21557] bridge_slave_0: left allmulticast mode [ 706.464537][T21557] bridge_slave_0: left promiscuous mode [ 706.470569][T21557] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.481212][T21557] bridge_slave_1: left allmulticast mode [ 706.486888][T21557] bridge_slave_1: left promiscuous mode [ 706.493310][T21557] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.513571][T21557] bond0: (slave bond_slave_0): Releasing backup interface [ 706.526980][T21557] bond0: (slave bond_slave_1): Releasing backup interface [ 706.542306][T21557] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 706.549938][T21557] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 706.563656][T21557] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 706.581506][T21557] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 706.597219][T21557] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 706.634037][T21593] netlink: 'syz.4.3871': attribute type 11 has an invalid length. [ 706.867546][T21598] syzkaller0: entered promiscuous mode [ 706.873789][T21601] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3873'. [ 706.896310][T21598] syzkaller0: entered allmulticast mode [ 706.919354][T21601] netlink: 'syz.0.3873': attribute type 11 has an invalid length. [ 706.952783][T21601] netlink: 4320 bytes leftover after parsing attributes in process `syz.0.3873'. [ 707.295053][T21622] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3879'. [ 707.674241][T21634] xt_connbytes: Forcing CT accounting to be enabled [ 707.694864][T21634] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 708.096161][T21653] bond4: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 708.106841][T21660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3888'. [ 708.123615][T21653] bond4 (unregistering): Released all slaves [ 708.140310][T21660] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3888'. [ 708.193589][T21656] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3890'. [ 708.206891][T21656] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3890'. [ 708.219331][T21656] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3890'. [ 708.361478][T21669] netlink: 'syz.0.3892': attribute type 2 has an invalid length. [ 708.379345][ T29] batman_adv: batadv0: Interface deactivated: vlan3 [ 708.476853][T21672] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3893'. [ 708.617865][T21689] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3898'. [ 709.197986][T21720] netlink: 'syz.3.3907': attribute type 16 has an invalid length. [ 709.211912][T21721] netlink: 'syz.0.3908': attribute type 23 has an invalid length. [ 709.235534][T21721] netlink: 'syz.0.3908': attribute type 23 has an invalid length. [ 709.450413][T21732] syzkaller0: entered promiscuous mode [ 709.458720][T21732] syzkaller0: entered allmulticast mode [ 709.659221][T21735] bond5: (slave bond_slave_1): Device is not our slave [ 709.676814][T21735] bond5: option active_slave: invalid value (bond_slave_1) [ 709.701763][T21735] bond5 (unregistering): Released all slaves [ 710.745477][T21780] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 711.143027][T21796] bond6: Invalid ad_actor_system MAC address. [ 711.178200][T21796] bond6: option ad_actor_system: invalid value (7) [ 711.194999][T21796] bond6 (unregistering): Released all slaves [ 711.241724][T21805] 8021q: adding VLAN 0 to HW filter on device bond6 [ 711.343591][T21813] IPVS: set_ctl: invalid protocol: 136 224.0.0.1:20001 [ 711.471536][T21817] veth1_macvtap: left promiscuous mode [ 711.585005][T21829] netdevsim netdevsim1 : renamed from netdevsim0 (while UP) [ 711.902352][T15709] IPVS: starting estimator thread 0... [ 711.932732][T21843] syzkaller1: entered promiscuous mode [ 711.957206][T21843] syzkaller1: entered allmulticast mode [ 712.010160][T21854] IPVS: using max 36 ests per chain, 86400 per kthread [ 712.357701][T21873] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 712.877441][ T5280] veth1_macvtap: entered promiscuous mode [ 713.091716][T21907] __nla_validate_parse: 20 callbacks suppressed [ 713.091737][T21907] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3955'. [ 713.279204][T21912] : renamed from veth0_to_bond (while UP) [ 713.374288][T21919] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3960'. [ 713.437688][T21919] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3960'. [ 713.517007][T21928] tipc: Enabled bearer , priority 10 [ 