last executing test programs: 3.381194903s ago: executing program 4 (id=2870): socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1d, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000005e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x5, 0x7, 0x8, 0x5, 0x80}, 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) socket$kcm(0x21, 0x2, 0xa) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000040000000000d0000000000005f00"], 0x0, 0x34, 0x0, 0x0, 0xfffffffc}, 0x28) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000440)={@fallback=r1, 0x37, 0x1, 0x7, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000580)={'tunl0\x00', &(0x7f0000000500)={'syztnl0\x00', 0x0, 0x20, 0x8000, 0xc, 0x2, {{0xb, 0x4, 0x0, 0x1, 0x2c, 0x66, 0x0, 0xa, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2e}, {[@rr={0x7, 0x17, 0xa8, [@broadcast, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @multicast2]}]}}}}}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32=r5, @ANYRES32=r3, @ANYBLOB="3600000005000000", @ANYRES32=r0, @ANYBLOB="fb0b50fa54af0b3077b0259d76b8", @ANYRES32=r0, @ANYBLOB, @ANYRES64=r4], 0x20) r6 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r6, &(0x7f0000000e40)=[{{&(0x7f00000000c0)={0xa, 0xfffe, 0x400, @loopback={0xff00000000000000}, 0x101}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000000)="8000102e7577d401", 0x8}], 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="16000000000000002900000043"], 0x18}}], 0x1, 0x4000880) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x21018}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve0\x00'}]}, 0x50}}, 0x80) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f00000000c0)=0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000240)={0x0, 'pim6reg0\x00', {0x2}, 0x9}) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r10 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r9, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r9, {}, {}, {0xfff3}}}, 0x24}}, 0x0) 3.096419556s ago: executing program 4 (id=2874): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00'}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x60}}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000001b80)=0xd, 0x4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r5, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r8, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0900000000000000000002000000140001800500020001"], 0x28}}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x34, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, r6) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x40004000) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) recvmmsg(r9, 0x0, 0x0, 0x10100, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @remote}) 2.618866596s ago: executing program 0 (id=2882): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000240)={0x3, {{0x2, 0x0, @multicast2}}}, 0x88) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_int(r2, 0x0, 0x33, &(0x7f0000000300)=0x80000005, 0x4) sendmsg$inet6(r2, &(0x7f0000000400)={&(0x7f0000000080)={0xa, 0x4e20, 0x5, @private0, 0x5}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000480)='`', 0x1}], 0x1}, 0x4044801) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_int(r3, 0x0, 0x33, &(0x7f0000000300)=0x80000005, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00'}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380), 0x4) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000880)={r5, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, &(0x7f0000000540)=[0x0, 0x0], &(0x7f0000000580)=[0x0], 0x0, 0xe7, &(0x7f00000005c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0x1e, 0x8, 0x8, &(0x7f0000000740)}}, 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1a000000ffff000000020000cc0f000080000200", @ANYRES32=r6, @ANYBLOB='\t\x00'/20, @ANYRES32=r7, @ANYRES32=r6, @ANYBLOB="00000000050000000200"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x6c7, r8}, 0x38) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x400005}, 0x1c) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c00000082aa01080000000000000000020000000900010073797a30000000000900020073797a3ae2ff0000"], 0x8d}, 0x1, 0x0, 0x0, 0x4080}, 0x0) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r11) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000016c0)=ANY=[@ANYBLOB="900000001000370400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8b04040000000000700012800b00010067656e657665000060000280050004000100000014000700000000000000000000000800000000010800010002000000050009000100000005000c"], 0x90}}, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="01000a00"}) getsockopt$sock_buf(r1, 0x1, 0xf, &(0x7f0000002100)=""/120, &(0x7f0000002180)=0x78) 2.230096056s ago: executing program 2 (id=2885): r0 = epoll_create(0x7) r1 = epoll_create1(0x0) r2 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000080)={0x40000011}) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001540)={{r4}, &(0x7f00000014c0), &(0x7f0000001500)='%pB \x00'}, 0x20) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000140)) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_subtree(r5, &(0x7f0000000700)=ANY=[], 0xfe33) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x8}, @ldst={0x3, 0x3, 0x3, 0xa, 0x0, 0xffffffffffffffe0}]}, &(0x7f0000000580)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x8}, 0x94) sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2313}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000010) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7d, 0x7d, 0x8, [@const={0x10, 0x0, 0x0, 0xa, 0x4}, @datasec={0x2, 0x4, 0x0, 0xf, 0x1, [{0x1, 0x10, 0x2000}, {0x4, 0x9867, 0x9b3}, {0x1, 0x10, 0x3}, {0x2, 0x0, 0x8}], "da"}, @decl_tag={0x2, 0x0, 0x0, 0x11, 0x1}, @func={0xe, 0x0, 0x0, 0xc, 0x3}, @typedef={0x5, 0x0, 0x0, 0x8, 0x4}, @func={0xd, 0x0, 0x0, 0xc, 0x1}]}, {0x0, [0x5f, 0x30, 0x2e, 0x2e, 0x0, 0x0]}}, &(0x7f00000004c0)=""/4096, 0xa0, 0x1000, 0x0, 0x7fffffff}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x4, 0x2d}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000015c0), r5) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000001680)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)={0x2c, r7, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x9}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) 2.101166094s ago: executing program 2 (id=2886): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000013b80)=ANY=[@ANYBLOB="280000001b1401"], 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x10) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) r2 = socket$kcm(0xa, 0x2, 0x88) sendmsg$inet(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000240)=[@ip_ttl={{0x14, 0xe000, 0x2, 0x7}}], 0x18}, 0x0) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x4, 0x0, 0x0, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0x5, 0x0, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) close(0x3) 2.099012979s ago: executing program 4 (id=2887): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x9, &(0x7f00000005c0)=ANY=[@ANYBLOB="1802000000000000000000000001000085100000010000009500000000000000184400000300000000000000000000008500000012000000950000000000000095"], &(0x7f0000000240)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x4c, 0x12, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2, [0x0, 0x0, 0x6], [0x0, 0x4]}, 0x400}}, 0x4c}, 0x1, 0x0, 0x0, 0x40090}, 0x0) r3 = openat$cgroup_subtree(r1, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x20, 0x40, 0x9, 0xfffffffc, 0x25dfdbfd, {0x3}, [@typed={0x4, 0x11f}, @nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0xa1, 0x0, 0x0, @binary}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x800) openat$cgroup_int(r5, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) (async) r7 = openat$cgroup_int(r5, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_int(r7, &(0x7f0000000280)=0xd, 0x12) write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) (async) write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) readv(r7, &(0x7f0000000700)=[{&(0x7f0000000bc0)=""/4096, 0x1000}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r8) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e0030000280080006"], 0x68}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e0030000280080006"], 0x68}}, 0x0) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r9, 0x0, 0x2e, &(0x7f0000000100)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="e008000000000b05d25a806c8c6394f90324fc6010000200c137153e3704020180fc0b09000c0000000000000000702ebab52fc96c1e4c5fb1091a63d4f5312812c677b2d37a4767158e5a70c8a5e18657cfdb15d1f3282ea8", 0x59}], 0x1000002b}, 0x0) 2.023521874s ago: executing program 2 (id=2889): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="98000000100001002abd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="a009000000000000140003006e657464657673696d3000000000000008002800babc00005c0016805800018054000c80140001"], 0x98}, 0x1, 0x0, 0x0, 0x24040854}, 0x40000) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000001700)=ANY=[@ANYBLOB="240000001e008d2af6ffffff000000000a000000", @ANYRES32=0x0, @ANYBLOB="0000d7ff07"], 0x24}}, 0x4044) 1.933308368s ago: executing program 4 (id=2891): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a1, &(0x7f0000000900)={'veth0_to_bond\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) 1.879629946s ago: executing program 2 (id=2892): socket$inet(0xa, 0x801, 0x81) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f00000000c0)=0x46, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x20000090, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback, 0x8}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x48) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x2d, 0x2, 0x0) connect$vsock_stream(r5, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00', @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b00010065727370616e00001400028008001400000000000500160000000000"], 0x44}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) r7 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), r6) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x34, r7, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="80040000", @ANYRES16=r7, @ANYBLOB="01002bbd7000fbdbdf250300000005000400010000001400020076657468315f766972745f77696669000900010073797a3200000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x3def50f2afc97867) sendmsg$SMC_PNETID_DEL(r8, 0x0, 0x4000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240)={0x1f, 0xffff, 0x2}, 0x6) socket$kcm(0x10, 0x2, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000280), r6) r9 = socket$tipc(0x1e, 0x5, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) setsockopt$TIPC_MCAST_BROADCAST(r9, 0x10f, 0x85) 1.8706857s ago: executing program 3 (id=2893): r0 = socket$nl_rdma(0x10, 0x3, 0x14) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xfffffffc, 0x8, 0x7, 0x4, 0x4, 0x0, 0x200, 0x6, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0x11}, {0xffe6, 0xb}, {0xb, 0xc}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xdb, 0x2, 0x7, 0x41, 0x7dd, 0x1}, {0xb2, 0x1, 0x2, 0x1000, 0x3, 0x6}, 0xcf0, 0x5, 0xd65}}, @TCA_TBF_RATE64={0xc, 0x4, 0xafdc78dbe0554eb6}, @TCA_TBF_PRATE64={0xc, 0x5, 0xee7f8a24a6399ccf}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4000000) ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="2800000011146ff9"], 0x28}}, 0x800) 1.813190323s ago: executing program 4 (id=2894): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, 0x0, 0x0) (async) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async, rerun: 32) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg(r4, &(0x7f0000000200)={&(0x7f0000000140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=""/35, 0x23}, 0x0) (async) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async, rerun: 32) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) (async, rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, 0x0, &(0x7f00000000c0)='GPL\x00'}, 0x94) (async, rerun: 64) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) (rerun: 64) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0c00000004000000040000000700000000000000", @ANYRES32=r7, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000001010000000000000000000434ae5462a200e76700be51a8986f8c5348c7c404c77d4e94834ea0d540543d89a98978d438f26ba22ae1bf508b63ffa9b1683240b750b8c0"], 0x50) (async) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r9}, 0x18) (async, rerun: 64) r10 = socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 64) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xb, 0x6, 0xfffffff1, 0x10001, 0x10040, 0xffffffffffffffff, 0x7fffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x3}, 0x50) r12 = bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0)={0x0, r0}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x6, 0xe31, 0x3ff, 0xe15a, 0x16408, r11, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x2, 0x0, @void, @value, @value=r12}, 0x50) (async) getsockopt$XDP_STATISTICS(r10, 0x11b, 0x7, &(0x7f00000003c0), &(0x7f0000000400)=0x18) (async) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000140)={r8, 0x58, &(0x7f00000000c0)}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r15 = socket$nl_generic(0x10, 0x3, 0x10) (async) r16 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r15, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x3c, r16, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x10, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x3c}}, 0x0) sendmsg$inet(r14, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) recvmsg(r13, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) 1.652956872s ago: executing program 4 (id=2896): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x4}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x78}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x1, 0x10, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000001000000000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000085000000a0000000bf91000000000000b702000000000000009500000000000000170a38ed15cbf9ebe03a2765d97680ad86fa9c0ac18622c602dfcf17797c57fd27fb8ce20c2269cd1a37f8982aea8e28e8bfc7e8f24c3b5e3548134f361ded7b0415fb67282e98c56b516ade7eaf5ccc6eddb88bb666836aa920dc4281911aed39b4b24921662ac1882901ab98bf81138c62760f046239a986f084a594b97727ab3bf3cdd856379e6d042002e6c98d20"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc1cf8d9cdff37140, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe, 0x0, &(0x7f0000000a00)="00000000076f00001abd8cf0eedf", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x60, 0x3, 0x6, 0x3, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x4140045e}, 0xc) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r10 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r10, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfd, 0x1000}, 0xc) r11 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r11, &(0x7f0000000240)={0x10, 0x0, 0x0, 0x51ee2927639cc674}, 0xc) r12 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r12, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) socket$netlink(0x10, 0x3, 0xc) 1.578324783s ago: executing program 0 (id=2897): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r1, 0xd7cf) (async) r2 = socket$netlink(0x10, 0x3, 0x10) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f00000000c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f00000001c0), 0x12) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000140)={0x4, 0x5, 0x7, 0x2, 0x80, 0x40, 0xf9, 0xff, 0x79, 0x2, 0x0, 0x9, 0xd7, 0x6}, 0xe) (async) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r8 = socket$unix(0x1, 0x2, 0x0) unshare(0x2c000680) (async) connect$unix(r8, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) (async) r9 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r9, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @dev={0xac, 0x14, 0x14, 0x35}}, 0x8) (async) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r10) (async) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010014000000000000000200e70308000300", @ANYRES32=r12, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f0009000000080026000816"], 0x40}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r13, 0x8933, &(0x7f0000000000)) 1.373764702s ago: executing program 1 (id=2898): sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0xc806, &(0x7f0000000180)={0x2, 0x4e21, @multicast1}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000d00)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @rand_addr=0x64010102}, {{0x0, 0x8035, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xc1}}}}}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000140)={@val={0x3, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x8016, 0x1400, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x1400, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) 1.370066786s ago: executing program 2 (id=2899): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'bond0\x00', 0x100}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101900, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000100)=0xffff0000) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000002540)=0x1) write$tun(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="000008000305070003008000060061ece01600602100fc000000000000000000000000000001fc0000000000000000000000000000015a02040158400500ff0200000000000000000000000000014e234e22040190781461e966fcd50ce8921826e4a94461c3c0dbf326e578f73b62bf9785ee8be064a29d9db427a3ff85887042f2fed8d5b451d80d7327ccedaac139537f4d043973"], 0x96) 1.273281046s ago: executing program 0 (id=2901): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010000104000000000000000000000018", @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800e00010069703665727370616e0000001c0002800400120004001200050017004100000005"], 0x50}}, 0x0) 1.195570516s ago: executing program 3 (id=2902): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x4, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'veth0\x00', &(0x7f0000000300)=@ethtool_gstrings={0x1b, 0x7}}) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x2, {0x40, 0x716, 0x2}}, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newtfilter={0x64, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0xe, 0x1}, {0x5, 0x40}}}]}}]}]}, @TCA_BASIC_CLASSID={0x8, 0x1, {0xffff, 0xb}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$tipc(r0, &(0x7f0000000400)={&(0x7f00000008c0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x4008030) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x48515}, 0x4) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r10 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x5d, &(0x7f0000000240)={&(0x7f0000000500)=@delchain={0x50, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r9, {0xfff3, 0xffe0}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @broadcast}, @TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "c1d1a1d6b8d93b12200000dbecc88ebe"}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40010}, 0x0) syz_emit_ethernet(0x2af, &(0x7f0000000940)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd6000084002793afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000030aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302000100001c0500000000260004000318fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8675b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5ceccfb8ad03e6f8bd0637f390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000220b17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e900000000000000039f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f00388adc02d06717fa1f20a35bd0cc5340ed6cbd2d91845c4eedbb96f7e7356be708b15c34e6f5a4c6556a6edf365adaba34cfbaba02e01c5ead191af9b3684269847a8d511ef46c5c4a6a2521bf0d71452f05449552e025b3e5415fee6042fdb5ff71348a1248c3d010000003fe6cc0118be9c992a31bec34c951528fc426d04cc100646c1fb6f9d78ce386c99ea2415b7092f799386c0762912c5d9dda22930671db119f419e3e6b7347908687fff502a883441d236ed3c1ee8abeab0b2b4d85369c26d6a56f57f80714e2a277f49e2ed6a040ae7a3d0996d989c693b52e35a22e012add73e8f926b10a655b0abc457c8042d866267fcbec6ec8e36c08d34b5c8094199"], 0x0) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="010027bd7000fcdbdf2502000000080001000000000042e19c397b2ef1240023287d27d60433245f17df86e2118393c18c08678cdf936e36c2a728ee8837908680d47f7e2dad099b6e55fe594f437de7fea8d50438cf66111ac26f9eb9c67a2fb299aa6e42192643490835a44d1869696859c47d3ef8165c43cf88257782982c5501e9ca8a0e09106355ba16ced0e0659116abcf0d455bf53f73c4ac3747616a506e03d929543963c2cae4642a3b260ad2ff22d3b38625f2aa2ac1d299e43d8da7be71c9d6841a5f3dd17e0624ff4afcf8bbdaa11d7dffd8e39d6334bd236fd8fb0e2a8063e1d8ebdba1ffc72274a8128d3bf4f102eba28dafa32141c9d3dd084661654ebc33b5575ea544067bf03235e03a265fbe1a51065a8f62b609386308e0ee60784ba9ae2963aeb241cd5c2f4815376ebf0aa68625dd96cf13ead253db0100000000000000e49375d05a48fd37654d1e70a811d958f5a0f5dc3e8dc1157f20a0ec93c549c8a1fca4ddf5b40d7ae0311a3d6f49158ce2a5a85753703c0cb3e1e41479b96709ff6009fc12b83bf56011656277b00b05227d862ce23d9a9395f6f586e947bb"], 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, r11, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0xa, 0xa, 'veth0\x00'}]}, 0x20}}, 0x40) 1.090299055s ago: executing program 0 (id=2903): socket$caif_seqpacket(0x25, 0x5, 0x3) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0xde, &(0x7f0000000480)={@random="e90dacb3d700", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3f, 0xd0, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0xbc, 0x0, @gue={{0x2, 0x0, 0x1, 0x9, 0x100}, "59ca82e877573885315da518d9d494110d7510c5e6b2b8819505195054997e44b0196c9ad469cca195675290accbe15bccbe81a0cdadd362f09aa5ba179e508163693d643154f29e8c17e317976d767a058244843f2fc552ceca376b37810edc48d0faf830024a20c49f990a1d54731a5a90833b51f5ae5e368a7c577aac4c4c29eb0598985ba276cef626ddc2d514522704c1eae19e48609d1f55ba5879d3032914b525cca21e15b23c0bf8"}}}}}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000001a80)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) 945.24807ms ago: executing program 2 (id=2904): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast2}, 0x20000003}}, 0x2e) r2 = socket$packet(0x11, 0x3, 0x300) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x0, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r6 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001080)={0x38, 0x1403, 0x1, 0x0, 0x25dfdbfc, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'wg0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x100) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r7, &(0x7f0000005080)={0x24, @short={0x2, 0x1, 0xaaa0}}, 0x14) r8 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r9, 0x84, 0x6b, &(0x7f00000003c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r9, 0x84, 0x1e, &(0x7f00000008c0)=0x2, 0x4) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x41, 0x0, 0x10820, 0x400}, [@IFLA_IFNAME={0x14, 0x3, 'macvlan0\x00'}]}, 0x34}}, 0x4084) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x4000, 