last executing test programs: 5m20.107560604s ago: executing program 4 (id=2280): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan0\x00'}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000000c0)={r1}) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r3, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000580)={0x14, 0x1, 0x3, 0x801}, 0x14}}, 0x0) (async) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x3f, &(0x7f0000000340)=0x7e, 0x4) (async) close(0x3) (async) r4 = socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000a40)=""/4072, 0xfe8}], 0x1}, 0x0) (async) write$cgroup_subtree(r4, &(0x7f0000001ec0)=ANY=[@ANYBLOB="004000003a00913a74067388481f9c0e0a"], 0xfe33) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056842bb002552da15f6", @ANYRES32=0x0, @ANYBLOB="000000293c000000280012800a00010076786c616e00000018000280140013"], 0x48}}, 0x0) (async) r5 = socket(0x10, 0x3, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.numa_stat\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5}) (async) sendmmsg$alg(r5, &(0x7f0000000140), 0x4924b68, 0x0) 5m20.015407646s ago: executing program 2 (id=2283): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r0, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) unshare(0x22020400) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000012c0)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r6, 0xad7f585b85390de9) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r9 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) r10 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=@newlink={0x38, 0x10, 0xffffff1f, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, 0x821}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6=r9}]}}}]}, 0x38}}, 0x0) (async) sendmsg$inet(r8, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r12, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg(r11, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r1, 0x4) 5m19.947205098s ago: executing program 4 (id=2285): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x77, &(0x7f00000002c0)="1a00000002000000", 0x8) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_HASH_MAX={0x8}, @IFLA_BR_MCAST_HASH_ELASTICITY={0x8}]}}}]}, 0x44}}, 0x0) 5m19.791365586s ago: executing program 2 (id=2289): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, 0x0, &(0x7f0000000140)) 5m19.740684808s ago: executing program 4 (id=2290): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x1, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}]}, 0x50}, 0x1, 0x7}, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x42}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6=r1}, @IFLA_GTP_FD1={0x8, 0x2, @udp6=r1}]}}}]}, 0x40}, 0x1, 0xba01, 0x0, 0x4000000}, 0x0) 5m19.647445141s ago: executing program 2 (id=2292): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000001a00)={0x30, r3, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SOCKETS={0x4}]}, 0x30}}, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x24, r1, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x24}}, 0x20000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f00000001c0), r4) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000fc0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002dbd7000fddbdf250100000008000100", @ANYRES32=r6, @ANYBLOB="3c000280380001"], 0x58}, 0x1, 0x0, 0x0, 0x20040881}, 0x0) 5m19.547983101s ago: executing program 4 (id=2294): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="fc0000001000010400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000000002b000000ac1e01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000002abd7000000000000200000000000000000000000c0008000800080000070000"], 0xfc}}, 0x4000) 5m19.452612945s ago: executing program 2 (id=2296): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4c, &(0x7f0000000040), 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000060a0b04000000000000000002000000500004804c0001800a000100696e6e65720000003c00028008000240000000840800034000000007080004400002000f0800014000000000180005800e0001007d6d6d656469617465000000040002800900010073797a30000000000900020073797a32"], 0xa4}}, 0x0) 5m19.35043026s ago: executing program 4 (id=2297): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000828bd7000fddbd5ff7f2ef1330e8dc0fc5bb29269b4dffdffffdf00080001003500000008000300", @ANYRES32=r2, @ANYBLOB="0c009900ff070000700000000a00180003030303030300000800050000000000"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) 5m19.16308406s ago: executing program 2 (id=2298): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f00000000c0)) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r6 = socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r7, &(0x7f0000000080)={0x1d, r5, 0x3, {0x2, 0xff, 0x4}}, 0x18) bind$can_j1939(r6, &(0x7f0000000140)={0x1d, r5, 0x3, {0x2, 0xf0, 0x1}, 0xfe}, 0x18) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x28, r2, 0xa11, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_ELEMENT_TTL={0x5}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0xc8) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)={0x84, 0x0, 0x1, 0x70bd25, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME={0x68, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x3}, @broadcast, @device_a, @initial, {}, @value=@ver_80211n={0x0, 0xf, 0x1, 0x3, 0x0, 0x0, 0x1}}, 0x0, @default, 0x508, @void, @val, @void, @void, @val={0x6, 0x2, 0x2}, @void, @void, @val={0x2a, 0x1, {0x1}}, @val={0x3c, 0x4, {0x1, 0x5, 0x57, 0x2}}, @val={0x2d, 0x1a, {0x4000, 0x2, 0x4, 0x0, {0x7fd, 0x7, 0x0, 0x0, 0x0, 0x1, 0x1, 0x2}, 0x6, 0x9, 0x7}}, @void, @val={0x71, 0x7, {0x0, 0xffffffffffffffff, 0x0, 0xfa, 0xffffffffffffffff, 0x8d, 0x60}}, @val={0x76, 0x6, {0xe, 0x39, 0x3, 0x2}}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x8090}, 0x20040000) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c000180060006006558000008000280"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) 5m18.863570728s ago: executing program 2 (id=2302): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xb, &(0x7f0000000080)=@framed={{}, [@printk={@lli, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0xfff8}, {}, {0x85, 0x0, 0x0, 0x10}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x1e00, 0x11}, 0x94) 5m18.73506458s ago: executing program 4 (id=2304): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="b7000000000000004e0000000000000040001e00000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xb579, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff0e}, 0x23) 5m18.419746469s ago: executing program 32 (id=2302): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xb, &(0x7f0000000080)=@framed={{}, [@printk={@lli, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0xfff8}, {}, {0x85, 0x0, 0x0, 0x10}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x1e00, 0x11}, 0x94) 5m18.404456081s ago: executing program 33 (id=2304): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="b7000000000000004e0000000000000040001e00000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xb579, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff0e}, 0x23) 8.654843168s ago: executing program 1 (id=5697): r0 = socket$kcm(0x10, 0x2, 0x4) socket(0x14, 0x2, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r3, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}, @in={0x2, 0x0, @private=0xc0586300}, @in6={0xa, 0x0, 0x0, @private0}, @in={0x2, 0x4e20, @broadcast}], 0x58) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20000000) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x2c, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x5}, 0x4004080) sendmsg$inet(r0, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) 8.393202852s ago: executing program 1 (id=5698): r0 = socket$xdp(0x2c, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000090a010200000000000000000000000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000340000000300c000b4047"], 0x78}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) (async) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe8, 0xe8, 0x3, [@enum={0x2, 0x3, 0x0, 0x6, 0x4, [{0x8, 0x81}, {0xa, 0xa00}, {0x1, 0x9}]}, @union={0x1, 0x1, 0x0, 0x5, 0x0, 0x7, [{0xe, 0x3, 0xa8a1}]}, @decl_tag={0x7fffffff, 0x0, 0x0, 0x11, 0x3, 0x4}, @enum64={0x4, 0x3, 0x0, 0x13, 0x0, 0x4, [{0xd, 0x2, 0xb}, {0xe, 0xd811}, {0x3, 0x8001, 0x5}]}, @union={0x6, 0x7, 0x0, 0x5, 0x0, 0x7ab7401, [{0xa, 0x2, 0x1}, {0x4, 0x4, 0x7}, {0x5, 0x5, 0x800}, {0x10, 0x3, 0x7fffffff}, {0xc, 0x1, 0xd}, {0x4, 0x5, 0x174245bc}, {0xc, 0x0, 0x5}]}, @fwd={0xd}]}, {0x0, [0x2e]}}, &(0x7f0000000280)=""/57, 0x103, 0x39, 0x1, 0x9, 0x10000}, 0x28) bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r6}, 0x8) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r5, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x10003, 0x0, 0x3}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r7}, &(0x7f0000000300), &(0x7f0000000340)=r5, 0x1000000}, 0x20) r8 = socket$packet(0x11, 0x3, 0x300) r9 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x25, 0x5, @void}, 0x10) bpf$ITER_CREATE(0x21, &(0x7f0000000240)={r9}, 0x8) (async) r10 = socket$kcm(0x10, 0x2, 0x4) close(r10) (async) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$inet(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="5c0000007a006bcd9e3fe3dc6e08000007000000010000007ea60864160af36504005425198bc3488bc3a0e69ee517d34460bc24eab556a705251e6182949a3651f668c3664402682fb6e27bbfa83b5cae0300c9f4d1938037e786a6", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x2048840) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000040)=@req={0x0, 0x0, 0x0, 0xfffffffe}, 0x10) (async) r11 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r11, 0x6, 0x1f, 0x0, 0x0) (async) sendmsg$NL80211_CMD_GET_INTERFACE(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000001180)={0x1c, r3, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) (async) getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x8, 0xffffffffffffffff, &(0x7f00000001c0)=0x4) (async) r12 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) close(r12) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x6, [@typedef={0x4, 0x0, 0x0, 0x7}, @typedef={0x4}, @union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x0, 0x2}]}]}, {0x0, [0x0, 0x0, 0x0, 0xda]}}, 0x0, 0x4e}, 0x20) (async) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f00000007c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000700)={0x88, 0x0, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xac2e}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffff689}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x400}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2b6}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x40) syz_emit_ethernet(0x82, &(0x7f0000000000)=ANY=[@ANYRES16, @ANYRES64=0x0], 0x0) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)) (async) ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, &(0x7f0000000100)={r2, 0x100000000, 0x2, 0x8}) 8.144893368s ago: executing program 1 (id=5704): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000000906010200000c0000000000020000000900020073797a310000000005000100070000002c0007801800018014000240fe8000000000000000000000000000bb060004404e1f00000500070088"], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) shutdown(r0, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) sendto$inet(r2, &(0x7f0000000100)="528939425fa8e0d99d086ac90432dc188e2f2ce58ce47a8e019f7f7bc8b1cdec11172bcb6d42a78e242b6b1cc6e047d116ee859248df7b139aae3c3711d7fcd9a6c838314a545335e11f89f6141211cc9c2516f7b5c026309d546dbc6811fcd50c50f08ee27a10c3758767eaf6b24be10a56229c7c5ffa984422de0c78705754e5156735c4a4a03a5018d691395287bfd766a99d145de05e2b7fd556e8bc97e827f78d3c733614b612e57b313c7bbb90a46eeb58371bd108c6d8ed9afea11ed99f4d221cdae3c1f041e0aa03c7a3cf8eb9dcfea47067b6bdc25fb5be8a832c4057826b4b3afb6414eb322fde4f0a81", 0xef, 0x0, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) recvfrom(r1, &(0x7f0000000000)=""/101, 0x65, 0x40000023, &(0x7f0000000080)=@vsock={0x28, 0x0, 0x7fffd8ee}, 0x80) sendmsg$nl_route(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=ANY=[@ANYBLOB="48000000100039042abd7000d2ffffff000203e4", @ANYRES32=0x0, @ANYBLOB="03000000c31006002800128008000100736974001c00028008000300ac1414bb06000d000080000006000e0008000000"], 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) 7.855753822s ago: executing program 1 (id=5709): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x5, 0xfffffffd) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000071123b000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xe, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600034000000000060005"], 0xe4}}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x14, 0x9, 0x6, 0x3, 0x0, 0x0, {0xa, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24018800}, 0x24000810) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x805}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x14, 0x4a, 0x3ab3666c4349b199, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r5) r7 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r7, &(0x7f0000003480)=[{{&(0x7f0000000640)={0xa, 0x0, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000680)=[@flowinfo={{0x14, 0x29, 0xb, 0x1}}], 0x18}}], 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="0100fdffffff000000000800000008000300", @ANYRES32=r8], 0x1c}}, 0x44040) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001240000000000500150020000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x3c}}, 0x880) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x1a043000) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt(r11, 0x400000000000003a, 0x1, 0x0, &(0x7f0000000000)) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000080)) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd608a96460014040000000000000000000000000000000000fe8000000000000000000000000000aa00000000", @ANYRES64=r10, @ANYRES16=r10, @ANYBLOB="a5ca4153a4683101f7126ec1201e9d0abb05541d97f6ff63bab8621a2c68a9e5eec4f90da1fece0d89747d1f98af1034e1faa173"], 0x0) 7.527571571s ago: executing program 1 (id=5716): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) (async) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x128}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x800002, 0xcf, &(0x7f0000000580)=""/207, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYRESDEC=r3, @ANYRESOCT=r2, @ANYBLOB="0000000000000000000000001d00000000000000705ec16cba58f4f92be9441b9df0d8d0ebd7d3f37bb415acbcde6a123d869de01fd44d261e4cd5bf7ce6381384a9ca89c138182f311ec7568977bd7bf225569d7220dfa10762df782ffaa95e6eeb546d1076ecec0da9ceeab02922d46a32466388234b8a38b474a89322075cef9c0f00f47ffefe02af0ea7838678d5d4349752f6cbde", @ANYRESOCT=r1, @ANYRESHEX=r2, @ANYRESDEC=r3], 0x48) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000bc0)={'sit0\x00', &(0x7f0000000b80)={'gre0\x00', 0x0, 0x7800, 0x700, 0x9, 0x7, {{0x5, 0x4, 0x2, 0xf, 0x14, 0x64, 0x0, 0xa, 0x4, 0x0, @rand_addr=0x64010101, @broadcast}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000bc0)={'sit0\x00', &(0x7f0000000b80)={'gre0\x00', 0x0, 0x7800, 0x700, 0x9, 0x7, {{0x5, 0x4, 0x2, 0xf, 0x14, 0x64, 0x0, 0xa, 0x4, 0x0, @rand_addr=0x64010101, @broadcast}}}}) r6 = socket(0x25, 0xa, 0x188ddaa9) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r6, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, r7, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x10001}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xfc}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x20044045}, 0x8000) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000540), &(0x7f0000000080), 0x619, r4}, 0x38) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000540), &(0x7f0000000080), 0x619, r4}, 0x38) 7.366367046s ago: executing program 1 (id=5720): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000240), 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000006c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r3, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x28, r5, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x20044040) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=0x0) sendmsg$NFC_CMD_START_POLL(r3, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x64, r4, 0x100, 0x70bd2c, 0x65dfdbfb, {}, [@NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x44}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x24}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x2}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xec}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x30}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x80}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_TM_PROTOCOLS={0x8, 0xe, 0xcc}, @NFC_ATTR_IM_PROTOCOLS={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000) r8 = accept4(r2, 0x0, 0x0, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r8) sendmsg$NL80211_CMD_STOP_AP(r0, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x20, r9, 0x300, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x80000001, 0x6}}}}, ["", "", ""]}, 0x20}}, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r8) r10 = socket$can_bcm(0x1d, 0x2, 0x2) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r11, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) connect$can_bcm(r10, &(0x7f0000000140)={0x1d, r12}, 0x10) sendmsg$can_bcm(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0500"], 0x48}}, 0x0) close(0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)={0x30, r1, 0x1, 0x70bd29, 0x4, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x14, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xca}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x80) 4.464146346s ago: executing program 5 (id=5751): r0 = socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000040)=0x840, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'tunl0\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x4004, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14) 4.363942768s ago: executing program 5 (id=5752): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) write$nbd(r1, &(0x7f0000000400)=ANY=[], 0xb4) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_int(r2, 0x0, 0x16, 0x0, 0x0) 4.167286536s ago: executing program 5 (id=5754): r0 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) ioctl$FIOCLEX(r0, 0x5451) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000380)="1323c456e2a659885728853f28e4f9565dfb3099f80cf478217c38a38bad0cc70aeca83401372fa5f6a6e4cc74a4bdbaf6c373a73b429b6c7fdf67e214c89a2204c7a69fdbfd1811b97113e114be835c2408d2af71931d7a9ca3ffa28a9767402d4fd3a1f042eb280aa4292d2710b7d56cd6dedc77384cfa5e84211846ee93e3a1973c73e348e8b211de2fdaeec56a82d273b09f276c43ea7ff1a3cf7dae8608474f1766d3b81713423014613a616f8b199cfe53abea04fc8bd68114cc0c3ede6fd7d6e8add1a61ce4db83bdca97ebc1ac9820dd5d79a1e74f2c41d9e5d5bee79797b4ce6fdb6aa611d0b335285d3db5613b13ca32019604d42912bb9592c5661242279648b7f868fc9862ad4fa71094e0189b258a1d6369c6b7c4c206eb5b0fa793d7d0b645e1e9731b5d64acb38118eb20f18c0ac2c1bb4e59476df1d8876cfa330ec6698685a657a40fd52c999c6061feb620bef44380aee58157199be51eb88d5231b78f2ed8a5515d395b783977bd6316934838ed3e25d5f3065b0358490523a749450ffdaf57dc93d706f6b1ebf03bb6ff36765bb61d8fb75af0ac62c26267fb25ff77c38978a5e735421db136eca51eff7a1380a6766f1d150ad90309a830c0c454d0da0e15b9a78192d37b907f5576e26055cb71faa59db337a45d3b0717fdf11afb35e4fa572eb55effb4a25263c0bd9a6f150ad92eea4c43a333eb78e625603bdad3274e85b3c2594a338e3f31637489bdc0317902ec4c985322b620104abac79e9a087ed54ead307e18e57ed8b9771515193253839081aae7d33f36ec36aaef827a64a446e4b8caac73650526c378214637fd0d4d4af748889eaf84265499c6187c9ba93324a93c12f14319e8264b3eac075054def4e9e667404464659718cb78dde4e50aa167aa19be4e0c78cae38ce07b7d8fbebfa7a0a119b6b397db91fd4f8715273171cc18740887ca35176cb91cf25f2d774872cda95edf86c0470f42653c8a4a9f9d4526c1ae6fdf870d38fda1ca389237d2ed6f25b71c28bbc85a2b4907dc502a7f8c79a12730aeb7b6245e5de6b4d59e27ab63e408fbf16aca9375b183573aee8f25aeb22e4d88773ad14b3fd65ffdd0997fce9729a266161910462fd9a50cfcbfb6e38314ce4f41eda8336886ea35c0ae3483ee65af7d32a728527fbb2b0207b9b8dfe89d357b49b669ac86864e8db6027a4a901286a72cbd0c2f1aaf339670fa999f581d7ec8204bdeb72a8242526df62b94982198d7f1b9dd901f957a6bb242a09d67802c6555f2a2da8d342c3d2c78923f3185b8821b3e33691287d2229e94eb413c027ab46ab8998540d035faa8888a67fe92c1141d66cefbe8f497b08bb1a3ea07211b439d5490472fa3625f3da6f9497e0ab49287d05247fa502215260fd8e42110a858debbffd086ff256c07856f38db648a97a9dcb59c21e75e5abdd469c9151bf4a10f6a44a6f658fac6580399feb1bbd67d483b8fa1254eec19a4522b524928a8f8ddf97a6612a1d44aa9aff65b41bf1be54c3208a4694c814263750c333790b8133df04298688a9559ed53fd5c13d3161ba0aaf2437fadd5d440795cc57d1f51b70ba146c9ef4b283583bc93edc10f3e8e13da137d51320018a11b26a9ad7ea0719068cff2aa51e9fefc33ec8871a7b6199b00e22555f1d97322e4433fb3978bdf4593607aa010941f6d96dc74dfec87a108047fb202dc79681f52c59d5841aca93b69a57a02384976a574970b2b4b8580dbb51f082514896c00a5501207cd172d5c6a5c33c278dfe1d5ceaf7afed7c4403370b84e579c2756ddd39de340622fbfae1696d28e8014d6a32fa11327f5a1b4e81faca9e380a29a649e2a5bac219b5d8a8138306c5ee124eb92c2510a665164c03724c46deef1fec935299883716dd39c7190668a1e211f690fd9f13c338223ddd166f41cbfc583e91201af8a605b8d5672f5311adeaaa66ebf48f4ee1f8568d11be876a2955725f539a01701905e7f7cbb0d7b043c67c1c6d59e150f5dfbd319b9bb4eadd554f1b8b512d425a62200d005ac68aba47e8f759c2ed351393eb89c51c37a29d4a7051a063535915db5a7ece6bba934452ee65f4ae75ebff1199d6319fac5107da4fbb84612ff8b57b0db737d90ad3c5151b5e593e58198c04f336c90d36eba959a7e75c10fec7c788c2ef8cdf6f91f8c96d0df683b9b7602774d267d117ec726319f874719a83543383e097966dc4d45e0e0405de7a86560b3222ddcc933818e730733c476e362b2bf301fbf08abc3925bf883396e04fc0d0917b0510db14de878dff3d3d8ef0c31d4918d21775c4c16861e878211b36b61dda4c9e5131b8007f74ff89a12911d971763614b82fa1776df01d5ec95e1d61d76aab2845f76c8857ecb36d309d6a6c77039c35b5223d9432f4244b51125a83cc2c3aac2492c168179bf09d161acf3a3f04a59e31bb3c552092ac2aef4f745cfecc881ff630ddb355dd00285f394dc5f63a906320ba417fa7ca02ea5ce83a642704cdc55a2e59e15c4739a28d29818239f95c6cc0b747e4fb507145236eed804199432777ff8d598f5b622a40594dd22abb3b6cbf814b6109cd6141f5245f3bbc414f329818bf0d6b2e0859070ef757c8d108c8a0f8cab616f49d6e33e74bb26f2f2a0d80e6047ebe839cc211daf672cccb82d46239c3261be1c0e95e700e4ade6bdb039cb5adcefb0eabcb1ddbdd406be672502158079612be3e1baeb1cf86efbd89b8510efe80875a837fe84185343f1121b43eaea94eaa4e8da10c4460928eb4e0a29506ee29ec6185546659b8503c91835a0f4630bc127e77e51c650cc790bc266425abe481c77ff6462c5f587a34f68848f7b674943f624a6a09b02f2d8327d63c281b97a6ceb3455417af42ac942405189be4e8a1da53a10c8fc24d157db3ce78a4634482654d00e4a87c74c8dab067bee20b33e047f55000a03c585f6c00fccb09008925a0b551c261ede9ca496379183d6bedd418c97746a1208afc5affaa160f9c92146dfe50ae5cfbbed4754