714.916549][T21975] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 714.989628][T21975] bond4 (unregistering): Released all slaves [ 715.035947][T21980] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3974'. [ 715.307868][T22001] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3979'. [ 715.339486][T22001] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3979'. [ 715.530520][ T5354] page_pool_release_retry() stalled pool shutdown: id 327, 1 inflight 60 sec [ 715.542768][T22017] netlink: 'syz.3.3985': attribute type 20 has an invalid length. [ 715.750315][T22030] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3989'. [ 716.126754][T22047] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3994'. [ 716.137160][T22046] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3995'. [ 716.152747][T22047] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3994'. [ 716.401564][T22064] tun0: tun_chr_ioctl cmd 1074025673 [ 716.563190][T22073] netlink: 'syz.4.4004': attribute type 2 has an invalid length. [ 716.612229][T22073] : entered promiscuous mode [ 716.866104][T22089] netlink: 'syz.2.4009': attribute type 13 has an invalid length. [ 717.148623][T22097] : renamed from bond_slave_0 (while UP) [ 717.154429][T22098] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 717.346184][T22110] tipc: Enabled bearer , priority 0 [ 717.424176][T22109] tipc: Disabling bearer [ 717.504924][T22115] Bluetooth: MGMT ver 1.23 [ 718.191740][T22150] __nla_validate_parse: 10 callbacks suppressed [ 718.191776][T22150] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4024'. [ 718.330814][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 718.355976][T22158] tipc: Enabled bearer , priority 0 [ 718.407981][T22165] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4027'. [ 718.487650][T22171] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 718.501356][T22161] syzkaller0: entered promiscuous mode [ 718.508701][T22161] syzkaller0: entered allmulticast mode [ 718.527939][T22161] tipc: Resetting bearer [ 718.653238][T22172] netdevsim netdevsim2 netdevsim0: refused to change device tx_queue_len [ 718.850576][T10698] tipc: Resetting bearer [ 718.868654][T22157] tipc: Resetting bearer [ 718.922950][T22192] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4032'. [ 718.943703][T22192] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4032'. [ 719.074577][T22196] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4034'. [ 719.311653][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.323646][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.334163][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.344888][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.354963][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.365438][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.375442][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.386118][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.395596][T22203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 721.189074][T22157] tipc: Disabling bearer [ 721.207203][ T5354] tipc: Node number set to 125471508 [ 721.713644][T22230] bond6: Unable to set up delay as MII monitoring is disabled [ 722.429750][T22230] bond6 (unregistering): Released all slaves [ 722.687643][T22268] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4046'. [ 722.697896][T22255] block nbd3: server does not support multiple connections per device. [ 722.746980][T22255] block nbd3: shutting down sockets [ 722.965068][T22277] tap0: tun_chr_ioctl cmd 1074025677 [ 722.979146][T22277] tap0: linktype set to 780 [ 723.503100][T22305] netlink: 'syz.2.4054': attribute type 1 has an invalid length. [ 723.564430][T22312] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4057'. [ 723.579847][T22310] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4056'. [ 723.618756][T22312] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4057'. [ 723.633794][T22298] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4053'. [ 723.638400][T22310] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4056'. [ 723.644107][T22298] net_ratelimit: 24 callbacks suppressed [ 723.644122][T22298] openvswitch: netlink: Message has 512 unknown bytes. [ 723.686517][T22313] gretap1: entered allmulticast mode [ 723.738566][T22313] bond8: (slave gretap1): making interface the new active one [ 723.782329][T22313] bond8: (slave gretap1): Enslaving as an active interface with an up link [ 