last executing test programs: 4.026794555s ago: executing program 3 (id=6011): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newtfilter={0x90, 0x2c, 0x20, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff1}, {0xa, 0x8}, {0xfff1}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MASK={0x8, 0x6, 0xfe000000}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0x4, 0x7}}]}}, @TCA_CHAIN={0x8, 0xb, 0x6b8}, @filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0xe, 0xffe0}}]}}, @TCA_CHAIN={0x8, 0xb, 0x100}, @TCA_RATE={0x6, 0x5, {0x40, 0x6c}}, @TCA_RATE={0x6, 0x5, {0x1, 0x8}}, @filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0xbe8f5e7e00fe31f8}}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x4048045) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=ANY=[@ANYBLOB="02180000150000000000000000000000030005000000000002000000e0000001000000000000000008001200000000000000000000000000100000000000000000000000000000007f000001000000000000000000000000fc010000000000000000000000000000030006000000000002000002ffffffff00000000000000000500190000000000020000000000ffff000000000000000002"], 0xa8}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.646437059s ago: executing program 3 (id=6019): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0xac, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0x3}, {0xffff, 0xffff}, {0x5, 0x6}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x54, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0xf}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0xffffffff}, @TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x8}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0x1}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x100}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x4}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x1}, @TCA_FQ_CODEL_ECN={0x8}, @TCA_FQ_CODEL_CE_THRESHOLD_SELECTOR={0x5, 0xa, 0x7}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x1d, 0x407, 0x2, 0x2, 0x3, 0x4}}, {0x4}}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x200001d4}, 0x8840) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0a00000004000000ff0f00000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000004fb6783d575cfecdf98b634293ffd474bfc2dc81d96d1fd9779552c08000000000000000707b28be2eb3ed0a67dead81def1f073b48b43260cf7c4d2e0a8a62ac753787891d5fe1c76e048885cb98034a78982d61763b8ccdc1dd8cfb02e3bea7987f0396975bf31df02a622c2a2111fb5c4"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000002c0)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(twofish-generic)\x00'}, 0x58) r5 = socket$inet6(0xa, 0x80000, 0x1) listen(r5, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="06200000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="181000000300000000007b2aa4f80a675d5d000000000000f8bef4b8cd0c1434cac65b85f3df5154589cc0d7d1be07fd1384d1fa05e984cc1a8cfb2939279d81bd6baca87f153c304562cb6501ab163a58b1425f91f2b2537fe53ff5adb9ab4e0a602dfff722dc1b927a4c06ca36d7ddac9f14b973ee0ead479b6a4211556cc078613875d706000000000000b3ccf10944"], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xd, &(0x7f0000000480)=ANY=[@ANYBLOB="89dd50c6bfebac26654f0d2b9c764e9bb630b01230d4e30554", @ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x15, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702", @ANYRES32=r6, @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f00000021c0)={r7, 0x0, 0x0}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000050050000400000008001b0000000000"], 0x30}}, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYRESDEC=r0, @ANYRESDEC, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000ff02000000000000000000000000000100000000000000000000000000000000010000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000000000000000000000000000100000000000000000000800000000000000000000000000000000000000000feffffff000000000000000002000073d9000000000000004c001400686d61632873686132353629000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000480002006362632873657270656e742900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00040002004e244e23000064010100"/344], 0x1a0}}, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x67, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r13 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r12, r11, 0x25, 0x0, @void}, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r13, 0x5421, &(0x7f0000000440)=0x100000001) 3.178807229s ago: executing program 3 (id=6026): bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="b7f2288d3aaea2bc0000def1260a0000", 0x10) socket$netlink(0x10, 0x3, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd8, 0x2, 0x9, 0x301, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x12}, @NFCTH_TUPLE={0x20, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x2c}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @NFCTH_STATUS={0x8}, @NFCTH_TUPLE={0x54, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x7f}}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20000800}, 0x20008040) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0xe26, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0xfffe, @local}, 0x39) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f00000003c0)={0x5, 0x1, 0x1ff}, 0xc) r1 = accept(0xffffffffffffffff, 0x0, 0x0) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000280)=0x9, &(0x7f00000002c0)=0x2) syz_genetlink_get_family_id$wireguard(&(0x7f00000013c0), r1) 2.795877951s ago: executing program 3 (id=6031): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000080)={0x0, 0x0, 0x200, 0xd9, 0xfffffffd, 0x7fffffff}) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="2c00000019000100feffffff000008001d"], 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x20004014) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x11a, 0x480, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket(0x2, 0x5, 0x0) sendmmsg$inet(r4, &(0x7f00000008c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @private=0xa010102}, 0x10, &(0x7f0000001740)=[{&(0x7f0000000200)='\f', 0x1}], 0x1}}], 0x1, 0x4000800) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000ac0)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x1f8, 0x0, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @dev={0xac, 0x14, 0x14, 0xb}, @rand_addr=0x64010101, 0x4, 0xffffffff}}}, {{@arp={@local, @remote, 0xffffff00, 0xffffff00, 0x3, 0x3, {@empty, {[0x0, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, 0x7, 0x7, 0xb8, 0x101, 0x5, 0x800, 'team_slave_1\x00', 'veth1\x00', {0x7f}, {}, 0x0, 0x120}, 0xc0, 0xe8}, @unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@arp={@rand_addr=0x64010102, @multicast1, 0xff, 0xff, 0xc, 0xd, {@mac, {[0x0, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff]}}, 0x7, 0x8522, 0x5, 0x3, 0x0, 0x40, 'team0\x00', 'nr0\x00', {}, {0x1fe}, 0x0, 0x8}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "fad89963553cb886271b1fb4a635121af22af0f691140598d433e89237bd"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000040)={r5, 0x8ec6, 0x10}, 0xc) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000140)={r5, 0x40}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000140)={r5, @in6={{0xa, 0x4e23, 0x1e, @loopback, 0x9}}, 0x1, 0x6, 0x2, 0x7, 0x4, 0x0, 0x2}, 0x9c) syz_emit_ethernet(0x4e, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd6087fb8900180000fe8808000000000000000000000900000000605c008f000000000002000000010100c204"], 0x0) 2.57984249s ago: executing program 2 (id=6032): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendfile(r3, r4, 0x0, 0xffffffff000) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x0, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r7, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000005c0)={&(0x7f0000000480)={0x138, r7, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x977e, 0x17}}}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x58}, @NL80211_ATTR_IE={0xea, 0x2a, [@cf={0x4, 0x6, {0x7, 0x2, 0x0, 0x9}}, @mesh_config={0x71, 0x7, {0x0, 0x0, 0x0, 0x1, 0x2, 0x1e, 0x40}}, @mesh_config={0x71, 0x7, {0x1, 0x0, 0x1, 0x0, 0x2, 0x7, 0x8}}, @fast_bss_trans={0x37, 0xa9, {0x8, 0x3, "f7a501cf7c2bb83b8d397d2351ef9bc2", "1bbfa1f4458510addd9ce8a9dbe3a4066b4fa6aaa5f8a5cdf4233bc45d1facae", "fcbb572a5e4c034f5391c5c127e3171b4a825ab0b44201dd866740efe3ab7b90", [{0x4, 0x1c, "f845d8b196b241da733902ada5f8b738f31ebf2d23177432e1c2c4df"}, {0x2, 0x27, "ab9ace8fc028eceaf7651a43d6acd7c55f243adf2e99aa3b334aac8dc798c27b7726bbab64d061"}, {0x1, 0xe, "684f4fd7eaec601e0167c9a9f07e"}]}}, @mesh_chsw={0x76, 0x6, {0xff, 0x98, 0x6, 0x9}}, @peer_mgmt={0x75, 0x14, {0x1, 0x2, @void, @void, @val="a902101cb4c7b8f2b77a95f1410d2ba6"}}, @challenge={0x10, 0x1, 0xbc}]}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x49}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x6a}]}, 0x138}, 0x1, 0x0, 0x0, 0x40800}, 0x20040000) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r9, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r9, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) recvfrom$inet(r9, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b00000000000400"], 0x44}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.964033896s ago: executing program 1 (id=6037): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r1, @ANYBLOB="0100000002"], 0x40) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x10, 0xc, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000100001000000000000000000bd00000a28000000000a010300000000000000000100000008000240000000030900010073797a310000000040000000030a05000000000000000000010000000900030073797a300000000014000480080002400000000008000140000000050900010073797a3100000000380000020000000000000000010020000c00024000000000000000010900010073797a31000000000c0004800800014000000005140000001100010000000000000000000000000a00000000"], 0xc8}}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0xe, &(0x7f0000000f00)=ANY=[@ANYBLOB="b70200000000e6ccbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe02000000850000001a000000b7000000100000009500000000000000455781a5fee65e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde43a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d1106fb0289ce67a66afd92c3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a060000009b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece6d311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da326018362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f707777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee23483508818b897e3b677d3d342640e328504ae2dbf8fe1d704765de74891f7c8dae85739c50409c62040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528d46362ea0d8d79c79ddca066da478c1b7d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5f001000000100008000000000ed6f6663677df37de0ec0d0f548b273940be5d1fe0aae14d1a76e0741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ce0000000000000000000000000000000064d3210f806a4877e73c19072e358da1cdbef27967e918e6f2bab4a78ce0103a91789340b00db45df429d650e2f6acfbf9bf2f1b23064f3e60a9ded23b652f110940813a14c97abc84ab3cf728efd94ba2895a0884e7f7c53bc60d1b9768a979929055be8565b8a15dffc8692476ff03963b626afbc18750629666d1f449f02271064768c0731aeccb2c342ae3fa9956354e847f086eee8cd78617ad6ae28f121b23c1128b78f521eea8c487ae31f9112db0e671dd47d95ea9653e51da8c99a996656149a65f8e88032ddf35717407"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000001c0), 0x10, 0x0, r3}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000040)=r5, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x2, 0x2, 0x401, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x40, 0x3, 0x6, 0x3, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x0) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.80824353s ago: executing program 1 (id=6040): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="540000001000050428bd7000fcdbdf2500200000", @ANYRES32=0x0, @ANYBLOB="4000000004000000240012800b0001006970766c616e0000140002"], 0x54}, 0x1, 0x0, 0x0, 0x4080}, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000df000000bfa3000000000000070300000080ffff720af0fff8ffffff71a4f0ff000000005d040200000000001d400500000000004704000001ed00ffc30300ff000000003f440000000000007a0a00fe00ffffffc30300ff41000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a0000000000000000"], &(0x7f00000001c0)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f00000000c0)=0x1000, 0x4) r3 = socket(0x1e, 0x4, 0x0) connect$inet(r3, &(0x7f0000000080)={0x1e, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000cc0)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c40)={0x20, 0x4, 0x8, 0x3, 0x0, 0x0, {0x1, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8080) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a700000001a0a0104000000000000000002000000440004"], 0x98}, 0x1, 0x0, 0x0, 0x20048800}, 0x4048800) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=@delneigh={0x1c, 0x1d, 0x20, 0x70bd27, 0x25dfdbff, {0x7, 0x0, 0x0, r1, 0x0, 0x20, 0xb}}, 0x1c}}, 0x0) 1.728535463s ago: executing program 0 (id=6041): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x3a0ffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0000001000030400000000fdffff200000030000", @ANYRES32=0x0, @ANYRES16=r0, @ANYBLOB="9f68f33976"], 0x48}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$nl_generic(r1, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1400000017000100000000000000002501"], 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000000) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3aee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d320f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c16af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf700"/1664], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f00000000c0)=0x2009, 0x4) sendmmsg$inet(r2, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket(0x15, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r4, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) write(r3, 0x0, 0x0) 1.722431362s ago: executing program 4 (id=6042): r0 = socket(0x400000000010, 0x80000, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), 0x10) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="24a2b48d6085550160f56829c17310f15c0fb2dbf00000001800090400000000000000000a000000000000060000000008001e0001000000"], 0x24}}, 0x80) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x64, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x30, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFLA_GRE_REMOTE={0x14, 0x7, @private2}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x64}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="0f00580069000b000000000000000000000000000001000000"], 0x20}}, 0x4000000) 1.634116142s ago: executing program 3 (id=6043): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="5400000010000504fcfffffffcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0255040004000000240012800b0001006970766c616e0000140002800600020002000000060001000200000008000500", @ANYRES32=r1], 0x54}, 0x1, 0x0, 0x0, 0x4001}, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000000280)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000009000000000000000800000000000000009500"/32], &(0x7f00000004c0)='GPL\x00', 0x4, 0x5, &(0x7f0000000500)=""/5, 0x40f00, 0x2f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7429}, 0x94) socket$pppoe(0x18, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="5400000010000504fcfffffffcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0255040004000000240012800b0001006970766c616e0000140002800600020002000000060001000200000008000500", @ANYRES32=r1], 0x54}, 0x1, 0x0, 0x0, 0x4001}, 0x0) (async) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) (async) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000000280)) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000009000000000000000800000000000000009500"/32], &(0x7f00000004c0)='GPL\x00', 0x4, 0x5, &(0x7f0000000500)=""/5, 0x40f00, 0x2f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7429}, 0x94) (async) 1.496699059s ago: executing program 1 (id=6044): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800020001010000"], 0x44}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r1) sendmsg$NFC_CMD_LLC_SET_PARAMS(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000ffdbdf251000000008000100", @ANYRES32, @ANYBLOB="050010"], 0x44}, 0x1, 0x0, 0x0, 0x8854}, 0x24000040) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000140)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000001c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000240)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000280)=0x0) sendmsg$NFC_CMD_DEV_DOWN(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x200000c0) 1.477090691s ago: executing program 2 (id=6045): syz_emit_ethernet(0x76, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000001aaaaaaaaaabb86dd60f53a0400403a0000000000000000000000000000000000ff72bcd002000000000000000000000000000102"], 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 1.451573168s ago: executing program 0 (id=6046): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000020800000000", @ANYRES16=r0, @ANYRES8=r0, @ANYRESOCT=r0, @ANYRES64=r0], 0x17) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000100000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) (async) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$unix(r4, &(0x7f00000006c0)={0x0, 0x41, 0x0}, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x11, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}}, 0x20040084) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c4400000000000e0feff00850000000f00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xc, 0x4, 0x8, 0xd, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x20000000}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r10, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r8}, 0x20) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r10, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r8}, 0x20) setsockopt$inet6_tcp_buf(r8, 0x6, 0x1f, &(0x7f0000000140)="cd7d2db8", 0x4) sendmmsg$inet6(r8, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000050) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000b00)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x6, 0x5}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40098}, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) r12 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r12, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='ip6tnl0\x00'}) (async) ioctl$sock_ifreq(r12, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='ip6tnl0\x00'}) r13 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES64, @ANYRES8, @ANYRESHEX=r4, @ANYRES32=r4, @ANYRES16=r11, @ANYRES8=r2], 0x64}}, 0x40080) (async) sendmsg$IPCTNL_MSG_CT_NEW(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES64, @ANYRES8, @ANYRESHEX=r4, @ANYRES32=r4, @ANYRES16=r11, @ANYRES8=r2], 0x64}}, 0x40080) sendmsg$IPCTNL_MSG_CT_NEW(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYRES8=r13], 0x98}, 0x1, 0x0, 0x0, 0x24088853}, 0x2d423fadc5ff6975) (async) sendmsg$IPCTNL_MSG_CT_NEW(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYRES8=r13], 0x98}, 0x1, 0x0, 0x0, 0x24088853}, 0x2d423fadc5ff6975) 1.404795045s ago: executing program 4 (id=6047): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xb, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000810000000000000004000630162000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000140)={r0, &(0x7f0000000000)='\x00', 0x648000, &(0x7f0000000080)={@align=0xfffffffffffffff8, {0xec6, 0x7f, 0x6, 0x8}}, 0x6, &(0x7f0000000380), &(0x7f0000000100)=0xff}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000340)={0x0, 0x1, 0x2, 0x1, @vifc_lcl_ifindex=r2, @remote}, 0x10) 1.388237523s ago: executing program 3 (id=6048): getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, 0x0, 0x0) socket$kcm(0x2c, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x503, 0x800000, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x800, 0x20e9}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x93e000, 0x1000}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070001000080000001"], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000000)={r3, &(0x7f0000000f80), 0x0}, 0x20) close(r1) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000080)=0x1000000, 0x4) 1.310394052s ago: executing program 4 (id=6049): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x33, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x20}}, 0x4c051) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)={0x3c, r2, 0x1, 0x0, 0x0, {0x2c}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xb8410608002e4972, 0xffffffffffffffff, 0x0) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000000104010800000000000094f1544eae86a20a8656ca274500000a0000"], 0x20}, 0x1, 0x0, 0x0, 0x400c000}, 