last executing test programs: 2m56.796079348s ago: executing program 1 (id=2054): r0 = socket$rds(0x15, 0x5, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7a1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xc7df}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xf92}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x200}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}]}, 0x68}}, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000180), r1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000001c0)=0x0) sendmsg$NFC_CMD_DEP_LINK_DOWN(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r4, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [@NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008080}, 0x4080) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r6, 0x300, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_TDLS_ACTION={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r7) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000480)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2}, 0x50) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000500)=@o_path={&(0x7f0000000440)='./file0\x00', r8, 0x4000, r2}, 0x18) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x6, 0x13, r7, 0xb9a36000) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), r7) sendmsg$ETHTOOL_MSG_EEE_SET(r7, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r9, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x40084) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000006c0)=@filter={'filter\x00', 0xe, 0x4, 0x458, 0xffffffff, 0xd0, 0xd0, 0x0, 0xffffffff, 0xffffffff, 0x388, 0x388, 0x388, 0xffffffff, 0x4, &(0x7f0000000680), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x3, 0x2}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xffffffff, 0xffffff00, 0xff000000], [0x0, 0xff000000, 0xffffff00, 0xff], 'ip6erspan0\x00', 'wg1\x00', {}, {}, 0x29, 0x80, 0x4, 0x8}, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x2, 0x9, 0x2, 0x0, 'syz1\x00', 0x40}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x9, 0x3}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0x0, 0xffffffff, 0xffffffff, 0xff], [0x0, 0xff], 'macvtap0\x00', 'team_slave_1\x00', {0xff}, {0xff}, 0x2b, 0xe, 0x4, 0x5a}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'veth1_to_batadv\x00', {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) r10 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000bc0), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r1, &(0x7f0000000cc0)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x488020}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c00)={0x4c, r10, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010100}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @remote}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @local}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10080}, 0x4080) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d40), r7) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000e00)={'ip6gre0\x00', &(0x7f0000000d80)={'syztnl2\x00', 0x0, 0x4, 0x7, 0x3, 0x0, 0x0, @mcast2, @mcast1, 0x8, 0x7807, 0x7, 0x7fff}}) getsockopt$PNPIPE_IFINDEX(r3, 0x113, 0x2, &(0x7f0000000e40)=0x0, &(0x7f0000000e80)=0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000ec0)={'vxcan0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001200)={0xffffffffffffffff, 0xe0, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000f00)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, &(0x7f0000000f40)=[0x0, 0x0, 0x0], &(0x7f0000000f80)=[0x0], 0x0, 0x68, &(0x7f0000000fc0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f0000001040), &(0x7f0000001080), 0x8, 0x7b, 0x8, 0x8, &(0x7f00000010c0)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000012c0)={'ip6_vti0\x00', &(0x7f0000001240)={'ip6gre0\x00', 0x0, 0x2f, 0xc6, 0x3, 0xffff83a4, 0x2a, @dev={0xfe, 0x80, '\x00', 0x21}, @rand_addr=' \x01\x00', 0x7, 0x10, 0x1, 0x76}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000001380)={'syztnl0\x00', &(0x7f0000001300)={'syztnl1\x00', 0x0, 0x4, 0x8, 0x7, 0x3, 0x44, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @loopback, 0x700, 0x8000, 0x77}}) getpeername$packet(0xffffffffffffffff, &(0x7f00000013c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001400)=0x14) sendmsg$ETHTOOL_MSG_EEE_GET(r7, &(0x7f0000001580)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001540)={&(0x7f0000001440)={0xec, r11, 0x4, 0x70bd2b, 0x25dfdbff, {}, [@HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r18}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x88}, 0x40044) sendmsg$ETHTOOL_MSG_COALESCE_SET(r7, &(0x7f0000001740)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001700)={&(0x7f0000001640)={0xa0, r11, 0x202, 0x70bd29, 0x25dfdbfe, {}, [@ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_HIGH={0x8, 0x14, 0x9}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_TX={0x5}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x80000001}, @ETHTOOL_A_COALESCE_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_TX={0x5}, @ETHTOOL_A_COALESCE_TX_USECS_IRQ={0x8, 0x8, 0x6}, @ETHTOOL_A_COALESCE_TX_USECS_LOW={0x8, 0x10, 0x7}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) 2m56.605384708s ago: executing program 1 (id=2058): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x8, 0x16, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7}, @map_fd={0x18, 0x8}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffffb}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x4}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x13, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000140)={0x3, 0xd, 0x5, 0xd41}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000240)=0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x24, r2, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3e}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40085}, 0x4000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0e0077550001000000bd", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275c, 0x0) socket$kcm(0x29, 0x2, 0x0) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f00000001c0)={0x1adbc, 0x1004, 0x0, 0x7, 0x1}) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r7 = accept4$netrom(r6, &(0x7f0000000240)={{0x3, @default}, [@rose, @null, @remote, @null, @rose, @bcast, @rose, @null]}, &(0x7f00000002c0)=0x48, 0x0) ioctl$int_in(r7, 0x5421, &(0x7f0000000340)=0xfa36) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8, @ANYRESHEX=r6], 0x48}}, 0x0) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r11, 0x100) accept4(r11, 0x0, 0x0, 0x0) shutdown(r11, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x28}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x5, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r10}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x5, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001680)={0x6, 0x5, &(0x7f0000001440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, [@exit, @generic={0x8, 0x6, 0xc, 0xfffc, 0x62e}]}, &(0x7f0000001480)='syzkaller\x00', 0x4, 0xd3, &(0x7f00000014c0)=""/211, 0x0, 0x11, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000015c0)={0x1, 0x3, 0x80, 0x9912}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000001600)=[r3], &(0x7f0000001640)=[{0x1, 0x5, 0x1, 0x2}, {0x5, 0x1, 0xf}, {0x2, 0x5, 0x4}, {0x4, 0x2, 0xf, 0xa}], 0x10, 0x4}, 0x94) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5000943f, &(0x7f0000000300)={{r0}, r1, 0x0, @inherit={0x60, &(0x7f0000000280)={0x0, 0x3, 0x8b4, 0x73, {0x0, 0x80, 0x6, 0x7}, [0x4, 0x93bf, 0x7]}}, @subvolid=0xb}) openat$tun(0xffffffffffffff9c, &(0x7f0000001740), 0x10902, 0x0) 2m55.618684724s ago: executing program 1 (id=2072): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@multicast1, @in6=@mcast2, 0x4, 0xb6e, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@loopback, 0x4d4, 0x32}, @in=@rand_addr=0x64010101, {0x0, 0x0, 0x1, 0x8000000000000001, 0xfffffffeffffffff, 0x10, 0x8001, 0x543}, {0x4, 0x7fffffffffffffff, 0xb, 0xfffffffffffffffd}, {0x0, 0xe}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x50}}, 0xf0}, 0x1, 0x0, 0x0, 0x880}, 0x2094) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="74000000010701030000000000000000030000040900010073797a3100000000540007800800024000000002080002400000b55a0800014000000001080001400000000108000240000000070800014000000006080001400000000808000240ffffdfda0800014000e000000806"], 0x74}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c0000004900010000000000000000000a000000000000eb00000000141001"], 0x3c}, 0x1, 0x0, 0x0, 0x800400d}, 0x8001) (async) r0 = socket$kcm(0x10, 0x2, 0x10) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050841) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0x1, 0x2, 0x4, 0x4, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1f, 0x5, &(0x7f00000002c0)=@framed={{}, [@map_fd={0x18, 0x0, 0x2, 0x0, r1}]}, &(0x7f0000000100)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x19}, 0x90) (async, rerun: 64) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 64) r3 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000bc0)=0xc) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, 0x4f, 0x1, 0x0, 0x0, {}, [@typed={0x8, 0x1, 0x0, 0x0, @uid=r4}]}, 0x1c}}, 0x0) (async) sendmsg$nl_xfrm(r2, &(0x7f0000001bc0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001b80)={&(0x7f0000000940)=@allocspi={0x1210, 0x16, 0x800, 0x70bd2c, 0x25dfdbfb, {{{@in=@local, @in=@private=0xa010101, 0x4e24, 0x1, 0x4e22, 0x1ff, 0xa, 0x20, 0xa0, 0x73, 0x0, r4}, {@in=@remote, 0x4d2, 0x33}, @in=@remote, {0x1, 0x200, 0x8, 0x81, 0x6, 0x3ff, 0x8, 0x100000001}, {0xbdf0, 0x0, 0x3, 0x1}, {0x8, 0x2, 0x2}, 0x70bd26, 0x0, 0xa, 0x2, 0x6, 0x4}, 0x6, 0x2}, [@algo_aead={0x104c, 0x12, {{'aegis128l-generic\x00'}, 0x8000, 0x100, "9228c8b0e8c3b68a3c825a22b41e56667c521a54ce47cc5d42d6e5de5352a94319b330855352700b08baed330ba6a39398b3f278073e2eb89a3dae123f7fdb15d372b9af74b70a76f4ca646a4f63b90ad2dea2982de7abbf5aa08ff43fe3d9bff58f04ff435726ac66ee7a97a4d8bb4f440320f7a2ba34079bfcf749d2c540800d7e04e90c7b8955e0d8755c8d5744c31029c9811730edc93dee2fd64028de6a3fb74167bd5b03d4b67d53d68afad97a1044af0b544348f15780b397de1562399e2da3d105f90161d4a55dfc68ba0260a2bebb905ea08140dc9f27dd090e62d36dd77efea099c4b73ceb8a919d6c4098ecd9009a9a86eb2e3cd834eeda4d01a8db999bea7cfa714517e17245de12bf5307416a2321ea0a73fcca74242f074deb5169cbfaca1629f001ac13cc3eacaf71475404d09b79fe5cddccd7238b7a5957974cd7aa0d5590f5ebea683f9a8213b85e6d3161b2efe750ac6a0d52eb31e5e4cd5653ac4283948959dacb449ea56af170444d5ee79804fe6d98d74096a3fcd4aa003aaab12dd097ca269154ba3a4d75d75125039c3e0d526b37ad6a40a6ca9731abc14f74116279247dba04f9c98e09be5264924b825bacb0d4e871da596c992f5dc54324e8b897e81ec85882fa8d872c5bb047d30e65896da7702010b635257cbe2e7729697d01b43ed46704ba24f901588536e4d7d1326363358bb1b3e50d2faa2ee79a359b06d241d94e851470bb71cd00f209587a219a76fbb90a0c35d4e9f8240187222d7e7b800b10825d3ffd343809b859715d9402e192dd547064f2a322dd302b090d2811d53da99475abc24f238b23e171309471192c271b37a5a6e0271e1a25687924d3068dc17041976137e8aa22f40ee0d6603fb81e9647e983a4a1caa0b058a40cb95acbe2e6393794889c7942e9e0e56bd57938d0d3954f21e890019abba6b4021cd0a2fdcefab19c75d344ef361fd1bd1ab372f9e7d2898498c251a8ea722ec19b2a6c8c4a95a8b19d505467fd58ef5493df679a1ec37a9a053045bdc25c644562e304fe78547a464f463f46a71632bbf0e3151490e32464b142bf4291e8ac87b0b73ac0858a2df551dfb5832be226f38686d8b764e74e0fe8159e06ec0ab94fc7f87363730d6cd892a58882a208630a1ea35e151fe431add4b237aa521e2899808c733049940951cca4bd78b61737490145c318f6951d865beb0e081d52b64776e45f0a3adb8aade84b4a3f052fdc75ef482bbdc9bd2de8cb02e274391dfee183730bf7cb45b930d8a871651aaeb581d9907e565d3f90cee16047879879d6d1563eb8d353e74dad8f19f2b489a3f7616d2a228d2eb4de7ef3c9808672cba82a97e6f8109f51c3fac9e5203940ee719b59736a0230476a52b1d8fb0694cef0ba7a243321d46c3951ec2b34e1fbd0afcf7d0f4d45a442ebabf21095b3570a905638aae70ede1fede2b616d50bc5ed955c5c98291519f2235d531722da6ce3790f114fdf5bb2f16f7a6b995c7215519427f637188319a933e996c11cb2ec1f0a1748f20b63cf43de32055ae81c8123508cfdb51724e32ea239fcfb8b57ad521e0a8bda94492d67518f545cdd1760987451be719d69166fb074a50c4cd26233ae57f6fb58ad1a09bb6121d4bb3ce696b200c315505f6730385d53b6d89d6f27d7c656173a12cc0801e0f26c8328f8c80d48eb8265d40af98d2dd5ad34171c03c7cb67faec93cfc51616669deb749452a1096950058e5889d5689b9386d192e5fb2af62455513b67dcf3ef2a1ae4e77a39c534b3f507b6238d21e2eec5ef88b0d2cc9f1f0c1c3f55df617f36ffcbd328c7ab0aaba4cfe167a385a408bebf7ef3ae3086c82573aac1a3c1ada87e20325c380dee78eafd1f2c8b75abb0561fcf7997f60afb3690d794ef822fd608c4c91edafafb5e069b47f3a89075c59d7a042eab014437759dae1124f418b17fb63ad445a5906492f8307b763aa4f362ca221ae73b4931d41177834743192d8feedac53dcdfb541077924bb69014587e0d5a0f2f328c364599f471810402112e8fb4a670d90c1a2f30a8ea8f5dcb0074a17baf10832c4a8c9fb095a675781fec3947f878b71393b7b551fdaee118481225929234247c7447d0d312baad110cf9a07f4766d4bb747bb390cc35bd5336b2b25dbd4b8f04ec8649ee03d11c3bd4a24f9380113ff6c2ac3bd01ed4d32affbc72967c535e9202bc4320a5626d6bc541ffadf08f07a3f1ca55ba15145599a9af13ee2217b332229abe69587e78a0e09252ef7e4914055841dbd3c240e193c48a5fce597513a4e36ce4ba34d65ea64ad16267998b07996d4c8f90d26f770b3b8beb9ab4e356f46fbf44e9a0f6e1d30165781cb641de7361b4eebaaa6cde0536df7b0ee5dd86bf06b7dfbb707dbbeafc740030ab9c2ce7a45b29c796aa7d008e68dbe1d3b1fbb3a1635c98f979e3b9a918d43aef00cff5cab4a30f61094b82c5f24f6df6506eb26c40d1be0c5fd0b6d385f9bb4493f73accd4af000b700d64eaaa68c7570ebdecf58748bb92ad2729d75faa7b6b06371269c191427b31a6c96fecbf525a4b7939e2557c00e6343b71167451c43885bdaf979014ccf50efd01f296d3e4a81b852cf94206bc96080380b48d968d28e84b66272951e2f67a616666d01b02c24be83312748131b324bf1893905d88960580bf48b24e4c5eb97b66650a4f5515ca12cfbee0f75033941c208a5cbe47d3c1d1cfde6cdf717515a1922a2134f2b3ad4cdaaaf18c83aa2d9bb40dfaa89ae8dfd9e4c6a2fed36300f3808776792fdcace0645d410a3aeb8bc22f7f45a3af2678415f459994d80e331ed71c743aef212b4900cadb2b2657a4237911b3cd15abc34bc3c2e3d21c759d732935e1df09eb76202e7f65c8208210721e93795f0f38311ad71c262f324bef78289e78da598bee32819f097126e9f1aac6b6a934b8cb125e0cf098a77aafc74d84833b06e3f85d0131f668642787a31f0afa92161b4b7dd6faa7acd3d3f2545c3a3266eb54d9b8ec37ec711755b412b53609b5639b140141aae04d449f05864fbfd40527d9dbf498827b8cd2f4aecb2540a864b73fe51c6d039a149b0c65892dc6cf9d4be15e86f3f46a9dd538efedb681257c10b33bc8b3a41b85c44fc38bc0603e6dc9020ffc84bc51ab5c32aac2a73e51e9de12bae3464db0edd1dda96396febb6adf57937d6cb11f8a8334cef006203c9490f130009eaab5b896d69235aa59598dc1b2f23183527aa29f429a31876f9e36118aa5185ec48aa92d5fca001100876f5a32c134e4bb3b79be28ac2fa9224073b2ca5a5be4fd364219d23035736fb805172b0939c4ca4dc257b3d97f7e21097df74a77f097cd06a6687097940809b4635a6e290869cc81f06866801a7d3399dde2565b10ca56f97db493865bdc2523c808bee68e3b24005d4e2bd440f7663325ca605f99a430139059c802accc17d67c49605b6b486746a0d132156809e153662b73c9a9ec1b1dbb7fccb251541c52407fd3fe24fbc5199cb6787383a354f19cf65f0890bccd6fa0f7bbec25290c49a13ff3dcccb3042ea83d0571c683205a7ab2b319644d4b1efefbf94a708330417186449e7cda489c413c40032eeab7540227aa91cb1549f4797603438eb20fe61765ee37867cbc0694e419ea8d3090452a1f81aa03942a55cf51cd5ccb06c5967b62d4f5a35baed86168707754af8522861ac2ef54fd87ae1fdfcc514ca8b302e886e2c1971e1733cfc6eb8109b39b821373929f44e086f2b022b456f9431cab74376e458e9269606aa49d84302192cf5780d3d0459a2cbca7d7fef321c47ba23a09c3bd60ca9a9878b7e06b21b7c7aaec9794de3165f0141974c48671a33b483ebb052cb6e1d98c341134df68875dd1b5dc93d440cfdc135e3cbcfec24378591876d254a01237594294a6871265d27101e124104ad04e19c9b5a28f9f8c53bea55b10390c58b8e8f436ebe700f2a9ad5225c20d5121f6ce6190ffccc38e28251e0537a7168867f551ac20c6eacd04f8c42a1fd27dd32da9d8728d7c818bebfa2582b2ff17b4b3b4d9041fbe63eb435a276d92d4944e11676f37fba521ad0812e4380df372a7772a4e6279fed8bc46e914732cfa1f5ca8c0612e91eb92093b0add4534c784ff1cffb0d9cfe4ff1b838f5e3e91c9298bc8ac793dd4d3f8a0da98e683890d940fe7ee145bb07d7142cef8998481b4552ed14001e84e75732b6b2a045ac09d48fee7e17c80f4de03a53c192b951616f60dda5640c8978fbb8daa26d973c2211065cf39628910fdf528769e2479d56bf8d126c7b20a975353293c4eba613c8f59b116efeafcca0b9881e0bae91925ba2527767368c0e93c3c1c44ea2c2524e609173a9385d904826f1880c51b7d0dc763e3f707ec0d9845f0f716a538b806ec858202d5e7dee35400a2e565add89b164d63d2b2b0d34f9041942cb5e06c0b0fafddea53a3af3a298fd9020a3a8fcad809bc9cf1a051a508b0e7a25e4f02aab276db633da47a191e1b224e66295ff0375bae55ec507d369aeac4b2fff132343425d7642a15e9b428827dc360b3a972de0a1cbd07cde1acfc262544b67f7b4519d26d62a007ec6a58280fad7f9e97fa047ecef0980431d6ed211f50b15099daa4a8606d45fbde4cc8b04e5d02a7ad4307bc3c227710607c31c270cab1a8e836353693699f7f9276b80a1bd429e54f3f6ef54ac53063ae823cafd4ca1f75ef45db9bfeb4aa859d9f51c49aeef9c6c0fa64b5e52b98d041d7c6c6e871993bedd2aeda9b3c399b9394ababc26817875dc951bcd49bcb8a8a6d83e153608bc0bd11a86f054cc7e99bba4f82eb417edaa3795d30a6ac4ce4a37bfeb8b8fe20107236e06070b1ee9dc01890d5b4e067886ed42886a3853baf32f79aa9071d73e8db5f07ec0f632ff0703b99852e1eda6c8307c983363fd361108fd5d68a90a799c09de48681460c6947df85b86d0f582aac7565757b2ec3ce98d8fc6163198bc5d35e7e049acda072d315d509a5afaff0e1620430700de782cfb145688be6448531bad817a42b36d3c1deee7490696435299c8c6407d46b88cd07eae37646d884a6ed876cdd2b42b0578d86e1ecedf5b48c053ce87655f5731c2c5bdf6ec0c86d89e20aca851f8e21e03ecdef3c8696121058cb7f0162ef4432e6e8d4e7102378c3ec2202d3c385c755950504c10d4aa4e67837d0e579b487d3d7f66cc6d56ea4ff8983756a3a3125e825eb16387d1a9e1d399ac358779efb36060887eb5a19208f5b5aaa88796c199387f73d8f6cca4c84f2ac6abec1140240007d2eb2e3ff467893b7a76e8ae2829c3a1faed995cb376399a6a12273e65d0f4f8f6d5bcb5e5bd55eec41d9b8d33ee8b6f31eb0ca43ebb60aba2d5a861e1da86d0099bca4a0e2241687dc949a22d136f833c22bec9aedf810c4f5d5abf8177fbd0514b947e9df7b426ff9c6a7db57f22530f991f6e4707eab6b565c752f748645afa6329d3e8e8f31ad9d56bb50d4bfe5dda93d716875b0919e46ecfd2fef9e12013ebaed2e7e49468e5ee9a0e281baebf003a810f672b832e26cc80327344a9144dacee18339e9c113368490fe5227249b915abf9c2e9e643f68a0020a72fdafecd388d2b90770cc1335009113318fe1b2caef02e176e9e0172e455403f68716684a9d1a2d885d2c62b2b686abafbc8f82687031bea2c0d5c35e53ba6e85fe9bf3d7adf9a53d6e43fa17521110a775a025434dc254cd2ffde490c6146805358360fb3c"}}, @tmpl={0xc4, 0x5, [{{@in=@remote, 0x4d2, 0x33}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3505, 0x1, 0x2, 0x3, 0x8, 0x9, 0x6}, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4d4, 0x33}, 0xa, @in=@rand_addr=0x64010102, 0x3500, 0x2, 0x3, 0x6, 0x2, 0xfffffffc, 0x8}, {{@in6=@local, 0x4d2, 0x6c}, 0x2, @in=@private=0xa010101, 0x3507, 0x3, 0x2, 0x9, 0x3c5, 0x0, 0x101}]}, @tfcpad={0x8, 0x16, 0xa}]}, 0x1210}, 0x1, 0x0, 0x0, 0x40100}, 0x0) (async, rerun: 64) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) (rerun: 64) 2m55.341244146s ago: executing program 1 (id=2075): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x30, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_VIA={0x4, 0x13, {0x0, "fea22255b36d2a6f2096c248b30c"}}]}, 0x30}}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x30, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_VIA={0x4, 0x13, {0x0, "fea22255b36d2a6f2096c248b30c"}}]}, 0x30}}, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000002c0)=@newqdisc={0x70, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x3c, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x6}, @TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x474c}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5}, @TCA_FQ_CODEL_ECN={0x8}, @TCA_FQ_CODEL_LIMIT={0x8}]}}]}, 0x70}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000002c0)=@newqdisc={0x70, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x3c, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x6}, @TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x474c}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5}, @TCA_FQ_CODEL_ECN={0x8}, @TCA_FQ_CODEL_LIMIT={0x8}]}}]}, 0x70}}, 0x0) 2m55.118142767s ago: executing program 1 (id=2078): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20000000}, [@call={0x85, 0x0, 0x0, 0x2e}, @printk={@lx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000680)) socket$inet_mptcp(0x2, 0x1, 0x106) socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r5}, &(0x7f0000000280), &(0x7f0000000240)=r2}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 2m54.886307849s ago: executing program 1 (id=2083): syz_emit_ethernet(0x3e, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x2d, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @dest_unreach={0x3, 0x11, 0x0, 0x0, 0x4, 0xccce, {0x5, 0x4, 0x2, 0x1, 0xff, 0x67, 0x3, 0xe7, 0x33, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x80, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4c010}, 0x4000000) 2m39.837157029s ago: executing program 32 (id=2083): syz_emit_ethernet(0x3e, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x2d, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @dest_unreach={0x3, 0x11, 0x0, 0x0, 0x4, 0xccce, {0x5, 0x4, 0x2, 0x1, 0xff, 0x67, 0x3, 0xe7, 0x33, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x80, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4c010}, 0x4000000) 1m14.077864769s ago: executing program 5 (id=3196): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3fb, 0x4, 0x70bd2d, 0x25dfdbff, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x24000800) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000380)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x4, 0x8, 0x4, 0xfff, 0x20, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, 0x20, 0x8, 0x1b, 0x6}}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r4, 0xfff) r5 = accept4(r4, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f00000008c0)=@sack_info={0x0, 0x55, 0x6}, 0xc) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd0000110000080000000060ec97000fa82c00fe8000000000000000000000000000aaff02000000000000000000000000000173"], 0xfde) 1m13.042205298s ago: executing program 5 (id=3210): r0 = socket$inet(0x10, 0x3, 0x0) (async) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000200)=@newqdisc={0xfffffffffffffed2, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xc}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x1}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x28, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0xb}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x1}, @TCA_CAKE_NAT={0x8, 0xb, 0x1}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}]}}]}, 0x7c}}, 0x0) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000000)={0xffffffffffffffff, 0x1, 0x5, 0x3, @vifc_lcl_ifindex=r2, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x40, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r5}, &(0x7f0000000040), &(0x7f00000000c0)='%-010d \x00'}, 0x20) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r5}, 0x4) (async) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x10, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000ff0500000000000000000000b7080000000000007b8af8ff00000000b7080000ff0100007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x48}}, 0x0) 1m12.77782439s ago: executing program 5 (id=3214): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000c40)=@raw={'raw\x00', 0x8, 0x3, 0x4b0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3e0, 0xffffffff, 0xffffffff, 0x3e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x160, 0x188, 0x0, {}, [@common=@srh1={{0x90}, {0x2c, 0x56, 0x81, 0xa, 0x41, @private2, @local, @private1, [0xffffffff, 0x0, 0xffffff00, 0xff], [0xffffff00, 0x0, 0xffffffff, 0xff], [0x0, 0xffffffff, 0xff, 0xff000000], 0xb8f4757fc1e05f28, 0x180}}, @common=@hl={{0x28}, {0x1, 0x7}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @local, [], [], 'wg1\x00', 'veth1_to_batadv\x00', {}, {}, 0x62}, 0x0, 0x228, 0x258, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x6, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3, 0x0, 0x40}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x6}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x510) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000980)=@filter={'filter\x00', 0x4, 0x4, 0x340, 0xffffffff, 0x0, 0x0, 0xd0, 0xfeffffff, 0xffffffff, 0x270, 0x270, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xc8}}, {{@ipv6={@private0, @loopback, [0xff, 0x0, 0xff000000], [0x0, 0xff, 0xff000000, 0xffffff00], 'team0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0xff, 0xe7, 0x4, 0x44}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x9, 0x8, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) sendto$inet6(r1, &(0x7f0000000000)="df2e99e4668a3cc783d58cfd184a94f51a8e", 0x12, 0x20000801, &(0x7f0000000040)={0xa, 0x4e23, 0xd, @local, 0x7}, 0x1c) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, 0x0, {0xd, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xffffff80, 0x2, [@TCA_CAKE_MPU={0x8, 0xe, 0xf5}]}}]}, 0x3c}}, 