723.940580][T22322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4058'. [ 724.020977][T22331] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4061'. [ 724.062754][T22331] xt_TCPMSS: Only works on TCP SYN packets [ 724.216997][T22342] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4063'. [ 724.764913][T22326] vlan2: left allmulticast mode [ 724.773927][T22326] bond0: left allmulticast mode [ 724.787049][T22326] bond4: left allmulticast mode [ 724.812066][T22326] gretap1: left allmulticast mode [ 724.829545][T22335] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4062'. [ 724.859810][T22335] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4062'. [ 724.903515][T10702] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.929373][T10702] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.954963][T10702] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.995387][T10702] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.025634][T10702] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.064137][T10702] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.094509][T10702] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.126504][T10702] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.297051][T22372] bond6: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 725.411146][T22389] netlink: 'syz.3.4071': attribute type 6 has an invalid length. [ 725.421849][T22372] bond6 (unregistering): Released all slaves [ 725.441060][T22389] IPv6: NLM_F_CREATE should be specified when creating new route [ 725.459078][T22392] netlink: 'syz.3.4071': attribute type 6 has an invalid length. [ 726.262438][T22418] 8021q: adding VLAN 0 to HW filter on device bond0 [ 726.277972][T22418] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 726.365578][T22418] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 726.377335][T22418] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 726.397433][T22418] veth1_vlan: left promiscuous mode [ 726.411525][T22418] veth0_vlan: left promiscuous mode [ 726.422217][T22418] veth0_vlan: entered promiscuous mode [ 726.440882][T22418] veth1_vlan: entered promiscuous mode [ 726.468198][T22418] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 726.502044][T22418] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 726.523699][T22418] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 726.542860][T22418] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 726.561590][T22418] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 726.654380][T22443] netlink: 'syz.2.4087': attribute type 1 has an invalid length. [ 726.714581][T22447] netlink: 'syz.2.4087': attribute type 2 has an invalid length. [ 726.850281][ T12] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.859230][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.870546][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.879663][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.006878][T22450] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 727.025872][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 727.035166][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.071951][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 727.083228][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.574211][T22448] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 727.585708][T22448] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 727.689648][T22448] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 727.697501][T22448] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 727.763547][T22448] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 727.771567][T22448] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 727.816785][T22448] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 727.829235][T22448] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 728.127619][T22488] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 728.469655][T22508] sctp: [Deprecated]: syz.1.4098 (pid 22508) Use of int in max_burst socket option. [ 728.469655][T22508] Use struct sctp_assoc_value instead [ 728.512790][T22508] netlink: 'syz.1.4098': attribute type 1 has an invalid length. [ 728.549150][T22512] netlink: 'syz.2.4101': attribute type 1 has an invalid length. [ 728.560793][T22512] netlink: 'syz.2.4101': attribute type 2 has an invalid length. [ 728.599369][T22508] bond2: entered promiscuous mode [ 728.605975][T22508] 8021q: adding VLAN 0 to HW filter on device bond2 [ 