eac096d12eeddebbc7a107bd93b1df79f3353fc4eac263014663273d1c431decef36171619a0bcd0f148a459431e8728ec44ee35970eed685fa7589d4dcfb79e1b98a330d3814401f9e2a50281265c5ba16429f538d30dc998bbb3ffd177deb9787082859d8569bc4d9b66f9d0fd63a892fe49bc746b03101f8191e3e3e8e4dc6c0ee83c7134271e4cebf9449b13fe4e01ede40544edc80f2df8af7741ca6311f5d9b5e55afcaaae30ea67662230ed8ced039ab5d4d003dcaf0c7174efc8c2a13520023d0b865250177e0241cd9738562d06dffbfce99bd482daf49fe024e9a0c741d854a8030efb3afaebaac4210df0738c346974d4a2b526bf47032b2c4f5a76c6acd47819d64df43740d4a7bf07db87613f8fa7c7e394de6ca79b9bb65d922fbf2d547afb5f3a1565b66d31d70732df18b8a306ef529d5682b893cfc0ac98b576537be1f87e373f42e6cc5973c1aa3ff3a70478bf6a7dcd1aff546aadf31489e788c527999229d72da3b3e47e5d9b6ab23cdd628d355379fe7924cdd6bbcbce9414c935d697e6f2da6daedc51e4bc77f21ed7257aaad0554a6f1198de04116a44d7ce9a2f92b0e93dbcf58069b6b11c1f2923c8f9c2c204774f03ec26fa06c28ef7fec095f7eb5b00d2c24068d38407787ac08628fe51b47a43f8c970e7a0dabc81474540dfc07a2376f791b957660389c291cf14ef43507b75dfd58d644e42fc4b83f4917adcc5eebb6bd582088b41010ce11d9e6ea65c3ebf0820356b0d567582f3cdac473894e8706c2191776c5edf5036e6d507b4563c839509d56e3ec463ee7681487be911c194c043956fa63a15701d9c28d863412411a1baa0c8ac6ad6c5d5f1567a311ed4d793064926e64ac8ab73888b9ad88dff6bc0f7026a4cd282c9557d1e5d279b1d58bc4355ffa70fbdcaabd8233ef68d4a78bb7d93f0ff541b22f258697ca3b2fb4df138f53aa575933a0fa1a8f92a6c9d3d8e6d5e232f219ea4c6a831b6105d6b7020004fcf8c040b4a6c69c4a6176dece4b5aa24444092efb4ecf5ad464a3dadbfde0bc7bfe88ebec2c6340d4f0cb82a9ab7c2f4ca4d3fb86f1d8d79c21f2eb8e29810c21a5151dcb11f53f86d29e83763aa3497243eab443e17686fee85245e808ca0598b981436707edd6880c912898850900a323ead3634f839f4d041af41e648b617c6e1cbf9cd624b23fda2a859c4bfed92efe66de6e9e8367375cc9b82f9b961c17b4f0daa656c9cd4ea599ec670724963db56a5781c266ee7c6b03d436c9c97fe354a658a26cf44cfbcb3a953b0287cf0eeb41e6338aca4575a7e397417d12f3f3e30f3fc1f9ab1c3e649bdb24fb79f2b0ac38cfd5961a933d1d1580f51220ccafa8ee25d7b0653de852f0fd78f3ef7bb1a9d2118d4804200aa98f1da9bc0078fe1bc32b1c7d9679f7e9b95acbf57bc10d8292d658d5cf5c6bd384a75201a2178a5e76c69dc3816503cc7977dbbcebe0ac8dce049da72b54be3c92abaf9a413071c2cb62504c53f66c1a3ff675649fd87fa6654957db5bebc29fbec88801909e87136c86fc8030c293821bd2521bbd61a6508dd167cc2f4c5ffc29164c59942f51e31e779c70786a419d20b5a8b1aeecdcfd2c48f9e3218e30c7f420e329104c1cf3a35f5ae02fc759c1cecc1d97672063df9ae5301a717c0b9ce743d14f4bdec9728c98f80d4d47cbb9ca24b15d171f7eba806b8d210f02cf4051e95465501c611548c3870e1ed440c5fd0c4cf48257717cc11abb3f925b105214c6893d394f663295aecc4ada381f738e26a951854f78f36d755a31f43e3423196e29ef74cf7b54ebd67752e04eef129d688038e7944a7c7851030846acc619932079dbb1e8d97cce72ab543375b6350b60e70a4c95848af1c6a12fa7286b1fe50be456211bc708824165bb1c30dc9e1268640420dd435b1ef378c567ccf4866da9fbd317ef06cb6e48f36d0ba62efe8f9f40ff9316733c97526912f76752a3e308be72b737a65e308350e7b9b99ad1f08ca5ec39c37ff7c716aeee8f7ccb74c5ed30a8f8d39e809f27bb64cca1563622739fd0186add2040fb377b7474a49561e9b047793ed47f9536b256ee5db8593cb8f0890b9dc1cb7cca95fdfc9b3f44aa33d6067475ac27d56377af7c9e164af75fd910fc383ab828d93986804feff30acfa3bc55792278232f6f054e3292d00e4e69a3d2256ba424b16c91f62d6bf4a3927ab105973d3892501178363effb7171c1469577382bb9e5bcaaf844e1f3552b51ce7733aa147a60e3447999f12146ab10160272eae69eeeb17351788146135647a161bab3bba11acb70a3a7b896dfe3956e7c3b46cd4cffbf02eb1b9d2b19a3f39922004d93e9ef7aebd19637182aa687d5e4b26de0ba7985ebcc37c49599a888e368ab0d6dc7ec396dfa112fee74717f8ee0aaf241c6206f3eab12cad8f4c6ecd240f7a4deba7dd6bafe5c611c55b1a9b6f34463c00b89f19e3e52f25ac7a1fd200d51881752ac7bab5b5466d0e10b7cb4d36d855470d157df92b882afd9ec89f14efb5aab75110d686ce5bf9aa27cc2cbadbc423b2e3b0407e180d72f4c962a3c9b0334ab467bbcf8b7646e35900e0970d0887040e434d8fb3d35691147d90494db8bdb6286a5a96a4e7a3b1ad6bfc169226fc3e0ebd00302875cdc22b829490863f92838a30664e0783f69ab1c9c5ad51aa6617b41b24a50da6f0852c8e781518c09d313b5", 0x1000}], 0x1) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000200)=@req3={0x10000, 0x100000001, 0x10003, 0x1, 0x0, 0x0, 0xfffffffc}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001e00010000000000007f000007000000", @ANYRES32, @ANYBLOB="000000000a000500aaaaaaaaaabb0000080009"], 0x30}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'syztnl2\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x29, 0x7f, 0x9, 0x2652cadf, 0x40, @rand_addr=' \x01\x00', @remote, 0x7, 0x10, 0x81, 0x4}}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @random="1d4f7293683a"}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000711009000000000095", @ANYRESHEX, @ANYRESHEX=r1, @ANYRES8], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 3.618905421s ago: executing program 6 (id=5755): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00'}, 0x18) r2 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r2, &(0x7f00000000c0)={0x18, 0x2, {0x10, @rand_addr=0x64010102}}, 0x1e) connect$pptp(r2, &(0x7f0000000440)={0x18, 0x2, {0x3, @empty}}, 0x1e) readv(0xffffffffffffffff, &(0x7f0000002340)=[{0x0}], 0x1) r3 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_MMAP_OFFSETS(r3, 0x11b, 0x1, &(0x7f0000002f80), &(0x7f0000003000)=0x80) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000080)=r1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f00000002c0)={0x0, {0x2, 0x4e23, @multicast1}, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e22, @rand_addr=0x64010101}, 0x320, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000200)='rose0\x00', 0x9, 0x3, 0x5}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f00000001c0)='g', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}, 0x2}, 0x1c) shutdown(r4, 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56741, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xfffffffffffffd06}}]}, 0x30}}, 0x0) r8 = socket(0x9, 0x1, 0x8000) ioctl$sock_inet_SIOCGIFNETMASK(r8, 0x891b, &(0x7f0000000340)={'veth0_to_bridge\x00', {0x2, 0x0, @broadcast}}) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x3, 0x6, 0x8, 0x81, 0x8, 0x2, 0x6, {0x0, @in6={{0xa, 0x4e21, 0x2, @private0, 0xd}}, 0xff, 0x9, 0x2, 0x2, 0x6}}, &(0x7f0000000040)=0xb0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@gettaction={0x90, 0x32, 0x6dd711a25f4cb68b, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x70, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xc32e}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffffff2c}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd167}}]}]}, 0x90}}, 0x2004c080) ioctl$TUNSETLINK(r0, 0x400454cd, 0x18) r10 = socket$kcm(0x2, 0xa, 0x2) r11 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$X25_QBITINCL(r11, 0x106, 0x1, &(0x7f0000001380)=0x1, 0x4) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000100)={'veth1_to_batadv\x00', @local}) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) 3.443865813s ago: executing program 0 (id=5757): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000aa91"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000580)=@framed={{}, [@snprintf={{}, {}, {}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffe00}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xc5}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) 3.439481108s ago: executing program 0 (id=5758): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000000440)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)='%pB \x00'}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r1, &(0x7f0000000300)="d009fdcbae142bf4af240b0d390243cb8c67fd4ed88165216b465c06580a40e16f58266dcdac4740a10b1280bd63734f61315dd6a791e9e40c116ac46ce2a4878cd6dc6897b4ba2096fc2964ee26505642869958831bc64158dcbb77d58c596773e6800f4345c2baf5b842e7fdfd3aea4c24fbf048cecf05fc46d012aba7effe2e098a9bd5795e00611340fe0f946a06a13a113b508d4fc550a7aff564f735", &(0x7f00000003c0)=@udp=r0, 0x4}, 0x20) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r2, 0x3}, 0x8) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000040)='veth0_to_team\x00', 0xe) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x40000, 0x0, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000080)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) 1.67307815s ago: executing program 5 (id=5761): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r2, &(0x7f0000000380)=[{&(0x7f00000006c0)="89e7ee0c7cdad9b4b47380c988cafbe863cac50580318bc98470cca6f706", 0x1e}], 0x1) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xffff, 0xb}, {}, {0xa, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_FLAGS={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) 1.566715699s ago: executing program 0 (id=5762): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xffffff6a) r1 = epoll_create1(0x80000) sendfile(r1, r0, 0x0, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f00000000c0)='rpcgss_upcall_result\x00', r0, 0x0, 0x2}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x15, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020692500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000085100000010000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70000000000000085000000060000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x90) 1.434816823s ago: executing program 3 (id=5763): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001300)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x5, [@func_proto={0x0, 0x5, 0x0, 0xd, 0x0, [{0xc, 0x4}, {0xa}, {0x3}, {0x3}, {0x2}]}]}, {0x0, [0x5f, 0x61, 0x61]}}, &(0x7f0000000180)=""/220, 0x51, 0xdc, 0x1}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x24, r3, 0x8, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x16}, @val={0x8, 0x3, r4}, @void}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40000100, 0x0, 0x0) r5 = accept4$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @multicast1}, &(0x7f0000000300)=0x10, 0x80000) sendmsg$NL80211_CMD_SET_REG(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x24, r3, 0x800, 0x70bd2d, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x4b}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000800) sendto$inet(r5, &(0x7f0000000340)="95871e65fbdf27be3b5c1a8af597cc2dcd4734546ceee2aafd8121c4fd7fcaf607", 0x21, 0x4000000, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r6) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150001000000280016802400010000000000000000000004010020000020000000000000000000000000000001"], 0x4c}}, 0x0) 1.376198049s ago: executing program 6 (id=5764): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) socket$packet(0x11, 0x3, 0x300) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r3 = accept(r1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="120000000400000004000000a4"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r4, &(0x7f0000000300), &(0x7f00000002c0)=@tcp6=r3}, 0x47) ppoll(&(0x7f0000000000)=[{r3, 0x2420}], 0x1, &(0x7f00000000c0)={0x0, 0x989680}, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=@newlink={0x38, 0x10, 0x437, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, 0x40c89}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5, 0x5, 0x1}]}}}]}, 0x38}}, 0x0) sendmmsg$inet(r5, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @empty, @rand_addr=0x3}}}], 0x20}}], 0x1, 0x4040880) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f00000027c0)=""/4102, 0x1006}, {&(0x7f0000005540)=""/4093, 0xffd}, {&(0x7f0000000440)=""/207, 0xcf}], 0x3}, 0x0) 1.302839056s ago: executing program 3 (id=5765): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61158c000000000061138c0000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18487b6feb89752cd600000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe0000000000000000000000000044585397feaadda3fcc64e7b0c08f7ac5c64cb190f1712a3b10fc34eb758705f1751d8c8b712eb39d2b8ad44f129c2c9aedb15"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x3}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 1.139556567s ago: executing program 3 (id=5766): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001e00), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r2, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000000c80)={0x4c, r4, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_FRAME={0x22, 0x33, @data_frame={@msdu=@type00={{0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x4}, @device_a, @device_b, @random="4ad168a9bb85", {0x9, 0xa}, "", @value={0xb, 0x1, 0x1, 0x0, 0x3}, @value=@ver_80211n={0x0, 0xf, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x40040c0) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r5, 0x0) socket$unix(0x1, 0x1, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x1c, r9, 0xd6d991d6a72eb001, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x5aad204f6b4b87c2) connect$unix(r6, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="b2", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="14"], 0x18, 0x8800}}], 0x1, 0x40001) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x14, 0x15, 0x301, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) syz_emit_ethernet(0x34e, &(0x7f0000000780)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00ed00", 0x318, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, [{0x0, 0xa, "a78c000005dc8080a2030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "00000500000000de25000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f005"}, {0xe, 0x7, "b8a3e10000a3e1100000006f00ffc0ffff00000000600000ff0bc0fe000000000000000000000000d9a0274400"/55}, {0x0, 0xc, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d180610027628cf9ef083611c9f68e2e1eb3d8bf9c6ab2642c4808298e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c"}]}}}}}}, 0x0) 1.009026313s ago: executing program 5 (id=5767): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="05000000000000007111ab00000000008510000002000000850000002a00000095000000000000009500a505000000008d8d72a4d2b0e866647a5563580154525990a711faae6b5efa82c515c097c645d4a49869490531e6fc004371de6a0e2aeb39db28a841fee433ca770c6799b28945ba973ff15b71d81a48f65b229efa31eb19c4d6945c8db59bf97ce0d74761c6ededcdebebfcd90759bd2cfe8b4253a9468fe5b0759b99a37a189ddd91f7bf447837"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000001400350076"], 0xe8}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) recvmsg$unix(r2, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) ioctl$BTRFS_IOC_DEV_REPLACE(r0, 0xca289435, &(0x7f00000007c0)={0x1, 0x4, @status={[0x1a8000, 0x6e5, 0x15, 0x2, 0x2, 0x4]}, [0x8, 0x8001, 0x9, 0x66, 0xffffffff, 0xf8, 0x4, 0x38, 0xe, 0x9c0, 0x1, 0x7, 0xfffffffffffffffd, 0x8, 0x80, 0x6, 0x6, 0xbc, 0x7, 0x7fffffff, 0x0, 0xe73, 0x4, 0x8000, 0x7fff, 0x24000000, 0xffffffffffffff26, 0x1, 0x9, 0x3, 0x14dbed02, 0x0, 0x3, 0x800, 0x8, 0x5, 0x9, 0x1f, 0x5, 0xd2e, 0xa1f, 0x4, 0x6, 0x9fc, 0x8000000000000000, 0x0, 0x690, 0x8000000000000001, 0x100000000000000, 0xc, 0x40, 0x7fffffff, 0x619, 0x2, 0x10000, 0xa00000000000, 0x80, 0x8000000000000000, 0x3, 0x6, 0x40, 0xfffffffffffffffe, 0xff, 0x81]}) syz_open_procfs$namespace(r5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0xffffffffffffff90, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001e00), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r7, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f00000002c0)=ANY=[@ANYBLOB="760000d3c39e765ba79d78522fdc13d4de4a240e06bdffa125c705580fe4aa052166564f89f8b2e7af6a477f36cbf281721d3fca12bc3e96fb794342a24cc53b92bcb83255494913c5a13108785dfb2872afccfcdb49b6af29f92afbae0e06c419d45f7750bb5a613db8eaf973eb6d031837e2286013f58df70b9319794daf91aaacc06bd2d5d092dd00b5def04874837442a4a30171f4dac80d785f12ef6ee1f0c5bccddeee292fbe43baf8b1b1f4e85056d7716b0662eb1801f25c40b7017f8ca8", @ANYRES16=r9, @ANYBLOB="010028bd7000fcdbdf258800000008000300", @ANYRES32=r8, @ANYBLOB="0a0006000802110000000000"], 0x28}, 0x1, 0x0, 0x0, 0x20040080}, 0x40040c0) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') r11 = socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r12, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r12, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f00000001c0)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}, @in6={0xa, 0x4e21, 0x7, @local, 0x9}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r12, 0x84, 0x1, &(0x7f00000000c0)={r13, 0x1000, 0x3, 0xc, 0x8, 0x7}, 0x14) sendmsg$NFT_BATCH(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c0003801400010067656e657665300000000000000000001400010076657468315f"], 0x104}}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=r10, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) setsockopt(r3, 0x1, 0x243, &(0x7f00000000c0)="dc3f41f49d856092b814e72ca38120710213de640f00a9bd4b1728a66856a4c3cd1debeeb4ef06eb305c39239bed47b65a5414a8f60b38d0c16e5b582afa7bfcd3cdcc4f4992b52ccb3f332584f744f7253dd2ffd1203b3ea6cec0510ee0d0d71e2dfe34f3bd2b8583101fe9", 0x6c) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup=r14, 0x24, 0x1, 0x4, &(0x7f00000001c0), 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) 1.008567688s ago: executing program 3 (id=5768): r0 = socket$isdn(0x22, 0x2, 0x26) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x80044942, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)="88d8ce92d5ad3dd44a5bb374edbeca0340d4e4a988e635195bd364", 0x1b}, 0x1, 0x0, 0x0, 0x20000040}, 0x4c090) (async, rerun: 64) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x15}]}}}]}]}], {0x14}}, 0x7c}}, 0x0) (rerun: 64) 916.820371ms ago: executing program 6 (id=5769): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0xfffffffc, @remote}}]}]}, @IFLA_GROUP={0x8}]}, 0x58}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="900000000002010400000000000000000a000000040001803c0003800c00029905000100000000002c00018014110300fe8000000000000000000000000000bb14000400000000000000000000000000000000003c0002802c00018014000300fc00000000000000000000000000000014000400ff0200000000000000000000000000010c000280050001"], 0x90}}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r1, &(0x7f00000004c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0x1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0xa, 0x20, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x101}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}, @generic={0xe, 0x4, 0x5, 0x5, 0xfff}, @jmp={0x5, 0x1, 0xd, 0x4, 0x9, 0xfffffffffffffffe, 0xfffffffffffffff0}, @ldst={0x1, 0x2, 0x3, 0x3, 0x0, 0xffffffffffffffc0, 0x8}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) 703.454033ms ago: executing program 0 (id=5770): r0 = socket$inet(0xa, 0x801, 0x84) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f00000006c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x6d}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$xdp(0x2c, 0x3, 0x0) (async) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x4, 0x5}}]}}]}, 0x3c}}, 0x2004c840) (async) r6 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r3, &(0x7f0000000040)={0x2c, 0x8, r5, 0x0, r6}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000980)={&(0x7f0000000940)='tlb_flush\x00', r2}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x15, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b7050000000b00006110200000000000d40500002000000095000000000000009abb1723bf2c203831c9545b21c751ee4024f479cbe4b89f9807836ea5847c95ffc926c2e182c7a3221481f5009edaf5f542a715b99fb3d2a73dd02584a54ee68c70dbfbcdcea76ee541e318cbe84cd4f5381f522e258a4d9aeb9b16feb66bf40fdf73be95633dc5de907f2ffdcc18494f09c327abd3a76fee11357181f05f7ac06d6a9078df8bc21f00cd8ac4109850ce4aa147beacafecd5c7ccdeecb146ca1e7611f8b3adb41b39029c1b9b59fbf1b4a80167ca6b113a1600000000000000000000cdb7fe6d684423596ee2bdad7787936c24c84d4721327a695ed24946de35ff5e000091e0610ac2d72b9b6f453f98e7b5a25941905bd564aac36dbe7d1db9f5561ad6f7c2e79fb80b6949d626024b5fb96e3da0d7113b1c826f49a2cbc18001d315aaf280a8a762689f8c6fee958836002f48815ad19ee99d81c9e3cda430cef4a75e5c4dd14c3cbb6af58e3f3b3f8cbd858532b02995d79ca5dac0fd49aa150f6e212e3f46e4f37f372ee43f136e4d3af6cc4a0ce2379cc1010d8483b82e54feeefa1e89d6a3b74fbb4b619c43984223674b40fbe29ea5752c76a5e6a44d95382a9e04f9a51881aedb6d6242d0fe2e7dcf1f8b22f46c37fb010f8e86c62a4c72327c7eaaf720aff72529429aed45219cb1b6476e53b650927d193b4062c4640de2781643edc5e59280c59332e92b52675a02009db11b3829d8424fdf33ccdb7f89bfa14f9c2a17f9183cb48222e685f49340891845efdac175d90c116eaa013315165865f9a3785e21b41fd4b5eda7eb5a7462307fe72a3fe53eb02c75867e6eeebfc3037683f66d407fc28c4735a221bb5b78a6f966474a98ceceb20f0d4757b8e81ab14d29bad2b19aa5aff53ee333009688b401064898f58f88226f0e675cc74f0adaf4b97315e12e88b5eabd519e523a7f0e839fe91774f85a65068de244a78687c12e4e6dffb556c8d30b8ee73faaac455701569da7ae1a4e44fdd2cf28965a9f5e09acf476e07e5ea768c558a5622601742b27b91724dde6a0f96d3e53e67db57bbd0d3f2dd8439192dfc71f9e5f289c7f519e8b794fb09b64fb3c1bcd46731051de09510ebd717eb57655d447753fd2ff052a9d6889ddb5a5f68564bd00a5ff58a75805eadb00000000000000006a9af2471aada1ad164502199e0a668ad4daa53e5658f82733b3c7f36fcf3146adf7025dfd79c5a67c27395f5ca5a90d45402e58b42946b5a977a56385f31083a4b65d61ec4991cd6c91a02bd788825a"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) (async) connect$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) 623.871134ms ago: executing program 6 (id=5771): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0x400, 0x0, 0x0, {0x60, 0x0, 0x0, r1, {}, {0x7baf9fec8731656c, 0xffff}, {0x2}}, [@TCA_INGRESS_BLOCK={0x8}, @qdisc_kind_options=@q_codel={{0xa}, {0x24, 0x2, [@TCA_CODEL_ECN={0x8, 0x4, 0x1}, @TCA_CODEL_LIMIT={0x8, 0x2, 0x5}, @TCA_CODEL_TARGET={0x8, 0x1, 0x80}, @TCA_CODEL_LIMIT={0x8, 0x2, 0xfffffffc}]}}]}, 0x5c}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r2 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000580)={'veth0\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) r7 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000040)={@dev, 0x800, 0x0, 0x2000000000903, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000000)={@local, 0x10000, 0x0, 0x1, 0x1, 0x0, 0x2}, 0x20) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000080)={@private2={0xfc, 0x2, '\x00', 0x1}, 0xffffff60, 0x0, 0x3, 0x2, 0x7, 0xffff}, &(0x7f00000000c0)=0x20) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'veth0\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r8}, 0x10) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@ipv4_newroute={0x3c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0xff, 0x6}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x6}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @private0}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001008210404000000070000000000000036099dc6b82074ccff7cd8ef6df6", @ANYRES32=0x0, @ANYBLOB="adffa888d2260000240012"], 0x50}}, 0xc080) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r10, 0x89f1, &(0x7f00000002c0)={'ip6tnl0\x00', &(0x7f0000000000)=@ethtool_cmd={0x0, 0x0, 0x0, 0x200, 0x2, 0x0, 0x0, 0x0, 0xdb, 0x4, 0x0, 0xfffff7fc, 0x7, 0x0, 0x0, 0x47, [0xfffffffc, 