0x25dfdbfb, {}, [@IFLA_MASTER={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x2}]}, 0x30}}, 0x4) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8}]}}}, {0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000180)=@req3={0x7, 0x2002, 0x0, 0x2, 0x8, 0x101, 0x5}, 0x1c) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000001300)) 928.645697ms ago: executing program 1 (id=2905): r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x8906}, @val={0x0, 0x87, 0xffff, 0x9, 0x6, 0x1}, @eth={@remote, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@llc_tr={0x11, {@llc={0xf0, 0x42, "97c2", "4f8620f14a71ac73cf246ef9f4b82e10b84cd4fb70e45cbe5e9146b267773cccd0e2718af6ceecab93b4beef7a8851c0d581c2c9c57c718e37e975a065e9bf95c417a03aca638359d32449a210095f927cd8efe65d88bc33882613154e1a7281aa8fd7c19d1b89dd7b26c7d4fa63b0c827808f628beacca83bb7"}}}}}}, 0x9a) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r1, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x7f}]}, 0x28}, 0x1, 0x0, 0x0, 0x20040041}, 0x80) sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r1, 0x8, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x5}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xc9}]}, 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x0) (async) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000380)={0x0, @in={{0x2, 0x4e21, @multicast2}}, 0xf18f, 0x40}, 0x90) (async) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000440)={0x0, 0x6}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000004c0)={r2, 0x8, 0x6}, &(0x7f0000000500)=0x8) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = accept4(r0, &(0x7f0000000540)=@generic, &(0x7f00000005c0)=0x80, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r3) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_INTERFACE(r4, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x28, r5, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x8000, 0x1c}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40840) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), r0) sendmsg$NL80211_CMD_DEL_MPATH(r4, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x40, r7, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x1, 0x2a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCGIFBRDADDR(r8, 0x8919, &(0x7f00000008c0)={'vxcan1\x00', {0x2, 0x0, @remote}}) (async) sendmsg$AUDIT_USER_AVC(r4, &(0x7f0000000a40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000a00)={&(0x7f0000000940)={0xbc, 0x453, 0x300, 0x70bd2c, 0x25dfdbfc, "209bacb658a0c2ca27653d182e17a34ab67b98f53f258e859312207d2240792b8435ff5f11a3c22b5d67958e6dd607cfa907dbcb33a816ee2cd4b72b578a4cd5ddfaf3064b9cd0e993b32fd51db621a3bae3f9edbe75533bccff0825df274a43b474934c1f5971f690fb8cbb9302c6f47068fb338f8a6421e13ccf1f26c4474212fc1f380b36e7012e42499a4eebd6e327d0819c1e71b2ff5e0fe505f0514bdab962c13915f937dcab", ["", ""]}, 0xbc}, 0x1, 0x0, 0x0, 0xc0c5}, 0x48000) (async) bind$inet(r4, &(0x7f0000000a80)={0x2, 0x4e21, @private=0xa010101}, 0x10) (async) socket$xdp(0x2c, 0x3, 0x0) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b00), r0) sendmsg$TIPC_NL_SOCK_GET(r3, &(0x7f0000000c40)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b40)={0x8c, r9, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'geneve0\x00'}}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7ff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffffb}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xd6a6}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7983}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x4000010) (async) sendmsg$TIPC_NL_KEY_FLUSH(r3, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x20, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48800}, 0x80) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000dc0)={0x78, r7, 0x2, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x66}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x251}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x9b4}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x334}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x149}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8d}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x2cb6d998}, @NL80211_ATTR_DURATION={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x40881}, 0x20000800) (async) recvmsg(r3, &(0x7f00000012c0)={&(0x7f0000000ec0)=@generic, 0x80, &(0x7f0000001180)=[{&(0x7f0000000f40)=""/219, 0xdb}, {&(0x7f0000001040)=""/245, 0xf5}, {&(0x7f0000001140)=""/24, 0x18}], 0x3, &(0x7f00000011c0)=""/213, 0xd5}, 0x10020) (async) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001340), r0) sendmsg$IPVS_CMD_GET_SERVICE(r8, &(0x7f00000014c0)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001480)={&(0x7f0000001380)={0xe0, r10, 0x8, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x76}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfff7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff1351}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xff}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2c}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xd0}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x800}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0xe0}}, 0x4804) (async) socket$netlink(0x10, 0x3, 0xf) (async) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000001500)={'filter\x00', 0x0, 0x0, 0x0, [0x9, 0x3, 0x7, 0x1c75, 0xc, 0x2]}, &(0x7f0000001580)=0x78) 712.216672ms ago: executing program 1 (id=2906): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmsg(r0, &(0x7f0000004b40)={0x0, 0x0, 0x0}, 0x40002100) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000d40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000002d030100000000009500ffb1000000006926000000000000bf67000000000000150002000fff5d004507000007000000d60600000ee60000bf1600000000000040700000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c043a7bc4b29d2dc480dd7a0d981422b32d93bad720100010000000000b39d0af449deaa27ea949e8f9000d885dfea27834aa7eb8d33ac04060630e78a30fc835e29eb532ba8546fc020c196738b5f32b09f95f5d5b196b9ffc02f952ac53e817671d1000000008ba8583aa4c77097f1c75df9bdd8288fd2f8743924cd6dd4ed457183edc74ca79c79a3da0cea39dbacd0e4b608cece26817f0f53dde0d43388e8f92d0bfdd4b427ee5b708aa2685c735f840e055a163e38a276b7fd16492587edaec8bc43f312c7ddfa59a53c9e772832f527c0ae9afcf582413f6f8c442ce39039a64965facb4340f2249cc60a8dec5b8a9ac6d60e36f57dbe1664decf85b7cae19a1d0d7bce02902284aa9041366eed09c3baafb2a4c14a373f8ffdfe107d401b7b93866f8aadff4df0f226f411d43d579541275f0bacd2dc24faf2d4d992d9f8031a422f2a30cf35e9d00644acc1ff674781281c6b93447312cc93c738b6a83a2e83225af295e0776d033557913ac9096ee1e119a06a38fcd918a18f4c01f60692a1684c55086bec71e819f8b345a5f80d3e5bc7e6854e2ea7a035b975b96e9459382fafc5f6fd106fbbd3b014b5a546f523afd9c9bed9212d7bb745123259e8f46b413e633db1668ad038725e3e01bd6707aee08b267dcd54b961c4d56b608d903ae06cc23eb1d79b3384512f2c424739aba4297063005376b6b900f3416835151fb61f08dfb4ad3732fc0f5a05339608b003a80cce6b032f13b5f2890ec29130022ff6fa874ce885e91c8e4df772286210e5aca1a64dfb12f0a2c1e992aae6afb3514afd648230650e532e8ec540a25b65657a7259922602ffdd3375a4b0f864db09907c7b8e97abb824c1f3167cff71e96682f37f37b156833d729d7369af37345fb97f3ac3e9c01328a3d7f36ae6d48c94bcf630fe6e94c5a080fe3ccde9ff72f98bd0454203a5cbe34ab7df76e54ec26942835ca6b9e0db2b24d19de496bf22d5cac91b6deb25b5622ddd7bddad97d4850735df6fff37098b06d660e5d73efdce87be427bc79e67ad31d7768d65f811ed84f29db15b8456dc951dcb8be1da330fd0c1371dbbfcedaff57e29b95b4277b46aa41eab05a756d8556d4c14b570770bc0a3c9cdd688e3e583ee2284fc32c6eed47d70c6c22c8226ae8d4144fac10d2ca22673cbe55ee11b68bf18f4811cf943b9a7f30f07be34ae41ae192b1222ccc12000966d63ee0f75e73c0ae0cd660cc27583f3a7c81f652948c92569f0ca58d4c42e91000000000000000000000000d8e5c9a920c1418f62bf914bcac98ad06c42b86346d4cc4658abfdf3475a579337d1cf5529a14b64f14c478c0e390628c4702c3daf07d681e412c91484a6bc790ecdb597a461d9ac4d69a005f3fdf015d622c027c0e0181631a9f6d56361187e2076a14caf88c82a37248ff7b26d20a1ff7c1f1a31fe22ed64360c29124bf041f978042f5a23624447ee4d1612268c80e5c3b88a2a22264ad8012750997733121fcbaa2a094ef8ab27579d4daa10d9b42b9f75ef42df0c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[@mss={0x2, 0x4b37}, @mss={0x2, 0x89}, @timestamp, @mss={0x2, 0x9}, @timestamp, @mss={0x2, 0xef}, @mss={0x2, 0x8}], 0x7) (async) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r1}, 0x8) (async) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) r4 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[@ANYBLOB="140000000d0603"], 0x14}}, 0x0) (async) syz_genetlink_get_family_id$smc(&(0x7f0000000080), r4) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1600000001000000ff0f00000500000080100000", @ANYRES16, @ANYBLOB="010001000000000010e6f9a117b25eaa117338b77c263952e2d46df293474930298643f0be675e76d5f8371ffd757fe23ff0f15f3465ad0ee0709951c7a1a522787e340f2795e52e9cfe9fc11e2734cefa8a135e785295415c48eb7f19907c9c7a66c5afccda2dd46fdf0abe5eca3f0c8e71c7506add1fbe86f44eb47558b376be023ba85a93ce495b4049681a15037d393e8b54b19b176ffb49040cc6d75b216774af8280451b16b873fb3b678792a19891e48cc7da5ba9c73f29b60b14d7a1eb6129c550b605625f80895a5249cfa343d31d5090cb714847580253b6b1ecbf8abc25a6d4866ea5a20270d59e9274e1e05f3403443ed3859c2ff300dbe1e43177eb46293176f1243a023f23e5d7f6082907444573c9304a926c89a5066333c2ba6395e6395cecb17b8614fa5817345dd4ec83435fe48f257b600ed155529203", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000000000000500"/28], 0xffffffffffffff1b) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x16, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000006000000000000000900000018110000", @ANYRES32, @ANYBLOB="0000000000000000b722000014000000b70300000000000085000000000000005509010000000000950000000000fcffffffffffffff000000000000000000001812000000000000000000008a34fa6e7a8319be34da681dce11a303c9bc1b76084f0c258163ad37614992c4eb328ca05b99edfd28383a417714005c668793fddb42eb471e583f443854b74c1f57b2e764c303cbf0dc97541404957a28a4f98c03271733bbbc20844aa27ed5f5398ca1995a439982a5c89f59a4a0032cb4b483b6a6fa18f725fa283b6c9726054ed77080e023d796ee4ad216a2a63b97d971bab779fb13087ba3d0066420e99d", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x4a, &(0x7f00000003c0)=""/74, 0x41000, 0x30, '\x00', r6, 0x0, r4, 0x8, &(0x7f0000000240)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x6, 0x0, 0x7fffffff}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000500)=[{0x5, 0x3, 0xf, 0x1}, {0x5, 0x3, 0x9, 0x5}, {0x1, 0x1, 0xf}, {0x1, 0x4, 0x1, 0x5}]}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x2, 0x13, &(0x7f0000000080)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x10, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1c, '\x00', r6, 0x0, r3}, 0x94) r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000b80)=@o_path={&(0x7f0000000b40)='./file0\x00', 0x0, 0x8, r4}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x16, &(0x7f0000000940)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x90}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xa6}, @alu={0x7, 0x0, 0x8, 0x4, 0x9, 0x1, 0x10}, @map_fd={0x18, 0x6, 0x1, 0x0, r5}, @map_idx={0x18, 0xa, 0x5, 0x0, 0x1}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x1}, @printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @map_fd={0x18, 0x3, 0x1, 0x0, r5}]}, &(0x7f0000000000)='GPL\x00', 0x81, 0xe1, &(0x7f0000000a00)=""/225, 0x41000, 0x24, '\x00', r6, 0x25, r3, 0x8, &(0x7f0000000540)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000b00)={0x1, 0x5, 0x2, 0x6}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000bc0)=[r7], &(0x7f0000000c00)=[{0x4, 0x1, 0x6, 0xf}, {0x2, 0x5, 0x7, 0xa}, {0x2, 0x1, 0x4, 0x7}, {0x1, 0x4, 0x10, 0x3}, {0x3, 0x4, 0x3, 0x7}, {0x1, 0x1, 0xb, 0xb}, {0x5, 0x3, 0x5, 0x3d2544d4b63fdac5}], 0x10, 0x4}, 0x94) (async) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f0000000140)=""/16, &(0x7f0000000180)=0x10) 691.992151ms ago: executing program 3 (id=2907): r0 = socket$kcm(0x2, 0x2, 0x0) (async, rerun: 32) r1 = socket$inet(0x2, 0x2, 0x1) (async, rerun: 32) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a09040000000000000000020000000900020073797a32000000000900010073797a30000000002c0004802800010907000100637400001c0002800800014000000013080002400000000505000300b6000000140000001100010000000000000000000000000a"], 0x80}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) (async, rerun: 32) sendmsg$inet(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)='\b\x00', 0x2}, {&(0x7f0000000340)="350000a2a2febf3459c215845f000000", 0x10}], 0x2, &(0x7f00000003c0)=[@ip_ttl={{0x14, 0x0, 0x2, 0x9}}], 0x18}, 0x24008004) (async, rerun: 32) setsockopt$sock_attach_bpf(r0, 0x1, 0x5, &(0x7f0000000180), 0x43) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r3, 0x0, 0x0) (async) unshare(0x24020400) (async) r4 = socket(0x11, 0x3, 0x0) bind$packet(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x88, r5, 0xd80db9843c980f11, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x45, 0x5b, "d60a70bfa3a65a46aa2171b373da4fa8eeb3f1218acbb132c1148d2190bda149c810b693db54b31bbfe356c659779f5a28a0a5645b915ec660fea940a457910a0a"}, @NL80211_ATTR_FRAME_MATCH={0x2b, 0x5b, "543d84f13d15abb72c79d1b7ee835577c462554bb90d02c481cd34a4e99b51ff63dae046018458"}]}, 0x88}, 0x1, 0x0, 0x0, 0x22004080}, 0x4094) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000880)={0x2, 0x4e1c, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32, @ANYBLOB="ac1414bb008000000000000038000000000000000000000007000000070e43aa5889c23ef593ae6bcd1844187c8073b5c9e00000000600000003000000080000000900001400000000000000000000000100000005000000000000001400000000000000000000000700000001000000000000001400000000000000000000000100000003000000000000001c000000000000000000000008"], 0xc0}, 0x0) 493.032419ms ago: executing program 1 (id=2908): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800003e88f6912cbcd37854b3298d0000000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x80000000, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000005000000020000000000000008000000", @ANYRES32=0x1, @ANYBLOB="0100"/13, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="040000000400"/28], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x80, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r3, 0x27, 0x14, 0x0, &(0x7f0000000000)="f8ad1dcc02cb29dcc80032008100", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r5 = socket$rxrpc(0x21, 0x2, 0x2) connect$rxrpc(r5, &(0x7f0000000780)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e22, 0x771d7490, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffffc}}, 0x24) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e24, 0x5, @loopback}, 0x5d) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x304}, "480ca6eda49ed6a6", "3a2cc8b276a753b0e23e2a8436b0e1d53d11b70c57abe2e932240e766d3aebfd", "a0eb068e", "e96e232f2004a832"}, 0x38) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r7, 0x0, 0x4, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYRES16=r0, @ANYRES16=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7040000000000008500000057"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000140)={r10, 0x288, 0x38d6, 0x1ff, 0x6}, 0x14) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000007c0)={r10, 0x2b, "0efffe25277c357428c3b0f6d0dc58c6a08f196d44985e38d1a662757ee0e1fbff42dc3483f1fee55cb604"}, &(0x7f0000000800)=0x33) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r8}, 0x18) sendmsg$NL80211_CMD_GET_WOWLAN(r4, &(0x7f0000000700)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000380)={0x28, 0x0, 0x800, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3c}, @void, @val={0xc, 0x99, {0x101, 0xe}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x22000085}, 0x4000008) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r11}, 0x18) r12 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r12, &(0x7f0000000140)={0x28, 0x0, 0x0, @host}, 0x10) 477.285821ms ago: executing program 3 (id=2909): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4008000) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a98000000060a0b040000000000000000020000006c000480680001800a000100696e6e65720000005800028008000240000000840800034000000007080004400000000f0800014000000000340005800c00015c7061794c6f61640024000280080004400000005608000340000000b9080001400000000a08000240000000040900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) 383.442528ms ago: executing program 1 (id=2910): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffff}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0f000000040000000800000001"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r1, &(0x7f0000000300), &(0x7f0000000040)=@udp6=r0}, 0x20) shutdown(r0, 0x0) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000d40)=""/4078, 0xfee}], 0x52}, 0x12100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xffe0}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x400}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffff}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0f000000040000000800000001"], 0x50) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r1, &(0x7f0000000300), &(0x7f0000000040)=@udp6=r0}, 0x20) (async) shutdown(r0, 0x0) (async) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000d40)=""/4078, 0xfee}], 0x52}, 0x12100) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x4, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xffe0}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x400}]}}]}, 0x3c}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) 264.394003ms ago: executing program 3 (id=2911): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0), &(0x7f0000000380), 0x1000fff, r0, 0x0, 0xa0028000}, 0x86) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, 0x0, 0x1) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='workqueue_queue_work\x00', r1, 0x0, 0x81200}, 0xcab89de138574654) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007112cc000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 131.420324ms ago: executing program 0 (id=2912): r0 = socket$kcm(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {}, [{0x78, 0x1, [@m_police={0x74, 0x1, 0x0, 0x0, {{0xb}, {0x48, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x10000000}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x20000000}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x8c}}, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="1400000035000b63717a3c4a01d8985b0808aa78", 0x14}], 0x1}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x2, [@func_proto={0x0, 0x4, 0x0, 0xd, 0xa, [{0xe, 0x9}, {0x4}, {0xe, 0x1}, {0x3, 0x5}]}]}}, &(0x7f0000000f40)=""/4089, 0x46, 0xff9, 0x1}, 0x28) write(r0, &(0x7f0000000100)="e9b07ed40f29a856b722261dbd08cefb10cc74d4db386b52b6ff7337437211d411d32e054c529fcbda5b720fefd85c12644f2bc5b30d8ff4c6e569adcd27516045d411b7c75491b0e5cd44f738cabf5956be1b2e7db9938171217b79f04629d3b7c569ffc20349266f9eb48f8565be5fb1ef48c7273232de9725eaacd46e5a47d5c90b01ceb8367c109647e29b81a55ab549a697db9bc6a413a14646df7bef6a12fdb35ea3aa87dbc2eadf995428d595b8eebaeaee9bc3894a661b", 0xbb) 42.949663ms ago: executing program 3 (id=2913): bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x15, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000711015000000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000001340)=ANY=[@ANYBLOB="ffffffffffff0180c200000186dd60122d9200283afffe80000000000000000000000000230c4c020000000000000000000000a7003a8900907800000000ff010000000000000000000000000001fe800000000000000000000000000013"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, [@alu={0x7, 0x0, 0x3, 0x0, 0x0, 0x1, 0x4}]}, &(0x7f00000005c0)='syzkaller\x00', 0x2}, 0x90) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="a24857a627efd839eabc1f4aaff25500914bae95d9b7ff5c3fc1245244a7e9b8d294742ea80e06a14bd5d2eb210aa6b09655fc95b69d135ac481cebf121d8c2b61eeb8ec701ae3b8ca1bfae60501649411e97f9df2c8972a5cceac6b4be7c6812fbe1706489cff66573fa551f1d5a367d5ce07e2870c5a16a3ad854cc82d802300a39b34fc0da599e01fa4c2a659d199a0c7cda4223f680729684a85e75c7cb6451f0f51fd0c8925a082736f7be1d24de7c662b04dd414674ef69b", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES64=r0, @ANYBLOB="0900000000000000000000bcf700001b00"/28], 0x48) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0x0, 0x5, 0x8}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r1, 0x58, &(0x7f0000000400)}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{&(0x7f0000000580)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, 0x0}, 0xa}, {{&(0x7f0000000d80)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, 0x80, 0x0}, 0x100}], 0x2, 0x2, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="16000000000000000100000006"], 0x48) bpf$MAP_DELETE_ELEM(0x15, &(0x7f0000000040)={r3, 0x0, 0x20000000}, 0x20) listen(r2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r2}, 0x20) sendmmsg$inet6(r2, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x1, &(0x7f0000000480)}}], 0x400, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r7, 0x890b, &(0x7f0000000000)={0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x1, 'syz1\x00', @bcast, 0xff, 0x8, [@bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmsg(r7, &(0x7f00000003c0)={&(0x7f0000000200)=@phonet={0x23, 0x1, 0x81, 0x40}, 0x80, 0x0}, 0x40041) ioctl$SIOCNRDECOBS(r7, 0x89e2) r8 = socket$unix(0x1, 0x2, 0x0) accept$unix(r8, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000800), r6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 1.666975ms ago: executing program 1 (id=2914): unshare(0x68040200) (async, rerun: 64) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000000000002800000005002e007f0000000a0001007770616e3000000005002b000200000053faa5da12076c76d3c31b73954be5707a6d7522e3e7197963a52f4bc4110893cb954167f21d0de224a2e7d3ca25330e6c8f8b6c81e8a2db5d61d9132b0e6478438c6d5d9c8c65139b036ebb05b4dd2dc90648f289d3cf2216c0490e"], 0x30}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) 0s ago: executing program 0 (id=2915): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca7f8fbc9cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b2cdf41dc10d1e8bf076d83923dd29c0301000000010000003d5d78c07fa1f7e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6e70af07da5ceb01b7551ef3bb622003b538dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0476619f28d99cde7a6b73340cc2160a1fe3c184b751c51160fbce841dfebd31a08b32808b80200000000009dd27080e71113610e10d8fb9c2aec61ce63a3462fd50117b89a9ab759b4eeb8cb000067d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0180aabc18cae2ed4b4390af9a9ceafd07ed0030000002cab154ad029a119ca3c972780870014605c83d7d11c3c975d5aec84222fff0d7216fdb0d3a0ec4bfae563858dc06e7c337642d3e5a815212f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a46939868d75211bbae0e7313bff5d4c391ddece00fc772dd6b4d4d0a917b239fe12280fc92c88c5b8dcdcc22ee1747790a8992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5cc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffff7f23877a6b24db0e067345560942fa629fbef2461c96a08707671215c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e42e50adab988dd8e12baf5cc9398c88607a08009c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859adfe38f77b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc874b2f663ddeef0005b3d96c7aae73835d5a3cda9e90d76c1993e0799d4894ee7f8249dc1e3428d2129369ee1b85afa1a5b6154eb2eea0d0df414b315f65112412392191fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7ade8a5b859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355a500587b603306a5af8d867d80a07f10d82eafb03062e95196d5e3ffea0000000000000be959096ea948cfa8e7194123e918914a71ad5a8521fb9553bc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c63ebb4380b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989177a1bcd1e30280bc586e79a5dd80701018e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fc03000000000000001547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5c759c3e5468f0000000011d415b6b085fb73a2c7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aac029d15af607ad83532ff181c985f54b39370c06e63055b4d6a36fa98a44e379d28307c9912fb097601f3f88a2ca6fd1f9320cfe7fc8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589c95d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd926891927a7267c47cf897853d160100b39b613faefe16bed1fc105dddd77ab929b837d4442d13d5a29179a00837918dd7854aa17eb9fbdc2bdc0e98ae2c3f23a6131e2879f04ff01000030b92dd493be66c2242f8184733b80ba28e8ffffff7f00000000bb2f89049c5f6d63d56995747639964217aacfe548bc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc17587641ed01889c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5d371c61f550e9d86aabda45706bda78ab60200000000000000000000000000000000000000706f78f0a2ea9667fb5b951808545a46830970c2dfae01adbda7d29bf1f7abdaf52e0de6f9d7150808ed086642e64ebf98762b34338b80e41b704c3eefaf0bb5ff070000000000000ea15ccc0d7a830b6eb33b6b61675511d693ef5e3c44bbf71cabc5f45c879e7499f8baae2a1a09cf38da73297764fbc0e723e1cc3abb12e3076982ed32c94a2ce3e6f37c47e983da4ca5c96187db5a2a2e1742bc93a65d7187126126b3a80f17dd2f7dbbe82d104ede9ba6925afc2ee6cb94f56f1363cad635abf8f983292c49c0ebf5005154c7b58a3a2a2ea86d2fd92b8661264f781e3fb02d05a28f3f17b64d0258853d45cb5ebde10cd3d82eeed2f1ed925b7cf400304932c5ed0a362b235ce37e1f17700f7d1fecf8be8a2c5d25a9c60657560d05441387ff158a018d19a286c58684a1d2f624c3eb59d509ee89cc2df52881d005b2e5c27563ba54e4153c132d0366aa660000000000000009c1aaec93ec0f925921fb2e9eb202a29bef28224dbabe723de5c584bc398a8792e493048c87f60a51a391e95921218149403558fd13c649f90b0911d57eeb298b590581eba1ce383b539ab80fd15445987b1bb4eb512545e1ab65fef3103ce10b1ee362b51c72f82edf2f502ddf52567775e34a56d1be892f1e62b08950d517fa6fb1b0ef2edf1b67f8644786116b037d4a36fdd30b000063e58c856ec44cbbc2d370553f832af9480215e09aaa3843fe360b1c293a14627f2cfbe278f31d0abc0f5aaa10926dbbfe8a4b131c13a73d4e6d065c2c0fed3ab8442520ce0e0ad7d2d177377ab197ace3ef8b1c24ceb0bdee84bd6e6317633938dd19dc42de7f8f860eca6d9c74525fcd3497526df4c13e3ba5f0d75365a4542ae9440d2fede416d618cdaaf7e038879c5d177b3876fda4121e00000100000000003edd3d43cc64e0d26b46907b42e08d000000000000903350932d3eef7fdada20c19807066e2c72d0d816eb9fa50be213bf6bbb7ccb9f2e8a153e6ced68f192ebed6e86af0f2cec7335fa8039fd6eb025440bc2a34d071f0a0e6774308a74748b8cd994ed368695aa2c5986aa9200a1306ffa5a71ca69e89a6980612b35fc858f37c2c398515a910a35e22ab0573c10b85df4c2972a2fb8b9c080fbb41a753791df727fdeaded2930376eda31312256191c620cce34d1e3bf40a4a207ab1575b399eb8155781bfc7cb5920b49c039935a888d77041894f60fbbcafa487ee96b368e8769da90b44190e569fe8b923c32c288baaca5c5558b5a78bb43e5d9e47a1d5809bb178184b5672d08e29aecf1f572ac1e6cab7e820751e95999b7532603494d37a2bff35a9eec46dfc8a52433f605ebf151c837b4966b5f3628a406175a87e32c5e4268d3000933b580415b162e2946446b8f02554c8a1225217d69d049685dd06aa8528673a9673a723ac414af77f523ad730d00e8700c213f95c87a94f39f506b9e000000000000000000000000000000000000000000000000000090668ac41a1c2a4f7831e6c6a3e9c68ca2c449482bb70a994e71a7f24873848fbb128c820c1de19cc003dfa65a2b296caeb1253802080e08eeb724c4c7b7e052afa19b0f2cd7a13bda4b5a8f3b8fa3ca70bb756a3d529718d5c79d9bdb89e5d33793533211d76d00a45079eff797476106bf76f1fed952a7c9162b88911b5b00c3d26fd2fb4d7b29d1ce025e102d458efd5cca3f3835ce760359eaa01cb13cb28d60e8942fdc02b6824c00dac62f8a2d4c680ae284a82f09d6641921536814b444e4188d9b2e97eb3b108e7876f0f3f3863147ab694218c7cecc075d52d590dddbb57fc6fedf5ec69d7894a7b5c8109f303dab998815c80534b0bd34c49eea63997e56728a8185a8bb6988a7197b87f5548f5edfdfb3efc907fe561b33a6f7c707f7828c6adaf3b2a39929b4b65253e787d65c08aff5e4a9b2267bd8f803ea38f10a6e9c4a49bf23525e08c12d229211fe4d88cf1440f29accfa50f327ac1fb20d7f164100111bd21fca713b2475f1c997f3000000000080c426bcec79c6bc83ce4e6cbb17c01be69db342192d0a716cc24710d23321441f475ec485d642b61c6bd907071dbbe37c0b78f60fd2ad0d13ca62d9d9aafb01c3920b64cb5e023810e2de4327f90c389ce36d90ff9f3cb9d8cd2260d05a8126943a3df17157470595c68ac8df7fea6d42ecb2cdb65b4f2aef0db2b2de949a6d4ec37f2fd693ae44944041a64fe6336aba1c66b1b95d2edbc40364a049616ae962d75eae619548aa86bd5f0bad56e7ad7de2ee5e6f3b42e3a27094b6b5face99456d9af1926b21d37faf7612d9752cf58e6424decd530b5419e117ec08647566b1bdd75d6a9a1e600aaf0f42ce94b4725d4c2da80150dc34e5975d6904f061ed9a7608959f2d24ee6ec4f2395d16e02f53c746f74b12013f738d76456c3407188eff97f31ca36e5d79e1f1c7c3b688ee21d37ba5ebf4afc2a61f16"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x55}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x3, 0x8, 0x1}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x3, 0x8, 0x1}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090000000000000000000000850000002a000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090000000000000000000000850000002a000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) socket$unix(0x1, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='sys_exit\x00', r1}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='sys_exit\x00', r1}, 0x10) syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="4dfa0e8929f856551e5ed16d619b0b009500000000000000080afcb5183a059484818868cd3165cc9bef17fd9e206abb7e172cfe3a01000000231530"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$netlink(0x10, 0x3, 0xb) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x48000) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000062102000100000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00]'], 0x54}, 0x1, 0x0, 0x0, 0x280608c0}, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) (async) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000580)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x2f, 0x0, "6248bc9c8095fdfb8d639d954a0649542709e9baf27860bd22292b501f2c28d45a71ec3fa8539e7223c278d70126314aca030d71da9dcb99d1d087f250685685db59cf6de9c2a0496da59a4fcf3d9ceb"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x0, 0x27, 0x0, "a58fc096f80633b333145c32b45013f5547000229e90bfdd2cbb775085438751fa41b217c492169b0cb51256adc3e5baedfa65fd3c4429b247e9dc51c16f89c5a42145bb09f23ab88b0bd564fd44893a"}, 0xd8) writev(r4, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001400add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) kernel console output (not intermixed with test programs): slave bond_slave_1): interface is now down [ 327.405144][ T9732] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 327.445546][ T9732] bond0: (slave bond_slave_0): interface is now down [ 327.479375][ T9732] bond0: (slave bond_slave_1): interface is now down [ 327.501401][T10356] netlink: 'syz.2.1149': attribute type 11 has an invalid length. [ 327.504869][ T9732] bond0: now running without any active interface! [ 327.533868][T10356] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1149'. [ 327.556900][T10361] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1151'. [ 327.580367][T10362] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1150'. [ 327.615013][T10356] netlink: 'syz.2.1149': attribute type 13 has an invalid length. [ 327.668478][T10367] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1149'. [ 328.929386][T10414] lo speed is unknown, defaulting to 1000 [ 329.052549][T10421] ip6tnl1: entered promiscuous mode [ 329.996124][T10453] lo speed is unknown, defaulting to 1000 [ 330.014472][T10459] sctp: [Deprecated]: syz.3.1175 (pid 10459) Use of struct sctp_assoc_value in delayed_ack socket option. [ 330.014472][T10459] Use struct sctp_sack_info instead [ 330.281015][T10474] ieee802154 phy1 wpan1: encryption failed: -22 [ 331.359802][T10527] syzkaller0: entered promiscuous mode [ 331.369779][T10528] netlink: 'syz.3.1193': attribute type 1 has an invalid length. [ 331.382776][T10527] syzkaller0: entered allmulticast mode [ 331.395809][T10528] __nla_validate_parse: 73 callbacks suppressed [ 331.395824][T10528] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1193'. [ 331.856887][T10541] bond0: (slave bond_slave_0): Releasing backup interface [ 331.892390][T10541] bond0: (slave bond_slave_1): Releasing backup interface [ 331.918620][T10541] team0: Port device team_slave_0 removed [ 331.941178][T10541] team0: Port device team_slave_1 removed [ 331.948583][T10541] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 331.968033][T10541] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 331.989287][T10563] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1203'. [ 332.007958][T10541] batman_adv: batadv0: Removing interface: gretap1 [ 332.027183][T10541] bond1: (slave batadv1): Releasing active interface [ 332.052374][T10541] batman_adv: batadv0: Interface deactivated: gretap3 [ 332.071481][T10541] batman_adv: batadv0: Removing interface: gretap3 [ 332.109562][T10552] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 332.149791][T10553] 8021q: adding VLAN 0 to HW filter on device bond2 [ 332.159765][T10553] bond0: (slave bond2): Enslaving as an active interface with an up link [ 332.229354][T10569] macsec1: entered promiscuous mode [ 332.243055][T10569] macsec1: entered allmulticast mode [ 332.287740][T10569] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1207'. [ 332.358659][T10577] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1209'. [ 332.368456][T10579] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1210'. [ 332.368578][T10572] netlink: 192 bytes leftover after parsing attributes in process `syz.0.1208'. [ 332.394123][T10572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1208'. [ 332.455651][T10580] netlink: 'syz.0.1208': attribute type 2 has an invalid length. [ 332.560505][T10575] lo speed is unknown, defaulting to 1000 [ 332.605785][T10589] netlink: 'syz.4.1211': attribute type 12 has an invalid length. [ 332.635651][T10589] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1211'. [ 332.702851][T10592] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1213'. [ 332.765055][T10594] Unsupported ieee802154 address type: 0 [ 332.928936][T10599] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1214'. [ 333.022661][T10589] lo speed is unknown, defaulting to 1000 [ 333.670520][T10623] IPv6: sit1: Disabled Multicast RS [ 334.012713][T10641] netlink: 'syz.3.1226': attribute type 1 has an invalid length. [ 334.078895][T10641] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 334.288949][T10654] erspan0: entered promiscuous mode [ 334.812767][T10678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 335.293557][T10687] delete_channel: no stack [ 335.342154][T10694] IPv4: Oversized IP packet from 127.202.26.0 [ 335.415135][T10701] syzkaller0: entered promiscuous mode [ 335.420664][T10701] syzkaller0: entered allmulticast mode [ 335.955456][T10736] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 336.475363][T10777] __nla_validate_parse: 10 callbacks suppressed [ 336.475383][T10777] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1262'. [ 336.499300][T10774] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1261'. [ 336.511221][T10774] gre0: entered allmulticast mode [ 336.638022][T10788] netlink: 'syz.4.1265': attribute type 4 has an invalid length. [ 336.683452][T10788] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1265'. [ 336.766746][T10800] tipc: Enabled bearer , priority 0 [ 336.801994][T10801] tipc: Resetting bearer [ 336.854111][T10797] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1267'. [ 336.913425][T10804] lo speed is unknown, defaulting to 1000 [ 336.942294][T10813] netlink: 'syz.2.1269': attribute type 21 has an invalid length. [ 336.968524][T10813] netlink: 'syz.2.1269': attribute type 6 has an invalid length. [ 337.025384][T10813] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1269'. [ 337.080731][T10817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1269'. [ 337.202125][T10813] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1269'. [ 337.372533][T10840] 8021q: VLANs not supported on ip6gre0 [ 337.474650][T10841] 8021q: VLANs not supported on ip6gre0 [ 337.672515][T10855] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 337.833233][T10858] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1284'. [ 338.224740][T10874] netlink: 'syz.0.1288': attribute type 1 has an invalid length. [ 338.421067][T10883] veth0: entered promiscuous mode [ 338.484290][T10887] veth1_to_team: entered allmulticast mode [ 338.490921][T10885] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1293'. [ 338.506730][T10885] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1293'. [ 338.518452][T10890] netlink: 'syz.0.1292': attribute type 13 has an invalid length. [ 338.749372][T10890] tipc: Resetting bearer [ 338.757552][T10890] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 338.790087][ T9734] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 338.831479][ T9734] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 338.870598][ T9729] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 338.897586][T10901] lo speed is unknown, defaulting to 1000 [ 339.053744][ T9729] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.145862][T10906] netlink: 'syz.2.1297': attribute type 1 has an invalid length. [ 339.213135][T10906] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 339.228943][T10906] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 339.252102][T10882] veth0: left promiscuous mode [ 339.278647][T10918] gretap4: entered promiscuous mode [ 339.308400][T10918] bond2: (slave gretap4): making interface the new active one [ 339.335704][T10918] bond2: (slave gretap4): Enslaving as an active interface with an up link [ 339.502044][T10935] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 340.735154][T10994] bond0: (slave bond_slave_1): Releasing backup interface [ 340.859108][T11004] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 341.051294][T11010] geneve2: entered promiscuous mode [ 341.059036][ T9728] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.088227][ T9725] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.107981][ T9725] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.120899][T11014] vlan0: entered promiscuous mode [ 341.130254][ T9725] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.574910][T11044] __nla_validate_parse: 2 callbacks suppressed [ 341.574927][T11044] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1332'. [ 341.594770][T11045] netlink: 'syz.4.1330': attribute type 12 has an invalid length. [ 341.602605][T11045] netlink: 9472 bytes leftover after parsing attributes in process `syz.4.1330'. [ 341.736544][T11058] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 341.815586][T11060] bridge5: entered promiscuous mode [ 341.837161][T11056] netlink: 'syz.0.1331': attribute type 1 has an invalid length. [ 342.134619][T11080] netlink: 26 bytes leftover after parsing attributes in process `syz.2.1337'. [ 342.175909][T11081] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 342.438952][T11088] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1342'. [ 342.704484][T11091] lo speed is unknown, defaulting to 1000 [ 342.799790][T11108] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1346'. [ 342.876016][T11108] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1346'. [ 343.163398][T11120] veth0: entered promiscuous mode [ 343.183568][T11120] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1349'. [ 343.226811][T11120] veth0 (unregistering): left promiscuous mode [ 343.244441][T11124] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1351'. [ 343.439578][T11129] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1352'. [ 343.513730][T11114] lo speed is unknown, defaulting to 1000 [ 343.518493][T11131] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1353'. [ 343.561366][T11131] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 343.746125][T11140] bridge0: port 3(dummy0) entered disabled state [ 343.770772][T11145] netlink: 'syz.4.1356': attribute type 13 has an invalid length. [ 343.820900][T11145] netlink: 'syz.4.1356': attribute type 17 has an invalid length. [ 343.877903][ T5930] lo speed is unknown, defaulting to 1000 [ 343.899927][ T5930] syz0: Port: 1 Link DOWN [ 343.929311][T11145] 0ªî{X¹¦: left allmulticast mode [ 344.047623][T11145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.061393][T11145] 8021q: adding VLAN 0 to HW filter on device team0 [ 344.086640][T11145] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 344.212484][ T5923] lo speed is unknown, defaulting to 1000 [ 344.833838][T11167] veth0_to_bridge: entered promiscuous mode [ 345.252843][T11166] veth0_to_bridge: left promiscuous mode [ 345.254838][T11180] netlink: 'syz.1.1366': attribute type 3 has an invalid length. [ 345.349221][T11182] tipc: Enabled bearer , priority 0 [ 345.376397][T11182] syzkaller0: entered promiscuous mode [ 345.381911][T11182] syzkaller0: entered allmulticast mode [ 345.411373][T11182] tipc: Resetting bearer [ 345.452933][T11182] tipc: Disabling bearer [ 345.801289][T11209] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 346.234600][T11203] batadv1: left allmulticast mode [ 346.326887][T11203] gretap4: left promiscuous mode [ 346.346693][T11203] geneve2: left promiscuous mode [ 346.384552][T11210] hsr_slave_0: left promiscuous mode [ 346.418121][T11210] hsr_slave_1: left promiscuous mode [ 346.471220][ T13] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.480424][ T13] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.501698][ T13] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.510884][ T13] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.633798][T11227] pimreg: entered allmulticast mode [ 346.679814][T11229] __nla_validate_parse: 7 callbacks suppressed [ 346.679832][T11229] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1381'. [ 346.892381][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 346.901483][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 346.911524][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 346.924275][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 346.946806][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 346.955799][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 346.963828][T11243] netlink: 'syz.2.1385': attribute type 3 has an invalid length. [ 347.059328][T11251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1389'. [ 347.069809][T11254] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1388'. [ 347.194647][T11258] lo speed is unknown, defaulting to 1000 [ 347.428364][T11269] tipc: Enabled bearer , priority 0 [ 347.436298][T11269] syzkaller0: entered promiscuous mode [ 347.441815][T11269] syzkaller0: entered allmulticast mode [ 347.452796][T11269] tipc: Resetting bearer [ 347.465702][T11268] tipc: Resetting bearer [ 347.485761][T11272] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1394'. [ 347.502682][T11268] tipc: Disabling bearer [ 347.623167][T11264] lo speed is unknown, defaulting to 1000 [ 347.721019][T11278] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1397'. [ 348.121645][T11301] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 348.587980][T11313] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1405'. [ 348.616041][T11314] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1407'. [ 348.648083][T11313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1405'. [ 348.921683][T11324] lo speed is unknown, defaulting to 1000 [ 349.265621][T11337] tap0: tun_chr_ioctl cmd 1074025677 [ 349.271133][T11337] tap0: linktype set to 0 [ 349.346225][T11341] tap1: tun_chr_ioctl cmd 1074025677 [ 349.352728][T11341] tap1: linktype set to 776 [ 349.839342][T11366] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1421'. [ 350.106614][T11382] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1428'. [ 350.154384][T11382] 8021q: VLANs not supported on ip6gre0 [ 350.792760][T11425] validate_nla: 27 callbacks suppressed [ 350.792781][T11425] netlink: 'syz.3.1441': attribute type 1 has an invalid length. [ 350.837657][T11423] netlink: 'syz.3.1441': attribute type 1 has an invalid length. [ 351.195915][T11453] netlink: 'syz.4.1445': attribute type 23 has an invalid length. [ 351.276563][T11458] netlink: 'syz.3.1448': attribute type 29 has an invalid length. [ 351.368649][T11463] tipc: Enabled bearer , priority 0 [ 351.386123][T11463] syzkaller0: entered promiscuous mode [ 351.391794][T11463] syzkaller0: entered allmulticast mode [ 351.441337][T11470] netlink: 'syz.2.1450': attribute type 16 has an invalid length. [ 351.449964][T11470] netlink: 'syz.2.1450': attribute type 17 has an invalid length. [ 351.451019][T11463] tipc: Resetting bearer [ 351.503518][T11470] erspan0: left promiscuous mode [ 351.545826][T11470] 8021q: adding VLAN 0 to HW filter on device bond0 [ 351.554185][T11470] 8021q: adding VLAN 0 to HW filter on device team0 [ 351.574553][T11470] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 351.607097][T11462] tipc: Resetting bearer [ 351.645540][T11462] tipc: Disabling bearer [ 351.892398][T11487] __nla_validate_parse: 5 callbacks suppressed [ 351.892421][T11487] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1455'. [ 351.939734][T11487] netlink: 108 bytes leftover after parsing attributes in process `syz.1.1455'. [ 351.964403][T11487] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1455'. [ 352.012860][T11496] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 352.653595][T11525] veth5: entered promiscuous mode [ 352.689363][T11538] tipc: Enabling of bearer rejected, failed to enable media [ 352.775377][T11533] netlink: 'syz.2.1467': attribute type 14 has an invalid length. [ 352.882708][T11545] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1470'. [ 352.895791][T11538] syzkaller0: entered promiscuous mode [ 352.901301][T11538] syzkaller0: entered allmulticast mode [ 353.311300][ T30] audit: type=1800 audit(1755607116.257:4): pid=11571 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1476" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=1772 res=0 errno=0 [ 353.361586][ T30] audit: type=1800 audit(1755607116.257:5): pid=11570 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1476" name=5D80CEFF4AA6DC5F710E8DF1F7582C892AF8D26C5BD9C07CAA9E7DED20F3F5CE5E3A882A02450DCF19 dev="tmpfs" ino=1772 res=0 errno=0 [ 353.639160][T11582] syzkaller0: entered promiscuous mode [ 353.650140][T11582] syzkaller0: entered allmulticast mode [ 353.711070][T11590] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1480'. [ 353.711070][T11588] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1480'. [ 355.821957][T11646] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 