0x22000004) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000200)='batadv_slave_0\x00', 0x10) bind$xdp(r4, &(0x7f0000000340)={0x2c, 0x3, 0x0, 0x6}, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x74, r5, 0x500, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "881d28517db164ae280e120053b450bb45c0548ff80c58f5"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "eb8559f114f97c16a25970dc19102af893b14faef2ff868b"}], @NL80211_ATTR_MESH_ID={0xa}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) 1.252100193s ago: executing program 1 (id=6050): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'bridge_slave_0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600602fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.079962624s ago: executing program 0 (id=6051): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0xc}}], 0x30}], 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@can_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x1d, 0x1, 0x8}, [@CGW_DST_IF={0x8}, @CGW_SRC_IF={0x8}, @CGW_FILTER={0xc, 0xb, {{0x1, 0x1, 0x1, 0x1}, {0x3, 0x1, 0x1}}}]}, 0x30}}, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$BTRFS_IOC_SEND(r1, 0x40489426, &(0x7f0000000180)={{r2}, 0x7, &(0x7f0000000080)=[0x1c000000000000, 0x3, 0x6a9, 0x7, 0x1, 0x2, 0x0], 0xd7f}) 1.039036869s ago: executing program 4 (id=6052): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6", @ANYBLOB="0000000000000000280012000c000100766574"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0xf1d, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0xf7fffffa}}]}, 0x38}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x24, 0x66, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) 900.01325ms ago: executing program 2 (id=6053): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x10000, @value=r1}, 0x28) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={r2, 0xfffff000, 0xe, 0x0, &(0x7f0000000ec0)="61df712bc884fed5722780b605a7", 0x0, 0x3, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 761.039602ms ago: executing program 2 (id=6054): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xffe0}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@delchain={0xd4, 0x2c, 0xf31, 0x70bd28, 0x2000, {0x0, 0x0, 0x0, r6, {0x8}, {0xfff2, 0xffff}, {0xffff, 0xffe0}}, [@filter_kind_options=@f_u32={{0x8}, {0x60, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'ip6_vti0\x00'}, @TCA_U32_POLICE={0x10, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x3}]}, @TCA_U32_INDEV={0x14, 0x8, 'veth1_to_team\x00'}, @TCA_U32_DIVISOR={0x8, 0x4, 0x24}, @TCA_U32_DIVISOR={0x8, 0x4, 0x18}, @TCA_U32_INDEV={0x14, 0x8, 'geneve0\x00'}]}}, @filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x7c}, @TCA_U32_DIVISOR={0x8, 0x4, 0x78}]}}, @filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ICMPV4_CODE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0x0, 0xffffffff, 0xffffff00]}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) 746.249858ms ago: executing program 0 (id=6055): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x89}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x82, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) sendto$inet6(r1, &(0x7f0000000040)='n\"', 0x2, 0x24044054, &(0x7f0000000140)={0xa, 0x4e21, 0x9e11, @private0={0xfc, 0x0, '\x00', 0x1}, 0xa}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x89}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) setsockopt(r1, 0x84, 0x82, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) (async) sendto$inet6(r1, &(0x7f0000000040)='n\"', 0x2, 0x24044054, &(0x7f0000000140)={0xa, 0x4e21, 0x9e11, @private0={0xfc, 0x0, '\x00', 0x1}, 0xa}, 0x1c) (async) 684.171826ms ago: executing program 4 (id=6056): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4040844) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x1e, 0x4, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={r2, 0xffffffffffffffff}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x16, 0x11, &(0x7f0000000c80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x23ffd, 0x0, 0x0, 0x0, 0x9}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0xe, 0x0, &(0x7f00000000c0)="00000000000000ce94327fc1a80c", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x8c, 0x0, 0x7, 0x401, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x5}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x7}, @NFACCT_FILTER={0x54, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xd4}, @NFACCT_FILTER_MASK={0x8}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x7}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfff}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x40}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xe}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfff}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x1}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x9}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x2}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4}, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) 679.288741ms ago: executing program 1 (id=6057): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x48811}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0)=r1}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x7, &(0x7f0000000100)=@framed={{0x18, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x50}, 0x94) 558.501749ms ago: executing program 0 (id=6058): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3b8, 0x0, 0x98, 0x130, 0x1c8, 0x288, 0x0, 0x98, 0x130, 0x288, 0x320, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@length={{0x28}, {0x0, 0xffff}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) (async, rerun: 64) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) sendmsg$nl_xfrm(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@allocspi={0xf8, 0x16, 0x401, 0xfffffffd, 0xfffffffe, {{{@in=@multicast2, @in6=@private2, 0x4, 0x0, 0x4e20, 0x0, 0x0, 0x80, 0x20, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@dev={0xfe, 0x80, '\x00', 0x10}, 0x20000000, 0x6c}, @in6=@private1, {0x4, 0xfffffffffffffffe, 0x5, 0x0, 0x3, 0x0, 0x0, 0x2}, {0x4, 0x0, 0x0, 0x2}, {0x10000004, 0x0, 0x3}, 0xfffffffe, 0x0, 0xa, 0x0, 0x0, 0x90}, 0xc, 0xfffffffd}}, 0xf8}}, 0x0) (async) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2711, 0x0, &(0x7f0000000040)) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'veth0\x00', 0x0}) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000004100000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) (async) r6 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000008c0)={0xe4, 0x10, 0x509, 0x70bd29, 0x0, "", [@nested={0xd4, 0x67, 0x0, 0x1, [@typed={0x8, 0x138, 0x0, 0x0, @u32=0xffffff15}, @generic="b812139e98acb4b04d37664e50566f48b611f64db287b25fb648103db68af0f165fcfac4d1e5d5fb1e81501dc4a1335c5a88cfe1758329ad0e8374d64db3d22e288f013511acec2deab7fe99a5d463fd48eb083b2da8b7d7e1a5144383f216e4752d1f6aba78b5506ac716244389bc22cdcfa56a364e3c79b42996a22f5ba1a1a5d5f278c05f1a87d99f84852d997a81d3778ba757c48baa70521a13d01e89961754eac08bcc02047287f0f81ca0c3330a57dd74b1bdd10f90c577fa202f73a33d93a2e774044d83"]}]}, 0xe4}], 0x1}, 0x40040) (async) r7 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') ioctl$NS_GET_PARENT(r7, 0x8004b708, 0x0) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002d80)={r5, r4, 0x25, 0x8, @void}, 0x10) (async) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000004000)=ANY=[@ANYRES8=r2], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r8, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e0ffff2000ffffff84000aac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 480.633896ms ago: executing program 4 (id=6059): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0xc8}}, 0x20050800) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000bc0)={0xffffffffffffffff, 0x20, &(0x7f0000000b80)={&(0x7f0000000a00)=""/219, 0xdb, 0x0, &(0x7f0000000b00)=""/100, 0x64}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x9, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r0, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$inet(r5, 0x0, 0x20000000) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a090000000000000000000200000009000200737903000000000008000440000000000900010073797a300000"], 0x64}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x4, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040}, 0x4000000) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r9, 0x6, 0xc, &(0x7f0000000500)=0x6, 0x4) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="2400000003010102000000000000363f01"], 0x24}, 0x1, 0x0, 0x0, 0x8010}, 0x20004c00) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r7) sendmsg$BATADV_CMD_GET_VLAN(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000800)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="08002abd7000fedbdf25110000000600280003000000080031000400000008002b0008000000dd7f3858d39fd0058f9ea209581f8d2438de7da548bae0e11817b27d5b8146f80d88e9987a70ca1bfdb4b2cc8f3e12cc038c87225ee20fcc2f403308c630a7a52877f747775acc669eff2c5548346732d780c8cf07509b9f8345233aaecdf58c381995c0e93678e9e13e3913a768df4cd26250b8d23b3b15e0fcee49dce5a5301d3974b0ee2cc589d48a3111e080f0028b56c182c3d444f93a948f6a900abb5c3dd08d169e5ebc1969843d59319e2d534b21495e1f485d8167fc33962c00fdd1d3ef1a705da2fb"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4000) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nbd(&(0x7f0000000580), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r13, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x3c, r14, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r15}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000000) r16 = socket$nl_generic(0x10, 0x3, 0x10) r17 = syz_genetlink_get_family_id$tipc2(&(0x7f0000006340), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r16, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000700)=ANY=[@ANYBLOB="20000000d9579736125545a1c1d1d70173c9103f397f3916596e5436dc3af4193723e09235680d7fbe1b0f979650d89bf589f8e4975803a44b60c551a667729a0e1fee11575914cb28933e8e72df72cab3eeac9f7e9f5072218a9062fec88bc8074fa205ecfdbc809de703c550f00437beee3c1933c2d8a174614da6d1c0366d9426a1c1874356f284b91c409ab9358d306422a47f4f98dfcab2fd96202be539b8cae15187802fa85433429b70f77785e6b368f929ba38de5c", @ANYRES16=r17, @ANYBLOB="000125bd7000ffdbdf25140000000c0007800800020000000000"], 0x20}, 0x1, 0x0, 0x0, 0x60000000}, 0x4000000) sendmsg$NFT_MSG_GETCHAIN(r11, 0x0, 0x48000) 466.52502ms ago: executing program 1 (id=6060): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0xf, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x4e21, @private=0xa010102}], 0x10) recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfecc}, 0x40000002) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x88, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x7ff8, 0x2}}, [@TCA_STAB={0x64, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x1, 0x1000, 0x34, 0x1, 0x8, 0x80000001, 0x8}}, {0x14, 0x2, [0x4, 0xc000, 0x200, 0x2, 0x3, 0x5, 0x0, 0x0]}}, {{0x1c, 0x1, {0x10, 0xf, 0x5, 0x0, 0x0, 0x81, 0x1, 0x8}}, {0x14, 0x2, [0x7, 0x3, 0x7, 0x5, 0xb33, 0x5, 0x1ff, 0x8001]}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r7, {0xc, 0xc}, {0xe, 0xfff1}, {0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) socket$rds(0x15, 0x5, 0x0) 453.87253ms ago: executing program 2 (id=6061): socket$packet(0x11, 0x2, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) write$cgroup_devices(r1, 0x0, 0x9) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r2, &(0x7f0000000280)="db5d0cd298416bd6bfc4f8c43e466c39311d8b1237923f773da43734619d21637361f94be7ece28370f0c0e6a39a8177bb0cf9463c8ccda6df4cbc45f29b95d241c9597b34cfeb5976ad8e1c56b003b8b96d6c508b49ac0e2387e0a1e60ca433568b94f8b3c423f7d11b313db4153777df4e64c75d03ccb441559c2b124536be9c266055e18591e3249b5acbd7fd2071169d139f1c118d2f32d32092db5981410a37550e43677534b3e8649c34d77721b70a661eb21e85d7", 0xb8, 0x800, &(0x7f0000000340)={0x2, 0x4e21, @remote}, 0x10) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000000080)={r4}, 0x8) r5 = socket(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x4000002, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x10000}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4020000}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0xffffc000) 316.057559ms ago: executing program 0 (id=6062): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000004f00)={0x0, 0x0, &(0x7f0000004ec0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000002600030328bd7000fedbdf251f00000001e8650779862bdeaac24d5ee592704570646a4ffaa462ac2fc8c46b4ec24d28b628081d6ab508462e129e8bb22b589795460c855c7a02b1ca0740806eae8043cd327f2333e209398c3ee403337b0461fba9e621b4abc949172b0919bd9bfb3144c2326b5fd352c6ea04ea"], 0x14}, 0x1, 0x0, 0x0, 0x4000010}, 0x24000844) r2 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000000)=@srh={0xeb3eacc489ddbaca, 0x0, 0x4, 0x0, 0x0, 0x8}, 0x8) sendmsg$inet6(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0xa, 0x4e20, 0x3, @empty, 0x1}, 0x1c, 0x0}, 0x20048018) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x0, 0xe, 0x9, 0xc, 0x18, @local, @loopback={0xfec0ffff00000000, 0xffff8881114a4aa8}, 0x700, 0x3c0f, 0x4, 0x3d}}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x408d1}, 0x40800) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x15, 0x0, 0x1, 0x6}, {0x28}]}) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), r4) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001e80)={0x190, r6, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_PEERS={0x168, 0x8, 0x0, 0x1, [{0x88, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x60, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @local}, {0x5}}]}, {0x34, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}]}, {0x64, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e22, @multicast2}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x400}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}, {0x78, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "20aa14261c0233d2619118b287b194920473017087889d5685590e926dba4953"}, @WGPEER_A_ALLOWEDIPS={0x2c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x190}, 0x1, 0x0, 0x0, 0xc004}, 0x4000040) 0s ago: executing program 2 (id=6063): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x1, 0x4, 0x8}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x8, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x102}, [@jmp={0x6, 0x0, 0xd, 0x0, 0x0, 0x1, 0x25}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, &(0x7f0000000040)=[0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x4c, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0x63, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000feffff7f00000000feffffff611051000000000095"], &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r3}, 0xc) kernel console output (not intermixed with test programs): type 1 has an invalid length. [ 944.971911][T23263] netlink: 'syz.0.4206': attribute type 2 has an invalid length. [ 945.271459][T23271] syzkaller1: tun_chr_ioctl cmd 2147767506 [ 945.345638][T23285] bridge2: entered promiscuous mode [ 945.368495][T23285] bridge2: entered allmulticast mode [ 946.525980][T23324] Unsupported ieee802154 address type: 0 [ 946.540409][T23324] gretap0: entered promiscuous mode [ 946.555719][T23326] syzkaller1: tun_chr_ioctl cmd 2147767521 [ 946.564421][T23325] syzkaller1: tun_chr_ioctl cmd 2147767521 [ 946.574111][T23326] __nla_validate_parse: 2 callbacks suppressed [ 946.574124][T23326] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.4218'. [ 946.590891][T23325] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.4218'. [ 946.657091][T23329] syzkaller0: entered promiscuous mode [ 946.663171][T23329] syzkaller0: entered allmulticast mode [ 946.966664][T23309] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 947.193846][T23341] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 947.458907][T23347] sctp: [Deprecated]: syz.2.4223 (pid 23347) Use of struct sctp_assoc_value in delayed_ack socket option. [ 947.458907][T23347] Use struct sctp_sack_info instead [ 947.752825][T23374] : renamed from veth0_to_bond (while UP) [ 948.071152][T23393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4234'. [ 948.102688][T23393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4234'. [ 948.126168][T23393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4234'. [ 948.605499][T23418] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4238'. [ 948.699014][T23421] syzkaller1: entered promiscuous mode [ 948.801208][T23431] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4243'. [ 949.238203][T23455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4251'. [ 950.228744][T23498] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4262'. [ 950.309778][T23503] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4263'. [ 950.526501][T23519] can: request_module (can-proto-0) failed. [ 950.913940][T23539] veth0_to_hsr: entered promiscuous mode [ 950.927071][T23539] veth0_to_hsr: left promiscuous mode [ 951.172731][T23546] erspan0: entered promiscuous mode [ 951.188337][T23548] netlink: 'syz.4.4275': attribute type 32 has an invalid length. [ 951.208081][T23545] erspan0: left promiscuous mode [ 951.237041][T23548] pim6reg1: entered promiscuous mode [ 951.276404][T23548] pim6reg1: entered allmulticast mode [ 951.544404][T23561] lo speed is unknown, defaulting to 1000 [ 951.552911][T23562] siw: device registration error -23 [ 951.559629][T23561] lo speed is unknown, defaulting to 1000 [ 951.611929][T23561] lo speed is unknown, defaulting to 1000 [ 951.645512][T23561] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 951.663500][T23561] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 951.681339][T23561] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 951.729687][T23561] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 951.758209][T23569] __nla_validate_parse: 7 callbacks suppressed [ 951.758230][T23569] netlink: 176 bytes leftover after parsing attributes in process `syz.0.4282'. [ 951.853452][T23561] lo speed is unknown, defaulting to 1000 [ 951.891443][T23561] lo speed is unknown, defaulting to 1000 [ 951.907355][T23561] lo speed is unknown, defaulting to 1000 [ 951.908855][T23569] can: request_module (can-proto-0) failed. [ 951.926685][T23561] lo speed is unknown, defaulting to 1000 [ 951.943322][T23561] lo speed is unknown, defaulting to 1000 [ 951.962785][T23561] lo speed is unknown, defaulting to 1000 [ 951.981286][T23561] lo speed is unknown, defaulting to 1000 [ 952.237629][T23583] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 952.280721][T23585] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4285'. [ 952.577252][T23596] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4289'. [ 952.624732][T23598] netlink: 'syz.1.4290': attribute type 3 has an invalid length. [ 952.655525][T23601] x_tables: duplicate underflow at hook 1 [ 952.958425][T23620] netlink: 176 bytes leftover after parsing attributes in process `syz.0.4297'. [ 953.024144][T23628] netlink: 124 bytes leftover after parsing attributes in process `syz.4.4299'. [ 953.087390][T23620] can: request_module (can-proto-0) failed. [ 953.103974][T23633] syzkaller0: entered promiscuous mode [ 953.116004][T23633] syzkaller0: entered allmulticast mode [ 953.390176][T23649] netlink: 'syz.3.4301': attribute type 23 has an invalid length. [ 953.479279][T23635] lo speed is unknown, defaulting to 1000 [ 953.630053][T23653] bond0 (unregistering): (slave syz_tun): Releasing backup interface [ 953.670696][T23653] bond0 (unregistering): Released all slaves [ 953.922834][T23662] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4305'. [ 953.971123][T23662] macvlan0: left promiscuous mode [ 954.000666][T23662] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4305'. [ 954.105522][T23674] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4305'. [ 954.335621][T23681] netlink: 256 bytes leftover after parsing attributes in process `syz.4.4310'. [ 954.366954][T23681] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4310'. [ 954.594016][T23696] 8021q: VLANs not supported on vcan0 [ 954.696219][T23692] can: request_module (can-proto-0) failed. [ 955.004115][T23720] Cannot find del_set index 3 as target [ 955.797023][T23760] netlink: 'syz.1.4334': attribute type 1 has an invalid length. [ 955.838514][T23764] netlink: 'syz.4.4335': attribute type 1 has an invalid length. [ 955.955557][T23760] bond5: entered promiscuous mode [ 955.964163][T23760] 8021q: adding VLAN 0 to HW filter on device bond5 [ 955.998420][T23768] netdevsim netdevsim2: Firmware load for './file0/file0/../file0' refused, path contains '..' component [ 956.016020][T23760] bond5: entered allmulticast mode [ 956.071094][T23770] can: request_module (can-proto-0) failed. [ 956.122922][T23766] bond5: (slave bridge3): making interface the new active one [ 956.131268][T23766] bridge3: entered promiscuous mode [ 956.141623][T23766] bridge3: entered allmulticast mode [ 956.167348][T23766] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 956.948634][T23805] set match dimension is over the limit! [ 957.192617][T23792] __nla_validate_parse: 7 callbacks suppressed [ 957.192636][T23792] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4341'. [ 957.260281][T23822] syzkaller1: entered promiscuous mode [ 957.266531][T23822] syzkaller1: entered allmulticast mode [ 957.648233][T23833] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4351'. [ 957.672218][T23836] ip_tables: iptables: counters copy to user failed while replacing table [ 957.748181][T23843] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4352'. [ 957.830276][T23833] can: request_module (can-proto-0) failed. [ 958.078394][T23855] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 958.526024][T23878] IPv6: Can't replace route, no match found [ 958.629549][T23883] sctp: [Deprecated]: syz.4.4361 (pid 23883) Use of struct sctp_assoc_value in delayed_ack socket option. [ 958.629549][T23883] Use struct sctp_sack_info instead [ 958.859050][ T30] audit: type=1804 audit(1786714683.408:17): pid=23893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4363" name="/newroot/250/memory.events" dev="tmpfs" ino=1310 res=1 errno=0 [ 958.925998][ T30] audit: type=1800 audit(1786714683.408:18): pid=23893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4363" name="memory.events" dev="tmpfs" ino=1310 res=0 errno=0 [ 958.971186][ T30] audit: type=1804 audit(1786714683.448:19): pid=23893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.4363" name="/newroot/250/memory.events" dev="tmpfs" ino=1310 res=1 errno=0 [ 959.128758][T23899] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4365'. [ 959.196592][T14117] IPVS: starting estimator thread 0... [ 959.205778][T23904] IPVS: rr: UDP 127.0.0.1:10000 - no destination available [ 959.337936][T23905] IPVS: using max 29 ests per chain, 69600 per kthread [ 959.556334][T23924] bridge6: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 959.713185][T23934] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4374'. [ 959.889595][T23941] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4375'. [ 960.126020][T23948] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4377'. [ 960.634175][T23966] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4382'. [ 960.688908][T23969] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4380'. [ 960.985460][T23985] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4386'. [ 961.030490][T23988] ipvlan2: entered promiscuous mode [ 961.200647][ T30] audit: type=1800 audit(1786714685.748:20): pid=24001 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4388" name=680B20 dev="tmpfs" ino=1342 res=0 errno=0 [ 961.272827][ T30] audit: type=1800 audit(1786714685.818:21): pid=24001 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4388" name=680B20 dev="tmpfs" ino=1342 res=0 errno=0 [ 961.934340][ T50] Bluetooth: hci2: command 0x0406 tx timeout [ 962.061367][T24034] syzkaller1: entered allmulticast mode [ 962.080481][ T5270] netdevsim netdevsim0 netdevsim3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 962.113577][ T5270] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 962.259077][T24047] netlink: 'syz.2.4398': attribute type 23 has an invalid length. [ 962.564492][T24083] __nla_validate_parse: 1 callbacks suppressed [ 962.564513][T24083] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4401'. [ 963.098084][T24113] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4414'. [ 963.113927][T24114] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4413'. [ 963.348279][T24127] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4419'. [ 963.421857][T24127] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4419'. [ 963.455164][T24127] syz_tun: left promiscuous mode [ 963.487550][T24127] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 963.557897][ T5725] lo speed is unknown, defaulting to 1000 [ 963.598552][T24135] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4420'. [ 963.677556][T24139] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4422'. [ 964.390454][T24189] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4436'. [ 964.462278][T24187] block nbd3: server does not support multiple connections per device. [ 964.481125][T24193] x_tables: duplicate underflow at hook 3 [ 964.488356][T24187] block nbd3: shutting down sockets [ 964.527150][T24189] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4436'. [ 964.538660][T24192] xt_hashlimit: size too large, truncated to 1048576 [ 964.601234][T24196] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4438'. [ 965.258348][T24220] ip_tables: iptables: counters copy to user failed while replacing table [ 965.712071][T24246] lo speed is unknown, defaulting to 1000 [ 966.246913][T24272] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 966.401941][T24283] bond4: option arp_all_targets: invalid value (3) [ 966.468885][T24283] bond4 (unregistering): Released all slaves [ 966.533169][T24299] netlink: 'syz.3.4465': attribute type 1 has an invalid length. [ 966.753717][T24299] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 966.878598][T24308] lo speed is unknown, defaulting to 1000 [ 967.082256][T24328] netlink: 'syz.4.4473': attribute type 12 has an invalid length. [ 967.157443][T24327] vlan4: entered allmulticast mode [ 967.230463][T24328] bond0: option primary_reselect: invalid value (181) [ 967.284375][T24332] bond4: Removing last arp target with arp_interval on [ 967.525467][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 967.668736][T24355] __nla_validate_parse: 15 callbacks suppressed [ 967.668759][T24355] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4479'. [ 967.781459][T24359] x_tables: duplicate underflow at hook 1 [ 967.813312][T24364] netlink: 'syz.1.4481': attribute type 11 has an invalid length. [ 967.879964][T24364] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4481'. [ 968.049578][T24375] netlink: 'syz.3.4484': attribute type 1 has an invalid length. [ 968.099702][T24375] bond5: entered promiscuous mode [ 968.118400][T24375] 8021q: adding VLAN 0 to HW filter on device bond5 [ 968.211107][T24376] 8021q: adding VLAN 0 to HW filter on device bond5 [ 968.218553][T24376] bond5: (slave xfrm1): The slave device specified does not support setting the MAC address [ 968.229050][T24376] bond5: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 968.245165][T24376] bond5: (slave xfrm1): making interface the new active one [ 968.252984][T24376] xfrm1: entered promiscuous mode [ 968.260156][T24376] bond5: (slave xfrm1): Enslaving as an active interface with an up link [ 968.324161][T24385] pimreg: entered allmulticast mode [ 968.329775][T24385] pimreg: left allmulticast mode [ 968.470843][T24389] sctp: [Deprecated]: syz.3.4487 (pid 24389) Use of int in max_burst socket option deprecated. [ 968.470843][T24389] Use struct sctp_assoc_value instead [ 969.057989][ C0] vcan0: j1939_tp_rxtimer: 0xffff888062cf0c00: rx timeout, send abort [ 969.068869][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888062cf0c00: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 969.193022][T24426] netlink: 'syz.4.4495': attribute type 3 has an invalid length. [ 969.306027][T24430] netlink: 284 bytes leftover after parsing attributes in process `syz.4.4495'. [ 969.334731][T24433] netlink: 'syz.0.4497': attribute type 12 has an invalid length. [ 969.355773][T24433] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4497'. [ 969.819938][T24457] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4505'. [ 969.855824][T24457] hsr_slave_1 (unregistering): left promiscuous mode [ 970.274171][T24478] tipc: Started in network mode [ 970.289825][T24478] tipc: Node identity ac141441, cluster identity 4711 [ 970.313485][T24478] tipc: Enabled bearer , priority 10 [ 970.343328][T24483] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4512'. [ 970.538374][T24499] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4516'. [ 970.706702][T24494] netlink: 'syz.1.4515': attribute type 5 has an invalid length. [ 970.770646][T24504] tipc: Enabling of bearer rejected, already enabled [ 970.814812][T24506] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4521'. [ 971.044696][ T30] audit: type=1804 audit(1786714695.598:22): pid=24520 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4524" name="/newroot/339/cgroup.controllers" dev="tmpfs" ino=1752 res=1 errno=0 [ 971.108832][ T30] audit: type=1800 audit(1786714695.598:23): pid=24520 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4524" name="cgroup.controllers" dev="tmpfs" ino=1752 res=0 errno=0 [ 971.239266][T24542] netlink: 'syz.0.4526': attribute type 13 has an invalid length. [ 971.251404][T24542] netlink: 'syz.0.4526': attribute type 17 has an invalid length. [ 971.587354][T24527] bridge0: port 1(vlan3) entered disabled state [ 972.318851][T24527] tipc: Resetting bearer [ 972.342927][T24527] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 972.417861][T24531] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4526'. [ 972.616374][T24542] 8021q: adding VLAN 0 to HW filter on device bond0 [ 972.635437][T24542] 8021q: adding VLAN 0 to HW filter on device team0 [ 972.661180][T24572] netlink: 'syz.2.4533': attribute type 3 has an invalid length. [ 972.663171][T24571] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.4534'. [ 972.685396][T24572] netlink: 'syz.2.4533': attribute type 16 has an invalid length. [ 972.692394][T24542] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 972.706370][T24572] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4533'. [ 972.747170][T24542] bridge_slave_0: left promiscuous mode [ 972.792620][T24542] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 972.808749][ T29] tipc: Node number set to 2886997057 [ 972.824922][ T5725] bridge0: port 1(vlan3) entered blocking state [ 972.833486][ T5725] bridge0: port 1(vlan3) entered forwarding state [ 973.019152][T24582] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4536'. [ 973.034153][T24582] netlink: 'syz.1.4536': attribute type 1 has an invalid length. [ 973.045290][T24582] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4536'. [ 973.056547][T24582] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4536'. [ 973.058422][T24576] syzkaller1: entered promiscuous mode [ 973.077926][T24576] syzkaller1: entered allmulticast mode [ 973.249098][T24584] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4538'. [ 973.282207][ T1001] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.295482][ T1001] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.321152][T24583] netlink: zone id is out of range [ 973.325192][ T1001] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.333863][T24583] netlink: zone id is out of range [ 973.348077][T24583] netlink: zone id is out of range [ 973.362298][T24583] netlink: zone id is out of range [ 973.372646][T24583] netlink: zone id is out of range [ 973.384600][T24583] netlink: zone id is out of range [ 973.397759][T24583] netlink: zone id is out of range [ 973.406702][T24583] netlink: zone id is out of range [ 973.416747][T24583] netlink: zone id is out of range [ 973.556565][ T12] IPVS: starting estimator thread 0... [ 973.651867][T24604] IPVS: using max 28 ests per chain, 67200 per kthread [ 973.660025][T24606] netlink: 176 bytes leftover after parsing attributes in process `syz.4.4543'. [ 973.673667][T24608] netlink: 176 bytes leftover after parsing attributes in process `syz.0.4544'. [ 973.740935][T24606] can: request_module (can-proto-0) failed. [ 973.788893][T24608] can: request_module (can-proto-0) failed. [ 974.098368][T24627] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4547'. [ 974.116573][T24627] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 974.224467][T24627] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 974.506761][T24640] netlink: 'syz.4.4552': attribute type 1 has an invalid length. [ 974.515397][T24640] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4552'. [ 974.524722][T24640] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4552'. [ 974.777014][T24654] netlink: 'syz.3.4556': attribute type 2 has an invalid length. [ 974.874751][T24664] 8021q: VLANs not supported on ip_vti0 [ 974.950264][T24670] lo: entered promiscuous mode [ 974.971067][T24670] tunl0: entered promiscuous mode [ 974.989238][T24670] gre0: entered promiscuous mode [ 974.996542][T24670] gretap0: entered promiscuous mode [ 975.002730][T24670] erspan0: entered promiscuous mode [ 975.008587][T24670] ip_vti0: entered promiscuous mode [ 975.014924][T24670] ip6_vti0: entered promiscuous mode [ 975.020853][T24670] sit0: entered promiscuous mode [ 975.027326][T24670] ip6tnl0: entered promiscuous mode [ 975.036274][T24670] ip6gre0: entered promiscuous mode [ 975.056564][T24670] syz_tun: entered promiscuous mode [ 975.066236][T24670] ip6gretap0: entered promiscuous mode [ 975.077205][T24674] can: request_module (can-proto-0) failed. [ 975.083926][T24670] bridge0: entered promiscuous mode [ 975.090046][T24670] vcan0: entered promiscuous mode [ 975.101570][T24670] dummy0: entered promiscuous mode [ 975.120911][T24670] nlmon0: entered promiscuous mode [ 975.131103][T24670] vxcan0: entered promiscuous mode [ 975.145151][T24670] vxcan1: entered promiscuous mode [ 975.157076][T24670] veth0: entered promiscuous mode [ 975.168715][T24670] veth1: entered promiscuous mode [ 975.187653][T24670] wg0: entered promiscuous mode [ 975.210599][T24670] wg1: entered promiscuous mode [ 975.227899][T24670] wg2: entered promiscuous mode [ 975.247095][T24670] veth0_to_bridge: entered promiscuous mode [ 975.265582][T24670] veth1_to_bridge: entered promiscuous mode [ 975.279320][T24670] veth0_to_bond: entered promiscuous mode [ 975.299322][T24670] veth1_to_bond: entered promiscuous mode [ 975.311432][T24670] veth0_to_team: entered promiscuous mode [ 975.328260][T24670] team_slave_0: entered promiscuous mode [ 975.352976][T24670] veth1_to_team: entered promiscuous mode [ 975.379697][T24670] team_slave_1: entered promiscuous mode [ 975.390276][T24670] veth1_to_batadv: entered promiscuous mode [ 975.397200][T24670] batadv_slave_1: entered promiscuous mode [ 975.405801][T24670] xfrm0: entered promiscuous mode [ 975.411536][T24670] veth0_to_hsr: entered promiscuous mode [ 975.995392][T24712] bridge0: port 2(bridge_slave_1) entered disabled state [ 976.005983][T24712] bridge0: port 1(bridge_slave_0) entered disabled state [ 976.270400][T24718] syzkaller0: entered allmulticast mode [ 976.456202][T24732] netlink: 'syz.3.4579': attribute type 11 has an invalid length. [ 976.568600][T24740] netlink: 'syz.3.4582': attribute type 1 has an invalid length. [ 976.635615][T24740] 8021q: adding VLAN 0 to HW filter on device bond6 [ 976.888380][T24757] lo speed is unknown, defaulting to 1000 [ 977.123578][T24767] syzkaller0: entered promiscuous mode [ 977.129208][T24767] syzkaller0: entered allmulticast mode [ 979.124937][T24779] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 979.133776][T24779] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 979.156521][T24779] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 979.162586][T24779] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 979.176615][T24779] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 979.183760][T24779] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 979.208495][T24779] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 979.214917][T24779] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 979.317735][T24725] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 979.667795][T24810] __nla_validate_parse: 19 callbacks suppressed [ 979.667815][T24810] netlink: 100 bytes leftover after parsing attributes in process `syz.1.4596'. [ 979.715167][T24810] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4596'. [ 979.728409][T24810] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4596'. [ 979.760747][T24810] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4596'. [ 980.027227][T24829] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4603'. [ 980.045057][T24827] netlink: 'syz.3.4602': attribute type 8 has an invalid length. [ 980.086444][T24827] netlink: 'syz.3.4602': attribute type 1 has an invalid length. [ 980.247955][T24827] bond7: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 980.257811][T24824] bridge0: port 1(bridge_slave_0) entered forwarding state [ 980.318375][T24841] veth5: entered promiscuous mode [ 980.329052][T24841] bond7: (slave veth5): Enslaving as a backup interface with a down link [ 980.360230][T24827] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4602'. [ 980.376915][T14115] net_ratelimit: 98 callbacks suppressed [ 980.376936][T14115] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 980.378385][T24827] 8021q: adding VLAN 0 to HW filter on device bond7 [ 980.463530][T24845] pim6reg1: entered promiscuous mode [ 980.469213][T24845] pim6reg1: entered allmulticast mode [ 980.523901][T14110] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 980.616362][T24847] syzkaller1: entered promiscuous mode [ 980.622397][T24847] syzkaller1: entered allmulticast mode [ 980.749990][T24860] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4612'. [ 981.114022][T24890] gre1: entered promiscuous mode [ 981.137592][T24890] gre1: entered allmulticast mode [ 981.150568][T24894] netlink: 27 bytes leftover after parsing attributes in process `syz.0.4620'. [ 981.181534][T24893] netlink: zone id is out of range [ 981.381543][T24909] netlink: 'syz.2.4627': attribute type 4 has an invalid length. [ 981.394825][T24909] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4627'. [ 981.759257][T24927] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4633'. [ 982.025780][T24944] ipvlan2: entered promiscuous mode [ 982.069737][T24949] Dead loop on virtual device ip6_vti0 (net 807), fix it urgently! [ 982.883750][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 983.110291][T24988] 8021q: adding VLAN 0 to HW filter on device bond7 [ 983.133907][T24988] bond6: (slave bond7): Enslaving as an active interface with an up link [ 983.210285][T25001] bond8: option ad_actor_sys_prio: invalid value (0) [ 983.225146][T25001] bond8: option ad_actor_sys_prio: allowed values 1 - 65535 [ 983.243776][T25001] bond8 (unregistering): Released all slaves [ 984.024899][T25064] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 984.424347][T25089] bond0 (unregistering): left allmulticast mode [ 984.431508][T25089] bond_slave_0: left allmulticast mode [ 984.437965][T25089] bond_slave_1: left allmulticast mode [ 984.444117][T25089] netdevsim netdevsim4 netdevsim1: left allmulticast mode [ 984.452409][T25089] bridge0: port 3(bond0) entered disabled state [ 984.468780][T25089] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 984.503719][T25089] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 984.535938][T25089] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 984.545931][T25089] netdevsim netdevsim4 netdevsim1: left promiscuous mode [ 984.573035][T25089] bond0 (unregistering): Released all slaves [ 984.781263][T25104] __nla_validate_parse: 6 callbacks suppressed [ 984.781279][T25104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4678'. [ 984.817241][T25104] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4678'. [ 984.832499][T25107] netlink: 'syz.4.4679': attribute type 11 has an invalid length. [ 984.867222][T25109] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 984.885217][T25109] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4680'. [ 984.910979][T25109] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 984.928029][T25111] netlink: 'syz.4.4679': attribute type 1 has an invalid length. [ 984.938264][T25111] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4679'. [ 984.952190][ T30] audit: type=1800 audit(1786714709.498:24): pid=25109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4680" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1515 res=0 errno=0 [ 984.979344][T25109] netlink: 'syz.0.4680': attribute type 2 has an invalid length. [ 984.999360][T25109] netlink: 'syz.0.4680': attribute type 8 has an invalid length. [ 985.015442][T25109] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4680'. [ 985.019398][T25114] netlink: 108 bytes leftover after parsing attributes in process `syz.1.4681'. [ 985.035640][T25113] IPVS: lc: FWM 3 0x00000003 - no destination available [ 985.200427][T25119] netlink: 600 bytes leftover after parsing attributes in process `syz.0.4682'. [ 985.233810][T25119] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 985.693507][T25151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4690'. [ 985.711243][T25150] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 