728.948586][T22531] bond6: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 728.965672][T22531] bond6 (unregistering): Released all slaves [ 728.983245][T22535] netlink: 'syz.1.4106': attribute type 2 has an invalid length. [ 729.011444][T22535] netlink: 'syz.1.4106': attribute type 1 has an invalid length. [ 729.019403][T22535] __nla_validate_parse: 9 callbacks suppressed [ 729.019419][T22535] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4106'. [ 729.134097][T22540] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 729.153750][T22541] netlink: 'syz.3.4108': attribute type 21 has an invalid length. [ 729.183705][T22541] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4108'. [ 729.263364][T22543] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4110'. [ 729.379012][T22546] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4113'. [ 729.408386][T22546] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 729.521404][T22554] netlink: 'syz.1.4115': attribute type 1 has an invalid length. [ 729.747862][T22554] 8021q: adding VLAN 0 to HW filter on device bond4 [ 729.818136][T22575] sctp: [Deprecated]: syz.2.4121 (pid 22575) Use of int in max_burst socket option. [ 729.818136][T22575] Use struct sctp_assoc_value instead [ 729.863784][T22577] sctp: [Deprecated]: syz.2.4121 (pid 22577) Use of int in max_burst socket option. [ 729.863784][T22577] Use struct sctp_assoc_value instead [ 730.021433][T22585] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4125'. [ 730.030999][T22585] netlink: 'syz.0.4125': attribute type 1 has an invalid length. [ 730.046035][T22569] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 730.085731][T22589] xt_hashlimit: size too large, truncated to 1048576 [ 730.131681][T22569] bond4 (unregistering): Released all slaves [ 730.235195][T22585] geneve2: entered promiscuous mode [ 730.318343][T22586] netlink: 'syz.1.4124': attribute type 1 has an invalid length. [ 730.463936][T22603] xt_hashlimit: size too large, truncated to 1048576 [ 730.584709][T22595] veth3: entered allmulticast mode [ 730.626430][T22595] bond5: (slave veth3): Enslaving as an active interface with a down link [ 730.738707][T22601] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 730.799546][T22612] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4130'. [ 730.825135][T22612] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4130'. [ 731.005296][T22619] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 731.015377][T22619] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 731.033088][T22617] netlink: 'syz.4.4131': attribute type 5 has an invalid length. [ 731.387012][T22638] bond9: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 731.444547][T22638] bond9 (unregistering): Released all slaves [ 731.745763][T22655] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4141'. [ 731.756261][T22654] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4142'. [ 732.071398][T22676] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 732.302132][T22680] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4149'. [ 732.901359][T22676] bond0: (slave wlan0): Error: Device is in use and cannot be enslaved [ 733.485464][T22719] mac80211_hwsim hwsim31 syzkaller0: entered promiscuous mode [ 733.497391][T22719] mac80211_hwsim hwsim31 syzkaller0: entered allmulticast mode [ 733.625972][T22728] validate_nla: 3 callbacks suppressed [ 733.625993][T22728] netlink: 'syz.3.4162': attribute type 1 has an invalid length. [ 733.796362][T22734] ip6tnl4: entered allmulticast mode [ 733.813604][T22734] bond4: (slave ip6tnl4): The slave device specified does not support setting the MAC address [ 733.835732][T22734] bond4: (slave ip6tnl4): Error -95 calling set_mac_address [ 734.080544][T22751] nbd3: detected capacity change from 0 to 63 [ 734.088683][T22756] block nbd2: NBD_DISCONNECT [ 734.095876][T22756] block nbd2: Send disconnect failed -32 [ 734.102993][T22756] block nbd2: shutting down sockets [ 734.143503][T22751] sctp: [Deprecated]: syz.2.4170 (pid 22751) Use of int in max_burst socket option deprecated. [ 734.143503][T22751] Use struct sctp_assoc_value instead [ 734.236678][ T8758] dvmrp0: left allmulticast mode [ 734.247805][ T5623] block nbd3: Receive control failed (result -104) [ 734.249484][ T8758] bond8: left allmulticast mode [ 735.075363][T22797] netlink: 'syz.3.4175': attribute type 1 has an invalid length. [ 735.217504][T22803] __nla_validate_parse: 4 callbacks suppressed [ 