355.874811][T11647] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 356.088095][T11662] lo speed is unknown, defaulting to 1000 [ 356.208913][T11667] vlan2: entered allmulticast mode [ 356.521292][T11688] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1503'. [ 356.562885][ T30] audit: type=1800 audit(1755607119.507:6): pid=11687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1503" name="blkio.bfq.io_queued_recursive" dev="tmpfs" ino=1668 res=0 errno=0 [ 356.596263][T11691] tun0: tun_chr_ioctl cmd 2148553947 [ 356.658614][T11692] IPVS: set_ctl: invalid protocol: 33 224.0.0.1:20004 [ 356.910741][T11711] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1508'. [ 356.934791][T11711] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1508'. [ 356.954568][T11711] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1508'. [ 356.975237][T11711] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1508'. [ 357.381928][T11739] tipc: Enabling of bearer rejected, already enabled [ 357.441987][T11746] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1516'. [ 357.490874][T11750] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1517'. [ 357.625304][T11759] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1519'. [ 357.888499][T11767] netlink: 'syz.4.1523': attribute type 1 has an invalid length. [ 357.896380][T11767] netlink: 'syz.4.1523': attribute type 2 has an invalid length. [ 357.908812][T11768] netlink: 'syz.4.1523': attribute type 1 has an invalid length. [ 357.919078][T11768] netlink: 'syz.4.1523': attribute type 2 has an invalid length. [ 358.026733][T11771] tipc: Enabled bearer , priority 0 [ 358.148445][T11771] syzkaller0: entered promiscuous mode [ 358.159794][T11771] syzkaller0: entered allmulticast mode [ 358.168783][T11771] tipc: Resetting bearer [ 358.219643][T11771] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 358.828540][ T9985] tipc: Resetting bearer [ 358.847387][T11770] tipc: Resetting bearer [ 359.301768][T11828] netlink: 604 bytes leftover after parsing attributes in process `syz.3.1535'. [ 360.212248][T11770] tipc: Disabling bearer [ 360.221784][T11813] smc: net device bond0 applied user defined pnetid SYZ2 [ 360.255621][T11826] netlink: 'syz.3.1535': attribute type 29 has an invalid length. [ 360.425882][T11831] netlink: 'syz.0.1537': attribute type 10 has an invalid length. [ 360.444899][T11834] IPVS: length: 212 != 24 [ 360.464727][T11831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 360.503496][T11831] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 360.533526][T11839] batadv_slave_0: entered promiscuous mode [ 360.671032][T11838] lo speed is unknown, defaulting to 1000 [ 361.779281][T11840] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1540'. [ 361.851296][T11876] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1540'. [ 361.880508][T11876] netlink: 'syz.3.1540': attribute type 13 has an invalid length. [ 361.903969][T11876] netlink: 'syz.3.1540': attribute type 17 has an invalid length. [ 362.020420][T11885] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1552'. [ 362.149008][T11876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 362.194798][T11891] netlink: 'syz.1.1553': attribute type 1 has an invalid length. [ 362.278228][T11876] 8021q: adding VLAN 0 to HW filter on device team0 [ 362.288479][T11876] bridge0: port 3(dummy0) entered blocking state [ 362.295137][T11876] bridge0: port 3(dummy0) entered forwarding state [ 362.305429][T11876] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 362.322039][ T9] lo speed is unknown, defaulting to 1000 [ 362.334321][ T9] syz0: Port: 1 Link ACTIVE [ 362.340035][T11888] netlink: 'syz.1.1553': attribute type 1 has an invalid length. [ 362.355055][T11854] lo speed is unknown, defaulting to 1000 [ 362.371750][ T5984] lo speed is unknown, defaulting to 1000 [ 362.826050][T11915] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1558'. [ 362.955308][T11926] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1561'. [ 362.960349][T11925] gtp1: entered promiscuous mode [ 363.295496][T11937] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1564'. [ 363.648521][T11947] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 363.659249][T11948] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 363.820398][T11952] lo speed is unknown, defaulting to 1000 [ 363.833690][T11954] netlink: 'syz.1.1568': attribute type 1 has an invalid length. [ 363.999318][T11964] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1568'. [ 364.030944][T11969] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 364.173309][T11954] 8021q: adding VLAN 0 to HW filter on device bond2 [ 364.236836][T11958] bond2: (slave ip6gretap1): making interface the new active one [ 364.252542][T11958] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 364.261856][T11959] netlink: 'syz.4.1569': attribute type 12 has an invalid length. [ 364.303491][T11961] veth7: entered promiscuous mode [ 364.313263][T11961] bond2: (slave veth7): Enslaving as an active interface with a down link [ 364.679354][T11993] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1577'. [ 364.775292][T12001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1580'. [ 364.923914][T12004] syzkaller0: entered promiscuous mode [ 364.939524][T12004] syzkaller0: entered allmulticast mode [ 365.116691][T12012] netlink: 277 bytes leftover after parsing attributes in process `syz.0.1581'. [ 365.145579][T12015] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1582'. [ 365.288745][T12015] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 365.685715][T12030] lo speed is unknown, defaulting to 1000 [ 365.708111][T12041] netlink: 'syz.1.1587': attribute type 3 has an invalid length. [ 366.172887][T12065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1591'. [ 366.212570][T12068] (unnamed net_device) (uninitialized): option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 366.336539][T12070] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 366.393237][T12070] netlink: 'syz.3.1591': attribute type 10 has an invalid length. [ 366.422429][T12070] bridge0: port 3(dummy0) entered disabled state [ 366.469674][T12070] bridge0: port 3(dummy0) entered blocking state [ 366.476264][T12070] bridge0: port 3(dummy0) entered forwarding state [ 366.501327][T12070] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 366.510375][ T9984] bond0: (slave bridge0): interface is now down [ 366.534365][ T9984] bond0: (slave bridge0): interface is now down [ 366.560548][ T9984] bond0: (slave bridge0): interface is now down [ 366.605209][ T9725] bond0: (slave bridge0): interface is now down [ 366.624131][ T9984] bond0: (slave bridge0): interface is now down [ 366.646354][ T9725] bond0: (slave bridge0): interface is now down [ 366.657891][T12084] syz.1.1595 uses old SIOCAX25GETINFO [ 366.663726][ T9725] bond0: now running without any active interface! [ 367.071753][T12098] tipc: Enabled bearer , priority 0 [ 367.134814][T12102] veth1_macvtap: left promiscuous mode [ 367.162325][T12102] tipc: Resetting bearer [ 367.205388][T12103] lo speed is unknown, defaulting to 1000 [ 367.222184][T12105] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1604'. [ 367.232089][T12105] netlink: 15 bytes leftover after parsing attributes in process `syz.2.1604'. [ 367.515882][T12114] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1608'. [ 367.616971][T12116] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 367.704631][T12114] netlink: 'syz.2.1608': attribute type 10 has an invalid length. [ 367.720411][T12114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1608'. [ 367.892163][T12098] tipc: Disabling bearer [ 368.371099][T12123] sit0: entered promiscuous mode [ 368.389324][T12123] netlink: 'syz.1.1610': attribute type 1 has an invalid length. [ 368.397682][T12123] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1610'. [ 368.434706][T12125] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1609'. [ 368.530061][T12128] tipc: Failed to remove unknown binding: 66,1,1/2886997007:85635265/85635267 [ 368.556637][T12128] tipc: Failed to remove unknown binding: 66,1,1/2886997007:85635265/85635267 [ 368.566191][T12128] tipc: Failed to remove unknown binding: 66,1,1/2886997007:85635265/85635267 [ 368.587592][T12135] netlink: 'syz.4.1613': attribute type 11 has an invalid length. [ 369.051529][T12157] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1619'. [ 369.111035][T12160] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1621'. [ 369.204363][T12160] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 369.250642][T12160] netlink: 'syz.0.1621': attribute type 10 has an invalid length. [ 369.270020][T12160] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1621'. [ 369.280018][T12168] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1624'. [ 369.312346][T12169] vlan3: entered promiscuous mode [ 369.317619][T12169] geneve0: entered promiscuous mode [ 369.416453][T12171] netlink: 'syz.2.1625': attribute type 1 has an invalid length. [ 369.465401][T12171] netlink: 'syz.2.1625': attribute type 1 has an invalid length. [ 369.507367][T12171] netlink: 'syz.2.1625': attribute type 1 has an invalid length. [ 369.589570][T12182] netdevsim netdevsim3: Direct firmware load for failed with error -2 [ 369.628862][T12182] netdevsim netdevsim3: Falling back to sysfs fallback for: [ 369.732290][T12190] lo speed is unknown, defaulting to 1000 [ 369.772698][T12196] Bluetooth: MGMT ver 1.23 [ 369.935582][T12201] netlink: 'syz.1.1634': attribute type 1 has an invalid length. [ 369.944779][T12201] block nbd0: Unsupported socket: shutdown callout must be supported. [ 369.995846][T12201] : entered promiscuous mode [ 370.266249][T12198] lo speed is unknown, defaulting to 1000 [ 370.559784][T12226] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 371.048645][T12238] netlink: 'syz.3.1645': attribute type 13 has an invalid length. [ 371.375944][T12248] team0: entered promiscuous mode [ 371.603341][T12255] team0 (unregistering): left promiscuous mode [ 371.691237][T12253] bond2: (slave gretap4): Releasing active interface [ 371.782352][T12270] lo speed is unknown, defaulting to 1000 [ 371.844003][ T5182] Bluetooth: hci2: command 0x0406 tx timeout [ 371.850177][ T5868] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 372.149477][T12290] bond0: option arp_validate: invalid value (18446744073491447809) [ 372.162936][ T9984] bond0: (slave bond_slave_0): interface is now down [ 372.215546][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.269274][ T9984] bond0: (slave bond_slave_0): interface is now down [ 372.287820][T12296] C: renamed from team_slave_0 [ 372.304470][ T9984] bond0: (slave bond_slave_0): interface is now down [ 372.329394][ T30] audit: type=1804 audit(1755607135.277:7): pid=12295 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1658" name="/newroot/288/cgroup.controllers" dev="tmpfs" ino=1504 res=1 errno=0 [ 372.334483][ T9984] bond0: (slave bond_slave_0): interface is now down [ 372.364311][ T30] audit: type=1800 audit(1755607135.277:8): pid=12295 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1658" name="cgroup.controllers" dev="tmpfs" ino=1504 res=0 errno=0 [ 372.387238][ T9985] bond0: (slave bond_slave_0): interface is now down [ 372.391648][T12305] __nla_validate_parse: 7 callbacks suppressed [ 372.391665][T12305] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1660'. [ 372.411224][ T30] audit: type=1800 audit(1755607135.277:9): pid=12302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1658" name="cgroup.controllers" dev="tmpfs" ino=1504 res=0 errno=0 [ 372.434719][ T9729] bond0: (slave bond_slave_0): interface is now down [ 372.454838][ T9734] bond0: (slave bond_slave_0): interface is now down [ 372.487885][ T9729] bond0: (slave bond_slave_0): interface is now down [ 372.515600][ T9729] bond0: (slave bond_slave_0): interface is now down [ 372.549897][ T9985] bond0: (slave bond_slave_0): interface is now down [ 372.574338][ T9984] bond0: (slave bond_slave_0): interface is now down [ 372.597668][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.628823][ T9985] bond0: (slave bond_slave_0): interface is now down [ 372.655092][ T9985] bond0: (slave bond_slave_0): interface is now down [ 372.674012][ T9729] bond0: (slave bond_slave_0): interface is now down [ 372.694391][ T9985] bond0: (slave bond_slave_0): interface is now down [ 372.714136][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.736788][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.764252][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.794119][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.815250][ T9729] bond0: (slave bond_slave_0): interface is now down [ 372.849175][ T9729] bond0: (slave bond_slave_0): interface is now down [ 372.874545][T12296] netlink: 'syz.2.1658': attribute type 1 has an invalid length. [ 372.882301][T12296] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1658'. [ 372.904003][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.944016][T12296] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 372.959637][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.968732][T12295] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1658'. [ 372.984217][ T1145] bond0: (slave bond_slave_0): interface is now down [ 372.992101][T12295] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1658'. [ 373.014172][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.033976][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.055066][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.091157][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.135862][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.164130][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.194816][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.214116][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.234375][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.262744][ T9729] bond0: (slave bond_slave_0): interface is now down [ 373.284988][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.304056][ T1145] bond0: (slave bond_slave_0): interface is now down [ 373.335088][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.365487][ T1145] bond0: (slave bond_slave_0): interface is now down [ 373.404771][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.444670][ T1145] bond0: (slave bond_slave_0): interface is now down [ 373.493749][ T9985] bond0: (slave bond_slave_0): interface is now down [ 373.555607][ T9985] bond0: now running without any active interface! [ 373.632490][T12326] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1668'. [ 373.680554][T12326] bridge_slave_1: left allmulticast mode [ 373.692637][T12326] bridge_slave_1: left promiscuous mode [ 373.710725][T12326] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.790601][T12326] ¾x9ÿ: left allmulticast mode [ 373.812218][T12326] ¾x9ÿ: left promiscuous mode [ 373.830351][T12335] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1670'. [ 373.835410][T12326] bridge0: port 1(1¾x9ÿ) entered disabled state [ 374.141600][T12335] netlink: 'syz.3.1670': attribute type 4 has an invalid length. [ 374.203009][T12336] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1680'. [ 374.214404][T12336] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1680'. [ 374.333939][T12345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1672'. [ 374.489410][T12355] netlink: 'syz.3.1675': attribute type 6 has an invalid length. [ 374.546779][T12359] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1676'. [ 374.762481][T12368] bond0: (slave batadv0): Releasing backup interface [ 374.803021][T12368] bond0: (slave wlan1): Releasing backup interface [ 374.822737][T12368] bond0: (slave wlan1): the permanent HWaddr of slave - 08:02:11:00:00:01 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 374.847216][T12368] batman_adv: batadv0: Removing interface: gretap1 [ 374.859007][T12368] batman_adv: batadv0: Removing interface: ip6gretap1 [ 374.872036][T12368] bond0: (slave bond2): Releasing backup interface [ 375.608218][T12402] bridge0: port 1(veth3) entered blocking state [ 375.616192][T12402] bridge0: port 1(veth3) entered disabled state [ 375.622764][T12402] veth3: entered allmulticast mode [ 375.650182][T12402] veth3: entered promiscuous mode [ 375.691450][T12409] bridge0: port 2(veth0_to_bond) entered blocking state [ 375.698860][T12409] bridge0: port 2(veth0_to_bond) entered disabled state [ 375.745819][T12412] netlink: 'syz.3.1689': attribute type 10 has an invalid length. [ 375.753685][T12412] netlink: 'syz.3.1689': attribute type 49 has an invalid length. [ 375.756006][T12409] veth0_to_bond: entered allmulticast mode [ 375.780190][T12409] veth0_to_bond: entered promiscuous mode [ 375.879730][T12409] vlan2: entered allmulticast mode [ 375.893755][T12409] veth1: entered allmulticast mode [ 375.909091][T12415] netlink: 'syz.1.1691': attribute type 12 has an invalid length. [ 376.783749][T12434] lo speed is unknown, defaulting to 1000 [ 377.239581][T12455] tipc: Enabled bearer , priority 0 [ 377.264820][T12455] syzkaller0: entered promiscuous mode [ 377.276726][T12455] syzkaller0: entered allmulticast mode [ 377.343148][T12455] tipc: Resetting bearer [ 377.418676][T12454] tipc: Resetting bearer [ 377.582334][T12454] tipc: Disabling bearer [ 377.875160][T12483] __nla_validate_parse: 14 callbacks suppressed [ 377.875179][T12483] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1710'. [ 378.018686][T12493] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 378.099886][T12497] IPVS: Error connecting to the multicast addr [ 378.406143][T12511] lo speed is unknown, defaulting to 1000 [ 378.577359][T12514] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1717'. [ 378.586390][T12515] tipc: Enabled bearer , priority 0 [ 378.587037][T12516] syzkaller0: entered promiscuous mode [ 378.599695][T12516] syzkaller0: entered allmulticast mode [ 378.643050][T12516] tipc: Resetting bearer [ 378.673417][T12514] veth0_to_bond: left allmulticast mode [ 378.679503][T12516] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1727'. [ 378.691442][T12514] veth0_to_bond: left promiscuous mode [ 378.700884][T12514] bridge0: port 2(veth0_to_bond) entered disabled state [ 378.720392][T12514] bond0: (slave bond_slave_0): Releasing backup interface [ 378.739732][T12514] team0: Port device team_slave_0 removed [ 378.748606][T12514] team0: Port device team_slave_1 removed [ 378.757944][T12514] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 378.769308][T12514] team0: Port device bond3 removed [ 378.776553][T12514] veth3: left allmulticast mode [ 378.781418][T12514] veth3: left promiscuous mode [ 378.786957][T12514] bridge0: port 1(veth3) entered disabled state [ 378.900723][T12517] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1727'. [ 379.030411][T12512] tipc: Resetting bearer [ 379.122796][T12512] tipc: Disabling bearer [ 379.150106][T12524] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1721'. [ 379.160967][T12524] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1721'. [ 379.382070][T12537] tipc: Enabling of bearer rejected, failed to enable media [ 379.570827][T12550] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1726'. [ 379.671345][T12550] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1726'. [ 379.724056][T12550] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1726'. [ 379.968160][T12570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1730'. [ 380.109124][T12568] lo speed is unknown, defaulting to 1000 [ 380.667974][T12572] lo speed is unknown, defaulting to 1000 [ 380.750233][T12583] Bluetooth: MGMT ver 1.23 [ 381.639774][T12580] lo speed is unknown, defaulting to 1000 [ 382.224835][T12627] tipc: Enabling of bearer rejected, already enabled [ 382.755647][T12642] netlink: 'syz.3.1752': attribute type 83 has an invalid length. [ 382.938994][T12655] tipc: Enabled bearer , priority 0 [ 382.963696][T12651] syzkaller0: entered promiscuous mode [ 382.979771][T12651] syzkaller0: entered allmulticast mode [ 382.990059][T12651] __nla_validate_parse: 3 callbacks suppressed [ 382.990074][T12651] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1755'. [ 383.055808][T12653] tipc: Resetting bearer [ 383.100222][T12649] tipc: Resetting bearer [ 383.150640][T12649] tipc: Disabling bearer [ 383.471726][T12677] bridge9: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 383.635253][T12684] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1762'. [ 383.638190][T12689] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1761'. [ 383.827390][T12699] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1764'. [ 384.260276][T12710] tipc: Enabled bearer , priority 0 [ 384.269201][T12710] syzkaller0: entered promiscuous mode [ 384.274838][T12710] syzkaller0: entered allmulticast mode [ 384.313500][T12710] tipc: Resetting bearer [ 384.322184][T12709] tipc: Resetting bearer [ 384.351166][T12709] tipc: Disabling bearer [ 384.793291][T12715] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 384.976615][T12749] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1776'. [ 385.294213][T12765] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1780'. [ 385.510937][T12775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1782'. [ 385.769116][T12786] netlink: 'syz.2.1784': attribute type 1 has an invalid length. [ 385.796392][T12786] netlink: 228 bytes leftover after parsing attributes in process `syz.2.1784'. [ 385.882273][T12796] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1785'. [ 386.027823][T12802] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1789'. [ 386.065241][T12804] dvmrp1: entered allmulticast mode [ 386.103266][T12804] dvmrp1: left allmulticast mode [ 386.310993][T12816] tipc: Enabled bearer , priority 0 [ 386.340589][T12816] syzkaller0: entered promiscuous mode [ 386.367281][T12816] syzkaller0: entered allmulticast mode [ 386.388373][T12824] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 386.397855][T12824] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 386.513742][T12824] netlink: 'syz.3.1794': attribute type 13 has an invalid length. [ 386.531454][T12824] netlink: 'syz.3.1794': attribute type 17 has an invalid length. [ 386.562582][T12816] tipc: Resetting bearer [ 386.594533][T12824] netlink: 'syz.3.1794': attribute type 27 has an invalid length. [ 386.679033][T12815] tipc: Resetting bearer [ 386.746456][T12815] tipc: Disabling bearer [ 386.803720][T12847] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 387.065296][T12859] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 387.112744][T12859] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 387.138951][T12859] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 387.252915][T12867] netlink: 'syz.4.1806': attribute type 1 has an invalid length. [ 387.305476][T12867] 8021q: adding VLAN 0 to HW filter on device bond5 [ 387.358503][T12871] bond5: (slave gretap0): making interface the new active one [ 387.367700][T12871] bond5: (slave gretap0): Enslaving as an active interface with an up link [ 387.522721][T12886] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 387.530075][T12886] IPv6: NLM_F_CREATE should be set when creating new route [ 387.537345][T12886] IPv6: NLM_F_CREATE should be set when creating new route [ 387.576981][T12887] lo speed is unknown, defaulting to 1000 [ 387.768154][T12893] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 388.119919][T12903] IPVS: set_ctl: invalid protocol: 58 224.0.0.1:20000 [ 388.358395][T12909] __nla_validate_parse: 3 callbacks suppressed [ 388.358415][T12909] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1817'. [ 388.419137][T12911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1819'. [ 388.692695][T12914] lo speed is unknown, defaulting to 1000 [ 389.050863][T12931] netlink: 'syz.1.1824': attribute type 9 has an invalid length. [ 389.070366][T12929] IPv6: sit2: Disabled Multicast RS [ 389.387027][T12936] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1820'. [ 389.426208][T12936] netlink: 'syz.2.1820': attribute type 13 has an invalid length. [ 389.450864][T12936] netlink: 'syz.2.1820': attribute type 17 has an invalid length. [ 389.515041][T12939] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1828'. [ 389.552678][T12936] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 389.635493][T12955] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1829'. [ 389.737042][T12955] netlink: 'syz.3.1829': attribute type 1 has an invalid length. [ 389.756433][T12955] netlink: 5624 bytes leftover after parsing attributes in process `syz.3.1829'. [ 389.976805][T12967] netlink: 'syz.3.1834': attribute type 10 has an invalid length. [ 389.985139][T12967] macvlan0: entered promiscuous mode [ 389.998304][T12967] team0: Port device macvlan0 removed [ 390.021544][T12967] bond0: (slave macvlan0): Enslaving as an active interface with a down link [ 390.250468][T12980] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1838'. [ 390.263594][T12980] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1838'. [ 390.435435][T12987] netlink: 'syz.3.1839': attribute type 1 has an invalid length. [ 390.443391][T12987] netlink: 'syz.3.1839': attribute type 1 has an invalid length. [ 390.568938][T12989] tipc: Enabled bearer , priority 0 [ 390.595648][T12989] syzkaller0: entered promiscuous mode [ 390.604682][T12989] syzkaller0: entered allmulticast mode [ 390.651098][T12989] tipc: Resetting bearer [ 390.670442][T12989] syzkaller0: tun_net_xmit 90 [ 390.677904][T12988] tipc: Resetting bearer [ 390.722027][T12992] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1841'. [ 390.732761][T12988] tipc: Disabling bearer [ 390.749388][T12991] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1841'. [ 391.030450][T13003] netlink: 'syz.1.1844': attribute type 1 has an invalid length. [ 391.176251][T13009] ip6tnl1: entered promiscuous mode [ 391.214185][T13009] ip6tnl1: entered allmulticast mode [ 391.313054][T13019] netlink: 'syz.0.1850': attribute type 1 has an invalid length. [ 391.329942][T13019] netlink: 'syz.0.1850': attribute type 3 has an invalid length. [ 391.647439][T13035] sit0: left promiscuous mode [ 391.734531][T13035] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 391.806515][T13038] lo speed is unknown, defaulting to 1000 [ 391.936581][T13045] gre0: left allmulticast mode [ 392.175755][T13045] 8021q: adding VLAN 0 to HW filter on device bond0 [ 392.236844][T13045] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 392.263238][T13035] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 392.466416][T13048] lo speed is unknown, defaulting to 1000 [ 392.759424][T13059] syzkaller0: entered promiscuous mode [ 392.770077][T13059] syzkaller0: entered allmulticast mode [ 393.145035][T13078] bond0: (slave rose0): Error: Device can not be enslaved while up [ 393.506457][T13098] delete_channel: no stack [ 393.593270][T13104] __nla_validate_parse: 7 callbacks suppressed [ 393.593303][T13104] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1870'. [ 393.737234][T13094] delete_channel: no stack [ 393.758912][T13094] delete_channel: no stack [ 393.797869][T13094] delete_channel: no stack [ 393.822893][T13094] delete_channel: no stack [ 393.848150][T13094] delete_channel: no stack [ 393.861006][T13094] delete_channel: no stack [ 393.897891][T13094] delete_channel: no stack [ 393.911361][T13094] delete_channel: no stack [ 393.933537][T13094] delete_channel: no stack [ 393.962874][T13094] delete_channel: no stack [ 393.982939][T13094] delete_channel: no stack [ 394.001472][T13094] delete_channel: no stack [ 394.019513][T13094] delete_channel: no stack [ 394.038563][T13094] delete_channel: no stack [ 394.051018][T13094] delete_channel: no stack [ 394.065366][T13094] delete_channel: no stack [ 394.070013][T13094] delete_channel: no stack [ 394.094947][T13094] delete_channel: no stack [ 394.099676][T13094] delete_channel: no stack [ 394.142826][T13094] delete_channel: no stack [ 394.158189][T13123] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1873'. [ 394.172306][T13094] delete_channel: no stack [ 394.205660][T13094] delete_channel: no stack [ 394.210327][T13094] delete_channel: no stack [ 394.221475][T13114] lo speed is unknown, defaulting to 1000 [ 394.238304][T13123] validate_nla: 4 callbacks suppressed [ 394.238322][T13123] netlink: 'syz.3.1873': attribute type 2 has an invalid length. [ 394.265062][T13094] delete_channel: no stack [ 394.277510][T13123] netlink: 'syz.3.1873': attribute type 1 has an invalid length. [ 394.285347][T13094] delete_channel: no stack [ 394.289740][T13094] delete_channel: no stack [ 394.307051][T13123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1873'. [ 394.349546][T13094] delete_channel: no stack [ 394.374632][T13094] delete_channel: no stack [ 394.379260][T13094] delete_channel: no stack [ 394.395273][T13094] delete_channel: no stack [ 394.399917][T13094] delete_channel: no stack [ 394.431550][T13094] delete_channel: no stack [ 394.761090][T13138] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1877'. [ 395.210987][T13159] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1882'. [ 395.631550][T13178] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.1888'. [ 395.650921][T13178] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1888'. [ 395.739114][T13182] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1889'. [ 395.824277][T13184] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1889'. [ 396.043707][T13194] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1893'. [ 396.162943][T13193] netlink: 'syz.1.1893': attribute type 4 has an invalid length. [ 396.185389][T13194] netlink: 'syz.1.1893': attribute type 4 has an invalid length. [ 396.316203][T13205] tap0: tun_chr_ioctl cmd 1074025677 [ 396.321768][T13205] tap0: linktype set to 270 [ 396.345233][T13201] tipc: Enabled bearer , priority 0 [ 396.365594][T13201] syzkaller0: entered promiscuous mode [ 396.372909][T13201] syzkaller0: entered allmulticast mode [ 396.403370][T13201] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 396.478921][T13201] tipc: Resetting bearer [ 396.500039][T13200] tipc: Resetting bearer [ 396.537862][T13200] tipc: Disabling bearer [ 396.601819][T13197] netlink: 'syz.3.1894': attribute type 1 has an invalid length. [ 396.610585][T13197] netlink: 'syz.3.1894': attribute type 4 has an invalid length. [ 396.621621][T13197] netlink: 'syz.3.1894': attribute type 1 has an invalid length. [ 396.629852][T13197] netlink: 'syz.3.1894': attribute type 4 has an invalid length. [ 396.943490][T13224] lo speed is unknown, defaulting to 1000 [ 397.002162][T13232] bond0: option mode: unable to set because the bond device is up [ 397.419656][T13237] netlink: zone id is out of range [ 397.444512][T13237] netlink: zone id is out of range [ 397.449699][T13237] netlink: zone id is out of range [ 397.473608][T13237] netlink: zone id is out of range [ 397.489421][T13237] netlink: get zone limit has 8 unknown bytes [ 397.993223][T13268] netlink: 'syz.2.1912': attribute type 14 has an invalid length. [ 398.001893][T13262] wg1: entered promiscuous mode [ 398.014960][T13262] wg1: entered allmulticast mode [ 398.043481][T13268] netlink: 'syz.2.1912': attribute type 26 has an invalid length. [ 398.717240][T13291] nbd: error processing sock list [ 398.723161][T13291] block nbd0: shutting down sockets [ 398.855176][T13296] __nla_validate_parse: 12 callbacks suppressed [ 398.855196][T13296] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1917'. [ 399.015055][T13313] netlink: 'syz.2.1918': attribute type 11 has an invalid length. [ 399.053259][T13316] vlan2: entered promiscuous mode [ 399.060994][T13316] team0: entered promiscuous mode [ 399.088085][T13316] team_slave_0: entered promiscuous mode [ 399.104731][T13316] team_slave_1: entered promiscuous mode [ 399.400409][T13333] sctp: [Deprecated]: syz.1.1923 (pid 13333) Use of int in maxseg socket option. [ 399.400409][T13333] Use struct sctp_assoc_value instead [ 399.432197][T13336] tipc: Enabling of bearer rejected, failed to enable media [ 399.761695][T13349] bond5: (slave gretap0): Releasing active interface [ 399.835448][T13349] ip6gretap0: entered promiscuous mode [ 399.857488][T13359] xt_limit: Overflow, try lower: 271964/0 [ 399.869474][T13358] netlink: zone id is out of range [ 399.875619][T13358] netlink: zone id is out of range [ 399.880790][T13358] netlink: zone id is out of range [ 399.892900][T13358] netlink: zone id is out of range [ 399.899296][T13358] netlink: zone id is out of range [ 399.980809][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 399.981939][T13366] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1932'. [ 399.990601][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.009015][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.020951][T13366] validate_nla: 3 callbacks suppressed [ 400.020967][T13366] netlink: 'syz.1.1932': attribute type 1 has an invalid length. [ 400.028763][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.065297][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.075128][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.095717][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.111054][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1933'. [ 400.317933][T13383] lo speed is unknown, defaulting to 1000 [ 400.560514][T13392] lo speed is unknown, defaulting to 1000 [ 401.879684][T13436] tipc: Resetting bearer [ 402.068468][T13441] bridge10: entered promiscuous mode [ 402.073822][T13441] bridge10: entered allmulticast mode [ 402.288193][T13456] netlink: 'syz.3.1957': attribute type 1 has an invalid length. [ 402.870195][T13473] netlink: 'syz.4.1962': attribute type 4 has an invalid length. [ 403.059704][T13482] netlink: 'syz.1.1964': attribute type 1 has an invalid length. [ 403.207598][T13485] batadv1: entered promiscuous mode [ 403.234335][T13485] batadv1: entered allmulticast mode [ 403.332016][T13495] netlink: 'syz.1.1969': attribute type 1 has an invalid length. [ 403.344442][T13495] netlink: 'syz.1.1969': attribute type 1 has an invalid length. [ 403.389183][T13496] tipc: Enabled bearer , priority 0 [ 403.531919][T13496] syzkaller0: entered promiscuous mode [ 403.540910][T13496] syzkaller0: entered allmulticast mode [ 403.552625][T13508] net_ratelimit: 19 callbacks suppressed [ 403.552642][T13508] openvswitch: netlink: Unknown key attributes 2 [ 403.571429][T13496] tipc: Resetting bearer [ 403.647017][ T9729] tipc: Resetting bearer [ 403.653514][T13493] tipc: Resetting bearer [ 403.796029][T13517] netlink: 'syz.1.1975': attribute type 39 has an invalid length. [ 404.387059][T13533] __nla_validate_parse: 19 callbacks suppressed [ 404.387080][T13533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1979'. [ 405.081998][T13493] tipc: Disabling bearer [ 405.104420][T13531] netlink: 'syz.3.1979': attribute type 1 has an invalid length. [ 405.123104][T13531] netlink: 5624 bytes leftover after parsing attributes in process `syz.3.1979'. [ 405.360746][T13548] IPVS: Unknown mcast interface: vcan0 [ 405.823005][T13567] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1989'. [ 405.861635][T13567] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1989'. [ 405.927058][T13569] tipc: Enabled bearer , priority 0 [ 406.014698][T13573] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1990'. [ 406.092022][T13569] syzkaller0: entered promiscuous mode [ 406.119450][T13569] syzkaller0: entered allmulticast mode [ 406.127224][T13569] tipc: Resetting bearer [ 406.225537][T13568] tipc: Resetting bearer [ 406.282067][T13582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1992'. [ 407.568798][T13568] tipc: Disabling bearer [ 407.591855][T13585] netlink: 'syz.2.1992': attribute type 1 has an invalid length. [ 407.613965][T13585] netlink: 5624 bytes leftover after parsing attributes in process `syz.2.1992'. [ 407.757518][T13591] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1994'. [ 407.809692][T13591] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1994'. [ 407.928589][T13606] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1994'. [ 408.315547][T13632] netlink: 'syz.2.2004': attribute type 10 has an invalid length. [ 408.345159][T13632] team0: entered promiscuous mode [ 408.483670][T13636] lo speed is unknown, defaulting to 1000 [ 408.590274][T13642] netlink: 'syz.2.2007': attribute type 1 has an invalid length. [ 409.198951][T13665] tipc: Enabled bearer , priority 14 [ 409.250030][T13673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.580575][T13685] netlink: 'syz.3.2018': attribute type 5 has an invalid length. [ 410.201736][T13685] lo speed is unknown, defaulting to 1000 [ 410.332714][T13699] netlink: 'syz.1.2021': attribute type 13 has an invalid length. [ 410.343598][T13699] netlink: 'syz.1.2021': attribute type 17 has an invalid length. [ 410.440522][T13703] __nla_validate_parse: 7 callbacks suppressed [ 410.440549][T13703] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2023'. [ 410.517694][T13699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.547388][T13699] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.754686][T13699] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 410.865724][T13712] netlink: 'syz.0.2026': attribute type 11 has an invalid length. [ 410.950361][T13697] lo speed is unknown, defaulting to 1000 [ 411.823351][T13722] netlink: 'syz.3.2029': attribute type 16 has an invalid length. [ 411.865523][T13722] netlink: 'syz.3.2029': attribute type 3 has an invalid length. [ 411.884913][T13722] netlink: 64066 bytes leftover after parsing attributes in process `syz.3.2029'. [ 412.170868][T13728] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2031'. [ 412.184254][T13728] netlink: 'syz.3.2031': attribute type 6 has an invalid length. [ 412.202305][T13728] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2031'. [ 412.273443][T13730] bond0: option all_slaves_active: invalid value (8) [ 412.407499][T13733] delete_channel: no stack [ 412.523162][T13737] netlink: 'syz.3.2034': attribute type 2 has an invalid length. [ 412.609818][T13735] gtp1: entered promiscuous mode [ 412.635279][T13735] gtp1: entered allmulticast mode [ 412.880991][T13760] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2039'. [ 412.974261][T13751] netlink: 'syz.2.2039': attribute type 1 has an invalid length. [ 413.012604][T13751] netlink: 5624 bytes leftover after parsing attributes in process `syz.2.2039'. [ 413.154638][T13767] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2040'. [ 413.306923][T13774] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 413.370207][T13774] netlink: 'syz.0.2043': attribute type 10 has an invalid length. [ 413.408705][T13774] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 413.426055][T13774] bond0: (slave wlan1): refused to change device type [ 413.681698][T13795] sctp: [Deprecated]: syz.2.2049 (pid 13795) Use of struct sctp_assoc_value in delayed_ack socket option. [ 413.681698][T13795] Use struct sctp_sack_info instead [ 413.739517][T13800] netlink: 208 bytes leftover after parsing attributes in process `syz.0.2050'. [ 413.781240][T13800] netlink: 'syz.0.2050': attribute type 1 has an invalid length. [ 413.990076][T13814] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2054'. [ 414.130465][T13821] tipc: Enabled bearer , priority 0 [ 414.146782][T13822] tipc: Resetting bearer [ 414.187198][T13822] tipc: Resetting bearer [ 414.212395][T13822] tipc: Disabling bearer [ 414.315549][T13835] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2060'. [ 414.683373][T13850] can: request_module (can-proto-4) failed. [ 415.426392][T13890] bond3 (unregistering): Released all slaves [ 415.512559][T13899] syzkaller1: entered promiscuous mode [ 415.539791][T13899] syzkaller1: entered allmulticast mode [ 415.618892][T13905] __nla_validate_parse: 4 callbacks suppressed [ 415.618910][T13905] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2077'. [ 415.827147][T13920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2082'. [ 415.871527][T13920] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2082'. [ 415.887716][T13920] validate_nla: 1 callbacks suppressed [ 415.887732][T13920] netlink: 'syz.1.2082': attribute type 1 has an invalid length. [ 415.914941][T13920] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2082'. [ 415.943414][T13934] dummy0: entered allmulticast mode [ 416.024049][T13920] nbd: socks must be embedded in a SOCK_ITEM attr [ 416.032028][T13920] block nbd0: shutting down sockets [ 416.294401][T13949] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2091'. [ 416.368171][T13955] TCP: TCP_TX_DELAY enabled [ 416.376576][T13955] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2088'. [ 416.454511][T13960] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2092'. [ 416.665755][T13957] lo speed is unknown, defaulting to 1000 [ 416.690183][T13964] netlink: 'syz.3.2093': attribute type 13 has an invalid length. [ 416.715432][T13964] netlink: 'syz.3.2093': attribute type 17 has an invalid length. [ 416.759367][T13964] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 416.842373][T13969] netlink: 192 bytes leftover after parsing attributes in process `syz.0.2094'. [ 416.880253][T13969] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2094'. [ 417.157018][T13980] netlink: 830 bytes leftover after parsing attributes in process `syz.2.2096'. [ 417.201759][T13971] lo speed is unknown, defaulting to 1000 [ 417.961308][T14010] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 417.991743][T14011] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 417.999049][T14011] IPv6: NLM_F_CREATE should be set when creating new route [ 418.006432][T14011] IPv6: NLM_F_CREATE should be set when creating new route [ 418.021544][T14010] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 418.596534][T14027] netlink: 'syz.3.2108': attribute type 1 has an invalid length. [ 418.776459][T14030] bond0: (slave bond_slave_1): Releasing backup interface [ 419.048160][T14046] netlink: 'syz.3.2112': attribute type 1 has an invalid length. [ 419.091764][T14024] lo speed is unknown, defaulting to 1000 [ 419.282589][T14059] syzkaller0: entered allmulticast mode [ 419.918138][T14074] C: renamed from team_slave_0 [ 419.961471][T14074] netlink: 'syz.1.2120': attribute type 2 has an invalid length. [ 420.009171][T14074] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 420.300321][T14048] syzkaller0: left allmulticast mode [ 421.104036][T14096] wg1: entered promiscuous mode [ 421.108965][T14096] wg1: entered allmulticast mode [ 421.432552][T14106] __nla_validate_parse: 9 callbacks suppressed [ 421.432573][T14106] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2127'. [ 421.744812][T14124] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2133'. [ 421.775205][T14125] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2132'. [ 421.789378][T14125] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2132'. [ 421.816937][T14125] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2132'. [ 421.874393][T14130] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (65535) [ 421.895409][T14130] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023 [ 422.003243][T14138] netlink: 'syz.4.2137': attribute type 3 has an invalid length. [ 422.062785][T14142] netlink: 'syz.4.2137': attribute type 3 has an invalid length. [ 422.158006][T14148] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 422.246689][T14152] syzkaller1: entered promiscuous mode [ 422.252394][T14152] syzkaller1: entered allmulticast mode [ 422.691192][T14172] FAULT_INJECTION: forcing a failure. [ 422.691192][T14172] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 422.719764][T14168] lo speed is unknown, defaulting to 1000 [ 422.738339][T14172] CPU: 0 UID: 0 PID: 14172 Comm: syz.4.2145 Not tainted syzkaller #0 PREEMPT(full) [ 422.738367][T14172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 422.738387][T14172] Call Trace: [ 422.738396][T14172] [ 422.738404][T14172] dump_stack_lvl+0x189/0x250 [ 422.738439][T14172] ? __pfx____ratelimit+0x10/0x10 [ 422.738468][T14172] ? __pfx_dump_stack_lvl+0x10/0x10 [ 422.738491][T14172] ? __pfx__printk+0x10/0x10 [ 422.738519][T14172] ? __might_fault+0xb0/0x130 [ 422.738571][T14172] should_fail_ex+0x414/0x560 [ 422.738602][T14172] _copy_from_user+0x2d/0xb0 [ 422.738626][T14172] ___sys_recvmsg+0x12e/0x510 [ 422.738654][T14172] ? __pfx____sys_recvmsg+0x10/0x10 [ 422.738701][T14172] ? __fget_files+0x3a0/0x420 [ 422.738743][T14172] __x64_sys_recvmsg+0x198/0x260 [ 422.738768][T14172] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 422.738798][T14172] ? __pfx_ksys_write+0x10/0x10 [ 422.738823][T14172] ? rcu_is_watching+0x15/0xb0 [ 422.738849][T14172] ? do_syscall_64+0xbe/0x3b0 [ 422.738881][T14172] do_syscall_64+0xfa/0x3b0 [ 422.738908][T14172] ? lockdep_hardirqs_on+0x9c/0x150 [ 422.738934][T14172] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.738953][T14172] ? clear_bhb_loop+0x60/0xb0 [ 422.738978][T14172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.739001][T14172] RIP: 0033:0x7f349f58ebe9 [ 422.739019][T14172] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 422.739036][T14172] RSP: 002b:00007f34a03d8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 422.739058][T14172] RAX: ffffffffffffffda RBX: 00007f349f7b5fa0 RCX: 00007f349f58ebe9 [ 422.739072][T14172] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 422.739084][T14172] RBP: 00007f34a03d8090 R08: 0000000000000000 R09: 0000000000000000 [ 422.739096][T14172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.739107][T14172] R13: 00007f349f7b6038 R14: 00007f349f7b5fa0 R15: 00007ffedea10178 [ 422.739138][T14172] [ 423.318945][T14191] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2147'. [ 423.433153][T14195] netlink: 'syz.3.2147': attribute type 1 has an invalid length. [ 423.441565][T14195] netlink: 5624 bytes leftover after parsing attributes in process `syz.3.2147'. [ 423.679390][T14202] netlink: 'syz.1.2150': attribute