985.712353][T25151] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4690'. [ 985.731177][T25151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4690'. [ 985.752416][T25155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 985.880106][T25159] ipvlan3: entered promiscuous mode [ 985.889995][T25159] bridge0: port 3(ipvlan3) entered blocking state [ 985.898309][T25159] bridge0: port 3(ipvlan3) entered disabled state [ 985.906470][T25159] ipvlan3: entered allmulticast mode [ 985.939907][T25159] ipvlan3: left allmulticast mode [ 986.349114][T25179] tap0: tun_chr_ioctl cmd 1074025677 [ 986.373003][T25179] tap0: linktype set to 805 [ 986.666567][T25201] netlink: 'syz.2.4704': attribute type 2 has an invalid length. [ 987.627593][T25247] syzkaller0: left promiscuous mode [ 987.641776][T25247] syzkaller0: left allmulticast mode [ 987.807623][T25257] rdma_rxe: rxe_newlink: failed to add veth1_vlan [ 989.015962][T25299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 989.048348][T25299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 989.075133][T25299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 989.290046][T25317] openvswitch: netlink: Missing key (keys=40, expected=100) [ 989.526110][T25324] smc: net device lo applied user defined pnetid SYZ2 [ 989.553915][T25324] smc: net device lo erased user defined pnetid SYZ2 [ 989.868560][T25337] __nla_validate_parse: 13 callbacks suppressed [ 989.868581][T25337] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4740'. [ 989.917383][T25337] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4740'. [ 990.145221][T25359] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4748'. [ 990.310805][T25366] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4751'. [ 990.340951][T25364] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4751'. [ 990.499746][T25378] Timeout policy `syz0' can only be used by L3 protocol number 0 [ 990.577738][T25381] netlink: 80 bytes leftover after parsing attributes in process `syz.4.4753'. [ 990.676737][T25365] batadv_slave_0: entered allmulticast mode [ 990.692627][T25365] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4749'. [ 990.708150][T25365] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 991.152090][T25401] netlink: 616 bytes leftover after parsing attributes in process `syz.1.4761'. [ 991.238188][T25410] netlink: 'syz.4.4762': attribute type 1 has an invalid length. [ 991.280969][T25410] 8021q: adding VLAN 0 to HW filter on device bond0 [ 991.337527][T25410] bond0: (slave veth3): Enslaving as an active interface with a down link [ 991.420646][T25410] bond0: (slave veth5): Enslaving as an active interface with a down link [ 991.917917][T25441] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4773'. [ 991.969180][T25441] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 992.031101][T25444] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4774'. [ 992.280940][T25462] netlink: 'syz.2.4781': attribute type 4 has an invalid length. [ 992.335753][T25466] netlink: 'syz.2.4781': attribute type 4 has an invalid length. [ 992.480135][T25472] netlink: 'syz.0.4785': attribute type 4 has an invalid length. [ 992.500547][T25474] netlink: 'syz.0.4785': attribute type 4 has an invalid length. [ 993.576800][T25537] tbf_change: 12 callbacks suppressed [ 993.576822][T25537] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 993.788435][T25544] netlink: 'syz.1.4806': attribute type 4 has an invalid length. [ 994.129658][T25566] can: request_module (can-proto-0) failed. [ 994.965244][T25609] netlink: 'syz.0.4820': attribute type 2 has an invalid length. [ 995.263353][T25629] __nla_validate_parse: 9 callbacks suppressed [ 995.263374][T25629] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4824'. [ 995.379912][T25636] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4829'. [ 995.393653][T25636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4829'. [ 995.547268][T25643] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4831'. [ 995.701333][T25650] netlink: 176 bytes leftover after parsing attributes in process `syz.2.4833'. [ 995.724179][T25650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4833'. [ 995.774412][T25653] sctp: [Deprecated]: syz.4.4834 (pid 25653) Use of int in max_burst socket option. [ 995.774412][T25653] Use struct sctp_assoc_value instead [ 995.897380][T25650] can: request_module (can-proto-0) failed. [ 996.357835][T25675] geneve4: entered promiscuous mode [ 996.452541][T14115] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 996.470111][T14115] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 996.487754][T14115] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 996.508260][T14115] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 996.654623][T25695] netlink: zone id is out of range [ 996.668164][T25695] netlink: zone id is out of range [ 996.678223][T25695] netlink: zone id is out of range [ 996.689983][T25695] netlink: zone id is out of range [ 996.701100][T25695] netlink: zone id is out of range [ 996.711113][T25695] netlink: zone id is out of range [ 996.727231][T25695] netlink: zone id is out of range [ 996.733675][T25699] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4844'. [ 996.764711][T25695] netlink: zone id is out of range [ 996.781937][T25695] netlink: zone id is out of range [ 996.798568][T25695] netlink: zone id is out of range [ 996.843652][T25702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4845'. [ 996.871928][T25702] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4845'. [ 996.890272][T25702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4845'. [ 996.908159][T25702] netlink: 'syz.1.4845': attribute type 5 has an invalid length. [ 997.797442][T25740] Cannot find add_set index 0 as target [ 997.899516][T25734] can: request_module (can-proto-0) failed. [ 998.031371][ T30] audit: type=1804 audit(1786714722.578:25): pid=25748 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4857" name="/newroot/352/cgroup.controllers" dev="tmpfs" ino=1833 res=1 errno=0 [ 998.104942][ T30] audit: type=1800 audit(1786714722.578:26): pid=25748 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4857" name="cgroup.controllers" dev="tmpfs" ino=1833 res=0 errno=0 [ 998.893109][T25798] Cannot find del_set index 4 as target [ 998.908305][T25795] IPVS: persistence engine module ip_vs_pe_ not found [ 999.273379][T25813] tipc: Enabling of bearer rejected, already enabled [ 999.284976][T25813] netlink: 'syz.3.4876': attribute type 1 has an invalid length. [ 999.353959][T25813] bond8: entered promiscuous mode [ 999.359568][T25813] 8021q: adding VLAN 0 to HW filter on device bond8 [ 999.372934][T25817] bond8: entered allmulticast mode [ 999.414670][T25813] bond8: (slave bridge9): making interface the new active one [ 999.422562][T25813] bridge9: entered promiscuous mode [ 999.428154][T25813] bridge9: entered allmulticast mode [ 999.444412][T25813] bond8: (slave bridge9): Enslaving as an active interface with an up link [ 999.523689][T25819] can: request_module (can-proto-0) failed. [ 999.648896][T25828] netlink: 'syz.0.4880': attribute type 15 has an invalid length. [ 1000.038183][T25856] tipc: Enabling of bearer rejected, already enabled [ 1000.060477][T25856] syzkaller0: entered promiscuous mode [ 1000.070351][T25856] syzkaller0: entered allmulticast mode [ 1000.108186][T25860] bond1: entered allmulticast mode [ 1000.114654][T25860] ipip0: entered allmulticast mode [ 1000.309293][T25853] bond1: left allmulticast mode [ 1000.324947][T25853] ipip0: left allmulticast mode [ 1000.606112][T25894] __nla_validate_parse: 21 callbacks suppressed [ 1000.606135][T25894] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4896'. [ 1000.655371][T25879] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4896'. [ 1000.801391][T25904] netlink: 176 bytes leftover after parsing attributes in process `syz.4.4900'. [ 1000.894490][T25907] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4902'. [ 1000.952782][T25904] can: request_module (can-proto-0) failed. [ 1001.003223][T25907] syzkaller0: entered promiscuous mode [ 1001.023643][T25907] syzkaller0: entered allmulticast mode [ 1001.580065][T25939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4911'. [ 1001.757291][T25943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4912'. [ 1001.772970][T25943] netlink: 'syz.1.4912': attribute type 32 has an invalid length. [ 1001.792134][T25943] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4912'. [ 1001.871806][T25958] netlink: 'syz.2.4917': attribute type 1 has an invalid length. [ 1001.917015][T25958] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1002.014098][T25958] bond4: (slave geneve2): making interface the new active one [ 1002.039226][T25958] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 1002.230963][T25972] netlink: 'syz.2.4921': attribute type 1 has an invalid length. [ 1002.276891][T25972] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1002.314173][T25972] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 1002.347473][T25972] netlink: 'syz.2.4921': attribute type 10 has an invalid length. [ 1002.379032][T25972] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4921'. [ 1002.393421][T25972] dummy0: entered promiscuous mode [ 1002.410579][T25972] bond5: (slave dummy0): Releasing backup interface [ 1002.725530][T25993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4928'. [ 1003.007222][T26008] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4933'. [ 1004.201151][T26070] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 1004.231584][T26070] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 1004.344547][T26054] net_ratelimit: 1705 callbacks suppressed [ 1004.344572][T26054] ip_tables: iptables: counters copy to user failed while replacing table [ 1004.465893][T26077] tipc: Resetting bearer [ 1004.612283][T26087] siw: device registration error -23 [ 1004.885021][T26092] can: request_module (can-proto-0) failed. [ 1005.662326][T26135] bridge_slave_0: left allmulticast mode [ 1005.682365][T26135] bridge0: port 1(bridge_slave_0) entered disabled state [ 1005.732921][T26135] bridge_slave_1: left allmulticast mode [ 1005.758466][T26135] bridge0: port 2(bridge_slave_1) entered disabled state [ 1005.825567][T26135] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1006.097504][T26145] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1006.348031][T26145] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1006.369793][T26171] tipc: New replicast peer: 255.255.255.255 [ 1006.382643][T26171] tipc: Enabled bearer , priority 10 [ 1006.414598][T26171] __nla_validate_parse: 4 callbacks suppressed [ 1006.414620][T26171] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4975'. [ 1006.475894][T26178] netlink: 'syz.0.4975': attribute type 1 has an invalid length. [ 1006.499943][T26177] netlink: 176 bytes leftover after parsing attributes in process `syz.2.4977'. [ 1006.572837][T26180] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4975'. [ 1006.596458][T26145] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1006.633702][T26171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4975'. [ 1006.660262][T26171] netlink: 'syz.0.4975': attribute type 3 has an invalid length. [ 1006.691275][T26171] netlink: 'syz.0.4975': attribute type 5 has an invalid length. [ 1006.694836][T26182] can: request_module (can-proto-0) failed. [ 1006.720797][T26171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4975'. [ 1006.773293][T26145] netdevsim netdevsim1 €Â (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1006.909857][T26171] geneve3: entered promiscuous mode [ 1006.928276][T26171] geneve3: entered allmulticast mode [ 1006.965276][T14115] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 46648 - 0 [ 1006.995951][T26188] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4978'. [ 1007.008761][T14115] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 46648 - 0 [ 1007.041989][T14115] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 46648 - 0 [ 1007.443861][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.462294][ T12] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.479994][ T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.531927][ T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.957168][T26240] netlink: 'syz.3.4992': attribute type 2 has an invalid length. [ 1007.968120][T26240] netlink: 'syz.3.4992': attribute type 2 has an invalid length. [ 1007.978114][T26240] netlink: 67 bytes leftover after parsing attributes in process `syz.3.4992'. [ 1008.059329][T26242] tipc: Enabling of bearer rejected, already enabled [ 1008.234780][T26252] mac80211_hwsim hwsim47 syzkaller0: left promiscuous mode [ 1008.722153][T12247] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1008.742673][T12247] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1008.767218][T12247] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1008.790793][T12247] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1009.035595][T26292] mac80211_hwsim hwsim47 syzkaller0: left allmulticast mode [ 1009.050694][T26296] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5010'. [ 1009.461896][T26323] netlink: 176 bytes leftover after parsing attributes in process `syz.1.5017'. [ 1009.507737][T26321] netlink: 232 bytes leftover after parsing attributes in process `syz.2.5016'. [ 1009.628096][T26323] can: request_module (can-proto-0) failed. [ 1009.669422][T26333] netlink: 'syz.2.5019': attribute type 3 has an invalid length. [ 1009.918252][T26343] netlink: 'syz.4.5022': attribute type 10 has an invalid length. [ 1010.328554][T26357] x_tables: duplicate underflow at hook 1 [ 1010.357922][T26361] x_tables: duplicate underflow at hook 1 [ 1010.632875][T26375] netlink: 'syz.2.5033': attribute type 1 has an invalid length. [ 1010.825730][T26383] bond6: (slave bridge3): making interface the new active one [ 1010.856798][T26383] bond6: (slave bridge3): Enslaving as an active interface with an up link [ 1011.467073][T26417] can: request_module (can-proto-0) failed. [ 1011.747452][T26434] syz_tun: entered allmulticast mode [ 1011.790556][T26436] bridge0: entered allmulticast mode [ 1011.865828][T26436] bridge_slave_1: left allmulticast mode [ 1011.885560][T26436] bridge_slave_1: left promiscuous mode [ 1011.903176][T26436] bridge0: port 2(bridge_slave_1) entered disabled state [ 1011.917031][T26444] __nla_validate_parse: 7 callbacks suppressed [ 1011.917051][T26444] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5045'. [ 1011.954041][T26436] bridge_slave_0: left allmulticast mode [ 1011.959944][T26436] bridge_slave_0: left promiscuous mode [ 1011.966253][T26436] bridge0: port 1(bridge_slave_0) entered disabled state [ 1012.035427][T26430] syz_tun: left allmulticast mode [ 1012.114285][T26452] hsr0: entered promiscuous mode [ 1012.159331][T26444] netdevsim netdevsim0 €Â: renamed from netdevsim0 (while UP) [ 1012.180095][T26452] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5046'. [ 1012.269988][T26452] hsr_slave_0: left promiscuous mode [ 1012.290687][T26452] hsr_slave_1: left promiscuous mode [ 1012.364271][T26452] hsr0 (unregistering): left promiscuous mode [ 1012.438831][T26462] ipvlan3: entered promiscuous mode [ 1012.632574][T26479] tipc: Enabling of bearer rejected, already enabled [ 1012.905142][T26492] netlink: 176 bytes leftover after parsing attributes in process `syz.4.5056'. [ 1013.097740][T26501] openvswitch: netlink: Actions may not be safe on all matching packets [ 1013.135757][T26492] can: request_module (can-proto-0) failed. [ 1013.405097][T26511] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5060'. [ 1013.433625][T26514] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5062'. [ 1013.443918][T26515] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5061'. [ 1013.464381][T26515] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5061'. [ 1013.481938][T26515] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5061'. [ 1013.772220][T26528] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5065'. [ 1013.975379][T26536] syzkaller1: entered promiscuous mode [ 1014.001176][T26536] syzkaller1: entered allmulticast mode [ 1014.257575][T26549] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5070'. [ 1014.322684][T26549] smc: net device wg2 applied user defined pnetid SYZ0 [ 1014.341046][T26551] netlink: 'syz.4.5071': attribute type 1 has an invalid length. [ 1014.421301][T26546] udevd[26546]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1014.456658][T26546] udevd[26546]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1014.489956][T26551] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1014.508333][T26549] 8021q: VLANs not supported on vxcan0 [ 1014.635041][T26555] bond12: (slave veth7): Enslaving as an active interface with a down link [ 1014.670755][T26556] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1014.702246][T26556] bond12: (slave batadv1): making interface the new active one [ 1014.720155][T26556] batadv1: entered promiscuous mode [ 1014.726834][T26556] bond12: (slave batadv1): Enslaving as an active interface with an up link [ 1014.762581][T26551] bond12 (unregistering): (slave veth7): Releasing active interface [ 1014.786345][T26551] bond12 (unregistering): (slave batadv1): Releasing active interface [ 1014.812847][T26551] bond12 (unregistering): Released all slaves [ 1015.088120][T26573] netlink: 'syz.0.5079': attribute type 23 has an invalid length. [ 1015.270741][T26586] ªªªªªª: renamed from vlan0 [ 1015.411993][T26593] xt_CT: No such helper "syz0" [ 1015.501489][T26604] netlink: 'syz.1.5085': attribute type 30 has an invalid length. [ 1015.546754][T26604] netlink: 'syz.1.5085': attribute type 30 has an invalid length. [ 1015.555537][ T6209] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1015.566522][ T6209] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1015.577161][ T6209] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1015.585806][ T6209] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1015.804620][T26619] siw: device registration error -23 [ 1015.949437][T26624] can: request_module (can-proto-0) failed. [ 1016.258814][T26640] netlink: 'syz.3.5097': attribute type 1 has an invalid length. [ 1017.115122][T26693] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1017.151880][T26680] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1017.158312][T26693] __nla_validate_parse: 20 callbacks suppressed [ 1017.158367][T26693] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5109'. [ 1017.233548][T26680] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1017.275327][T26692] netlink: 'syz.3.5108': attribute type 10 has an invalid length. [ 1017.369073][T26693] vlan0: entered promiscuous mode [ 1017.748053][T26721] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5116'. [ 1017.809218][T26725] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5117'. [ 1017.821021][T26725] netlink: 88 bytes leftover after parsing attributes in process `syz.0.5117'. [ 1018.037936][T26737] ip_tables: iptables: counters copy to user failed while replacing table [ 1018.072576][T26745] netlink: 'syz.3.5124': attribute type 1 has an invalid length. [ 1018.084168][T26739] vxcan1: entered promiscuous mode [ 1018.206083][T26753] geneve3: entered allmulticast mode [ 1018.371368][T26746] syzkaller1: entered promiscuous mode [ 1018.396186][T26746] syzkaller1: entered allmulticast mode [ 1018.423918][T26762] ip_tables: iptables: counters copy to user failed while replacing table [ 1018.448366][T26762] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5127'. [ 1018.643060][T26776] pimreg: entered allmulticast mode [ 1018.665830][T26780] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5130'. [ 1019.054090][T26798] netlink: 'syz.3.5134': attribute type 4 has an invalid length. [ 1019.263333][T26803] netlink: 'syz.3.5135': attribute type 21 has an invalid length. [ 1019.282030][T26803] netlink: 156 bytes leftover after parsing attributes in process `syz.3.5135'. [ 1019.307605][T26803] "syz.3.5135" (26803) uses obsolete ecb(arc4) skcipher [ 1019.434608][T26780] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5130'. [ 1019.455368][T26780] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5130'. [ 1019.465822][T26780] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5130'. [ 1019.723151][T26822] netlink: 'syz.1.5139': attribute type 1 has an invalid length. [ 1019.789191][T26822] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1019.804918][T26822] tipc: New replicast peer: 255.255.255.255 [ 1019.813787][T26822] tipc: Enabled bearer , priority 10 [ 1020.385697][T26857] netlink: 'syz.3.5146': attribute type 1 has an invalid length. [ 1020.766315][T26873] netlink: 'syz.2.5152': attribute type 13 has an invalid length. [ 1020.817487][T26879] netlink: 