735.217525][T22803] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4175'. [ 736.833913][ T8758] bond0 (unregistering): Released all slaves [ 736.853254][ T8758] bond1 (unregistering): Released all slaves [ 736.869272][ T8758] bond2 (unregistering): Released all slaves [ 736.886070][ T8758] bond3 (unregistering): Released all slaves [ 736.904663][ T8758] bond4 (unregistering): Released all slaves [ 736.929026][ T8758] bond5 (unregistering): Released all slaves [ 736.946718][ T8758] bond6 (unregistering): Released all slaves [ 736.967783][ T8758] bond7 (unregistering): Released all slaves [ 736.986479][ T8758] bond8 (unregistering): Released all slaves [ 737.011807][ T8758] bond9 (unregistering): Released all slaves [ 737.028025][ T8758] bond10 (unregistering): Released all slaves [ 737.048620][ T8758] bond11 (unregistering): Released all slaves [ 737.066206][ T8758] bond12 (unregistering): Released all slaves [ 737.083002][ T8758] bond13 (unregistering): Released all slaves [ 737.118851][T22762] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4172'. [ 737.129332][T22764] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4172'. [ 737.164282][T22797] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 737.482089][ T8758] : left promiscuous mode [ 737.543725][T22826] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4178'. [ 737.871889][ T8758] tipc: Left network mode [ 738.266505][T22839] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4182'. [ 738.309250][T22839] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4182'. [ 738.386358][T22860] netlink: 'syz.4.4186': attribute type 1 has an invalid length. [ 738.420289][T22860] netlink: 228 bytes leftover after parsing attributes in process `syz.4.4186'. [ 738.452611][T22867] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4188'. [ 738.465578][T22860] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4186'. [ 738.487505][T22867] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4188'. [ 738.508475][T22864] netlink: 'syz.0.4187': attribute type 9 has an invalid length. [ 738.898505][T22878] syzkaller0: entered promiscuous mode [ 738.931071][T22878] syzkaller0: entered allmulticast mode [ 739.511344][T22909] sit0: left promiscuous mode [ 739.537251][T22909] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 739.607324][T22909] mac80211_hwsim hwsim26 wlan0: left promiscuous mode [ 739.624736][T22909] vlan2: left allmulticast mode [ 739.637506][T22909] bond0: left allmulticast mode [ 739.654507][T22909] bond_slave_0: left allmulticast mode [ 739.663219][T22909] bond_slave_1: left allmulticast mode [ 739.692483][T22909] ip6erspan1: left allmulticast mode [ 739.705605][T22909] bond3: left promiscuous mode [ 739.716903][T22909] xfrm1: left promiscuous mode [ 739.864014][T10698] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 739.918754][T10698] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 740.053903][ T8758] [ 740.056380][ T8758] ====================================================== [ 740.063417][ T8758] WARNING: possible circular locking dependency detected [ 740.070470][ T8758] syzkaller #0 Not tainted [ 740.074902][ T8758] ------------------------------------------------------ [ 740.081935][ T8758] kworker/u8:9/8758 is trying to acquire lock: [ 740.088109][ T8758] ffff88801c28d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x6d/0x170 [ 740.098694][ T8758] [ 740.098694][ T8758] but task is already holding lock: [ 740.106079][ T8758] ffff88801c28d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x800 [ 740.115713][ T8758] [ 740.115713][ T8758] which lock already depends on the new lock. [ 740.115713][ T8758] [ 740.126130][ T8758] [ 740.126130][ T8758] the existing dependency chain (in reverse order) is: [ 740.135154][ T8758] [ 740.135154][ T8758] -> #11 (&root->kernfs_rwsem){++++}-{4:4}: [ 740.143257][ T8758] down_write+0x96/0x200 [ 740.148039][ T8758] kernfs_add_one+0x41/0x5e0 [ 740.153170][ T8758] kernfs_create_dir_ns+0x1a1/0x230 [ 740.158911][ T8758] internal_create_group+0x440/0x1180 [ 740.164832][ T8758] cpuhp_invoke_callback+0x434/0x810 [ 740.170666][ T8758] cpuhp_issue_call+0x3f0/0x750 [ 740.176056][ T8758] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 740.182658][ T8758] __cpuhp_setup_state+0x3f/0x60 [ 740.188129][ T8758] do_one_initcall+0x250/0x870 [ 740.193436][ T8758] do_initcall_level+0x10a/0x1a0 [ 740.198928][ T8758] do_initcalls+0x59/0xa0 [ 740.203797][ T8758] kernel_init_freeable+0x29d/0x3e0 [ 740.209616][ T8758] kernel_init+0x1d/0x1d0 [ 740.214480][ T8758] ret_from_fork+0x514/0xb70 [ 740.219610][ T8758] ret_from_fork_asm+0x1a/0x30 [ 740.224913][ T8758] [ 740.224913][ T8758] -> #10 (cpuhp_state_mutex){+.