0x80]}}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r10}, &(0x7f0000000240), &(0x7f0000000300)=r8}, 0x20) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x44, r12, 0xb0fe12b999fd9953, 0x70bd25, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xe}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4800}, 0x4000040) 561.904996ms ago: executing program 3 (id=5772): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x9}], 0x18}, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r5, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000001e00)=""/229, 0xe5}], 0x1}}], 0x2, 0x11, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000000)=0x3, 0x4) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x1c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0xf}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000180)={r6}, 0x8) 288.28807ms ago: executing program 0 (id=5773): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="440013001000030425bd7000000000000000000006c3f850cf828ea414ca8eee0b896bc5edeefe3aef0e2876dc66ca6f45d3dae7b5f9a31d05a73c7bf1c6f32456c1ba8bb4c9f7eb6e0c3c4928dbf721a171395c17f2005290864be1033e82d29f56cbf006ec743bda9c164d4372a4", @ANYRES32=0x0, @ANYBLOB="00050000000000001c0012800e00010069703665727370616e000000680002800400120008000a00", @ANYRES32=0x0, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) 287.692107ms ago: executing program 3 (id=5774): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0aa6f133678352f3891b000000440a626a1214fa", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x88dd895beaa99965, 0x12, r0, 0xe352a000) close(0x3) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r1, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r2, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r2, 0x80) accept$netrom(r2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r3, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r3, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) recvmmsg(r1, &(0x7f0000007cc0)=[{{0x0, 0x0, 0x0}, 0x80}], 0x1, 0x32000, 0x0) close(0x3) syz_extract_tcp_res$synack(&(0x7f0000000080)={0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x1076, &(0x7f0000000780)={@local, @empty, @val={@void, {0x8100, 0x3, 0x1, 0x4}}, {@mpls_uc={0x8847, {[{}, {0xc13, 0x0, 0x1}, {0x1}, {0x5, 0x0, 0x1}, {0x1, 0x0, 0x1}, {0x6, 0x0, 0x1}], @ipv4=@generic={{0x13, 0x4, 0x3, 0x15, 0x104c, 0x65, 0x0, 0xcb, 0x79d1e6b47c0bb789, 0x0, @broadcast, @multicast2, {[@ssrr={0x89, 0x13, 0x41, [@remote, @empty, @multicast2, @local]}, @generic={0x82, 0xe, "ad9a8bfea359ac7441a81cd4"}, @noop, @ra={0x94, 0x4, 0x1}, @noop, @generic={0x0, 0xe, "994ceba28bb867c6c3b9dcec"}]}}, "5bb6632c9c7902c023ac1fe7cefad318853df19a1b83973619fe8421763993472aed2554c0d597ed7ac114fc92911f007a81a1936bd270f8fc5713a142cc73d6219339d2e059fafee7008de17bba58a54ff1012f22b9463e0a904a9b31f5ab73d1abd03c6eb967a72c55a11c00fc0412536eef4a04c707cf4a8ffeb395c8e985f5443bcd78e88784ce004f86708aee9c97747da11f761d357cbf91bd1ce35bdd700e692d602859a21d97ef18967818509551dd94fc27b524a22bd53785d6979e2fb784091a33e9e2015da4292cd52b4822250526a79e2af1a4fcfbb7546e53e0c89df12d5f7ba637df6485eb9c56fb021c41b7b19e223aeb9c37010b000b0f1bdfea971d9630d49ef68cee8718e860508722aabb582b744ff789553032e4f27b32cd2031a95dca8ade52d6964fbbfdf5fabb9233ab45f6823eb004961bdc705681db64099aaf5864d71d84d959e58a014d8dde838c85977443dae28990f362002c11c6c048a3515e31fecd06eda0052c93a00a3865774a557ecbd0a11e7d630abdc97918ba1d4d4da594efd45861241816dd8f8fffc34edf699c5e3a5543ab744fa6ad5bb1ccabd7241b2ef0ae4a0c10e26a82343f36ceab8dfea932b324048f88af751054a24a5e77e587a34c6f86ccc82907f7d207355cb9cbd4794e4369343a12662a54625828db31b481ce8920d5e2f073f7d3d6da674cf82ef376cfaeb007a30ad7b1fc5c04dae948e22e4b213985bfb881a8677e9b5aab7e2aa3b8d438fcc11d1c65b04c37abe957134a4d4fede7667ababca701243653947eb223f1f5bf219f2827d97196db31253936180093841a2750ab2567c02a9ad760c62e5ee6b8b0ba7bfc8e45ba2162c1b183640ce73d1eabe243e0da6a5cb520433f80e8301ab8f4cb0dfc65c51692c762323d7dde8b5f5ce4eb2b1549a5b83531a0cb3746ab50af70e9f9c135dff77ddaf5aee8fa6651d6d014f80ab5676fb660e659bddebcb2a6f0eda7ddfb002f1ba92eb73657fe78f979d75b7295ee75981d6c36f57c1104f67fe0598c045d085145043cdf00a9b7b386a17297d4e86ceed164296790e44b1dd41f2d78f7ff3b10c46c8e204402e53707fe6621ff2faf21ceb9c6ea50f00ac8d3b4924a7ff9ffd4aaffcf01f65d02e7c5bb90a1f134a6a0ab819e2d178ad994da3562dfe188bc3e30d5ae260e3776d23e4a61c50dcddc3d25444533df7d1c38be8080c45e4c1922ef49277ee508636c12a770dd3d437692f39676df3eb55d5055400e6ab8bc324b6ffe3d76e2ecacec9f11047ea4751b28e33fa393ffb9f068f694438fed6729928f162bcd84d38ad33cf6806d040fc2800ece58ae150c2c111e7365563bb33475a401ec85517fc7eb0b6737fc5bc6d1d0392791c2f4207790b49725a91729dd49f17f904f0c5aa094f6422e39f5a1bb43a788b0b12ea7571265524c49bcef175d9c1b713a49fa66805d0beed906f6a86ec3e9701da9f477f58baa49c598e4b7536d3d3f92b27af7019bdbeaee034bce7923ed68033b09c32c3c2713b97d22e8276e34a2731008fed068b00fca2bd9b7afb4ff845e2db1414d833aa7659ff716bf6c71667fb89f369de126ff1c1e09ca43c6a71d607ba7267fd2c3f3a889269b8add40e563c7a52f180cfd4133a10b50b1fe93f03335038bd51379839b5ad59a545ffb3f371819e140141cfb04ba883e8a58bd741185358e06d0ca3c3b8f67d1740472db3feb34b80e55fe4dcfb3f1d478b525e91c9f0a7393f908cdfd13ee8e340377a56f4e547d5c7ce0ad6e4ecf5f0feabdb6d7fb5c09117def046419ec1e96385571aa177f7d27275e5c01b12ba67844f5d950f7fca1566e04e8e9da3512529c7b1fc71b21edf1cde61cdeb30e7dd5bfa432bba4b77177e2f467ef4b0c9d137e5fcc69acf2bd49cdafbee8a1e910ba8c979c32575c25d2f0952907c967ea7b1c4220c96113e9494ce95ca6954f18e478335bb670c268095273707f151ede744295a814bd7d8feb3a6364e5dc2fc6460c7b6efceda039094e6fdc22bc5d4a8187acb9ff6aacd5c920743f91683713c098a52e1fb434519fc194e05a50d3aa2ed4803c5a19e8a2a1ad41a8797f06fac40a7a5219f549840d4e6469068ce53d4377f39bcb084cf613a4fe8771722e177174a70ba4293ebd73f0c06f9ad67861ee26158a3bab85304607fe5d0974dc6d2d64900387b744919c9a8cb598b5e5a14a79307b2bd0bee7adbea60044b0ab064c7a2e3d14e893b2a288f290340791576e5450f33f16454c67b9102d5d900750449c2e11fb100305239b1af97bd8b847add5fed2e52dbedd82dede6e2ffe72d5ae648c60c9bdd80974f395aef58a4da28522b8c60e3067c403e43c6174cae3980162ab98e31e80aacb134e1ce207c557347baeef7f04eb71a1ba5e3907fc730dfe800b0be7b1acfa5904c7dadf887ef78031fe24e6beead232c5c0b1ff641b1771d5f2e0b70140687464a0e9319f1a90d705efdd1abf2462910a90970a12dd973cd76826d1cf94210a8d2799e2470c82766cb3de24bd0a7fd190ebc42a231403baac9b261071398c00104339ec714550719f3fd0efbb6f53e69ae85c688a895d566f634c1a354352e1b58ca314333fe009c41f9d8c6965ef2e823561df0366a0422b0b27ee9b2056c956be74474aaf9d88990dd8297b8e2a2c81f81baaa67e308ba3af4fc9e1ce144b87c7c8486411c5722a84547ceaabc9d65b107362040722622a54746ac5a2dfa7f84c2bad8168f716612f1445d6dcca787bd237bdcb187fe4cc17e146db2abe6137e366036fe6ef2941a0d46cfb9af54643616d6f2ea0626fb38cb594a926f424a63640c71e42905a067e069e35902ca3d7c986c56166619d5373eccbbaf82eb000e6b253675c5e1ee89167917da45e417fccb8011a5acc1b1b9ad293580fa94166714615fece43d73ae9f540f913da3941b8bdb8f36b0a5bebf259c538407ca24b03eee94ec7cdd44a0b2e55672c57f7df3dfd15424ab054b1cfc3c7cb26d9dfeef2d037576555c657b646d374cc665ec8b3c8e923b7dc02199c948f6d0c2ac5b93790d09048c9aabb1eda1f88c97bd3f1870b79f46a5d3fa068993c0f9d4d52c9eb447bf35c7677b21d948aaf120998b726a9bcb4d1ac9344722a2549dcff6692754d0f7612c655e29ffd0e04b8ad9d40a6126476449554b6a16a9145040ee8dcf157f8bdd1268427799ae6fc6e2ad96107aa0aaab644f2059f62251edf5c3ff2f3ab8e8bb89bdd4b42f2f0b72c9ae80e3aeeaec7755adf2af479193d77fe620959ac418011dafe1a4081917d2b426f021771aa30153f19c91ba0f78062873fda2bea5cd283420f4ac80c18ea9bd18632e20e00c6e504a43c70dcfee98836e41f781f4521c5c01d0890f381d14af769cbb21df34c5a1f02617ec6b80d01cc76a1019f392e73297c42ea8b50ffc0f3c5ad169f1b59ed9f390d08391062daaa315f949c3fb8d574225f3ef402a2fecbd0872aca48e1939ea282da0c2faa06db5f572c6df36c525946a11d9ba5b47408815ead20f38ea79e69043269dedd1903346409ef77763bb6bfd90a1e543d0eda6af84f545b00df3350d99ce36088db1622258db52b73a2cca52219e43801e957d81129b177a60a9d67f42c88ce1b768dd2cc743d5d95b69f9c80ff6074b332be41c476c9dae1e3808e8acfd52bb8724fe8a542de8fecc16f4597d0b9d687ac055f0860f14bc3342196833794c711184bd16de436765d2404ec36a4025aa248c9b6b1d87a39a0eee0dcb8db234c917b8c5ddb11c71bc18f315aeb57bec0cbe83a0e2f5fb992a438ce146e9bafc4907b623ec99bffede327c2e9443c5da03cbad2896e5da9de89682a26f22205bf287bdebac2576122ad375af559c9ad81fc1064a3121f1590ab495473e336ac09b2de3ac2b8ef7db03c57515988df51f1a759edf5bc7082e3e2d47b572772472df28a60a4553dca48b77757e66e6d2693729174cd48cf4969fd1f3511184c3f2e15014fe94d5e38278a6d5f8006f23b8d87c813ce78dfd9b4a22a0a553eea90a678c21a9a331b6f86ac0768a80725b6d29ae24bb0f0504d894530b475e4faf5d8b5e4ecf752b3ee7c045e116dd876274bf3ac015a0c5b93fdebb7042ee1afbd3fd2a1abd2105d19fb4a7becfa1d396da178d3ea8e754cbbf83100a8fa768c4e3f225327153a19bc8c16e74719dd7bb49a5f61029521d79cc5d3e7ccff5a213a4729739ef1028ea2caa44a8633b6e5a4d60a20e5a96ce04bad7ccd39bc742081ba82c88706a5b2594404d4c5965d6f87accaa6a4e7d8580ad79edb915f61c2efb4cc528b4c8958af3ab956f6da951b75e92bbd5be8ce2085acdb5519d9c17b9dd0994ef1ccfab5c3b6bb5666d72eb4f2f3a21d83ae976d52c6cf28d764b270d018a78bfd77d767564ff059e9e4605c3fcdb4532c13ea87766f66e0584244eb863faeb004703da57cc02b12d6d68fc933f7c20dbcfd20042b9587a1c60699604443c1807ecdce49b928b48a54842d4224717190e26f49da38fadecb0977caf3652513c7bc8fd054dba8baa1463fcb2f62d6eb27b22f752b657fc1387dcb507142c6b3ab336f7a584ef9ead7d402a45c7bdd8ff2294fc97dc742b985273e0ed9323551967ec0bb34fc0c3cae28251332e04da3bdd7b6655f45fd7cd2e934320d3317272ce56e83d846edff61c4d69cbe622c6e9edcf9aa323738a3e47de8fd9adb9d650a771d40304233e4364b73a36ffc99e1fef203ec10456eff10ca490edbbda5d2dde03b9d141e8e1e21815f44036178729480b9e7594b39236bb01156a789315815f78251b4cf2de7bdc7c6af6b7ef9d0227e4c3f870f79e06123ee22cef748f811f60a5c592bb503e722ccf8d5eecc0cd44ff7aca7fe5c53bfe0926ebee89d338c2b158ab961e4024673109d81c500085f78addf1ddd21d96e172a39c00818bad71f05e364a869ddd2a5554178bd3573b4053fcb0d5639b1ee06b5b2629b4d7e3ac53aade27812bda67f44787b7aaa093b24f30d772d2e0de5a99eb1617102a0cad211d021ec5ce5c4ecc6afe6a793792ac20746209e19d4cb611ef7d6068b9f0d8fde874dfddb832a1733cea270e5be4ab3e4fe8bdebf001ef2bf9324297f62680598b645544943c5a627b89587874b76c4b994a8ecbc69af80e32133b82ecbfde10912969405901946452dcb91b5efb3fec6a2d661ab82019788414d3c1848c1ef7802033dcbd0463951a315c19a657bc08e77ae20faddda4cd43cc9ee9557094c265f03f7eeb53da340eeae8c9df060a0159d0129c7c55a88b8fc23c073b00cd0b6535bde0934b044a6f36cb7ca2576d540090efa2f0ba3d83fb686bb7eb6f282d38985360ac4057233f7d6d30cde61aa0f14e5dd56ddc71d4a38dea18e72c6cbf547e820e7cf532474ce14375d2a52fa473d35a1ad94638f3c38f2ad5a3fad993c5f941988f1a8ce057a73b4957ec95d585c4f90b760aa68260c00d8c27c3c0b6f19fa971b6e294305f17371cd3c3a1f6af7fb43d11c2cf9d834ecacaeb431e44891da95eb1d2d851ca1846026cda7f78c3c49cf38e90d0244e00869f6bf67d13ef6e50a45e2ce743af73ee71d173ac5db8947713ddb9a8f472c61ba937746b75da2953d3e1b5f3990d89e42602ad7c23380ab3d1a5a664efae778dfe5b3e8e2f1ca6d2e10858c2138247a1c91962f59103e62d5be6a589f6774ebb4b0dc1c80319934c3fd162d70d114a552c75305e92f7b87e18acaa498e1f2df740799"}}}}}, 0x0) syz_emit_ethernet(0x104, &(0x7f0000000280)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x5, 0xf6, 0x65, 0x0, 0x45, 0x6, 0x0, @local, @empty, {[@lsrr={0x83, 0xb, 0xd2, [@remote, @multicast1]}, @ra={0x94, 0x4}, @noop]}}, {{0x4e23, 0x4e23, 0x41424344, r4, 0x0, 0x0, 0xf, 0x8, 0x0, 0x0, 0xb0, {[@window={0x3, 0x3, 0x3}, @generic={0x1, 0x6, "de51ef7a"}, @mptcp=@syn={0x1e, 0xc, 0x8, 0x1, 0x6, 0x80000001, 0x49a6}, @window={0x3, 0x3, 0x80}, @nop, @mss={0x2, 0x4, 0x1}, @fastopen={0x22, 0x9, "8d1a294b495e11"}]}}, {"e8753a990fa8364d58ecab2c809983399fc585b039c55da285f9b2e11b383c0ad9765aaddf2ee649ed8aba8b46bd7097a7188bd66f1ebbc768844a4532123e2427c45e0c737b0ec6f3572b8ffb4d3765a8104b15f7a71948e23f0e4247f3a739d8112d44c462b290a40e578421eb503542821f4adf368060e367064485f3df212dc6b8a2bd8e766b4b49baa53d7a45f2e2fbaf77a8a7"}}}}}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IP_SET_OP_GET_FNAME(r5, 0x1, 0x53, &(0x7f0000000000)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000040)=0x2c) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="250300000000000000001600000014000180100001006574683a697036745a6e6c30"], 0x28}}, 0x4000000) ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, &(0x7f0000000140)={r5, 0xe, 0x8000000000000000, 0x7fffffff}) ioctl$SIOCX25SCAUSEDIAG(r7, 0x89ec, &(0x7f0000000180)={0x5, 0xb}) 287.434715ms ago: executing program 6 (id=5775): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a34000000140a030000000000070000010900020073797a30000000000900016973797a3100000000080003400000000a140000001100010000000000000000000200000a"], 0x5c}, 0x1, 0x0, 0x0, 0x8884}, 0x404c800) 127.567685ms ago: executing program 6 (id=5776): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'geneve1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000010000100000100"/20, @ANYRES32=r2, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028008000f"], 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000000) (async) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x30, 0x3e, 0x107, 0x70bd31, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0x18, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0xc, 0x15, 0x0, 0x0, @u64=0x30}]}]}, 0x30}}, 0x0) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0902000000000000000001000000050002000a00000014000700ff00000000000000000000000000000108000b00", @ANYRES32=r0], 0x38}}, 0x0) 126.333198ms ago: executing program 0 (id=5777): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe66692712724b2c9, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa}, 0x94) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES8], 0x20}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='blkio.bfq.sectors_recursive\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(r3, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8001000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="10002cbd7df1adaec65e730a63d3a438dbdf25010000000000000008410000000c00180000000369623a00"], 0x28}}, 0x40000) (async) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x24}, 0x1, 0x0, 0x0, 0x20000014}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="64000000100037040000000000002fb01c637c4c", @ANYRES32=0x0, @ANYBLOB="0000000000000000440012800e00010069703665727370616e00000030000280140006002001000000000000000000000000000214000700fc020000000000000000000000000000040012"], 0x64}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_LEAVE_OCB(r6, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r7, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x14}}, 0x40080) (async, rerun: 64) close(0xffffffffffffffff) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r8, 0x0, 0xc8, &(0x7f0000003d40), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x9, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071108600000000001d400500000000002604000001ed00000f030000000000007c440000000000006b0a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c26fc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock=0xd, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, r0}, 0x94) (async) close(0x4) (async) r9 = socket(0xa, 0x3, 0x4) ioctl$sock_SIOCBRDELBR(r9, 0x89a2, &(0x7f0000000000)='bridge0\x00') r10 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=0xffffffffffffffff, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000040)=r10, 0x4) 0s ago: executing program 5 (id=5778): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="8f", 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000e00000000001c00000018000180140002006e657464657673696d30"], 0x2c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x2, 0x16, &(0x7f0000000800)=ANY=[@ANYBLOB="611234000000000061134c0000000000bf3000000000000015000200000000103d030100000000009500000000000000bc26080000000000bf67000000000000070300000fff07006702000003000000160600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f909ad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305865050df26469fac5202d6293c3d5e11f4f83e7455baeeba4f"], &(0x7f0000000100)='GPL\x00'}, 0x94) kernel console output (not intermixed with test programs): 309] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4062'. [ 461.207008][T20309] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4062'. [ 461.251211][T20309] netlink: 'syz.5.4062': attribute type 12 has an invalid length. [ 461.271185][T20309] netlink: 'syz.5.4062': attribute type 11 has an invalid length. [ 462.517614][T20381] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4081'. [ 462.580389][T20381] team_slave_0: entered promiscuous mode [ 462.586829][T20381] team_slave_1: entered promiscuous mode [ 462.606939][T20381] macsec1: entered promiscuous mode [ 462.618217][T20381] team0: entered promiscuous mode [ 462.634106][T20381] macsec1: entered allmulticast mode [ 462.639977][T20381] team0: entered allmulticast mode [ 462.645852][T20381] team_slave_0: entered allmulticast mode [ 462.651915][T20381] team_slave_1: entered allmulticast mode [ 462.659869][T20381] team0: Device macsec1 is already an upper device of the team interface [ 462.671027][T20381] team0: left allmulticast mode [ 462.676117][T20381] team_slave_0: left allmulticast mode [ 462.703830][T20381] team_slave_1: left allmulticast mode [ 462.709457][T20381] team0: left promiscuous mode [ 462.715557][T20381] team_slave_0: left promiscuous mode [ 462.721187][T20381] team_slave_1: left promiscuous mode [ 462.918623][T20400] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4088'. [ 462.928213][T20398] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 462.970364][T20398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4087'. [ 462.980838][T20398] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4087'. [ 462.998287][T20404] netlink: 104 bytes leftover after parsing attributes in process `syz.5.4089'. [ 463.519560][T20433] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4097'. [ 463.559247][T20433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4097'. [ 463.586285][T20433] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4097'. [ 463.639213][T20433] veth9: entered allmulticast mode [ 463.882072][T20446] sch_tbf: burst 4 is lower than device ip6tnl0 mtu (1452) ! [ 463.967048][T20451] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4103'. [ 463.996041][T20451] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4103'. [ 464.104138][ T30] audit: type=1804 audit(1755063184.126:23): pid=20451 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.4103" name="/newroot/159/memory.events" dev="tmpfs" ino=827 res=1 errno=0 [ 464.217898][T20464] tipc: Enabled bearer , priority 0 [ 464.243861][ T30] audit: type=1800 audit(1755063184.126:24): pid=20451 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4103" name="memory.events" dev="tmpfs" ino=827 res=0 errno=0 [ 464.251802][T20464] syzkaller0: entered promiscuous mode [ 464.320299][T20464] syzkaller0: entered allmulticast mode [ 464.362486][T20473] netlink: 'syz.1.4111': attribute type 1 has an invalid length. [ 464.461084][T20464] tipc: Resetting bearer [ 464.550658][T20462] tipc: Resetting bearer [ 464.591247][T20462] tipc: Disabling bearer [ 464.984631][T20502] atomic_op ffff8880577ce998 conn xmit_atomic 0000000000000000 [ 465.037306][T20503] veth3: entered allmulticast mode [ 465.323275][T20533] FAULT_INJECTION: forcing a failure. [ 465.323275][T20533] name failslab, interval 1, probability 0, space 0, times 0 [ 465.384154][T20533] CPU: 0 UID: 0 PID: 20533 Comm: syz.5.4126 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 465.384187][T20533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 465.384198][T20533] Call Trace: [ 465.384207][T20533] [ 465.384216][T20533] dump_stack_lvl+0x189/0x250 [ 465.384257][T20533] ? __pfx____ratelimit+0x10/0x10 [ 465.384283][T20533] ? __pfx_dump_stack_lvl+0x10/0x10 [ 465.384308][T20533] ? __pfx__printk+0x10/0x10 [ 465.384344][T20533] ? __pfx___might_resched+0x10/0x10 [ 465.384371][T20533] should_fail_ex+0x414/0x560 [ 465.384401][T20533] should_failslab+0xa8/0x100 [ 465.384433][T20533] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 465.384461][T20533] ? __alloc_skb+0x112/0x2d0 [ 465.384499][T20533] __alloc_skb+0x112/0x2d0 [ 465.384531][T20533] netlink_sendmsg+0x5c6/0xb30 [ 465.384571][T20533] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.384601][T20533] ? aa_sock_msg_perm+0xf1/0x1d0 [ 465.384631][T20533] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 465.384653][T20533] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.384681][T20533] __sock_sendmsg+0x219/0x270 [ 465.384708][T20533] ____sys_sendmsg+0x505/0x830 [ 465.384745][T20533] ? __pfx_____sys_sendmsg+0x10/0x10 [ 465.384787][T20533] ? import_iovec+0x74/0xa0 [ 465.384812][T20533] ___sys_sendmsg+0x21f/0x2a0 [ 465.384844][T20533] ? __pfx____sys_sendmsg+0x10/0x10 [ 465.384917][T20533] ? __fget_files+0x2a/0x420 [ 465.384945][T20533] ? __fget_files+0x3a0/0x420 [ 465.384986][T20533] __x64_sys_sendmsg+0x19b/0x260 [ 465.385037][T20533] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 465.385078][T20533] ? __pfx_ksys_write+0x10/0x10 [ 465.385110][T20533] ? do_syscall_64+0xbe/0x3b0 [ 465.385141][T20533] do_syscall_64+0xfa/0x3b0 [ 465.385164][T20533] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.385186][T20533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.385206][T20533] ? clear_bhb_loop+0x60/0xb0 [ 465.385239][T20533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.385259][T20533] RIP: 0033:0x7fbe6038ebe9 [ 465.385278][T20533] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 465.385296][T20533] RSP: 002b:00007fbe611af038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 465.385319][T20533] RAX: ffffffffffffffda RBX: 00007fbe605b6180 RCX: 00007fbe6038ebe9 [ 465.385334][T20533] RDX: 0000000004000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 465.385347][T20533] RBP: 00007fbe611af090 R08: 0000000000000000 R09: 0000000000000000 [ 465.385360][T20533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.385372][T20533] R13: 00007fbe605b6218 R14: 00007fbe605b6180 R15: 00007fff91d2e9a8 [ 465.385406][T20533] [ 466.265783][T20562] netlink: 'syz.6.4136': attribute type 1 has an invalid length. [ 466.274923][T20562] netlink: 'syz.6.4136': attribute type 2 has an invalid length. [ 467.449504][T20627] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 468.062742][T20611] delete_channel: no stack [ 468.268576][T20665] __nla_validate_parse: 9 callbacks suppressed [ 468.268599][T20665] netlink: 1200 bytes leftover after parsing attributes in process `syz.6.4162'. [ 468.289171][T20665] openvswitch: netlink: Flow key attr not present in new flow. [ 468.520438][T20681] macsec1: entered promiscuous mode [ 468.527590][T20681] macsec1: entered allmulticast mode [ 468.859495][T20703] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4173'. [ 469.149412][T20713] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4176'. [ 469.214207][T20721] netlink: 