'syz.3.5155': attribute type 2 has an invalid length. [ 1020.897429][T26887] netlink: 'syz.3.5155': attribute type 2 has an invalid length. [ 1021.022917][ T1001] bond2: (slave gretap1): link status up again after 0 ms [ 1021.034201][T26879] ¿: entered promiscuous mode [ 1021.052563][ T1001] bond2: (slave gretap1): link status up again after 0 ms [ 1021.069730][ T5724] tipc: Node number set to 1952119127 [ 1021.082360][ T6209] bond2: (slave gretap1): link status up again after 0 ms [ 1021.147618][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1021.286852][T14115] bond2: (slave gretap1): failed to get link speed/duplex [ 1021.324540][T26909] syzkaller1: entered promiscuous mode [ 1021.340544][T26909] syzkaller1: entered allmulticast mode [ 1021.474480][T26921] tipc: Enabling of bearer rejected, already enabled [ 1021.503609][T12247] bond2: (slave gretap1): failed to get link speed/duplex [ 1021.663719][T26929] lo: Caught tx_queue_len zero misconfig [ 1021.678233][T26929] netlink: 'syz.2.5168': attribute type 11 has an invalid length. [ 1021.732082][T14115] bond2: (slave gretap1): failed to get link speed/duplex [ 1021.747350][T26931] can: request_module (can-proto-0) failed. [ 1021.757060][T26929] veth0_macvtap: Caught tx_queue_len zero misconfig [ 1021.763800][T26933] Cannot find add_set index 0 as target [ 1021.861789][ T1001] bond2: (slave gretap1): failed to get link speed/duplex [ 1021.993618][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1022.131122][T26953] xt_l2tp: v2 doesn't support IP mode [ 1022.213222][T26956] __nla_validate_parse: 8 callbacks suppressed [ 1022.213242][T26956] netlink: 244 bytes leftover after parsing attributes in process `syz.3.5173'. [ 1022.352242][T26966] veth0: entered promiscuous mode [ 1022.376176][T26966] veth0: left promiscuous mode [ 1022.488828][T26970] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5178'. [ 1022.580977][T26974] netlink: 'syz.1.5179': attribute type 6 has an invalid length. [ 1022.610474][T26974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5179'. [ 1022.624884][T26971] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5175'. [ 1022.672048][T26977] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5180'. [ 1022.883402][ T12] IPVS: starting estimator thread 0... [ 1023.011936][T26993] IPVS: using max 29 ests per chain, 69600 per kthread [ 1023.149138][T26996] tipc: Enabling of bearer rejected, already enabled [ 1023.380337][T27017] netlink: 'syz.4.5188': attribute type 1 has an invalid length. [ 1023.429150][T27019] netlink: 176 bytes leftover after parsing attributes in process `syz.1.5190'. [ 1023.468349][T27017] netlink: 'syz.4.5188': attribute type 2 has an invalid length. [ 1023.524670][ T1001] net_ratelimit: 13 callbacks suppressed [ 1023.524692][ T1001] bond2: (slave gretap1): failed to get link speed/duplex [ 1023.698903][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1023.773899][T27025] can: request_module (can-proto-0) failed. [ 1023.845249][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1023.855954][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1023.991838][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1024.165140][T14110] bond2: (slave gretap1): failed to get link speed/duplex [ 1024.273124][T27008] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5187'. [ 1024.602254][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1024.752183][T14115] bond2: (slave gretap1): failed to get link speed/duplex [ 1024.850473][T27008] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5187'. [ 1024.872376][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1025.002973][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1025.142359][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1025.221176][T27082] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5198'. [ 1025.573876][T27104] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5205'. [ 1025.861710][T27118] SET target dimension over the limit! [ 1025.890279][T27119] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1026.526342][T27146] syzkaller0: entered promiscuous mode [ 1026.545668][T27146] syzkaller0: entered allmulticast mode [ 1026.694118][T27158] block nbd0: Unsupported socket: should be TCP or UNIX. [ 1027.062022][T27176] bridge0: port 1(vlan3) entered disabled state [ 1027.244435][T27195] __nla_validate_parse: 4 callbacks suppressed [ 1027.244456][T27195] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5225'. [ 1027.286031][T27176] netdevsim netdevsim0 €Â: left allmulticast mode [ 1027.302383][T27176] vlan2: left allmulticast mode [ 1027.310411][T27176] bond0: left allmulticast mode [ 1027.321322][T27176] tipc: Resetting bearer [ 1027.331381][T27176] syzkaller0: left promiscuous mode [ 1027.340092][T27176] syzkaller0: left allmulticast mode [ 1027.350796][T27176] bond1: left promiscuous mode [ 1027.362724][T27176] macsec0: left promiscuous mode [ 1027.373735][T27176] geneve3: left promiscuous mode [ 1027.378888][T27176] geneve3: left allmulticast mode [ 1027.422019][ T6209] netdevsim netdevsim0 €Â: unset [1, 0] type 2 family 0 port 46648 - 0 [ 1027.454273][ T6209] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 46648 - 0 [ 1027.494355][ T6209] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 46648 - 0 [ 1027.906574][T27225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5232'. [ 1028.009558][T27225] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1028.227883][T27237] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5235'. [ 1028.431572][T27249] netlink: 27 bytes leftover after parsing attributes in process `syz.3.5238'. [ 1028.583491][ T6209] net_ratelimit: 21 callbacks suppressed [ 1028.583521][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1028.668459][T27264] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5245'. [ 1028.763769][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1028.798256][T27271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5246'. [ 1028.822277][T27271] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5246'. [ 1028.838941][T27271] netlink: 'syz.0.5246': attribute type 15 has an invalid length. [ 1028.857497][T27275] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5248'. [ 1028.891857][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1028.920953][T27278] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5249'. [ 1029.012396][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1029.058728][T27289] netlink: 'syz.2.5251': attribute type 62 has an invalid length. [ 1029.131996][ T6209] bond2: (slave gretap1): failed to get link speed/duplex [ 1029.242350][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1029.372720][ T1001] bond2: (slave gretap1): failed to get link speed/duplex [ 1029.480494][T27314] netlink: 'syz.1.5258': attribute type 1 has an invalid length. [ 1029.512824][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1029.580977][T27327] netlink: 'syz.3.5262': attribute type 11 has an invalid length. [ 1029.605498][T27328] netlink: 199784 bytes leftover after parsing attributes in process `syz.1.5258'. [ 1029.615507][T27328] netlink: 'syz.1.5258': attribute type 1 has an invalid length. [ 1029.644105][T27314] bond11: option mode: invalid value (7) [ 1029.653834][T27314] bond11 (unregistering): Released all slaves [ 1029.798158][T27332] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1029.829379][T27345] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1029.901190][T27334] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1029.909691][T27334] 8021q: adding VLAN 0 to HW filter on device team0 [ 1029.930592][T27334] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1030.179091][T27334] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1030.232644][ T12] bridge0: port 1(vlan3) entered blocking state [ 1030.239081][ T12] bridge0: port 1(vlan3) entered forwarding state [ 1030.320759][T27347] syzkaller0: left promiscuous mode [ 1030.332807][T27347] syzkaller0: left allmulticast mode [ 1030.614067][T27377] netlink: 'syz.4.5275': attribute type 12 has an invalid length. [ 1030.927700][T27384] bond11: option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 1030.954699][T27384] bond11 (unregistering): Released all slaves [ 1031.026566][T27398] netlink: 'syz.4.5279': attribute type 1 has an invalid length. [ 1031.064074][T27402] syzkaller0: entered promiscuous mode [ 1031.070109][T27402] syzkaller0: entered allmulticast mode [ 1031.424683][ T30] audit: type=1804 audit(1786714755.978:27): pid=27412 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5280" name="/newroot/482/cgroup.controllers" dev="tmpfs" ino=2490 res=1 errno=0 [ 1031.499982][ T30] audit: type=1800 audit(1786714755.978:28): pid=27412 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5280" name="cgroup.controllers" dev="tmpfs" ino=2490 res=0 errno=0 [ 1031.897705][T27433] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1031.987304][T27435] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 1032.006247][T27435] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 1032.059094][T27441] 8021q: VLANs not supported on syzkaller1 [ 1032.135965][T27442] syzkaller1: entered promiscuous mode [ 1032.142944][T27442] syzkaller1: entered allmulticast mode [ 1032.874427][T27491] netlink: 'syz.0.5301': attribute type 1 has an invalid length. [ 1032.953772][T27491] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1033.074191][T27498] bond5: (slave veth1): Enslaving as an active interface with a down link [ 1033.089819][T27508] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1033.258952][T27491] bridge0: port 1(vlan3) entered disabled state [ 1033.434184][T27491] tipc: Resetting bearer [ 1033.445114][T27491] syzkaller0: left promiscuous mode [ 1033.450576][T27491] syzkaller0: left allmulticast mode [ 1033.500865][T27506] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1033.559134][T27506] bond5: (slave batadv1): making interface the new active one [ 1033.589781][T27506] batadv1: entered promiscuous mode [ 1033.599777][T27506] bond5: (slave batadv1): Enslaving as an active interface with an up link [ 1033.616229][T27523] netlink: 'syz.3.5307': attribute type 4 has an invalid length. [ 1033.703980][T12247] net_ratelimit: 19 callbacks suppressed [ 1033.704002][T12247] bond2: (slave gretap1): failed to get link speed/duplex [ 1033.844000][T12247] bond2: (slave gretap1): failed to get link speed/duplex [ 1033.983532][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1034.072857][T27533] __nla_validate_parse: 10 callbacks suppressed [ 1034.072881][T27533] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5311'. [ 1034.113481][ T1001] bond2: (slave gretap1): failed to get link speed/duplex [ 1034.245730][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1034.362923][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1034.443489][T27567] sctp: [Deprecated]: syz.3.5320 (pid 27567) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1034.443489][T27567] Use struct sctp_sack_info instead [ 1034.502096][T12247] bond2: (slave gretap1): failed to get link speed/duplex [ 1034.771847][ T1001] bond2: (slave gretap1): failed to get link speed/duplex [ 1034.895080][T12247] bond2: (slave gretap1): failed to get link speed/duplex [ 1035.032332][ T1001] bond2: (slave gretap1): failed to get link speed/duplex [ 1035.041425][T27583] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5325'. [ 1035.090977][T27585] netlink: 'syz.3.5325': attribute type 15 has an invalid length. [ 1035.123221][T27583] netlink: 'syz.3.5325': attribute type 15 has an invalid length. [ 1035.611459][T27602] netlink: 'syz.2.5329': attribute type 1 has an invalid length. [ 1035.624227][T27595] lo speed is unknown, defaulting to 1000 [ 1035.746137][T27602] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1035.815773][T27610] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1035.836098][T27618] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5334'. [ 1035.858680][T27610] bond7: (slave ip6_vti0): The slave device specified does not support setting the MAC address [ 1035.875163][T27610] bond7: (slave ip6_vti0): Error -95 calling set_mac_address [ 1035.904790][T27606] netlink: 656 bytes leftover after parsing attributes in process `syz.1.5331'. [ 1035.915752][T27615] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1035.971281][T27622] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5334'. [ 1036.025520][T27614] netlink: 'syz.3.5334': attribute type 1 has an invalid length. [ 1036.132918][ T30] audit: type=1800 audit(1786714760.688:29): pid=27629 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5337" name=CB dev="tmpfs" ino=2545 res=0 errno=0 [ 1036.153751][ T30] audit: type=1800 audit(1786714760.688:30): pid=27630 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5337" name=CB dev="tmpfs" ino=2545 res=0 errno=0 [ 1036.382430][T27638] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5341'. [ 1036.490609][T27639] netlink: 'syz.3.5339': attribute type 29 has an invalid length. [ 1036.794235][T27662] netlink: 220 bytes leftover after parsing attributes in process `syz.4.5347'. [ 1038.130877][T27740] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1038.212162][T27733] netlink: 27 bytes leftover after parsing attributes in process `syz.3.5365'. [ 1038.316476][T27747] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5365'. [ 1038.363717][T27751] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5369'. [ 1038.550136][T27763] netlink: 'syz.4.5369': attribute type 7 has an invalid length. [ 1038.572265][T27763] netlink: 'syz.4.5369': attribute type 8 has an invalid length. [ 1038.785572][T14110] net_ratelimit: 21 callbacks suppressed [ 1038.785596][T14110] bond2: (slave gretap1): failed to get link speed/duplex [ 1038.953188][T12247] bond2: (slave gretap1): failed to get link speed/duplex [ 1039.043811][T27765] lo speed is unknown, defaulting to 1000 [ 1039.166060][T27777] __nla_validate_parse: 1 callbacks suppressed [ 1039.166080][T27777] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5373'. [ 1039.197939][T27770] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5373'. [ 1039.214472][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 1039.294111][T27777] Unsupported ieee802154 address type: 0 [ 1039.347268][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1039.522847][T14118] bond2: (slave gretap1): failed to get link speed/duplex [ 1039.652066][T14110] bond2: (slave gretap1): failed to get link speed/duplex [ 1039.772587][T14118] bond2: (slave gretap1): failed to get link speed/duplex [ 1039.892607][T14110] bond2: (slave gretap1): failed to get link speed/duplex [ 1040.015543][T14118] bond2: (slave gretap1): failed to get link speed/duplex [ 1040.141914][T14118] bond2: (slave gretap1): failed to get link speed/duplex [ 1040.272503][ T12] bond2: (slave gretap1): failed to get link speed/duplex [ 1040.432355][T27823] dummy0: left promiscuous mode [ 1040.445637][T27826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5386'. [ 1040.555057][T27826] sctp: [Deprecated]: syz.4.5386 (pid 27826) Use of int in max_burst socket option. [ 1040.555057][T27826] Use struct sctp_assoc_value instead [ 1040.627625][T27831] mac80211_hwsim hwsim47 syzkaller0: left promiscuous mode [ 1040.673359][T27831] mac80211_hwsim hwsim47 syzkaller0: left allmulticast mode [ 1040.773853][T27835] sctp: [Deprecated]: syz.2.5388 (pid 27835) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1040.773853][T27835] Use struct sctp_sack_info instead [ 1040.924521][T27849] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5394'. [ 1040.964449][T27852] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5392'. [ 1041.251381][T27862] netlink: 152 bytes leftover after parsing attributes in process `syz.3.5397'. [ 1041.455836][T27870] lo speed is unknown, defaulting to 1000 [ 1041.616363][T27880] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5403'. [ 1041.925383][T27893] "syz.1.5407" (27893) uses obsolete ecb(arc4) skcipher [ 1042.005141][T27899] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5407'. [ 1042.364482][T27923] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5414'. [ 1042.474043][T27933] sctp: [Deprecated]: syz.4.5415 (pid 27933) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1042.474043][T27933] Use struct sctp_sack_info instead [ 1042.513895][T27933] netlink: 'syz.4.5415': attribute type 2 has an invalid length. [ 1042.533706][T27933] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5415'. [ 1042.587541][T27933] ¿: entered promiscuous mode [ 1042.935309][T27975] netlink: 'syz.2.5423': attribute type 21 has an invalid length. [ 1043.043761][T27982] syzkaller1: entered promiscuous mode [ 1043.061815][T27982] syzkaller1: entered allmulticast mode [ 1043.872318][T27950] net_ratelimit: 27 callbacks suppressed [ 1043.872341][T27950] bond2: (slave gretap1): failed to get link speed/duplex [ 1044.012222][T27951] bond2: (slave gretap1): failed to get link speed/duplex [ 1044.094315][T28039] netlink: 'syz.3.5440': attribute type 3 has an invalid length. [ 1044.115388][T28041] pim6reg1: entered promiscuous mode [ 1044.124172][T28039] netlink: 'syz.3.5440': attribute type 1 has an invalid length. [ 1044.128557][T28041] pim6reg1: entered allmulticast mode [ 1044.155993][T28039] NCSI netlink: No device for ifindex 0 [ 1044.185446][T28045] bond6: entered promiscuous mode [ 1044.190763][T28045] bond6: entered allmulticast mode [ 1044.197051][T28045] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1044.207747][T28041] syzkaller0: left promiscuous mode [ 1044.213377][T28041] syzkaller0: left allmulticast mode [ 1044.271841][T27925] bond2: (slave gretap1): failed to get link speed/duplex [ 1044.309578][T28053] __nla_validate_parse: 7 callbacks suppressed [ 1044.309610][T28053] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5442'. [ 1044.368264][T28053] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5442'. [ 1044.420275][T28056] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5443'. [ 1044.467687][T27950] bond2: (slave gretap1): failed to get link speed/duplex [ 1044.592232][T14110] bond2: (slave gretap1): failed to get link speed/duplex [ 1044.604659][T28067] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5445'. [ 1044.624809][T28070] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1044.715213][T27925] bond2: (slave gretap1): failed to get link speed/duplex [ 1044.824500][T28083] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5448'. [ 1045.051449][T28094] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5450'. [ 1045.159328][T28093] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5450'. [ 1045.432245][T27950] bond2: (slave gretap1): failed to get link speed/duplex [ 1045.472753][T28110] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5452'. [ 1045.528275][T28115] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5453'. [ 1045.562058][T27925] bond2: (slave gretap1): failed to get link speed/duplex [ 1045.749728][ T30] audit: type=1800 audit(1786714770.298:31): pid=28122 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5456" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2681 res=0 errno=0 [ 1045.821755][T27950] bond2: (slave gretap1): failed to get link speed/duplex [ 1045.931831][T27925] bond2: (slave gretap1): failed to get link speed/duplex [ 1045.969095][T28126] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5458'. [ 1045.995268][T28126] netlink: 'syz.0.5458': attribute type 1 has an invalid length. [ 1047.598277][T28159] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1048.330052][T27925] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.353249][T27925] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.405435][T27925] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.434997][T27925] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.725928][T28197] can: request_module (can-proto-0) failed. [ 1049.274818][T28233] netlink: 'syz.0.5483': attribute type 1 has an invalid length. [ 1049.499012][T28244] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20004 [ 1049.655544][T28249] __nla_validate_parse: 8 callbacks suppressed [ 1049.655567][T28249] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5488'. [ 1049.813901][T28255] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5490'. [ 1049.856022][T28262] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5492'. [ 1049.873165][T28262] netlink: 312 bytes leftover after parsing attributes in process `syz.3.5492'. [ 1049.887316][T28263] netlink: 'syz.0.5491': attribute type 16 has an invalid length. [ 1049.896142][T28262] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5492'. [ 1049.918332][T28263] netlink: 53010 bytes leftover after parsing attributes in process `syz.0.5491'. [ 1049.963432][T28268] netlink: 176 bytes leftover after parsing attributes in process `syz.1.5494'. [ 1050.288936][T28276] can: request_module (can-proto-0) failed. [ 1050.405168][T28286] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 1050.876500][T28300] netlink: 'syz.3.5498': attribute type 1 has an invalid length. [ 1050.894693][T28300] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.5498'. [ 1050.906187][T28305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5500'. [ 1050.917427][T28300] netlink: 'syz.3.5498': attribute type 1 has an invalid length. [ 1050.931060][T28300] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.5498'. [ 1050.949935][T28306] netlink: 'syz.0.5502': attribute type 1 has an invalid length. [ 1051.108726][T28312] lo speed is unknown, defaulting to 1000 [ 1051.552618][T28331] netlink: 'syz.2.5509': attribute type 1 has an invalid length. [ 1051.678263][T28331] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1051.788754][T28340] IPVS: set_ctl: invalid protocol: 148 224.0.0.2:20004 [ 1051.924012][T28344] net_ratelimit: 5 callbacks suppressed [ 1051.924035][T28344] ip_tables: iptables: counters copy to user failed while replacing table [ 1052.263582][T28350] can: request_module (can-proto-0) failed. [ 1052.487552][T28366] netlink: 'syz.0.5517': attribute type 1 has an invalid length. [ 1052.543707][T28366] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1052.604340][T28371] openvswitch: netlink: Missing key (keys=c0, expected=40280) [ 1053.064979][T28402] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1053.228619][T28407] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1053.602994][T28411] sctp: [Deprecated]: syz.4.5529 (pid 28411) Use of int in max_burst socket option. [ 1053.602994][T28411] Use struct sctp_assoc_value instead [ 1054.311406][T28457] syzkaller0: entered promiscuous mode [ 1054.321428][T28457] syzkaller0: entered allmulticast mode [ 1054.335841][T28451] lo speed is unknown, defaulting to 1000 [ 1054.612492][T28466] syzkaller0: entered promiscuous mode [ 1054.618282][T28466] syzkaller0: entered allmulticast mode [ 1054.661842][T28471] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1054.866871][T28479] netlink: 'syz.3.5548': attribute type 11 has an invalid length. [ 1055.108378][T28484] __nla_validate_parse: 9 callbacks suppressed [ 1055.108392][T28484] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5549'. [ 1055.131943][T28484] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5549'. [ 1055.388849][T28491] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5551'. [ 1055.408173][T28493] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5551'. [ 1055.901603][T28518] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5560'. [ 1056.043929][T28526] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5562'. [ 1056.058288][T28527] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5563'. [ 1056.068355][T28526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5562'. [ 1056.100346][T28526] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5562'. [ 1056.111316][T28528] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5564'. [ 1056.164802][T28530] tunl0: Caught tx_queue_len zero misconfig [ 1056.176096][T28530] sch_fq: defrate 4294967293 ignored. [ 1056.351109][T28540] netlink: 'syz.2.5568': attribute type 1 has an invalid length. [ 1056.355622][T28538] bridge0: port 2(wlan1) entered blocking state [ 1056.369909][T28538] bridge0: port 2(wlan1) entered disabled state [ 1056.377992][T28538] mac80211_hwsim hwsim44 wlan1: entered allmulticast mode [ 1056.388793][T28538] mac80211_hwsim hwsim44 wlan1: entered promiscuous mode [ 1056.444068][T28540] bond9: entered promiscuous mode [ 1056.449894][T28540] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1056.492908][T28546] mac80211_hwsim hwsim44 wlan1 (unregistering): left allmulticast mode [ 1056.504039][T28546] mac80211_hwsim hwsim44 wlan1 (unregistering): left promiscuous mode [ 1056.515770][T28546] bridge0: port 2(wlan1) entered disabled state [ 1056.666538][T28552] FAULT_INJECTION: forcing a failure. [ 1056.666538][T28552] name failslab, interval 1, probability 0, space 0, times 0 [ 1056.679289][T28552] CPU: 0 UID: 0 PID: 28552 Comm: syz.2.5571 Not tainted syzkaller #0 PREEMPT(full) [ 1056.679322][T28552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1056.679336][T28552] Call Trace: [ 1056.679344][T28552] [ 1056.679354][T28552] dump_stack_lvl+0xe8/0x150 [ 1056.679392][T28552] should_fail_ex+0x40c/0x560 [ 1056.679424][T28552] should_failslab+0xa8/0x100 [ 1056.679455][T28552] kmem_cache_alloc_bulk_noprof+0x8b/0x7b0 [ 1056.679485][T28552] ? pfn_valid+0x125/0x4c0 [ 1056.679515][T28552] ? pfn_valid+0x125/0x4c0 [ 1056.679541][T28552] ? pfn_valid+0x125/0x4c0 [ 1056.679569][T28552] bpf_test_run_xdp_live+0x16e9/0x1c20 [ 1056.679607][T28552] ? bpf_test_run_xdp_live+0x43e/0x1c20 [ 1056.679657][T28552] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1056.679683][T28552] ? 0xffffffffa02057c0 [ 1056.679748][T28552] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1056.679783][T28552] ? _copy_from_user+0x94/0xb0 [ 1056.679812][T28552] ? bpf_test_init+0x113/0x150 [ 1056.679835][T28552] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1056.679862][T28552] bpf_prog_test_run_xdp+0x7d8/0x11d0 [ 1056.679903][T28552] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1056.679936][T28552] ? __fget_files+0x2a/0x420 [ 1056.679969][T28552] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1056.679998][T28552] bpf_prog_test_run+0x2c5/0x340 [ 1056.680032][T28552] __sys_bpf+0xa22/0xd90 [ 1056.680068][T28552] ? __pfx___sys_bpf+0x10/0x10 [ 1056.680106][T28552] ? __fget_files+0x2a/0x420 [ 1056.680152][T28552] ? ksys_write+0x242/0x270 [ 1056.680186][T28552] ? __pfx_ksys_write+0x10/0x10 [ 1056.680223][T28552] __x64_sys_bpf+0xba/0xd0 [ 1056.680248][T28552] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.680272][T28552] do_syscall_64+0x174/0x580 [ 1056.680297][T28552] ? trace_irq_disable+0x3b/0x140 [ 1056.680322][T28552] ? clear_bhb_loop+0x70/0xc0 [ 1056.680349][T28552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.680370][T28552] RIP: 0033:0x7fde9299e0d9 [ 1056.680391][T28552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1056.680410][T28552] RSP: 002b:00007fde937ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1056.680433][T28552] RAX: ffffffffffffffda RBX: 00007fde92c25fa0 RCX: 00007fde9299e0d9 [ 1056.680448][T28552] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1056.680462][T28552] RBP: 00007fde937ae090 R08: 0000000000000000 R09: 0000000000000000 [ 1056.680473][T28552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1056.680486][T28552] R13: 00007fde92c26038 R14: 00007fde92c25fa0 R15: 00007ffc7ec979e8 [ 1056.680521][T28552] [ 1057.045454][T28564] netlink: 'syz.4.5573': attribute type 22 has an invalid length. [ 1057.072614][T28564] netlink: 'syz.4.5573': attribute type 22 has an invalid length. [ 1057.119164][T28559] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 1057.439539][T28589] ip_tables: iptables: counters copy to user failed while replacing table [ 1057.619319][T28602] FAULT_INJECTION: forcing a failure. [ 1057.619319][T28602] name failslab, interval 1, probability 0, space 0, times 0 [ 1057.632084][T28602] CPU: 1 UID: 0 PID: 28602 Comm: syz.0.5587 Not tainted syzkaller #0 PREEMPT(full) [ 1057.632113][T28602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1057.632127][T28602] Call Trace: [ 1057.632136][T28602] [ 1057.632146][T28602] dump_stack_lvl+0xe8/0x150 [ 1057.632182][T28602] should_fail_ex+0x40c/0x560 [ 1057.632213][T28602] should_failslab+0xa8/0x100 [ 1057.632246][T28602] kmem_cache_alloc_bulk_noprof+0x8b/0x7b0 [ 1057.632276][T28602] ? pfn_valid+0x125/0x4c0 [ 1057.632305][T28602] ? pfn_valid+0x125/0x4c0 [ 1057.632332][T28602] ? pfn_valid+0x125/0x4c0 [ 1057.632364][T28602] bpf_test_run_xdp_live+0x16e9/0x1c20 [ 1057.632407][T28602] ? bpf_test_run_xdp_live+0x43e/0x1c20 [ 1057.632447][T28602] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1057.632485][T28602] ? 0xffffffffa02057c0 [ 1057.632558][T28602] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1057.632595][T28602] ? _copy_from_user+0x94/0xb0 [ 1057.632627][T28602] ? bpf_test_init+0x113/0x150 [ 1057.632651][T28602] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1057.632682][T28602] bpf_prog_test_run_xdp+0x7d8/0x11d0 [ 1057.632728][T28602] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1057.632761][T28602] ? __fget_files+0x2a/0x420 [ 1057.632794][T28602] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1057.632823][T28602] bpf_prog_test_run+0x2c5/0x340 [ 1057.632857][T28602] __sys_bpf+0xa22/0xd90 [ 1057.632893][T28602] ? __pfx___sys_bpf+0x10/0x10 [ 1057.632932][T28602] ? __fget_files+0x2a/0x420 [ 1057.632978][T28602] ? ksys_write+0x242/0x270 [ 1057.633012][T28602] ? __pfx_ksys_write+0x10/0x10 [ 1057.633049][T28602] __x64_sys_bpf+0xba/0xd0 [ 1057.633074][T28602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.633098][T28602] do_syscall_64+0x174/0x580 [ 1057.633120][T28602] ? trace_irq_disable+0x3b/0x140 [ 1057.633145][T28602] ? clear_bhb_loop+0x70/0xc0 [ 1057.633172][T28602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.633194][T28602] RIP: 0033:0x7f67f9d9e0d9 [ 1057.633214][T28602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1057.633233][T28602] RSP: 002b:00007f67fab97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1057.633255][T28602] RAX: ffffffffffffffda RBX: 00007f67fa025fa0 RCX: 00007f67f9d9e0d9 [ 1057.633271][T28602] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1057.633284][T28602] RBP: 00007f67fab97090 R08: 0000000000000000 R09: 0000000000000000 [ 1057.633298][T28602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1057.633311][T28602] R13: 00007f67fa026038 R14: 00007f67fa025fa0 R15: 00007ffc004f1de8 [ 1057.633345][T28602] [ 1058.058538][T28616] IPVS: set_ctl: invalid protocol: 51 100.1.1.2:20002 [ 1058.147349][T28611] can: request_module (can-proto-0) failed. [ 1058.756455][T28650] ip_tables: iptables: counters copy to user failed while replacing table [ 1058.768468][T28649] netlink: 'syz.4.5603': attribute type 1 has an invalid length. [ 1058.829364][T28649] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1058.928950][T28659] bond12: (slave geneve5): making interface the new active one [ 1058.996288][T28659] bond12: (slave geneve5): Enslaving as an active interface with an up link [ 1059.025350][T28646] tipc: Enabling of bearer rejected, failed to enable media [ 1060.114791][T28721] bridge0: port 1(batadv0) entered blocking state [ 1060.134917][T28721] bridge0: port 1(batadv0) entered disabled state [ 1060.145105][T28721] batadv0: entered allmulticast mode [ 1060.154004][T28721] batadv0: entered promiscuous mode [ 1060.601945][ T12] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1060.613444][ T12] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1060.902649][T28749] 8021q: VLANs not supported on syzkaller0 [ 1060.919771][T28748] __nla_validate_parse: 11 callbacks suppressed [ 1060.919791][T28748] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5627'. [ 1060.969184][T28748] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5627'. [ 1060.995028][T28754] ip6tnl0: Caught tx_queue_len zero misconfig [ 1061.070036][T28758] netlink: 'syz.4.5627': attribute type 1 has an invalid length. [ 1061.152545][T27949] batman_adv: batadv0: IGMP Querier appeared [ 1061.158623][T27949] batman_adv: batadv0: MLD Querier appeared [ 1061.228489][T28768] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5633'. [ 1061.306077][T28768] bond11: entered promiscuous mode [ 1061.324874][T28768] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1061.521383][T28783] x_tables: duplicate underflow at hook 1 [ 1061.626106][T28798] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5639'. [ 1061.707184][T28798] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5639'. [ 1061.869281][T28803] sctp: [Deprecated]: syz.0.5639 (pid 28803) Use of int in maxseg socket option. [ 1061.869281][T28803] Use struct sctp_assoc_value instead [ 1062.264950][T28819] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5644'. [ 1062.310138][T28821] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1062.337131][T28814] syzkaller0: entered promiscuous mode [ 1062.346325][T28814] syzkaller0: entered allmulticast mode [ 1062.532562][T28832] netlink: 'syz.2.5648': attribute type 1 has an invalid length. [ 1062.537387][T28839] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5649'. [ 1062.634785][T28832] bond10: option mode: invalid value (19) [ 1062.653362][T28832] bond10 (unregistering): Released all slaves [ 1062.753592][T28839] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5649'. [ 1064.366698][T28917] bridge4: entered promiscuous mode [ 1064.377864][T28917] bridge4: entered allmulticast mode [ 1064.523034][T28929] IPVS: Unknown mcast interface: rose0 [ 1064.535391][T28929] IPVS: Unknown mcast interface: dvmrp0 [ 1064.998624][T28956] smc: net device wg2 erased user defined pnetid SYZ0 [ 1065.062411][T28956] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5682'. [ 1065.090239][T28963] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5684'. [ 1065.123593][T28963] netlink: 'syz.0.5684': attribute type 11 has an invalid length. [ 1065.146756][T28968] netlink: 'syz.1.5683': attribute type 16 has an invalid length. [ 1065.194739][T28968] netlink: 'syz.1.5683': attribute type 17 has an invalid length. [ 1065.315053][T28969] bond8: Removing last ns target with arp_interval on [ 1065.599082][T28968] vlan0: left promiscuous mode [ 1065.624909][T28968] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1065.742383][T27949] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1065.771493][T27949] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1065.797127][T27949] netdevsim netdevsim0 €Â: set [0, 0] type 1 family 0 port 8472 - 0 [ 1066.564441][T29035] __nla_validate_parse: 2 callbacks suppressed [ 1066.564462][T29035] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5701'. [ 1066.611970][T29035] IPVS: nq: FWM 3 0x00000003 - no destination available [ 1066.646186][T29040] Cannot find add_set index 0 as target [ 1066.865088][T29046] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5706'. [ 1067.438484][T29079] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5718'. [ 1067.449898][T29079] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5718'. [ 1067.536687][T29086] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5720'. [ 1067.567032][T29088] syzkaller0: left promiscuous mode [ 1067.583572][T29088] syzkaller0: left allmulticast mode [ 1067.611505][T29088] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5721'. [ 1067.681519][T29096] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1067.730719][T29100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5724'. [ 1067.956046][T29107] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1068.157590][T29114] netlink: 'syz.3.5728': attribute type 1 has an invalid length. [ 1068.171008][T29114] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 1068.235341][T29124] netlink: 1 bytes leftover after parsing attributes in process `syz.3.5731'. [ 1068.375701][T29132] FAULT_INJECTION: forcing a failure. [ 1068.375701][T29132] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1068.395382][T29130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5733'. [ 1068.420185][T29132] CPU: 0 UID: 0 PID: 29132 Comm: syz.0.5732 Not tainted syzkaller #0 PREEMPT(full) [ 1068.420216][T29132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1068.420231][T29132] Call Trace: [ 1068.420240][T29132] [ 1068.420249][T29132] dump_stack_lvl+0xe8/0x150 [ 1068.420287][T29132] should_fail_ex+0x40c/0x560 [ 1068.420317][T29132] _copy_from_user+0x2d/0xb0 [ 1068.420350][T29132] ___sys_sendmsg+0x1c6/0x360 [ 1068.420378][T29132] ? __lock_acquire+0x683/0x2cf0 [ 1068.420412][T29132] ? __pfx____sys_sendmsg+0x10/0x10 [ 1068.420478][T29132] ? __fget_files+0x2a/0x420 [ 1068.420505][T29132] ? __fget_files+0x3a2/0x420 [ 1068.420543][T29132] __x64_sys_sendmsg+0x1b1/0x290 [ 1068.420573][T29132] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1068.420621][T29132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1068.420645][T29132] do_syscall_64+0x174/0x580 [ 1068.420668][T29132] ? trace_irq_disable+0x3b/0x140 [ 1068.420694][T29132] ? clear_bhb_loop+0x70/0xc0 [ 1068.420721][T29132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1068.420743][T29132] RIP: 0033:0x7f67f9d9e0d9 [ 1068.420764][T29132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1068.420783][T29132] RSP: 002b:00007f67fab97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1068.420807][T29132] RAX: ffffffffffffffda RBX: 00007f67fa025fa0 RCX: 00007f67f9d9e0d9 [ 1068.420823][T29132] RDX: 0000000004000040 RSI: 0000200000000240 RDI: 0000000000000003 [ 1068.420838][T29132] RBP: 00007f67fab97090 R08: 0000000000000000 R09: 0000000000000000 [ 1068.420851][T29132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1068.420864][T29132] R13: 00007f67fa026038 R14: 00007f67fa025fa0 R15: 00007ffc004f1de8 [ 1068.420899][T29132] [ 1068.791197][T29141] netlink: 156 bytes leftover after parsing attributes in process `syz.4.5737'. [ 1069.539594][T29170] tipc: Enabled bearer , priority 0 [ 1069.553057][T29172] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 1070.535431][T29225] netlink: 'syz.1.5764': attribute type 1 has an invalid length. [ 1071.557327][ T30] audit: type=1804 audit(1786714796.108:32): pid=29268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.5777" name="/newroot/488/cgroup.controllers" dev="tmpfs" ino=2506 res=1 errno=0 [ 1071.612116][ T30] audit: type=1800 audit(1786714796.108:33): pid=29268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5777" name="cgroup.controllers" dev="tmpfs" ino=2506 res=0 errno=0 [ 1071.651208][ T30] audit: type=1800 audit(1786714796.108:34): pid=29268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5777" name="cgroup.controllers" dev="tmpfs" ino=2506 res=0 errno=0 [ 1071.676618][ T30] audit: type=1804 audit(1786714796.128:35): pid=29270 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.5777" name="/newroot/488/cgroup.controllers" dev="tmpfs" ino=2506 res=1 errno=0 [ 1071.700171][ T30] audit: type=1800 audit(1786714796.138:36): pid=29269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5777" name="cgroup.controllers" dev="tmpfs" ino=2506 res=0 errno=0 [ 1071.725088][ T30] audit: type=1800 audit(1786714796.138:37): pid=29268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5777" name="cgroup.controllers" dev="tmpfs" ino=2506 res=0 errno=0 [ 1071.753086][T29273] __nla_validate_parse: 11 callbacks suppressed [ 1071.753138][T29273] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5778'. [ 1072.054443][T29302] syzkaller1: entered promiscuous mode [ 1072.060203][T29302] syzkaller1: entered allmulticast mode [ 1072.073963][T29292] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5784'. [ 1072.228171][T29308] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5787'. [ 1072.249296][T29308] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5787'. [ 1072.347114][T29313] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5787'. [ 1072.537589][T29289] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1072.563441][T29308] netlink: 'syz.2.5787': attribute type 12 has an invalid length. [ 1072.879215][T29337] FAULT_INJECTION: forcing a failure. [ 1072.879215][T29337] name failslab, interval 1, probability 0, space 0, times 0 [ 1072.903832][T29338] netlink: 'syz.1.5797': attribute type 11 has an invalid length. [ 1072.921421][T29337] CPU: 1 UID: 0 PID: 29337 Comm: syz.4.5795 Not tainted syzkaller #0 PREEMPT(full) [ 1072.921451][T29337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1072.921464][T29337] Call Trace: [ 1072.921474][T29337] [ 1072.921484][T29337] dump_stack_lvl+0xe8/0x150 [ 1072.921528][T29337] should_fail_ex+0x40c/0x560 [ 1072.921559][T29337] should_failslab+0xa8/0x100 [ 1072.921592][T29337] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1072.921620][T29337] ? skb_clone+0x212/0x3a0 [ 1072.921645][T29337] ? skb_clone+0x212/0x3a0 [ 1072.921677][T29337] skb_clone+0x212/0x3a0 [ 1072.921707][T29337] __netlink_deliver_tap+0x413/0x860 [ 1072.921747][T29337] ? netlink_deliver_tap+0x2e/0x1b0 [ 1072.921776][T29337] netlink_deliver_tap+0x19c/0x1b0 [ 1072.921805][T29337] netlink_unicast+0x77f/0x940 [ 1072.921842][T29337] netlink_sendmsg+0x813/0xb40 [ 1072.921881][T29337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1072.921913][T29337] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1072.921955][T29337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1072.921981][T29337] sock_sendmsg_nosec+0x13a/0x180 [ 1072.922016][T29337] ____sys_sendmsg+0x54e/0x850 [ 