+.}-{4:4}: [ 740.232842][ T8758] [ 740.232842][ T8758] -> #9 (cpu_hotplug_lock){++++}-{0:0}: [ 740.240589][ T8758] cpus_read_lock+0x42/0x160 [ 740.245717][ T8758] static_key_slow_inc+0x12/0x30 [ 740.251192][ T8758] ipv6_flowlabel_opt+0x1cb1/0x2ae0 [ 740.256936][ T8758] do_ipv6_setsockopt+0xdff/0x3180 [ 740.262586][ T8758] ipv6_setsockopt+0x59/0x170 [ 740.267803][ T8758] do_sock_setsockopt+0x17c/0x1b0 [ 740.273383][ T8758] __x64_sys_setsockopt+0x13d/0x1b0 [ 740.279119][ T8758] do_syscall_64+0x174/0x580 [ 740.284253][ T8758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.290676][ T8758] [ 740.290676][ T8758] -> #8 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 740.298512][ T8758] lock_sock_nested+0x41/0x100 [ 740.303829][ T8758] tls_sw_sendmsg+0x161/0x2860 [ 740.309127][ T8758] sock_sendmsg_nosec+0x90/0x180 [ 740.314595][ T8758] sock_sendmsg+0x1ca/0x2d0 [ 740.319647][ T8758] splice_to_socket+0xb5e/0x12a0 [ 740.325121][ T8758] direct_splice_actor+0x101/0x160 [ 740.330772][ T8758] splice_direct_to_actor+0x57b/0xcb0 [ 740.336688][ T8758] do_splice_direct+0x195/0x290 [ 740.342078][ T8758] do_sendfile+0x52e/0x7c0 [ 740.347029][ T8758] __se_sys_sendfile64+0x144/0x1a0 [ 740.352669][ T8758] do_syscall_64+0x174/0x580 [ 740.357803][ T8758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.364234][ T8758] [ 740.364234][ T8758] -> #7 (&ctx->tx_lock){+.+.}-{4:4}: [ 740.371720][ T8758] __mutex_lock+0x19d/0x1550 [ 740.376849][ T8758] tls_sw_sendmsg+0x13c/0x2860 [ 740.382154][ T8758] sock_sendmsg_nosec+0x90/0x180 [ 740.387627][ T8758] sock_sendmsg+0x1ca/0x2d0 [ 740.392667][ T8758] __sock_xmit+0x245/0x4f0 [ 740.397612][ T8758] nbd_disconnect+0x3ad/0x560 [ 740.402820][ T8758] nbd_disconnect_and_put+0x32/0x280 [ 740.408642][ T8758] nbd_genl_disconnect+0x4af/0x590 [ 740.414292][ T8758] genl_family_rcv_msg_doit+0x233/0x340 [ 740.420376][ T8758] genl_rcv_msg+0x614/0x7a0 [ 740.425422][ T8758] netlink_rcv_skb+0x226/0x4a0 [ 740.430732][ T8758] genl_rcv+0x28/0x40 [ 740.435252][ T8758] netlink_unicast+0x7bb/0x940 [ 740.440557][ T8758] netlink_sendmsg+0x813/0xb40 [ 740.445859][ T8758] sock_sendmsg_nosec+0x13a/0x180 [ 740.451420][ T8758] ____sys_sendmsg+0x54e/0x850 [ 740.456731][ T8758] ___sys_sendmsg+0x2a5/0x360 [ 740.461952][ T8758] __x64_sys_sendmsg+0x1b1/0x290 [ 740.467435][ T8758] do_syscall_64+0x174/0x580 [ 740.472563][ T8758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.478989][ T8758] [ 740.478989][ T8758] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 740.486680][ T8758] __mutex_lock+0x19d/0x1550 [ 740.491814][ T8758] nbd_queue_rq+0x373/0x1150 [ 740.496948][ T8758] blk_mq_dispatch_rq_list+0x499/0x1990 [ 740.503031][ T8758] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 740.509903][ T8758] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 740.516436][ T8758] blk_mq_run_work_fn+0x16c/0x300 [ 740.522001][ T8758] process_scheduled_works+0xa8e/0x14e0 [ 740.528104][ T8758] worker_thread+0xa47/0xfb0 [ 740.533246][ T8758] kthread+0x388/0x470 [ 740.537862][ T8758] ret_from_fork+0x514/0xb70 [ 740.542997][ T8758] ret_from_fork_asm+0x1a/0x30 [ 740.548299][ T8758] [ 740.548299][ T8758] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 740.555528][ T8758] __mutex_lock+0x19d/0x1550 [ 740.560685][ T8758] nbd_queue_rq+0xc1/0x1150 [ 740.565752][ T8758] blk_mq_dispatch_rq_list+0x499/0x1990 [ 740.571838][ T8758] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 740.578711][ T8758] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 740.585226][ T8758] blk_mq_run_work_fn+0x16c/0x300 [ 740.590793][ T8758] process_scheduled_works+0xa8e/0x14e0 [ 740.596876][ T8758] worker_thread+0xa47/0xfb0 [ 740.601998][ T8758] kthread+0x388/0x470 [ 740.606605][ T8758] ret_from_fork+0x514/0xb70 [ 740.611741][ T8758] ret_from_fork_asm+0x1a/0x30 [ 740.617048][ T8758] [ 740.617048][ T8758] -> #4 (set->srcu){.+.