0x44080) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r5, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) accept4(r2, &(0x7f0000000240)=@tipc, &(0x7f00000002c0)=0x80, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000e50003000000000085100000fcffffff250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) 1m12.406646178s ago: executing program 5 (id=3221): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xb, &(0x7f00000009c0)=@framed={{}, [@printk={@u, {0x3, 0x3, 0x3, 0xa, 0x0}, {0x5}, {0x7, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@map, 0x35, 0x1, 0x3fffffc, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000080), &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000280)={@dev}, &(0x7f00000002c0)=0x14) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r3, &(0x7f0000001500)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x1}], 0x1}}], 0x1, 0x24008094) close(0x4) close(0x3) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r4, @ANYRES32=r0, @ANYBLOB="2700000013000000", @ANYRES32=r0, @ANYBLOB, @ANYRES32=r0, @ANYBLOB="a64fbc10f2d8eb00d290", @ANYRES64=r1], 0x20) 1m12.228933414s ago: executing program 5 (id=3223): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b705000000000000611083000000000007000000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r0 = socket(0x5, 0x3, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYRESHEX=r2, @ANYRES32=r3, @ANYRES32=r0, @ANYRES8=r1], 0x3c}}, 0x10) r4 = socket$inet(0x2, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r4, 0x0, 0x487, &(0x7f00000000c0), &(0x7f0000000200)=0x30) 1m11.835382817s ago: executing program 5 (id=3229): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfd, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000000)=@base={0xa, 0x4, 0x8000, 0x5c, 0x2000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x50) 56.824247122s ago: executing program 33 (id=3229): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfd, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000000)=@base={0xa, 0x4, 0x8000, 0x5c, 0x2000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x50) 2.618908683s ago: executing program 6 (id=3964): r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002580)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0xffffffff, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, 0x0, 0x0, 0x0, 0x60}}], 0x1, 0x4000040) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x10}}, 0x6c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@ipv6_newroute={0x1c, 0x18, 0x1, 0x0, 0x0, {0xa, 0x0, 0xfc}}, 0x1c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0x3fe3aa0262d8c58b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x6, 0x2, @TCA_ETF_PARMS={0x8, 0x1, {0x0, 0x0, 0x2}}}}]}, 0x40}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x7fff}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}, 0x1, 0x0, 0x0, 0x8010}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={r8, 0x4, 0x100, 0x3}, 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newtaction={0x84, 0x30, 0xffff, 0x0, 0x0, {}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0xffffffffffffffff}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x84}}, 0x0) r10 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r10, 0x8918, 0x0) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_bt_hidp_HIDPCONNADD(r10, 0x400448c8, &(0x7f0000000240)={r9, r11, 0xe2ce, 0x55, &(0x7f0000000080)="b4b7f1c86ecb5853a6d73e36fb4b89582c54bab504c858c59e80520bc996ac6623a6403ecc48501b9e3b7d489a10fcbb1c9b2d9fb1c6203533e938b653c75c34309e45f2c3aabe0976f96c793cf7a84eb321300efd", 0x6, 0x1, 0x200, 0x1800, 0x3473, 0x4, 0x8, 'syz1\x00'}) 2.600459847s ago: executing program 3 (id=3965): accept(0xffffffffffffffff, &(0x7f0000000000)=@vsock, &(0x7f0000000080)=0x80) (async) r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@vsock, &(0x7f0000000080)=0x80) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000100)={r1}) r3 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@hci, &(0x7f00000001c0)=0x80, 0x800) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x4000, r0}, 0x18) (async) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x4000, r0}, 0x18) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r4, 0xffffffffffffffff, 0x0, 0x0, @val=@netfilter={0x1, 0x1, 0xbcb}}, 0x20) (async) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r4, 0xffffffffffffffff, 0x0, 0x0, @val=@netfilter={0x1, 0x1, 0xbcb}}, 0x20) close(r5) (async) close(r5) socket(0x3, 0x0, 0x7f) (async) r6 = socket(0x3, 0x0, 0x7f) setsockopt$sock_timeval(r6, 0x1, 0x42, &(0x7f00000002c0), 0x10) getpeername$packet(r2, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000340)=0x14) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000003c0)={'tunl0\x00', &(0x7f0000000380)={'syztnl0\x00', r7, 0x7, 0x8, 0x9, 0x1, {{0x8, 0x4, 0x3, 0x8, 0x20, 0x66, 0x0, 0x5, 0x29, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp={0x44, 0x8, 0xca, 0x0, 0xd, [0x6]}, @ra={0x94, 0x4, 0x1}]}}}}}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000440), 0xffffffffffffffff) (async) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NFC_CMD_VENDOR(r8, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x40, r9, 0x4, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_VENDOR_SUBCMD={0x8, 0x1e, 0x400}, @NFC_ATTR_VENDOR_DATA={0xb, 0x1f, "768dc3c8e7a967"}, @NFC_ATTR_VENDOR_SUBCMD={0x8, 0x1e, 0x100}, @NFC_ATTR_VENDOR_SUBCMD={0x8, 0x1e, 0x7fffffff}, @NFC_ATTR_VENDOR_SUBCMD={0x8, 0x1e, 0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x4000) getsockopt$ARPT_SO_GET_INFO(r3, 0x0, 0x60, &(0x7f0000000540)={'filter\x00', 0x0, [0x758, 0x1, 0x2]}, &(0x7f00000005c0)=0x44) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xa, '\x00', r7, 0xffffffffffffffff, 0x5, 0x1}, 0x50) getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f00000007c0)={@local, @dev}, &(0x7f0000000800)=0xc) (async) getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f00000007c0)={@local, @dev, 0x0}, &(0x7f0000000800)=0xc) ioctl$XFS_IOC_START_COMMIT(r6, 0x80585882, &(0x7f0000000840)={0xffffffffffffffff}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000940)={0xcff, 0x0}, 0x8) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a00)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000980), &(0x7f00000009c0)='%pK \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{r3, 0xffffffffffffffff}, &(0x7f0000000a40), &(0x7f0000000a80)=r4}, 0x20) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000001300)={{r6, &(0x7f0000000b00)='nfc\x00', 0x400040, &(0x7f0000000b40)={@align=0x7, {0x40, 0x2b, 0x2, 0x8000000000000001}}, 0x6, &(0x7f0000000b80)={@_ha_fsid}, &(0x7f0000000bc0)=0x800}, 0x7, &(0x7f0000001200)=[{0x3, 0x1ff, &(0x7f0000000c00)='syztnl0\x00', &(0x7f0000000c40)="728fab6fab749cee7f132d2b523d54e2f4b24e8cbdd10a6da3c9dd6a1dcbed2aeccf2ffaa8c8ad06f62167ebce5a836719fc41edb2b08bc292eb4af1f17de7ccbfaa7d724c249e188f528af249a0332dd9f454b49e63416c20a2e82d6abce13c409770b118887a39106bc86447c7704fac158f5e675eaad9be3caf12fe1aed226a9fedac76accabeed0b1d3a22eadd3605090275a70e5644a7f51da64f36e7ae30a0da105139a11a083efd3bb2bdb9f9", 0xb0, 0x2a}, {0x1, 0x0, &(0x7f0000000d00)='-)\x9c%+\x00', &(0x7f0000000d40)="e425b55d0adcc39e48c2670366fb1f743f7d58657456c85b8374fbe3093b97eb6afc953bfce0fab66e01e95f0e003240399fae264d9efd39d629b7f22c5f37b5943b702a5e014fe13a3c28616880bad3e9417869133e835c511d3a6c814ee36d6ecd772a8871464c3e7d86d06746ecec6e4a3bce763ab013cc0d8f83cac1001e41268af66b404aa0d51d49ad7be186915c97e3d89f984f60697ee85eaa7befe8bce88fa0bd9ede8d33d152db741ad880d4bd7cccc3c1ba954f6e7376e5d3e7be1b056782d5ece48553b77f20fb243d1baa4ff892d73eea1b5ce8052a8f4bfb1a19010327ccc4be7f1710796ceed8", 0xee, 0x38}, {0x1, 0xd, &(0x7f0000000e40)='.%\x00', &(0x7f0000000e80)="06fbe01db90ef042727d3b5e757bde4767539d8304ff51ed354a5adda8c4ab98ccc32116c9a5", 0x26, 0x22}, {0x3, 0x1, &(0x7f0000000ec0)='syztnl0\x00', &(0x7f0000000f00)="276759a973898dfd50a135009da9dbd008875f56b1d7de636c99e25595f2f811ae053194b8d18ebd72bc8b6ed0209f9f3649f90dabfe1ffaae5d21a95c8868fc0e96f7ec535b95097ea9b9cc0872df8aec77584ba45d49c1cfa7ce93f7291684de801166be433f4fa89dfe8b913dbf93e4c6bf0cc9fdbc893b77403307baed8702c970c5305e4e32407729a083e995239fc2e452a8d88b8c392947ef03a4d621159558af43e18951b03d5c2326dec2e937a89eeba79d68ade48350a5f2230b396126ad53f2ef5a39f443672d9e9916fc5ae561bba25cedaa10be941e427c1497449c73b7900520", 0xe7, 0x3a}, {0x2, 0x9, &(0x7f0000001000)='x%$)-{\x00', &(0x7f0000001040)="d4486011df3704a6d4952f2f43d8c2613dd80aeedc1bea9d1cfeb566c9b952b641dcd10afead367c39464aad45484c5b5b7f85405b296dcead818eccbf6780f99b06449a41f36d322b35e6d5b3d40d2b2ae4146482052d637fd48cba6ad819e34aca0ec48f", 0x65, 0x20}, {0x1, 0x72, &(0x7f00000010c0)='filter\x00', &(0x7f0000001100)="c2ca76a033439e804976af3fbb632bd278a758818c35cc9085406c2b712a0e4e1bea56f7309d5e52811ec064193570a53ee5f46096811f340d6b6ef856dd0ee028ec81561836f77f237d65f15480814ea8af7b2b813f278f988dd092094819d010324660097bdfec7ee7212b463f965f4564a427ac84e57566acc69ba293ddb8", 0x80}, {0x2, 0x10, &(0x7f0000001180)=',\xc6&\x00', &(0x7f00000011c0)="e9ccb348d8144f732264cb84df9536e8c2d67d925f157cffbb9e3273b466eda05ae82880522a90d7926c67c2821742370f8c1c619c819744e215a3", 0x3b, 0x1a}]}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001380)={0x1, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001440)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000013c0), &(0x7f0000001400)='%-010d \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000014c0)={0xd, 0x5, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x29}, [@map_fd={0x18, 0x0, 0x1, 0x0, r10}]}, &(0x7f00000006c0)='GPL\x00', 0x5, 0x83, &(0x7f0000000700)=""/131, 0x40f00, 0x0, '\x00', r11, @sock_ops, r12, 0x8, &(0x7f00000008c0)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000900)={0x5, 0x7, 0x200, 0x2}, 0x10, r13, r4, 0x0, &(0x7f0000001480)=[0x1, r14, 0xffffffffffffffff, r15, r16, r17, r18], 0x0, 0x10, 0x3}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000014c0)={0xd, 0x5, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x29}, [@map_fd={0x18, 0x0, 0x1, 0x0, r10}]}, &(0x7f00000006c0)='GPL\x00', 0x5, 0x83, &(0x7f0000000700)=""/131, 0x40f00, 0x0, '\x00', r11, @sock_ops, r12, 0x8, &(0x7f00000008c0)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000900)={0x5, 0x7, 0x200, 0x2}, 0x10, r13, r4, 0x0, &(0x7f0000001480)=[0x1, r14, 0xffffffffffffffff, r15, r16, r17, r18], 0x0, 0x10, 0x3}, 0x94) r19 = socket$phonet(0x23, 0x2, 0x1) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x10, r19, 0x88b9d000) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000001580)={'nicvf0\x00'}) bind$nfc_llcp(r0, &(0x7f00000015c0)={0x27, 0x0, 0xffffffffffffffff, 0x3, 0xb, 0x6, "93c8599b21d596d644e6adbeaeb90e040b5b6a423b338a1b393460245b5ee00bc86a73f35c36d805fa0665de821377a1e984360244f63d4680c2c2b36811fa", 0xa}, 0x60) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001a00)={{r15}, &(0x7f0000001640), &(0x7f00000019c0)}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001a00)={{r15}, &(0x7f0000001640), &(0x7f00000019c0)}, 0x20) 2.398390827s ago: executing program 0 (id=3967): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000003c0)={0x0, 0x1}, 0x8}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r1, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001200)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) r2 = socket$inet6(0xa, 0x2, 0x1) getsockopt$IP_SET_OP_GET_FNAME(r2, 0x1, 0x53, &(0x7f0000000080)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f00000000c0)=0x2c) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x5c, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x200}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e21}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_LINK={0x8}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e23}]}}}]}, 0x5c}}, 0x2674c596b08d5d52) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000880)=@ipv6_delrule={0x1c, 0x1e, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}, 0x1c}}, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0) close(r5) ioctl$SIOCSIFHWADDR(r5, 0x8b28, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) ioctl$sock_bt_hci(r5, 0x400448e3, &(0x7f00000002c0)="b6fa09619bb63b12c99e874b1f000ca52e194c52ac8f1aad57bd9bc27d40891f95523fc42956693267a634f70855c9288b57c239949690748a55f4f8f821388a79c99efc2fc070414abe940d0ba7b96e1c48066b5305c8ac80b1848f56b26267bccb601101ccd3ec31500e03848990f8882051d401a3530081893f6e94677d137dcdc72786959eea30c27913ecea45e63b0cfa26082a11fedf72b0e55df5b5ebf44fe94a460f831fba8b85f32a1d2cfd03d3f213a316ea3533f64519d31bdb7c1484cef8c0337e067d061c90c34b609a1ea70821dec21374a87768e5ee2071") 2.350601783s ago: executing program 3 (id=3968): r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000140)=0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newqdisc={0x5c, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x5, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) 2.146200987s ago: executing program 0 (id=3971): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1000000000000000100100000e00000018000000000000001001000001"], 0x28}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="0010000000000000240012800b000100697036746e6c000014000280050009002900000008000100", @ANYRES32, @ANYBLOB="08000400000058"], 0x4c}}, 0x0) 2.145631042s ago: executing program 6 (id=3972): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'\x00', 0x52d35ce30131f272}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10e) syz_emit_ethernet(0x4a, &(0x7f0000000680)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x33, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "91d785d58954605c802acf9f965fe399"}]}}}}}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.sectors\x00', 0x0, 0x0) recvmsg$can_raw(r2, &(0x7f0000000780)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/12, 0xc}, {&(0x7f0000000100)=""/147, 0x93}, {&(0x7f0000000840)=""/164, 0xa4}, {&(0x7f0000000280)=""/2, 0x2}, {&(0x7f0000000340)=""/251, 0xfb}, {&(0x7f0000000440)=""/93, 0x5d}, {&(0x7f00000004c0)=""/195, 0xc3}, {&(0x7f00000005c0)=""/32, 0x20}], 0x8, &(0x7f0000000680)=""/239, 0xef}, 0x10100) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)=@newtaction={0x7c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x68, 0x1, [@m_tunnel_key={0x64, 0x1, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @loopback={0x400000004000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) 2.093489206s ago: executing program 4 (id=3973): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x30}, [@ldst={0x7, 0x3, 0x0, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4000004, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xfff1}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x2}]}}]}, 0x44}}, 0x20004055) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0xf3a, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000240)=0x1) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x10001) write(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r4, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r5, 0x10c, 0x5, &(0x7f0000000000), 0x4) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x3}, 0x8) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x8, 0x2c, 0x0, @remote, @local, {[], {{0x3a00, 0x5, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 1.867351627s ago: executing program 3 (id=3974): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macvtap0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macvtap0\x00'}) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8000000, 0x0, 0xff, 0x1, 0xfffc}, 0x20) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) (async) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0xffffffffffffffa2, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfffa, 0x2}, {}, {0x1c, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}, @TCA_FLOWER_KEY_SCTP_DST={0x6}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x24004000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$IP6T_SO_GET_ENTRIES(r6, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="6e617404000000000000000000000000000000000000000000000000000000008300000050d0f96125f5e5ea18422cba3103c98156b8b57c8b50dc5a551fc47c55aea325ee02f026d52358b97c0700e65774031164e66b666b104001998ca89216cfd7ccb52a7b5c49da354b5c6d50ffd1171eea4bcd3c7ba9a1e8edc01bf6c396832c1b339fda0070557495784fcc8e06231d32bb91e96c9a2eed377a1de892af1453e55b1e04032257187f9e673ccffc849dc309ce6cc432c750c990c8e68e5c6a216bb7faf84f6c9508801dd267e61c6f2d7f573c8122db62a64825eeb8daa0f2756a5542de6c2503bf44af6bf7ff2dfa6b202e84567e543f4f4da3430f1e0b3978580aa288d40d2b4d554b210500"/281], &(0x7f0000000140)=0xa7) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@ipv4_newaddr={0x4c, 0x14, 0x300, 0x70bd29, 0x25dfdbfb, {0x2, 0x1f, 0x49, 0xfd, r4}, [@IFA_TARGET_NETNSID={0x8, 0xa, 0x3}, @IFA_LOCAL={0x8, 0x2, @loopback}, @IFA_LOCAL={0x8, 0x2, @broadcast}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0x5, 0x300, 0x7}}, @IFA_BROADCAST={0x8, 0x4, @loopback}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200088c0}, 0x48094) (async) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@ipv4_newaddr={0x4c, 0x14, 0x300, 0x70bd29, 0x25dfdbfb, {0x2, 0x1f, 0x49, 0xfd, r4}, [@IFA_TARGET_NETNSID={0x8, 0xa, 0x3}, @IFA_LOCAL={0x8, 0x2, @loopback}, @IFA_LOCAL={0x8, 0x2, @broadcast}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0x5, 0x300, 0x7}}, @IFA_BROADCAST={0x8, 0x4, @loopback}]}, 0x4c}, 0x1, 0x0, 0x0, 0x200088c0}, 0x48094) 1.861616951s ago: executing program 2 (id=3975): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x6e}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@ipv6_newroute={0x24, 0x18, 0x111, 0x1, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x2, 0x0, 0x8}, [@RTA_PREF={0x5, 0x14, 0x48}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113380000000000bf1000000000000025000200091b00003d030000000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200001400000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r1 = socket(0x9, 0x80000, 0x3ca) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000340), 0x2000, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000300)=0x73d, 0x4) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10200}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x178, r2, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x7, 0x20}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_FRAME={0x13e, 0x33, @data_frame={@a_msdu=@type00={{0x0, 0x2, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_b, @from_mac, {0xa, 0x9}, "", @value={0xb, 0x1, 0x1, 0x1, 0x3}}, @a_msdu=[{@broadcast, @device_b, 0x87, "e711f02d5f1a39cdf17af2c34daae9acf743b28c35f4818b668888a064a036cfaaa3d4c757f34743879f34c590f279d63790a685731b75599d4698e081592d6fef0f3ac85c29c53eb3834e440c01a128499cdc9b257538ce8b35ccf25aeeefb2bc6db763bf456573dd72e247f1b4cd5f82d72ef15f351da3418ebcf08fd96e9e66885178e60261"}, {@device_b, @broadcast, 0x2b, "31f12b248df54efa1915a0c4103f2492b853fbe2cb0110fdbc931d661fdd68993a70c204f4a46abda7313f"}, {@device_a, @device_b, 0x3b, "ef37b76f6679e7e829032f940f29cd56d9cec1393867c50117b379c5a0e82667b9ba4962597c8abede73bfb74e6b52a8e3588f31fea94f1d544713"}]}}]}, 0x178}, 0x1, 0x0, 0x0, 0x1}, 0x8080) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r1, 0x8002f515, &(0x7f00000002c0)) 1.803592792s ago: executing program 4 (id=3976): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a00000000000000040004"], 0x1c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newnexthop={0x38, 0x68, 0x1, 0x3, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x6}]}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@dev={0xfe, 0x80, '\x00', 0x17}}]}, 0x38}}, 0x40000) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0xf8, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0xc8, 0x2, {{}, [@TCA_NETEM_LOSS={0x8c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0x101, 0xfffffffc, 0x2, 0x5}}, @NETEM_LOSS_GI={0x18, 0x1, {0x8, 0x80000001, 0x3, 0x1, 0x1ff}}, @NETEM_LOSS_GE={0xd, 0x2, {0x2, 0x3, 0x3, 0x7}}, @NETEM_LOSS_GI={0x18, 0x1, {0x7ff, 0x3, 0xfffeffff, 0xc5, 0x401}}, @NETEM_LOSS_GI={0x18, 0x1, {0xffff, 0xb1, 0x7fffffff, 0xde9, 0x42}}, @NETEM_LOSS_GI={0x18, 0x1, {0xc, 0x4, 0x1, 0x0, 0x1000}}]}, @TCA_NETEM_RATE={0x14, 0xd}, @TCA_NETEM_CORRUPT={0xc, 0x2}]}}}]}, 0xf8}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='net_prio.prioidx\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdbf4, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {0x0, 0x2}, {0xfff3, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x20084084) sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd0, r5, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x42}}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xd01a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}]}, 0xd0}}, 0x20040050) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00'}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a00000000000000040004"], 0x1c}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newnexthop={0x38, 0x68, 0x1, 0x3, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x6}]}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@dev={0xfe, 0x80, '\x00', 0x17}}]}, 0x38}}, 0x40000) (async) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0xf8, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0xc8, 0x2, {{}, [@TCA_NETEM_LOSS={0x8c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0x101, 0xfffffffc, 0x2, 0x5}}, @NETEM_LOSS_GI={0x18, 0x1, {0x8, 0x80000001, 0x3, 0x1, 0x1ff}}, @NETEM_LOSS_GE={0xd, 0x2, {0x2, 0x3, 0x3, 0x7}}, @NETEM_LOSS_GI={0x18, 0x1, {0x7ff, 0x3, 0xfffeffff, 0xc5, 0x401}}, @NETEM_LOSS_GI={0x18, 0x1, {0xffff, 0xb1, 0x7fffffff, 0xde9, 0x42}}, @NETEM_LOSS_GI={0x18, 0x1, {0xc, 0x4, 0x1, 0x0, 0x1000}}]}, @TCA_NETEM_RATE={0x14, 0xd}, @TCA_NETEM_CORRUPT={0xc, 0x2}]}}}]}, 0xf8}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='net_prio.prioidx\x00', 0x0, 0x0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) socket(0x400000000010, 0x3, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdbf4, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {0x0, 0x2}, {0xfff3, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x20084084) (async) sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xd0, r5, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x42}}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xd01a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}]}, 0xd0}}, 0x20040050) (async) 1.74238073s ago: executing program 0 (id=3977): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0xa, 0x300) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000400000003"], 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3, '\x00', 0x0, 0x0}, 0x50) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x24, @none={0x3}}, 0x14, &(0x7f0000000100)={0x0, 0x1b}, 0x7}, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'lo\x00', &(0x7f0000000440)=@ethtool_eeprom={0xb, 0xff, 0xaa2}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, 0x0, 0x20) socket(0x10, 0x3, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x50, r2, 0x8b5a1000) r6 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$IPT_SO_GET_INFO(r6, 0x0, 0x40, &(0x7f0000000280)={'raw\x00', 0x0, [0x3f39, 0x4a3, 0xdb1, 0x7, 0xa6]}, &(0x7f0000000300)=0x54) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newlink={0x30, 0x10, 0x49920d862a921d1b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_PROMISCUITY={0x8}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x30}}, 0x0) 1.741792803s ago: executing program 3 (id=3978): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x6, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000000000000000000000f7ffffbe0000000000000095"], &(0x7f0000000000)='GPL\x00', 0x8}, 0x94) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x2, 0x9}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8000000, 0x0, 0x1, 0xa}, 0x20) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@mcast2, @in6=@ipv4={""/10, ""/2, @initdev}}}, {{@in6=@dev}, 0x0, @in6=@private0}}, &(0x7f0000000480)=0xe8) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, 0x0, &(0x7f00000001c0)=0x61) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f00000000c0)) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000002200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000239853e80900000008000300", @ANYRES32=r7], 0x20}}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {0x0, 0x1}, {0xc, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) setsockopt$inet6_IPV6_PKTINFO(r8, 0x29, 0x32, &(0x7f0000000080)={@private2, r10}, 0x14) r11 = socket$unix(0x1, 0x2, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r13, {0xfff3, 0xb}, {0xffff, 0x10}, {0x4, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@deltfilter={0x2c, 0x2d, 0x400, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r13, {0xfff3, 0x3}, {0xe, 0x10}, {0xffe5, 