'syz.5.4177': attribute type 1 has an invalid length. [ 469.266833][T20721] netlink: 224 bytes leftover after parsing attributes in process `syz.5.4177'. [ 469.456096][T20730] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4180'. [ 469.577144][T20733] openvswitch: netlink: IPv4 tun info is not correct [ 469.856694][T20744] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4186'. [ 469.898052][T20742] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4185'. [ 470.246893][T20769] 8021q: VLANs not supported on ip6gre0 [ 470.509582][T20761] syzkaller1: entered promiscuous mode [ 470.518116][T20761] syzkaller1: entered allmulticast mode [ 470.538123][T20788] netlink: 14 bytes leftover after parsing attributes in process `syz.5.4199'. [ 470.610250][T20789] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4199'. [ 470.666727][T20788] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4199'. [ 470.816199][T20788] pimreg3: entered allmulticast mode [ 470.871096][T20794] tipc: Enabled bearer , priority 0 [ 471.296314][T20821] netlink: 'syz.0.4207': attribute type 1 has an invalid length. [ 471.367050][T20821] bond2: entered promiscuous mode [ 471.376292][T20821] 8021q: adding VLAN 0 to HW filter on device bond2 [ 471.554215][T20827] 8021q: adding VLAN 0 to HW filter on device bond2 [ 471.604718][T20827] bond2: (slave wireguard1): The slave device specified does not support setting the MAC address [ 471.642124][T20827] bond2: (slave wireguard1): Setting fail_over_mac to active for active-backup mode [ 471.743244][T20827] bond2: (slave wireguard1): making interface the new active one [ 471.790690][T20827] wireguard1: entered promiscuous mode [ 471.799501][T20827] bond2: (slave wireguard1): Enslaving as an active interface with an up link [ 472.145151][T20868] netlink: 'syz.5.4216': attribute type 1 has an invalid length. [ 472.213249][T20876] netlink: 'syz.0.4217': attribute type 1 has an invalid length. [ 472.340605][T20876] 8021q: adding VLAN 0 to HW filter on device bond3 [ 472.978420][T20913] dummy0: entered promiscuous mode [ 472.998344][T20913] batadv_slave_1: entered promiscuous mode [ 473.019497][T20913] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:24) already exists on: dummy0 [ 473.032923][T20913] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 473.993579][T20973] __nla_validate_parse: 6 callbacks suppressed [ 473.993602][T20973] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4246'. [ 474.025974][T20973] tc_dump_action: action bad kind [ 474.045228][T20973] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4246'. [ 474.218859][T20983] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 474.225179][T20983] syzkaller0: linktype set to 264 [ 474.286535][T20986] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4251'. [ 474.721143][T21016] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4261'. [ 475.224504][T21052] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4272'. [ 475.237972][T21054] sctp: [Deprecated]: syz.0.4273 (pid 21054) Use of int in max_burst socket option deprecated. [ 475.237972][T21054] Use struct sctp_assoc_value instead [ 475.301849][T21057] geneve2: entered promiscuous mode [ 475.307332][T21057] geneve2: entered allmulticast mode [ 475.322370][ T13] netdevsim netdevsim6 eth0: set [1, 1] type 2 family 0 port 19999 - 0 [ 475.338842][ T13] netdevsim netdevsim6 eth1: set [1, 1] type 2 family 0 port 19999 - 0 [ 475.347778][ T13] netdevsim netdevsim6 eth2: set [1, 1] type 2 family 0 port 19999 - 0 [ 475.360970][ T13] netdevsim netdevsim6 eth3: set [1, 1] type 2 family 0 port 19999 - 0 [ 475.379341][T21057] netdevsim netdevsim6 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.390789][T21057] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.405434][T21057] netdevsim netdevsim6 eth3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 475.484389][T21057] netdevsim netdevsim6 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.500337][T21057] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.510865][T21057] netdevsim netdevsim6 eth2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 475.596754][T21057] netdevsim netdevsim6 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.634942][T21057] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.648834][T21057] netdevsim netdevsim6 eth1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 475.711239][T21057] netdevsim netdevsim6 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.722995][T21057] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.733883][T21057] netdevsim netdevsim6 eth0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 475.994680][ T1041] netdevsim netdevsim6 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.008429][ T1041] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 476.019228][ T1041] netdevsim netdevsim6 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 476.061234][ T3036] netdevsim netdevsim6 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.090923][ T3036] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 476.142189][T21080] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4281'. [ 476.151410][ T3036] netdevsim netdevsim6 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 476.243903][T21087] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4282'. [ 476.327197][ T13] netdevsim netdevsim6 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.379439][ T13] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 476.402465][ T13] netdevsim netdevsim6 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 476.447902][ T13] netdevsim netdevsim6 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.462801][ T13] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 476.475703][T21100] netlink: 'syz.0.4283': attribute type 11 has an invalid length. [ 476.491831][ T13] netdevsim netdevsim6 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 476.544161][T21102] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4284'. [ 476.835180][T21108] svc: failed to register nfsdv3 RPC service (errno 111). [ 476.846072][T21119] netlink: zone id is out of range [ 476.852941][T21119] netlink: del zone limit has 4 unknown bytes [ 476.869116][T21108] svc: failed to register nfsaclv3 RPC service (errno 111). [ 476.928945][T21119] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4290'. [ 477.613949][T21149] team0: Device vti0 is of different type [ 477.737980][T21153] lo: entered promiscuous mode [ 477.762546][T21153] netlink: 'syz.6.4300': attribute type 2 has an invalid length. [ 477.770426][T21153] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 477.807700][T21160] netlink: 'syz.1.4302': attribute type 1 has an invalid length. [ 478.191164][T21180] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4309'. [ 479.197281][T21168] ipvlan0: left promiscuous mode [ 479.361450][T21168] vlan0: left allmulticast mode [ 479.378698][T21168] vlan0: left promiscuous mode [ 479.395857][T21168] macvtap1: left promiscuous mode [ 479.426490][T21168] bond2: left promiscuous mode [ 479.431443][T21168] wireguard1: left promiscuous mode [ 479.476298][ T49] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.527546][ T49] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.563105][ T49] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.582044][ T49] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.686523][T21211] bridge5: entered promiscuous mode [ 479.703421][T21211] bridge5: entered allmulticast mode [ 479.710110][T21213] netlink: 'syz.0.4315': attribute type 1 has an invalid length. [ 479.922954][T21229] netlink: 'syz.0.4321': attribute type 1 has an invalid length. [ 479.934572][T21229] netlink: 228 bytes leftover after parsing attributes in process `syz.0.4321'. [ 479.960397][T21229] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4321'. [ 479.973021][T21230] IPv6: NLM_F_CREATE should be specified when creating new route [ 480.008196][T21230] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4322'. [ 480.092377][T21244] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4325'. [ 480.208221][T21252] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4327'. [ 480.365061][T21260] kthread_run failed with err -4 [ 480.560363][T21276] netlink: 256 bytes leftover after parsing attributes in process `syz.6.4332'. [ 480.856684][T21295] netlink: 'syz.6.4339': attribute type 1 has an invalid length. [ 480.878918][T21295] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4339'. [ 481.020931][T21307] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4342'. [ 481.489751][T21326] netlink: 'syz.3.4343': attribute type 1 has an invalid length. [ 481.650784][T21329] (unnamed net_device) (uninitialized): Unable to set peer notification delay as MII monitoring is disabled [ 481.751226][T21341] netlink: 'syz.0.4348': attribute type 1 has an invalid length. [ 481.759642][T21341] netlink: 212 bytes leftover after parsing attributes in process `syz.0.4348'. [ 481.770896][T21341] netlink: 'syz.0.4348': attribute type 1 has an invalid length. [ 481.831620][T21345] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4350'. [ 482.058019][T21345] bond0: (slave bond_slave_0): Releasing backup interface [ 482.089773][T21345] bond_slave_0 (unregistering): left allmulticast mode [ 482.359754][T21372] netlink: 'syz.3.4358': attribute type 1 has an invalid length. [ 482.386984][ T30] audit: type=1800 audit(1755063202.416:25): pid=21375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.4360" name="memory.events" dev="tmpfs" ino=2250 res=0 errno=0 [ 482.412163][T21372] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 482.444416][ T30] audit: type=1804 audit(1755063202.426:26): pid=21375 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.4360" name="/newroot/440/memory.events" dev="tmpfs" ino=2250 res=1 errno=0 [ 483.728041][ T94] block nbd1: Possible stuck request ffff88802571e000: control (read@0,1024B). Runtime 330 seconds [ 483.739779][ T94] block nbd1: Possible stuck request ffff88802571e1c0: control (read@1024,1024B). Runtime 330 seconds [ 483.751353][ T94] block nbd1: Possible stuck request ffff88802571e380: control (read@2048,1024B). Runtime 330 seconds [ 483.763903][ T94] block nbd1: Possible stuck request ffff88802571e540: control (read@3072,1024B). Runtime 330 seconds [ 484.140628][T21460] tipc: Enabling of bearer rejected, failed to enable media [ 484.596665][T21483] netdevsim netdevsim3 ÿÿÿÿÿÿ: renamed from netdevsim0 [ 485.075329][T21507] __nla_validate_parse: 9 callbacks suppressed [ 485.075353][T21507] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4394'. [ 485.110876][T21509] netlink: 266 bytes leftover after parsing attributes in process `syz.5.4395'. [ 485.197812][T21513] netlink: 48 bytes leftover after parsing attributes in process `syz.6.4397'. [ 485.224093][T21511] tipc: Enabled bearer , priority 0 [ 485.242438][T21511] syzkaller0: entered promiscuous mode [ 485.250730][T21511] syzkaller0: entered allmulticast mode [ 485.281981][T21511] tipc: Resetting bearer [ 485.302205][T21510] tipc: Resetting bearer [ 485.345580][T21510] tipc: Disabling bearer [ 485.491590][T21521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4400'. [ 485.501386][T21521] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4400'. [ 485.510731][T21521] netlink: 'syz.3.4400': attribute type 11 has an invalid length. [ 485.772409][T21534] nbd: couldn't find a device at index -373156329 [ 485.878819][T21536] tipc: New replicast peer: 255.255.255.255 [ 485.886467][T21536] tipc: Enabled bearer , priority 10 [ 486.299546][T21552] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4409'. [ 486.479504][T21564] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4413'. [ 486.568610][T21567] netlink: 'syz.6.4414': attribute type 29 has an invalid length. [ 486.597365][T21567] netlink: 'syz.6.4414': attribute type 29 has an invalid length. [ 486.818891][T21591] netlink: 140 bytes leftover after parsing attributes in process `syz.3.4421'. [ 487.079964][T21606] syzkaller0: create flow: hash 2445615554 index 1 [ 487.088456][T21607] delete_channel: no stack [ 487.118934][T21608] tipc: Started in network mode [ 487.139951][T21608] tipc: Node identity 3a1333b396ae, cluster identity 4711 [ 487.178440][T21608] tipc: Enabled bearer , priority 0 [ 487.206553][T21600] syzkaller0: entered promiscuous mode [ 487.221201][T21613] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4428'. [ 487.229041][T21600] syzkaller0: entered allmulticast mode [ 487.386480][T21616] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 487.409336][T21620] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4427'. [ 487.421379][T21615] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 487.442282][T21619] tipc: Resetting bearer [ 487.457347][T21596] syzkaller0: delete flow: hash 2445615554 index 1 [ 488.302237][ T8872] tipc: Node number set to 2898080691 [ 490.317942][T21600] veth1_to_bond: entered allmulticast mode [ 490.324918][T21600] veth1_to_bond: left allmulticast mode [ 490.338311][T21620] geneve2: entered promiscuous mode [ 490.349346][T21620] geneve2: entered allmulticast mode [ 490.372771][T21599] tipc: Resetting bearer [ 490.445316][T21599] tipc: Disabling bearer [ 490.496517][ T3008] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.534040][ T3008] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.563394][T21666] __nla_validate_parse: 2 callbacks suppressed [ 490.563416][T21666] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4439'. [ 490.579195][ T3008] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.620484][ T3008] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.830572][T21681] vxcan1: tx address claim with different name [ 490.882705][T21671] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4442'. [ 491.006540][T21681] tipc: Enabled bearer , priority 0 [ 491.068368][T21678] tipc: Disabling bearer [ 491.422704][T21715] FAULT_INJECTION: forcing a failure. [ 491.422704][T21715] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 491.454088][T21715] CPU: 1 UID: 0 PID: 21715 Comm: syz.6.4450 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 491.454120][T21715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 491.454131][T21715] Call Trace: [ 491.454139][T21715] [ 491.454149][T21715] dump_stack_lvl+0x189/0x250 [ 491.454179][T21715] ? __pfx____ratelimit+0x10/0x10 [ 491.454204][T21715] ? __pfx_dump_stack_lvl+0x10/0x10 [ 491.454227][T21715] ? __pfx__printk+0x10/0x10 [ 491.454270][T21715] should_fail_ex+0x414/0x560 [ 491.454299][T21715] _copy_to_user+0x31/0xb0 [ 491.454322][T21715] simple_read_from_buffer+0xe1/0x170 [ 491.454356][T21715] proc_fail_nth_read+0x1b3/0x220 [ 491.454383][T21715] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 491.454410][T21715] ? rw_verify_area+0x2a6/0x4d0 [ 491.454435][T21715] ? __lock_acquire+0xab9/0xd20 [ 491.454460][T21715] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 491.454484][T21715] vfs_read+0x200/0x980 [ 491.454508][T21715] ? fdget_pos+0x247/0x320 [ 491.454531][T21715] ? __pfx___mutex_lock+0x10/0x10 [ 491.454556][T21715] ? __pfx_vfs_read+0x10/0x10 [ 491.454583][T21715] ? __fget_files+0x2a/0x420 [ 491.454616][T21715] ? __fget_files+0x3a0/0x420 [ 491.454643][T21715] ? __fget_files+0x2a/0x420 [ 491.454679][T21715] ksys_read+0x145/0x250 [ 491.454708][T21715] ? __pfx_ksys_read+0x10/0x10 [ 491.454729][T21715] ? rcu_is_watching+0x15/0xb0 [ 491.454756][T21715] ? do_syscall_64+0xbe/0x3b0 [ 491.454786][T21715] do_syscall_64+0xfa/0x3b0 [ 491.454809][T21715] ? lockdep_hardirqs_on+0x9c/0x150 [ 491.454832][T21715] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.454851][T21715] ? clear_bhb_loop+0x60/0xb0 [ 491.454883][T21715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.454902][T21715] RIP: 0033:0x7f58fb98d5fc [ 491.454921][T21715] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 491.454939][T21715] RSP: 002b:00007f58fc7ae030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 491.454962][T21715] RAX: ffffffffffffffda RBX: 00007f58fbbb6180 RCX: 00007f58fb98d5fc [ 491.454977][T21715] RDX: 000000000000000f RSI: 00007f58fc7ae0a0 RDI: 0000000000000004 [ 491.454989][T21715] RBP: 00007f58fc7ae090 R08: 0000000000000000 R09: 0000000000000000 [ 491.455001][T21715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.455013][T21715] R13: 00007f58fbbb6218 R14: 00007f58fbbb6180 R15: 00007ffc92e68cd8 [ 491.455045][T21715] [ 491.730382][T21729] netlink: 300 bytes leftover after parsing attributes in process `syz.3.4453'. [ 491.786026][ T8872] IPVS: starting estimator thread 0... [ 491.882025][T21731] IPVS: using max 27 ests per chain, 64800 per kthread [ 491.902154][T21733] netlink: 'syz.5.4456': attribute type 11 has an invalid length. [ 491.939815][T21733] tipc: Enabling of bearer rejected, already enabled [ 491.988399][T21741] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4459'. [ 492.007829][T21740] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.4460'. [ 492.165409][T21751] sctp: [Deprecated]: syz.0.4461 (pid 21751) Use of struct sctp_assoc_value in delayed_ack socket option. [ 492.165409][T21751] Use struct sctp_sack_info instead [ 492.236235][T21760] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4463'. [ 492.272493][T21761] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4465'. [ 492.681014][T21781] ip6gre1: entered allmulticast mode [ 492.736578][T21781] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 492.924310][T21783] can: request_module (can-proto-3) failed. [ 492.992375][T21808] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4473'. [ 493.013788][T21808] netlink: 'syz.1.4473': attribute type 1 has an invalid length. [ 493.059680][T21811] netlink: 64985 bytes leftover after parsing attributes in process `syz.5.4474'. [ 493.110105][T21815] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4475'. [ 493.123195][T21808] 8021q: adding VLAN 0 to HW filter on device bond8 [ 493.135921][T21808] bond7: (slave bond8): making interface the new active one [ 493.144235][T21808] bond7: (slave bond8): Enslaving as an active interface with an up link [ 493.155436][T21822] bond7: entered promiscuous mode [ 493.212292][T21822] bond8: entered promiscuous mode [ 493.239048][T21822] bond7: entered allmulticast mode [ 493.252096][T21822] bond8: entered allmulticast mode [ 493.260714][T21822] 8021q: adding VLAN 0 to HW filter on device bond7 [ 493.964642][T21874] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 494.288631][T21889] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 494.973291][T21939] netlink: 'syz.5.4510': attribute type 4 has an invalid length. [ 495.284717][T21953] batadv1: entered allmulticast mode [ 495.387135][T21958] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 495.642877][T21972] __nla_validate_parse: 11 callbacks suppressed [ 495.642902][T21972] netlink: 44 bytes leftover after parsing attributes in process `syz.6.4519'. [ 495.666771][T21973] netlink: 516 bytes leftover after parsing attributes in process `syz.5.4520'. [ 495.676445][T21972] netlink: 43 bytes leftover after parsing attributes in process `syz.6.4519'. [ 495.712475][T21978] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4519'. [ 495.747272][T21972] netlink: 'syz.6.4519': attribute type 5 has an invalid length. [ 495.797001][T21972] netlink: 43 bytes leftover after parsing attributes in process `syz.6.4519'. [ 495.882244][T21986] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4526'. [ 495.996004][T21995] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4528'. [ 496.061544][T21997] RDS: rds_bind could not find a transport for fe88::6, load rds_tcp or rds_rdma? [ 496.162450][T22003] netlink: 'syz.5.4531': attribute type 21 has an invalid length. [ 496.272920][ T5185] Bluetooth: hci1: command 0x0401 tx timeout [ 496.313659][T22015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4535'. [ 496.328231][T22015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4535'. [ 496.500049][T22020] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 496.679165][T22033] netlink: 'syz.1.4541': attribute type 1 has an invalid length. [ 496.743330][T22037] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 496.797580][T22043] openvswitch: netlink: Tunnel attr 2 has unexpected len 12 expected 4 [ 496.800887][T22030] syzkaller0: entered promiscuous mode [ 496.838424][T22030] syzkaller0: entered allmulticast mode [ 496.859789][T22041] geneve3: entered promiscuous mode [ 497.457892][T22067] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.4551'. [ 499.574710][T22077] netlink: 'syz.0.4554': attribute type 7 has an invalid length. [ 499.595126][T22079] netlink: 'syz.1.4555': attribute type 1 has an invalid length. [ 499.635063][T22084] netlink: 'syz.1.4555': attribute type 1 has an invalid length. [ 500.273171][T22120] vxcan1: tx address claim with dest, not broadcast [ 500.908643][T22154] __nla_validate_parse: 6 callbacks suppressed [ 500.908663][T22154] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4574'. [ 501.058307][T22160] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4577'. [ 501.084196][T22163] vxcan1: tx address claim with dest, not broadcast [ 501.109357][T22164] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4577'. [ 501.311377][T22173] netlink: 'syz.6.4582': attribute type 12 has an invalid length. [ 501.409164][T22175] netlink: 'syz.1.4583': attribute type 1 has an invalid length. [ 501.417520][T22178] delete_channel: no stack [ 501.433684][T22175] netlink: 172 bytes leftover after parsing attributes in process `syz.1.4583'. [ 501.586591][T22189] netlink: 176 bytes leftover after parsing attributes in process `syz.0.4588'. [ 501.604851][T22189] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4588'. [ 501.634424][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 501.647219][T22192] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4589'. [ 501.811094][T22202] netlink: 'syz.5.4591': attribute type 11 has an invalid length. [ 502.089327][T22219] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4598'. [ 502.109971][T22219] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4598'. [ 502.740964][T22253] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4606'. [ 502.781575][ T1041] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.833809][ T1041] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.865950][ T1041] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.880512][ T1041] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.974570][T22265] dvmrp1: entered allmulticast mode [ 503.041271][T22269] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 503.052668][T22269] syzkaller0: entered promiscuous mode [ 503.058317][T22269] syzkaller0: entered allmulticast mode [ 503.120536][T22273] netlink: 'syz.0.4612': attribute type 33 has an invalid length. [ 503.652536][T22303] tipc: Enabled bearer , priority 0 [ 503.666760][T22303] syzkaller0: entered promiscuous mode [ 503.674597][T22303] syzkaller0: entered allmulticast mode [ 503.701977][ T5868] Bluetooth: hci5: command 0x0406 tx timeout [ 504.100423][T22314] team0 (unregistering): Port device team_slave_0 removed [ 504.109546][T22314] team0 (unregistering): Port device team_slave_1 removed [ 504.135526][T22303] tipc: Resetting bearer [ 504.147772][T22302] tipc: Resetting bearer [ 504.210245][T22302] tipc: Disabling bearer [ 504.381130][T22341] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 505.047536][T22368] netlink: 'syz.3.4642': attribute type 10 has an invalid length. [ 505.052804][T22376] netlink: 'syz.1.4644': attribute type 15 has an invalid length. [ 505.069124][T22368] mac80211_hwsim hwsim45 wlan1: entered promiscuous mode [ 505.083147][T22368] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 506.098180][T22432] mac80211_hwsim hwsim39 ÿ: renamed from wlan1 (while UP) [ 506.232958][T22442] __nla_validate_parse: 14 callbacks suppressed [ 506.232980][T22442] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4664'. [ 506.342594][T22451] nftables ruleset with unbound chain [ 506.695737][T22473] netlink: 'syz.0.4670': attribute type 2 has an invalid length. [ 506.734703][T22472] tipc: Enabled bearer , priority 0 [ 506.927894][ T1041] tipc: Subscription rejected, illegal request [ 506.952886][T22472] syzkaller0: entered promiscuous mode [ 506.959092][T22472] syzkaller0: entered allmulticast mode [ 506.987284][T22479] tipc: Resetting bearer [ 507.007475][T22470] tipc: Resetting bearer [ 507.016999][T22485] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4674'. [ 509.573639][T22470] tipc: Disabling bearer [ 509.916499][T22522] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4680'. [ 509.979139][T22522] netdevsim netdevsim5: Direct firmware load for ..