+}-{0:0}: [ 740.624190][ T8758] __synchronize_srcu+0xc9/0x2f0 [ 740.629673][ T8758] elevator_switch+0x1e8/0x7b0 [ 740.634974][ T8758] elevator_change+0x2fa/0x480 [ 740.640273][ T8758] elevator_set_default+0x375/0x440 [ 740.646011][ T8758] blk_register_queue+0x3f3/0x4e0 [ 740.651594][ T8758] __add_disk+0x6cb/0xe30 [ 740.656474][ T8758] add_disk_fwnode+0xfb/0x4b0 [ 740.661691][ T8758] nbd_dev_add+0x733/0xb60 [ 740.666667][ T8758] nbd_init+0x15f/0x1e0 [ 740.671351][ T8758] do_one_initcall+0x250/0x870 [ 740.676665][ T8758] do_initcall_level+0x10a/0x1a0 [ 740.682144][ T8758] do_initcalls+0x59/0xa0 [ 740.687016][ T8758] kernel_init_freeable+0x29d/0x3e0 [ 740.692753][ T8758] kernel_init+0x1d/0x1d0 [ 740.697619][ T8758] ret_from_fork+0x514/0xb70 [ 740.702750][ T8758] ret_from_fork_asm+0x1a/0x30 [ 740.708049][ T8758] [ 740.708049][ T8758] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 740.715894][ T8758] __mutex_lock+0x19d/0x1550 [ 740.721029][ T8758] elevator_change+0x1af/0x480 [ 740.726329][ T8758] elevator_set_none+0xb5/0x140 [ 740.731720][ T8758] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 740.738073][ T8758] nbd_start_device+0x189/0xb30 [ 740.743464][ T8758] nbd_genl_connect+0x1597/0x1c10 [ 740.749114][ T8758] genl_family_rcv_msg_doit+0x233/0x340 [ 740.755193][ T8758] genl_rcv_msg+0x614/0x7a0 [ 740.760235][ T8758] netlink_rcv_skb+0x226/0x4a0 [ 740.765555][ T8758] genl_rcv+0x28/0x40 [ 740.770092][ T8758] netlink_unicast+0x7bb/0x940 [ 740.775405][ T8758] netlink_sendmsg+0x813/0xb40 [ 740.780694][ T8758] sock_sendmsg_nosec+0x13a/0x180 [ 740.786250][ T8758] ____sys_sendmsg+0x54e/0x850 [ 740.791549][ T8758] ___sys_sendmsg+0x2a5/0x360 [ 740.796777][ T8758] __x64_sys_sendmsg+0x1b1/0x290 [ 740.802247][ T8758] do_syscall_64+0x174/0x580 [ 740.807372][ T8758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.813811][ T8758] [ 740.813811][ T8758] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 740.822444][ T8758] blk_alloc_queue+0x544/0x690 [ 740.827753][ T8758] __blk_mq_alloc_disk+0x194/0x390 [ 740.833418][ T8758] nbd_dev_add+0x494/0xb60 [ 740.838379][ T8758] nbd_init+0x15f/0x1e0 [ 740.843074][ T8758] do_one_initcall+0x250/0x870 [ 740.848383][ T8758] do_initcall_level+0x10a/0x1a0 [ 740.853862][ T8758] do_initcalls+0x59/0xa0 [ 740.858730][ T8758] kernel_init_freeable+0x29d/0x3e0 [ 740.864459][ T8758] kernel_init+0x1d/0x1d0 [ 740.869321][ T8758] ret_from_fork+0x514/0xb70 [ 740.874461][ T8758] ret_from_fork_asm+0x1a/0x30 [ 740.879754][ T8758] [ 740.879754][ T8758] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 740.886988][ T8758] fs_reclaim_acquire+0x71/0x100 [ 740.892460][ T8758] kmem_cache_alloc_noprof+0x64/0x5f0 [ 740.898377][ T8758] __kernfs_iattrs+0xdd/0x380 [ 740.903600][ T8758] kernfs_iop_setattr+0xe6/0x3f0 [ 740.909091][ T8758] notify_change+0xbba/0xea0 [ 740.914223][ T8758] do_truncate+0x1c2/0x250 [ 740.919183][ T8758] path_openat+0x2fed/0x3830 [ 740.924323][ T8758] do_file_open+0x23e/0x4a0 [ 740.929369][ T8758] do_sys_openat2+0x115/0x200 [ 740.934585][ T8758] __x64_sys_openat+0x138/0x170 [ 740.939981][ T8758] do_syscall_64+0x174/0x580 [ 740.945122][ T8758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.951559][ T8758] [ 740.951559][ T8758] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 740.960097][ T8758] __lock_acquire+0x1520/0x2cf0 [ 740.965495][ T8758] lock_acquire+0x106/0x350 [ 740.970548][ T8758] down_write+0x96/0x200 [ 740.975320][ T8758] kernfs_unlink_sibling+0x6d/0x170 [ 740.981069][ T8758] kernfs_rename_ns+0x48e/0x800 [ 740.986461][ T8758] sysfs_rename_link_ns+0x16e/0x1b0 [ 740.992211][ T8758] device_rename+0x110/0x210 [ 740.997347][ T8758] __dev_change_net_namespace+0x1392/0x1de0 [ 741.003779][ T8758] cfg802154_switch_netns+0xbd/0x410 [ 741.009606][ T8758] cfg802154_pernet_exit+0x75/0xc0 [ 741.015259][ T8758] ops_undo_list+0x43d/0x8d0 [ 741.020396][ T8758] cleanup_net+0x572/0x810 [ 741.025363][ T8758] process_scheduled_works+0xa8e/0x14e0 [ 741.031458][ T8758] worker_thread+0xa47/0xfb0 [ 741.036590][ T8758] kthread+0x388/0x470 [ 741.041205][ T8758] ret_from_fork+0x514/0xb70 [ 741.046340][ T8758] ret_from_fork_asm+0x1a/0x30 [ 741.051640][ T8758] [ 741.051640][ T8758] other info that might help us debug this: [ 741.051640][ T8758] [ 741.061879][ T8758] Chain exists of: [ 741.061879][ T8758] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 741.061879][ T8758] [ 741.076329][ T8758] Possible unsafe locking scenario: [ 741.076329][ T8758] [ 741.083790][ T8758] CPU0 CPU1 [ 741.089168][ T8758] ---- ---- [ 741.094533][ T8758] lock(&root->kernfs_rwsem); [ 741.099312][ T8758] lock(cpuhp_state_mutex); [ 741.106430][ T8758] lock(&root->kernfs_rwsem); [ 741.113724][ T8758] lock(&root->kernfs_iattr_rwsem); [ 741.119019][ T8758] [ 741.119019][ T8758] *** DEADLOCK *** [ 741.119019][ T8758] [ 741.127174][ T8758] 5 locks