0xfff3}}, [@TCA_RATE={0x6, 0x5, {0x80, 0x3}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000810}, 0x84084) 1.650684404s ago: executing program 6 (id=3979): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r2) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r2, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fddbdf257f00000008000300", @ANYRES32=0x0, @ANYBLOB="0a00f5c36291deaac32134010000000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x804}, 0x5cfb2db58417ab92) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000004c0)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000600)=[@assoc={0x18, 0x117, 0x4, 0x48000}, @assoc={0x18, 0x117, 0x4, 0x100}], 0x30}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={0x1, 0x58, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_newroute={0x2c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfe, {0x2, 0x20, 0x10, 0x0, 0xfd, 0x4, 0xfe, 0x2, 0x20000000}, [@RTA_OIF={0x8, 0x4, r7}, @RTA_PREFSRC={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x27}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4a044}, 0x20004090) sendto$packet(r2, &(0x7f0000000180)="dc7f966edbbf6ff649752e6ed240ffea9ba4b16476b60dad869a5a36b4b3a8cc3ec9016b0e9ed91ace25c8ccb364eb65a92f184b34d6a67f023da854674ccddd1016717b11d4541b487792ce95942afb1b5e4ba83d48ffdc0ffb70cf7b88a5005079d4cdaf5aa1236cb6345860ab14d2fa3e461dc499cbbae79bb6cb5c46c2561ba7511c432039b59945e5831417", 0x8e, 0x80, &(0x7f0000000380)={0x11, 0x10, r4, 0x1, 0x9}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r9, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newtaction={0x104, 0x30, 0x83d79f1e8021ba05, 0x0, 0x0, {}, [{0xf0, 0x1, [@m_nat={0xec, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x20000000}, @rand_addr, @multicast2, 0xff}}]}, {0x9b, 0x6, "3a96c225784c52055797dc527558b5f4e8c412d3cd4e0d83efcda28bac4f5e253e3fe9fa05eb2eef188a9240882a0d36cff3af16a0448a5c3e7c191cc1fdf86f153a1b5e3091e1b8fdf0edf0bd36597423cdd5e683d5d3bdd5a2c96982cf31bf43f07f00470cb5dd66136ccc4b4c042ea6cf8a0f584771d74475aedb9b4bf2a32ce5f5cc7cd351ee448d745e554bcd675e12ba017b6fd1"}, {0xc}, {0xc}}}]}]}, 0x104}}, 0x0) 1.571959938s ago: executing program 2 (id=3980): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x5c}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000042000000b700000000000010950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836801ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d09a0a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a504a0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffaf, 0x10, &(0x7f0000000040)}, 0x3c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r1, 0x0, 0xe, 0x0, &(0x7f00000002c0)="69d387051eaf71a0486e5c660000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001e00010000000000000000000710"], 0x1c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) ioctl$VFAT_IOCTL_READDIR_BOTH(r3, 0x82307201, &(0x7f0000000480)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002680)=ANY=[@ANYBLOB="18000000520001c700001000000000101c"], 0x18}}, 0x0) 1.519158202s ago: executing program 4 (id=3981): syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61109c00000000006113740000000000bfa00000000000000700000008ffffffd503010017740040950000000000000069163a0000000000bf67000000000000350607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x52, &(0x7f0000000100)={@broadcast, @random="b53eab4f726c", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\'\b', 0x1c, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x28}, @mcast2, {[], @mlv2_query={0x82, 0x0, 0x0, 0x4, 0x6, @dev={0xfe, 0x80, '\x00', 0x2a}, 0x1, 0x0, 0x0, 0x2}}}}}}, 0x0) recvmsg(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x140) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x92}, [@ldst={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xcf, &(0x7f0000000180)=""/207, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 1.373559885s ago: executing program 4 (id=3982): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_BYTEMODE={0x8, 0x7, 0x1}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48801}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000002d0301000000000095000000000000006926000000000000bf67000000000000150600000fff070067060000200000006a0200000ee60000bf050000000000004e350000000000006507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff3d53010000000000840400000000000073720000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a157f9005bd38addaa65b925f1ffed25b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf72a4de1c2ea17f04537fc211576846ac629d1d93265ba4580047a9dc88de358ce795731891a2031de4e09740c64e5506f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfadfe6d4421c49fb6641cbf56914e76702f673b586c767562a90a3967093b000e3806f825f1d0da2a304e06543b56d35235d78b7a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664a44e22b72e843e7cf55f394cf75d1cd3ee79a25fb98cc45b3fde43e42e150d4a2fddd9a97677400ef0bd697d135324ce480c2960344de346bd511dea4ff7a07400b2d12dd1a8c4c300aee5f948777085ca142b79dfc3aca5fadaa0532ab0572169f68584ff2ee063bc7e75ecd5cc8973464629ba236e3ff97f6033d0800000000000000cef54a60aff12590a50ef147e3e640193d00263003a4ef412420a070dd0327e47c8c7abb77b4b53874788d7e2e5d554de4713db957afb56d4673f1b904c5a317d3670003000000183fb7d36e173044f4ab34"], &(0x7f0000000100)='GPL\x00'}, 0x48) 844.892309ms ago: executing program 6 (id=3983): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1e0000006700000008000000ad00000008680100", @ANYRES32=0x1, @ANYBLOB="8100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000003000000040000000500"/24, @ANYRES32, @ANYBLOB="09307d6a0e148981ad707c8109465f716c65be6e8570487e585dcd7d60c83a6c4c8361062446f4f5bc5c58562c"], 0x50) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000080)=ANY=[@ANYBLOB="c40000001900f3fe0000000000000000fe8000000000000000000000000000bbac"], 0xc4}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) write$nci(0xffffffffffffffff, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP_V2={0x0, 0x1, 0x2, 0x1, 0x7, {0x1, 0x2, 0x4, 0xffda, 0x3, 0xed, 0x8d, 0x3ac6, 0xf3, "c1ab3daddfe37ca15abe4894b5b3d4cf4b13b08c55b5cd433428dee17d3c18f82a0e020f9e38613ed4ee08dcee0f05fd838e0355dc453fb581983d3db6b9945ce6955bb2aa1fb405907ce42f65ef44805a2dc94aa4c96e3bddc9f253bda3729f590d2b24eb6931d9a68cf0710dfc7cde8c895aa86b7d863e3ad0090fd2b58e801b7e44d9b76c894fce3b11daf5aa7996efe737cfe0104dd221eff183b19c9ef4ac81ab4a0c9477e84522f4e1bb2b5e3fcab4e7400a45ab7d7d8ba5eabfc332aa9c91f6f120f673755e8b30e63cdaa997b9ba3bdf86ca756ac0f393aec8aadf3e0aa0602c91472e749d1e25960c69c51ade3efd"}}, 0x104) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000100)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_bpf={0x5c, 0x1, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x7, 0x5, 0x8001, 0x8}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb01001800000000000b003c0000003c000000020000000052d7c2dce80bb0a200000002000004ffffff010000000003000000000000000000000300786d56dd5a4d2d0000000000000000000000000002000000000000000000000006"], 0x0, 0x56, 0x0, 0x2}, 0x20) 751.187144ms ago: executing program 2 (id=3984): r0 = socket$inet6(0x10, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfff00001}, {0x16}]}, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000006c0)={'ip_vti0\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000100)={r3, 0x2, 0x6, @local}, 0x10) sendto$inet6(r0, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, &(0x7f0000000580)=@framed={{}, [@snprintf={{}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0x8c}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 742.467073ms ago: executing program 4 (id=3985): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff71a4f0ff000000002d040000000000003d400300000000006504000001ed000079110000000000006c440000000000007a0ab0fe000000007b13000000000000c500f9ffffff00009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e6b3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7a29aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d390dd65be2467b373eafd9aa58f2077184b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c5da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b93d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6ffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd86975023cb08cc7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c5538a294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e17fb1c1ca571380d7b4ead35a655e0b4a26b702396df7e0cbe02b6e4314f244a94aa8e98b0b263f0083bf93f05beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba5823a34a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc06000000000000008fe26e37037f27f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e05000000d03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d0a874c74b777df005c55fc30511d00000000c85265b2bd83d64a532869d708000000000000007baa5b6a682b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a56edbd287eba77f35c35d91f3c62a0ca74836a640224de85f2b4a5fee500bbc584328a6a7a4628c4378c9b71dff64075b74a6520adb187b40d2cccbcb08c0634ee74658d3e23bf2871ed2aa2a05e319374511c8b0bf1b69d2b3782b3f481c314e7bd4615dbbf24c06ac95bd639e68d0e6aa7f0d07bf69a93365f803f0144af37236ea133c2255b0613bf8ba1d538e06c2411e8d70053b712084fd0e313de9bb19266e49a3a2190cb039c6f89610acd896319b9c8d1b8aac2eaa5a4f8be7419a09e3fb5be3be2fcdadd2299839cc40e684e6e2b4e1385fde7a0babcb0be672110268a34dad364fddee69e564119cebb6940c6356ff83ca527c573d700000000000000c6299263e6d9097f225de969485bce3d7dc471c0669bb6a467cf0de54dfcc1857048fe22a19dbb1b3cb9babaa839f1f6e817a62d95a5b971ff96a5c66c338c6f2a2da4644519f40761402e9c81013d76c7152c95ba5efa24ce1930f23a2277f057ffb6b0144f3b434a2adc456ef4d2fbdf7c6238c2bb00ffcf2d23d68cb9b027f3b22589f7956b66c5692b46ea03abb6a404c8ccceaa4ba4161409fcb54b86eaca26b24464e0ff504b87c90697ec2a82bbfd1c31713190d3e6e502c434909d6ba06cd0361a0fd90552272f24519ea9938413947edd3a0a7aa780c1dcdddf13b46ca94f37c89664c9cc1857d64ca371fa1b6131"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0x50}, 0x48) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000380)={@dev={0xfe, 0x80, '\x00', 0x1f}, 0x76, r2}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 660.40755ms ago: executing program 0 (id=3986): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x4e21, 0x0, @mcast1={0xff, 0x7}, 0x10000}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1c, &(0x7f0000001340)=""/4096, &(0x7f0000002340)=0x1000) (async) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000100)=@srh={0x1, 0x0, 0x4, 0x0, 0x2, 0x10, 0x385}, 0x8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e21, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) r3 = socket(0x200000000000011, 0x2, 0x0) (async) r4 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f00000001c0)={0x6fb4, {{0xa, 0x4e21, 0x5, @mcast2, 0x8}}, 0x1}, 0x90) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000140)={@private0={0xfc, 0x0, '\x00', 0x1}, r5}, 0x14) (async) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000000000000000000008500000028000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) (async) r7 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r7, &(0x7f0000000440)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r7, 0x84, 0x17, &(0x7f00000004c0)={r8, 0x3, 0x3, "2a9a9e"}, 0xb) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000012c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (async) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, [{0x19, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x1, "000000050000000026000400"}, {0x22, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x3, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "b8a3e100908f6164000000020000000000000000000000ffff008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="650a00000000000061112800000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) 550.524669ms ago: executing program 0 (id=3987): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000240)={&(0x7f0000000080)={0x58, 0x2, 0x1, 0x401, 0x0, 0x0, {0x7, 0x0, 0x6}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x11}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_IP_PROTO={0x5, 0x1b, 0x1}]}, 0x24}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a54a38f8c78ac1af3ee000000060a0b040000000000000000020000002800048024000180090001006d65746100000000140002800800014000000000080002400000001b0900010073797a30000000000900020073797a8f00000000140000001100010000000000000000000000000a"], 0x7c}}, 0x0) 549.239406ms ago: executing program 6 (id=3988): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket(0x1, 0x803, 0x0) (async) r5 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0003000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r6, @ANYBLOB="5606145f", @ANYRES32=r6, @ANYBLOB], 0x44}}, 0x884) 538.689477ms ago: executing program 2 (id=3989): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, [@ldst={0x1, 0x2, 0x2, 0x2, 0x1, 0x2}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) 407.571171ms ago: executing program 2 (id=3990): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x34}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2e}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000017f03e3f7000000106ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00010007080c00bdad01409bbc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27fff", 0x89}], 0x1, 0x0, 0x0, 0x7}, 0x0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) (async, rerun: 64) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000180)={0x0, @initdev, @dev}, &(0x7f0000000200)=0xc) (rerun: 64) sendmsg$ETHTOOL_MSG_EEE_GET(r1, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r4, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004}, 0x8080) (async) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r3, 0x215eb000) (async) pipe(&(0x7f0000000740)) (async, rerun: 32) r6 = socket(0x14, 0x2, 0x4) (rerun: 32) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) (async) pread64(r7, &(0x7f0000000b40)=""/4096, 0x1000, 0x3) ioctl$sock_SIOCGIFINDEX(r6, 0x61d0, 0x0) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x20040024}, 0x810) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYRES32=r1], 0xa4}, 0x1, 0x0, 0x0, 0x48005}, 0x801) (async) ioctl$F2FS_IOC_GARBAGE_COLLECT(0xffffffffffffffff, 0x4004f506, &(0x7f0000000380)=0xfffffffc) (async, rerun: 32) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={0x0, 0xa1e, 0x4, [0x3, 0x1, 0xffff, 0xb]}, &(0x7f00000000c0)=0x10) 347.287523ms ago: executing program 3 (id=3991): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0008"], 0x34}}, 0x400c010) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x44, r2, 0x1, 0x0, 0x3, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x5a3}, @NL80211_ATTR_STA_WME={0x14, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x9}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x64, r2, 0x300, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x3f}}}}, [@NL80211_ATTR_FRAME={0x3e, 0x33, @action={{{0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x50}, @device_b, @device_b, @from_mac=@device_b, {0x3, 0x2a4}, @value=@ver_80211n={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}, @tdls_chsw_req={0xc, 0x5, {0xac, 0xa9, @void, {0x65, 0x12, {@from_mac=@broadcast, @device_b, @broadcast}}, {0x68, 0x4, {0x0, 0x9}}}}}}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x80) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={r5}, 0x8) 275.804376ms ago: executing program 2 (id=3992): r0 = socket(0x1, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'gre0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x0, 0x8000, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @empty}}}}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000040)="9eb1d91a92dc7c8fff658bb539e2ffb332da224694fdccf0d42de77a0a87e914330c5422", 0x24}], 0x2}, 0x20008b88) r2 = socket(0x848000000015, 0x805, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0x7ee, @mcast2, 0x2}, 0x1c) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x10}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b1a, &(0x7f0000000000)={'wlan1\x00'}) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xc8502a02}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELCHAIN={0x11c, 0x5, 0xa, 0x606, 0x0, 0x0, {0x7}, [@NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_COUNTERS={0x7c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x635b}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8001}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xfff7ffffffffff95}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_HOOK={0x44, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1652235e}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x14e6ea52}, @NFTA_HOOK_DEV={0x14, 0x3, 'vcan0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'xfrm0\x00'}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x7}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x21b6c673}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x144}, 0x1, 0x0, 0x0, 0x800}, 0x40004) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r6) ioctl$SIOCSIFHWADDR(r6, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5, 0x8, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}}, 0x4000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmsg$unix(r8, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) syz_open_procfs$namespace(r9, 0x0) write$cgroup_pid(r6, &(0x7f00000001c0)=r9, 0x12) 194.664822ms ago: executing program 0 (id=3993): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001280)={0x18, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x4, 0x6}]}, 0x18}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@in={0x2, 0x4e20, @loopback=0x7f0000fd}, 0x10, &(0x7f0000000100)=[{&(0x7f00000001c0)="db34", 0x2}], 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000008400000006"], 0x18, 0x240488d1}, 0x8c4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_FLUSH_PMKSA(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="53194e748cdc0e3fbd823802317c98d641e56d8951db5efa76a8fd2e7da8d75ed96d9d8b5793642e"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) ioctl$FS_IOC_GETFSUUID(r0, 0x80111500, &(0x7f0000000300)) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)={0x14, r4, 0x3141e0b2751b0f9b, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x60c5}, 0x80) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000200)={@multicast1, @rand_addr, 0x0}, &(0x7f0000000240)=0xc) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r0, &(0x7f0000000940)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xa00}, 0xc, &(0x7f0000000900)={&(0x7f0000000700)={0x1fc, r4, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x1a4, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0xcc, 0x3, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, 'O-\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'bond\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xf50}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xe}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x100}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '+!\x95\xe5\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x10, 0x2, '[*}]^]$\\-%@\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, '*%..u}$.!%%\\\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x401}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'bond\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_VALUE={0xcf, 0x4, "1df6727934e8260644a89b4c2f0e4a953d45f5684f7cc506a316b32ffe9e157dcf9cd7597afa256977ad93f6c6f39ff65d9e43321fac35718c6b3be7b503d0a4521fc3e762264595f25f93bde8585c305c1b464fda2e3e7a93487e8066bcacc53a624fd8051dc4a9e13ee40365aa157fb838ed5fdd02905a47e958c1a1bf0d2312f8c651a484e2892d7f0906e8ad5dd424f14e7abbd901bf36eead24c508df28107d2f6f6c9696763202800364e2b0ac0d91bdc39f740b630f31e03ee7c841b2d6ea98a63c4fdb7134f9bb"}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000001200230b000000000000000000000200", @ANYRES32=0x0, @ANYBLOB="0000000000000000080012800400"], 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x484cb}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0x7fff}]}}}]}, 0x3c}}, 0x0) 2.4545ms ago: executing program 6 (id=3994): bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000040)="f9cee3041cf0bc0c34ae7e58ba2660ec", 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000080)={0x3, 'pim6reg\x00', {0x5}, 0x1cf6}) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xd4, 0x0, 0x400, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x81, 0x3a}}}}, [@NL80211_ATTR_SCHED_SCAN_MATCH={0xac, 0x84, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x1c, 0x6, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x8, 0x2, 0x314fb5f8}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x7}, @NL80211_BAND_6GHZ={0x8}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0xf71}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @random="bcfa9b3e5664"}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @random="7ed45a341543"}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x24, 0x6, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x8}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x6}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x6}, @NL80211_BAND_LC={0x8, 0x5, 0x8}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @from_mac}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x1}]}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x24000881}, 0x44844) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0)={0x8, 0x8, 0xc, 0xfffffeff, 0x9}, 0x14) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000400)={r1, &(0x7f0000000300)='(^#\x00', 0x224000, &(0x7f0000000340)={@_ha_fsid={[0x5, 0x1]}, {0xf, 0xe, 0x16a85b0f, 0xf4e4}}, 0xc1, &(0x7f0000000380)={@_ha_fsid}, &(0x7f00000003c0)=0x4}) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000000440)="c77fe2f0bb617debb070c9c2427f88e11a405a09c01defd69d04e2cd414c2cefa9a35cf161fdee1790538c5a755fc3dafc9971f9b7029136c5d54bf6dec043a6571e6544096c1bd6c06a1dfa2793560e845bbe7aea40462cc32e5041b9c9656920a0f92278b41f4ed6b1cbf061405cfff3d11b4fc2909799be3cf597c6c4e87593fb3c2dbecc691ac0a8ba3f") getsockname$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000540)=0x14) r5 = socket$inet_udplite(0x2, 0x2, 0x88) r6 = getuid() setsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000000580)={{{@in=@broadcast, @in6=@loopback, 0x4e24, 0x300, 0x4e22, 0x3, 0xa, 0x20, 0x80, 0x0, r4, r6}, {0x4, 0x0, 0xffffffff, 0x9, 0x3, 0x1a6, 0x9, 0x3}, {0xffffffffffffffff, 0x3ff, 0xffffffffffff2902, 0x3}, 0x1000, 0x6e6bb0, 0x0, 0x1}, {{@in6=@private0, 0x4d6, 0xff}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x3e}, 0x3505, 0x4, 0x3, 0x13, 0x2af, 0x3f8, 0x9}}, 0xe8) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x14d47937edfb1105}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x44, 0x0, 0x7, 0x5, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x8000000000000001}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x9d9}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0xecc9}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x20000801) connect$inet(r3, &(0x7f00000007c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2a}}, 0x10) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000800)=@generic={0x2, 0x9, 0x1}) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000880), r1) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000b40)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000b00)={&(0x7f00000008c0)={0x22c, r7, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x88, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xd}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x59b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER_NAME={0x17, 0x1, @l2={'eth', 0x3a, 'batadv_slave_0\x00'}}]}, @TIPC_NLA_LINK={0x8c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1fa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_NODE={0x104, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x31a3fadb}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "32e67e0bbd80af4d12b165510394836803c82a65faffc4cae5fa7c399a568c684a241a86"}}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "f2d39ddf94c769193f49c0d7fa166ca10e95bb033e61579047bf43d3f969ac26c94c"}}, @TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_ID={0x5b, 0x3, "34e60d9e800a4bec63167cb2ec26eb3d79d1deb85de52993a0af04849a745d979dd3dff25a3dd7a4729a82b11ccedfa34ca2019e4f4a3f240cafd74c7286cd5c98858cdfa0693226d8089fccac49dc7f74d21b5352ae90"}]}]}, 0x22c}, 0x1, 0x0, 0x0, 0x80}, 0x40) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000b80)=@req={0x9, 0x3, 0x7, 0xfffffffd}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000c40)={r3, 0x58, &(0x7f0000000bc0)}, 0x10) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000c80)) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f0000000cc0)=0x2, 0x4) connect$packet(r3, &(0x7f0000000d00)={0x11, 0x5, r4, 0x1, 0x4, 0x6, @random="ebc72b139c20"}, 0x14) pread64(r1, &(0x7f0000000d40)=""/114, 0x72, 0x2) syz_genetlink_get_family_id$gtp(&(0x7f0000000dc0), r1) socket$igmp(0x2, 0x3, 0x2) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000f00)={@cgroup=r3, 0x35, 0x0, 0x2, &(0x7f0000000e00)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000e40)=[0x0, 0x0, 0x0], &(0x7f0000000e80)=[0x0, 0x0, 0x0], &(0x7f0000000ec0)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000f40), &(0x7f0000000f80)=0x14) 1.720481ms ago: executing program 3 (id=3995): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="c7fb12b026c262657fec4d90c8141eeaf6a4fbd58b0c4b9f0a929947b6c1d0b0e578a5ee64cb7d45f0ac2a0a55fa8beb4295740b86", @ANYRES16=r1, @ANYBLOB="01002abd7000fddbdf25180000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000100000050fd0b004e44000006001600020000000500120001000000060011000700000008000b00ff7f0000"], 0x64}, 0x1, 0x0, 0x0, 0x804}, 0x4000000) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000000040)=[{{0x1, 0x1, 0x1, 0x1}, {0x1, 0x0, 0x1, 0x1}}, {{0x2, 0x1}, {0x1, 0x0, 0x1}}], 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_raw(r2, &(0x7f0000000140)={0x1d, r3}, 0x10) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x200002, 0x0) socket$phonet(0x23, 0x2, 0x1) close(r4) 0s ago: executing program 4 (id=3996): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=@migrate={0x50, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0x50}}, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001a0001000000000000000a0080"], 0x38}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffdd, 0xa}, [@ldst={0x3, 0x2, 0x3, 0x1c10a1, 0x0, 0x41}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7}, 0x48) kernel console output (not intermixed with test programs): [ 340.257208][T15508] lo: entered allmulticast mode [ 340.262336][T15508] tunl0: entered allmulticast mode [ 340.299371][T15508] gre0: entered allmulticast mode [ 340.305313][T15508] gretap0: entered allmulticast mode [ 340.320690][T15508] erspan0: entered allmulticast mode [ 340.352099][T15508] ip_vti0: entered allmulticast mode [ 340.369790][T15508] ip6_vti0: entered allmulticast mode [ 340.388419][T15508] sit0: entered allmulticast mode [ 340.396953][T15508] ip6tnl0: entered allmulticast mode [ 340.417813][T15508] ip6gre0: entered allmulticast mode [ 340.423759][T15508] ip6gretap0: entered allmulticast mode [ 340.431166][T15508] bridge0: entered allmulticast mode [ 340.437208][T15508] bond0: entered allmulticast mode [ 340.442637][T15508] bridge_slave_1: entered allmulticast mode [ 340.450867][T15508] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 340.459907][T15508] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode [ 340.467705][T15508] dummy0: entered allmulticast mode [ 340.482236][T15508] nlmon0: entered allmulticast mode [ 340.498558][T15508] batadv0: entered allmulticast mode [ 340.517420][T15508] veth0: entered allmulticast mode [ 340.533455][T15508] veth1: entered allmulticast mode [ 340.545456][T15508] wg0: entered allmulticast mode [ 340.552739][T15508] wg1: entered allmulticast mode [ 340.558957][T15508] wg2: entered allmulticast mode [ 340.564436][T15508] veth0_to_bridge: entered allmulticast mode [ 340.574549][T15508] x9: entered allmulticast mode [ 340.580650][T15508] veth1_to_bridge: entered allmulticast mode [ 340.593065][T15508] veth0_to_bond: entered allmulticast mode [ 340.608570][T15508] bond_slave_0: entered allmulticast mode [ 340.614675][T15508] veth1_to_bond: entered allmulticast mode [ 340.627929][T15508] bond_slave_1: entered allmulticast mode [ 340.634492][T15508] veth0_to_team: entered allmulticast mode [ 340.640877][T15508] team_slave_0: entered allmulticast mode [ 340.647216][T15508] veth1_to_team: entered allmulticast mode [ 340.653324][T15508] team_slave_1: entered allmulticast mode [ 340.659552][T15508] veth0_to_batadv: entered allmulticast mode [ 340.665958][T15508] batadv_slave_0: entered allmulticast mode [ 340.672418][T15508] veth0_to_hsr: entered allmulticast mode [ 340.679251][T15508] hsr_slave_0: entered allmulticast mode [ 340.690538][T15508] veth1_to_hsr: entered allmulticast mode [ 340.725938][T15508] veth1_virt_wifi: entered allmulticast mode [ 340.754461][T15508] veth0_virt_wifi: entered allmulticast mode [ 340.791214][T15508] virt_wifi0: entered allmulticast mode [ 340.811760][T15508] veth1_vlan: entered allmulticast mode [ 340.829537][T15508] veth0_vlan: entered allmulticast mode [ 340.880933][T15529] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2568'. [ 340.889206][T15508] vlan0: entered allmulticast mode [ 340.899197][T15508] vlan1: entered allmulticast mode [ 340.913410][T15508] macvlan0: entered allmulticast mode [ 340.930772][T15508] macvlan1: entered allmulticast mode [ 340.949246][T15508] ipvlan0: entered allmulticast mode [ 340.955246][T15508] ipvlan1: entered allmulticast mode [ 340.971928][T15508] veth1_macvtap: entered allmulticast mode [ 340.993075][T15508] veth0_macvtap: entered allmulticast mode [ 341.014622][T15508] macvtap0: entered allmulticast mode [ 341.027604][T15508] macsec0: entered allmulticast mode [ 341.039084][T15508] geneve0: entered allmulticast mode [ 341.055024][T15508] geneve1: entered allmulticast mode [ 341.069651][T15508] netdevsim netdevsim4 netdevsim1: entered allmulticast mode [ 341.089012][T15508] netdevsim netdevsim4 netdevsim2: entered allmulticast mode [ 341.103493][T15508] netdevsim netdevsim4 netdevsim3: entered allmulticast mode [ 341.116301][T15508] bridge1: entered allmulticast mode [ 341.122650][T15508] sit1: entered allmulticast mode [ 341.155668][T15508] syztnl1: entered allmulticast mode [ 341.161573][T15508] mac80211_hwsim hwsim13 wlan2: entered allmulticast mode [ 341.178156][T15508] ip6tnl1: entered allmulticast mode [ 341.184126][T15508] 8: entered allmulticast mode [ 341.192403][T15508] ipip0: entered allmulticast mode [ 341.207265][T15508] bond1: entered allmulticast mode [ 341.213472][T15508] bond2: entered allmulticast mode [ 341.220210][T15508] geneve2: entered allmulticast mode [ 341.262436][T15508] bridge2: entered allmulticast mode [ 341.268652][T15508] veth2: entered allmulticast mode [ 341.276872][T15508] veth3: entered allmulticast mode [ 341.283498][T15508] xfrm1: left promiscuous mode [ 341.288740][T15508] macvtap1: entered allmulticast mode [ 341.295091][T15508] gretap1: entered allmulticast mode [ 341.305014][T15508] veth4: entered allmulticast mode [ 341.312484][T15508] veth5: left promiscuous mode [ 341.317665][T15508] veth5: entered allmulticast mode [ 341.323829][T15508] bond4: entered allmulticast mode [ 341.329329][T15508] geneve3: entered allmulticast mode [ 341.345969][T15508] bond5: entered allmulticast mode [ 341.352402][T15508] mac80211_hwsim hwsim24 wlan3: entered allmulticast mode [ 341.363154][T15508] bond6: entered allmulticast mode [ 341.373510][T15508] bond7: entered allmulticast mode [ 341.383909][T15508] vxlan0: entered allmulticast mode [ 341.395620][T15508] ipip1: entered allmulticast mode [ 341.401754][T15508] gtp0: entered allmulticast mode [ 341.410472][T15508] veth6: entered allmulticast mode [ 341.419940][T15508] veth7: left promiscuous mode [ 341.427777][T15508] tap0: entered allmulticast mode [ 341.433056][T15508] ip6tnl2: entered allmulticast mode [ 341.438726][T15508] bond8: entered allmulticast mode [ 341.444074][T15508] sit2: entered allmulticast mode [ 341.461003][T15508] wireguard0: entered allmulticast mode [ 341.477686][T15508] 9: entered allmulticast mode [ 341.483782][T15508] mac80211_hwsim hwsim29 wlan4: entered allmulticast mode [ 341.497589][T15508] bond9: left promiscuous mode [ 341.502533][T15508] bridge3: left promiscuous mode [ 341.508409][T15508] bond9: entered allmulticast mode [ 341.513896][T15508] bridge3: entered allmulticast mode [ 341.522972][T15508] vlan2: entered allmulticast mode [ 341.537335][T15508] veth8: entered allmulticast mode [ 341.543798][T15508] ip6gre1: entered allmulticast mode [ 341.571563][T15508] gre1: entered allmulticast mode [ 341.589117][T15508] bridge4: entered allmulticast mode [ 341.597565][T15508] bond10: entered allmulticast mode [ 341.609158][T15508] veth10: entered allmulticast mode [ 341.614699][T15508] veth11: entered allmulticast mode [ 341.621065][T15508] gtp1: entered allmulticast mode [ 341.629748][T15508] bond11: left promiscuous mode [ 341.639180][T15508] bridge5: entered allmulticast mode [ 341.655249][T15508] gtp2: entered allmulticast mode [ 341.667675][T15508] : entered allmulticast mode [ 341.686197][T15508] bond12: entered allmulticast mode [ 341.716328][T15508] geneve4: entered allmulticast mode [ 341.722169][T15508] vlan4: entered allmulticast mode [ 341.836062][T15529] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 341.889873][ T149] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 341.924106][ T149] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.959470][ T149] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 341.977244][ T149] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.042228][ T149] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.076998][ T149] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.125876][ T6159] nci: nci_rsp_packet: unsupported rsp opcode 0xf00 [ 342.219906][ T6159] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.229762][ T6159] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.239220][ T6159] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.248373][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 342.248407][ C1] lec:lec_tx_timeout: lec0 [ 342.257241][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 342.304972][ T6159] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.560634][T15586] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2586'. [ 342.561199][T15589] netlink: 256 bytes leftover after parsing attributes in process `syz.5.2585'. [ 342.582488][T15589] unsupported nlmsg_type 40 [ 342.826345][T15548] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 343.073003][T15606] netlink: 'syz.5.2588': attribute type 5 has an invalid length. [ 343.099379][T15606] geneve3: entered promiscuous mode [ 343.106508][T15606] geneve3: entered allmulticast mode [ 343.128908][ T49] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 343.147780][ T49] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 343.187331][ T49] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 343.205419][ T49] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 343.351183][T15615] openvswitch: netlink: IP tunnel dst address not specified [ 343.483728][T15591] wg1 speed is unknown, defaulting to 1000 [ 343.488920][T15618] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 344.348882][T15655] __nla_validate_parse: 14 callbacks suppressed [ 344.348903][T15655] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2602'. [ 344.633444][T15674] syzkaller1: entered promiscuous mode [ 344.640637][T15674] syzkaller1: entered allmulticast mode [ 344.725114][T15677] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2607'. [ 345.287946][T15709] netlink: 'syz.2.2612': attribute type 1 has an invalid length. [ 345.388294][T15713] netlink: 'syz.2.2612': attribute type 1 has an invalid length. [ 345.454249][T15709] 8021q: adding VLAN 0 to HW filter on device bond16 [ 345.484027][T15719] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2617'. [ 345.509032][T15721] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2619'. [ 345.525570][T15719] bond0: ARP target 8.4.0.0 is already present [ 345.548910][T15719] bond0: option arp_ip_target: invalid value (1032) [ 345.647342][T15731] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2620'. [ 345.999035][T15753] netlink: 'syz.2.2628': attribute type 3 has an invalid length. [ 346.300256][T15770] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2632'. [ 346.331107][T15770] bond0: ARP target 8.4.0.0 is already present [ 346.338773][T15770] bond0: option arp_ip_target: invalid value (1032) [ 346.351254][T15774] syzkaller0: entered promiscuous mode [ 346.361684][T15774] syzkaller0: entered allmulticast mode [ 346.396507][T15778] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.2634'. [ 346.438608][T15782] delete_channel: no stack [ 346.550609][T15784] netlink: 'syz.0.2636': attribute type 5 has an invalid length. [ 346.576818][T15784] netlink: 140 bytes leftover after parsing attributes in process `syz.0.2636'. [ 346.889542][T15813] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2644'. [ 346.906410][T15811] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2642'. [ 346.920980][T15814] netlink: 'syz.5.2643': attribute type 4 has an invalid length. [ 347.022448][T15819] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 347.057553][T15817] netlink: 'syz.2.2645': attribute type 10 has an invalid length. [ 347.104982][T15819] netlink: 'syz.3.2646': attribute type 1 has an invalid length. [ 347.266674][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 347.275046][ C1] lec:lec_tx_timeout: lec0 [ 347.280000][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 347.288870][T15839] xt_HMARK: proto mask must be zero with L3 mode [ 347.556430][T15854] tipc: Enabling of bearer rejected, failed to enable media [ 347.889407][T15870] syzkaller0: entered promiscuous mode [ 347.902157][T15870] syzkaller0: entered allmulticast mode [ 348.073877][T15882] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 348.247198][T15888] sctp: [Deprecated]: syz.5.2664 (pid 15888) Use of int in max_burst socket option. [ 348.247198][T15888] Use struct sctp_assoc_value instead [ 348.413166][T15890] netdevsim netdevsim3: Direct firmware load for .. @ failed with error -2 [ 348.426824][ T5835] Bluetooth: hci5: command 0x0405 tx timeout [ 348.464373][T15890] netdevsim netdevsim3: Falling back to sysfs fallback for: .. @ [ 348.587873][T15919] netlink: 'syz.5.2669': attribute type 2 has an invalid length. [ 349.155056][T15945] bond0: ARP target 8.4.0.0 is already present [ 349.168531][T15945] bond0: option arp_ip_target: invalid value (1032) [ 349.185256][T15947] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.196206][T15943] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 349.264790][T15951] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 349.532621][T15966] __nla_validate_parse: 12 callbacks suppressed [ 349.532713][T15966] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2685'. [ 349.600191][T15972] netlink: 144 bytes leftover after parsing attributes in process `syz.5.2686'. [ 349.640395][T15974] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2685'. [ 349.714431][T15963] syzkaller0: entered promiscuous mode [ 349.723014][T15963] syzkaller0: entered allmulticast mode [ 349.782869][T15978] netlink: 248 bytes leftover after parsing attributes in process `syz.5.2688'. [ 349.795591][T15978] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2688'. [ 349.820785][T15980] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2689'. [ 349.888821][T15982] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2690'. [ 350.480967][T15984] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2691'. [ 352.180025][T15984] bond0: ARP target 8.4.0.0 is already present [ 352.186277][T15984] bond0: option arp_ip_target: invalid value (1032) [ 352.286691][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 352.295201][ C1] lec:lec_tx_timeout: lec0 [ 352.300883][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 352.639545][T16011] syzkaller1: entered promiscuous mode [ 352.654326][T16011] syzkaller1: entered allmulticast mode [ 352.824644][T16016] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2703'. [ 352.839174][T16019] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2704'. [ 352.853526][T16019] bond0: ARP target 8.4.0.0 is already present [ 352.860511][T16019] bond0: option arp_ip_target: invalid value (1032) [ 353.447140][T16049] netlink: 'syz.5.2714': attribute type 1 has an invalid length. [ 353.536104][T16049] bond1: entered promiscuous mode [ 353.543303][T16049] 8021q: adding VLAN 0 to HW filter on device bond1 [ 353.553048][T16054] nbd: must specify a size in bytes for the device [ 353.608066][T16049] syzkaller0: entered promiscuous mode [ 353.615101][T16049] syzkaller0: entered allmulticast mode [ 353.727955][T16049] RDS: rds_bind could not find a transport for ::ffff:10.1.1.4, load rds_tcp or rds_rdma? [ 353.780237][T16062] block nbd2: server does not support multiple connections per device. [ 353.792311][T16062] block nbd2: shutting down sockets [ 354.910413][T16105] __nla_validate_parse: 69 callbacks suppressed [ 354.910436][T16105] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2727'. [ 355.021747][T16112] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2730'. [ 355.205905][T16123] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2731'. [ 355.252455][T16121] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 355.781018][T16150] "syz.5.2741" (16150) uses obsolete ecb(arc4) skcipher [ 355.862672][T16152] Cannot find del_set index 4 as target [ 356.245115][T16167] netlink: 'syz.4.2747': attribute type 1 has an invalid length. [ 356.383318][T16173] bond13: (slave vxcan1): The slave device specified does not support setting the MAC address [ 356.445768][T16173] bond13: (slave vxcan1): Error -95 calling set_mac_address [ 356.587734][T16167] bond13: (slave gretap2): making interface the new active one [ 356.613705][T16167] bond13: (slave gretap2): Enslaving as an active interface with an up link [ 356.669373][T16182] macvlan2: entered promiscuous mode [ 356.674864][T16182] macvlan2: entered allmulticast mode [ 356.689668][T16182] bond13: entered promiscuous mode [ 356.701421][T16182] gretap2: entered promiscuous mode [ 356.708393][T16182] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 356.728790][T16182] bond13: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap2 [ 356.749077][T16182] bond13: left promiscuous mode [ 356.755219][T16182] gretap2: left promiscuous mode [ 357.316665][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 357.324912][ C1] lec:lec_tx_timeout: lec0 [ 357.329690][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 357.385858][T16214] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2757'. [ 357.425078][T16214] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2757'. [ 357.449620][T16214] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2757'. [ 357.737690][T16235] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.2762'. [ 357.849063][T16242] netlink: 'syz.3.2764': attribute type 1 has an invalid length. [ 357.852096][T16240] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2762'. [ 357.872840][T16242] netlink: 280 bytes leftover after parsing attributes in process `syz.3.2764'. [ 357.981503][T16249] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2765'. [ 358.001142][T16249] bond0: ARP target 8.4.0.0 is already present [ 358.015063][T16249] bond0: option arp_ip_target: invalid value (1032) [ 359.285038][T16310] netlink: 'syz.0.2782': attribute type 1 has an invalid length. [ 359.482928][T16320] netlink: 'syz.4.2784': attribute type 1 has an invalid length. [ 359.617410][T16336] 8021q: adding VLAN 0 to HW filter on device bond14 [ 359.827693][T16341] syzkaller0: entered promiscuous mode [ 359.840360][T16341] syzkaller0: entered allmulticast mode [ 360.223024][ T5145] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 360.233552][ T5145] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 360.242232][ T5145] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 360.251081][ T5145] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 360.259272][ T5145] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 360.608375][T16362] wg1 speed is unknown, defaulting to 1000 [ 360.760485][T16362] chnl_net:caif_netlink_parms(): no params data found [ 360.841694][T16362] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.849092][T16362] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.856492][T16362] bridge_slave_0: entered allmulticast mode [ 360.864348][T16362] bridge_slave_0: entered promiscuous mode [ 360.872402][T16362] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.879917][T16362] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.887751][T16362] bridge_slave_1: entered allmulticast mode [ 360.895301][T16362] bridge_slave_1: entered promiscuous mode [ 360.925816][T16362] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 360.939133][T16362] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 360.971692][T16362] team0: Port device team_slave_0 added [ 360.980372][T16362] team0: Port device team_slave_1 added [ 361.018279][T16362] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 361.025605][T16362] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.054504][T16362] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 361.068752][T16362] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 361.075874][T16362] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.102906][T16362] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 361.149293][T16362] hsr_slave_0: entered promiscuous mode [ 361.155983][T16362] hsr_slave_1: entered promiscuous mode [ 361.162454][T16362] debugfs: 'hsr0' already exists in 'hsr' [ 361.168403][T16362] Cannot create hsr debugfs directory [ 361.340745][T16362] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.353429][T16362] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 361.450541][T16362] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.461820][T16362] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 361.511593][T16362] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.522200][T16362] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 361.582578][T16362] batman_adv: batadv0: Removing interface: netdevsim0 [ 361.591225][T16362] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.603396][T16362] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 362.336797][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 362.345396][ C1] lec:lec_tx_timeout: lec0 [ 362.350919][ T5835] Bluetooth: hci6: command tx timeout [ 362.357402][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 362.497667][T16325] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 362.510843][T16359] netlink: 'syz.0.2794': attribute type 1 has an invalid length. [ 362.649338][T16362] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 362.714995][T16362] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 362.792047][T16362] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 362.824216][T16362] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 362.883744][T16397] __nla_validate_parse: 3 callbacks suppressed [ 362.883773][T16397] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2797'. [ 362.914368][T16396] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 362.930548][T16396] macsec3: entered promiscuous mode [ 363.027663][T16413] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.2802'. [ 363.092204][T16415] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.2799'. [ 363.164641][T16362] 8021q: adding VLAN 0 to HW filter on device bond0 [ 363.190523][T16418] netlink: 'syz.4.2803': attribute type 11 has an invalid length. [ 363.210722][T16418] netlink: 'syz.4.2803': attribute type 11 has an invalid length. [ 363.223278][T16362] 8021q: adding VLAN 0 to HW filter on device team0 [ 363.231242][T16418] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2803'. [ 363.247948][ T6169] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.255434][ T6169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 363.299761][ T6139] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.307234][ T6139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 363.491909][T16427] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2806'. [ 363.523744][T16429] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2807'. [ 363.546166][T16429] netlink: 'syz.4.2807': attribute type 1 has an invalid length. [ 363.572131][T16429] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2807'. [ 363.891534][T16446] ipt_ECN: cannot use operation on non-tcp rule [ 364.035693][T16449] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2812'. [ 364.127297][T16449] netlink: 'syz.0.2812': attribute type 10 has an invalid length. [ 364.273241][T16362] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 364.428072][ T5835] Bluetooth: hci6: command tx timeout [ 364.485674][T16362] veth0_vlan: entered promiscuous mode [ 364.522304][T16362] veth1_vlan: entered promiscuous mode [ 364.695942][T16362] veth0_macvtap: entered promiscuous mode [ 364.737274][T16362] veth1_macvtap: entered promiscuous mode [ 365.319118][T16484] batman_adv: batadv0: Interface deactivated: dummy0 [ 365.694531][T16484] macvlan0: left promiscuous mode [ 365.711232][T16484] geneve2: left promiscuous mode [ 365.716324][T16484] geneve2: left allmulticast mode [ 365.722766][T16484] vti0: left promiscuous mode [ 365.728631][T16484] veth5: left allmulticast mode [ 365.734638][T16484] h: left promiscuous mode [ 365.740279][T16484] bond5: left promiscuous mode [ 365.745456][T16484] ip6gre1: left promiscuous mode [ 365.757067][T16484] bond6: left allmulticast mode [ 365.777040][T16484] vlan2: left allmulticast mode [ 365.782294][T16484] bond7: left allmulticast mode [ 365.790156][T16484] geneve4: left allmulticast mode [ 365.797608][T16484] ip6tnl3: left allmulticast mode [ 365.809861][T16484] vxlan0: left promiscuous mode [ 365.830224][T16484] ip6gre3: left promiscuous mode [ 365.836321][T16484] ip6gre3: left allmulticast mode [ 365.863066][T16484] team1: left promiscuous mode [ 365.869346][T16484] team1: left allmulticast mode [ 366.021671][ T10] wg1 speed is unknown, defaulting to 1000 [ 366.021689][ T6139] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.045085][ T10] syz2: Port: 1 Link DOWN [ 366.052712][ T6139] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.090911][ T6139] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.167611][T16362] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 366.172902][T16526] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2827'. [ 366.208972][T16362] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 366.242112][ T6169] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.251632][ T6169] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.262594][ T6169] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.288940][ T6169] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.507797][ T5835] Bluetooth: hci6: command tx timeout [ 366.546820][ T6172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.555139][ T6172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.655447][T16546] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2834'. [ 366.663063][ T6139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.667607][T16548] bond5: entered allmulticast mode [ 366.677555][ T6139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.679121][T16548] ip6gre1: entered allmulticast mode [ 366.942647][T16548] bond5: left allmulticast mode [ 366.971982][T16548] ip6gre1: left allmulticast mode [ 367.054177][T16565] atomic_op ffff888067cec198 conn xmit_atomic 0000000000000000 [ 367.130315][T16570] digital: digital_start_poll: Unknown protocol [ 367.160222][T16570] netlink: 'syz.3.2838': attribute type 1 has an invalid length. [ 367.220451][T16570] 8021q: adding VLAN 0 to HW filter on device bond10 [ 367.233228][T16572] bond0: ARP target 8.4.0.0 is already present [ 367.258962][T16572] bond0: option arp_ip_target: invalid value (1032) [ 367.271248][T16570] bond10: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 367.282998][T16570] netlink: 'syz.3.2838': attribute type 1 has an invalid length. [ 367.291743][T16570] netlink: 'syz.3.2838': attribute type 2 has an invalid length. [ 367.366740][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 367.375092][ C1] lec:lec_tx_timeout: lec0 [ 367.380328][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 367.512308][T16584] mac80211_hwsim hwsim12 syzkaller0: left promiscuous mode [ 367.545949][T16584] mac80211_hwsim hwsim12 syzkaller0: left allmulticast mode [ 367.547952][T16594] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 367.714643][T16563] bridge0: entered promiscuous mode [ 367.724136][T16563] bridge0: entered allmulticast mode [ 367.784781][T16559] bridge1: entered promiscuous mode [ 367.790955][T16559] bridge1: entered allmulticast mode [ 367.927315][T16600] bridge2: entered promiscuous mode [ 367.932672][T16600] bridge2: entered allmulticast mode [ 367.942106][T16600] team0: Port device bridge2 added [ 367.979762][T16607] bridge0: port 3(team0) entered blocking state [ 368.000035][T16607] bridge0: port 3(team0) entered disabled state [ 368.031852][T16607] team0: entered allmulticast mode [ 368.059995][T16607] team_slave_0: entered allmulticast mode [ 368.070193][T16607] team_slave_1: entered allmulticast mode [ 368.126126][T16607] team0: entered promiscuous mode [ 368.143184][T16607] team_slave_0: entered promiscuous mode [ 368.153586][T16607] team_slave_1: entered promiscuous mode [ 368.174866][T16616] __nla_validate_parse: 3 callbacks suppressed [ 368.174886][T16616] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2849'. [ 368.221289][T16616] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2849'. [ 368.339328][T16609] syzkaller0: entered promiscuous mode [ 368.357275][T16609] syzkaller0: entered allmulticast mode [ 368.360546][T16633] netlink: 'syz.5.2855': attribute type 10 has an invalid length. [ 368.415222][T16616] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2849'. [ 368.461670][T16616] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2849'. [ 368.588410][ T5835] Bluetooth: hci6: command tx timeout [ 368.644374][T16644] netlink: 'syz.3.2858': attribute type 5 has an invalid length. [ 368.848729][T16658] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 370.979269][T16679] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 371.348930][T16701] nftables ruleset with unbound chain [ 371.415118][T16708] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2875'. [ 371.670685][T16720] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2876'. [ 371.705872][T16718] openvswitch: netlink: Missing key (keys=40, expected=80) [ 371.720846][T16726] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2878'. [ 372.084593][T16739] dvmrp0: entered allmulticast mode [ 372.213739][T16749] netlink: 388 bytes leftover after parsing attributes in process `syz.3.2882'. [ 372.878697][T16785] : renamed from virt_wifi0 [ 372.990094][T16790] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2889'. [ 373.146633][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5770 ms [ 373.154722][ C1] lec:lec_tx_timeout: lec0 [ 373.160222][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 373.301306][T16809] batman_adv: batadv0: Interface deactivated: dummy0 [ 373.360152][T16809] batman_adv: batadv0: Removing interface: dummy0 [ 373.403404][T16809] bond8: (slave veth0_to_bond): Releasing active interface [ 373.436719][T16809] bond8: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 373.516235][T16809] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 373.774175][T16831] netlink: 232 bytes leftover after parsing attributes in process `syz.4.2895'. [ 373.842194][T16834] netlink: 232 bytes leftover after parsing attributes in process `syz.4.2895'. [ 373.895589][T16840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2896'. [ 374.189655][T16853] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2900'. [ 374.212890][T16853] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2900'. [ 374.446086][T16861] bridge0: port 4(syz_tun) entered blocking state [ 374.457527][T16861] bridge0: port 4(syz_tun) entered disabled state [ 374.477741][T16861] syz_tun: entered allmulticast mode [ 374.500624][T16861] syz_tun: entered promiscuous mode [ 374.529052][T16867] netlink: 'syz.5.2904': attribute type 1 has an invalid length. [ 374.603281][ T5145] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 374.618932][ T5145] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 374.629871][ T5145] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 374.650181][ T5145] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 374.658464][ T5145] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 374.902259][T16882] netlink: 256 bytes leftover after parsing attributes in process `syz.5.2908'. [ 375.036273][T16884] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2909'. [ 375.119904][T16886] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2910'. [ 375.253385][T16873] wg1 speed is unknown, defaulting to 1000 [ 375.854110][T16873] chnl_net:caif_netlink_parms(): no params data found [ 375.937159][T16941] delete_channel: no stack [ 376.040573][T16873] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.049928][T16873] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.060196][T16873] bridge_slave_0: entered allmulticast mode [ 376.070179][T16873] bridge_slave_0: entered promiscuous mode [ 376.071162][T16950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2926'. [ 376.080242][T16873] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.093354][T16873] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.101735][T16873] bridge_slave_1: entered allmulticast mode [ 376.110636][T16873] bridge_slave_1: entered promiscuous mode [ 376.123746][T16954] netlink: 'syz.5.2928': attribute type 1 has an invalid length. [ 376.184909][T16954] bond2: entered promiscuous mode [ 376.190616][T16954] bond2: entered allmulticast mode [ 376.196540][T16954] 8021q: adding VLAN 0 to HW filter on device bond2 [ 376.222028][T16873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.237594][T16873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.281041][T16873] team0: Port device team_slave_0 added [ 376.308329][T16873] team0: Port device team_slave_1 added [ 376.340251][T16962] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2930'. [ 376.391040][T16873] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 376.398592][T16873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.428583][T16873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 376.450285][T16873] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 376.463145][T16873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.490904][T16873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 376.657279][T16873] hsr_slave_0: entered promiscuous mode [ 376.672809][T16873] hsr_slave_1: entered promiscuous mode [ 376.679781][T16873] debugfs: 'hsr0' already exists in 'hsr' [ 376.685944][T16873] Cannot create hsr debugfs directory [ 376.699268][T16979] netlink: 'syz.5.2936': attribute type 2 has an invalid length. [ 376.710512][T16936] delete_channel: no stack [ 376.748374][ T5835] Bluetooth: hci1: command tx timeout [ 377.487966][T17005] netlink: 'syz.2.2945': attribute type 2 has an invalid length. [ 377.496194][T17017] syzkaller0: entered promiscuous mode [ 377.520542][T17017] syzkaller0: entered allmulticast mode [ 377.720387][T17028] mac80211_hwsim hwsim12 syzkaller0: entered promiscuous mode [ 377.728571][T17028] mac80211_hwsim hwsim12 syzkaller0: entered allmulticast mode [ 377.852968][T16873] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 377.891098][T16873] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 377.924808][T16873] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 377.944428][T16873] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 377.970404][T17034] netlink: 'syz.0.2953': attribute type 1 has an invalid length. [ 378.056458][T17041] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 378.201665][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5040 ms [ 378.210127][ C1] lec:lec_tx_timeout: lec0 [ 378.216454][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 378.326972][T16873] 8021q: adding VLAN 0 to HW filter on device bond0 [ 378.414145][T16873] 8021q: adding VLAN 0 to HW filter on device team0 [ 378.440428][ T6169] bridge0: port 1(bridge_slave_0) entered blocking state [ 378.447861][ T6169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 378.493103][T17058] pim6reg: entered allmulticast mode [ 378.542520][ T6169] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.549860][ T6169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.636311][T17066] netlink: 'syz.0.2961': attribute type 1 has an invalid length. [ 378.833020][ T5835] Bluetooth: hci1: command tx timeout [ 378.919916][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.947901][T17080] __nla_validate_parse: 7 callbacks suppressed [ 378.947922][T17080] netlink: 14 bytes leftover after parsing attributes in process `syz.5.2966'. [ 378.980753][T17083] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2967'. [ 379.016305][T17080] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 379.028278][T17080] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 379.044139][T17080] bond0 (unregistering): Released all slaves [ 379.065424][T17083] bond0: ARP target 8.4.0.0 is already present [ 379.084332][T17083] bond0: option arp_ip_target: invalid value (1032) [ 379.308028][T17100] syzkaller0: entered promiscuous mode [ 379.320721][T17100] syzkaller0: entered allmulticast mode [ 379.342463][T17106] tipc: Started in network mode [ 379.347724][T17106] tipc: Node identity ac141441, cluster identity 4711 [ 379.355992][T17106] tipc: Enabled bearer , priority 10 [ 379.604944][T17121] openvswitch: netlink: Missing key (keys=40, expected=80) [ 379.615089][T17121] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2978'. [ 379.625127][T17121] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2978'. [ 379.673856][T16873] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 379.784881][T16873] veth0_vlan: entered promiscuous mode [ 379.817768][T16873] veth1_vlan: entered promiscuous mode [ 379.888524][T16873] veth0_macvtap: entered promiscuous mode [ 379.903951][T17132] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2981'. [ 379.936362][T17133] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2980'. [ 379.961729][T17137] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2982'. [ 379.980384][T16873] veth1_macvtap: entered promiscuous mode [ 380.075718][T16873] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.151171][T16873] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.223067][ T149] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.256839][ T149] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.272350][ T149] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.303763][ T149] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.450204][T17157] netlink: 'syz.5.2986': attribute type 5 has an invalid length. [ 380.470010][T17157] netlink: 140 bytes leftover after parsing attributes in process `syz.5.2986'. [ 380.511659][ T7163] tipc: Node number set to 2886997057 [ 380.540593][ T149] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.570957][ T149] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.634461][T17162] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 380.643763][ T6169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.665517][ T6169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.906996][ T5835] Bluetooth: hci1: command tx timeout [ 381.088189][T17186] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2992'. [ 381.336060][T17195] IPVS: set_ctl: invalid protocol: 62 172.20.20.187:20001 [ 381.408104][T17200] netlink: 'syz.2.3001': attribute type 15 has an invalid length. [ 381.416172][T17200] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3001'. [ 381.519821][ T6152] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 381.537930][T17200] netlink: 'syz.2.3001': attribute type 15 has an invalid length. [ 381.552513][ T6152] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 381.635384][ T6152] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 381.705793][ T6152] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 381.794707][ T5145] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 381.807081][ T5145] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 381.815875][ T5145] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 381.833609][ T5145] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 381.842640][ T5145] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 382.140953][T17225] netlink: 'syz.4.3009': attribute type 13 has an invalid length. [ 382.166440][T17225] netlink: 'syz.4.3009': attribute type 13 has an invalid length. [ 382.772463][T17214] wg1 speed is unknown, defaulting to 1000 [ 382.989362][ T5835] Bluetooth: hci1: command tx timeout [ 383.195548][T17214] chnl_net:caif_netlink_parms(): no params data found [ 383.227407][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 383.235963][ C1] lec:lec_tx_timeout: lec0 [ 383.242152][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 383.263630][T17271] skbuff: bad partial csum: csum=65506/2 headroom=144 headlen=65526 [ 383.281713][T17271] netlink: 'syz.3.3021': attribute type 10 has an invalid length. [ 383.293653][T17272] netlink: 'syz.5.3022': attribute type 6 has an invalid length. [ 383.483292][T17214] bridge0: port 1(bridge_slave_0) entered blocking state [ 383.493367][T17214] bridge0: port 1(bridge_slave_0) entered disabled state [ 383.501994][T17214] bridge_slave_0: entered allmulticast mode [ 383.510573][T17214] bridge_slave_0: entered promiscuous mode [ 383.529648][T17214] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.551926][T17214] bridge0: port 2(bridge_slave_1) entered disabled state [ 383.572428][T17214] bridge_slave_1: entered allmulticast mode [ 383.598928][T17214] bridge_slave_1: entered promiscuous mode [ 383.747841][T17214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 383.870251][T17214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 383.959011][ T5835] Bluetooth: hci4: command tx timeout [ 383.977024][T17306] __nla_validate_parse: 8 callbacks suppressed [ 383.977047][T17306] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3027'. [ 384.064162][T17306] block nbd3: Unsupported socket: should be TCP or UNIX. [ 384.119032][T17214] team0: Port device team_slave_0 added [ 384.150162][T17214] team0: Port device team_slave_1 added [ 384.243576][T17321] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 384.250593][T17214] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 384.261743][T17322] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3032'. [ 384.271028][T17214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 384.300951][T17214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 384.307495][T17322] nbd: must specify at least one socket [ 384.355290][T17214] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 384.377040][T17214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 384.445858][T17214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 384.462998][T17331] netlink: 'syz.3.3034': attribute type 2 has an invalid length. [ 384.609688][T17214] hsr_slave_0: entered promiscuous mode [ 384.629062][T17214] hsr_slave_1: entered promiscuous mode [ 384.645014][T17214] debugfs: 'hsr0' already exists in 'hsr' [ 384.662210][T17214] Cannot create hsr debugfs directory [ 385.067238][ T5835] Bluetooth: hci1: command tx timeout [ 385.250221][T17214] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.262325][T17362] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 385.294284][T17356] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 385.316871][T17214] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 385.335374][T17214] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 56593 - 0 [ 385.348103][T17214] netdevsim netdevsim0 eth3 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 385.406977][T17371] netlink: 'syz.2.3041': attribute type 10 has an invalid length. [ 385.503810][T17378] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3042'. [ 385.567040][T17381] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3043'. [ 386.037013][ T5835] Bluetooth: hci4: command tx timeout [ 386.157880][T17371] veth0_macvtap: left promiscuous mode [ 386.315629][T17378] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 386.339148][T17378] team0: Port device batadv1 added [ 386.372281][ T6139] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.383578][ T6139] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.398238][ T6139] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.427687][T17214] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 386.482761][T17214] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 386.520248][T17214] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 56593 - 0 [ 386.547193][T17401] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3046'. [ 386.556783][T17214] netdevsim netdevsim0 eth2 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 386.611208][ T6139] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.621303][T17401] bond0: ARP target 8.4.0.0 is already present [ 386.628709][T17401] bond0: option arp_ip_target: invalid value (1032) [ 386.737914][T17214] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 386.777570][T17214] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 386.802687][T17214] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 56593 - 0 [ 386.846737][T17214] netdevsim netdevsim0 eth1 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 386.891353][T17415] netem: incorrect gi model size [ 386.898429][T17415] netem: change failed [ 386.958832][T17214] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 387.007616][T17214] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 387.031816][T17214] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 56593 - 0 [ 387.053396][T17214] netdevsim netdevsim0 eth0 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 387.204141][T17435] netlink: 'syz.3.3053': attribute type 1 has an invalid length. [ 387.278459][T17436] netlink: 'syz.2.3054': attribute type 10 has an invalid length. [ 387.302630][T17439] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3055'. [ 387.316189][T17435] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3053'. [ 387.371711][T17440] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3053'. [ 387.424724][T17435] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.453401][T17435] bridge_slave_0 (unregistering): left allmulticast mode [ 387.471368][T17435] bridge_slave_0 (unregistering): left promiscuous mode [ 387.482953][T17448] netlink: 'syz.4.3055': attribute type 58 has an invalid length. [ 387.495541][T17435] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.520858][T17448] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3055'. [ 388.107094][ T5835] Bluetooth: hci4: command tx timeout [ 388.213846][T17482] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3060'. [ 388.256736][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 388.264982][ C1] lec:lec_tx_timeout: lec0 [ 388.270286][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 388.356920][T17214] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 388.409355][T17214] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 388.465646][T17214] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 388.560899][T17496] tipc: Enabling of bearer rejected, failed to enable media [ 388.581355][T17214] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 388.610063][T17500] bond0: ARP target 8.4.0.0 is already present [ 388.617746][T17500] bond0: option arp_ip_target: invalid value (1032) [ 388.625441][T17496] tipc: Trying to set illegal importance in message [ 388.917870][T17522] ieee802154 phy1 wpan1: encryption failed: -22 [ 388.939850][T17214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 389.012518][T17214] 8021q: adding VLAN 0 to HW filter on device team0 [ 389.030495][T17531] __nla_validate_parse: 2 callbacks suppressed [ 389.030515][T17531] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3071'. [ 389.056233][T17534] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3072'. [ 389.091985][T17534] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3072'. [ 389.192316][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.199686][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.221319][ T6139] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.228764][ T6139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.335706][T17544] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 389.419954][ T29] audit: type=1804 audit(1775440063.874:4): pid=17544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.3073" name="/newroot/148/memory.events" dev="tmpfs" ino=776 res=1 errno=0 [ 389.492517][T17214] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 389.527223][ T29] audit: type=1800 audit(1775440063.894:5): pid=17544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.3073" name="memory.events" dev="tmpfs" ino=776 res=0 errno=0 [ 389.979102][T17578] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3082'. [ 390.016227][T17580] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3083'. [ 390.041001][T17214] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 390.192416][ T5145] Bluetooth: hci4: command tx timeout [ 390.250239][T17214] veth0_vlan: entered promiscuous mode [ 390.317774][T17214] veth1_vlan: entered promiscuous mode [ 390.383374][T17594] openvswitch: netlink: Message has 4 unknown bytes. [ 390.523659][T17598] dummy0: left allmulticast mode [ 390.549091][T17598] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3091'. [ 390.565587][T17214] veth0_macvtap: entered promiscuous mode [ 390.625910][T17214] veth1_macvtap: entered promiscuous mode [ 390.636282][T17603] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 390.691999][T17600] netlink: 'syz.3.3093': attribute type 1 has an invalid length. [ 390.714034][T17600] netlink: 'syz.3.3093': attribute type 3 has an invalid length. [ 390.731001][T17600] netlink: 172 bytes leftover after parsing attributes in process `syz.3.3093'. [ 390.738027][T17214] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 390.755447][T17600] NCSI netlink: No device for ifindex 813332851 [ 390.802457][T17214] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 390.860890][ T6152] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.899750][T17586] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3085'. [ 390.930070][ T6152] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.949497][ T6152] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.997169][ T6139] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.227276][ T5145] Bluetooth: hci3: command 0x0405 tx timeout [ 391.252624][T17586] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 391.260824][T17586] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 391.362897][T17586] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 391.393527][T17586] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 391.446727][T17586] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 391.453612][T17586] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 391.512580][T17586] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 391.522110][T17586] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 391.634449][T17586] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 391.643497][T17586] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 391.904258][T17646] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3103'. [ 391.949609][ T1160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.951746][T17646] bond0: ARP target 8.4.0.0 is already present [ 391.963561][T17650] netlink: 'syz.3.3104': attribute type 1 has an invalid length. [ 391.973031][ T1160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.983895][T17650] netlink: 'syz.3.3104': attribute type 2 has an invalid length. [ 391.992592][T17646] bond0: option arp_ip_target: invalid value (1032) [ 392.153634][T17655] syzkaller0: entered promiscuous mode [ 392.160340][T17655] syzkaller0: entered allmulticast mode [ 392.209647][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.240839][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 393.286915][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 393.295681][ C1] lec:lec_tx_timeout: lec0 [ 393.301041][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 394.533090][T17699] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3115'. [ 394.565824][T17699] bond0: ARP target 8.4.0.0 is already present [ 394.596692][T17699] bond0: option arp_ip_target: invalid value (1032) [ 394.603884][T17697] netlink: 'syz.5.3114': attribute type 6 has an invalid length. [ 395.057473][ T5145] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 395.078683][ T5145] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 395.088361][ T5145] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 395.096501][ T5145] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 395.105881][ T5145] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 395.232629][T17731] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.243934][T17731] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.257498][T17720] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 395.271279][T17718] bond0: entered promiscuous mode [ 395.280896][T17718] bond0: entered allmulticast mode [ 395.288448][T17718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 395.325015][T17735] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.398932][T17731] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.432743][T17731] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.561923][T17744] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3124'. [ 395.688994][T17750] netlink: 'syz.3.3125': attribute type 5 has an invalid length. [ 395.716897][T17731] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.736892][T17731] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3122'. [ 395.751481][T17750] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 395.856547][T17753] syzkaller0: entered promiscuous mode [ 395.863261][T17753] syzkaller0: entered allmulticast mode [ 395.937988][T17755] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3127'. [ 396.234642][T17755] bond0: ARP target 8.4.0.0 is already present [ 396.250984][T17755] bond0: option arp_ip_target: invalid value (1032) [ 396.282008][T17719] wg1 speed is unknown, defaulting to 1000 [ 396.304949][T17770] netlink: 'syz.0.3130': attribute type 33 has an invalid length. [ 396.826433][T17719] chnl_net:caif_netlink_parms(): no params data found [ 397.006488][T17719] bridge0: port 1(bridge_slave_0) entered blocking state [ 397.015222][T17719] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.022964][T17719] bridge_slave_0: entered allmulticast mode [ 397.031795][T17719] bridge_slave_0: entered promiscuous mode [ 397.041428][T17719] bridge0: port 2(bridge_slave_1) entered blocking state [ 397.049801][T17719] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.057704][T17719] bridge_slave_1: entered allmulticast mode [ 397.068020][T17719] bridge_slave_1: entered promiscuous mode [ 397.178824][T17719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 397.228490][ T5835] Bluetooth: hci2: command tx timeout [ 397.267489][T17719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 397.276935][T17819] bond0: ARP target 8.4.0.0 is already present [ 397.302972][T17819] bond0: option arp_ip_target: invalid value (1032) [ 397.425616][T17719] team0: Port device team_slave_0 added [ 397.479457][T17719] team0: Port device team_slave_1 added [ 397.571285][T17835] netlink: 'syz.2.3146': attribute type 2 has an invalid length. [ 397.579478][T17719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 397.579498][T17719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.579526][T17719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.581509][T17719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.691997][T17719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.752086][T17719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.904422][T17719] hsr_slave_0: entered promiscuous mode [ 397.916179][T17719] hsr_slave_1: entered promiscuous mode [ 397.924174][T17719] debugfs: 'hsr0' already exists in 'hsr' [ 397.932113][T17719] Cannot create hsr debugfs directory [ 397.940622][T17849] 8021q: VLANs not supported on ip_vti0 [ 398.306636][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 398.314801][ C1] lec:lec_tx_timeout: lec0 [ 398.320155][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 398.325240][T17842] wg1 speed is unknown, defaulting to 1000 [ 398.630536][T17871] openvswitch: netlink: IP tunnel dst address not specified [ 398.797244][T17719] bond0: (slave netdevsim0): Releasing backup interface [ 399.035831][T17886] IPv6: addrconf: prefix option has invalid lifetime [ 399.042807][T17886] IPv6: addrconf: prefix option has invalid lifetime [ 399.109561][T17719] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 399.181183][T17719] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 399.306752][ T5835] Bluetooth: hci2: command tx timeout [ 399.337957][T17719] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 399.377753][T17719] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 399.556406][T17915] __nla_validate_parse: 15 callbacks suppressed [ 399.556426][T17915] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3168'. [ 399.695356][T17719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 399.707580][T17923] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3169'. [ 399.757595][T17719] 8021q: adding VLAN 0 to HW filter on device team0 [ 399.803912][ T6172] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.811282][ T6172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 399.937118][ T6152] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.938042][T17935] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3173'. [ 399.944386][ T6152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 400.257290][T17951] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3177'. [ 400.357105][T17951] netlink: 6 bytes leftover after parsing attributes in process `syz.5.3177'. [ 400.451247][T17956] netlink: 'syz.0.3178': attribute type 1 has an invalid length. [ 400.478285][T17958] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 400.482737][T17719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 400.503695][T17958] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 400.582384][T17956] 8021q: adding VLAN 0 to HW filter on device bond1 [ 400.647746][T17962] bond1: entered allmulticast mode [ 400.716071][T17966] bond1: (slave ip6gretap1): making interface the new active one [ 400.731994][T17966] ip6gretap1: entered allmulticast mode [ 400.741357][T17966] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 401.307835][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 401.317048][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 401.371736][T17719] veth0_vlan: entered promiscuous mode [ 401.387649][ T5835] Bluetooth: hci2: command tx timeout [ 401.401301][T17719] veth1_vlan: entered promiscuous mode [ 401.438442][T17719] veth0_macvtap: entered promiscuous mode [ 401.461860][T17719] veth1_macvtap: entered promiscuous mode [ 401.481422][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 401.523000][T17719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.574902][T17719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.681739][ T6172] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.697482][ T6172] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.709459][ T6172] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.720366][ T6172] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.895722][T18030] Cannot find set identified by id 1 to match [ 401.904201][T18030] netlink: 1363 bytes leftover after parsing attributes in process `syz.3.3198'. [ 401.906087][ T6169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.949763][ T6169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.009706][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.019008][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.511861][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 402.668624][T18062] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3206'. [ 402.714923][T18068] netlink: 'syz.4.3206': attribute type 11 has an invalid length. [ 402.770313][T18068] netlink: 'syz.4.3206': attribute type 11 has an invalid length. [ 402.778700][T18068] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3206'. [ 402.820304][T18075] netlink: 'syz.5.3210': attribute type 9 has an invalid length. [ 402.922960][T18080] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3211'. [ 402.928561][T18082] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3213'. [ 403.104884][T18089] ip6t_srh: unknown srh match flags 5F28 [ 403.234072][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 403.243573][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 403.313333][T18097] xt_socket: unknown flags 0xe4 [ 403.327117][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 403.336010][ C1] lec:lec_tx_timeout: lec0 [ 403.341828][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 403.403576][T18104] tipc: Started in network mode [ 403.417642][T18104] tipc: Node identity e0000001, cluster identity 4711 [ 403.438236][T18104] tipc: Enabling of bearer rejected, failed to enable media [ 403.467341][ T5835] Bluetooth: hci2: command tx timeout [ 403.551658][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 403.878310][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 404.005724][T18132] pim6reg: entered allmulticast mode [ 404.031689][T18132] pim6reg: left allmulticast mode [ 404.350742][T18157] syz.0.3233 (18157) used obsolete PPPIOCDETACH ioctl [ 404.587449][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 404.810715][T18189] __nla_validate_parse: 9 callbacks suppressed [ 404.810735][T18189] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3240'. [ 404.837510][T18188] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3240'. [ 404.855506][T18188] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3240'. [ 404.865356][T18188] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3240'. [ 405.089739][T18199] tipc: Enabled bearer , priority 0 [ 405.123059][T18205] openvswitch: netlink: Key 6 has unexpected len 16 expected 2 [ 405.223779][T18213] netlink: 'syz.3.3245': attribute type 1 has an invalid length. [ 405.250118][T18199] syzkaller0: entered promiscuous mode [ 405.255973][T18199] syzkaller0: entered allmulticast mode [ 405.266462][T18199] tipc: Resetting bearer [ 405.277007][T18213] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3245'. [ 405.288886][T18198] tipc: Resetting bearer [ 406.673133][ T7157] net_ratelimit: 3 callbacks suppressed [ 406.673155][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 406.912977][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 406.933211][T18231] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3248'. [ 407.717474][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 407.873908][T18198] tipc: Disabling bearer [ 407.887133][T18224] bond0: entered promiscuous mode [ 407.892507][T18224] bond_slave_0: entered promiscuous mode [ 407.900041][T18224] bond_slave_1: entered promiscuous mode [ 407.926443][T18231] bond0: ARP target 8.4.0.0 is already present [ 407.956887][T18231] bond0: option arp_ip_target: invalid value (1032) [ 407.995431][T18233] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3249'. [ 408.356620][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 408.364935][ C1] lec:lec_tx_timeout: lec0 [ 408.370483][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 408.490534][T18251] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3255'. [ 408.524200][T18251] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3255'. [ 408.747177][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.152312][T18266] netlink: 'syz.4.3259': attribute type 1 has an invalid length. [ 409.163181][T18266] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3259'. [ 409.545048][T18282] syzkaller0: entered promiscuous mode [ 409.552668][T18282] syzkaller0: entered allmulticast mode [ 409.797521][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.952041][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 410.532998][T18319] __nla_validate_parse: 3 callbacks suppressed [ 410.533021][T18319] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3276'. [ 410.755366][T18327] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3277'. [ 410.825207][T18329] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3278'. [ 410.847081][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 410.855836][T18329] bond0: ARP target 8.4.0.0 is already present [ 410.864539][T18329] bond0: option arp_ip_target: invalid value (1032) [ 410.963332][T18333] netem: change failed [ 411.241287][T18343] netlink: 'syz.2.3282': attribute type 1 has an invalid length. [ 411.872071][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.309263][T18377] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3290'. [ 412.366856][T18377] bond0: ARP target 8.4.0.0 is already present [ 412.374373][T18377] bond0: option arp_ip_target: invalid value (1032) [ 412.743999][T18393] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3296'. [ 412.922627][ T5826] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.931926][T18394] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3296'. [ 412.946512][T18394] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3296'. [ 412.953781][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.006978][ T5826] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.019518][T18394] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 413.094092][T18394] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 413.131950][T18394] bond0 (unregistering): Released all slaves [ 413.295748][T18398] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3297'. [ 413.469232][ T5826] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.673276][T18260] Set syz1 is full, maxelem 65536 reached [ 413.943965][T18421] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3303'. [ 413.953917][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.115361][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.165805][T18432] IPv6: sit1: Disabled Multicast RS [ 414.186700][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 414.195333][ C1] lec:lec_tx_timeout: lec0 [ 414.200569][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 414.339526][T18444] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3309'. [ 414.496495][T18454] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 414.910638][T18452] wg1 speed is unknown, defaulting to 1000 [ 414.993718][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.088203][T18482] sit2: entered promiscuous mode [ 415.094100][T18482] sit2: entered allmulticast mode [ 415.296468][T16516] IPVS: starting estimator thread 0... [ 415.408817][T18503] IPVS: using max 24 ests per chain, 57600 per kthread [ 415.430757][ T6169] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.455884][ T6169] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.512262][ T6169] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.539894][ T6169] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 415.659392][T18516] __nla_validate_parse: 6 callbacks suppressed [ 415.659412][T18516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3329'. [ 415.691928][T18516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3329'. [ 415.899306][T18526] netlink: 'syz.2.3331': attribute type 39 has an invalid length. [ 416.077428][T18533] netlink: 'syz.0.3335': attribute type 1 has an invalid length. [ 416.270601][T18539] bond2: (slave bridge1): Enslaving as a backup interface with an up link [ 416.295779][T18546] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3337'. [ 416.324473][T18542] bond2: (slave bridge2): Enslaving as a backup interface with a down link [ 416.337650][T18546] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 416.343537][T18546] syzkaller1: Linktype set failed because interface is up [ 416.360721][ T7163] syzkaller1: tun_net_xmit 90 [ 416.709205][T18568] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3346'. [ 416.721776][ T5826] IPVS: starting estimator thread 0... [ 416.774963][T18573] netlink: 160 bytes leftover after parsing attributes in process `syz.2.3348'. [ 416.818921][T18570] IPVS: using max 25 ests per chain, 60000 per kthread [ 416.912227][T18580] netlink: 'syz.0.3350': attribute type 1 has an invalid length. [ 416.952976][T18580] bond3: entered promiscuous mode [ 416.959341][T18580] 8021q: adding VLAN 0 to HW filter on device bond3 [ 416.981433][T18580] 8021q: adding VLAN 0 to HW filter on device bond3 [ 416.989111][T18580] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 416.999574][T18580] bond3: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 417.012958][T18580] bond3: (slave vcan1): making interface the new active one [ 417.020666][T18580] vcan1: entered promiscuous mode [ 417.028965][T18580] bond3: (slave vcan1): Enslaving as an active interface with an up link [ 417.069372][ T7163] net_ratelimit: 146 callbacks suppressed [ 417.069395][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.157081][ T5826] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.595826][T18609] netlink: 'syz.2.3358': attribute type 10 has an invalid length. [ 417.814279][T18621] tipc: Started in network mode [ 417.847541][T18621] tipc: Node identity ac14140f, cluster identity 4711 [ 417.870523][T18621] tipc: New replicast peer: 255.255.255.255 [ 417.899695][T18621] tipc: Enabled bearer , priority 10 [ 418.082222][T18635] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3363'. [ 418.107527][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.318044][T18648] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3366'. [ 418.443931][T18651] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3367'. [ 418.470398][T18651] No such timeout policy "syz0" [ 418.588437][ T5826] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.808622][T18668] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3371'. [ 419.026717][ T7157] tipc: Node number set to 2886997007 [ 419.026989][T18677] netlink: 'syz.2.3374': attribute type 11 has an invalid length. [ 419.056953][T18677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3374'. [ 419.063563][T18681] netlink: 'syz.4.3376': attribute type 1 has an invalid length. [ 419.066414][T18677] netlink: 'syz.2.3374': attribute type 11 has an invalid length. [ 419.147920][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.217220][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 419.225795][ C1] lec:lec_tx_timeout: lec0 [ 419.232272][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 419.287090][T18689] netlink: 'syz.2.3378': attribute type 1 has an invalid length. [ 419.354118][T18689] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 419.366298][T18689] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 419.438115][ T5145] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 419.448718][ T5145] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 419.461630][ T5145] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 419.471443][ T5145] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 419.479438][ T5145] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 419.495585][T18699] macvlan2: entered promiscuous mode [ 419.503296][T18699] macvlan2: entered allmulticast mode [ 419.510337][T18699] bond2: entered promiscuous mode [ 419.517166][T18699] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 419.531463][T18699] bond2: left promiscuous mode [ 419.838256][T18721] netlink: 'syz.0.3386': attribute type 1 has an invalid length. [ 419.876820][ T5826] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.888153][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.998028][T18724] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 420.029164][T18724] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 420.129480][T18721] netlink: 'syz.0.3386': attribute type 4 has an invalid length. [ 420.187704][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.235510][T18698] wg1 speed is unknown, defaulting to 1000 [ 420.621047][T18717] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 420.700205][T18698] chnl_net:caif_netlink_parms(): no params data found [ 420.912692][T18759] __nla_validate_parse: 6 callbacks suppressed [ 420.912714][T18759] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3393'. [ 421.227181][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.366999][T18751] wg1 speed is unknown, defaulting to 1000 [ 421.393121][T18698] bridge0: port 1(bridge_slave_0) entered blocking state [ 421.408536][T18698] bridge0: port 1(bridge_slave_0) entered disabled state [ 421.421647][T18698] bridge_slave_0: entered allmulticast mode [ 421.438050][T18698] bridge_slave_0: entered promiscuous mode [ 421.531994][T18698] bridge0: port 2(bridge_slave_1) entered blocking state [ 421.546226][T18698] bridge0: port 2(bridge_slave_1) entered disabled state [ 421.547544][ T5145] Bluetooth: hci3: command tx timeout [ 421.564698][T18698] bridge_slave_1: entered allmulticast mode [ 421.585899][T18698] bridge_slave_1: entered promiscuous mode [ 421.627014][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.754816][T18779] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3398'. [ 421.774865][T18779] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3398'. [ 421.798910][T18779] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3398'. [ 421.800655][T18698] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 421.843984][T18698] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.882864][T18779] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3398'. [ 421.916786][T18779] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3398'. [ 421.925817][T18779] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3398'. [ 