type 1 has an invalid length. [ 423.919944][T14217] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2151'. [ 423.987023][T14223] netlink: 'syz.3.2151': attribute type 10 has an invalid length. [ 424.089835][T14207] bond3: (slave bridge5): Enslaving as an active interface with a down link [ 424.941810][T14272] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2161'. [ 424.977199][T14272] netlink: 'syz.1.2161': attribute type 1 has an invalid length. [ 425.027117][T14272] netlink: 5624 bytes leftover after parsing attributes in process `syz.1.2161'. [ 425.112691][T14275] tipc: Enabling of bearer rejected, already enabled [ 425.302327][T14283] netlink: 'syz.3.2168': attribute type 2 has an invalid length. [ 425.344480][T14283] tap0: tun_chr_ioctl cmd 1074025678 [ 425.349823][T14283] tap0: group set to 0 [ 425.439944][T14296] netlink: 'syz.0.2172': attribute type 1 has an invalid length. [ 425.448726][T14290] geneve0: entered promiscuous mode [ 425.468839][ T9985] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.481334][T14295] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 425.507963][T14299] netlink: 'syz.0.2172': attribute type 2 has an invalid length. [ 425.541610][ T9985] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.550823][ T9985] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.579617][T14299] netlink: 'syz.0.2172': attribute type 1 has an invalid length. [ 425.595051][ T36] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.021579][T14318] 0ªî{X¹¦: renamed from gretap0 [ 426.029762][T14318] 0ªî{X¹¦: entered allmulticast mode [ 426.039146][T14318] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 426.213649][T14327] tipc: Enabling of bearer rejected, already enabled [ 426.435075][T14345] __nla_validate_parse: 141 callbacks suppressed [ 426.435094][T14345] netlink: 740 bytes leftover after parsing attributes in process `syz.1.2187'. [ 426.628517][T14361] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 426.640610][T14358] IPVS: stopping backup sync thread 14361 ... [ 427.053522][T14386] tipc: Enabling of bearer rejected, already enabled [ 427.079002][T14386] sch_tbf: burst 151 is lower than device syzkaller0 mtu (313) ! [ 427.091217][T14389] netlink: 380 bytes leftover after parsing attributes in process `syz.1.2195'. [ 427.279286][T14401] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2199'. [ 427.284263][T14402] FAULT_INJECTION: forcing a failure. [ 427.284263][T14402] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 427.309566][T14402] CPU: 0 UID: 0 PID: 14402 Comm: syz.0.2200 Not tainted syzkaller #0 PREEMPT(full) [ 427.309595][T14402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 427.309610][T14402] Call Trace: [ 427.309619][T14402] [ 427.309628][T14402] dump_stack_lvl+0x189/0x250 [ 427.309660][T14402] ? __pfx____ratelimit+0x10/0x10 [ 427.309690][T14402] ? __pfx_dump_stack_lvl+0x10/0x10 [ 427.309717][T14402] ? __pfx__printk+0x10/0x10 [ 427.309762][T14402] should_fail_ex+0x414/0x560 [ 427.309796][T14402] _copy_to_user+0x31/0xb0 [ 427.309824][T14402] simple_read_from_buffer+0xe1/0x170 [ 427.309868][T14402] proc_fail_nth_read+0x1b3/0x220 [ 427.309896][T14402] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 427.309925][T14402] ? rw_verify_area+0x2a6/0x4d0 [ 427.309950][T14402] ? __lock_acquire+0xab9/0xd20 [ 427.309980][T14402] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 427.310006][T14402] vfs_read+0x200/0xa30 [ 427.310033][T14402] ? fdget_pos+0x247/0x320 [ 427.310057][T14402] ? __pfx___mutex_lock+0x10/0x10 [ 427.310089][T14402] ? __pfx_vfs_read+0x10/0x10 [ 427.310119][T14402] ? __fget_files+0x2a/0x420 [ 427.310157][T14402] ? __fget_files+0x3a0/0x420 [ 427.310189][T14402] ? __fget_files+0x2a/0x420 [ 427.310233][T14402] ksys_read+0x145/0x250 [ 427.310265][T14402] ? __pfx_ksys_read+0x10/0x10 [ 427.310291][T14402] ? rcu_is_watching+0x15/0xb0 [ 427.310320][T14402] ? do_syscall_64+0xbe/0x3b0 [ 427.310356][T14402] do_syscall_64+0xfa/0x3b0 [ 427.310387][T14402] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.310408][T14402] ? asm_common_interrupt+0x26/0x40 [ 427.310427][T14402] ? clear_bhb_loop+0x60/0xb0 [ 427.310454][T14402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.310474][T14402] RIP: 0033:0x7f937018d5fc [ 427.310494][T14402] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 427.310513][T14402] RSP: 002b:00007f9370f3d030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 427.310540][T14402] RAX: ffffffffffffffda RBX: 00007f93703b5fa0 RCX: 00007f937018d5fc [ 427.310556][T14402] RDX: 000000000000000f RSI: 00007f9370f3d0a0 RDI: 0000000000000005 [ 427.310569][T14402] RBP: 00007f9370f3d090 R08: 0000000000000000 R09: 0000000000000000 [ 427.310582][T14402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 427.310594][T14402] R13: 00007f93703b6038 R14: 00007f93703b5fa0 R15: 00007ffefdc93d18 [ 427.310630][T14402] [ 427.900551][T14430] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2208'. [ 427.931836][T14430] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2208'. [ 428.148133][T14452] validate_nla: 1 callbacks suppressed [ 428.148152][T14452] netlink: 'syz.3.2212': attribute type 4 has an invalid length. [ 428.274582][T14460] tipc: Enabled bearer , priority 0 [ 428.283020][T14460] syzkaller0: entered promiscuous mode [ 428.289586][T14460] syzkaller0: entered allmulticast mode [ 428.318399][T14460] tipc: Resetting bearer [ 428.325771][T14460] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 428.351038][T14459] tipc: Resetting bearer [ 428.379392][T14459] tipc: Disabling bearer [ 428.411848][T14465] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2220'. [ 428.423539][T14465] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2220'. [ 428.471392][T14467] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 428.968990][T14493] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2229'. [ 428.999806][T14493] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2229'. [ 429.229878][T14503] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 429.328505][T14505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2234'. [ 429.567551][T14513] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 429.752826][T14514] lo speed is unknown, defaulting to 1000 [ 429.769116][T14520] tipc: Enabled bearer , priority 0 [ 429.859954][T14520] syzkaller0: entered promiscuous mode [ 429.866704][T14520] syzkaller0: entered allmulticast mode [ 429.934231][T14520] tipc: Resetting bearer [ 429.952744][T14518] tipc: Resetting bearer [ 429.979249][T14518] tipc: Disabling bearer [ 430.051566][T14537] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20003 [ 430.095513][T14523] lo speed is unknown, defaulting to 1000 [ 430.190829][T14536] tipc: Enabled bearer , priority 0 [ 430.231227][T14536] syzkaller0: entered promiscuous mode [ 430.346331][T14536] syzkaller0: entered allmulticast mode [ 430.428336][T14549] geneve3: entered allmulticast mode [ 430.488550][ T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.500342][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.543748][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.623070][T14547] netlink: 'syz.3.2246': attribute type 1 has an invalid length. [ 430.657170][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.802959][T14535] tipc: Resetting bearer [ 430.863406][T14535] tipc: Disabling bearer [ 430.881320][T14575] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 431.788519][T14598] ip6gre1: entered promiscuous mode [ 432.301653][T14618] lo speed is unknown, defaulting to 1000 [ 433.245987][T14633] __nla_validate_parse: 9 callbacks suppressed [ 433.246007][T14633] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2266'. [ 433.288120][T14633] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2266'. [ 433.314782][T14633] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2266'. [ 433.323789][T14633] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2266'. [ 433.586990][T14653] netlink: 'syz.1.2273': attribute type 1 has an invalid length. [ 433.808336][T14649] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2271'. [ 433.818062][T14649] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 433.886827][T14656] bond4: (slave bridge6): making interface the new active one [ 433.895951][T14656] bond4: (slave bridge6): Enslaving as an active interface with an up link [ 433.942359][T14662] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2276'. [ 434.064301][T14662] netlink: 11 bytes leftover after parsing attributes in process `syz.4.2276'. [ 434.096693][T14674] FAULT_INJECTION: forcing a failure. [ 434.096693][T14674] name failslab, interval 1, probability 0, space 0, times 0 [ 434.097428][T14670] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2277'. [ 434.137008][T14674] CPU: 0 UID: 0 PID: 14674 Comm: syz.2.2278 Not tainted syzkaller #0 PREEMPT(full) [ 434.137032][T14674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 434.137044][T14674] Call Trace: [ 434.137052][T14674] [ 434.137061][T14674] dump_stack_lvl+0x189/0x250 [ 434.137088][T14674] ? __pfx____ratelimit+0x10/0x10 [ 434.137115][T14674] ? __pfx_dump_stack_lvl+0x10/0x10 [ 434.137137][T14674] ? __pfx__printk+0x10/0x10 [ 434.137181][T14674] should_fail_ex+0x414/0x560 [ 434.137212][T14674] should_failslab+0xa8/0x100 [ 434.137252][T14674] kmem_cache_alloc_noprof+0x73/0x3c0 [ 434.137278][T14674] ? skb_clone+0x212/0x3a0 [ 434.137305][T14674] skb_clone+0x212/0x3a0 [ 434.137330][T14674] __netlink_deliver_tap+0x404/0x850 [ 434.137372][T14674] ? netlink_deliver_tap+0x2e/0x1b0 [ 434.137409][T14674] netlink_deliver_tap+0x19c/0x1b0 [ 434.137438][T14674] netlink_sendskb+0x68/0x140 [ 434.137466][T14674] netlink_unicast+0x397/0x9e0 [ 434.137488][T14674] ? auto_movable_can_online_movable+0x455/0x7d0 [ 434.137523][T14674] ? __pfx_netlink_unicast+0x10/0x10 [ 434.137551][T14674] ? __alloc_skb+0x1bc/0x2d0 [ 434.137584][T14674] ctrl_getfamily+0x499/0x590 [ 434.137607][T14674] ? __pfx_ctrl_getfamily+0x10/0x10 [ 434.137629][T14674] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 434.137661][T14674] genl_family_rcv_msg_doit+0x215/0x300 [ 434.137691][T14674] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 434.137739][T14674] genl_rcv_msg+0x60e/0x790 [ 434.137768][T14674] ? __pfx_genl_rcv_msg+0x10/0x10 [ 434.137789][T14674] ? __pfx_ctrl_getfamily+0x10/0x10 [ 434.137811][T14674] ? __asan_memcpy+0x40/0x70 [ 434.137832][T14674] ? __pfx_ref_tracker_free+0x10/0x10 [ 434.137868][T14674] netlink_rcv_skb+0x205/0x470 [ 434.137893][T14674] ? __lock_acquire+0xab9/0xd20 [ 434.137922][T14674] ? __pfx_genl_rcv_msg+0x10/0x10 [ 434.137945][T14674] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 434.137994][T14674] ? down_read+0x1ad/0x2e0 [ 434.138014][T14674] genl_rcv+0x28/0x40 [ 434.138033][T14674] netlink_unicast+0x82c/0x9e0 [ 434.138068][T14674] ? __pfx_netlink_unicast+0x10/0x10 [ 434.138096][T14674] ? netlink_sendmsg+0x642/0xb30 [ 434.138122][T14674] ? skb_put+0x11b/0x210 [ 434.138144][T14674] netlink_sendmsg+0x805/0xb30 [ 434.138184][T14674] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.138217][T14674] ? aa_sock_msg_perm+0xf1/0x1d0 [ 434.138248][T14674] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 434.138270][T14674] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.138301][T14674] __sock_sendmsg+0x219/0x270 [ 434.138330][T14674] __sys_sendto+0x3bd/0x520 [ 434.138361][T14674] ? __pfx___sys_sendto+0x10/0x10 [ 434.138421][T14674] ? count_memcg_event_mm+0x21/0x260 [ 434.138456][T14674] ? exc_page_fault+0x76/0xf0 [ 434.138502][T14674] ? do_user_addr_fault+0xc8a/0x1390 [ 434.138537][T14674] __x64_sys_sendto+0xde/0x100 [ 434.138572][T14674] do_syscall_64+0xfa/0x3b0 [ 434.138600][T14674] ? lockdep_hardirqs_on+0x9c/0x150 [ 434.138627][T14674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.138647][T14674] ? clear_bhb_loop+0x60/0xb0 [ 434.138672][T14674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.138691][T14674] RIP: 0033:0x7f01b8190a7c [ 434.138710][T14674] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b [ 434.138728][T14674] RSP: 002b:00007f01b8f1fec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 434.138749][T14674] RAX: ffffffffffffffda RBX: 00007f01b8f1ffc0 RCX: 00007f01b8190a7c [ 434.138765][T14674] RDX: 0000000000000020 RSI: 00007f01b8f20010 RDI: 0000000000000003 [ 434.138778][T14674] RBP: 0000000000000000 R08: 00007f01b8f1ff14 R09: 000000000000000c [ 434.138790][T14674] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 434.138801][T14674] R13: 00007f01b8f1ff68 R14: 00007f01b8f20010 R15: 0000000000000000 [ 434.138833][T14674] [ 516.124527][T14701] lo speed is unknown, defaulting to 1000 [ 516.316805][T14709] netlink: 'syz.3.2285': attribute type 13 has an invalid length. [ 516.343028][T14709] netlink: 'syz.3.2285': attribute type 17 has an invalid length. [ 516.378234][T14709] 0ªî{X¹¦: left allmulticast mode [ 516.423377][T14709] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 516.545882][T14704] lo speed is unknown, defaulting to 1000 [ 516.660736][T14714] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2288'. [ 516.697230][T14714] pimreg: entered allmulticast mode [ 516.718455][T14714] pimreg: left allmulticast mode [ 516.797827][T14716] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2288'. [ 516.809962][T14716] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2288'. [ 517.111404][T14720] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.212173][T14723] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2290'. [ 517.296606][T14720] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.414685][T14720] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.493241][T14725] tipc: Enabling of bearer rejected, already enabled [ 517.527750][T14720] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.745971][ T9729] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.769158][ T9729] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.024321][ T9729] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.078823][ T9729] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.290801][T14746] netlink: 'syz.1.2298': attribute type 1 has an invalid length. [ 518.299176][T14746] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2298'. [ 518.545760][T14756] IPVS: set_ctl: invalid protocol: 29 172.20.20.187:20002 [ 518.567791][ T30] audit: type=1800 audit(1755607281.507:10): pid=14754 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2300" name="memory.events" dev="tmpfs" ino=2310 res=0 errno=0 [ 518.616482][T14764] netlink: 'syz.3.2302': attribute type 1 has an invalid length. [ 518.827844][T14779] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2306'. [ 519.177625][T14770] netlink: 'syz.4.2303': attribute type 1 has an invalid length. [ 519.239100][T14770] netlink: 'syz.4.2303': attribute type 1 has an invalid length. [ 519.285256][T14770] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2303'. [ 519.446422][T14797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2311'. [ 519.849034][T14811] netlink: 'syz.2.2314': attribute type 3 has an invalid length. [ 519.893208][T14809] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2312'. [ 520.190577][T14829] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2319'. [ 520.900546][T14867] lo speed is unknown, defaulting to 1000 [ 521.747069][T14898] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 522.306678][T14926] __nla_validate_parse: 36 callbacks suppressed [ 522.306699][T14926] netlink: 304 bytes leftover after parsing attributes in process `syz.0.2343'. [ 522.574436][T14929] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.2346'. [ 522.672553][T14939] lo speed is unknown, defaulting to 1000 [ 522.682868][T14942] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2348'. [ 523.186149][T14955] pim6reg1: entered promiscuous mode [ 523.191493][T14955] pim6reg1: entered allmulticast mode [ 523.694872][T14953] lo speed is unknown, defaulting to 1000 [ 523.838568][T14983] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2358'. [ 524.244297][T14991] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2361'. [ 525.265185][T15017] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2369'. [ 525.313871][T15017] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2369'. [ 525.516457][T15027] tipc: Enabled bearer , priority 0 [ 525.560232][T15027] syzkaller0: entered promiscuous mode [ 525.587560][T15027] syzkaller0: entered allmulticast mode [ 525.677290][T15027] tipc: Resetting bearer [ 525.760029][T15028] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.2371'. [ 526.114763][T15046] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.190520][T15046] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.297559][T15047] lo speed is unknown, defaulting to 1000 [ 526.309513][T15046] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.321449][T15058] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 526.717687][T15062] bridge0: port 3(dummy0) entered disabled state [ 526.980686][ T9] lo speed is unknown, defaulting to 1000 [ 526.987261][ T9] syz0: Port: 1 Link DOWN [ 527.010102][T15046] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.045451][T15038] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 527.055735][T15073] tipc: Enabled bearer , priority 0 [ 527.075980][T15074] syzkaller0: entered promiscuous mode [ 527.081464][T15074] syzkaller0: entered allmulticast mode [ 527.082030][T15066] netlink: 'syz.1.2378': attribute type 1 has an invalid length. [ 527.105949][T15068] lo speed is unknown, defaulting to 1000 [ 527.182785][T15066] tipc: Resetting bearer [ 527.213060][T15065] tipc: Resetting bearer [ 527.260730][T15065] tipc: Disabling bearer [ 527.318753][T15087] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2380'. [ 527.385513][ T9728] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.462526][T15098] bond0: (slave bridge0): Releasing backup interface [ 527.510499][T15098] dummy0: left allmulticast mode [ 527.531707][T15103] netlink: 'syz.3.2381': attribute type 10 has an invalid length. [ 527.539736][T15098] dummy0: left promiscuous mode [ 527.564101][T15098] bridge0: port 3(dummy0) entered disabled state [ 527.581125][T15098] bridge_slave_0: left allmulticast mode [ 527.589641][T15098] bridge_slave_0: left promiscuous mode [ 527.611322][T15098] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.686331][T15098] bridge_slave_1: left allmulticast mode [ 527.710059][T15098] bridge_slave_1: left promiscuous mode [ 527.737155][T15098] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.756680][T15098] veth0_to_bond: left allmulticast mode [ 527.782459][T15098] veth0_to_bond: left promiscuous mode [ 527.793164][T15098] bridge7: port 2(veth0_to_bond) entered disabled state [ 527.813311][T15098] bond0: (slave bond_slave_0): Releasing backup interface [ 527.822479][T15098] team_slave_0: left promiscuous mode [ 527.830326][T15098] team0: Port device team_slave_0 removed [ 527.837300][T15098] team_slave_1: left promiscuous mode [ 527.845973][T15098] team0: Port device team_slave_1 removed [ 527.853142][T15098] bond0: (slave macvlan0): Releasing backup interface [ 527.862632][T15098] bond1: (slave bridge1): Releasing active interface [ 527.876879][T15098] veth3: left allmulticast mode [ 527.881779][T15098] veth3: left promiscuous mode [ 527.887414][T15098] bridge7: port 1(veth3) entered disabled state [ 527.905163][ T36] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.928394][T15088] lo speed is unknown, defaulting to 1000 [ 528.050587][ T36] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.099362][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.478646][T15131] netlink: 196 bytes leftover after parsing attributes in process `syz.4.2387'. [ 528.572869][T15135] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2389'. [ 528.894115][T15146] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2390'. [ 528.945994][T15117] tipc: Resetting bearer [ 528.988426][T15125] pimreg: entered allmulticast mode [ 529.029537][T15128] dvmrp8: entered allmulticast mode [ 529.074347][T15131] vlan3: entered promiscuous mode [ 529.090123][T15131] team0: entered promiscuous mode [ 529.119183][ T13] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.165676][T15118] pimreg: left allmulticast mode [ 529.178921][T15118] dvmrp8: left allmulticast mode [ 529.280246][ T13] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.295160][ T13] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.332205][ T13] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.393001][T15160] pim6reg1: entered promiscuous mode [ 529.410669][T15160] pim6reg1: entered allmulticast mode [ 529.580605][T15171] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2394'. [ 529.628939][T15178] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2400'. [ 529.742056][T15171] syzkaller0: left promiscuous mode [ 529.755409][T15171] syzkaller0: left allmulticast mode [ 529.944049][T15163] 8021q: adding VLAN 0 to HW filter on device bond3 [ 529.975891][T15163] bond3: entered promiscuous mode [ 529.997630][T15163] team0: Port device bond3 added [ 530.378381][T15203] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2405'. [ 530.488300][T15205] bridge9: entered promiscuous mode [ 530.494261][T15205] bridge9: entered allmulticast mode [ 530.501966][T15205] team0: Port device bridge9 added [ 530.560797][T15207] netlink: 'syz.0.2406': attribute type 1 has an invalid length. [ 530.580023][T15207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2406'. [ 530.591192][T15207] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2406'. [ 530.607696][T15207] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 530.619067][T15207] gretap2: entered promiscuous mode [ 530.788971][T15217] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2408'. [ 531.690309][T15272] tipc: Enabled bearer , priority 0 [ 531.716982][T15272] syzkaller0: entered promiscuous mode [ 531.730750][T15272] syzkaller0: entered allmulticast mode [ 531.755562][T15280] @ÿ: renamed from veth0_vlan [ 531.807726][T15272] tipc: Resetting bearer [ 531.837355][T15271] tipc: Resetting bearer [ 531.877446][T15271] tipc: Disabling bearer [ 532.100626][T15305] netlink: 'syz.3.2433': attribute type 21 has an invalid length. [ 532.121333][T15305] netlink: 'syz.3.2433': attribute type 4 has an invalid length. [ 532.129865][T15305] netlink: 'syz.3.2433': attribute type 5 has an invalid length. [ 532.409029][T15315] __nla_validate_parse: 5 callbacks suppressed [ 532.409049][T15315] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2437'. [ 532.446558][T15315] netlink: 34 bytes leftover after parsing attributes in process `syz.4.2437'. [ 532.795332][T15327] netlink: 'syz.1.2440': attribute type 1 has an invalid length. [ 532.829722][T15327] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 532.860281][T15327] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2440'. [ 533.166062][T15348] netlink: 'syz.3.2446': attribute type 8 has an invalid length. [ 533.234806][T15351] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2447'. [ 533.351340][T15361] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2448'. [ 533.355153][T15358] netlink: 'syz.3.2450': attribute type 12 has an invalid length. [ 533.364223][T15360] netlink: 'syz.2.2451': attribute type 1 has an invalid length. [ 533.386496][T15361] netlink: 'syz.0.2448': attribute type 1 has an invalid length. [ 533.407373][T15367] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2448'. [ 533.424590][T15366] netlink: 'syz.3.2450': attribute type 23 has an invalid length. [ 533.456713][T15371] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2449'. [ 533.494651][T15371] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 533.538920][T15360] bond4: entered promiscuous mode [ 533.544520][T15360] 8021q: adding VLAN 0 to HW filter on device bond4 [ 533.580488][T15372] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 533.640259][T15375] erspan1: entered promiscuous mode [ 533.821079][T15395] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2456'. [ 534.018496][T15408] netlink: 'syz.2.2462': attribute type 4 has an invalid length. [ 534.039966][T15408] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2462'. [ 534.316667][T15423] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2464'. [ 534.504649][T15430] tipc: Enabling of bearer rejected, failed to enable media [ 534.532353][T15433] tipc: Enabled bearer , priority 0 [ 534.639217][T15433] syzkaller0: entered promiscuous mode [ 534.681092][T15433] syzkaller0: entered allmulticast mode [ 534.747750][T15449] tipc: Enabling of bearer rejected, already enabled [ 534.779584][T15456] syzkaller0: entered promiscuous mode [ 534.800884][T15456] syzkaller0: entered allmulticast mode [ 534.907517][T15432] tipc: Resetting bearer [ 534.975348][T15432] tipc: Disabling bearer [ 535.118858][T15469] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 535.303708][T15479] veth5: entered promiscuous mode [ 535.422378][T15492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 535.638243][T15502] smc: ib device syz0 ibport 1 applied user defined pnetid SYZ1 [ 535.784505][T15511] tipc: Enabled bearer , priority 0 [ 535.804578][T15511] syzkaller0: entered promiscuous mode [ 535.811620][T15511] syzkaller0: entered allmulticast mode [ 535.911464][T15511] tipc: Resetting bearer [ 535.929000][T15510] tipc: Resetting bearer [ 535.969271][T15510] tipc: Disabling bearer [ 536.223483][T15535] tipc: Enabled bearer , priority 0 [ 536.241945][T15535] syzkaller0: entered promiscuous mode [ 536.251946][T15535] syzkaller0: entered allmulticast mode [ 536.331488][ T9984] nci: nci_rx_work: unknown MT 0x1 [ 536.406567][T15551] tipc: Resetting bearer [ 536.440329][T15548] lo speed is unknown, defaulting to 1000 [ 536.630775][T15554] 8021q: adding VLAN 0 to HW filter on device bond5 [ 536.644538][ T5182] Bluetooth: hci4: command 0x0405 tx timeout [ 536.645406][T15554] bridge0: port 1(bond5) entered blocking state [ 536.658863][T15554] bridge0: port 1(bond5) entered disabled state [ 536.665476][T15554] bond5: entered allmulticast mode [ 536.682900][T15554] bond5: entered promiscuous mode [ 536.755807][T15562] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 537.036020][T15533] tipc: Resetting bearer [ 537.105511][T15533] tipc: Disabling bearer [ 537.176430][T15574] syz_tun: entered allmulticast mode [ 537.312577][T15569] dvmrp1: entered allmulticast mode [ 537.397936][T15566] syz_tun: left allmulticast mode [ 537.688777][T15581] lo speed is unknown, defaulting to 1000 [ 537.690554][T15590] __nla_validate_parse: 9 callbacks suppressed [ 537.690572][T15590] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2504'. [ 538.139885][T15604] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2507'. [ 538.177946][T15604] validate_nla: 4 callbacks suppressed [ 538.177964][T15604] netlink: 'syz.2.2507': attribute type 1 has an invalid length. [ 538.212901][T15604] netlink: 5624 bytes leftover after parsing attributes in process `syz.2.2507'. [ 538.445911][T15608] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2509'. [ 538.477535][T15608] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2509'. [ 538.502431][T15610] tipc: Enabled bearer , priority 0 [ 538.520116][T15610] syzkaller0: entered promiscuous mode [ 538.526630][T15610] syzkaller0: entered allmulticast mode [ 538.536500][T15612] netlink: 'syz.2.2510': attribute type 11 has an invalid length. [ 538.581381][T15610] tipc: Resetting bearer [ 538.601032][T15609] tipc: Resetting bearer [ 538.658860][T15609] tipc: Disabling bearer [ 538.691378][T15615] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2512'. [ 538.722844][T15615] 0ªX¹¦À: renamed from caif0 [ 538.767413][T15615] 0ªX¹¦À: entered allmulticast mode [ 538.780323][T15615] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 538.848568][T15621] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2514'. [ 538.944941][T15631] syzkaller0: entered allmulticast mode [ 538.957526][T15631] macsec2: entered promiscuous mode [ 538.962762][T15631] syzkaller0: entered promiscuous mode [ 539.035813][T15631] syzkaller0: left promiscuous mode [ 539.424999][T15651] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2523'. [ 539.611110][T15657] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2525'. [ 539.653910][T15657] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2525'. [ 540.733293][T15701] team0: left promiscuous mode [ 540.741289][T15701] bond3: left promiscuous mode [ 540.770340][T15701] wg1: left promiscuous mode [ 540.842865][T15701] tipc: Resetting bearer [ 540.864094][T15701] syzkaller0: left promiscuous mode [ 540.907058][T15701] bond4: left promiscuous mode [ 541.110709][T15721] tipc: Enabling of bearer rejected, failed to enable media [ 541.811234][T15762] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 541.842280][T15762] IPVS: set_ctl: invalid protocol: 136 224.0.0.2:0 [ 543.149715][T15764] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 543.176450][T15771] syz_tun: entered promiscuous mode [ 543.181693][T15771] syz_tun: entered allmulticast mode [ 543.217452][T15770] syzkaller1: entered promiscuous mode [ 543.234098][T15770] syzkaller1: entered allmulticast mode [ 543.435328][T15791] __nla_validate_parse: 1 callbacks suppressed [ 543.435350][T15791] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2557'. [ 544.284458][T15817] netlink: 'syz.2.2559': attribute type 11 has an invalid length. [ 544.357318][T15821] netlink: 3752 bytes leftover after parsing attributes in process `syz.1.2562'. [ 544.419216][T15819] lo speed is unknown, defaulting to 1000 [ 544.667420][T15832] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2565'. [ 544.723708][ T30] audit: type=1800 audit(1755607307.667:11): pid=15802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2559" name="cgroup.controllers" dev="tmpfs" ino=2455 res=0 errno=0 [ 545.005462][T15838] netlink: 'syz.0.2567': attribute type 9 has an invalid length. [ 545.114965][T15838] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2567'. [ 545.132043][T15840] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 545.342113][T15847] netlink: 'syz.0.2570': attribute type 10 has an invalid length. [ 545.372681][T15835] lo speed is unknown, defaulting to 1000 [ 545.547895][T15852] bond6: entered promiscuous mode [ 545.553071][T15852] bond6: entered allmulticast mode [ 545.567675][T15852] 8021q: adding VLAN 0 to HW filter on device bond6 [ 545.577414][T15855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 545.847248][T15860] IPVS: set_ctl: invalid protocol: 30768 48.48.48.48:12336 [ 546.129085][T15883] netlink: 'syz.0.2581': attribute type 21 has an invalid length. [ 546.141905][T15875] lo speed is unknown, defaulting to 1000 [ 546.181012][T15884] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2581'. [ 546.285466][T15883] netlink: 'syz.0.2581': attribute type 6 has an invalid length. [ 546.305850][T15883] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2581'. [ 546.618298][T15882] lo speed is unknown, defaulting to 1000 [ 546.995256][T15885] lo speed is unknown, defaulting to 1000 [ 547.087307][T15899] netlink: 184 bytes leftover after parsing attributes in process `syz.4.2583'. [ 547.168226][T15880] lo speed is unknown, defaulting to 1000 [ 547.578750][T15907] bond0: (slave rose0): Error: Device can not be enslaved while up [ 547.596207][T15879] lo speed is unknown, defaulting to 1000 [ 548.536224][T15928] lo speed is unknown, defaulting to 1000 [ 548.964188][ T5182] Bluetooth: hci4: command 0x0405 tx timeout [ 549.022463][T15944] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 549.111674][T15943] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2594'. [ 549.160896][T15946] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2595'. [ 549.189288][T15946] netlink: 'syz.0.2595': attribute type 30 has an invalid length. [ 549.278072][T15946] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2595'. [ 549.287558][T15946] netlink: 'syz.0.2595': attribute type 30 has an invalid length. [ 549.304352][ T12] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.350278][ T12] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.363252][ T12] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.435996][ T12] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.297836][T15975] lo speed is unknown, defaulting to 1000 [ 550.792622][T15987] netlink: 'syz.1.2606': attribute type 7 has an invalid length. [ 550.889450][T15987] netlink: 'syz.1.2606': attribute type 8 has an invalid length. [ 550.907659][T15988] netlink: 320 bytes leftover after parsing attributes in process `syz.1.2606'. [ 550.965228][T15987] netlink: 'syz.1.2606': attribute type 4 has an invalid length. [ 550.972994][T15987] netlink: 204 bytes leftover after parsing attributes in process `syz.1.2606'. [ 551.072894][T15994] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2607'. [ 551.396793][T15982] netlink: 'syz.4.2604': attribute type 6 has an invalid length. [ 551.665779][T15999] netlink: 216 bytes leftover after parsing attributes in process `syz.3.2608'. [ 551.743561][T15999] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2608'. [ 551.759341][T15999] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2608'. [ 551.864655][T16016] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 551.982834][T16016] IPVS: set_ctl: invalid protocol: 50 255.255.255.255:20000 [ 552.031112][T16023] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2615'. [ 553.245632][T16074] IPVS: Unknown mcast interface: vcan0 [ 553.285814][T16076] IPVS: Unknown mcast interface: vcan0 [ 554.031160][T16102] bond5 (unregistering): Released all slaves [ 554.391564][T16136] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 554.564175][ T5182] Bluetooth: hci2: command 0x0406 tx timeout [ 554.565368][ T5868] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 554.922593][T16161] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 554.939797][T16161] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 555.213631][T16179] bridge0: entered allmulticast mode [ 555.236303][T16179] pim6reg: entered allmulticast mode [ 555.423699][T16190] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2656'. [ 555.439131][T16190] netlink: 120 bytes leftover after parsing attributes in process `syz.3.2656'. [ 555.470235][T16190] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2656'. [ 555.637437][T16202] netlink: 'syz.3.2659': attribute type 1 has an invalid length. [ 555.653599][T16202] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2659'. [ 555.733933][T16196] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2658'. [ 555.794977][T16205] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2660'. [ 555.937045][T16214] lo speed is unknown, defaulting to 1000 [ 555.956727][T16205] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2660'. [ 559.221581][T16234] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2666'. [ 559.268184][T16234] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 559.288121][T16241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2666'. [ 559.319277][T16242] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2664'. [ 559.569242][T16253] netlink: 'syz.2.2673': attribute type 2 has an invalid length. [ 559.776526][T16263] tipc: Enabling of bearer rejected, already enabled [ 560.314646][T16287] netlink: 'syz.1.2684': attribute type 4 has an invalid length. [ 560.822344][T16324] __nla_validate_parse: 3 callbacks suppressed [ 560.822362][T16324] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2698'. [ 560.912449][T16332] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2695'. [ 560.976902][T16336] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2696'. [ 561.000990][T16338] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2699'. [ 561.015588][T16326] netlink: 'syz.3.2696': attribute type 1 has an invalid length. [ 561.025446][T16326] netlink: 5624 bytes leftover after parsing attributes in process `syz.3.2696'. [ 561.038687][T16338] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2699'. [ 561.170577][T16347] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2701'. [ 561.256488][T16354] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2703'. [ 561.389440][T16359] vlan3: entered promiscuous mode [ 561.401001][T16359] team0: entered promiscuous mode [ 561.759546][T16370] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2707'. [ 561.850656][T16378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2706'. [ 561.895945][T16378] netlink: 'syz.0.2706': attribute type 1 has an invalid length. [ 561.920245][T16385] siw: device registration error -23 [ 562.148114][T16397] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 562.155438][T16397] IPv6: NLM_F_CREATE should be set when creating new route [ 562.162697][T16397] IPv6: NLM_F_CREATE should be set when creating new route [ 562.477405][T16425] netlink: 'syz.0.2721': attribute type 30 has an invalid length. [ 562.705172][T16440] veth0_to_team: entered promiscuous mode [ 562.728595][T16440] veth0_to_team: entered allmulticast mode [ 562.741722][T16442] syzkaller1: entered promiscuous mode [ 562.751654][T16442] syzkaller1: entered allmulticast mode [ 562.760243][T16442] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 562.877487][T16450] FAULT_INJECTION: forcing a failure. [ 562.877487][T16450] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 562.912256][T16450] CPU: 0 UID: 0 PID: 16450 Comm: syz.0.2730 Not tainted syzkaller #0 PREEMPT(full) [ 562.912281][T16450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 562.912294][T16450] Call Trace: [ 562.912303][T16450] [ 562.912312][T16450] dump_stack_lvl+0x189/0x250 [ 562.912341][T16450] ? __pfx____ratelimit+0x10/0x10 [ 562.912369][T16450] ? __pfx_dump_stack_lvl+0x10/0x10 [ 562.912392][T16450] ? __pfx__printk+0x10/0x10 [ 562.912419][T16450] ? __might_fault+0xb0/0x130 [ 562.912459][T16450] should_fail_ex+0x414/0x560 [ 562.912489][T16450] _copy_from_user+0x2d/0xb0 [ 562.912512][T16450] ___sys_sendmsg+0x158/0x2a0 [ 562.912536][T16450] ? __pfx____sys_sendmsg+0x10/0x10 [ 562.912594][T16450] ? __fget_files+0x2a/0x420 [ 562.912623][T16450] ? __fget_files+0x3a0/0x420 [ 562.912663][T16450] __x64_sys_sendmsg+0x19b/0x260 [ 562.912686][T16450] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 562.912716][T16450] ? __pfx_ksys_write+0x10/0x10 [ 562.912740][T16450] ? rcu_is_watching+0x15/0xb0 [ 562.912765][T16450] ? do_syscall_64+0xbe/0x3b0 [ 562.912798][T16450] do_syscall_64+0xfa/0x3b0 [ 562.912824][T16450] ? lockdep_hardirqs_on+0x9c/0x150 [ 562.912857][T16450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.912876][T16450] ? clear_bhb_loop+0x60/0xb0 [ 562.912901][T16450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.912920][T16450] RIP: 0033:0x7f937018ebe9 [ 562.912936][T16450] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 562.912953][T16450] RSP: 002b:00007f9370f3d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.912974][T16450] RAX: ffffffffffffffda RBX: 00007f93703b5fa0 RCX: 00007f937018ebe9 [ 562.912989][T16450] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 562.913002][T16450] RBP: 00007f9370f3d090 R08: 0000000000000000 R09: 0000000000000000 [ 562.913014][T16450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 562.913025][T16450] R13: 00007f93703b6038 R14: 00007f93703b5fa0 R15: 00007ffefdc93d18 [ 562.913057][T16450] [ 563.359052][T16462] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 563.373088][T16462] tipc: Failed to remove unknown binding: 66,1,1/2886997007:457783859/457783861 [ 563.626510][T16479] macsec2: entered promiscuous mode [ 563.631912][T16479] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 563.645930][T16479] macsec2: entered allmulticast mode [ 563.663915][T16479] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 563.867536][T16491] pim6reg: entered allmulticast mode [ 564.154739][T16512] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 564.180505][T16459] tipc: Failed to remove unknown binding: 66,1,1/2886997007:457783859/457783861 [ 564.195979][T16459] tipc: Failed to remove unknown binding: 66,1,1/2886997007:457783859/457783861 [ 564.361429][T16505] lo speed is unknown, defaulting to 1000 [ 564.444799][T16521] ip6gre0: entered promiscuous mode [ 564.450132][T16521] ip6gre0: entered allmulticast mode [ 566.842128][T16548] __nla_validate_parse: 9 callbacks suppressed [ 566.842146][T16548] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2756'. [ 566.871292][T16548] vlan0: entered promiscuous mode [ 566.893810][T16548] bridge_slave_0: entered promiscuous mode [ 566.942063][T16539] lo speed is unknown, defaulting to 1000 [ 566.990368][T16553] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2757'. [ 567.001122][T16553] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2757'. [ 567.052803][T16553] team0: entered promiscuous mode [ 567.062323][T16553] bond3: entered promiscuous mode [ 567.071753][T16553] team0: left promiscuous mode [ 567.083609][T16553] bond3: left promiscuous mode [ 567.222261][T16565] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2760'. [ 567.231797][T16565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2760'. [ 567.277628][T16566] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2760'. [ 567.429273][T16557] lo speed is unknown, defaulting to 1000 [ 567.640087][T16582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2764'. [ 567.675329][T16582] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2764'. [ 568.702585][T16610] netlink: 'syz.4.2769': attribute type 1 has an invalid length. [ 568.726010][T16610] netlink: 'syz.4.2769': attribute type 3 has an invalid length. [ 568.743368][T16610] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2769'. [ 568.755041][T16607] tipc: Resetting bearer [ 568.766766][T16610] NCSI netlink: No device for ifindex 246 [ 568.826957][ T9985] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 568.856357][ T9985] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 568.900657][ T9985] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 568.931494][ T9985] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 569.038008][T16615] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2771'. [ 569.318456][T16632] netlink: 'syz.3.2778': attribute type 11 has an invalid length. [ 569.375192][T16638] netlink: 'syz.1.2779': attribute type 1 has an invalid length. [ 569.891756][T16675] netlink: 'syz.4.2789': attribute type 2 has an invalid length. [ 569.921722][T16675] þ: entered promiscuous mode [ 569.988728][T16677] lo speed is unknown, defaulting to 1000 [ 570.041908][T16683] netlink: 'syz.4.2792': attribute type 1 has an invalid length. [ 570.100618][T16685] tipc: Resetting bearer [ 570.122679][T16682] netlink: 'syz.2.2791': attribute type 10 has an invalid length. [ 570.149781][T16682] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 570.231908][T16693] FAULT_INJECTION: forcing a failure. [ 570.231908][T16693] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 570.253382][T16693] CPU: 0 UID: 0 PID: 16693 Comm: syz.0.2795 Not tainted syzkaller #0 PREEMPT(full) [ 570.253408][T16693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 570.253420][T16693] Call Trace: [ 570.253428][T16693] [ 570.253436][T16693] dump_stack_lvl+0x189/0x250 [ 570.253465][T16693] ? __pfx____ratelimit+0x10/0x10 [ 570.253492][T16693] ? __pfx_dump_stack_lvl+0x10/0x10 [ 570.253516][T16693] ? __pfx__printk+0x10/0x10 [ 570.253557][T16693] should_fail_ex+0x414/0x560 [ 570.253588][T16693] _copy_to_user+0x31/0xb0 [ 570.253613][T16693] simple_read_from_buffer+0xe1/0x170 [ 570.253647][T16693] proc_fail_nth_read+0x1b3/0x220 [ 570.253673][T16693] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 570.253699][T16693] ? rw_verify_area+0x2a6/0x4d0 [ 570.253723][T16693] ? __lock_acquire+0xab9/0xd20 [ 570.253749][T16693] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 570.253776][T16693] vfs_read+0x200/0xa30 [ 570.253800][T16693] ? fdget_pos+0x247/0x320 [ 570.253820][T16693] ? __pfx___mutex_lock+0x10/0x10 [ 570.253849][T16693] ? __pfx_vfs_read+0x10/0x10 [ 570.253876][T16693] ? __fget_files+0x2a/0x420 [ 570.253910][T16693] ? __fget_files+0x3a0/0x420 [ 570.253938][T16693] ? __fget_files+0x2a/0x420 [ 570.253978][T16693] ksys_read+0x145/0x250 [ 570.254006][T16693] ? __pfx_ksys_read+0x10/0x10 [ 570.254029][T16693] ? rcu_is_watching+0x15/0xb0 [ 570.254054][T16693] ? do_syscall_64+0xbe/0x3b0 [ 570.254088][T16693] do_syscall_64+0xfa/0x3b0 [ 570.254114][T16693] ? lockdep_hardirqs_on+0x9c/0x150 [ 570.254141][T16693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.254160][T16693] ? clear_bhb_loop+0x60/0xb0 [ 570.254184][T16693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.254203][T16693] RIP: 0033:0x7f937018d5fc [ 570.254221][T16693] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 570.254237][T16693] RSP: 002b:00007f9370f3d030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 570.254258][T16693] RAX: ffffffffffffffda RBX: 00007f93703b5fa0 RCX: 00007f937018d5fc [ 570.254289][T16693] RDX: 000000000000000f RSI: 00007f9370f3d0a0 RDI: 0000000000000004 [ 570.254302][T16693] RBP: 00007f9370f3d090 R08: 0000000000000000 R09: 0000000000000000 [ 570.254326][T16693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 570.254346][T16693] R13: 00007f93703b6038 R14: 00007f93703b5fa0 R15: 00007ffefdc93d18 [ 570.254382][T16693] [ 570.583543][T16680] lo speed is unknown, defaulting to 1000 [ 570.792107][T16703] 8021q: adding VLAN 0 to HW filter on device bond5 [ 570.934095][T16708] bond5: (slave bridge11): Enslaving as an active interface with an up link [ 570.942548][T16715] netlink: 'syz.3.2799': attribute type 1 has an invalid length. [ 571.182951][T16720] dvmrp8: entered allmulticast mode [ 571.221195][T16711] dvmrp8: left allmulticast mode [ 571.328409][T16727] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 571.340690][T16724] bond5: (slave bridge11): Releasing backup interface [ 571.685867][T16743] nbd: must specify at least one socket [ 572.013514][T16759] IPVS: set_ctl: invalid protocol: 113 224.0.0.1:20000 [ 572.031326][T16763] __nla_validate_parse: 16 callbacks suppressed [ 572.031343][T16763] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2812'. [ 572.069064][T16764] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2813'. [ 572.091615][T16763] lo speed is unknown, defaulting to 1000 [ 573.061554][T16786] openvswitch: netlink: ufid size 18 bytes exceeds the range (1, 16) [ 573.071386][T16786] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 573.256479][T16799] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2823'. [ 573.399166][T16809] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2825'. [ 573.568876][T16816] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2827'. [ 573.611204][T16816] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2827'. [ 573.638094][T16822] dummy0: left allmulticast mode [ 573.653311][T16820] netlink: 'syz.1.2829': attribute type 13 has an invalid length. [ 573.662934][T16820] netlink: 'syz.1.2829': attribute type 17 has an invalid length. [ 573.691101][T16820] 8021q: adding VLAN 0 to HW filter on device team0 [ 573.867717][T16820] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 573.962180][T16831] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2832'. [ 574.035059][T16834] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2833'. [ 574.061012][T16836] sctp: [Deprecated]: syz.4.2832 (pid 16836) Use of int in max_burst socket option. [ 574.061012][T16836] Use struct sctp_assoc_value instead [ 574.081403][T16837] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2834'. [ 574.408089][T16856] netlink: 'syz.4.2840': attribute type 6 has an invalid length. [ 574.857558][T16880] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2846'. [ 574.912529][T16879] wireguard0: entered promiscuous mode [ 574.935846][T16879] wireguard0: entered allmulticast mode [ 575.109346][T16893] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 575.119583][T16893] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 575.157325][T16897] netlink: 'syz.2.2849': attribute type 4 has an invalid length. [ 575.172799][T16897] netlink: 'syz.2.2849': attribute type 4 has an invalid length. [ 575.356004][T16906] bridge0: port 1(macvlan4) entered blocking state [ 575.364019][T16906] bridge0: port 1(macvlan4) entered disabled state [ 575.375242][T16906] macvlan4: entered allmulticast mode [ 575.386094][T16906] macvlan4: left allmulticast mode [ 575.531744][T16917] netlink: 'syz.0.2857': attribute type 12 has an invalid length. [ 575.601550][T16923] netlink: 'syz.3.2859': attribute type 10 has an invalid length. [ 575.617119][T16923] bond0: (slave netdevsim0): Enslaving as an active interface with a down link [ 576.079735][T16951] netlink: 'syz.2.2863': attribute type 29 has an invalid length. [ 576.103494][T16951] netlink: 'syz.2.2863': attribute type 29 has an invalid length. [ 576.134653][T16951] unsupported nla_type 58 [ 576.459607][T16974] bridge0: failed insert local address into bridge forwarding table [ 576.910912][T17000] netlink: 'syz.2.2878': attribute type 2 has an invalid length. [ 576.938364][T17000] netlink: 'syz.2.2878': attribute type 2 has an invalid length. [ 576.948561][T17003] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 577.037881][T17007] netlink: 'syz.2.2881': attribute type 16 has an invalid length. [ 577.290575][T17019] __nla_validate_parse: 24 callbacks suppressed [ 577.290597][T17019] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2883'. [ 577.334699][T17024] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2882'. [ 577.388658][ T49] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.404787][ T49] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.414274][ T49] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.422740][ T49] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.695217][T17037] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2886'. [ 577.963515][T17052] tipc: Enabled bearer , priority 0 [ 577.995683][T17052] syzkaller0: entered promiscuous mode [ 578.001206][T17052] syzkaller0: entered allmulticast mode [ 578.053897][T17052] tipc: Resetting bearer [ 578.076579][T17052] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2893'. [ 578.157142][T17051] tipc: Resetting bearer [ 578.329984][T17051] tipc: Disabling bearer [ 578.477400][T17080] syzkaller1: entered promiscuous mode [ 578.483112][T17080] syzkaller1: entered allmulticast mode [ 578.775033][T17091] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2902'. [ 578.950273][T17103] wg0 speed is unknown, defaulting to 1000 [ 578.981706][T17103] wg0 speed is unknown, defaulting to 1000 [ 579.026916][T17103] wg0 speed is unknown, defaulting to 1000 [ 579.323547][ T5868] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 579.342728][ T5868] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 579.351933][ T5868] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 579.385764][ T5868] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 579.393551][ T5868] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 579.465670][T17124] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2910'. [ 579.478938][T17119] lo speed is unknown, defaulting to 1000 [ 579.511554][ T9984] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 579.533908][ T9984] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 579.555869][T17124] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2910'. [ 579.562499][ T9984] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 579.583628][ T9984] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 579.628828][T17124] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2910'. [ 579.796658][T17134] [ 579.799022][T17134] ====================================================== [ 579.806045][T17134] WARNING: possible circular locking dependency detected [ 579.813080][T17134] syzkaller #0 Not tainted [ 579.817499][T17134] ------------------------------------------------------ [ 579.824519][T17134] syz.3.2913/17134 is trying to acquire lock: [ 579.830582][T17134] ffffffff8f68d298 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x390/0xd50 [ 579.839592][T17103] infiniband syz2: set down [ 579.839738][T17134] [ 579.839738][T17134] but task is already holding lock: [ 579.844286][ T9] wg0 speed is unknown, defaulting to 1000 [ 579.851585][T17134] ffff888031c11b70 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x193/0xd50 [ 579.851637][T17134] [ 579.851637][T17134] which lock already depends on the new lock. [ 579.851637][T17134] [ 579.851645][T17134] [ 579.851645][T17134] the existing dependency chain (in reverse order) is: [ 579.851653][T17134] [ 579.851653][T17134] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 579.851679][T17134] lock_acquire+0x120/0x360 [ 579.851704][T17134] _raw_spin_lock_bh+0x36/0x50 [ 579.904270][T17134] nr_rt_device_down+0x12a/0x720 [ 579.909727][T17134] nr_device_event+0x137/0x150 [ 579.915003][T17134] notifier_call_chain+0x1b3/0x3e0 [ 579.920628][T17134] netif_close_many+0x29c/0x410 [ 579.926018][T17134] netif_close+0x158/0x210 [ 579.930959][T17134] dev_close+0x10a/0x220 [ 579.935811][T17134] bpq_device_event+0x377/0x6a0 [ 579.941183][T17134] notifier_call_chain+0x1b3/0x3e0 [ 579.946808][T17134] __dev_notify_flags+0x18d/0x2e0 [ 579.952352][T17134] netif_change_flags+0xe8/0x1a0 [ 579.957811][T17134] dev_change_flags+0x130/0x260 [ 579.963191][T17134] dev_ioctl+0x7b4/0x1150 [ 579.968040][T17134] sock_do_ioctl+0x22c/0x300 [ 579.973146][T17134] sock_ioctl+0x576/0x790 [ 579.977987][T17134] __se_sys_ioctl+0xfc/0x170 [ 579.983096][T17134] do_syscall_64+0xfa/0x3b0 [ 579.988120][T17134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.994530][T17134] [ 579.994530][T17134] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 580.002347][T17134] lock_acquire+0x120/0x360 [ 580.007379][T17134] _raw_spin_lock_bh+0x36/0x50 [ 580.012662][T17134] nr_rt_device_down+0xa9/0x720 [ 580.018028][T17134] nr_device_event+0x137/0x150 [ 580.023302][T17134] notifier_call_chain+0x1b3/0x3e0 [ 580.028941][T17134] netif_close_many+0x29c/0x410 [ 580.034320][T17134] netif_close+0x158/0x210 [ 580.039258][T17134] dev_close+0x10a/0x220 [ 580.044021][T17134] bpq_device_event+0x377/0x6a0 [ 580.049397][T17134] notifier_call_chain+0x1b3/0x3e0 [ 580.055022][T17134] __dev_notify_flags+0x18d/0x2e0 [ 580.060560][T17134] netif_change_flags+0xe8/0x1a0 [ 580.066029][T17134] dev_change_flags+0x130/0x260 [ 580.071399][T17134] dev_ioctl+0x7b4/0x1150 [ 580.076246][T17134] sock_do_ioctl+0x22c/0x300 [ 580.081358][T17134] sock_ioctl+0x576/0x790 [ 580.086208][T17134] __se_sys_ioctl+0xfc/0x170 [ 580.091318][T17134] do_syscall_64+0xfa/0x3b0 [ 580.096344][T17134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.102750][T17134] [ 580.102750][T17134] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 580.110652][T17134] validate_chain+0xb9b/0x2140 [ 580.115944][T17134] __lock_acquire+0xab9/0xd20 [ 580.121157][T17134] lock_acquire+0x120/0x360 [ 580.126198][T17134] _raw_spin_lock_bh+0x36/0x50 [ 580.131506][T17134] nr_rt_ioctl+0x390/0xd50 [ 580.136455][T17134] sock_do_ioctl+0xd9/0x300 [ 580.141478][T17134] sock_ioctl+0x576/0x790 [ 580.146330][T17134] __se_sys_ioctl+0xfc/0x170 [ 580.151446][T17134] do_syscall_64+0xfa/0x3b0 [ 580.156482][T17134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.162898][T17134] [ 580.162898][T17134] other info that might help us debug this: [ 580.162898][T17134] [ 580.173120][T17134] Chain exists of: [ 580.173120][T17134] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 580.173120][T17134] [ 580.186954][T17134] Possible unsafe locking scenario: [ 580.186954][T17134] [ 580.194400][T17134] CPU0 CPU1 [ 580.199759][T17134] ---- ---- [ 580.205116][T17134] lock(&nr_node->node_lock); [ 580.209978][T17134] lock(nr_node_list_lock); [ 580.217083][T17134] lock(&nr_node->node_lock); [ 580.224361][T17134] lock(nr_neigh_list_lock); [ 580.229034][T17134] [ 580.229034][T17134] *** DEADLOCK *** [ 580.229034][T17134] [ 580.237177][T17134] 2 locks held by syz.3.2913/17134: [ 580.242364][T17134] #0: ffffffff8f68d2f8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x104/0xd50 [ 580.251855][T17134] #1: ffff888031c11b70 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x193/0xd50 [ 580.261516][T17134] [ 580.261516][T17134] stack backtrace: [ 580.267395][T17134] CPU: 1 UID: 0 PID: 17134 Comm: syz.3.2913 Not tainted syzkaller #0 PREEMPT(full) [ 580.267417][T17134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 580.267429][T17134] Call Trace: [ 580.267439][T17134] [ 580.267448][T17134] dump_stack_lvl+0x189/0x250 [ 580.267474][T17134] ? __pfx_dump_stack_lvl+0x10/0x10 [ 580.267496][T17134] ? __pfx__printk+0x10/0x10 [ 580.267521][T17134] ? stack_trace_save+0x9c/0xe0 [ 580.267551][T17134] print_circular_bug+0x2ee/0x310 [ 580.267574][T17134] check_noncircular+0x134/0x160 [ 580.267599][T17134] validate_chain+0xb9b/0x2140 [ 580.267630][T17134] __lock_acquire+0xab9/0xd20 [ 580.267661][T17134] ? nr_rt_ioctl+0x390/0xd50 [ 580.267683][T17134] lock_acquire+0x120/0x360 [ 580.267709][T17134] ? nr_rt_ioctl+0x390/0xd50 [ 580.267733][T17134] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 580.267759][T17134] ? nr_rt_ioctl+0x390/0xd50 [ 580.267781][T17134] _raw_spin_lock_bh+0x36/0x50 [ 580.267803][T17134] ? nr_rt_ioctl+0x390/0xd50 [ 580.267825][T17134] nr_rt_ioctl+0x390/0xd50 [ 580.267854][T17134] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 580.267882][T17134] ? apparmor_capable+0x137/0x1b0 [ 580.267908][T17134] ? capable+0x89/0xe0 [ 580.267927][T17134] ? nr_ioctl+0x1b1/0x3b0 [ 580.267941][T17134] sock_do_ioctl+0xd9/0x300 [ 580.267962][T17134] ? __pfx_sock_do_ioctl+0x10/0x10 [ 580.267980][T17134] ? __lock_acquire+0xab9/0xd20 [ 580.268007][T17134] sock_ioctl+0x576/0x790 [ 580.268043][T17134] ? __pfx_sock_ioctl+0x10/0x10 [ 580.268062][T17134] ? __fget_files+0x2a/0x420 [ 580.268086][T17134] ? __fget_files+0x3a0/0x420 [ 580.268110][T17134] ? __fget_files+0x2a/0x420 [ 580.268135][T17134] ? bpf_lsm_file_ioctl+0x9/0x20 [ 580.268155][T17134] ? __pfx_sock_ioctl+0x10/0x10 [ 580.268174][T17134] __se_sys_ioctl+0xfc/0x170 [ 580.268194][T17134] do_syscall_64+0xfa/0x3b0 [ 580.268217][T17134] ? lockdep_hardirqs_on+0x9c/0x150 [ 580.268239][T17134] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.268255][T17134] ? clear_bhb_loop+0x60/0xb0 [ 580.268272][T17134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.268288][T17134] RIP: 0033:0x7f452378ebe9 [ 580.268318][T17134] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 580.268332][T17134] RSP: 002b:00007f452452e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 580.268349][T17134] RAX: ffffffffffffffda RBX: 00007f45239b5fa0 RCX: 00007f452378ebe9 [ 580.268362][T17134] RDX: 0000000000000000 RSI: 00000000000089e2 RDI: 000000000000000b [ 580.268372][T17134] RBP: 00007f4523811e19 R08: 0000000000000000 R09: 0000000000000000 [ 580.268382][T17134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 580.268391][T17134] R13: 00007f45239b6038 R14: 00007f45239b5fa0 R15: 00007fff6a92a7e8 [ 580.268410][T17134] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 580.555032][T17136] lo speed is unknown, defaulting to 1000 [ 580.637657][T17142] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2915'. [ 580.642146][T17136] wg0 speed is unknown, defaulting to 1000 [ 580.655589][T17103] infiniband syz2: added wg0 [ 580.660551][T17103] syz2: rxe_create_cq: returned err = -12 [ 580.677078][T17103] infiniband syz2: Couldn't create ib_mad CQ [ 580.683296][T17103] infiniband syz2: Couldn't open port 1 [ 580.778735][T17103] RDS/IB: syz2: added [ 580.782783][T17103] smc: adding ib device syz2 with port count 1 [ 580.835491][T17103] smc: ib device syz2 port 1 has pnetid [ 580.870909][ T981] wg0 speed is unknown, defaulting to 1000 [ 580.890839][T17103] wg0 speed is unknown, defaulting to 1000 [ 581.444819][ T5182] Bluetooth: hci5: command tx timeout [ 581.622174][ T9985] team0: Port device bridge9 removed [ 581.778122][ T9985] bond0 (unregistering): Released all slaves [ 581.787274][ T9985] bond1 (unregistering): Released all slaves [ 581.797859][ T9985] bond2 (unregistering): Released all slaves [ 581.877716][ T9985] bond3 (unregistering): Released all slaves [ 581.887506][ T9985] bond4 (unregistering): Released all slaves [ 581.966681][ T9985] bond5 (unregistering): Released all slaves [ 582.041500][ T9985] bond6 (unregistering): Released all slaves [ 582.050875][ T9985] bond7 (unregistering): Released all slaves [ 582.078606][T17103] wg0 speed is unknown, defaulting to 1000 [ 582.151683][ T9985] k›*·]‘: left promiscuous mode [ 582.195938][ T9985] þ: left promiscuous mode [ 582.207300][T17103] wg0 speed is unknown, defaulting to 1000 [ 582.272311][ T9985] tipc: Disabling bearer [ 582.277767][ T9985] tipc: Left network mode [ 582.291316][T17103] wg0 speed is unknown, defaulting to 1000 [ 582.380554][T17103] wg0 speed is unknown, defaulting to 1000 [ 582.459053][T17103] wg0 speed is unknown, defaulting to 1000 [ 582.986532][ T9985] hsr_slave_0: left promiscuous mode [ 582.992177][ T9985] hsr_slave_1: left promiscuous mode [ 583.525529][ T5182] Bluetooth: hci5: command tx timeout [ 583.657038][ T9985] IPVS: stop unused estimator thread 0... [ 583.736645][ T9728] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.796293][ T9728] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.876907][ T9728] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.926289][ T9728] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.994170][ T9728] bond5: left allmulticast mode [ 583.999167][ T9728] bond5: left promiscuous mode [ 584.004129][ T9728] bridge0: port 1(bond5) entered disabled state [ 584.148871][ T9728] dvmrp1 (unregistering): left allmulticast mode [ 584.197996][ T9728] tipc: Disabling bearer [ 584.374397][ T9728] smc: removing net device bond0 with user defined pnetid SYZ2 [ 584.382129][ T9728] bond0 (unregistering): Released all slaves [ 584.456937][ T9728] bond1 (unregistering): Released all slaves [ 584.528583][ T9728] bond2 (unregistering): Released all slaves [ 584.539164][ T9728] bond3 (unregistering): Released all slaves [ 584.548554][ T9728] bond4 (unregistering): Released all slaves [ 584.620949][ T9728] bond5 (unregistering): Released all slaves [ 584.630193][ T9728] bond6 (unregistering): Released all slaves [ 584.703072][ T9728] tipc: Disabling bearer [ 584.708783][ T9728] tipc: Left network mode [ 584.728416][ T9728] IPVS: stopping master sync thread 7367 ... [ 584.735247][ T9728] IPVS: stopping backup sync thread 17003 ... [ 585.258794][ T9728] hsr_slave_0: left promiscuous mode [ 585.264693][ T9728] hsr_slave_1: left promiscuous mode [ 585.892949][ T9728] ------------[ cut here ]------------ [ 585.898518][ T9728] WARNING: CPU: 0 PID: 9728 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0x26d/0x2f0 [ 585.908143][ T9728] Modules linked in: [ 585.912044][ T9728] CPU: 0 UID: 0 PID: 9728 Comm: kworker/u8:14 Not tainted syzkaller #0 PREEMPT(full) [ 585.921622][ T9728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 585.931759][ T9728] Workqueue: netns cleanup_net [ 585.936584][ T9728] RIP: 0010:xfrm_state_fini+0x26d/0x2f0 [ 585.942179][ T9728] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 cb 1b 01 f8 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 89 dc e1 f7 e8 64 b2 9d f7 90 <0f> 0b 90 e9 fd fd ff ff e8 56 b2 9d f7 90 0f 0b 90 e9 60 fe ff ff [ 585.961863][ T9728] RSP: 0018:ffffc9000bc27898 EFLAGS: 00010293 [ 585.967957][ T9728] RAX: ffffffff8a21f9cc RBX: ffff888032c58000 RCX: ffff888030b9bc00 [ 585.975965][ T9728] RDX: 0000000000000000 RSI: ffffffff8be332e0 RDI: ffff888030b9bc00 [ 585.983968][ T9728] RBP: ffffc9000bc279b0 R08: ffffffff8fa37e37 R09: 1ffffffff1f46fc6 [ 585.991932][ T9728] R10: dffffc0000000000 R11: fffffbfff1f46fc7 R12: ffffffff8f630aa0 [ 585.999960][ T9728] R13: 1ffff92001784f40 R14: ffff888032c59480 R15: dffffc0000000000 [ 586.008017][ T9728] FS: 0000000000000000(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 [ 586.017010][ T9728] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 586.023609][ T9728] CR2: 00007f03728d1140 CR3: 000000000df36000 CR4: 00000000003526f0 [ 586.031637][ T9728] Call Trace: [ 586.034958][ T9728] [ 586.037900][ T9728] xfrm_net_exit+0x2d/0x70 [ 586.042338][ T9728] ops_undo_list+0x49a/0x990 [ 586.046994][ T9728] ? __pfx_ops_undo_list+0x10/0x10 [ 586.052136][ T9728] ? do_raw_spin_unlock+0x122/0x240 [ 586.057375][ T9728] cleanup_net+0x4c5/0x800 [ 586.061816][ T9728] ? __pfx_cleanup_net+0x10/0x10 [ 586.066785][ T9728] ? rcu_is_watching+0x15/0xb0 [ 586.071562][ T9728] ? process_scheduled_works+0x9ef/0x17b0 [ 586.077309][ T9728] ? process_scheduled_works+0x9ef/0x17b0 [ 586.083039][ T9728] process_scheduled_works+0xae1/0x17b0 [ 586.088673][ T9728] ? __pfx_process_scheduled_works+0x10/0x10 [ 586.094688][ T9728] worker_thread+0x8a0/0xda0 [ 586.099279][ T9728] kthread+0x711/0x8a0 [ 586.103389][ T9728] ? __pfx_worker_thread+0x10/0x10 [ 586.108523][ T9728] ? __pfx_kthread+0x10/0x10 [ 586.113128][ T9728] ? _raw_spin_unlock_irq+0x23/0x50 [ 586.118354][ T9728] ? lockdep_hardirqs_on+0x9c/0x150 [ 586.123565][ T9728] ? __pfx_kthread+0x10/0x10 [ 586.128208][ T9728] ret_from_fork+0x3f9/0x770 [ 586.132817][ T9728] ? __pfx_ret_from_fork+0x10/0x10 [ 586.137984][ T9728] ? __switch_to_asm+0x39/0x70 [ 586.142790][ T9728] ? __switch_to_asm+0x33/0x70 [ 586.147590][ T9728] ? __pfx_kthread+0x10/0x10 [ 586.152222][ T9728] ret_from_fork_asm+0x1a/0x30 [ 586.157094][ T9728] [ 586.160130][ T9728] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 586.167411][ T9728] CPU: 0 UID: 0 PID: 9728 Comm: kworker/u8:14 Not tainted syzkaller #0 PREEMPT(full) [ 586.176952][ T9728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 586.187005][ T9728] Workqueue: netns cleanup_net [ 586.191783][ T9728] Call Trace: [ 586.195062][ T9728] [ 586.197997][ T9728] dump_stack_lvl+0x99/0x250 [ 586.202593][ T9728] ? __asan_memcpy+0x40/0x70 [ 586.207189][ T9728] ? __pfx_dump_stack_lvl+0x10/0x10 [ 586.212389][ T9728] ? __pfx__printk+0x10/0x10 [ 586.216998][ T9728] vpanic+0x281/0x750 [ 586.220985][ T9728] ? __pfx__printk+0x10/0x10 [ 586.225585][ T9728] ? __pfx_vpanic+0x10/0x10 [ 586.230121][ T9728] ? is_bpf_text_address+0x292/0x2b0 [ 586.235425][ T9728] panic+0xb9/0xc0 [ 586.239191][ T9728] ? __pfx_panic+0x10/0x10 [ 586.243616][ T9728] __warn+0x31b/0x4b0 [ 586.247604][ T9728] ? xfrm_state_fini+0x26d/0x2f0 [ 586.252564][ T9728] ? xfrm_state_fini+0x26d/0x2f0 [ 586.257507][ T9728] report_bug+0x2be/0x4f0 [ 586.261839][ T9728] ? xfrm_state_fini+0x26d/0x2f0 [ 586.266778][ T9728] ? xfrm_state_fini+0x26d/0x2f0 [ 586.271715][ T9728] ? xfrm_state_fini+0x26f/0x2f0 [ 586.276674][ T9728] handle_bug+0x84/0x160 [ 586.280916][ T9728] exc_invalid_op+0x1a/0x50 [ 586.285415][ T9728] asm_exc_invalid_op+0x1a/0x20 [ 586.290270][ T9728] RIP: 0010:xfrm_state_fini+0x26d/0x2f0 [ 586.295821][ T9728] Code: c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 cb 1b 01 f8 48 8b 3b 5b 41 5c 41 5d 41 5e 41 5f 5d e9 89 dc e1 f7 e8 64 b2 9d f7 90 <0f> 0b 90 e9 fd fd ff ff e8 56 b2 9d f7 90 0f 0b 90 e9 60 fe ff ff [ 586.315430][ T9728] RSP: 0018:ffffc9000bc27898 EFLAGS: 00010293 [ 586.321504][ T9728] RAX: ffffffff8a21f9cc RBX: ffff888032c58000 RCX: ffff888030b9bc00 [ 586.329517][ T9728] RDX: 0000000000000000 RSI: ffffffff8be332e0 RDI: ffff888030b9bc00 [ 586.337488][ T9728] RBP: ffffc9000bc279b0 R08: ffffffff8fa37e37 R09: 1ffffffff1f46fc6 [ 586.345462][ T9728] R10: dffffc0000000000 R11: fffffbfff1f46fc7 R12: ffffffff8f630aa0 [ 586.353450][ T9728] R13: 1ffff92001784f40 R14: ffff888032c59480 R15: dffffc0000000000 [ 586.361448][ T9728] ? xfrm_state_fini+0x26c/0x2f0 [ 586.366415][ T9728] ? xfrm_state_fini+0x26c/0x2f0 [ 586.371358][ T9728] xfrm_net_exit+0x2d/0x70 [ 586.375789][ T9728] ops_undo_list+0x49a/0x990 [ 586.380384][ T9728] ? __pfx_ops_undo_list+0x10/0x10 [ 586.385523][ T9728] ? do_raw_spin_unlock+0x122/0x240 [ 586.390735][ T9728] cleanup_net+0x4c5/0x800 [ 586.395157][ T9728] ? __pfx_cleanup_net+0x10/0x10 [ 586.400100][ T9728] ? rcu_is_watching+0x15/0xb0 [ 586.404860][ T9728] ? process_scheduled_works+0x9ef/0x17b0 [ 586.410585][ T9728] ? process_scheduled_works+0x9ef/0x17b0 [ 586.416558][ T9728] process_scheduled_works+0xae1/0x17b0 [ 586.422109][ T9728] ? __pfx_process_scheduled_works+0x10/0x10 [ 586.428095][ T9728] worker_thread+0x8a0/0xda0 [ 586.432690][ T9728] kthread+0x711/0x8a0 [ 586.436765][ T9728] ? __pfx_worker_thread+0x10/0x10 [ 586.441871][ T9728] ? __pfx_kthread+0x10/0x10 [ 586.446458][ T9728] ? _raw_spin_unlock_irq+0x23/0x50 [ 586.451652][ T9728] ? lockdep_hardirqs_on+0x9c/0x150 [ 586.456853][ T9728] ? __pfx_kthread+0x10/0x10 [ 586.461458][ T9728] ret_from_fork+0x3f9/0x770 [ 586.466053][ T9728] ? __pfx_ret_from_fork+0x10/0x10 [ 586.471163][ T9728] ? __switch_to_asm+0x39/0x70 [ 586.475935][ T9728] ? __switch_to_asm+0x33/0x70 [ 586.480699][ T9728] ? __pfx_kthread+0x10/0x10 [ 586.485294][ T9728] ret_from_fork_asm+0x1a/0x30 [ 586.490098][ T9728] [ 586.493465][ T9728] Kernel Offset: disabled [ 586.497788][ T9728] Rebooting in 86400 seconds..