1072.922049][T29337] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1072.922087][T29337] ? import_iovec+0x73/0xa0 [ 1072.922122][T29337] ___sys_sendmsg+0x2a5/0x360 [ 1072.922147][T29337] ? __lock_acquire+0x683/0x2cf0 [ 1072.922180][T29337] ? __pfx____sys_sendmsg+0x10/0x10 [ 1072.922248][T29337] ? __fget_files+0x2a/0x420 [ 1072.922274][T29337] ? __fget_files+0x3a2/0x420 [ 1072.922313][T29337] __x64_sys_sendmsg+0x1b1/0x290 [ 1072.922343][T29337] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1072.922390][T29337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.922414][T29337] do_syscall_64+0x174/0x580 [ 1072.922437][T29337] ? trace_irq_disable+0x3b/0x140 [ 1072.922462][T29337] ? clear_bhb_loop+0x70/0xc0 [ 1072.922496][T29337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.922518][T29337] RIP: 0033:0x7fb0bcb9e0d9 [ 1072.922539][T29337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1072.922557][T29337] RSP: 002b:00007fb0bdb15028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1072.922581][T29337] RAX: ffffffffffffffda RBX: 00007fb0bce25fa0 RCX: 00007fb0bcb9e0d9 [ 1072.922597][T29337] RDX: 0000000004000040 RSI: 0000200000000240 RDI: 0000000000000003 [ 1072.922611][T29337] RBP: 00007fb0bdb15090 R08: 0000000000000000 R09: 0000000000000000 [ 1072.922625][T29337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1072.922638][T29337] R13: 00007fb0bce26038 R14: 00007fb0bce25fa0 R15: 00007ffda73abf08 [ 1072.922673][T29337] [ 1073.267299][T29346] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5799'. [ 1073.288591][T29340] dvmrp16: entered allmulticast mode [ 1073.368370][T29346] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1073.402897][T29346] macvlan2: entered promiscuous mode [ 1073.408740][T29346] macvlan2: entered allmulticast mode [ 1073.415443][T29346] bond9: entered promiscuous mode [ 1073.421440][T29346] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1073.758638][T29346] bond9: left promiscuous mode [ 1074.093156][T29340] dvmrp16: left allmulticast mode [ 1074.106957][T29357] netlink: 'syz.4.5801': attribute type 1 has an invalid length. [ 1074.122059][T29357] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5801'. [ 1074.428711][T29379] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5807'. [ 1074.471089][T29384] tipc: Enabling of bearer rejected, failed to enable media [ 1074.570359][T29386] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5808'. [ 1074.683015][T29400] FAULT_INJECTION: forcing a failure. [ 1074.683015][T29400] name failslab, interval 1, probability 0, space 0, times 0 [ 1074.696022][T29400] CPU: 1 UID: 0 PID: 29400 Comm: syz.4.5811 Not tainted syzkaller #0 PREEMPT(full) [ 1074.696051][T29400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1074.696065][T29400] Call Trace: [ 1074.696074][T29400] [ 1074.696084][T29400] dump_stack_lvl+0xe8/0x150 [ 1074.696120][T29400] should_fail_ex+0x40c/0x560 [ 1074.696152][T29400] should_failslab+0xa8/0x100 [ 1074.696185][T29400] __kmalloc_noprof+0xfe/0x720 [ 1074.696212][T29400] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1074.696235][T29400] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1074.696267][T29400] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1074.696306][T29400] genl_family_rcv_msg_doit+0xda/0x340 [ 1074.696336][T29400] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1074.696368][T29400] ? apparmor_capable+0x126/0x170 [ 1074.696397][T29400] ? bpf_lsm_capable+0x9/0x20 [ 1074.696423][T29400] ? security_capable+0x7e/0x2c0 [ 1074.696532][T29400] genl_rcv_msg+0x614/0x7a0 [ 1074.696572][T29400] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1074.696604][T29400] ? __pfx_wg_set_device_doit+0x10/0x10 [ 1074.696667][T29400] ? __pfx_ref_tracker_free+0x10/0x10 [ 1074.696707][T29400] netlink_rcv_skb+0x226/0x4a0 [ 1074.696735][T29400] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1074.696770][T29400] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1074.696815][T29400] ? down_read+0x2be/0x330 [ 1074.696846][T29400] genl_rcv+0x28/0x40 [ 1074.696875][T29400] netlink_unicast+0x7bb/0x940 [ 1074.696914][T29400] netlink_sendmsg+0x813/0xb40 [ 1074.696953][T29400] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1074.696986][T29400] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1074.697025][T29400] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1074.697051][T29400] sock_sendmsg_nosec+0x13a/0x180 [ 1074.697087][T29400] ____sys_sendmsg+0x54e/0x850 [ 1074.697121][T29400] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1074.697159][T29400] ? import_iovec+0x73/0xa0 [ 1074.697193][T29400] ___sys_sendmsg+0x2a5/0x360 [ 1074.697218][T29400] ? __lock_acquire+0x683/0x2cf0 [ 1074.697251][T29400] ? __pfx____sys_sendmsg+0x10/0x10 [ 1074.697330][T29400] ? __fget_files+0x2a/0x420 [ 1074.697356][T29400] ? __fget_files+0x3a2/0x420 [ 1074.697395][T29400] __x64_sys_sendmsg+0x1b1/0x290 [ 1074.697426][T29400] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1074.697474][T29400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1074.697499][T29400] do_syscall_64+0x174/0x580 [ 1074.697521][T29400] ? trace_irq_disable+0x3b/0x140 [ 1074.697546][T29400] ? clear_bhb_loop+0x70/0xc0 [ 1074.697572][T29400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1074.697592][T29400] RIP: 0033:0x7fb0bcb9e0d9 [ 1074.697613][T29400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1074.697631][T29400] RSP: 002b:00007fb0bdb15028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1074.697652][T29400] RAX: ffffffffffffffda RBX: 00007fb0bce25fa0 RCX: 00007fb0bcb9e0d9 [ 1074.697667][T29400] RDX: 0000000004000040 RSI: 0000200000000240 RDI: 0000000000000003 [ 1074.697681][T29400] RBP: 00007fb0bdb15090 R08: 0000000000000000 R09: 0000000000000000 [ 1074.697694][T29400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1074.697706][T29400] R13: 00007fb0bce26038 R14: 00007fb0bce25fa0 R15: 00007ffda73abf08 [ 1074.697740][T29400] [ 1075.166959][T29386] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1075.205153][T29386] bond12 (unregistering): Released all slaves [ 1075.228677][T29408] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1075.570101][T29414] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 1075.818216][T29423] lo speed is unknown, defaulting to 1000 [ 1076.339221][T29449] FAULT_INJECTION: forcing a failure. [ 1076.339221][T29449] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1076.379702][T29449] CPU: 0 UID: 0 PID: 29449 Comm: syz.3.5824 Not tainted syzkaller #0 PREEMPT(full) [ 1076.379732][T29449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1076.379745][T29449] Call Trace: [ 1076.379754][T29449] [ 1076.379764][T29449] dump_stack_lvl+0xe8/0x150 [ 1076.379800][T29449] should_fail_ex+0x40c/0x560 [ 1076.379832][T29449] _copy_from_user+0x2d/0xb0 [ 1076.379865][T29449] kstrtouint_from_user+0xd6/0x180 [ 1076.379968][T29449] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1076.380014][T29449] proc_fail_nth_write+0x8e/0x210 [ 1076.380043][T29449] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1076.380082][T29449] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1076.380111][T29449] vfs_write+0x296/0xba0 [ 1076.380153][T29449] ? __pfx_vfs_write+0x10/0x10 [ 1076.380186][T29449] ? __fget_files+0x2a/0x420 [ 1076.380219][T29449] ? __fget_files+0x3a2/0x420 [ 1076.380245][T29449] ? __fget_files+0x2a/0x420 [ 1076.380282][T29449] ksys_write+0x150/0x270 [ 1076.380315][T29449] ? __pfx_ksys_write+0x10/0x10 [ 1076.380354][T29449] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.380378][T29449] do_syscall_64+0x174/0x580 [ 1076.380401][T29449] ? trace_irq_disable+0x3b/0x140 [ 1076.380428][T29449] ? clear_bhb_loop+0x70/0xc0 [ 1076.380454][T29449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.380477][T29449] RIP: 0033:0x7f3c4395e90e [ 1076.380497][T29449] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1076.380516][T29449] RSP: 002b:00007f3c44889fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1076.380539][T29449] RAX: ffffffffffffffda RBX: 00007f3c4488a6c0 RCX: 00007f3c4395e90e [ 1076.380555][T29449] RDX: 0000000000000001 RSI: 00007f3c4488a0a0 RDI: 0000000000000004 [ 1076.380569][T29449] RBP: 00007f3c4488a090 R08: 0000000000000000 R09: 0000000000000000 [ 1076.380583][T29449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1076.380596][T29449] R13: 00007f3c43c26038 R14: 00007f3c43c25fa0 R15: 00007fff86953cf8 [ 1076.380633][T29449] [ 1076.922670][T29471] netlink: 'syz.1.5833': attribute type 1 has an invalid length. [ 1076.986481][T29471] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1077.018089][T29471] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5833'. [ 1077.235427][T29480] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1077.258963][T29480] bond12: (slave batadv1): making interface the new active one [ 1077.274277][T29480] bond12: (slave batadv1): Enslaving as an active interface with an up link [ 1077.590786][T29496] bridge0: port 2(vlan5) entered blocking state [ 1077.619677][T29496] bridge0: port 2(vlan5) entered disabled state [ 1077.652639][T29496] vlan5: entered allmulticast mode [ 1077.674743][T29496] dummy0: entered allmulticast mode [ 1077.705559][T29496] vlan5: entered promiscuous mode [ 1077.711544][T29496] dummy0: entered promiscuous mode [ 1077.728120][T29492] veth1_to_bond: entered allmulticast mode [ 1078.074302][T29501] veth1_to_bond: entered promiscuous mode [ 1078.276711][T29513] veth1_to_bond: left promiscuous mode [ 1078.293615][T29513] veth1_to_bond: left allmulticast mode [ 1079.189607][T29561] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5853'. [ 1079.464058][T29567] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1079.738447][T29573] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1079.801208][T29573] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1079.925033][T29573] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1079.955568][T29573] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1079.977924][T29573] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1079.998113][T29573] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1080.526537][T15238] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1080.552355][T15238] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1080.566376][T15238] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1080.583891][T15238] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1080.591959][T15238] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1080.653974][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1080.663194][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1080.671726][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1080.695999][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1080.704320][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1081.278084][T29621] sctp: [Deprecated]: syz.1.5872 (pid 29621) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1081.278084][T29621] Use struct sctp_sack_info instead [ 1081.521563][T29638] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5877'. [ 1081.629533][T29638] tipc: Started in network mode [ 1081.640127][T29638] tipc: Node identity 4246, cluster identity 4711 [ 1081.650319][T29638] tipc: Node number set to 16966 [ 1081.671861][T27946] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.734871][T27925] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.756967][T29646] lo speed is unknown, defaulting to 1000 [ 1081.766407][T27951] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1082.154658][T29659] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5882'. [ 1082.178718][T29602] lo speed is unknown, defaulting to 1000 [ 1082.432281][T27951] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1082.432336][T29668] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5882'. [ 1082.500137][T29670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5885'. [ 1082.509340][T29670] netlink: 'syz.0.5885': attribute type 18 has an invalid length. [ 1082.517830][T29670] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5885'. [ 1082.728019][T29670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5885'. [ 1082.777814][T29670] netlink: 'syz.0.5885': attribute type 18 has an invalid length. [ 1082.791166][T29670] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5885'. [ 1082.805428][ T50] Bluetooth: hci4: command tx timeout [ 1082.989869][T29679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5887'. [ 1083.231415][T29687] syzkaller1: entered promiscuous mode [ 1083.237554][T29687] syzkaller1: entered allmulticast mode [ 1083.245900][T29693] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5891'. [ 1083.261829][T29693] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5891'. [ 1083.300832][T29693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5891'. [ 1083.370363][T29693] tipc: Resetting bearer [ 1083.415764][T29693] tipc: Disabling bearer [ 1083.440859][T29702] dvmrp8: entered allmulticast mode [ 1083.454345][T29703] tipc: Enabling of bearer rejected, failed to enable media [ 1083.549018][T29703] bond10: option arp_interval: invalid value (18446744073709551615) [ 1083.559752][T29703] bond10: option arp_interval: allowed values 0 - 2147483647 [ 1083.580541][T29703] bond10 (unregistering): Released all slaves [ 1083.804607][T29602] bridge0: port 1(bridge_slave_0) entered blocking state [ 1083.815433][T29602] bridge0: port 1(bridge_slave_0) entered disabled state [ 1083.823058][T29602] bridge_slave_0: entered allmulticast mode [ 1083.831333][T29602] bridge_slave_0: entered promiscuous mode [ 1083.845116][T29602] bridge0: port 2(bridge_slave_1) entered blocking state [ 1083.852702][T29602] bridge0: port 2(bridge_slave_1) entered disabled state [ 1083.860049][T29602] bridge_slave_1: entered allmulticast mode [ 1083.869135][T29602] bridge_slave_1: entered promiscuous mode [ 1083.957411][T29602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1084.027541][T29602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1084.112397][T29602] team0: Port device team_slave_0 added [ 1084.135385][T29602] team0: Port device team_slave_1 added [ 1084.231031][T29602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1084.244296][T29602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1084.271324][T29602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1084.357295][T29602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1084.386249][T29602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1084.433008][T29602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1084.603866][T29602] hsr_slave_0: entered promiscuous mode [ 1084.611954][T29602] hsr_slave_1: entered promiscuous mode [ 1084.618386][T29602] debugfs: 'hsr0' already exists in 'hsr' [ 1084.624788][T29602] Cannot create hsr debugfs directory [ 1084.740089][T29746] bridge0: port 3(vlan6) entered blocking state [ 1084.773221][T29746] bridge0: port 3(vlan6) entered disabled state [ 1084.815357][T29746] vlan6: entered allmulticast mode [ 1084.835633][T29746] geneve0: entered allmulticast mode [ 1084.872967][T29746] vlan6: entered promiscuous mode [ 1084.882350][ T50] Bluetooth: hci4: command tx timeout [ 1084.896114][T29746] geneve0: entered promiscuous mode [ 1085.366286][T29602] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1085.403420][T29602] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.498845][T29761] bridge0: port 1(veth0) entered blocking state [ 1085.524524][T29761] bridge0: port 1(veth0) entered disabled state [ 1085.551353][T29761] veth0: entered allmulticast mode [ 1085.562269][T29761] veth0: entered promiscuous mode [ 1085.570765][T29761] bridge0: port 1(veth0) entered blocking state [ 1085.577304][T29761] bridge0: port 1(veth0) entered forwarding state [ 1085.620789][T29602] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1085.636600][T29602] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1085.670043][T29772] Cannot find add_set index 0 as target [ 1085.677400][T29765] can: request_module (can-proto-0) failed. [ 1085.876237][T29602] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1085.904314][T29602] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.058840][T29602] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1086.108466][T29602] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.749170][T29602] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1086.766858][T29602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1086.777339][T29602] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1086.809243][T29602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1086.835173][T29602] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1086.877640][T29602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1086.898966][T29602] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1086.962082][ T50] Bluetooth: hci4: command tx timeout [ 1086.966905][T29602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1086.978594][T29839] openvswitch: netlink: Message has 4 unknown bytes. [ 1087.022915][T29833] netlink: 'syz.3.5924': attribute type 3 has an invalid length. [ 1087.057869][T29841] tipc: Enabling of bearer rejected, already enabled [ 1087.205816][T29602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1087.228012][T29852] netlink: 'syz.0.5927': attribute type 2 has an invalid length. [ 1087.252494][T29602] 8021q: adding VLAN 0 to HW filter on device team0 [ 1087.296091][T14110] bridge0: port 1(bridge_slave_0) entered blocking state [ 1087.303360][T14110] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1087.356465][T14110] bridge0: port 2(bridge_slave_1) entered blocking state [ 1087.363716][T14110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1087.436398][T29860] __nla_validate_parse: 8 callbacks suppressed [ 1087.436419][T29860] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5930'. [ 1087.485187][T29860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5930'. [ 1087.514776][T29860] netlink: 'syz.1.5930': attribute type 18 has an invalid length. [ 1087.565860][T29868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5930'. [ 1087.582384][T29868] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5930'. [ 1087.593530][T29868] netlink: 'syz.1.5930': attribute type 18 has an invalid length. [ 1087.758973][T29872] netlink: 136 bytes leftover after parsing attributes in process `syz.3.5933'. [ 1088.042516][T29882] bond4: Unknown bonding mode 6 for xdp xmit [ 1088.135258][T29887] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5937'. [ 1088.691372][T29602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1088.819981][T29911] netlink: 2136 bytes leftover after parsing attributes in process `syz.2.5941'. [ 1089.047898][ T50] Bluetooth: hci4: command tx timeout [ 1089.071157][T29921] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5944'. [ 1089.087145][T29917] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5943'. [ 1089.174676][T29930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5944'. [ 1089.378561][T29602] veth0_vlan: entered promiscuous mode [ 1089.395568][T29602] veth1_vlan: entered promiscuous mode [ 1089.420804][T29936] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1089.455693][T29602] veth0_macvtap: entered promiscuous mode [ 1089.467162][T29602] veth1_macvtap: entered promiscuous mode [ 1089.488583][T29602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1089.504317][T29602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1089.552515][T27949] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1089.587459][T27949] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1089.624534][T14110] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1089.642109][T14110] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1090.631472][T29963] netlink: 'syz.2.5954': attribute type 1 has an invalid length. [ 1090.657014][T29963] : renamed from dummy0 [ 1092.137623][T29926] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1092.292431][T27925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1092.323736][T27925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1092.514020][T29978] __nla_validate_parse: 1 callbacks suppressed [ 1092.514041][T29978] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5960'. [ 1092.605075][T27925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1092.615985][T27925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1092.859112][T29986] netlink: 176 bytes leftover after parsing attributes in process `syz.0.5963'. [ 1092.988021][T29991] Cannot find add_set index 0 as target [ 1092.999348][T29989] can: request_module (can-proto-0) failed. [ 1095.356655][T29987] syzkaller0: entered promiscuous mode [ 1095.388569][T29987] syzkaller0: entered allmulticast mode [ 1095.620046][T30002] pim6reg1: entered promiscuous mode [ 1095.643267][T30002] pim6reg1: entered allmulticast mode [ 1095.779336][T30000] lo speed is unknown, defaulting to 1000 [ 1095.794158][T30011] netlink: 'syz.0.5967': attribute type 4 has an invalid length. [ 1096.806490][T30049] netlink: 'syz.4.5976': attribute type 1 has an invalid length. [ 1096.837104][T30050] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5975'. [ 1096.862609][T30050] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5975'. [ 1097.047660][T30054] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5979'. [ 1097.086905][T30054] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 1097.154213][T30054] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5979'. [ 1097.437955][T30078] xt_hashlimit: size too large, truncated to 1048576 [ 1097.787199][T30086] syzkaller0: entered promiscuous mode [ 1097.821819][T30086] syzkaller0: entered allmulticast mode [ 1098.654894][T30133] tipc: Resetting bearer [ 1098.834577][T30149] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6001'. [ 1098.910533][T30130] bond11: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 1098.926913][T30130] bond11 (unregistering): Released all slaves [ 1099.201830][T27951] netdevsim netdevsim0 €Â: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1099.218971][T27951] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1099.246351][T30158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6004'. [ 1099.250364][T27951] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1099.317588][T30158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6004'. [ 1099.330821][T30158] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6004'. [ 1099.376649][T27949] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1099.421149][T27949] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1099.450565][T27949] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1099.485680][T30172] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6008'. [ 1100.099994][T30168] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1100.266821][T30168] bond3: left promiscuous mode [ 1100.285299][T30168] geneve3: left allmulticast mode [ 1100.299491][T30168] bond9: left promiscuous mode [ 1100.313564][T30168] bridge4: left promiscuous mode [ 1100.323848][T30168] bridge4: left allmulticast mode [ 1100.398543][T30187] tipc: Enabling of bearer rejected, already enabled [ 1100.412587][T27946] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1100.461960][ T12] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1100.534742][T27946] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1100.559195][T27946] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1100.576006][T27946] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1100.592005][T30205] netlink: 'syz.4.6012': attribute type 1 has an invalid length. [ 1100.601053][T30205] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6012'. [ 1100.628829][T30206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6011'. [ 1100.646462][T30208] xt_hashlimit: max too large, truncated to 1048576 [ 1100.662896][T30206] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6011'. [ 1100.682499][T30208] xt_limit: Overflow, try lower: 268435456/134217728 [ 1100.690635][T30206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6011'. [ 1100.714247][T30208] xt_hashlimit: max too large, truncated to 1048576 [ 1100.721020][T30206] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6011'. [ 1100.735433][T30211] xt_limit: Overflow, try lower: 268435456/134217728 [ 1101.254159][ T12] bond7: (slave ip6gretap2): link status up again after 0 ms [ 1101.313400][ T12] bond7: (slave ip6gretap2): link status up again after 0 ms [ 1101.337605][ T12] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1101.472255][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1101.592725][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1101.615201][T30260] FAULT_INJECTION: forcing a failure. [ 1101.615201][T30260] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1101.659936][T30260] CPU: 1 UID: 0 PID: 30260 Comm: syz.2.6029 Not tainted syzkaller #0 PREEMPT(full) [ 1101.659966][T30260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1101.659980][T30260] Call Trace: [ 1101.659989][T30260] [ 1101.659999][T30260] dump_stack_lvl+0xe8/0x150 [ 1101.660045][T30260] should_fail_ex+0x40c/0x560 [ 1101.660079][T30260] _copy_from_user+0x2d/0xb0 [ 1101.660111][T30260] bpf_test_init+0xd8/0x150 [ 1101.660144][T30260] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 1101.660190][T30260] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1101.660224][T30260] ? __fget_files+0x2a/0x420 [ 1101.660259][T30260] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1101.660288][T30260] bpf_prog_test_run+0x2c5/0x340 [ 1101.660322][T30260] __sys_bpf+0xa22/0xd90 [ 1101.660357][T30260] ? __pfx___sys_bpf+0x10/0x10 [ 1101.660396][T30260] ? __fget_files+0x2a/0x420 [ 1101.660442][T30260] ? ksys_write+0x242/0x270 [ 1101.660477][T30260] ? __pfx_ksys_write+0x10/0x10 [ 1101.660514][T30260] __x64_sys_bpf+0xba/0xd0 [ 1101.660539][T30260] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1101.660563][T30260] do_syscall_64+0x174/0x580 [ 1101.660587][T30260] ? trace_irq_disable+0x3b/0x140 [ 1101.660613][T30260] ? clear_bhb_loop+0x70/0xc0 [ 1101.660640][T30260] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1101.660665][T30260] RIP: 0033:0x7fde9299e0d9 [ 1101.660685][T30260] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1101.660704][T30260] RSP: 002b:00007fde937ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1101.660726][T30260] RAX: ffffffffffffffda RBX: 00007fde92c25fa0 RCX: 00007fde9299e0d9 [ 1101.660742][T30260] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1101.660755][T30260] RBP: 00007fde937ae090 R08: 0000000000000000 R09: 0000000000000000 [ 1101.660768][T30260] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1101.660781][T30260] R13: 00007fde92c26038 R14: 00007fde92c25fa0 R15: 00007ffc7ec979e8 [ 1101.660816][T30260] [ 1101.932511][T27951] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1102.062048][T27951] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1102.173946][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1102.293635][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1102.337816][T30284] netlink: 'syz.4.6035': attribute type 1 has an invalid length. [ 1102.396730][T30287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1103.320074][T30333] syzkaller0: entered promiscuous mode [ 1103.343159][T30333] syzkaller0: entered allmulticast mode [ 1104.174213][T30374] __nla_validate_parse: 13 callbacks suppressed [ 1104.174235][T30374] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6059'. [ 1104.199068][T30374] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6059'. [ 1104.537671][T30380] nbd3: detected capacity change from 0 to 127 [ 1104.563251][ T1753] [ 1104.565729][ T1753] ====================================================== [ 1104.572793][ T1753] WARNING: possible circular locking dependency detected [ 1104.579926][ T1753] syzkaller #0 Not tainted [ 1104.584396][ T1753] ------------------------------------------------------ [ 1104.591540][ T1753] kworker/1:1H/1753 is trying to acquire lock: [ 1104.597728][ T1753] ffff8880400da268 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x373/0x1150 [ 1104.606986][ T1753] [ 1104.606986][ T1753] but task is already holding lock: [ 1104.614431][ T1753] ffff8880271b0178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0x1150 [ 1104.623142][ T1753] [ 1104.623142][ T1753] which lock already depends on the new lock. [ 1104.623142][ T1753] [ 1104.633578][ T1753] [ 1104.633578][ T1753] the existing dependency chain (in reverse order) is: [ 1104.642615][ T1753] [ 1104.642615][ T1753] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 1104.649947][ T1753] __mutex_lock+0x19d/0x1550 [ 1104.655106][ T1753] nbd_queue_rq+0xc1/0x1150 [ 1104.660151][ T1753] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1104.666449][ T1753] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1104.673363][ T1753] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1104.679899][ T1753] blk_mq_run_work_fn+0x16c/0x300 [ 1104.685460][ T1753] process_scheduled_works+0xa8e/0x14e0 [ 1104.691749][ T1753] worker_thread+0xa47/0xfb0 [ 1104.696884][ T1753] kthread+0x388/0x470 [ 1104.701492][ T1753] ret_from_fork+0x514/0xb70 [ 1104.706656][ T1753] ret_from_fork_asm+0x1a/0x30 [ 1104.711969][ T1753] [ 1104.711969][ T1753] -> #5 (set->srcu){.+.+}-{0:0}: [ 1104.719161][ T1753] __synchronize_srcu+0xc9/0x2f0 [ 1104.724650][ T1753] elevator_switch+0x1e8/0x7b0 [ 1104.730013][ T1753] elevator_change+0x2fa/0x480 [ 1104.735310][ T1753] elevator_set_default+0x375/0x440 [ 1104.741044][ T1753] blk_register_queue+0x3f3/0x4e0 [ 1104.746655][ T1753] __add_disk+0x6cb/0xe30 [ 1104.751543][ T1753] add_disk_fwnode+0x100/0x3a0 [ 1104.756837][ T1753] nbd_dev_add+0x733/0xb60 [ 1104.761862][ T1753] nbd_init+0x15f/0x1e0 [ 1104.766604][ T1753] do_one_initcall+0x250/0x870 [ 1104.771911][ T1753] do_initcall_level+0x10a/0x1a0 [ 1104.777397][ T1753] do_initcalls+0x59/0xa0 [ 1104.782349][ T1753] kernel_init_freeable+0x29d/0x3e0 [ 1104.788087][ T1753] kernel_init+0x1d/0x1d0 [ 1104.792956][ T1753] ret_from_fork+0x514/0xb70 [ 1104.798084][ T1753] ret_from_fork_asm+0x1a/0x30 [ 1104.803398][ T1753] [ 1104.803398][ T1753] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 1104.811235][ T1753] __mutex_lock+0x19d/0x1550 [ 1104.816370][ T1753] elevator_change+0x1af/0x480 [ 1104.821676][ T1753] elevator_set_none+0xb5/0x140 [ 1104.827079][ T1753] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1104.833433][ T1753] nbd_start_device+0x189/0xb30 [ 1104.838829][ T1753] nbd_genl_connect+0x1597/0x1c10 [ 1104.844396][ T1753] genl_family_rcv_msg_doit+0x233/0x340 [ 1104.850474][ T1753] genl_rcv_msg+0x614/0x7a0 [ 1104.855548][ T1753] netlink_rcv_skb+0x226/0x4a0 [ 1104.860879][ T1753] genl_rcv+0x28/0x40 [ 1104.865407][ T1753] netlink_unicast+0x7bb/0x940 [ 1104.870706][ T1753] netlink_sendmsg+0x813/0xb40 [ 1104.876099][ T1753] sock_sendmsg_nosec+0x13a/0x180 [ 1104.881678][ T1753] ____sys_sendmsg+0x54e/0x850 [ 1104.886983][ T1753] ___sys_sendmsg+0x2a5/0x360 [ 1104.892198][ T1753] __x64_sys_sendmsg+0x1b1/0x290 [ 1104.897673][ T1753] do_syscall_64+0x174/0x580 [ 1104.902802][ T1753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1104.909357][ T1753] [ 1104.909357][ T1753] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 1104.917982][ T1753] blk_alloc_queue+0x544/0x690 [ 1104.923470][ T1753] __blk_mq_alloc_disk+0x194/0x390 [ 1104.929224][ T1753] nbd_dev_add+0x494/0xb60 [ 1104.934195][ T1753] nbd_init+0x15f/0x1e0 [ 1104.938908][ T1753] do_one_initcall+0x250/0x870 [ 1104.944239][ T1753] do_initcall_level+0x10a/0x1a0 [ 1104.949725][ T1753] do_initcalls+0x59/0xa0 [ 1104.954594][ T1753] kernel_init_freeable+0x29d/0x3e0 [ 1104.960338][ T1753] kernel_init+0x1d/0x1d0 [ 1104.965209][ T1753] ret_from_fork+0x514/0xb70 [ 1104.970341][ T1753] ret_from_fork_asm+0x1a/0x30 [ 1104.975646][ T1753] [ 1104.975646][ T1753] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 1104.982880][ T1753] fs_reclaim_acquire+0x71/0x100 [ 1104.988369][ T1753] __kmalloc_noprof+0xbc/0x720 [ 1104.993674][ T1753] tls_sw_sendmsg+0x59b/0x2b50 [ 1104.999179][ T1753] sock_sendmsg_nosec+0x90/0x180 [ 1105.004672][ T1753] sock_sendmsg+0x1ca/0x2d0 [ 1105.009726][ T1753] splice_to_socket+0xb5e/0x12a0 [ 1105.015206][ T1753] direct_splice_actor+0x101/0x160 [ 1105.020859][ T1753] splice_direct_to_actor+0x57b/0xcb0 [ 1105.026779][ T1753] do_splice_direct+0x195/0x290 [ 1105.032263][ T1753] do_sendfile+0x52e/0x7c0 [ 1105.037221][ T1753] __se_sys_sendfile64+0x144/0x1a0 [ 1105.042894][ T1753] do_syscall_64+0x174/0x580 [ 1105.048024][ T1753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1105.054462][ T1753] [ 1105.054462][ T1753] -> #1 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 1105.062572][ T1753] lock_sock_nested+0x41/0x100 [ 1105.067920][ T1753] inet_shutdown+0x6a/0x390 [ 1105.073088][ T1753] nbd_mark_nsock_dead+0x2cb/0x550 [ 1105.078749][ T1753] recv_work+0x1cee/0x1e10 [ 1105.083706][ T1753] process_scheduled_works+0xa8e/0x14e0 [ 1105.089788][ T1753] worker_thread+0xa47/0xfb0 [ 1105.094915][ T1753] kthread+0x388/0x470 [ 1105.099524][ T1753] ret_from_fork+0x514/0xb70 [ 1105.104677][ T1753] ret_from_fork_asm+0x1a/0x30 [ 1105.109981][ T1753] [ 1105.109981][ T1753] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 1105.117655][ T1753] __lock_acquire+0x1520/0x2cf0 [ 1105.123066][ T1753] lock_acquire+0x106/0x350 [ 1105.128128][ T1753] __mutex_lock+0x19d/0x1550 [ 1105.133265][ T1753] nbd_queue_rq+0x373/0x1150 [ 1105.138513][ T1753] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1105.144610][ T1753] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1105.151570][ T1753] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1105.158092][ T1753] blk_mq_run_work_fn+0x16c/0x300 [ 1105.163651][ T1753] process_scheduled_works+0xa8e/0x14e0 [ 1105.169744][ T1753] worker_thread+0xa47/0xfb0 [ 1105.174867][ T1753] kthread+0x388/0x470 [ 1105.179485][ T1753] ret_from_fork+0x514/0xb70 [ 1105.184622][ T1753] ret_from_fork_asm+0x1a/0x30 [ 1105.189928][ T1753] [ 1105.189928][ T1753] other info that might help us debug this: [ 1105.189928][ T1753] [ 1105.200170][ T1753] Chain exists of: [ 1105.200170][ T1753] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 1105.200170][ T1753] [ 1105.212347][ T1753] Possible unsafe locking scenario: [ 1105.212347][ T1753] [ 1105.219933][ T1753] CPU0 CPU1 [ 1105.225354][ T1753] ---- ---- [ 1105.230732][ T1753] lock(&cmd->lock); [ 1105.234737][ T1753] lock(set->srcu); [ 1105.241170][ T1753] lock(&cmd->lock); [ 1105.247703][ T1753] lock(&nsock->tx_lock); [ 1105.252133][ T1753] [ 1105.252133][ T1753] *** DEADLOCK *** [ 1105.252133][ T1753] [ 1105.260342][ T1753] 4 locks held by kworker/1:1H/1753: [ 1105.265639][ T1753] #0: ffff88801e6f7d40 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1105.276726][ T1753] #1: ffffc90005c47c40 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1105.289622][ T1753] #2: ffff88802703f698 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x144/0x300 [ 1105.299037][ T1753] #3: ffff8880271b0178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0x1150 [ 1105.308042][ T1753] [ 1105.308042][ T1753] stack backtrace: [ 1105.313957][ T1753] CPU: 1 UID: 0 PID: 1753 Comm: kworker/1:1H Not tainted syzkaller #0 PREEMPT(full) [ 1105.313979][ T1753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1105.313991][ T1753] Workqueue: kblockd blk_mq_run_work_fn [ 1105.314015][ T1753] Call Trace: [ 1105.314024][ T1753] [ 1105.314039][ T1753] dump_stack_lvl+0xe8/0x150 [ 1105.314064][ T1753] print_circular_bug+0x2e1/0x300 [ 1105.314092][ T1753] check_noncircular+0x12e/0x150 [ 1105.314120][ T1753] __lock_acquire+0x1520/0x2cf0 [ 1105.314145][ T1753] ? irqentry_exit+0x218/0x8f0 [ 1105.314164][ T1753] ? __pfx___schedule+0x10/0x10 [ 1105.314187][ T1753] ? irqentry_exit+0x218/0x8f0 [ 1105.314207][ T1753] ? nbd_queue_rq+0x373/0x1150 [ 1105.314222][ T1753] lock_acquire+0x106/0x350 [ 1105.314242][ T1753] ? nbd_queue_rq+0x373/0x1150 [ 1105.314264][ T1753] __mutex_lock+0x19d/0x1550 [ 1105.314281][ T1753] ? nbd_queue_rq+0x373/0x1150 [ 1105.314296][ T1753] ? ret_from_fork_asm+0x1a/0x30 [ 1105.314319][ T1753] ? unwind_next_frame+0x8f/0x2550 [ 1105.314369][ T1753] ? nbd_queue_rq+0x373/0x1150 [ 1105.314385][ T1753] ? __pfx___mutex_lock+0x10/0x10 [ 1105.314402][ T1753] ? ret_from_fork_asm+0x1a/0x30 [ 1105.314427][ T1753] ? stack_trace_save+0xa9/0x100 [ 1105.314446][ T1753] ? __pfx_stack_trace_save+0x10/0x10 [ 1105.314467][ T1753] nbd_queue_rq+0x373/0x1150 [ 1105.314485][ T1753] ? __lock_acquire+0x13e8/0x2cf0 [ 1105.314507][ T1753] ? __pfx_nbd_queue_rq+0x10/0x10 [ 1105.314530][ T1753] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1105.314560][ T1753] ? sbitmap_get+0x229/0x390 [ 1105.314635][ T1753] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 1105.314657][ T1753] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 1105.314682][ T1753] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1105.314715][ T1753] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 1105.314742][ T1753] ? blk_mq_run_work_fn+0x144/0x300 [ 1105.314759][ T1753] ? blk_mq_run_work_fn+0x144/0x300 [ 1105.314778][ T1753] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1105.314802][ T1753] ? blk_mq_run_work_fn+0x144/0x300 [ 1105.314818][ T1753] blk_mq_run_work_fn+0x16c/0x300 [ 1105.314834][ T1753] ? process_scheduled_works+0xa20/0x14e0 [ 1105.314851][ T1753] process_scheduled_works+0xa8e/0x14e0 [ 1105.314880][ T1753] ? __pfx_process_scheduled_works+0x10/0x10 [ 1105.314900][ T1753] ? assign_work+0x3cf/0x5d0 [ 1105.314918][ T1753] worker_thread+0xa47/0xfb0 [ 1105.314942][ T1753] ? __kthread_parkme+0x71/0x1f0 [ 1105.314965][ T1753] kthread+0x388/0x470 [ 1105.314987][ T1753] ? __pfx_worker_thread+0x10/0x10 [ 1105.315003][ T1753] ? __pfx_kthread+0x10/0x10 [ 1105.315030][ T1753] ret_from_fork+0x514/0xb70 [ 1105.315055][ T1753] ? __pfx_ret_from_fork+0x10/0x10 [ 1105.315076][ T1753] ? __switch_to+0xc89/0x1420 [ 1105.315096][ T1753] ? __pfx_kthread+0x10/0x10 [ 1105.315118][ T1753] ret_from_fork_asm+0x1a/0x30 [ 1105.315148][ T1753] [ 1105.600515][ T50] block nbd3: Receive control failed (result -32) [ 1105.774589][ T1753] block nbd3: Send control failed (result -32) [ 1105.780838][ T1753] block nbd3: Request send failed, requeueing [ 1105.787252][ T1753] block nbd3: Dead connection, failed to find a fallback [ 1105.794518][ T1753] block nbd3: shutting down sockets [ 1105.799769][ T1753] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1105.809347][ T1753] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1105.817268][ T1753] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 1105.826897][ T1753] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1105.834764][ T1753] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1105.842620][ T1753] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1105.850590][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.861295][ T1718] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1105.869464][ T1718] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1105.877553][ T1718] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1105.885895][ T1718] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1105.893955][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.903591][ T1718] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1105.911440][ T1718] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1105.919802][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.933456][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.943916][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.954443][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.964482][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1105.974624][T30389] ldm_validate_partition_table(): Disk read failed. [ 1105.981540][ T1718] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1105.992552][T30389] Dev nbd3: unable to read RDB block 0 [ 1105.999589][T30389] nbd3: unable to read partition table [ 1106.023135][T30389] ldm_validate_partition_table(): Disk read failed. [ 1106.030807][T30389] Dev nbd3: unable to read RDB block 0 [ 1106.038786][T30389] nbd3: unable to read partition table [ 1106.301744][T27925] net_ratelimit: 55 callbacks suppressed [ 1106.301769][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1106.432045][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1106.541749][T14110] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1106.652089][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1106.761785][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1106.881985][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1106.991766][T14110] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1107.101739][ T12] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1107.211990][T27925] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1107.321786][T14110] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1111.342157][T14110] net_ratelimit: 35 callbacks suppressed [ 1111.342180][T14110] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1111.462394][T27950] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1111.572076][T14110] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1111.681865][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1111.792015][ T12] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1111.901840][ T12] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1112.011938][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1112.121815][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1112.232175][T14110] bond7: (slave ip6gretap2): failed to get link speed/duplex [ 1112.341876][T27946] bond7: (slave ip6gretap2): failed to get link speed/duplex