422.006164][ T1160] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 422.051097][ T1160] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 422.096317][ T1160] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 422.129970][T18698] team0: Port device team_slave_0 added [ 422.136049][T18767] wg1 speed is unknown, defaulting to 1000 [ 422.136072][ T1160] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 422.176215][T18698] team0: Port device team_slave_1 added [ 422.267501][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.335492][T18698] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 422.343784][T18698] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.379457][T18698] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 422.401332][T18698] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 422.416749][T18698] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.444954][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.495455][T18698] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 422.735451][T18698] hsr_slave_0: entered promiscuous mode [ 422.748653][T18698] hsr_slave_1: entered promiscuous mode [ 422.765780][T18698] debugfs: 'hsr0' already exists in 'hsr' [ 422.774731][T18698] Cannot create hsr debugfs directory [ 422.907165][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.226911][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.308198][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.323733][T18800] : entered promiscuous mode [ 423.349725][T18800] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3404'. [ 423.570973][T18809] validate_nla: 3 callbacks suppressed [ 423.570994][T18809] netlink: 'syz.3.3406': attribute type 1 has an invalid length. [ 423.625076][T18809] netlink: 476 bytes leftover after parsing attributes in process `syz.3.3406'. [ 423.634439][ T5145] Bluetooth: hci3: command tx timeout [ 423.691449][T18809] netlink: 1041 bytes leftover after parsing attributes in process `syz.3.3406'. [ 423.720850][T18812] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 423.746233][T18698] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 423.754449][T18815] nbd: socks must be embedded in a SOCK_ITEM attr [ 423.803281][T18698] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 423.832380][T18698] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 423.875771][T18698] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 424.011636][T18829] bond0: ARP target 8.4.0.0 is already present [ 424.022027][T18829] bond0: option arp_ip_target: invalid value (1032) [ 424.145261][T18698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 424.207925][T18698] 8021q: adding VLAN 0 to HW filter on device team0 [ 424.220755][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.235013][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.242568][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 424.243768][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.250673][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 424.250700][ C1] lec:lec_tx_timeout: lec0 [ 424.256949][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 424.269947][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.270077][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 424.287515][T18836] netlink: 'syz.2.3413': attribute type 15 has an invalid length. [ 424.325578][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.363230][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.385559][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.394786][T18698] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 424.395327][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.406498][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.424114][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.438607][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.450318][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.458796][T18833] ip6t_srh: unknown srh invflags 4000 [ 424.772996][T18848] syzkaller1: entered promiscuous mode [ 424.785598][T18848] syzkaller1: entered allmulticast mode [ 424.803223][T18851] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 424.871410][T18698] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 425.096698][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805713cc00: rx timeout, send abort [ 425.107854][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805713cc00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 425.215939][T18867] bond0: ARP target 8.4.0.0 is already present [ 425.240837][T18867] bond0: option arp_ip_target: invalid value (1032) [ 425.386323][T18872] sctp: [Deprecated]: syz.0.3422 (pid 18872) Use of int in maxseg socket option. [ 425.386323][T18872] Use struct sctp_assoc_value instead [ 425.413604][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.690537][T18698] veth0_vlan: entered promiscuous mode [ 425.707743][ T5145] Bluetooth: hci3: command tx timeout [ 425.771853][T18698] veth1_vlan: entered promiscuous mode [ 425.889998][T18698] veth0_macvtap: entered promiscuous mode [ 425.908006][T18698] veth1_macvtap: entered promiscuous mode [ 425.948507][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.955915][T18698] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 425.983794][T18698] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 426.005465][ T149] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.039185][ T149] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.085985][ T149] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.098846][T18891] x_tables: duplicate underflow at hook 3 [ 426.101538][ T149] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.239583][ T6172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 426.264190][ T6172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 426.293816][T18895] __nla_validate_parse: 4 callbacks suppressed [ 426.293837][T18895] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3430'. [ 426.315927][T18895] x_tables: duplicate underflow at hook 3 [ 426.346220][ T149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 426.354911][ T149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 426.436864][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.544767][T18901] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3432'. [ 426.972477][T18922] netlink: 'syz.0.3438': attribute type 29 has an invalid length. [ 427.004719][T18926] lo: entered allmulticast mode [ 427.018290][T18926] lo: left allmulticast mode [ 427.025271][T18922] netlink: 'syz.0.3438': attribute type 29 has an invalid length. [ 427.051353][T18922] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3438'. [ 427.077266][T18922] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3438'. [ 427.468934][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.788894][ T5145] Bluetooth: hci3: command tx timeout [ 427.828608][ T5826] IPVS: starting estimator thread 0... [ 427.840896][T18974] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3452'. [ 427.868483][T18978] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3453'. [ 427.898911][T18978] netlink: 'syz.4.3453': attribute type 7 has an invalid length. [ 427.921228][T18978] netlink: 'syz.4.3453': attribute type 7 has an invalid length. [ 427.947479][T18976] IPVS: using max 28 ests per chain, 67200 per kthread [ 428.127667][ T49] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.136528][ T49] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.148716][ T49] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.166778][ T49] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.507884][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.987582][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.225284][T18995] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3456'. [ 429.266628][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 429.274847][ C1] lec:lec_tx_timeout: lec0 [ 429.279787][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 429.302449][T19001] netlink: 'syz.6.3457': attribute type 1 has an invalid length. [ 429.471055][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.557187][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.112919][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.121401][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.286309][T18946] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 430.503278][T19007] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3461'. [ 430.537216][T19008] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3460'. [ 430.587471][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.610703][T19008] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 430.923665][T19023] can: request_module (can-proto-5) failed. [ 431.205391][T19042] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3468'. [ 431.277916][T19050] IPVS: stopping master sync thread 19051 ... [ 431.282177][T19051] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_vlan, syncid = 2, id = 0 [ 431.514682][T19057] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3471'. [ 431.633116][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.235530][T19086] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3477'. [ 432.383619][T19092] xt_CT: You must specify a L4 protocol and not use inversions on it [ 432.630619][T19102] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3483'. [ 432.671363][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.715855][T19102] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3483'. [ 432.829135][T19107] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3484'. [ 433.150602][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.152705][T19128] netlink: 'syz.6.3488': attribute type 28 has an invalid length. [ 433.375124][T19138] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3494'. [ 433.384400][T19133] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 433.427308][T19133] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 433.565996][T19146] C: renamed from lo (while UP) [ 433.578264][T19146] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 433.614108][T19141] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3495'. [ 433.622088][T19152] netlink: 'syz.0.3499': attribute type 1 has an invalid length. [ 433.634413][T19152] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3499'. [ 433.665117][T19153] netlink: 'syz.0.3499': attribute type 1 has an invalid length. [ 433.676768][T19153] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3499'. [ 433.708688][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.753689][T19157] netlink: 16215 bytes leftover after parsing attributes in process `syz.3.3500'. [ 434.286901][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 434.294990][ C1] lec:lec_tx_timeout: lec0 [ 434.302455][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 434.482600][T19181] syz.0.3507 (19181) used greatest stack depth: 17472 bytes left [ 434.696494][T19199] bond0: ARP target 8.4.0.0 is already present [ 434.724997][T19199] bond0: option arp_ip_target: invalid value (1032) [ 434.747581][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.800846][T19208] syzkaller1: entered promiscuous mode [ 434.851456][T19208] syzkaller1: entered allmulticast mode [ 435.137038][T19222] netlink: 'syz.6.3519': attribute type 2 has an invalid length. [ 435.513636][T19238] syzkaller0: entered promiscuous mode [ 435.520323][T19238] syzkaller0: entered allmulticast mode [ 435.534359][T19238] lo: entered promiscuous mode [ 435.562653][T19238] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 435.599760][T19242] netlink: 'syz.4.3524': attribute type 1 has an invalid length. [ 435.736525][T19242] syzkaller0: entered promiscuous mode [ 435.742387][T19242] syzkaller0: entered allmulticast mode [ 435.787329][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.188393][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.869968][ T7165] net_ratelimit: 1 callbacks suppressed [ 437.869984][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.920308][T19255] bond0: ARP target 8.4.0.0 is already present [ 437.927019][T19255] bond0: option arp_ip_target: invalid value (1032) [ 438.177459][T19284] netlink: 'syz.3.3537': attribute type 1 has an invalid length. [ 438.196963][T19284] __nla_validate_parse: 5 callbacks suppressed [ 438.196985][T19284] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3537'. [ 438.232309][T19296] netlink: 'syz.3.3537': attribute type 2 has an invalid length. [ 438.240481][T19284] netlink: 'syz.3.3537': attribute type 1 has an invalid length. [ 438.255278][T19284] netlink: 'syz.3.3537': attribute type 8 has an invalid length. [ 438.268858][T19284] netlink: 582 bytes leftover after parsing attributes in process `syz.3.3537'. [ 438.364268][T19301] netlink: 'syz.2.3541': attribute type 1 has an invalid length. [ 438.419109][T19301] netlink: 476 bytes leftover after parsing attributes in process `syz.2.3541'. [ 438.494188][T19301] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.3541'. [ 438.536289][T19312] netlink: 'syz.3.3545': attribute type 1 has an invalid length. [ 438.852483][T19326] netlink: 'syz.2.3550': attribute type 1 has an invalid length. [ 438.907187][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.218171][T19350] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3556'. [ 439.227797][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.316948][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 439.325092][ C1] lec:lec_tx_timeout: lec0 [ 439.329899][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 439.714385][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.890391][T19386] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3567'. [ 439.915939][T19388] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3568'. [ 439.943608][T19388] bond0: ARP target 8.4.0.0 is already present [ 439.950638][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.959603][T19388] bond0: option arp_ip_target: invalid value (1032) [ 440.310818][T19420] openvswitch: netlink: Invalid VLAN frame [ 440.352102][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.800892][T19429] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3578'. [ 440.988232][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.027210][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.276059][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.357300][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.066963][ C0] net_ratelimit: 1 callbacks suppressed [ 443.066984][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.081131][ T7157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.082675][T19401] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 443.348142][T19442] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3581'. [ 443.372464][T19443] netlink: 'syz.0.3582': attribute type 1 has an invalid length. [ 443.380534][T19443] netlink: 'syz.0.3582': attribute type 3 has an invalid length. [ 443.388858][T19443] netlink: 'syz.0.3582': attribute type 7 has an invalid length. [ 443.401430][T19443] netlink: 'syz.0.3582': attribute type 8 has an invalid length. [ 443.420862][T19443] netlink: 184 bytes leftover after parsing attributes in process `syz.0.3582'. [ 443.484377][T19443] NCSI netlink: No device for ifindex 131092 [ 443.489713][T19445] 8021q: adding VLAN 0 to HW filter on device bond0 [ 443.552202][T19445] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 443.605524][T19448] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3583'. [ 443.626009][T19448] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 443.638996][T19448] team0: Port device batadv2 added [ 443.810377][T19458] netlink: 'syz.3.3587': attribute type 1 has an invalid length. [ 443.830165][T19458] netlink: 16110 bytes leftover after parsing attributes in process `syz.3.3587'. [ 443.873401][T19458] netlink: 'syz.3.3587': attribute type 1 has an invalid length. [ 443.876002][T19464] sctp: [Deprecated]: syz.0.3586 (pid 19464) Use of int in max_burst socket option. [ 443.876002][T19464] Use struct sctp_assoc_value instead [ 443.894810][T19458] netlink: 16110 bytes leftover after parsing attributes in process `syz.3.3587'. [ 443.971808][T19464] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3586'. [ 444.118420][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.336892][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 444.345033][ C1] lec:lec_tx_timeout: lec0 [ 444.352519][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 444.495062][T19497] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3594'. [ 444.552765][T19497] bond0: ARP target 8.4.0.0 is already present [ 444.565112][T19497] bond0: option arp_ip_target: invalid value (1032) [ 444.644339][T19506] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3595'. [ 444.762147][T19508] xfrm1: entered allmulticast mode [ 444.871128][T19514] tipc: Enabling of bearer rejected, failed to enable media [ 444.948935][T19520] bond1: Removing last ns target with arp_interval on [ 445.140857][T19531] netlink: 'syz.4.3602': attribute type 83 has an invalid length. [ 445.158281][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.173790][T19535] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3604'. [ 445.190069][T19531] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3602'. [ 445.309425][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.682581][T19541] bond0: ARP target 8.4.0.0 is already present [ 445.690560][T19541] bond0: option arp_ip_target: invalid value (1032) [ 445.886205][T19563] : entered promiscuous mode [ 446.187403][ T7156] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.359589][T19598] bond0: ARP target 8.4.0.0 is already present [ 446.388810][T19598] bond0: option arp_ip_target: invalid value (1032) [ 446.729336][T19616] gretap0: entered promiscuous mode [ 446.735743][T19616] vlan3: entered promiscuous mode [ 447.080307][T19623] netlink: 'syz.3.3628': attribute type 39 has an invalid length. [ 447.163509][T19623] hsr_slave_1 (unregistering): left promiscuous mode [ 447.232056][ T7156] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.277305][T19634] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.287961][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.267755][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.347446][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.202514][T19584] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 449.307075][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.315958][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.324437][ T7156] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.366750][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 449.375125][ C1] lec:lec_tx_timeout: lec0 [ 449.379803][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 449.608535][T19672] __nla_validate_parse: 9 callbacks suppressed [ 449.608558][T19672] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3640'. [ 449.689909][T19680] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 449.874335][T19689] SET target dimension over the limit! [ 449.900898][T19690] netlink: 'syz.3.3645': attribute type 1 has an invalid length. [ 449.915894][T19690] netlink: 'syz.3.3645': attribute type 2 has an invalid length. [ 449.951357][T19694] syzkaller0: entered promiscuous mode [ 449.957136][T19694] syzkaller0: entered allmulticast mode [ 449.970376][T19691] netlink: 'syz.3.3645': attribute type 9 has an invalid length. [ 449.981293][T19698] veth0_virt_wifi: entered promiscuous mode [ 450.047682][T19698] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3648'. [ 450.215286][T19711] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3650'. [ 450.287824][T19698] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3648'. [ 450.310971][T19713] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3651'. [ 450.343321][T19699] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3648'. [ 450.353433][ T7156] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.379226][T19710] block nbd2: NBD_DISCONNECT [ 450.591393][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.656231][T19726] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3656'. [ 450.788197][T19738] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3660'. [ 450.801731][T19726] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 450.828297][T19726] bond3 (unregistering): Released all slaves [ 450.941947][T19747] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3663'. [ 450.981910][T19747] bond0: ARP target 8.4.0.0 is already present [ 451.009739][T19747] bond0: option arp_ip_target: invalid value (1032) [ 451.114020][T19754] xt_hashlimit: size too large, truncated to 1048576 [ 451.163104][T19755] xt_connbytes: Forcing CT accounting to be enabled [ 451.198167][T19761] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3666'. [ 451.230593][T16516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.388992][T19757] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 451.393172][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.489805][T19757] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 451.499651][T19777] netlink: 'syz.0.3671': attribute type 7 has an invalid length. [ 451.516182][T19777] netlink: 'syz.0.3671': attribute type 8 has an invalid length. [ 451.580808][T19777] ip6gretap0: entered promiscuous mode [ 451.598959][T19777] gretap0: entered promiscuous mode [ 451.611928][T19777] erspan0: entered promiscuous mode [ 451.873091][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.395799][T19812] bond0: ARP target 8.4.0.0 is already present [ 452.402871][T19812] bond0: option arp_ip_target: invalid value (1032) [ 452.620308][T19825] syzkaller0: entered promiscuous mode [ 452.626389][T19825] syzkaller0: entered allmulticast mode [ 452.971698][T19845] syzkaller0: entered promiscuous mode [ 452.978164][T19845] syzkaller0: entered allmulticast mode [ 453.084554][T19850] netlink: 'syz.3.3698': attribute type 1 has an invalid length. [ 453.095155][T19850] netlink: 'syz.3.3698': attribute type 1 has an invalid length. [ 453.481408][ T7165] net_ratelimit: 1 callbacks suppressed [ 453.481439][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.793596][T19875] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 453.994907][T19886] netlink: 'syz.2.3708': attribute type 11 has an invalid length. [ 454.004156][T19886] netlink: 'syz.2.3708': attribute type 4 has an invalid length. [ 454.025876][T19886] pim6reg1: entered promiscuous mode [ 454.038401][T19886] pim6reg1: entered allmulticast mode [ 454.067509][T19886] netlink: 'syz.2.3708': attribute type 11 has an invalid length. [ 454.102352][T19886] netlink: 'syz.2.3708': attribute type 4 has an invalid length. [ 454.268860][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.508711][ T7165] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.573205][T19907] netlink: 'syz.2.3715': attribute type 1 has an invalid length. [ 454.610793][T19907] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 454.685360][T19917] __nla_validate_parse: 11 callbacks suppressed [ 454.685385][T19917] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3717'. [ 454.789493][T19917] gretap0: entered promiscuous mode [ 454.795115][T19917] vlan2: entered promiscuous mode [ 454.961526][T19929] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3723'. [ 454.975558][T19929] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3723'. [ 454.996205][T19930] netlink: 'syz.3.3722': attribute type 2 has an invalid length. [ 455.037840][T19929] tipc: Enabled bearer , priority 0 [ 455.125717][T19929] wg1: entered allmulticast mode [ 455.154649][T19929] tipc: Resetting bearer [ 455.164238][T19938] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3726'. [ 455.183925][T19928] tipc: Disabling bearer [ 455.408546][T19955] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3732'. [ 455.707004][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6330 ms [ 455.715528][ C1] lec:lec_tx_timeout: lec0 [ 455.722727][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 455.820009][T19967] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 455.841285][T19967] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 456.517759][T20005] netlink: 'syz.0.3748': attribute type 3 has an invalid length. [ 456.534409][T19997] bond1: option miimon: invalid value (18446744073709551585) [ 456.542751][T19997] bond1: option miimon: allowed values 0 - 2147483647 [ 456.552322][T19997] bond1 (unregistering): Released all slaves [ 456.631664][T20000] bond1: option miimon: invalid value (18446744073709551585) [ 456.639909][T20000] bond1: option miimon: allowed values 0 - 2147483647 [ 456.653726][T20000] bond1 (unregistering): Released all slaves [ 456.718294][T20007] bridge_slave_1: left allmulticast mode [ 456.724369][T20007] bridge_slave_1: left promiscuous mode [ 456.733749][T20007] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.798999][T20014] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3750'. [ 456.817759][T20007] bond0: (slave bond_slave_0): Releasing backup interface [ 456.848532][T20007] bond0: (slave bond_slave_1): Releasing backup interface [ 456.854823][T20014] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3750'. [ 456.873720][T20007] team0: Port device team_slave_0 removed [ 456.883942][T20007] team0: Port device team_slave_1 removed [ 456.891032][T20007] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 456.899179][T20007] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 456.914103][T20007] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 456.922631][T20007] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 456.935400][T20007] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 457.024601][T20021] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3750'. [ 457.293817][T20038] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3757'. [ 457.687958][T20062] bridge0: port 2(bridge_slave_1) entered disabled state [ 457.695672][T20062] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.739887][T20069] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3764'. [ 457.942632][T20074] netlink: 'syz.3.3768': attribute type 61 has an invalid length. [ 458.001629][T20081] set match dimension is over the limit! [ 458.017995][T20082] set match dimension is over the limit! [ 458.149612][T20085] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 458.157808][T20085] syzkaller1: linktype set to 4 [ 458.791264][T20114] veth3: entered allmulticast mode [ 458.816546][T20114] netlink: 'syz.0.3778': attribute type 142 has an invalid length. [ 459.524585][T20148] ieee802154 phy1 wpan1: encryption failed: -22 [ 459.557292][T20150] netlink: 'syz.0.3787': attribute type 1 has an invalid length. [ 459.771216][ T7163] IPVS: starting estimator thread 0... [ 459.812065][T20159] netlink: 'syz.0.3790': attribute type 1 has an invalid length. [ 459.837314][T20159] bond6: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 459.879751][T20159] bond6: (slave lo): Enslaving as an active interface with an up link [ 459.897455][T20161] IPVS: using max 48 ests per chain, 115200 per kthread [ 459.905985][T20159] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 459.923752][T20154] netlink: 'syz.3.3789': attribute type 29 has an invalid length. [ 459.933072][T20162] netlink: 'syz.3.3789': attribute type 29 has an invalid length. [ 460.157292][T20171] __nla_validate_parse: 9 callbacks suppressed [ 460.157313][T20171] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3793'. [ 460.340974][T20178] netlink: 'syz.0.3796': attribute type 2 has an invalid length. [ 460.457948][T20178] bond7: entered promiscuous mode [ 460.465893][T20183] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3798'. [ 460.481466][T20178] bond7: entered allmulticast mode [ 460.488117][T20178] 8021q: adding VLAN 0 to HW filter on device bond7 [ 460.876348][T20203] netlink: 'syz.4.3804': attribute type 5 has an invalid length. [ 461.045697][T20206] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 461.053417][T20206] IPv6: NLM_F_CREATE should be set when creating new route [ 461.061233][T20206] IPv6: NLM_F_CREATE should be set when creating new route [ 461.148521][T20208] sctp: [Deprecated]: syz.4.3806 (pid 20208) Use of int in max_burst socket option. [ 461.148521][T20208] Use struct sctp_assoc_value instead [ 461.166113][T20211] sctp: [Deprecated]: syz.2.3807 (pid 20211) Use of int in maxseg socket option. [ 461.166113][T20211] Use struct sctp_assoc_value instead [ 461.466674][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 461.474928][ C1] lec:lec_tx_timeout: lec0 [ 461.480032][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 461.783507][T20233] ip6t_rpfilter: unknown options [ 461.820079][T20233] syzkaller0: entered promiscuous mode [ 461.831020][T20235] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3816'. [ 461.852437][T20237] netlink: 'syz.6.3817': attribute type 83 has an invalid length. [ 462.012826][T20245] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 462.098255][T20250] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 462.205163][T20259] netlink: 766 bytes leftover after parsing attributes in process `syz.6.3824'. [ 462.274063][T20261] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3823'. [ 462.827974][T20293] netlink: 'syz.2.3833': attribute type 4 has an invalid length. [ 462.836085][T20293] netlink: 17 bytes leftover after parsing attributes in process `syz.2.3833'. [ 462.882722][T20295] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3835'. [ 462.944968][T20302] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3834'. [ 463.053262][T20305] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3836'. [ 463.302291][T20305] bond3: entered promiscuous mode [ 463.332468][T20305] 8021q: adding VLAN 0 to HW filter on device bond3 [ 463.397710][T20309] bridge2: entered promiscuous mode [ 463.411942][T20309] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 463.592152][T20327] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3841'. [ 463.939850][T20348] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 464.052446][T20356] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.061396][T20356] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.129974][T20360] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.137467][T20360] bridge0: port 2(bridge_slave_1) entered forwarding state [ 464.145166][T20360] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.152717][T20360] bridge0: port 1(bridge_slave_0) entered forwarding state [ 464.169436][T20360] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.176845][T20360] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.717388][T20391] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 465.075612][T20408] Bluetooth: MGMT ver 1.23 [ 465.242581][T20421] netlink: 'syz.0.3864': attribute type 1 has an invalid length. [ 465.401237][T20421] 8021q: adding VLAN 0 to HW filter on device bond8 [ 465.452826][T20433] syzkaller0: entered promiscuous mode [ 465.497223][T20433] syzkaller0: entered allmulticast mode [ 465.511863][T20440] __nla_validate_parse: 6 callbacks suppressed [ 465.511887][T20440] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3867'. [ 465.580504][T20440] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3867'. [ 465.621520][T20449] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3870'. [ 466.239008][T20485] netlink: 'syz.4.3876': attribute type 1 has an invalid length. [ 466.246357][T20486] bridge0: port 1(gretap0) entered blocking state [ 466.269719][T20486] bridge0: port 1(gretap0) entered disabled state [ 466.278099][T20488] netlink: 'syz.6.3878': attribute type 21 has an invalid length. [ 466.285868][T20486] gretap0: entered allmulticast mode [ 466.306010][T20491] netlink: 'syz.4.3876': attribute type 1 has an invalid length. [ 466.308096][T20488] IPv6: NLM_F_CREATE should be specified when creating new route [ 466.322435][T20490] netlink: 'syz.2.3879': attribute type 10 has an invalid length. [ 466.330568][T20486] gretap0: entered promiscuous mode [ 466.340406][T20486] bridge0: port 1(gretap0) entered blocking state [ 466.347092][T20486] bridge0: port 1(gretap0) entered forwarding state [ 466.375632][T20490] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 466.557346][T20500] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3880'. [ 466.849981][T20514] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3885'. [ 466.872290][T20516] netlink: 184 bytes leftover after parsing attributes in process `syz.6.3884'. [ 466.893948][T20516] ksmbd: Unknown IPC event: 4, ignore. [ 466.909526][T20514] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3885'. [ 466.949509][T20523] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3888'. [ 466.961648][T20523] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3888'. [ 467.157689][T20534] netlink: 'syz.6.3890': attribute type 1 has an invalid length. [ 467.182146][T20534] netlink: 96 bytes leftover after parsing attributes in process `syz.6.3890'. [ 467.226675][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 467.235857][ C1] lec:lec_tx_timeout: lec0 [ 467.242347][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 467.249620][T20534] netlink: 'syz.6.3890': attribute type 1 has an invalid length. [ 467.291660][T20534] netlink: 'syz.6.3890': attribute type 8 has an invalid length. [ 467.300515][T20534] netlink: 'syz.6.3890': attribute type 1 has an invalid length. [ 467.319603][T20534] netlink: 'syz.6.3890': attribute type 1 has an invalid length. [ 467.367506][T20534] netlink: 'syz.6.3890': attribute type 8 has an invalid length. [ 467.532788][T20548] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 467.627084][T20548] xt_hashlimit: size too large, truncated to 1048576 [ 467.712510][T20556] : renamed from vxcan1 (while UP) [ 467.872965][T20571] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 468.027496][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.036874][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.045439][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.054496][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.639231][T20608] syzkaller0: entered promiscuous mode [ 468.801803][T20616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 468.930075][T20625] sctp: [Deprecated]: syz.2.3916 (pid 20625) Use of int in max_burst socket option deprecated. [ 468.930075][T20625] Use struct sctp_assoc_value instead [ 469.244849][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.328827][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.407068][ T7163] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.754126][T20663] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 470.012026][T20671] sch_fq: defrate 0 ignored. [ 470.209624][T20688] tipc: Started in network mode [ 470.224978][T20688] tipc: Node identity , cluster identity 4711 [ 470.236991][T20688] tipc: Failed to obtain node identity [ 470.245929][T20688] tipc: Enabling of bearer rejected, failed to enable media [ 470.584930][T20672] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.592972][T20672] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.909114][T20672] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 470.950982][T20672] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 471.317718][T20678] __nla_validate_parse: 77 callbacks suppressed [ 471.317742][T20678] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3937'. [ 471.340157][T20698] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 471.462497][ T149] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.474400][ T149] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.567874][T20712] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3944'. [ 471.718021][ T49] bond5 (unregistering): (slave ip6gre1): Releasing backup interface [ 471.827040][ T49] bond6 (unregistering): (slave ip6gretap1): Releasing active interface [ 471.886833][T20736] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 472.080524][ T49] bond7 (unregistering): (slave geneve4): Releasing active interface [ 472.256845][ T49] bond0 (unregistering): Released all slaves [ 472.266636][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 472.275065][ C1] lec:lec_tx_timeout: lec0 [ 472.280076][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 472.291788][ T49] bond1 (unregistering): Released all slaves [ 472.305541][ T49] bond2 (unregistering): Released all slaves [ 472.324575][ T49] bond3 (unregistering): Released all slaves [ 472.342995][ T49] bond4 (unregistering): Released all slaves [ 472.363399][ T49] bond5 (unregistering): Released all slaves [ 472.383445][ T49] bond6 (unregistering): Released all slaves [ 472.401198][ T49] bond7 (unregistering): Released all slaves [ 472.424184][ T49] bond8 (unregistering): Released all slaves [ 472.439903][ T49] bond9 (unregistering): Released all slaves [ 472.457443][ T49] bond10 (unregistering): (slave veth0_to_bond): Releasing active interface [ 472.472301][ T49] bond10 (unregistering): Released all slaves [ 472.485591][ T149] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.497272][ T149] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.507213][ T149] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.516314][ T149] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.576670][ T149] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.599093][ T149] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.761075][ T49] tipc: Disabling bearer [ 472.790429][ T49] tipc: Left network mode [ 472.860688][T20754] ip6tnl3: entered allmulticast mode [ 472.896011][ T49] IPVS: stopping backup sync thread 13297 ... [ 473.000986][T20760] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3958'. [ 473.060939][T20761] ieee802154 phy1 wpan1: encryption failed: -22 [ 473.233872][T20780] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3964'. [ 473.285018][T20780] netlink: 2 bytes leftover after parsing attributes in process `syz.6.3964'. [ 473.504572][T20800] validate_nla: 101 callbacks suppressed [ 473.504595][T20800] netlink: 'syz.3.3968': attribute type 16 has an invalid length. [ 473.571427][T20800] netlink: 'syz.3.3968': attribute type 17 has an invalid length. [ 473.677889][T20800] bridge0: port 1(gretap0) entered disabled state [ 473.800112][T20800] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 473.924789][T20816] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3972'. [ 473.998870][T20824] IPv6: NLM_F_REPLACE set, but no existing node found! [ 474.191669][T20832] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3978'. [ 475.099512][T20859] netlink: 'syz.4.3985': attribute type 1 has an invalid length. [ 475.289478][T20872] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3988'. [ 475.458019][T20859] bond2: entered promiscuous mode [ 475.473911][T20859] 8021q: adding VLAN 0 to HW filter on device bond2 [ 475.544094][T20889] sctp: [Deprecated]: syz.3.3991 (pid 20889) Use of struct sctp_assoc_value in delayed_ack socket option. [ 475.544094][T20889] Use struct sctp_sack_info instead [ 475.634987][T20872] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 475.645407][T20878] bond2: (slave bridge2): making interface the new active one [ 475.662210][T20878] bridge2: entered promiscuous mode [ 475.669328][T20878] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 475.733617][ T49] hsr_slave_0: left promiscuous mode [ 475.769555][ T49] 0: left promiscuous mode [ 475.786250][ T49] batman_adv: batadv0: Removing interface: dummy0 [ 475.823945][T20903] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 475.859828][ T49] pim6reg (unregistering): left allmulticast mode [ 475.877805][T20903] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 475.982966][ T12] smc: removing ib device syz1 [ 476.284056][T20900] bond9: option resend_igmp: invalid value (32767) [ 476.296867][T20900] bond9: option resend_igmp: allowed values 0 - 255 [ 476.308504][T20900] bond9 (unregistering): Released all slaves [ 476.362501][ T10] ================================================================== [ 476.371075][ T10] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x5e/0x170 [ 476.380306][ T10] Read of size 8 at addr ffff88807aa962f0 by task kworker/0:1/10 [ 476.388118][ T10] [ 476.390454][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 476.390488][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 476.390499][ T10] Workqueue: events smc_ib_port_event_work [ 476.390521][ T10] Call Trace: [ 476.390529][ T10] [ 476.390537][ T10] dump_stack_lvl+0xe8/0x150 [ 476.390559][ T10] print_report+0xba/0x230 [ 476.390576][ T10] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 476.390592][ T10] kasan_report+0x117/0x150 [ 476.390612][ T10] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 476.390631][ T10] __ethtool_get_link_ksettings+0x5e/0x170 [ 476.390650][ T10] ib_get_eth_speed+0x180/0x7f0 [ 476.390680][ T10] ? rxe_query_port+0x7e/0x3d0 [ 476.390700][ T10] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 476.390724][ T10] ? do_raw_spin_unlock+0xf5/0x210 [ 476.390743][ T10] rxe_query_port+0x93/0x3d0 [ 476.390764][ T10] ib_query_port+0x170/0x830 [ 476.390779][ T10] smc_ib_port_event_work+0x15a/0x940 [ 476.390797][ T10] ? process_scheduled_works+0xa8d/0x18c0 [ 476.390815][ T10] ? process_scheduled_works+0xa8d/0x18c0 [ 476.390833][ T10] process_scheduled_works+0xb6e/0x18c0 [ 476.390862][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 476.390881][ T10] ? assign_work+0x3d5/0x5e0 [ 476.390901][ T10] worker_thread+0xa53/0xfc0 [ 476.390929][ T10] kthread+0x388/0x470 [ 476.390943][ T10] ? __pfx_worker_thread+0x10/0x10 [ 476.390961][ T10] ? __pfx_kthread+0x10/0x10 [ 476.390975][ T10] ret_from_fork+0x51e/0xb90 [ 476.390995][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 476.391012][ T10] ? __switch_to+0xc7d/0x1450 [ 476.391028][ T10] ? __pfx_kthread+0x10/0x10 [ 476.391042][ T10] ret_from_fork_asm+0x1a/0x30 [ 476.391077][ T10] [ 476.391082][ T10] [ 476.566526][ T10] Allocated by task 5837: [ 476.570869][ T10] kasan_save_track+0x3e/0x80 [ 476.575900][ T10] __kasan_kmalloc+0x93/0xb0 [ 476.580622][ T10] __kvmalloc_node_noprof+0x528/0x8a0 [ 476.586118][ T10] alloc_netdev_mqs+0xa6/0x11b0 [ 476.590986][ T10] rtnl_create_link+0x31f/0xd70 [ 476.595848][ T10] rtnl_newlink_create+0x277/0xb70 [ 476.601135][ T10] rtnl_newlink+0x166a/0x1bb0 [ 476.605812][ T10] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 476.610749][ T10] netlink_rcv_skb+0x232/0x4b0 [ 476.615725][ T10] netlink_unicast+0x80f/0x9b0 [ 476.620495][ T10] netlink_sendmsg+0x813/0xb40 [ 476.625271][ T10] __sys_sendto+0x672/0x710 [ 476.629789][ T10] __x64_sys_sendto+0xde/0x100 [ 476.634642][ T10] do_syscall_64+0x14d/0xf80 [ 476.639265][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.645606][ T10] [ 476.648019][ T10] Freed by task 49: [ 476.651831][ T10] kasan_save_track+0x3e/0x80 [ 476.656512][ T10] kasan_save_free_info+0x46/0x50 [ 476.661557][ T10] __kasan_slab_free+0x5c/0x80 [ 476.666322][ T10] kfree+0x1c1/0x630 [ 476.670391][ T10] device_release+0xc4/0x1f0 [ 476.674982][ T10] kobject_put+0x228/0x560 [ 476.679593][ T10] netdev_run_todo+0xc75/0xde0 [ 476.684402][ T10] default_device_exit_batch+0x986/0xa00 [ 476.690340][ T10] ops_undo_list+0x52b/0x940 [ 476.694960][ T10] cleanup_net+0x56b/0x800 [ 476.699472][ T10] process_scheduled_works+0xb6e/0x18c0 [ 476.705202][ T10] worker_thread+0xa53/0xfc0 [ 476.709895][ T10] kthread+0x388/0x470 [ 476.713974][ T10] ret_from_fork+0x51e/0xb90 [ 476.718571][ T10] ret_from_fork_asm+0x1a/0x30 [ 476.723344][ T10] [ 476.725669][ T10] The buggy address belongs to the object at ffff88807aa96000 [ 476.725669][ T10] which belongs to the cache kmalloc-cg-4k of size 4096 [ 476.740172][ T10] The buggy address is located 752 bytes inside of [ 476.740172][ T10] freed 4096-byte region [ffff88807aa96000, ffff88807aa97000) [ 476.754498][ T10] [ 476.756824][ T10] The buggy address belongs to the physical page: [ 476.763247][ T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7aa90 [ 476.772110][ T10] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 476.780786][ T10] memcg:ffff888030f90181 [ 476.785202][ T10] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 476.792752][ T10] page_type: f5(slab) [ 476.796739][ T10] raw: 00fff00000000040 ffff88813fe02500 dead000000000100 dead000000000122 [ 476.805584][ T10] raw: 0000000000000000 0000000800040004 00000000f5000000 ffff888030f90181 [ 476.814255][ T10] head: 00fff00000000040 ffff88813fe02500 dead000000000100 dead000000000122 [ 476.823901][ T10] head: 0000000000000000 0000000800040004 00000000f5000000 ffff888030f90181 [ 476.833152][ T10] head: 00fff00000000003 ffffea0001eaa401 00000000ffffffff 00000000ffffffff [ 476.841839][ T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 476.850871][ T10] page dumped because: kasan: bad access detected [ 476.857284][ T10] page_owner tracks the page as allocated [ 476.863436][ T10] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5206, tgid 5206 (udevd), ts 36102057484, free_ts 36074914965 [ 476.884455][ T10] post_alloc_hook+0x231/0x280 [ 476.889325][ T10] get_page_from_freelist+0x24dc/0x2580 [ 476.895055][ T10] __alloc_frozen_pages_noprof+0x18d/0x380 [ 476.900870][ T10] allocate_slab+0x77/0x660 [ 476.905382][ T10] refill_objects+0x331/0x3c0 [ 476.910077][ T10] __pcs_replace_empty_main+0x2e6/0x730 [ 476.915811][ T10] __kvmalloc_node_noprof+0x657/0x8a0 [ 476.921368][ T10] seq_read_iter+0x202/0xe10 [ 476.926031][ T10] vfs_read+0x582/0xa70 [ 476.930302][ T10] ksys_read+0x150/0x270 [ 476.934614][ T10] do_syscall_64+0x14d/0xf80 [ 476.939218][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.945222][ T10] page last free pid 5195 tgid 5195 stack trace: [ 476.951943][ T10] __free_frozen_pages+0xc2b/0xdb0 [ 476.957249][ T10] __slab_free+0x263/0x2b0 [ 476.961777][ T10] qlist_free_all+0x97/0x100 [ 476.966551][ T10] kasan_quarantine_reduce+0x148/0x160 [ 476.972023][ T10] __kasan_slab_alloc+0x22/0x80 [ 476.976926][ T10] __kmalloc_noprof+0x316/0x760 [ 476.981781][ T10] tomoyo_realpath_from_path+0xe3/0x5d0 [ 476.987505][ T10] tomoyo_check_open_permission+0x229/0x470 [ 476.993581][ T10] security_file_open+0xa9/0x240 [ 476.999744][ T10] do_dentry_open+0x384/0x14e0 [ 477.004672][ T10] vfs_open+0x3b/0x340 [ 477.008869][ T10] path_openat+0x2e08/0x3860 [ 477.013494][ T10] do_file_open+0x23e/0x4a0 [ 477.018100][ T10] do_sys_openat2+0x113/0x200 [ 477.023092][ T10] __x64_sys_openat+0x138/0x170 [ 477.028220][ T10] do_syscall_64+0x14d/0xf80 [ 477.032994][ T10] [ 477.035405][ T10] Memory state around the buggy address: [ 477.041049][ T10] ffff88807aa96180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 477.049657][ T10] ffff88807aa96200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 477.057984][ T10] >ffff88807aa96280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 477.066130][ T10] ^ [ 477.074592][ T10] ffff88807aa96300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 477.083095][ T10] ffff88807aa96380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 477.091430][ T10] ================================================================== [ 477.161846][ T10] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 477.169300][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 477.178594][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 477.188969][ T10] Workqueue: events smc_ib_port_event_work [ 477.194828][ T10] Call Trace: [ 477.198221][ T10] [ 477.201350][ T10] vpanic+0x56c/0xa60 [ 477.205468][ T10] ? __pfx_vpanic+0x10/0x10 [ 477.210386][ T10] ? __pfx___schedule+0x10/0x10 [ 477.215425][ T10] panic+0xc5/0xd0 [ 477.219170][ T10] ? __pfx_panic+0x10/0x10 [ 477.223728][ T10] ? preempt_schedule_common+0x82/0xd0 [ 477.229780][ T10] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 477.235876][ T10] check_panic_on_warn+0x89/0xb0 [ 477.241014][ T10] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 477.247016][ T10] end_report+0x73/0x180 [ 477.251285][ T10] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 477.257369][ T10] kasan_report+0x128/0x150 [ 477.262046][ T10] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 477.268099][ T10] __ethtool_get_link_ksettings+0x5e/0x170 [ 477.274025][ T10] ib_get_eth_speed+0x180/0x7f0 [ 477.278913][ T10] ? rxe_query_port+0x7e/0x3d0 [ 477.283781][ T10] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 477.289183][ T10] ? do_raw_spin_unlock+0xf5/0x210 [ 477.294397][ T10] rxe_query_port+0x93/0x3d0 [ 477.299042][ T10] ib_query_port+0x170/0x830 [ 477.304078][ T10] smc_ib_port_event_work+0x15a/0x940 [ 477.309475][ T10] ? process_scheduled_works+0xa8d/0x18c0 [ 477.315218][ T10] ? process_scheduled_works+0xa8d/0x18c0 [ 477.320968][ T10] process_scheduled_works+0xb6e/0x18c0 [ 477.326545][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 477.332549][ T10] ? assign_work+0x3d5/0x5e0 [ 477.337157][ T10] worker_thread+0xa53/0xfc0 [ 477.341770][ T10] kthread+0x388/0x470 [ 477.345929][ T10] ? __pfx_worker_thread+0x10/0x10 [ 477.351047][ T10] ? __pfx_kthread+0x10/0x10 [ 477.355727][ T10] ret_from_fork+0x51e/0xb90 [ 477.360349][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 477.365468][ T10] ? __switch_to+0xc7d/0x1450 [ 477.370152][ T10] ? __pfx_kthread+0x10/0x10 [ 477.374764][ T10] ret_from_fork_asm+0x1a/0x30 [ 477.379783][ T10] [ 477.382982][ T10] Kernel Offset: disabled [ 477.387411][ T10] Rebooting in 86400 seconds..