€ failed with error -2 [ 510.028332][T22522] netdevsim netdevsim5: Falling back to sysfs fallback for: ..€ [ 510.389411][T22535] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4684'. [ 510.498848][ C0] vcan0: j1939_xtp_rx_dat: no tx connection found [ 510.777514][T22552] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4688'. [ 510.963063][T22570] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4689'. [ 511.003445][T22566] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4691'. [ 511.022446][T22566] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4691'. [ 511.209552][T22577] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4696'. [ 511.255767][ C0] vcan0: j1939_tp_rxtimer: 0xffff888059d31400: rx timeout, send abort [ 511.385632][T22592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4698'. [ 511.750647][T22613] netlink: 'syz.6.4701': attribute type 4 has an invalid length. [ 511.769665][ C0] vcan0: j1939_tp_rxtimer: 0xffff888059d31400: abort rx timeout. Force session deactivation [ 513.796364][ T94] block nbd1: Possible stuck request ffff88802571e000: control (read@0,1024B). Runtime 360 seconds [ 513.808072][ T94] block nbd1: Possible stuck request ffff88802571e1c0: control (read@1024,1024B). Runtime 360 seconds [ 513.819456][ T94] block nbd1: Possible stuck request ffff88802571e380: control (read@2048,1024B). Runtime 360 seconds [ 513.830584][ T94] block nbd1: Possible stuck request ffff88802571e540: control (read@3072,1024B). Runtime 360 seconds [ 513.968888][T22616] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4703'. [ 514.133157][T22626] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4706'. [ 514.247810][T22626] vlan4: entered allmulticast mode [ 514.294787][T22626] bridge0: entered allmulticast mode [ 514.308805][T22626] bridge6: port 1(vlan4) entered blocking state [ 514.354075][T22626] bridge6: port 1(vlan4) entered disabled state [ 514.422916][T22626] vlan4: entered promiscuous mode [ 514.433587][T22626] bridge0: entered promiscuous mode [ 514.753355][T22655] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.4713'. [ 514.795200][T22659] netlink: 'syz.5.4711': attribute type 1 has an invalid length. [ 514.818491][T22659] netlink: 224 bytes leftover after parsing attributes in process `syz.5.4711'. [ 514.940255][T22659] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4711'. [ 515.046932][T22668] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4716'. [ 515.174000][T22674] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4717'. [ 515.298254][T22680] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4719'. [ 515.386580][T22686] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4723'. [ 515.411350][T22686] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 515.526388][T22694] batman_adv: batadv0: Interface deactivated: dummy0 [ 515.538273][T22694] batman_adv: batadv0: Removing interface: dummy0 [ 515.560652][T22694] bridge_slave_0: left allmulticast mode [ 515.576318][T22693] netlink: 'syz.1.4725': attribute type 1 has an invalid length. [ 515.589426][T22694] bridge_slave_0: left promiscuous mode [ 515.599104][T22694] bridge0: port 1(bridge_slave_0) entered disabled state [ 515.619832][T22694] bridge_slave_1: left allmulticast mode [ 515.636427][T22694] bridge_slave_1: left promiscuous mode [ 515.643522][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 515.658440][T22694] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.680218][T22694] bond0: (slave bond_slave_0): Releasing backup interface [ 515.689575][T22694] bond_slave_0: left promiscuous mode [ 515.696119][T22702] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 515.738544][T22694] team0: Port device team_slave_0 removed [ 515.805581][T22694] team0: Port device team_slave_1 removed [ 515.821591][T22694] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 515.844572][T22694] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 515.857260][T22694] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 515.865717][T22694] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 515.889933][T22694] bond0: (slave wlan1): Releasing backup interface [ 515.902059][T22694] mac80211_hwsim hwsim45 wlan1: left promiscuous mode [ 515.913570][T22707] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 515.967502][T22694] vlan4: left promiscuous mode [ 515.973072][T22694] bridge0: left promiscuous mode [ 515.978802][T22694] bridge6: port 1(vlan4) entered disabled state [ 516.054853][T22703] bond9: (slave bridge9): making interface the new active one [ 516.063747][T22703] bond9: (slave bridge9): Enslaving as an active interface with an up link [ 516.131573][T22707] vlan0: entered promiscuous mode [ 516.723059][T22739] __nla_validate_parse: 3 callbacks suppressed [ 516.723080][T22739] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4739'. [ 516.964563][T22758] netlink: 'syz.5.4744': attribute type 11 has an invalid length. [ 516.964831][T22757] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4742'. [ 517.001481][T22757] netlink: 'syz.6.4742': attribute type 2 has an invalid length. [ 517.046888][T22757] netlink: 112 bytes leftover after parsing attributes in process `syz.6.4742'. [ 517.099605][T22765] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4742'. [ 517.280296][T22772] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4748'. [ 517.482610][T22772] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 517.866051][T22797] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4755'. [ 517.892350][T22797] netlink: 50 bytes leftover after parsing attributes in process `syz.3.4755'. [ 517.910060][T22797] netlink: 50 bytes leftover after parsing attributes in process `syz.3.4755'. [ 518.073214][T22809] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4759'. [ 518.256927][T22820] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4761'. [ 518.515296][T22836] netlink: 'syz.5.4769': attribute type 8 has an invalid length. [ 518.562558][T22838] pim6reg527: entered allmulticast mode [ 518.991042][T22864] syzkaller1: entered promiscuous mode [ 518.997327][T22864] syzkaller1: entered allmulticast mode [ 519.009716][T22864] syzkaller1: left promiscuous mode [ 519.015528][T22864] syzkaller1: left allmulticast mode [ 519.250517][T22868] bond0: (slave syz_tun): Releasing backup interface [ 519.258390][T22868] syz_tun: left allmulticast mode [ 519.271268][T22868] bridge_slave_0: left allmulticast mode [ 519.278164][T22868] bridge_slave_0: left promiscuous mode [ 519.305360][T22868] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.323495][T22868] bridge_slave_1: left allmulticast mode [ 519.347811][T22868] bridge_slave_1: left promiscuous mode [ 519.355135][T22868] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.400370][T22868] bond0: (slave bond_slave_1): Releasing backup interface [ 519.431199][T22868] bond_slave_1: left allmulticast mode [ 519.497311][T22876] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 519.543392][T22868] team0: Port device team_slave_0 removed [ 519.570247][T22868] team0: Port device team_slave_1 removed [ 519.607698][T22868] bond0: (slave wlan1): Releasing backup interface [ 519.631554][T22868] mac80211_hwsim hwsim31 wlan1: left allmulticast mode [ 519.657777][T22868] bond2: (slave gretap1): Releasing active interface [ 519.673085][T22868] gretap1: left promiscuous mode [ 519.678329][T22868] gretap1: left allmulticast mode [ 519.716460][T22873] team0: Mode changed to "activebackup" [ 519.723962][T22876] vlan0: entered promiscuous mode [ 519.775353][T22876] team0: Port device vlan0 added [ 519.896966][T22888] syzkaller0: entered promiscuous mode [ 519.903071][T22888] syzkaller0: entered allmulticast mode [ 519.955179][T22894] bridge_slave_0: left allmulticast mode [ 519.965896][T22894] bridge_slave_0: left promiscuous mode [ 519.986240][T22894] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.998764][T22894] bridge_slave_1: left allmulticast mode [ 520.004969][T22894] bridge_slave_1: left promiscuous mode [ 520.011374][T22894] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.038255][T22894] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 520.054969][T22894] batman_adv: batadv0: Removing interface: wlan1 [ 520.848842][T22939] netlink: 'syz.0.4798': attribute type 1 has an invalid length. [ 520.900848][T22939] netlink: 'syz.0.4798': attribute type 1 has an invalid length. [ 521.309392][T22962] netlink: 'syz.1.4806': attribute type 7 has an invalid length. [ 521.406653][T22962] : entered promiscuous mode [ 521.650538][ T5185] Bluetooth: hci1: link tx timeout [ 521.658075][ T5185] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 521.765855][T22978] syz.3.4809: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 521.822174][T22978] CPU: 0 UID: 0 PID: 22978 Comm: syz.3.4809 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 521.822207][T22978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 521.822219][T22978] Call Trace: [ 521.822227][T22978] [ 521.822237][T22978] dump_stack_lvl+0x189/0x250 [ 521.822271][T22978] ? __pfx_dump_stack_lvl+0x10/0x10 [ 521.822296][T22978] ? __pfx__printk+0x10/0x10 [ 521.822324][T22978] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 521.822348][T22978] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 521.822375][T22978] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 521.822402][T22978] warn_alloc+0x214/0x310 [ 521.822441][T22978] ? __pfx_warn_alloc+0x10/0x10 [ 521.822483][T22978] ? __get_vm_area_node+0x28f/0x300 [ 521.822524][T22978] ? packet_set_ring+0x6f4/0x2350 [ 521.822550][T22978] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 521.822618][T22978] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 521.822647][T22978] ? alloc_pages_mpol+0x3cd/0x4a0 [ 521.822678][T22978] ? packet_set_ring+0x6f4/0x2350 [ 521.822699][T22978] vzalloc_noprof+0xb2/0xf0 [ 521.822727][T22978] ? packet_set_ring+0x6f4/0x2350 [ 521.822749][T22978] packet_set_ring+0x6f4/0x2350 [ 521.822797][T22978] ? __pfx_packet_set_ring+0x10/0x10 [ 521.822843][T22978] ? _copy_from_user+0x94/0xb0 [ 521.822868][T22978] packet_setsockopt+0xc5a/0x12c0 [ 521.822893][T22978] ? __pfx_packet_setsockopt+0x10/0x10 [ 521.822921][T22978] ? __lock_acquire+0xab9/0xd20 [ 521.822956][T22978] ? aa_sk_perm+0x81e/0x950 [ 521.822989][T22978] ? __pfx_aa_sk_perm+0x10/0x10 [ 521.823018][T22978] ? __fget_files+0x2a/0x420 [ 521.823045][T22978] ? aa_sock_opt_perm+0xff/0x1b0 [ 521.823076][T22978] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 521.823098][T22978] ? __pfx_packet_setsockopt+0x10/0x10 [ 521.823119][T22978] do_sock_setsockopt+0x17c/0x1b0 [ 521.823155][T22978] __x64_sys_setsockopt+0x13f/0x1b0 [ 521.823190][T22978] do_syscall_64+0xfa/0x3b0 [ 521.823216][T22978] ? lockdep_hardirqs_on+0x9c/0x150 [ 521.823239][T22978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.823259][T22978] ? clear_bhb_loop+0x60/0xb0 [ 521.823284][T22978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.823303][T22978] RIP: 0033:0x7f211e18ebe9 [ 521.823322][T22978] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 521.823340][T22978] RSP: 002b:00007f211c3d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 521.823363][T22978] RAX: ffffffffffffffda RBX: 00007f211e3b6090 RCX: 00007f211e18ebe9 [ 521.823378][T22978] RDX: 000000000000000d RSI: 0000000000000107 RDI: 0000000000000004 [ 521.823390][T22978] RBP: 00007f211e211e19 R08: 000000000000001c R09: 0000000000000000 [ 521.823404][T22978] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 521.823417][T22978] R13: 00007f211e3b6128 R14: 00007f211e3b6090 R15: 00007ffe4fe99a48 [ 521.823453][T22978] [ 521.823461][T22978] Mem-Info: [ 522.143672][T22978] active_anon:7350 inactive_anon:0 isolated_anon:0 [ 522.143672][T22978] active_file:1600 inactive_file:40003 isolated_file:0 [ 522.143672][T22978] unevictable:768 dirty:55 writeback:0 [ 522.143672][T22978] slab_reclaimable:13245 slab_unreclaimable:125601 [ 522.143672][T22978] mapped:32241 shmem:4231 pagetables:1114 [ 522.143672][T22978] sec_pagetables:0 bounce:0 [ 522.143672][T22978] kernel_misc_reclaimable:0 [ 522.143672][T22978] free:1297012 free_pcp:9780 free_cma:0 [ 522.193549][T22978] Node 0 active_anon:29400kB inactive_anon:0kB active_file:6400kB inactive_file:159808kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:128964kB dirty:216kB writeback:0kB shmem:15388kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14256kB pagetables:4328kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 522.229146][T22978] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 522.307918][T22978] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 522.338603][T22978] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 522.345059][T22978] Node 0 DMA32 free:1263336kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29152kB inactive_anon:0kB active_file:6400kB inactive_file:158232kB unevictable:1536kB writepending:216kB present:3129332kB managed:2557520kB mlocked:0kB bounce:0kB free_pcp:30256kB local_pcp:13840kB free_cma:0kB [ 522.382497][ T49] tipc: Resetting bearer [ 522.384416][T22978] lowmem_reserve[]: 0 0 1 1 1 [ 522.399301][T22978] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 522.429455][T22978] lowmem_reserve[]: 0 0 0 0 0 [ 522.460024][T22978] Node 1 Normal free:3909340kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:9568kB local_pcp:9024kB free_cma:0kB [ 522.549567][T22978] lowmem_reserve[]: 0 0 0 0 0 [ 522.565606][T22978] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 522.611108][T22978] Node 0 DMA32: 245*4kB (ME) 382*8kB (UM) 156*16kB (M) 90*32kB (UM) 76*64kB (UME) 8*128kB (M) 21*256kB (UME) 124*512kB (UME) 119*1024kB (UME) 7*2048kB (UM) 255*4096kB (M) = 1264836kB [ 522.660163][T22978] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 522.705899][T22978] Node 1 Normal: 171*4kB (UME) 44*8kB (UME) 39*16kB (UME) 183*32kB (UME) 62*64kB (UME) 14*128kB (UME) 5*256kB (UME) 3*512kB (ME) 2*1024kB (ME) 2*2048kB (UE) 949*4096kB (M) = 3909340kB [ 522.725556][T22978] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 522.736239][T22978] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 522.754030][T22978] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 522.778328][T22978] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 522.788186][T22978] 42981 total pagecache pages [ 522.793889][T22978] 0 pages in swap cache [ 522.798355][T22978] Free swap = 124996kB [ 522.802711][T22978] Total swap = 124996kB [ 522.807000][T22978] 2097051 pages RAM [ 522.811133][T22978] 0 pages HighMem/MovableOnly [ 522.816227][T22978] 425645 pages reserved [ 522.820494][T22978] 0 pages cma reserved [ 523.163667][ T49] tipc: Disabling bearer [ 523.693980][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 523.703462][ T5868] Bluetooth: hci1: command 0x0401 tx timeout [ 523.722031][ T49] bond0 (unregistering): Released all slaves [ 523.740406][ T49] bond1 (unregistering): Released all slaves [ 523.890712][ T49] bond2 (unregistering): Released all slaves [ 524.044082][ T49] bond3 (unregistering): (slave veth3): Releasing active interface [ 524.055838][ T49] bond3 (unregistering): Released all slaves [ 524.069656][ T49] bond4 (unregistering): Released all slaves [ 524.211294][ T49] bond5 (unregistering): Released all slaves [ 524.224889][ T12] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 524.242132][ T12] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 524.252180][ T8869] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 524.390990][T23032] nbd: socks must be embedded in a SOCK_ITEM attr [ 524.437833][T23035] __nla_validate_parse: 5 callbacks suppressed [ 524.437852][T23035] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4823'. [ 524.563243][ T49] : left promiscuous mode [ 524.622118][ T8869] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 524.625067][T23040] syzkaller1: entered promiscuous mode [ 524.653435][T23040] syzkaller1: entered allmulticast mode [ 524.669146][T23032] netlink: 22 bytes leftover after parsing attributes in process `syz.1.4822'. [ 524.693270][ T49] tipc: Left network mode [ 524.742436][ T8869] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 524.979094][T23060] netlink: 152064 bytes leftover after parsing attributes in process `syz.0.4829'. [ 524.989807][T23060] netlink: zone id is out of range [ 524.995456][T23060] netlink: zone id is out of range [ 525.016159][ T30] audit: type=1800 audit(1755063245.056:27): pid=23057 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4830" name="memory.events" dev="tmpfs" ino=1536 res=0 errno=0 [ 525.033564][T23062] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4831'. [ 525.038316][T23060] netlink: zone id is out of range [ 525.084651][T23060] netlink: zone id is out of range [ 525.098039][T23060] netlink: zone id is out of range [ 525.123821][T23060] netlink: zone id is out of range [ 525.134194][T23060] netlink: zone id is out of range [ 525.139547][T23060] netlink: zone id is out of range [ 525.150155][T23060] netlink: zone id is out of range [ 525.173664][T23060] netlink: zone id is out of range [ 525.197270][T23062] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4831'. [ 525.218814][T23068] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4834'. [ 525.220922][T23062] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4831'. [ 525.242894][T23068] veth0: entered promiscuous mode [ 525.369213][T23075] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4834'. [ 525.571586][T23081] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4836'. [ 525.588619][T23081] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4836'. [ 527.090845][T23091] sit0: entered promiscuous mode [ 527.097505][T23091] netlink: 'syz.0.4838': attribute type 1 has an invalid length. [ 527.109671][T23065] veth0: left promiscuous mode [ 527.283365][T23104] netlink: 'syz.0.4841': attribute type 29 has an invalid length. [ 527.428513][ T49] hsr_slave_0: left promiscuous mode [ 527.438406][ T49] hsr_slave_1: left promiscuous mode [ 527.453234][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 527.474124][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 527.482658][T23119] netlink: 'syz.6.4844': attribute type 13 has an invalid length. [ 527.531532][ T49] vlan0: left allmulticast mode [ 527.537178][ T49] vlan0: left promiscuous mode [ 527.542895][ T49] veth1_macvtap: left promiscuous mode [ 527.548482][ T49] veth0_macvtap: left promiscuous mode [ 527.555039][ T49] veth1_vlan: left allmulticast mode [ 527.560685][ T49] veth1_vlan: left promiscuous mode [ 528.101877][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 529.155011][T23167] netlink: 'syz.0.4859': attribute type 13 has an invalid length. [ 529.204478][T23167] lo: entered promiscuous mode [ 529.209602][T23167] lo: entered allmulticast mode [ 529.221028][T23167] tunl0: entered promiscuous mode [ 529.235341][T23167] tunl0: entered allmulticast mode [ 529.248244][T23167] gre0: entered promiscuous mode [ 529.263630][T23167] gre0: entered allmulticast mode [ 529.283874][T23167] gretap0: entered promiscuous mode [ 529.297061][T23167] gretap0: entered allmulticast mode [ 529.318261][T23167] gretap0: refused to change device tx_queue_len [ 529.493795][ T49] IPVS: stop unused estimator thread 0... [ 529.620068][T23182] __nla_validate_parse: 10 callbacks suppressed [ 529.620184][T23182] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4865'. [ 529.645314][T23183] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4864'. [ 530.260099][T23217] netlink: 268 bytes leftover after parsing attributes in process `syz.0.4877'. [ 530.386990][T23222] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4879'. [ 530.648433][T23235] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4881'. [ 530.669606][T23232] sch_fq: defrate 0 ignored. [ 530.918851][T23254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4887'. [ 530.952979][T23254] net_ratelimit: 218 callbacks suppressed [ 530.953004][T23254] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 530.979296][T23245] netlink: 'syz.3.4885': attribute type 16 has an invalid length. [ 531.017676][T23245] netlink: 'syz.3.4885': attribute type 17 has an invalid length. [ 531.040939][T23254] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.138354][T23245] bond0: left promiscuous mode [ 531.146944][T23245] 8021q: adding VLAN 0 to HW filter on device bond0 [ 531.195974][T23245] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 531.734976][T23294] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4895'. [ 531.928555][T23300] netlink: 256 bytes leftover after parsing attributes in process `syz.3.4898'. [ 532.080689][T23300] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4898'. [ 532.092976][T23309] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4900'. [ 532.969040][T23362] netlink: 'syz.1.4917': attribute type 1 has an invalid length. [ 532.994858][T23312] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 533.429942][T23384] tipc: Enabled bearer , priority 10 [ 533.604894][T23397] bridge5: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 534.023106][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.029327][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.068768][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.122013][T23419] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 534.144720][T23418] hsr0 speed is unknown, defaulting to 1000 [ 534.157005][T23416] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 534.226135][T23426] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 534.257909][T23416] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 534.392750][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.468377][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.531778][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.554319][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.566360][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.589737][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.610120][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.624116][T23416] hsr0 speed is unknown, defaulting to 1000 [ 534.718486][T23438] __nla_validate_parse: 6 callbacks suppressed [ 534.718509][T23438] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4938'. [ 534.794848][T23440] tipc: Enabled bearer , priority 0 [ 534.802095][T23438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 534.832151][T23438] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 535.019573][T23452] tipc: Resetting bearer [ 535.153740][T23439] tipc: Disabling bearer [ 535.207178][T23461] netlink: 'syz.5.4944': attribute type 83 has an invalid length. [ 535.233214][T23458] netem: incorrect gi model size [ 535.249167][T23458] netem: change failed [ 535.433340][T23469] sctp: [Deprecated]: syz.0.4946 (pid 23469) Use of struct sctp_assoc_value in delayed_ack socket option. [ 535.433340][T23469] Use struct sctp_sack_info instead [ 535.459380][T23472] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4948'. [ 535.763324][T23486] netlink: 'syz.0.4953': attribute type 1 has an invalid length. [ 535.853848][T23486] 8021q: adding VLAN 0 to HW filter on device bond4 [ 535.895976][T23486] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4953'. [ 535.970513][T23501] netlink: 'syz.3.4955': attribute type 7 has an invalid length. [ 536.187409][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 538.224471][T23499] bond4: (slave gretap1): making interface the new active one [ 538.233651][T23499] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 538.435177][T23513] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4960'. [ 538.448890][T23514] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4960'. [ 538.476725][T23511] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 538.662381][T23523] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4963'. [ 538.705114][T23525] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4964'. [ 538.723104][T23526] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4964'. [ 539.389852][T23568] hsr0 speed is unknown, defaulting to 1000 [ 539.492797][T23576] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4978'. [ 539.524538][T23579] netlink: 300 bytes leftover after parsing attributes in process `syz.3.4979'. [ 539.866522][T23590] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4982'. [ 539.918817][T23593] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4982'. [ 539.928067][T23593] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4982'. [ 539.937556][T23592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4983'. [ 539.958034][T23592] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (64) [ 539.989912][T23594] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 540.125109][T23601] netlink: 'syz.5.4985': attribute type 1 has an invalid length. [ 540.153564][T23601] netlink: 244 bytes leftover after parsing attributes in process `syz.5.4985'. [ 540.381058][T23611] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4989'. [ 540.461391][T23615] netlink: 'syz.3.4991': attribute type 13 has an invalid length. [ 540.493793][T23615] lo: entered promiscuous mode [ 540.498633][T23615] lo: entered allmulticast mode [ 540.548471][T23615] tunl0: entered promiscuous mode [ 540.564920][T23615] tunl0: entered allmulticast mode [ 540.603065][T23615] gre0: entered promiscuous mode [ 540.612393][T23615] gre0: entered allmulticast mode [ 540.635974][T23615] gretap0: entered promiscuous mode [ 540.638508][T23624] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4994'. [ 540.641369][T23615] gretap0: entered allmulticast mode [ 540.653633][T23624] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4994'. [ 540.664497][T23615] gretap0: refused to change device tx_queue_len [ 540.673541][T23615] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 540.879284][T23634] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4998'. [ 541.057786][T23647] hsr0 speed is unknown, defaulting to 1000 [ 541.067226][T23644] netlink: 'syz.1.4999': attribute type 10 has an invalid length. [ 541.090040][T23644] tipc: Resetting bearer [ 541.115950][T23651] netlink: 22 bytes leftover after parsing attributes in process `syz.0.5003'. [ 542.329845][T23693] hsr0 speed is unknown, defaulting to 1000 [ 542.470717][T23707] (unnamed net_device) (uninitialized): down delay (33554432) is not a multiple of miimon (637), value rounded to 33553975 ms [ 543.297726][T23735] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 543.718959][T23760] hsr0 speed is unknown, defaulting to 1000 [ 543.862610][ T94] block nbd1: Possible stuck request ffff88802571e000: control (read@0,1024B). Runtime 390 seconds [ 543.873703][ T94] block nbd1: Possible stuck request ffff88802571e1c0: control (read@1024,1024B). Runtime 390 seconds [ 543.884940][ T94] block nbd1: Possible stuck request ffff88802571e380: control (read@2048,1024B). Runtime 390 seconds [ 543.896781][ T94] block nbd1: Possible stuck request ffff88802571e540: control (read@3072,1024B). Runtime 390 seconds [ 544.306589][T23783] tipc: New replicast peer: 255.255.255.255 [ 544.313882][T23783] tipc: Enabled bearer , priority 10 [ 544.957013][T23814] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 545.029192][T23818] __nla_validate_parse: 12 callbacks suppressed [ 545.029215][T23818] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5054'. [ 545.315171][T23839] tipc: Enabled bearer , priority 0 [ 545.348389][T23840] syzkaller0: entered promiscuous mode [ 545.355194][T23840] syzkaller0: entered allmulticast mode [ 545.480866][T23839] tipc: Resetting bearer [ 545.490515][T23836] tipc: Resetting bearer [ 545.524965][T23845] netlink: 248 bytes leftover after parsing attributes in process `syz.0.5060'. [ 545.536484][T23836] tipc: Disabling bearer [ 545.579814][T23850] hsr0 speed is unknown, defaulting to 1000 [ 545.598194][T23804] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 545.862959][T23865] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5066'. [ 546.353839][T23888] tipc: Enabled bearer , priority 0 [ 546.365671][T23891] netlink: 'syz.1.5070': attribute type 33 has an invalid length. [ 546.408706][T23891] netlink: 152 bytes leftover after parsing attributes in process `syz.1.5070'. [ 546.537936][T23888] syzkaller0: entered promiscuous mode [ 546.561704][T23888] syzkaller0: entered allmulticast mode [ 546.574399][T23898] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 546.604503][T23893] IPVS: set_ctl: invalid protocol: 43 172.30.0.6:20000 [ 546.626755][T23893] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5073'. [ 546.715104][T23888] tipc: Resetting bearer [ 546.754183][T23887] tipc: Resetting bearer [ 546.809188][T23887] tipc: Disabling bearer [ 546.834839][T23893] sit0: entered promiscuous mode [ 546.840107][T23893] sit0: entered allmulticast mode [ 546.849255][T23906] tipc: Enabled bearer , priority 10 [ 546.859701][T23908] tipc: Enabled bearer , priority 10 [ 546.939549][T23901] hsr0 speed is unknown, defaulting to 1000 [ 546.950809][T23914] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5076'. [ 547.168134][T23922] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5081'. [ 547.247052][T23922] tipc: Enabled bearer , priority 0 [ 547.336950][T23933] syzkaller0: entered promiscuous mode [ 547.344357][T23933] syzkaller0: entered allmulticast mode [ 547.409023][T23922] tipc: Resetting bearer [ 547.491147][T23921] tipc: Resetting bearer [ 547.537432][T23921] tipc: Disabling bearer [ 547.579069][T23939] hsr0 speed is unknown, defaulting to 1000 [ 547.691849][T23946] netlink: 'syz.3.5086': attribute type 1 has an invalid length. [ 547.700086][T23946] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5086'. [ 547.704350][T23948] netlink: 'syz.6.5087': attribute type 1 has an invalid length. [ 547.717784][T23946] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5086'. [ 547.731268][T23944] delete_channel: no stack [ 547.947063][ T8871] tipc: Node number set to 2622437764 [ 548.765557][T23993] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5101'. [ 548.954234][T24002] hsr0 speed is unknown, defaulting to 1000 [ 549.674835][T24019] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 550.047852][T24038] __nla_validate_parse: 1 callbacks suppressed [ 550.047874][T24038] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.5114'. [ 550.103418][T24039] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5114'. [ 550.546739][T24060] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5119'. [ 550.557637][T24060] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 550.737299][T24062] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5120'. [ 550.756782][T24062] netlink: 14560 bytes leftover after parsing attributes in process `syz.5.5120'. [ 550.778714][T24064] hsr0 speed is unknown, defaulting to 1000 [ 550.971120][T24077] netlink: 'syz.0.5124': attribute type 25 has an invalid length. [ 551.108454][T24082] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 551.181350][T24085] netlink: 'syz.3.5127': attribute type 9 has an invalid length. [ 551.651197][T24105] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5134'. [ 551.836071][T24111] Bluetooth: MGMT ver 1.23 [ 551.874243][T24110] FAULT_INJECTION: forcing a failure. [ 551.874243][T24110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 551.892770][T24110] CPU: 0 UID: 0 PID: 24110 Comm: syz.0.5136 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 551.892802][T24110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 551.892815][T24110] Call Trace: [ 551.892823][T24110] [ 551.892832][T24110] dump_stack_lvl+0x189/0x250 [ 551.892862][T24110] ? __pfx____ratelimit+0x10/0x10 [ 551.892888][T24110] ? __pfx_dump_stack_lvl+0x10/0x10 [ 551.892911][T24110] ? __pfx__printk+0x10/0x10 [ 551.892939][T24110] ? __might_fault+0xb0/0x130 [ 551.892979][T24110] should_fail_ex+0x414/0x560 [ 551.893008][T24110] _copy_from_iter+0x1db/0x16f0 [ 551.893042][T24110] ? rcu_is_watching+0x15/0xb0 [ 551.893063][T24110] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 551.893090][T24110] ? __pfx__copy_from_iter+0x10/0x10 [ 551.893120][T24110] ? __build_skb_around+0x257/0x3e0 [ 551.893149][T24110] ? netlink_sendmsg+0x642/0xb30 [ 551.893171][T24110] ? skb_put+0x11b/0x210 [ 551.893203][T24110] netlink_sendmsg+0x6b2/0xb30 [ 551.893238][T24110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.893269][T24110] ? aa_sock_msg_perm+0xf1/0x1d0 [ 551.893298][T24110] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 551.893319][T24110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.893346][T24110] __sock_sendmsg+0x219/0x270 [ 551.893373][T24110] ____sys_sendmsg+0x505/0x830 [ 551.893408][T24110] ? __pfx_____sys_sendmsg+0x10/0x10 [ 551.893448][T24110] ? import_iovec+0x74/0xa0 [ 551.893480][T24110] ___sys_sendmsg+0x21f/0x2a0 [ 551.893511][T24110] ? __pfx____sys_sendmsg+0x10/0x10 [ 551.893584][T24110] ? __fget_files+0x2a/0x420 [ 551.893612][T24110] ? __fget_files+0x3a0/0x420 [ 551.893653][T24110] __x64_sys_sendmsg+0x19b/0x260 [ 551.893686][T24110] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 551.893726][T24110] ? __pfx_ksys_write+0x10/0x10 [ 551.893750][T24110] ? rcu_is_watching+0x15/0xb0 [ 551.893775][T24110] ? do_syscall_64+0xbe/0x3b0 [ 551.893805][T24110] do_syscall_64+0xfa/0x3b0 [ 551.893828][T24110] ? lockdep_hardirqs_on+0x9c/0x150 [ 551.893852][T24110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.893872][T24110] ? clear_bhb_loop+0x60/0xb0 [ 551.893896][T24110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.893915][T24110] RIP: 0033:0x7f5d3698ebe9 [ 551.893935][T24110] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 551.893951][T24110] RSP: 002b:00007f5d377ff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 551.893973][T24110] RAX: ffffffffffffffda RBX: 00007f5d36bb5fa0 RCX: 00007f5d3698ebe9 [ 551.893988][T24110] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000005 [ 551.894001][T24110] RBP: 00007f5d377ff090 R08: 0000000000000000 R09: 0000000000000000 [ 551.894014][T24110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.894026][T24110] R13: 00007f5d36bb6038 R14: 00007f5d36bb5fa0 R15: 00007ffda208a3c8 [ 551.894060][T24110] [ 552.188565][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 552.425229][T24127] hsr0 speed is unknown, defaulting to 1000 [ 552.564014][T24140] IPVS: set_ctl: invalid protocol: 60 172.20.20.187:20001 [ 552.576928][T24140] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5145'. [ 552.593467][T24140] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 552.606848][T24140] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 552.630294][T24145] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5143'. [ 553.141917][ T5185] Bluetooth: hci1: command 0x0401 tx timeout [ 553.262941][T24162] can: request_module (can-proto-0) failed. [ 553.464086][T24171] FAULT_INJECTION: forcing a failure. [ 553.464086][T24171] name failslab, interval 1, probability 0, space 0, times 0 [ 553.489052][T24176] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5155'. [ 553.512294][T24171] CPU: 1 UID: 0 PID: 24171 Comm: syz.6.5154 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 553.512326][T24171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 553.512338][T24171] Call Trace: [ 553.512346][T24171] [ 553.512355][T24171] dump_stack_lvl+0x189/0x250 [ 553.512384][T24171] ? __pfx____ratelimit+0x10/0x10 [ 553.512410][T24171] ? __pfx_dump_stack_lvl+0x10/0x10 [ 553.512434][T24171] ? __pfx__printk+0x10/0x10 [ 553.512464][T24171] ? __lock_acquire+0xab9/0xd20 [ 553.512504][T24171] should_fail_ex+0x414/0x560 [ 553.512544][T24171] should_failslab+0xa8/0x100 [ 553.512576][T24171] kmem_cache_alloc_noprof+0x73/0x3c0 [ 553.512602][T24171] ? skb_clone+0x212/0x3a0 [ 553.512626][T24171] skb_clone+0x212/0x3a0 [ 553.512650][T24171] __netlink_deliver_tap+0x404/0x850 [ 553.512691][T24171] ? netlink_deliver_tap+0x2e/0x1b0 [ 553.512718][T24171] netlink_deliver_tap+0x19c/0x1b0 [ 553.512745][T24171] netlink_unicast+0x7fa/0x9e0 [ 553.512779][T24171] ? __pfx_netlink_unicast+0x10/0x10 [ 553.512805][T24171] ? netlink_sendmsg+0x642/0xb30 [ 553.512827][T24171] ? skb_put+0x11b/0x210 [ 553.512858][T24171] netlink_sendmsg+0x805/0xb30 [ 553.512895][T24171] ? __pfx_netlink_sendmsg+0x10/0x10 [ 553.512923][T24171] ? aa_sock_msg_perm+0xf1/0x1d0 [ 553.512951][T24171] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 553.512973][T24171] ? __pfx_netlink_sendmsg+0x10/0x10 [ 553.513000][T24171] __sock_sendmsg+0x219/0x270 [ 553.513026][T24171] ____sys_sendmsg+0x505/0x830 [ 553.513062][T24171] ? __pfx_____sys_sendmsg+0x10/0x10 [ 553.513103][T24171] ? import_iovec+0x74/0xa0 [ 553.513129][T24171] ___sys_sendmsg+0x21f/0x2a0 [ 553.513161][T24171] ? __pfx____sys_sendmsg+0x10/0x10 [ 553.513232][T24171] ? __fget_files+0x2a/0x420 [ 553.513257][T24171] ? __fget_files+0x3a0/0x420 [ 553.513296][T24171] __x64_sys_sendmsg+0x19b/0x260 [ 553.513328][T24171] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 553.513366][T24171] ? __pfx_ksys_write+0x10/0x10 [ 553.513389][T24171] ? rcu_is_watching+0x15/0xb0 [ 553.513413][T24171] ? do_syscall_64+0xbe/0x3b0 [ 553.513444][T24171] do_syscall_64+0xfa/0x3b0 [ 553.513473][T24171] ? lockdep_hardirqs_on+0x9c/0x150 [ 553.513495][T24171] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.513515][T24171] ? clear_bhb_loop+0x60/0xb0 [ 553.513549][T24171] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.513568][T24171] RIP: 0033:0x7f58fb98ebe9 [ 553.513587][T24171] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 553.513605][T24171] RSP: 002b:00007f58fc7f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 553.513627][T24171] RAX: ffffffffffffffda RBX: 00007f58fbbb5fa0 RCX: 00007f58fb98ebe9 [ 553.513642][T24171] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000005 [ 553.513654][T24171] RBP: 00007f58fc7f0090 R08: 0000000000000000 R09: 0000000000000000 [ 553.513667][T24171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 553.513678][T24171] R13: 00007f58fbbb6038 R14: 00007f58fbbb5fa0 R15: 00007ffc92e68cd8 [ 553.513714][T24171] [ 554.025947][T24181] hsr0 speed is unknown, defaulting to 1000 [ 554.035032][T24191] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5160'. [ 554.725188][T24228] vxcan1: tx address claim with dest, not broadcast [ 554.888746][T24231] hsr0 speed is unknown, defaulting to 1000 [ 554.957779][T24244] netlink: 'syz.0.5174': attribute type 33 has an invalid length. [ 555.058827][T24251] veth0: entered promiscuous mode [ 555.124336][T24251] __nla_validate_parse: 2 callbacks suppressed [ 555.124359][T24251] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5177'. [ 555.633966][T24276] openvswitch: netlink: Missing key (keys=40, expected=80) [ 555.729701][T24281] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5186'. [ 555.789767][T24286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5188'. [ 555.917110][T24286] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 556.341704][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 556.452250][T24302] hsr0 speed is unknown, defaulting to 1000 [ 556.777843][T24318] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5196'. [ 557.160840][T24336] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5203'. [ 557.381776][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 557.406979][T24344] netlink: 'syz.3.5206': attribute type 2 has an invalid length. [ 557.426046][T24343] hsr0 speed is unknown, defaulting to 1000 [ 557.426723][T24344] netlink: 1184 bytes leftover after parsing attributes in process `syz.3.5206'. [ 557.447356][ T5868] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 557.463284][ T5868] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 557.472384][ T5868] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 557.483140][ T5868] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 557.490958][ T5868] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 557.537871][ T9290] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 557.595153][T24352] netlink: 'syz.1.5207': attribute type 10 has an invalid length. [ 557.613763][T24352] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 557.680359][T24345] hsr0 speed is unknown, defaulting to 1000 [ 557.786271][ T9290] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 558.057990][ T9290] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 558.299055][ T9290] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 558.421731][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 558.682987][T24387] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5217'. [ 558.717199][T24387] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5217'. [ 558.759942][T24387] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 558.939601][T24403] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5220'. [ 558.979652][T24345] chnl_net:caif_netlink_parms(): no params data found [ 559.448728][T24438] netlink: 'syz.3.5225': attribute type 1 has an invalid length. [ 559.457182][T24438] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5225'. [ 559.471931][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 559.552693][ T5868] Bluetooth: hci3: command tx timeout [ 560.484261][ T9290] bond1 (unregistering): Released all slaves [ 560.500899][ T9290] bond2 (unregistering): Released all slaves [ 560.507189][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 560.525943][ T9290] bond0 (unregistering): Released all slaves [ 560.576657][T24345] bridge0: port 1(bridge_slave_0) entered blocking state [ 560.595119][T24345] bridge0: port 1(bridge_slave_0) entered disabled state [ 560.606093][T24345] bridge_slave_0: entered allmulticast mode [ 560.619254][T24345] bridge_slave_0: entered promiscuous mode [ 560.670622][T24449] hsr_slave_0: left promiscuous mode [ 560.775247][T24345] bridge0: port 2(bridge_slave_1) entered blocking state [ 560.786453][T24345] bridge0: port 2(bridge_slave_1) entered disabled state [ 560.794245][T24345] bridge_slave_1: entered allmulticast mode [ 560.802713][T24345] bridge_slave_1: entered promiscuous mode [ 560.809450][ T9290] tipc: Disabling bearer [ 560.815935][ T9290] tipc: Disabling bearer [ 560.829574][T21199] hsr0 speed is unknown, defaulting to 1000 [ 560.841914][ T9290] tipc: Left network mode [ 560.846469][T21199] infiniband syz1: ib_query_port failed (-19) [ 560.965704][T24345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 560.981477][T24454] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 560.993972][T24457] netlink: 'syz.6.5230': attribute type 2 has an invalid length. [ 561.008054][T24457] __nla_validate_parse: 3 callbacks suppressed [ 561.008075][T24457] netlink: 244 bytes leftover after parsing attributes in process `syz.6.5230'. [ 561.042377][T24345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 561.053857][T24455] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 561.219538][T24345] team0: Port device team_slave_0 added [ 561.411061][T24345] team0: Port device team_slave_1 added [ 561.541888][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 561.576960][T24488] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5239'. [ 561.630044][ T5868] Bluetooth: hci3: command tx timeout [ 561.641185][T24491] netlink: 2 bytes leftover after parsing attributes in process `syz.0.5240'. [ 561.673670][T24491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 561.747539][T24471] team0 (unregistering): Port device vlan0 removed [ 561.857855][T24500] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5241'. [ 561.899611][T24485] veth9: entered allmulticast mode [ 561.911411][T24488] netlink: 2 bytes leftover after parsing attributes in process `syz.1.5239'. [ 561.964942][T24345] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 561.978150][T24345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 562.016458][T24345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 562.108507][T24345] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 562.141215][T24345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 562.175675][T24345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 562.407261][T24520] netlink: 72 bytes leftover after parsing attributes in process `syz.6.5245'. [ 562.482392][T24523] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5246'. [ 562.491567][ T9290] hsr_slave_0: left promiscuous mode [ 562.501487][ T9290] hsr_slave_1: left promiscuous mode [ 562.570615][ T9290] pimreg3 (unregistering): left allmulticast mode [ 562.574088][T24529] netlink: 120 bytes leftover after parsing attributes in process `syz.0.5247'. [ 562.591908][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 563.077713][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 563.631848][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 563.655398][T24345] hsr_slave_0: entered promiscuous mode [ 563.667160][T24345] hsr_slave_1: entered promiscuous mode [ 563.702460][ T5868] Bluetooth: hci3: command tx timeout [ 564.619872][ T9290] IPVS: stop unused estimator thread 0... [ 564.661740][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 565.069041][T24596] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5265'. [ 565.095668][T24593] netlink: 148 bytes leftover after parsing attributes in process `syz.6.5264'. [ 565.588791][T24345] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 565.664033][T24345] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 565.706761][T24345] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 565.713789][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 565.773087][T24345] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 565.782579][ T5868] Bluetooth: hci3: command tx timeout [ 566.004668][T24638] netlink: 'syz.3.5277': attribute type 11 has an invalid length. [ 566.014316][T24638] __nla_validate_parse: 5 callbacks suppressed [ 566.014334][T24638] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5277'. [ 566.023371][T24626] netlink: 144 bytes leftover after parsing attributes in process `syz.1.5274'. [ 566.091528][T24638] batadv_slave_1 (unregistering): left promiscuous mode [ 566.267866][T24345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 566.432497][T24345] 8021q: adding VLAN 0 to HW filter on device team0 [ 566.574652][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 566.581937][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 566.751687][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 566.771277][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.778533][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 567.021967][T24672] nbd: must specify a size in bytes for the device [ 567.043250][T24666] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5281'. [ 567.121506][T24678] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5282'. [ 567.359789][T24686] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 567.507608][T24345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 567.781829][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 567.850910][T24704] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5288'. [ 567.864499][T24704] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5288'. [ 567.958229][T24711] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5290'. [ 567.976459][T24711] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5290'. [ 567.985933][T24711] tc_dump_action: action bad kind [ 568.210900][T24719] wg1: entered promiscuous mode [ 568.228401][T24719] wg1: entered allmulticast mode [ 568.254421][T24721] bridge0: port 1(syz_tun) entered blocking state [ 568.270853][T24721] bridge0: port 1(syz_tun) entered disabled state [ 568.281292][T24721] syz_tun: entered allmulticast mode [ 568.298329][T24721] syz_tun: entered promiscuous mode [ 568.317368][T24345] veth0_vlan: entered promiscuous mode [ 568.489690][T24345] veth1_vlan: entered promiscuous mode [ 568.621363][T24731] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5295'. [ 568.647149][T24345] veth0_macvtap: entered promiscuous mode [ 568.710236][T24345] veth1_macvtap: entered promiscuous mode [ 568.821170][T24345] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 568.832332][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 569.014931][T24345] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 569.022698][T24720] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 569.050214][ T3036] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.066692][ T3036] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.121382][ T3036] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.131389][ T3036] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 569.200780][T24745] netlink: 144 bytes leftover after parsing attributes in process `syz.6.5299'. [ 569.410687][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 569.441995][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 569.493512][ T3036] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 569.509193][ T3036] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 569.864446][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 570.238613][T24771] netlink: 'syz.0.5306': attribute type 6 has an invalid length. [ 570.287546][T24771] netlink: 'syz.0.5306': attribute type 5 has an invalid length. [ 570.792863][T24796] macsec1: entered promiscuous mode [ 570.808016][T24796] team0: entered promiscuous mode [ 570.822628][T24796] geneve0: entered promiscuous mode [ 570.845295][T24796] macsec1: entered allmulticast mode [ 570.862731][T24796] team0: entered allmulticast mode [ 570.874269][T24796] geneve0: entered allmulticast mode [ 570.901859][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 570.924225][T24796] team0: Device macsec1 is already an upper device of the team interface [ 570.974103][T24796] team0: left allmulticast mode [ 570.979289][T24796] geneve0: left allmulticast mode [ 570.985707][T24796] team0: left promiscuous mode [ 571.010934][T24796] geneve0: left promiscuous mode [ 571.363329][T24811] openvswitch: netlink: IP tunnel dst address not specified [ 571.533669][T24822] nbd: must specify at least one socket [ 571.851841][T24840] __nla_validate_parse: 7 callbacks suppressed [ 571.851862][T24840] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5324'. [ 571.941850][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 572.230471][T24856] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.5329'. [ 572.808617][T24878] Bluetooth: MGMT ver 1.23 [ 572.981686][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 573.014101][T24888] delete_channel: no stack [ 573.035912][T24883] netlink: 5 bytes leftover after parsing attributes in process `syz.6.5339'. [ 573.187961][T24895] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5339'. [ 573.224213][T24896] netlink: 212388 bytes leftover after parsing attributes in process `syz.3.5343'. [ 573.279644][T24896] openvswitch: netlink: Message has 5 unknown bytes. [ 573.563752][T24907] netlink: 128 bytes leftover after parsing attributes in process `syz.3.5346'. [ 573.582027][T24907] netlink: 128 bytes leftover after parsing attributes in process `syz.3.5346'. [ 573.657270][T24914] netlink: 'syz.1.5350': attribute type 4 has an invalid length. [ 573.701792][T24914] netlink: 17 bytes leftover after parsing attributes in process `syz.1.5350'. [ 573.710000][T24918] netlink: 'syz.1.5350': attribute type 4 has an invalid length. [ 573.721433][T24918] netlink: 17 bytes leftover after parsing attributes in process `syz.1.5350'. [ 573.942617][ T94] block nbd1: Possible stuck request ffff88802571e000: control (read@0,1024B). Runtime 420 seconds [ 573.953793][ T94] block nbd1: Possible stuck request ffff88802571e1c0: control (read@1024,1024B). Runtime 420 seconds [ 573.965202][ T94] block nbd1: Possible stuck request ffff88802571e380: control (read@2048,1024B). Runtime 420 seconds [ 573.976485][ T94] block nbd1: Possible stuck request ffff88802571e540: control (read@3072,1024B). Runtime 420 seconds [ 574.021873][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 574.128932][T24944] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5356'. [ 574.147160][T24946] team0: Mode changed to "activebackup" [ 574.199412][T24929] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 574.248444][T24937] syzkaller1: entered promiscuous mode [ 574.255180][T24937] syzkaller1: entered allmulticast mode [ 574.620139][T24957] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 575.061690][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 575.276579][T24998] netlink: set zone limit has 4 unknown bytes [ 575.485237][T25008] netlink: 'syz.0.5371': attribute type 29 has an invalid length. [ 575.513367][T25004] netlink: 'syz.0.5371': attribute type 29 has an invalid length. [ 575.719492][T25024] FAULT_INJECTION: forcing a failure. [ 575.719492][T25024] name failslab, interval 1, probability 0, space 0, times 0 [ 575.737536][T25024] CPU: 1 UID: 0 PID: 25024 Comm: syz.0.5378 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 575.737568][T25024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 575.737581][T25024] Call Trace: [ 575.737589][T25024] [ 575.737598][T25024] dump_stack_lvl+0x189/0x250 [ 575.737629][T25024] ? __pfx____ratelimit+0x10/0x10 [ 575.737653][T25024] ? __pfx_dump_stack_lvl+0x10/0x10 [ 575.737676][T25024] ? __pfx__printk+0x10/0x10 [ 575.737708][T25024] ? __pfx___might_resched+0x10/0x10 [ 575.737732][T25024] should_fail_ex+0x414/0x560 [ 575.737761][T25024] should_failslab+0xa8/0x100 [ 575.737792][T25024] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 575.737818][T25024] ? __alloc_skb+0x112/0x2d0 [ 575.737860][T25024] __alloc_skb+0x112/0x2d0 [ 575.737889][T25024] netlink_sendmsg+0x5c6/0xb30 [ 575.737929][T25024] ? __pfx_netlink_sendmsg+0x10/0x10 [ 575.737966][T25024] ? aa_sock_msg_perm+0xf1/0x1d0 [ 575.737996][T25024] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 575.738018][T25024] ? __pfx_netlink_sendmsg+0x10/0x10 [ 575.738053][T25024] __sock_sendmsg+0x219/0x270 [ 575.738080][T25024] ____sys_sendmsg+0x505/0x830 [ 575.738115][T25024] ? __pfx_____sys_sendmsg+0x10/0x10 [ 575.738156][T25024] ? import_iovec+0x74/0xa0 [ 575.738181][T25024] ___sys_sendmsg+0x21f/0x2a0 [ 575.738210][T25024] ? __pfx____sys_sendmsg+0x10/0x10 [ 575.738283][T25024] ? __fget_files+0x2a/0x420 [ 575.738311][T25024] ? __fget_files+0x3a0/0x420 [ 575.738353][T25024] __x64_sys_sendmsg+0x19b/0x260 [ 575.738386][T25024] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 575.738427][T25024] ? __pfx_ksys_write+0x10/0x10 [ 575.738449][T25024] ? rcu_is_watching+0x15/0xb0 [ 575.738475][T25024] ? do_syscall_64+0xbe/0x3b0 [ 575.738504][T25024] do_syscall_64+0xfa/0x3b0 [ 575.738526][T25024] ? lockdep_hardirqs_on+0x9c/0x150 [ 575.738548][T25024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.738567][T25024] ? clear_bhb_loop+0x60/0xb0 [ 575.738591][T25024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.738608][T25024] RIP: 0033:0x7f5d3698ebe9 [ 575.738626][T25024] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 575.738643][T25024] RSP: 002b:00007f5d377ff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 575.738665][T25024] RAX: ffffffffffffffda RBX: 00007f5d36bb5fa0 RCX: 00007f5d3698ebe9 [ 575.738679][T25024] RDX: 0000000000000000 RSI: 0000200000003700 RDI: 0000000000000003 [ 575.738691][T25024] RBP: 00007f5d377ff090 R08: 0000000000000000 R09: 0000000000000000 [ 575.738702][T25024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 575.738713][T25024] R13: 00007f5d36bb6038 R14: 00007f5d36bb5fa0 R15: 00007ffda208a3c8 [ 575.738747][T25024] [ 576.043781][T25028] netlink: 'syz.5.5380': attribute type 2 has an invalid length. [ 576.101729][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 576.569624][T25067] netlink: 'syz.5.5388': attribute type 1 has an invalid length. [ 576.901532][T25082] __nla_validate_parse: 5 callbacks suppressed [ 576.901554][T25082] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5395'. [ 577.142308][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 577.163221][T25093] openvswitch: netlink: Flow actions attr not present in new flow. [ 577.197860][T25097] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5398'. [ 577.827003][T25119] dvmrp0: entered allmulticast mode [ 578.181878][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 578.445088][T25154] netlink: 76 bytes leftover after parsing attributes in process `syz.6.5413'. [ 578.480691][T25154] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5413'. [ 578.537753][T25161] netlink: 'syz.6.5413': attribute type 11 has an invalid length. [ 578.571837][T25161] netlink: 'syz.6.5413': attribute type 11 has an invalid length. [ 578.590460][T25161] netlink: 152 bytes leftover after parsing attributes in process `syz.6.5413'. [ 578.654784][T25159] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5414'. [ 578.695162][T25159] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 578.720433][T25159] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 578.820358][T25160] netlink: 'syz.5.5416': attribute type 23 has an invalid length. [ 579.208119][T25175] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x5 [ 579.221739][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 579.660538][T25196] sctp: [Deprecated]: syz.5.5423 (pid 25196) Use of struct sctp_assoc_value in delayed_ack socket option. [ 579.660538][T25196] Use struct sctp_sack_info instead [ 579.700144][T25199] netlink: 'syz.0.5425': attribute type 1 has an invalid length. [ 579.747152][T25200] netlink: 'syz.0.5425': attribute type 1 has an invalid length. [ 579.778519][T25196] netlink: 100 bytes leftover after parsing attributes in process `syz.5.5423'. [ 579.839640][T25199] 8021q: adding VLAN 0 to HW filter on device bond5 [ 579.850126][T25204] netem: change failed [ 579.899674][T25206] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5427'. [ 579.951396][T25206] geneve3: entered promiscuous mode [ 580.252210][T25240] netlink: 68 bytes leftover after parsing attributes in process `syz.6.5433'. [ 580.261885][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 580.807290][T25257] pim6reg1: entered promiscuous mode [ 580.816668][T25257] pim6reg1: entered allmulticast mode [ 580.875818][T25258] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5437'. [ 581.301833][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 581.753941][ T5185] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 581.764469][ T5185] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 581.773451][ T5185] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 581.785709][ T5185] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 581.798238][ T5185] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 582.342243][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 582.518835][T25279] chnl_net:caif_netlink_parms(): no params data found [ 583.381682][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 583.599289][T25303] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 583.667623][T25305] __nla_validate_parse: 1 callbacks suppressed [ 583.667647][T25305] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5448'. [ 583.777943][T25310] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5450'. [ 583.871045][ T5868] Bluetooth: hci4: command tx timeout [ 583.898639][T25308] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5449'. [ 583.997294][T25279] bridge0: port 1(bridge_slave_0) entered blocking state [ 584.018268][T25279] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.044586][T25279] bridge_slave_0: entered allmulticast mode [ 584.063265][T25279] bridge_slave_0: entered promiscuous mode [ 584.088544][T25279] bridge0: port 2(bridge_slave_1) entered blocking state [ 584.105267][T25279] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.114656][T25279] bridge_slave_1: entered allmulticast mode [ 584.123609][T25279] bridge_slave_1: entered promiscuous mode [ 584.294288][T25279] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 584.338302][T25279] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 584.422001][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 584.450389][T25331] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 584.510992][T25279] team0: Port device team_slave_0 added [ 584.586469][T25279] team0: Port device team_slave_1 added [ 584.639648][T25351] netlink: 'syz.5.5461': attribute type 11 has an invalid length. [ 584.727197][T25279] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 584.752046][T25279] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.778835][T25279] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 584.792646][T25279] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 584.800384][T25279] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.827960][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 584.851502][T25279] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.972890][T25361] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5464'. [ 584.991543][T25279] hsr_slave_0: entered promiscuous mode [ 584.998612][T25279] hsr_slave_1: entered promiscuous mode [ 585.006025][T25279] debugfs: 'hsr0' already exists in 'hsr' [ 585.014362][T25279] Cannot create hsr debugfs directory [ 585.208672][T25279] netdevsim netdevsim6 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.219607][T25279] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 585.230425][T25279] netdevsim netdevsim6 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 585.296889][T25279] netdevsim netdevsim6 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.307135][T25279] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 585.317511][T25279] netdevsim netdevsim6 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 585.391374][T25279] netdevsim netdevsim6 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.401422][T25279] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 585.411427][T25279] netdevsim netdevsim6 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 585.458228][T25279] netdevsim netdevsim6 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.468243][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 585.476235][T25279] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 585.486292][T25279] netdevsim netdevsim6 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 585.771299][T25279] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 585.805994][T25381] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5469'. [ 585.859589][T25279] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 585.896345][T25378] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5468'. [ 585.906515][T25279] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 585.933287][T25378] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 585.942475][ T5868] Bluetooth: hci4: command tx timeout [ 586.005119][T25391] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5472'. [ 586.096515][T25378] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 586.170130][T25279] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 586.259671][T25400] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5473'. [ 586.501835][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 586.568803][T25417] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5477'. [ 586.575940][T25279] 8021q: adding VLAN 0 to HW filter on device bond0 [ 586.648687][T25279] 8021q: adding VLAN 0 to HW filter on device team0 [ 586.709700][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 586.717145][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 586.789134][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.796385][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 587.038832][T25279] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 587.079893][T25439] netlink: 'syz.3.5484': attribute type 1 has an invalid length. [ 587.133169][T25442] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5486'. [ 587.169724][T25437] bond2 (unregistering): Released all slaves [ 587.321403][T25456] netlink: 'syz.0.5487': attribute type 1 has an invalid length. [ 587.384993][T25457] netlink: 'syz.1.5488': attribute type 1 has an invalid length. [ 587.541778][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 587.667194][T25279] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 588.022653][ T5185] Bluetooth: hci4: command tx timeout [ 588.582036][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 588.627302][T25507] team0: Device ip6gre2 is of different type [ 588.673523][T25501] __nla_validate_parse: 6 callbacks suppressed [ 588.673543][T25501] netlink: 324 bytes leftover after parsing attributes in process `syz.1.5502'. [ 588.760013][T25502] netlink: 324 bytes leftover after parsing attributes in process `syz.1.5502'. [ 588.965472][T25279] veth0_vlan: entered promiscuous mode [ 589.045425][T25279] veth1_vlan: entered promiscuous mode [ 589.169846][T25279] veth0_macvtap: entered promiscuous mode [ 589.224799][T25279] veth1_macvtap: entered promiscuous mode [ 589.314475][T25279] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 589.379396][T25279] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 589.456138][ T2988] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.499496][ T2988] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.530181][ T2988] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.572737][ T2988] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.621926][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 589.720038][T25553] syzkaller0: entered promiscuous mode [ 589.727645][T25553] syzkaller0: entered allmulticast mode [ 589.753192][T25554] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5515'. [ 589.883865][T25558] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 590.101800][ T5868] Bluetooth: hci4: command tx timeout [ 590.401127][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.429084][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.567284][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.599377][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.661785][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 590.733003][T25580] : renamed from bridge_slave_0 (while UP) [ 590.930265][T25597] netlink: 401 bytes leftover after parsing attributes in process `syz.3.5527'. [ 591.011939][ T8869] IPVS: starting estimator thread 0... [ 591.079391][T25608] tipc: Enabling of bearer rejected, failed to enable media [ 591.101902][T25602] IPVS: using max 24 ests per chain, 57600 per kthread [ 591.584571][T25637] netlink: 'syz.0.5531': attribute type 1 has an invalid length. [ 591.597596][T25637] netlink: 5624 bytes leftover after parsing attributes in process `syz.0.5531'. [ 591.701716][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 591.775872][T25648] 8021q: adding VLAN 0 to HW filter on device ipvlan4 [ 591.786872][T25648] bond0: (slave ipvlan4): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 592.379776][T25680] netlink: 72 bytes leftover after parsing attributes in process `syz.5.5546'. [ 592.398799][T25680] netlink: 72 bytes leftover after parsing attributes in process `syz.5.5546'. [ 592.530773][T25687] netlink: 36 bytes leftover after parsing attributes in process `syz.6.5549'. [ 592.573508][T25693] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 592.601101][T25696] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 592.741834][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 593.007619][T25712] netlink: 100 bytes leftover after parsing attributes in process `syz.3.5556'. [ 593.029247][T25713] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5555'. [ 593.230516][T25726] netlink: 'syz.0.5560': attribute type 11 has an invalid length. [ 593.489657][T25740] netdevsim netdevsim6: Direct firmware load for failed with error -2 [ 593.515578][T25740] netdevsim netdevsim6: Falling back to sysfs fallback for: [ 593.784714][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 593.943388][T25765] hsr0 speed is unknown, defaulting to 1000 [ 593.964652][T25765] hsr0 speed is unknown, defaulting to 1000 [ 593.993522][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.020558][T25765] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 594.111106][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.133693][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.162150][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.176932][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.208086][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.219209][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.235051][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.248888][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.259485][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.269945][T25765] hsr0 speed is unknown, defaulting to 1000 [ 594.821837][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 594.868624][T25801] __nla_validate_parse: 3 callbacks suppressed [ 594.868647][T25801] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5583'. [ 594.934557][T25804] netlink: 'syz.5.5584': attribute type 11 has an invalid length. [ 594.954914][T25804] netlink: 'syz.5.5584': attribute type 11 has an invalid length. [ 594.989265][T25804] netlink: 152 bytes leftover after parsing attributes in process `syz.5.5584'. [ 595.265350][T25819] netlink: 'syz.3.5588': attribute type 32 has an invalid length. [ 595.486865][T25829] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 595.637709][T25845] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5590'. [ 595.734365][T25852] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5600'. [ 595.861788][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 596.184659][T25873] netlink: 1284 bytes leftover after parsing attributes in process `syz.1.5606'. [ 596.226161][T25875] netlink: 1284 bytes leftover after parsing attributes in process `syz.1.5606'. [ 596.334944][T25884] sctp: [Deprecated]: syz.6.5610 (pid 25884) Use of int in max_burst socket option. [ 596.334944][T25884] Use struct sctp_assoc_value instead [ 596.594088][T25896] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5613'. [ 596.624631][T25896] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (222) [ 596.679151][T25903] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5615'. [ 596.826466][T25910] openvswitch: netlink: Actions may not be safe on all matching packets [ 596.870334][T25911] netlink: 48 bytes leftover after parsing attributes in process `syz.5.5618'. [ 596.901737][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 596.913842][T25911] netlink: 48 bytes leftover after parsing attributes in process `syz.5.5618'. [ 597.346260][T25939] netlink: 'syz.3.5626': attribute type 21 has an invalid length. [ 597.619564][T25956] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.636543][T25956] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 597.716829][T25958] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (64) [ 597.951672][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 598.089261][T25985] netlink: ct family unspecified [ 598.096915][T25985] openvswitch: netlink: Actions may not be safe on all matching packets [ 598.549184][T26006] vlan3: entered promiscuous mode [ 598.573178][T26006] bridge0: entered promiscuous mode [ 598.618421][T26007] netlink: 'syz.5.5649': attribute type 4 has an invalid length. [ 598.981931][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 599.050496][T26034] vlan2: entered allmulticast mode [ 599.061420][T26034] bridge0: entered allmulticast mode [ 600.021706][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 600.106995][ T5185] Bluetooth: hci4: command 0x0405 tx timeout [ 600.362711][T26107] netlink: 'syz.1.5684': attribute type 1 has an invalid length. [ 600.405773][T26107] __nla_validate_parse: 14 callbacks suppressed [ 600.405806][T26107] netlink: 180 bytes leftover after parsing attributes in process `syz.1.5684'. [ 600.425599][T26112] netlink: 'syz.0.5682': attribute type 1 has an invalid length. [ 600.453833][T26112] netlink: 236 bytes leftover after parsing attributes in process `syz.0.5682'. [ 600.470356][T26118] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5686'. [ 600.482483][T26118] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5686'. [ 600.906581][T26133] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 601.068074][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 601.699265][T26170] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5701'. [ 601.743908][T26172] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5700'. [ 601.756877][T26172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5700'. [ 601.791259][T26172] netlink: 31 bytes leftover after parsing attributes in process `syz.0.5700'. [ 601.834920][T26172] netlink: 'syz.0.5700': attribute type 2 has an invalid length. [ 601.864626][T26172] netlink: 31 bytes leftover after parsing attributes in process `syz.0.5700'. [ 602.043410][T26186] netlink: 184 bytes leftover after parsing attributes in process `syz.3.5707'. [ 602.106549][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 602.173123][T26195] netlink: 'syz.1.5709': attribute type 5 has an invalid length. [ 602.281203][T26201] unsupported nlmsg_type 40 [ 603.141931][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 603.859087][T26270] vxcan1: tx address claim with dest, not broadcast [ 604.037674][ T94] block nbd1: Possible stuck request ffff88802571e000: control (read@0,1024B). Runtime 450 seconds [ 604.048681][ T94] block nbd1: Possible stuck request ffff88802571e1c0: control (read@1024,1024B). Runtime 450 seconds [ 604.060375][ T94] block nbd1: Possible stuck request ffff88802571e380: control (read@2048,1024B). Runtime 450 seconds [ 604.072448][ T94] block nbd1: Possible stuck request ffff88802571e540: control (read@3072,1024B). Runtime 450 seconds [ 604.181805][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 604.185938][T26278] FAULT_INJECTION: forcing a failure. [ 604.185938][T26278] name failslab, interval 1, probability 0, space 0, times 0 [ 604.204599][ T5185] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 604.216269][T26278] CPU: 0 UID: 0 PID: 26278 Comm: syz.6.5737 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 604.216302][T26278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 604.216314][T26278] Call Trace: [ 604.216323][T26278] [ 604.216332][T26278] dump_stack_lvl+0x189/0x250 [ 604.216363][T26278] ? __pfx____ratelimit+0x10/0x10 [ 604.216388][T26278] ? __pfx_dump_stack_lvl+0x10/0x10 [ 604.216413][T26278] ? __pfx__printk+0x10/0x10 [ 604.216443][T26278] ? __pfx___might_resched+0x10/0x10 [ 604.216464][T26278] ? fs_reclaim_acquire+0x7d/0x100 [ 604.216500][T26278] should_fail_ex+0x414/0x560 [ 604.216530][T26278] should_failslab+0xa8/0x100 [ 604.216560][T26278] __kmalloc_noprof+0xcb/0x4f0 [ 604.216586][T26278] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 604.216614][T26278] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 604.216644][T26278] genl_family_rcv_msg_doit+0xb8/0x300 [ 604.216681][T26278] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 604.216710][T26278] ? apparmor_capable+0x137/0x1b0 [ 604.216734][T26278] ? bpf_lsm_capable+0x9/0x20 [ 604.216759][T26278] ? security_capable+0x7e/0x2e0 [ 604.216799][T26278] genl_rcv_msg+0x60e/0x790 [ 604.216828][T26278] ? __pfx_genl_rcv_msg+0x10/0x10 [ 604.216845][T26278] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 604.216872][T26278] ? __pfx_nl80211_tx_control_port+0x10/0x10 [ 604.216899][T26278] ? __pfx_nl80211_post_doit+0x10/0x10 [ 604.216931][T26278] ? __asan_memcpy+0x40/0x70 [ 604.216953][T26278] ? __pfx_ref_tracker_free+0x10/0x10 [ 604.216987][T26278] netlink_rcv_skb+0x208/0x470 [ 604.217010][T26278] ? __lock_acquire+0xab9/0xd20 [ 604.217038][T26278] ? __pfx_genl_rcv_msg+0x10/0x10 [ 604.217060][T26278] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 604.217110][T26278] ? down_read+0x1ad/0x2e0 [ 604.217141][T26278] genl_rcv+0x28/0x40 [ 604.217169][T26278] netlink_unicast+0x82f/0x9e0 [ 604.217203][T26278] ? __pfx_netlink_unicast+0x10/0x10 [ 604.217227][T26278] ? netlink_sendmsg+0x642/0xb30 [ 604.217245][T26278] ? skb_put+0x11b/0x210 [ 604.217274][T26278] netlink_sendmsg+0x805/0xb30 [ 604.217306][T26278] ? __pfx_netlink_sendmsg+0x10/0x10 [ 604.217332][T26278] ? aa_sock_msg_perm+0xf1/0x1d0 [ 604.217358][T26278] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 604.217375][T26278] ? __pfx_netlink_sendmsg+0x10/0x10 [ 604.217399][T26278] __sock_sendmsg+0x219/0x270 [ 604.217424][T26278] ____sys_sendmsg+0x505/0x830 [ 604.217456][T26278] ? __pfx_____sys_sendmsg+0x10/0x10 [ 604.217494][T26278] ? import_iovec+0x74/0xa0 [ 604.217517][T26278] ___sys_sendmsg+0x21f/0x2a0 [ 604.217547][T26278] ? __pfx____sys_sendmsg+0x10/0x10 [ 604.217617][T26278] ? __fget_files+0x2a/0x420 [ 604.217643][T26278] ? __fget_files+0x3a0/0x420 [ 604.217693][T26278] __x64_sys_sendmsg+0x19b/0x260 [ 604.217722][T26278] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 604.217761][T26278] ? __pfx_ksys_write+0x10/0x10 [ 604.217783][T26278] ? rcu_is_watching+0x15/0xb0 [ 604.217807][T26278] ? do_syscall_64+0xbe/0x3b0 [ 604.217838][T26278] do_syscall_64+0xfa/0x3b0 [ 604.217859][T26278] ? lockdep_hardirqs_on+0x9c/0x150 [ 604.217882][T26278] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.217901][T26278] ? clear_bhb_loop+0x60/0xb0 [ 604.217926][T26278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.217945][T26278] RIP: 0033:0x7f70dfb8ebe9 [ 604.217965][T26278] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 604.217980][T26278] RSP: 002b:00007f70e0a19038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 604.218003][T26278] RAX: ffffffffffffffda RBX: 00007f70dfdb5fa0 RCX: 00007f70dfb8ebe9 [ 604.218017][T26278] RDX: 0000000000000000 RSI: 0000200000003700 RDI: 0000000000000003 [ 604.218030][T26278] RBP: 00007f70e0a19090 R08: 0000000000000000 R09: 0000000000000000 [ 604.218042][T26278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 604.218054][T26278] R13: 00007f70dfdb6038 R14: 00007f70dfdb5fa0 R15: 00007ffe20dd2f88 [ 604.218090][T26278] [ 604.658452][ T5185] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 604.665580][T26285] netlink: 'syz.5.5739': attribute type 1 has an invalid length. [ 604.677370][ T5185] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 604.685872][ T5185] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 604.695130][ T5185] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 604.759123][ T3008] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 604.770001][ T3008] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 604.780508][ T3008] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 604.873277][ T3008] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 604.883606][ T3008] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 604.893652][ T3008] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 604.983997][ T3008] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 604.996634][ T3008] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 604.997028][T26299] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 605.006873][ T3008] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 605.037714][T26280] hsr0 speed is unknown, defaulting to 1000 [ 605.120799][ T3008] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 605.139162][ T3008] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 605.158812][ T3008] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 605.231874][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 606.157975][ T3008] tipc: Disabling bearer [ 606.214399][ T3008] dvmrp0 (unregistering): left allmulticast mode [ 606.271771][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 606.524725][T26345] sctp: [Deprecated]: syz.0.5758 (pid 26345) Use of struct sctp_assoc_value in delayed_ack socket option. [ 606.524725][T26345] Use struct sctp_sack_info instead [ 606.741993][ T5185] Bluetooth: hci0: command tx timeout [ 606.750928][T26355] netlink: 'syz.3.5760': attribute type 3 has an invalid length. [ 606.859724][ T3008] bond9 (unregistering): (slave bridge9): Releasing active interface [ 607.101461][ T3008] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 607.114377][ T3008] bond0 (unregistering): Released all slaves [ 607.267464][ T3008] bond1 (unregistering): Released all slaves [ 607.308750][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 607.434736][ T3008] bond2 (unregistering): Released all slaves [ 607.584949][ T3008] bond3 (unregistering): Released all slaves [ 607.599906][ T3008] bond4 (unregistering): Released all slaves [ 607.614868][ T3008] bond5 (unregistering): Released all slaves [ 607.769317][ T3008] bond6 (unregistering): Released all slaves [ 607.925786][ T3008] bond7 (unregistering): (slave bond8): Releasing backup interface [ 607.934266][ T3008] bond8 (unregistering): left promiscuous mode [ 607.940538][ T3008] bond8 (unregistering): left allmulticast mode [ 607.948641][ T3008] bond7 (unregistering): Released all slaves [ 608.099110][ T3008] bond8 (unregistering): Released all slaves [ 608.117042][ T3008] bond9 (unregistering): Released all slaves [ 608.130679][ T3008] bond10 (unregistering): Released all slaves [ 608.148106][ T3008] bond11 (unregistering): Released all slaves [ 608.169643][T26332] netlink: 'syz.5.5754': attribute type 5 has an invalid length. [ 608.213311][T26343] __nla_validate_parse: 10 callbacks suppressed [ 608.213334][T26343] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5755'. [ 608.267264][T26350] veth0_to_team: entered promiscuous mode [ 608.277748][T26350] veth0_to_team: entered allmulticast mode [ 608.341671][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 608.365128][T26280] chnl_net:caif_netlink_parms(): no params data found [ 608.401372][ T3008] : left promiscuous mode [ 608.476064][T26361] tipc: Started in network mode [ 608.481158][T26361] tipc: Node identity 080211000001, cluster identity 4711 [ 608.507026][T26361] tipc: Enabled bearer , priority 0 [ 608.531042][ T3008] tipc: Disabling bearer [ 608.541436][ T3008] tipc: Disabling bearer [ 608.557769][T26361] mac80211_hwsim hwsim58 syzkaller0: entered promiscuous mode [ 608.571774][T26361] mac80211_hwsim hwsim58 syzkaller0: entered allmulticast mode [ 608.581960][ T3008] tipc: Left network mode [ 608.842047][ T5185] Bluetooth: hci0: command tx timeout [ 609.149359][T26387] netlink: 40 bytes leftover after parsing attributes in process `syz.6.5769'. [ 609.169127][T26380] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5767'. [ 609.181180][T26385] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 609.209494][T26380] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5767'. [ 609.257515][T26381] delete_channel: no stack [ 609.348028][T26280] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.372255][T26280] bridge0: port 1(bridge_slave_0) entered disabled state [ 609.381727][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 609.391508][T26280] bridge_slave_0: entered allmulticast mode [ 609.400019][T26280] bridge_slave_0: entered promiscuous mode [ 609.488755][T26389] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5771'. [ 609.499535][T26280] bridge0: port 2(bridge_slave_1) entered blocking state [ 609.507283][ T8871] tipc: Node number set to 134418688 [ 609.509684][T26280] bridge0: port 2(bridge_slave_1) entered disabled state [ 609.520557][T26280] bridge_slave_1: entered allmulticast mode [ 609.531092][T26280] bridge_slave_1: entered promiscuous mode [ 609.595576][ T3008] hsr_slave_0: left promiscuous mode [ 609.615007][ T3008] hsr_slave_1: left promiscuous mode [ 609.691408][ T3008] veth1_macvtap: left promiscuous mode [ 609.698134][T26400] netlink: 32 bytes leftover after parsing attributes in process `syz.6.5775'. [ 609.700995][ T3008] veth0_macvtap: left promiscuous mode [ 609.717651][ T3008] veth1_vlan: left promiscuous mode [ 609.973613][ T3008] Oops: general protection fault, probably for non-canonical address 0xdffffc001fffc1ac: 0000 [#1] SMP KASAN PTI [ 609.985552][ T3008] KASAN: probably user-memory-access in range [0x00000000fffe0d60-0x00000000fffe0d67] [ 609.995129][ T3008] CPU: 1 UID: 0 PID: 3008 Comm: kworker/u8:8 Not tainted 6.16.0-syzkaller-12108-gc04fdca8a98a #0 PREEMPT(full) [ 610.007289][ T3008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 610.017619][ T3008] Workqueue: netns cleanup_net [ 610.022410][ T3008] RIP: 0010:__ip_mc_dec_group+0x2fd/0x690 [ 610.028136][ T3008] Code: 69 14 bc f7 c6 05 88 8b 89 05 01 48 c7 c7 00 90 9e 8c be 97 05 00 00 48 c7 c2 80 90 9e 8c e8 9a ee 99 f7 4c 89 e3 48 c1 eb 03 <42> 80 3c 2b 00 74 08 4c 89 e7 e8 d4 7e 1f f8 4d 8b 2c 24 4d 39 f5 [ 610.048124][ T3008] RSP: 0018:ffffc9000b1a73d8 EFLAGS: 00010206 [ 610.054304][ T3008] RAX: ffffffff8a03970e RBX: 000000001fffc1ac RCX: ffff88802f5b5a00 [ 610.062367][ T3008] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 610.070338][ T3008] RBP: ffff8880592ee420 R08: ffffffff8f5348a7 R09: 1ffffffff1ea6914 [ 610.078334][ T3008] R10: dffffc0000000000 R11: fffffbfff1ea6915 R12: 00000000fffe0d60 [ 610.086329][ T3008] R13: dffffc0000000000 R14: ffff888079651200 R15: 1ffff1100b25dc84 [ 610.094307][ T3008] FS: 0000000000000000(0000) GS:ffff888125d21000(0000) knlGS:0000000000000000 [ 610.103242][ T3008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 610.109827][ T3008] CR2: 00007f211bf90f98 CR3: 0000000076872000 CR4: 00000000003526f0 [ 610.117806][ T3008] Call Trace: [ 610.121093][ T3008] [ 610.124121][ T3008] inetdev_event+0x2a7/0x15b0 [ 610.128817][ T3008] ? __pfx_inetdev_event+0x10/0x10 [ 610.133954][ T3008] notifier_call_chain+0x1b6/0x3e0 [ 610.139075][ T3008] netif_close_many+0x29c/0x410 [ 610.143937][ T3008] ? __pfx_netif_close_many+0x10/0x10 [ 610.149406][ T3008] unregister_netdevice_many_notify+0x7b9/0x1ff0 [ 610.155741][ T3008] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 610.162502][ T3008] ? unregister_netdevice_queue+0x1b3/0x380 [ 610.168404][ T3008] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 610.174650][ T3008] ? __pfx_veth_dellink+0x10/0x10 [ 610.179686][ T3008] default_device_exit_batch+0x819/0x890 [ 610.185336][ T3008] ? __pfx___might_resched+0x10/0x10 [ 610.190627][ T3008] ? __pfx_default_device_exit_batch+0x10/0x10 [ 610.196788][ T3008] ? __pfx_rdma_dev_exit_net+0x10/0x10 [ 610.202257][ T3008] ? net_generic+0x1e/0x240 [ 610.206856][ T3008] ? __pfx_default_device_exit_batch+0x10/0x10 [ 610.213276][ T3008] ops_undo_list+0x525/0x990 [ 610.217890][ T3008] ? __pfx_ops_undo_list+0x10/0x10 [ 610.223027][ T3008] ? do_raw_spin_unlock+0x122/0x240 [ 610.228320][ T3008] cleanup_net+0x4c5/0x800 [ 610.232744][ T3008] ? __pfx_cleanup_net+0x10/0x10 [ 610.237702][ T3008] ? _raw_spin_unlock_irq+0x23/0x50 [ 610.242909][ T3008] ? process_scheduled_works+0x9ef/0x17b0 [ 610.248637][ T3008] ? process_scheduled_works+0x9ef/0x17b0 [ 610.254358][ T3008] process_scheduled_works+0xade/0x17b0 [ 610.260010][ T3008] ? __pfx_process_scheduled_works+0x10/0x10 [ 610.266013][ T3008] worker_thread+0x8a0/0xda0 [ 610.270616][ T3008] kthread+0x70e/0x8a0 [ 610.274697][ T3008] ? __pfx_worker_thread+0x10/0x10 [ 610.279809][ T3008] ? __pfx_kthread+0x10/0x10 [ 610.284432][ T3008] ? _raw_spin_unlock_irq+0x23/0x50 [ 610.289636][ T3008] ? lockdep_hardirqs_on+0x9c/0x150 [ 610.294845][ T3008] ? __pfx_kthread+0x10/0x10 [ 610.299444][ T3008] ret_from_fork+0x3fc/0x770 [ 610.304035][ T3008] ? __pfx_ret_from_fork+0x10/0x10 [ 610.309148][ T3008] ? __switch_to_asm+0x39/0x70 [ 610.313914][ T3008] ? __switch_to_asm+0x33/0x70 [ 610.318688][ T3008] ? __pfx_kthread+0x10/0x10 [ 610.323368][ T3008] ret_from_fork_asm+0x1a/0x30 [ 610.328142][ T3008] [ 610.331247][ T3008] Modules linked in: [ 610.337426][ T3008] ---[ end trace 0000000000000000 ]--- [ 610.357330][ T3008] RIP: 0010:__ip_mc_dec_group+0x2fd/0x690 [ 610.365523][ T3008] Code: 69 14 bc f7 c6 05 88 8b 89 05 01 48 c7 c7 00 90 9e 8c be 97 05 00 00 48 c7 c2 80 90 9e 8c e8 9a ee 99 f7 4c 89 e3 48 c1 eb 03 <42> 80 3c 2b 00 74 08 4c 89 e7 e8 d4 7e 1f f8 4d 8b 2c 24 4d 39 f5 [ 610.388511][ T3008] RSP: 0018:ffffc9000b1a73d8 EFLAGS: 00010206 [ 610.396887][ T3008] RAX: ffffffff8a03970e RBX: 000000001fffc1ac RCX: ffff88802f5b5a00 [ 610.407773][ T3008] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 610.416595][ T3008] RBP: ffff8880592ee420 R08: ffffffff8f5348a7 R09: 1ffffffff1ea6914 [ 610.431876][ C0] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 610.432445][ T3008] R10: dffffc0000000000 R11: fffffbfff1ea6915 R12: 00000000fffe0d60 [ 610.447858][ T3008] R13: dffffc0000000000 R14: ffff888079651200 R15: 1ffff1100b25dc84 [ 610.457363][ T3008] FS: 0000000000000000(0000) GS:ffff888125d21000(0000) knlGS:0000000000000000 [ 610.484128][ T3008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 610.490780][ T3008] CR2: 0000000000000000 CR3: 0000000076954000 CR4: 00000000003526f0 [ 610.498950][ T3008] Kernel panic - not syncing: Fatal exception [ 610.512520][ T3008] Kernel Offset: disabled [ 610.516936][ T3008] Rebooting in 86400 seconds..