held by kworker/u8:9/8758: [ 741.132467][ T8758] #0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 741.143365][ T8758] #1: ffffc90006f97c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 741.153916][ T8758] #2: ffffffff9001d468 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 741.163254][ T8758] #3: ffffffff9002c000 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x18/0xc0 [ 741.172850][ T8758] #4: ffff88801c28d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x800 [ 741.182913][ T8758] [ 741.182913][ T8758] stack backtrace: [ 741.188809][ T8758] CPU: 0 UID: 0 PID: 8758 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) [ 741.188828][ T8758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 741.188841][ T8758] Workqueue: netns cleanup_net [ 741.188865][ T8758] Call Trace: [ 741.188872][ T8758] [ 741.188879][ T8758] dump_stack_lvl+0xe8/0x150 [ 741.188905][ T8758] print_circular_bug+0x2e1/0x300 [ 741.188923][ T8758] check_noncircular+0x12e/0x150 [ 741.188952][ T8758] __lock_acquire+0x1520/0x2cf0 [ 741.188977][ T8758] ? __lock_acquire+0x683/0x2cf0 [ 741.188999][ T8758] ? __lock_acquire+0x683/0x2cf0 [ 741.189024][ T8758] ? kernfs_unlink_sibling+0x6d/0x170 [ 741.189048][ T8758] lock_acquire+0x106/0x350 [ 741.189069][ T8758] ? kernfs_unlink_sibling+0x6d/0x170 [ 741.189105][ T8758] down_write+0x96/0x200 [ 741.189120][ T8758] ? kernfs_unlink_sibling+0x6d/0x170 [ 741.189146][ T8758] ? __pfx_down_write+0x10/0x10 [ 741.189160][ T8758] ? kernfs_root+0x1c/0x230 [ 741.189180][ T8758] ? kernfs_root+0x1c/0x230 [ 741.189200][ T8758] ? kernfs_root+0x1c/0x230 [ 741.189221][ T8758] ? kernfs_root+0x1ea/0x230 [ 741.189242][ T8758] kernfs_unlink_sibling+0x6d/0x170 [ 741.189269][ T8758] kernfs_rename_ns+0x48e/0x800 [ 741.189297][ T8758] sysfs_rename_link_ns+0x16e/0x1b0 [ 741.189320][ T8758] device_rename+0x110/0x210 [ 741.189339][ T8758] __dev_change_net_namespace+0x1392/0x1de0 [ 741.189366][ T8758] ? __pfx___dev_change_net_namespace+0x10/0x10 [ 741.189387][ T8758] ? __lock_acquire+0x683/0x2cf0 [ 741.189413][ T8758] ? __mutex_trylock_common+0x15f/0x270 [ 741.189430][ T8758] ? __pfx___mutex_trylock_common+0x10/0x10 [ 741.189447][ T8758] ? rcu_is_watching+0x15/0xb0 [ 741.189482][ T8758] ? trace_contention_end+0x3d/0x140 [ 741.189498][ T8758] ? __mutex_lock+0x30d/0x1550 [ 741.189539][ T8758] ? do_raw_spin_unlock+0xf5/0x210 [ 741.189558][ T8758] ? _raw_spin_unlock+0x28/0x50 [ 741.189577][ T8758] ? cfg802154_pernet_exit+0x18/0xc0 [ 741.189595][ T8758] ? xa_erase+0xc6/0xf0 [ 741.189611][ T8758] ? __pfx___mutex_lock+0x10/0x10 [ 741.189639][ T8758] cfg802154_switch_netns+0xbd/0x410 [ 741.189660][ T8758] cfg802154_pernet_exit+0x75/0xc0 [ 741.189680][ T8758] ops_undo_list+0x43d/0x8d0 [ 741.189704][ T8758] ? __pfx_ops_undo_list+0x10/0x10 [ 741.189726][ T8758] ? idr_destroy+0x227/0x290 [ 741.189751][ T8758] cleanup_net+0x572/0x810 [ 741.189773][ T8758] ? __pfx_cleanup_net+0x10/0x10 [ 741.189797][ T8758] ? rcu_is_watching+0x15/0xb0 [ 741.189826][ T8758] ? process_scheduled_works+0xa20/0x14e0 [ 741.189844][ T8758] process_scheduled_works+0xa8e/0x14e0 [ 741.189872][ T8758] ? __pfx_process_scheduled_works+0x10/0x10 [ 741.189893][ T8758] ? assign_work+0x3cf/0x5d0 [ 741.189911][ T8758] worker_thread+0xa47/0xfb0 [ 741.189934][ T8758] ? __kthread_parkme+0x71/0x1f0 [ 741.189958][ T8758] kthread+0x388/0x470 [ 741.189980][ T8758] ? __pfx_worker_thread+0x10/0x10 [ 741.189998][ T8758] ? __pfx_kthread+0x10/0x10 [ 741.190020][ T8758] ret_from_fork+0x514/0xb70 [ 741.190045][ T8758] ? __pfx_ret_from_fork+0x10/0x10 [ 741.190067][ T8758] ? __switch_to+0xc89/0x1420 [ 741.190088][ T8758] ? __pfx_kthread+0x10/0x10 [ 741.190116][ T8758] ret_from_fork_asm+0x1a/0x30 [ 741.190137][ T8758] [ 741.583360][T22947] __nla_validate_parse: 2 callbacks suppressed [ 741.583379][T22947] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4201'. [ 741.619736][T22916] bond5: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 741.657623][T22916] bond5 (unregistering): Released all slaves [ 741.694454][T10698] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 741.753054][T10698] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 741.770945][T22925] ieee80211 疽m%AAZZI %sU]Y: Selected rate control algorithm 'minstrel_ht' [ 742.491289][ T8758] IPVS: stop unused estimator thread 0... [ 747.130601][ T1316] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 749.049994][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured!