last executing test programs: 6.02266023s ago: executing program 4 (id=7341): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=@newsa={0x13c, 0x10, 0x413, 0x0, 0x25dfdbfb, {{@in6=@dev, @in=@remote}, {@in=@private=0xa010100, 0x0, 0x32}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, {0x0, 0x400, 0x0, 0x0, 0x0, 0x40000000000000}, {0x0, 0xb, 0x0, 0x8000}, {}, 0x0, 0x1000000, 0xa}, [@algo_aead={0x4c, 0x12, {{'rfc4106-gcm-aesni\x00'}, 0x0, 0x40}}]}, 0x13c}}, 0x4000080) socket$inet6(0xa, 0x2, 0x0) (async) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) (async) setsockopt$inet6_int(r2, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) read(r2, &(0x7f0000000040)=""/244, 0xf4) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES32=r0], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000ad8000000060a010400000000000000000a0000010900010073797a3100000000ac0004802000018007000100637400001400028008000240000000010800014000000009540001800a00010072656469720000084400028008f101400000001108000240000000170800034000000061080003400000000608000140000000000800024000000008080002400000000f08000340000000303400018011000100666c6f775f6f66666c6f616400ffff001c0002800900010057797a32000000000900010073797a31000000000900020073797a32"], 0x100}, 0x1, 0x0, 0x0, 0x8001}, 0x24000000) 5.194468548s ago: executing program 0 (id=7347): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25e000000100000000000000000000000000000000000000000000000000000000000401464e2400020000000021000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb000000000000000000000100000004d632000000ff020000000000000000000000000001060000000000000000000000000000000000000000000000090000000000000004000000ffffffffd00000000000000001000080000000004305000000000000040000000000000000000000000000800001000000000000010000000000000030e1613f00000000000000002dbd7000053500000a000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x40) 5.005839377s ago: executing program 4 (id=7350): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x74, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x43}, 0x4008085) socket(0x1f, 0x5, 0x2000000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_type(r5, &(0x7f0000000100), 0x2, 0x0) preadv(r6, &(0x7f0000000ac0)=[{&(0x7f00000004c0)=""/83, 0x53}], 0x1, 0x80000000, 0xffffffff) socket$unix(0x1, 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4a24, @dev={0xac, 0x14, 0x14, 0x12}}, {0x2, 0x4e21, @empty}, 0x4, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200001, 0x1ff, 0x9}) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) ioctl$SIOCX25SFACILITIES(r1, 0x8917, 0x0) 4.923466252s ago: executing program 0 (id=7351): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="04000000040000000400000009"], 0x50) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f00000000c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd22, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xc, 0xf}, {}, {0xfff1, 0x2}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r3, {0xa, 0xc}, {0x0, 0xfff1}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x240440d4}, 0x4041810) bind$inet(r1, &(0x7f0000000440)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000038f030000000000fe02001085000000b900000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x12, '\x00', 0x0, @lsm=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000200)={0x0, 0xfffffffffffffc6c, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x501, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0xffffffff, 0x3, 0xfffffffe, 0x40a}}}}, 0x7a}, 0x1, 0x0, 0x0, 0x1}, 0x4098) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@mpls_getroute={0xa0, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_NEWDST={0x84, 0x13, [{0x8, 0x0, 0x1}, {0x48}, {0x999f}, {}, {0xa67}, {0x9}, {0xa7}, {0x831}, {0x2}, {0x6, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x7, 0x0, 0x1}, {0x1, 0x0, 0x1}, {0x2}, {0xc}, {0x4, 0x0, 0x1}, {0xffb6b, 0x0, 0x1}, {0x5}, {0x101}, {}, {0x7}, {0x208}, {0x3, 0x0, 0x1}, {0x8}, {0x7}, {0xb, 0x0, 0x1}, {0x2}, {0x7f, 0x0, 0x1}, {0x5, 0x0, 0x1}, {0x8f, 0x0, 0x1}, {0xd4}, {0x6, 0x0, 0x1}]}]}, 0xa0}}, 0x4000) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x4}, {}, {0xffe0, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x41d808}]}}]}, 0x3c}}, 0x20040054) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={0x1, &(0x7f00000003c0)="798a53293a7aebc5f37072f7064370a29c27c99f69bb684623e10ccb498f99c7363516e192ea2f8063616167dcbe3af496bd81611b3274f26b7397a144f8fb24fe050a51f545da10cda39c8192212cb3477c5738587beac881584fac537bdb2a0fb281f9599b4c410509", &(0x7f00000001c0)=""/62}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000850000962a110398a4000000000000"], &(0x7f00000000c0)='syzkaller\x00'}, 0x94) 4.396429322s ago: executing program 1 (id=7354): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="58010000100013070000000000000000fc020000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141417000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000000000000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e530c001c00", @ANYRES32=0x0, @ANYBLOB="07a6000000"], 0x158}}, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f00000002c0)={{}, 0x0, 0x0, @inherit={0x48, &(0x7f0000019400)=ANY=[]}, @devid}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xf, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0xffffffff}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000002400)="800000800000210ee7decd7a0000", 0xe, 0x200000c1, &(0x7f00000001c0)={0x11, 0x88a8, r5, 0x1, 0x3}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000240)=ANY=[@ANYRESOCT=r3, @ANYRESDEC=r3, @ANYRESHEX=r4, @ANYRESOCT=r6], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000002c0)={@private1={0xfc, 0x1, '\x00', 0x3}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @dev={0xfe, 0x80, '\x00', 0x24}, 0x9, 0x8, 0x0, 0x0, 0x4, 0x200002}) ioctl$F2FS_IOC_DECOMPRESS_FILE(r2, 0xf517, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)) ioctl$sock_inet6_tcp_SIOCATMARK(r2, 0x8010743f, 0x0) r7 = socket(0xf, 0x1, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000000090108000000000000000000000001080005400000001c0900010073797a31000c000480080001400000000386676055b690caaba62cc09f5ebfbd4caa8561150d4ceb6772879defd566f5b79660095987e913b2d7d2ddebe4380d94d0d2121ab8dabc2205e3a4613c724d753621ba000000"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x2000000) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000100)={0x0, 0xfffffcebfff, 0x1000, 0x0, 0x1}, 0x20) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r10, 0x0, 0x8008000000010, &(0x7f0000000180)="17000000020002000003be8c5ee17688a8006c00030100ecff3f0000000300000a0001000098fc5a53d3f5b7e4a96c6b06169da9c0f8d9485bbb6a880000d6c8db0000dba67e06000000e289c46f8ab8b4028a7a63c900000200df0180000000000100000000000080c457681f009cee4a5acb3da400001fb7315033bf79ac2df5bc080236e2b68c8eec25a02aff06011500394100000000000affff02dfccebf6ba00085d024f0298e9e90554062a80e605007f71174aa9", 0xb8) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_IP_PROTO={0x5, 0x1b, 0x1}]}, 0x24}}, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c00018006000600800e0000100002800c0019"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$nl_route(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000056000100000000000000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) 4.071865501s ago: executing program 3 (id=7355): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x4}, {0x0, [0x0, 0x5f]}}, 0x0, 0x1c}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x4}, {0x0, [0x0, 0x5f]}}, 0x0, 0x1c}, 0x28) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b04, &(0x7f0000000040)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b04, &(0x7f0000000040)={'wlan0\x00'}) sendmmsg$inet_sctp(r0, &(0x7f0000003480)=[{0x0, 0x0, 0x0, 0x6, &(0x7f0000002580)=[@prinfo={0x18, 0x84, 0x5, {0x10, 0x5}}, @dstaddrv4={0x18, 0x84, 0x7, @multicast1}], 0x30, 0x8004}], 0x1, 0x44000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x15}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000000000)={0x40, 0x1405, 0x1, 0x70bd2d, 0x25dfdbfb, "", [{{0x8, 0x1, 0x2}, {0x8, 0x3, 0x1}}, {{0x8}, {0x8, 0x3, 0x3}}, {{0x8}, {0x8, 0x3, 0x4}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x40080) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) (async) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) getpid() (async) r7 = getpid() ioctl$sock_FIOSETOWN(r6, 0x8901, &(0x7f0000000380)=r7) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f00000003c0)) r8 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x4) socket$unix(0x1, 0x1, 0x0) (async) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)={0x58, 0x0, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000048}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)={0x58, 0x0, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000048}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r13, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_DEL(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x24, r13, 0x1, 0x1, 0x3, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000840}, 0x4000084) (async) sendmsg$FOU_CMD_DEL(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x24, r13, 0x1, 0x1, 0x3, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000840}, 0x4000084) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r5, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}, @ETHTOOL_A_PAUSE_TX={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) 3.83596143s ago: executing program 3 (id=7356): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="18000000200015"], 0x18}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) ioctl$INCFS_IOC_FILL_BLOCKS(r2, 0x80106720, &(0x7f0000000340)={0x5, &(0x7f0000001440)=[{0xa9, 0x3c, &(0x7f0000000000)="5da2d5c666e2223eb58cd7dd4a28f8c4411d98f54ea92a0e52ed830e2e676a9db05beeeb77b176efd7a8f9861e3c5aa3dc8e5884013ec8893c6294ae", 0x1}, {0x9, 0x2d, &(0x7f0000000040)="e3e98834dc841bc950d0c0e6ec425bae45e317000c40aa790b71fb2c55d745ca06629ec5ddcf68e55681b56a60"}, {0x94a, 0x10, &(0x7f0000000180)="91a356464b53f6e4b9c6cdc9359cb46b", 0x0, 0x1}, {0x9, 0x1000, &(0x7f0000000440)="afa00243596ed84e90d8d60068790944e2a110a30b44e2e5e0300f4b51a431d549cb348bf04b941fa759f4e0d377d385629acc96ed3185e8eac82f2a17ac410957831d2850cceb4e28068afaf3f527a5a519c6ffb662e357908d2be59b38d00393c155b5620ed1e56bb970dab5b004f25df7848bb5c8c08e2b4d7980fc3ce5390794b25de2a510e1f1bf4a24a40a407fabc96d59d5157b67d61c16f498d04954d79e1dc155227c20dd4fab733a06375f5ddfea0d3e84eba8c0c8e41c33088978a6d89e1392f1d499416f7ba64de582f372678e625a3bb37580a3b5a81c0c0341a87839512bc2ffde6f4239db5a921fdee9a2029c51d4567769c6357c3ade18e9675949b91b29a60af443664bc131b215f9935302ab2b93cb8460d1e1d07712c6237fc8a5f435a8806bbf22cfb6b34b3000510787c1f982983f1bd02658fd3ba677e51f8e6e197410fb2a1dc5d5a8ab28e3f9f33284f3c1601dccd043ef92efa79a05e277439805c15fabe9fac307a0125a8993bf8167ebfe598a02d67aa076526c83de46a48fa756e59275116af70cd467ceeac8b8d0ae60f3192fc55d5c20c413ae41f9d99c77122598b71d04fcdb1c675d1ac7dc917f1ef5a3b58d9578bbc4363a29120603c60841b6178e46415b76fbb506057d30a130872de72d1d3cbd2aedf885cabcfd1842ce04a4f471a64866d5577ee412c3f60d72adfce1be8b94ca0ccc8b8ad02e587141ba96f66327207398ad3c60b9276a508400b461771608f7e000f6f2c788fbfcb0dbe1864b3180dbfb9a494a4fd04b9355739ced48598b5bc2a3a74ed214f0675106e9995cf5b1a75d3a8544acba9534d39d61c591047f5ac8e63d4ca05c415238f4cc38bdf9d7d249aaa9edbb257ee6f16ff63b9ef5dceadd8e15830a158792584e6ad64d4d26d8ed391acc772978921f14bc8dbdab00635885f73b94a31ed7677e1322bb8402c6ded9adf85cbcf408a0507d5256d4006fdebc137cd6ad77ebd8657e6a3e996a18bcbbc5dfdac692f155bb3614cb2b7b620bae12e9ab8d1192f0d1528c375ebc68f45b525be03765ee5ee5f93dc4bafb1f04f218d3068fe3d45c1d2036e8f5ebf1a9f6daca0fbcd6193926d7c9feec9fc64c36c0cf518ec0abc000a70146f90a7b5f6e62502d7bfe7b9f6684fe934f73295434eb750d4eafbad68e4ff780683875fdc43ff922288c5a2d8683237874de1800a6f3a06d52c5897739e922f6431a79ee1ce8e8783428c6b20ad59db0cfc0fa5112509d2364a6e9a6133faceeea26dd3be515d67d8dadc6ae2875c3d389f49dbd0dc788e5ec3a74bc3cd9913669d3e45d4bb77b2f56043ca337c203b5aa2c9dccc051f091627e54b38a4a4059f7e65af8727c94e4c1abd076da3cf80bb4ecd79c9a01696f821d7784cbcca00bd800e231f576cbb95aed05ab1f97afe85822cf1736542bf7584a8a861602fd3a9fd6627d1ebaf46586add97811abb5aea4ba212bd309e0cdd5c418d051b41d0b5a639b7b533c3dfff3be48d9a72dc43e0424f774e4391e4e45bdcd80435af5a5dcb54980d219fe38045c2167d2700d8214324441884f10277b9ace14c47de64b98e876c63d07acc8d7a3498a2c9b6038ff3bfa79e50eb0717330d9a1949121cf30abbc949b5c9f6e6ef7fc5c420188067a45e880e333e7eb6ef4ffcc97c2d1b9843051d8435174437a200d121e026b96b5c39cca9a9758d870a83d30706f7ffd8c7c754875ad0d160f4870c4aac5e83536e1c4e90ef586aa6b54031ee0b18a46328dd910b6677992e7143d8c41598a4c0c3b586728310a6ed8315483bf425234eb1e01a9c42fb0e8ec61eada036858d13a0eb51f919b90a2dc72853ef67ce94f18bd76ddf0b2e4a760c71ad30665804986bd6f498e3ce7ca1086ae1a2b336523fb6c1852c63f1956b4341cb279811eafa1fbb93c99a5208d1bd8b93f880958036d05dc3b1c525eccfe94d3f4eb8e7cd3eb5e34ad860c583a8883644a312ee259437a9a69db353b2b70efcf3f25922470425afff17f1069ee1d28ce8aac3981f03eef43adc0dc551077c822864fbb3a45979d31f7cbe3bfc609049847fb40f9aeb12eb2b8b3830f8c01365b47060e1f4ebd86cd889913d171bdf8ee830356b4d35b131da9ffe473145832022c93a484143ad04ae6d83f4c66cc5cd17966d28ff31ff199a31fa460617314d58c45c3f7fc6089eac1fbb5c012674015742544c150b89507279b257f514dace8607bef889e3bf05911de592166c5d74be69fa771584969ee64bf59f641b81532ceb1db1cbd46ca834fa7f23772a03eba32b476bbbe860379d8f68e0aa63af450caea3eb7fdbd8f30af45fd203391166424a9099ad63686da87e9c40b4cf9d15d0c77f66ce67e3bee7fa2fa8480e93d7013991b3800268bdbd10a7d486e4b3f90a1fbb9bc96238331ccfcd104d0aa45dce7033607d22e0e646efe77ab976a528fc4e35b79f8eaaba797c663f583bcdad8efd828dd50f97a1b68e438813f69b95530858b5d2f19449301dde7cfe10958fe9aee655d09458ba88d384c82c786da6eef7cd16945b6bbbc343a777dd10ab04546fbc5c08379d6d1606f08ccd05bd705bf3a0e7af7317d7e161d22d0eba551cbc9110535ba2b1500107858ec097b02638c3f29f37e94a2d11796cac7ce730d99f210031008dc4774487e58da24d38b19be9a0d48f5cd3c230a738730e619c0334747d48dd0ba346d216129a581faacea6b8a2a522193a5d068c4d18f1cd2a8eb8940dd196753978eb4bebb5038b405f0e994b8cad9fce0c875762a0a6346047e19aa54bc2a9bffbf4e1f5a9e02657e3ac7757f09f23162bcea7b57b2341bcf9dc0f2c5b5bc73841483cd018f65728b19fd82fd991fabf86b9b794e279f683744016a077c9c1e5cf254dd32f747aa2bde4e5629abf5a776837371f7138bcc1f226a3075801a7469736fb74a047e0865f74c541b137e0a475e6a7340798ac9495b0816efe1d60b4f267dfa9136291da87d5f6d9519708a76fcd84fc5beb9654c7cca5fce1d126f2d45f1bbf62c3ae34999deb508007191c7086ffe3f6b4265e9003f035c5e018ad563bf30f3d87e930220ae36cf73c9c013464c7b83906a5845928912fb829c8a810a90c1ba12473104779c655d9b5f32d7e635a7f62ef1776f38a5604f7751dd76b8bf0380d1455897cf695762517abaccae054b408e2f19caa3e4d10f5640790ceaa6ae87a3ac0578db15b65fac33f76203b67d528278a3e39eb318bafdbfab87c97619c1bc73dff9d840bb269d9f205029ee25e203a28d8613e2845efcd9030be582eb1d8f7ede5be305c5a96e6ac61c003ad3accdc058e054d075316c0df826af43a3f57fe2441e7ae093731efa1b9e500465ca7240811c436cc4cb9f5ffc32043425d18c4594d43cf89bc914d4ce2b61806938c736eb298f95a4768b794762277777ca0fc6196aa83a4d7d548f7e09eb81e101de7ecf5fcb31b36c8a9edfc124bfa4678d0b6cbcd2d2b30579173e5c98a15a89888555caf687a0756577a6a71f658d821a027d912ed3b2a944458d00812b463467eb058bde163ee5330baf27ed102ef0c188dc03352d0e2330e9e64a74ae773ea37555f1011cf2d0c7ffcb8517c272ce8b377e93cc326ce393faa073fc40a0242503775d1282947850399fdf9e4949c3e46920c84e88628d512d3cc0f561da9e52aa4d7b1bd6ca7b65e1efdb9fce3c6212404c72ded6cd0e51170564c12892cb94e81a8820e4e8100f3d570df32e375c121c6c5f6b9a956fc046d580a6752c395d5964b63e6c6d1ce3883d429b19ca6db6cf9ce275e4b0b7f496c0a6cd9bb7f154d80f7472be2a2e535fdfa587e612182afc274dbe39c7cddc1415db9a73846221f358e88731a0d018e944844d549787c46cceeea9ac8fa0e6f73eaf171ea4f8c47feb7dd1312f10aacf1af1bfb21e1eb2fbed263a15e6b1aef31ff6736994be5b1ace6f8c482990c0bb6bf0da36688985d47acc8d66798d2ffad6b1babeb9a1c003a7b6382d82e3357171583200c172697d9a47c769e5e5f20a054ee4ea89d7f3fd34c3ac1f98b8ceca392666a4e87d4b58222990d23576af5d43f3911d20bfdbb523eb25f791cbcefc9ecfdadbea4f3e73e1f2c8dc0a86b02f8e80fc18103affa0a37f42f0f89149c451bb029192bbb73bb448bb0415dc86aaa43e7c6ec5982d0fb0f0b3ea151dc4edbc70ea709037d498f78955063248296efe2fa9ecb18459ab196aba8304662cd9471910bf4511a8b5c794e122fab4a5e615a605b68c5fbeaf955e844d221b1a2e5a66268ee8b4beddea94b81eae84a029d90672a1b3fd9d825ab958ee8170508eb543b517d121cac7d7a041404ea3a7ff17049235bff10fda9f71542ddbdf04d6a1f6174840d4a33d94d689ebd6c728c371f2847834285d6f09795e054e18f1a231f35f13db4b60cf006af1ba43c9a1b414aed4dde28bf3a049244683a3fc767ae25ab504ebabf65949f01d91db25c56e709b0f7bff0f52b6d1f4755d545bbf4f0f2dca45dcf4a41f68f208a47e49bf8584471cdc2fe56605b7d01e86807bbd7685430cb8d0d8d879818fc780f96634ca517e997c3b2420ee21186e3d164186807bf15de049c4a1c50b840450f2c5ad0259ed8f3df8a26b0c6b06014f3fde3ce228b1bfd023432f5a920b42350517b2dad52701de803d8dce525c52e24d02e380ce60ed84badef9c4cf19f21fbb5e85656a4fb73a7af21423b05ed1e111668dec83655829bc845ddec9491de4cec2d64385b814bb4104548fbb6607b9fc819643b430a4a297e6244b95438e44b7fd0c1098a55cf3d236662e3f8db21a4b03850da5efe53d6768606d6dd68bc010d3f64d2c9d196fa6abae9e10821ea075109637c6a39bd0ed698dedfd995d5a424765c59ef417531dcff2d8e31411a15d4c14f9abeaec055a7a3d892e48a353fd2fd8016917602d77ac8efc64a786594bc763d3992b5984cb7a9801e1eaf478c3c671140178096e1b486445444d74fde23c8afebe5b7e21f9b0de1f54270b172bc588e120a51f85685052df4b45f65852ca056f4bbf97911655d58458a762842b7670e1af784c9e091389132e8a9cf786e838cc7f7a0ffc4c22a7dcb79281cc96b64ca293891be5897a33f33d4d974000e8f031a9ac47fd70ffe23e237484b63d9daa6f4927d258a034687f04ed3110b5078cc1544ebc2d149cfe3dce80ce00bef3039d113724a42e774300dec104679f15a9974443e5594349e943749a6ef4679dd407294a1ccff94bd897665b9fac7334e997b9fd08f39f7d9ff242d5cf556aff0029a87fc8ce904d1b86ad75cb464f73a9ba5c1f1c4cd96e05d7ec8238617e1136d36ea8a759931e306af5574748d383168141cbbee662bf68cc374cf2f347a1c10e46da38ae075fb596f072ad8b92e93c0e242d5df05d40cad46e12c5efbe869457eee53cd3b63643f69dc6e579c6b2f7ecd30d599662abd8959733da8fbd34eb91b90eb7089fb72f13e2b9e1c0abd399755352593e29b8d5c6fe80829c57b2c3c558aa8bc83afdce349a7557d2b9211d78d036ac8c369af83898f70ded6f3a6df6100b88372028bfaf9ba062df664bdf86026a60e1298c560d49fca5d32976582f5058ff265d97d8a5aa7c536a75fee08938ceedb3b61d966edbf5a056aa7f45823c16f0da2a05abde80f5f01a59f00ca5188dbd2f37f1bb885d3935dc1946c0d558758ec2f8880d155a0a23ae721448fc760a7994c2210b2e0353b28a8f3948b476591f", 0x0, 0x1}, {0x4, 0x32, &(0x7f0000000280)="df922944e8e4de93c6aaba6aeba525855bd59cec3d2f7bf56c11b7225a2e834769084d4e3825e1913fa93f38c6f865dd7b74"}]}) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "12ad"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.624264829s ago: executing program 3 (id=7358): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) r2 = accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x10, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000028000000bca30000000000002403000007feffff720af0ff0000020071a4f0ff000000001f030000000000002e0a0200000000002604fdffffff000e61142c00000000001d430000000000007a0a00fe0000001f61144c0000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081504507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5e7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927e2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28e6ce4d9791c73c2d37999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fcf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b6"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) getsockopt(r2, 0x6, 0xb525, &(0x7f0000000100)=""/27, &(0x7f0000000140)=0x1b) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}]}}}]}, 0x38}}, 0x0) 3.438576211s ago: executing program 3 (id=7360): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079109000000000007b0ae8ff0000000095000000feff0000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3f}, 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x0, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xf, 0xffe0}, {0x6, 0xfff3}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x40811}, 0x1) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000280)={r0, &(0x7f0000000180)='wg1\x00', 0x401201, &(0x7f00000001c0)={@align=0xffffffffffff0000, {0x9, 0xcac1, 0x3, 0x6}}, 0xe6df, &(0x7f0000000200), &(0x7f0000000240)=0x2}) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000280)={r0, &(0x7f0000000180)='wg1\x00', 0x401201, &(0x7f00000001c0)={@align=0xffffffffffff0000, {0x9, 0xcac1, 0x3, 0x6}}, 0xe6df, &(0x7f0000000200), &(0x7f0000000240)=0x2}) socket$nl_audit(0x10, 0x3, 0x9) (async) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x3c, 0x3e9, 0x716, 0x70bd27, 0x25dfdbfc, {0x0, 0x8, 0x2, 0x0, 0x0, 0x7aa6, 0x4, 0x8, 0x0, 0x7, 0x9}}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) 3.417449302s ago: executing program 3 (id=7361): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair(0x2a, 0x6, 0x1c000, &(0x7f00000001c0)={0xffffffffffffffff}) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x6, 0x0, 0x100, 0x4, 0x460202}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000480)={'ip6_vti0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00'}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast2, @in=@local}, {@in6=@empty, 0x0, 0x32}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x4c, 0x12, {{'pcrypt(rfc4309(ccm_base(cbc(aes-aesni),wp384)))\x00'}, 0x0, 0x60}}]}, 0x13c}}, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f00000004c0)={r3, r7, 0x7f, 0xfc, &(0x7f00000003c0)="8153ef1c8aacb8a1ac5f8b8323567877b85518436d8fc6ebad54a41d7d17e547ea94f6f57e2ab0bff6611e67783ed26a338dc34538c6897168d1a0a5f8f3e11fc92c193c84fb53bd7dfb85ba2c6ef444035c17da9617ef5e9bae653293b8e4ae32e7ce2fbd699c04babe1c55ac8a1b5e88743b6d5defa34d96efb553997c0a0a49f9c54b2a18b1503b518dad4073b46ec45c5b286cfbe54596683953e43a004d1d87ef00743d7ad68b7558122c6299140248daac9f51a6d0f688693120a5fd65e80f7fb1436ebe0797bfcb84289e4159b0c38c9df8805cc5b937f222bd10b828a6b1938a518676180fad2697fc96b4e0bb0d07f42845b9a9bfe5c6df", 0x5, 0x7, 0x6, 0x5, 0x40, 0x2, 0x4, 'syz1\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000240)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @dev={0xfe, 0x80, '\x00', 0x36}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x86020086, r8}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x50}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x114, 0x2c, 0xd27, 0x70bd21, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0x4, 0xbdea46afeab7b972}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xdc, 0x2, [@TCA_FLOWER_KEY_ICMPV6_CODE={0x5}, @TCA_FLOWER_KEY_ARP_TIP_MASK={0x8, 0x3c, 0xffffffff}, @TCA_FLOWER_KEY_TCP_FLAGS={0x6, 0x47, 0xfffc}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0xbb}, @TCA_FLOWER_KEY_IPV4_DST_MASK={0x8, 0xd, 0xffffff00}, @TCA_FLOWER_CLASSID={0x8, 0x1, {0xfff1, 0xffe0}}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xa0, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x2c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0x98}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5, 0x4, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x24, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x81}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x60}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x3}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x2c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6d}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5964}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8001}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x2}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x2}]}]}, @TCA_FLOWER_KEY_MPLS_BOS={0x5, 0x44, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0xc, 0xbc}}]}, 0x114}, 0x1, 0x0, 0x0, 0xc048}, 0x80c0) 3.277190583s ago: executing program 1 (id=7362): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xd, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x50) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000480)=[@in6={0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, '\x00', 0x10}, 0xc32}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, @in={0x2, 0x4e21, @multicast2}], 0x3c) splice(r0, &(0x7f00000004c0), r0, &(0x7f0000000500)=0x100000000, 0x10001, 0xb) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000580)={'ip6_vti0\x00', 0x0, 0x29, 0x8, 0x6, 0x10001, 0x40, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, 0x20, 0xa0, 0xa, 0xfffffffa}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000580)={'ip6_vti0\x00', 0x0, 0x29, 0x8, 0x6, 0x10001, 0x40, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, 0x20, 0xa0, 0xa, 0xfffffffa}}) sendmsg$nl_route(r1, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)=@ipv4_newaddr={0x30, 0x14, 0x200, 0x70bd2b, 0x25dfdbfb, {0x2, 0x8, 0xa, 0xfe, r2}, [@IFA_ADDRESS={0x8, 0x1, @broadcast}, @IFA_BROADCAST={0x8, 0x4, @empty}, @IFA_ADDRESS={0x8, 0x1, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0x41}, 0x4041051) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000700), &(0x7f0000000740)=0x4) bpf$TOKEN_CREATE(0x24, &(0x7f0000000780)={0x0, r0}, 0x8) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000780)={0x0, r0}, 0x8) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000007c0)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x0, 0x1, 0x0, 0x1, 0x20, 0x36, 0x7}, &(0x7f0000000880)=0x9c) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000007c0)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x0, 0x1, 0x0, 0x1, 0x20, 0x36, 0x7}, &(0x7f0000000880)=0x9c) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f00000008c0)={r4, 0x3, 0x30, 0xffff, 0x7fff}, &(0x7f0000000900)=0x18) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000980), r0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000009c0)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000a40)={'sit0\x00', &(0x7f0000000a00)={'syztnl0\x00', r2, 0x8, 0x7, 0x7, 0x5, {{0x6, 0x4, 0x2, 0x4, 0x18, 0x66, 0x0, 0x5, 0x29, 0x0, @multicast2, @remote, {[@noop]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000a40)={'sit0\x00', &(0x7f0000000a00)={'syztnl0\x00', r2, 0x8, 0x7, 0x7, 0x5, {{0x6, 0x4, 0x2, 0x4, 0x18, 0x66, 0x0, 0x5, 0x29, 0x0, @multicast2, @remote, {[@noop]}}}}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000a80)={'dummy0\x00', 0x0}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000ac0)={@empty, 0x0}, &(0x7f0000000b00)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001000)={&(0x7f0000000b40)={0x488, r5, 0x1, 0x70bd2b, 0x25dfdbff, {}, [{{0x8, 0x1, r6}, {0x8c, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x8, 0x10, 0x3, 0x4}]}}}]}}, {{0x8}, {0x2a0, 0x2, 0x0, 0x1, [{0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0xb, 0xff, 0xfd, 0xe}, {0x1, 0x8, 0xfd, 0x1}, {0x4, 0x2, 0x3, 0x9}, {0x1ff, 0x7f, 0x5, 0x4}, {0x9, 0x8, 0x2, 0xffffffff}, {0xfff, 0xb, 0xf, 0x3ff}, {0x3ff, 0xaf, 0x10, 0x1}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xe1}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x69fb}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r2}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r9}}, {0x8}}}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000000) (async) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001000)={&(0x7f0000000b40)={0x488, r5, 0x1, 0x70bd2b, 0x25dfdbff, {}, [{{0x8, 0x1, r6}, {0x8c, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x8, 0x10, 0x3, 0x4}]}}}]}}, {{0x8}, {0x2a0, 0x2, 0x0, 0x1, [{0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0xb, 0xff, 0xfd, 0xe}, {0x1, 0x8, 0xfd, 0x1}, {0x4, 0x2, 0x3, 0x9}, {0x1ff, 0x7f, 0x5, 0x4}, {0x9, 0x8, 0x2, 0xffffffff}, {0xfff, 0xb, 0xf, 0x3ff}, {0x3ff, 0xaf, 0x10, 0x1}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xe1}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x69fb}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r2}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r9}}, {0x8}}}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000000) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f00000010c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r10, &(0x7f00000016c0)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001680)={&(0x7f0000001100)={0x548, r11, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x28, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3ff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xa}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x3, @mcast2, 0x2}}}}]}, @TIPC_NLA_NODE={0xb0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x11, 0x3, "0d294095338bb97f53cc378278"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x8a, 0x3, "12b6e4777b6b00689c18882b58ca9b8b4219f01d245e7d9aa55886d9a77e0539cc9567e9fd7099e785ca445df7767862a19651061f4a8f3a25041c73967ed6f9d28fdde6e7de165e8f937475e1d25e78dc17ab99527e458b09504a8170ae0022b5f6193d6463ac952cfa4f47b21e3e6a405ff0dcaa92b45a3b592d612bd2bb44a31ec36972b0"}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_NODE={0xf4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "1591c0bd8f64c32b1ad61285c22d60242108eef289efec"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x800}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "17a96178f54c7b734ed79900d64f173e97eaf4b3"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xa}, @TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "0efa81fc9a68771666912a5d6ac37ca4dbd63cf6da55899ef5ffb8e2"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}]}, @TIPC_NLA_NET={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100000000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffff9}]}, @TIPC_NLA_NODE={0x218, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xad, 0x3, "8cc07a2a3b16d8ba6e0947e3d14f5d614a69a130ca9e47f190181cbeca426fb987a9a0c2c94e177fd0285f60f9c851d4c92a4c1cf52f177a69454bf6cca179a34cf207aca07de53c248905052c6cfe99b1575abb353979b836c70eb02c103969625ea5afb4a9ea7a8372c52ba3560b92e4ae0f6617063920054583235dad34acab7d1b97511d02437b6448ce808b5231f8b4bdb18128e7dbe35e705937b5081858a49d3054087a4e5e"}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "9d38efb6d1ed5363597d4f4550e5df6933f0b7e120d916a7"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "45e68dc555f8c9c61273b09ff65fa122a2e4ddcffc28ee5105"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfff}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "ab0a0a64611bf42d04881edda3de3a473247b78e5a32bb"}}, @TIPC_NLA_NODE_KEY={0x4a, 0x4, {'gcm(aes)\x00', 0x22, "52d927e64ed29f620041d76083afbf6a112e8ef9b1222966c11b648a600c006a80f6"}}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "5cc049cf8bc203240773d3f777c1e54a2f062495dbe916"}}]}, @TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @multicast1}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x97, @dev={0xfe, 0x80, '\x00', 0x17}, 0x1ff}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'pimreg0\x00'}}]}, @TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xd}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "fa54e2c7efaab291316538f01b5b13427c409d6ca7a5c41fe60ecf7d9cfb94"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}]}, 0x548}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000001700), r10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000001700), r10) socket$nl_generic(0x10, 0x3, 0x10) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000001740), r12) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000001740), r12) socket$nl_generic(0x10, 0x3, 0x10) (async) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ethtool(&(0x7f00000017c0), r10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r13, &(0x7f0000001900)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000018c0)={&(0x7f0000001800)={0xa4, r14, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x52}, 0x4005881) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000001940)={'caif0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000001940)={'caif0\x00'}) accept$inet6(0xffffffffffffffff, &(0x7f0000001980)={0xa, 0x0, 0x0, @remote}, &(0x7f00000019c0)=0x1c) 3.276216777s ago: executing program 0 (id=7363): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000004c0)=0x0) sendmsg$netlink(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000000)=ANY=[@ANYRESDEC=r1], 0x114}, {&(0x7f0000000040)={0x38c, 0x3a, 0x4, 0x70bd25, 0x25dfdbff, "", [@nested={0x2c, 0x116, 0x0, 0x1, [@nested={0x4, 0x13}, @nested={0x4, 0x153}, @nested={0x4, 0x98}, @nested={0x4, 0x55}, @nested={0x4, 0x140}, @typed={0x14, 0xe0, 0x0, 0x0, @ipv6=@private1}]}, @generic="3ff2941c294005f35a1621910b0b6ac091ddb760b5f85fec7c5adcde8f3e80fc7f1020b347d88b62d100b161ba586aa427ae0d73b7ebfa2c0e34be2e333432face6adc45aea2a19c0258f650e633dd46065fb788dd0b9b029aa4a597d8bf64d777e2c797362b8ec0f742058cca47c488859ae4619d9268fc5b25dfe0276790cf2cfabb370403cf030be0f88adfa5bbf0ac8201de1c36ac472c82279879e55f3fc83ca410f6e42d85a798b53f3862", @generic="c17bedd22e6dcb4ffa104e", @generic="6e9c9aa8c3459987d8cc6fc2176de95547160f831e54af35e90077dad0aae8faf340568ed92120e808a68384a91f9fcdd7f3b317b9add1a098ad34bd6d077b11ffbcb6d56ef92d2204ceab1efcfb92e950ae53484ef3ee7e1c9b45a04f87f8ce151a6877f97062cd7e1606c12ad9ab320d53402829999b2b07823aa997a6f4badf8165af2c7744fc2155e8d4066f", @typed={0x8, 0x97, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1b}}, @nested={0x10a, 0x93, 0x0, 0x1, [@nested={0x4, 0xfd}, @generic="b99b7854499b5ed0c2f4748f244c3b7eca8fb521221f5d9f587eb2f8d6685d4c8c451131d189b68e9aff95f4e901716c9303543747af3b9dc68b7606a81bc4c4a1e4ea0e3dd72a936d6d51285eef81f3bf7f3c9de2364b215f48171ef9cc4a88ef5e2091f9b373870e86f792d2afe9973244077a93ae8a39591a91503f1d5803000a60d5a793aeb603db367c2741c6f8ba852a5ef4bff85f2de878f869414884557d39839926c0f1b49ef33598f203ade8689391f47798c71db524f098ed0c6929936183eb743539f23ddecf50b1c9e9aa61890fe19e8903e718def5bf53cf20ceba209adfde94862df4effcb306d8b265aad58a9fb1ca5c8a6d", @typed={0x4, 0xfe}, @nested={0x4, 0x7b}]}, @typed={0x8, 0x14a, 0x0, 0x0, @fd=r0}, @generic="c77c9d2c559a726ab543dc2c450e188f164622dda090eb9c16122bdc149c1f271e655dc1a294681206c92dae32d2c65cc578ce0ae3905a4ba6d29fa6a32db16246dc964c1aedfdd82a807a3ec64cea5ff688eca22d3f1adb6cbfcbbdedd9d376c7dd6a10757ec5c5f1b93f43c389599e7031f0ad65e9f291c00809c71ced635c9308f12e127f410db7466ceb23d9e03cd074d3f3a36b82f37a87b8127b8be7b7ee56f7d744d9a0948fedd2b30151c367e850abeaaf70e95ffea717690521e05b3fd856120b17c4227b3ecab6b3832f8de7cf7be7dd7acfa11d52b531cd58b5cc33d483de7180c03c7b9ec21d97"]}, 0x38c}, {&(0x7f0000000440)={0x50, 0x10, 0x8, 0x70bd2b, 0x25dfdbfc, "", [@generic="4b3ed236b6837fc2111d7e8eea9c700004169812a70272d8a1a58d56af9a03479180caf663cba24182f7cd30961fb9ec5d2f30cbd8153587", @typed={0x8, 0x127, 0x0, 0x0, @u32=0x9}]}, 0x50}, {&(0x7f0000000500)={0x228, 0x13, 0x4, 0x70bd28, 0x25dfdbff, "", [@generic="b4ec0cdd83180b556ae6503f45a6a9523984bbdb1f0f27dec9cafc1667fde5d64c674a566c66c652541a26bf8e33a52916201109e748176232a395994ea75a94ff796ac3872711f136e11a84d1765dc419408827514e7b4c5f4877f8784e4fd944204286c3b180cf7d7c8985e5462544f07de9e9f973775f8c2a650f0045090b6c3d0b76d1a91179afaf4e969553a2e814a256409a006d442acb74", @generic="47d2d26de2ba7c34fe44aae81c2d544cb0cf48ea740a80b4463b0df03f465edd9869852260c130024fa1c5580fe6f81242e5913c7454654be7808b3c150ff87114e5af52ce58f0e42995ed008c409bd7ba27de1abf1bd2be7177ccc798994c279f25c434d59a13f60521a248539485d62046f87a65dae867a966a011b8f0e6e8d45bb57f6152283afd24b6f44b77542d4ad03542f037f999a6e02dc0d9f17d7c0c789fddfe7b195cc6dc28245dd5dd1131b4336fab5b71ec110482f7ea234bee63c021ac48795563cebd59178fe4e49b272f161495157a661c02c3f803", @typed={0x8, 0x48, 0x0, 0x0, @uid=r2}, @typed={0x14, 0xa5, 0x0, 0x0, @ipv6=@private0}, @generic="a60a3fb41961775fba3c5ea25aaecee6c83ad15f22a5669b7cbff7e8f1340777898e0264f5149b82bf163a82f8e81545fa6453a7439ee154b9f87e0255a79327cf815777ecb0fb9a75df06a42fb75f4b717f4f51b95548127a8ac020e857841ece39713bf1b4", @typed={0x8, 0x4, 0x0, 0x0, @ipv4=@private=0xa010101}, @typed={0x14, 0xb7, 0x0, 0x0, @ipv6=@loopback}]}, 0x228}], 0x4}, 0x8044) 3.01800062s ago: executing program 0 (id=7364): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socketpair(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet6_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dfdbfb, "", [@nested={0x104, 0x117, 0x0, 0x1, [@typed={0xc, 0x16, 0x0, 0x0, @u64=0xfac06}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xeb}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 2.975624538s ago: executing program 3 (id=7365): bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad6706000002000000070300000ee60000bf250000000000002d350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56600a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa595b49a5eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8ddaf2cdad3d1a74a2f078aa6402483856a6e495408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae06e394c9639564f000fc3cdd05a157544d0200000000000000ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc4ee8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f88e80ef80c6ed3e1ff91ff111000000050000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcbacec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0ddd932d838ff651023853d42210642986f8bbc7340bc8393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d68124674478186edd036f15bf847c33f79e1a0ad3d2b5080ecb01420c9f1b534e969fce97ffff07000009000000bfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a823e28f359608ea326c77a1aa17318f392a0ec6c188916f4149c503027feccfd68ec8278a90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8e68f076c659f56d6c7f97a94d604f45cfe88b30c170000000001000000ef931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f0400000000000000d23b48bb38b31a14ffcddd92c38f6b6d86a0e56d47a82bad5d2a6dce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6623065624f1300007d6072f0cf120ad2ba519afdd43a14000000000000000000000000007ef2f3c58d045f0700000094069acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf8d5d0b9ad0ff7ee6ea51cb3a490a85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d000000000000000000007758b1267669ded883b5867c5916a74843b78495516df750c57744c76a09629dd0aaca5cb0f14f49db80a1aa2692c18fbb31cbdb3f2e138e6d5ba3491fc3617b511f24bad26466407e39000000000080d7a1bf4624d31c13a6840f45a7f4e01a50d790132abb36915e35b1ac35bf3921357f638684bba17b8fe1e2123153ecd6d1f76820d4f8fa0b96b50c00000000000000007bc8170380557bc11cf6ee3395974e37018a2a7473312cb32affb8ff72a253e0d36099e460f13694b9891af526d9608271838e83d17103887f34210dd4c0cf60dec608b4ca5ba2f3037bf381e7b5d5b27820000000000000000000000b719bd34f3244730f708fdd532640edc6b82dd4ad72ecbaccafef806f5447aba2246d56a601bbd8c24ba1e16dda3296ce100e4ab79494c84bd51ef08ec095a40862fa81210c5e4d8176cec133e10061804b9c4b9fc6b0b76e86fb515dbbbf555f41dd17e57c21ca82b13495312b6ed454a3106bec17583da68803cd09e40792ba6d9a4051c9fdf23b292a980b335cdc1c883a79cec6f9663ab7bcdb28f11257301ac9fa7b95ce09be8b346a07c6889a421c4f7492ea5dfa1577c9c81ebe1abb08e8b4496d937b2952e7a4c93510c2b6f8b067b151176535421e2bb019b1eb2558f60f1614006c160109434624d72a603cc818b965aeaf8499464f09c1c4529c93c0a7f05967d16323a1"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x28, 0x5, 0x72}, 0x2c) r4 = socket$kcm(0xa, 0x2, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010106, 0x4e20, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e21, 0x10000, 0x2, 0x2}}, 0x44) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4f23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000140)={r2, r3, 0x1e, 0x0, @val=@netfilter={0x2, 0x0, 0x400}}, 0x20) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000980)={r8, r7, 0x0, r6}, 0x10) ioctl$int_in(r7, 0x5452, &(0x7f0000000000)=0xbe3) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001a80)=@newlink={0x34, 0x10, 0x439, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r1, 0x0, 0x110d1}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc, 0x5, {0xfffffffc, 0x2}}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8041}, 0x40000880) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0xd, 0x2, &(0x7f00000000c0)=@raw=[@call={0x85, 0x0, 0x0, 0x8b}, @exit], &(0x7f0000000400)='GPL\x00'}, 0x94) 2.954634446s ago: executing program 1 (id=7366): bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f00000003c0)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1}, 0x4) (async) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x8, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x7, 0xa, 0xfffffff3}}}}]}, 0x44}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newtfilter={0x3c, 0x2c, 0xd2b, 0x803, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2404c044}, 0x240440d4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) (async) sendto$inet(r5, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'team_slave_1\x00', 0x6bf1c2d5adba8c32}) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) (async) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="05"], 0x10) (async) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000240)=0xb1, 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r7, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r5}, 0x20) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x1e, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x10000000}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x200}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @ldst={0x0, 0x2, 0x1, 0x0, 0xa, 0x0, 0x10}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 2.836529856s ago: executing program 2 (id=7367): syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) (rerun: 32) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) (async) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) (async) listen(r6, 0x4) r7 = socket$netlink(0x10, 0x3, 0x4) writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB="38010000", @ANYRES16=r4, @ANYBLOB="010000000000000000000700000008000300", @ANYRES32=r5, @ANYBLOB="0c009900000000003e000000140004006e69637666300000000000000000000008000500060000000c00178004000500040004"], 0x138}}, 0x0) (async, rerun: 64) r8 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r9, @ANYBLOB="01060000000000000000090000002c0004801300010062726f6164636173742d6c696e6b00001400078008000600"], 0xac}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000005c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000580)={&(0x7f0000000380)={0x1cc, r9, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x880d}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x800}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}, @TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x28261463}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x101}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}]}, @TIPC_NLA_MEDIA={0x6c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}, @TIPC_NLA_SOCK={0x78, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7e}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7ff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xe}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x401}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x93d}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x89}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}]}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x8081}, 0x800) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="18000000000000000000000000000000711234000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) (async) pwritev(r2, &(0x7f0000000100)=[{&(0x7f0000000040)='\x00!', 0x2}, {&(0x7f0000000140)="abffa99a7d6ed2dcacc958fd3a5c773e03b4a54890c6ba34d4a318f17925141e844a5882851431385aa863defbc0d479f945bbd8eb945276a091970bbeccd52a559731b33c20fd6eb7d6adb5ba81c0eccf6ee0dfd3f702812d39c7853360046b50ad6a4436d4247a5e920c58f140a138faa35246b17306e25f6e34b456ccefe6c20a544cb784ec517071b8f1563bb232c4019084d9003f1a2832609a0e8eb141c1ded373dd38c0e827721ecab5570c9b", 0xb0}, {&(0x7f0000000240)="43e51f1bce2ede7abb6a4b66c403f7e047ecee20f0c2fcb0e9a0fa457ecafec104711845155c12d3083c2643fa79d4831d46244b8543a725fd5366f46c47f28a49d9cd9504e8fcb98c7295b91fddb7740713db6271cd2cabd133fcda03c5c0f034350170b69e304f501b3d0b0adab4ab55293a945272119c6ce79f8290df879fff628d42f94b5057e51e8a86a1879350d393acc57a51418944c4ebd0bc038ee67565694f4a4a655c4c280a6c171c3d9f3526cd4edb361a", 0xb7}, {&(0x7f0000000300)="f2671cb24621eed7e7a51d5659a146245add4a2f90cb80f9129d9a161de443485cc5ee75345f3572a222faec0745c7d800937747222bbd7f4dc9514a4799640f8255dc6a4743dab90efdb54b411a188a4e021ae5b392d4de7029e547a196c8990184ef06499677b80d5e21e063b3e263e1b2d2df8b2200a968be53e544fc", 0x7e}], 0x4, 0x5, 0x0) (async) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES8=r0, @ANYRESOCT=r1], 0x58}}, 0x0) 2.463601133s ago: executing program 1 (id=7368): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a00120002002800000019002d4400009b84136ef75afb83de066a5900e1baac341b61130000f2ff00000100"/85, 0x55}], 0x1, 0x0, 0x0, 0x7a000000}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'wg2\x00'}) 2.22188056s ago: executing program 2 (id=7369): r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000400)=0x140, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0x1ff01018ce30c2a5}, @TCA_TBF_RATE64={0xc, 0x4, 0xdcd9be68b5bd509}, @TCA_TBF_PARMS={0x28, 0x1, {{0x81, 0x0, 0xee8, 0x1c, 0x800, 0x8}, {0x7, 0x2, 0x7, 0x3, 0x5, 0x7}, 0x6db63122, 0x7, 0x1257}}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84d, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0x4, 0x7fff, 0x402, 0xb}, 0x5, 0x34, 0x91f}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_RATE64={0xc, 0x4, 0xdd31e353c9fd1eb}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) 2.205864557s ago: executing program 0 (id=7370): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, 0x0, &(0x7f0000000100)) 1.986252331s ago: executing program 1 (id=7371): r0 = socket$inet6(0xa, 0x80002, 0x88) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x3, 0x14, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000100008018150000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000450000001801000020646c2500000000002020207b1af8ff00000000bfa100000002000008000000b7030000010000008500000006000000950000000000000016b093f114884bd5dac2ac565d4d319682442881fe043b898724dd1517aceceda5deb275acb05532685ac375fd8fe07ee4069261ec925b83be3342c81d48501864b5f36c118dc5cc8997d80261d34649c1a046b3b0bea64f0774ae33d5d95fa7baec995242a4c64232861e05d3c4be964611fa43fd67d4901764c80a3c56e54711447854193cccf7e140da00709c1e3514be754b2f18a65a133978a7287a86dba5b2e8bd41a22fe97437560a18c8d74170cdd0f494b219dc5597d1e2692c83c3fab5d92f5e0aba51a5278814e848d2866131b0189586887e60252033270f3c039c787302b825"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001700)=@newqdisc={0x24, 0x24, 0x4, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xffe0}, {}, {0x7, 0xc}}}, 0x24}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="480000001000010000000000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="4000000010800000280012800e0001006970366772657461700000001400028006000e"], 0x48}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="d8000000180081084e81f783db4cb9040a07080006007c09e8fc55a10a0015000600142603600e120800020081000401a8000100fcc0ffff000000fd035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1}, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0x30, 0x2, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x41) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1c}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x88}, @NFTA_SET_DESC={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x78}}, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x11100, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000001800)=[{{&(0x7f00000002c0)={0xa, 0x4e20, 0x0, @remote, 0x1}, 0x1c, 0x0}}], 0x1, 0x4000) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40000100, 0x0, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r8, &(0x7f00000004c0)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c, 0x0, 0x0, &(0x7f0000000180)=[@pktinfo={{0x20, 0x29, 0x32, {@mcast1}}}], 0x20}}], 0x1, 0x8000) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) r9 = socket$inet(0x2, 0x4000000805, 0x0) sendmmsg(r9, &(0x7f0000000e40)=[{{&(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000000300)=[{&(0x7f00000000c0)="ae", 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000008400000005"], 0x18}}], 0x2, 0x0) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x68, 0x68, 0x8, [@func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xf, 0x1}, {0x5}, {0x10, 0x1}, {0xb, 0x1}, {0x9, 0x2}, {0x2, 0x2}, {0xc}, {0xc, 0x3}, {0x3, 0x3}, {0x6, 0x2}]}, @func={0xc, 0x0, 0x0, 0xc, 0x2}]}, {0x0, [0x30, 0x0, 0x30, 0x61, 0x5f, 0x5f]}}, &(0x7f00000001c0)=""/159, 0x88, 0x9f, 0x1, 0x3}, 0x28) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r11, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000002080)={0x18, r12, 0xd01, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000cb00000001000000080000009b870400", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r10, @ANYBLOB="000000e0"], 0x50) 1.905805419s ago: executing program 0 (id=7372): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0xffffffffffffffb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r5, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073797a5b3100100000080041007369770014003300626f6e643000000000000000000000c69b0a221bbb3e9626b9f08f2b8734c58d9399053561d53ccabdcd79a65224ae1242e088e64b94c6f07fd9935b17385cab94ebf035e28be0a6e97e274dd3989a6c1f1c701fe0d8e9f3"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000800) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001014d9ec29bd7000fcd9df250800030001000000080001000000000008004b001300060008004a0000000000080015000300000008004f0001000000"], 0x40}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x9, 0x2, 0x7fff, 0x21, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private2, 0x7800, 0x7, 0x6, 0x9}}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, r7, 0xfffffffffffffffc, {0x1, 0xf0, 0x4}, 0xff}, 0x73) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket$igmp6(0xa, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000500000005000000002000000090000000000000e03000000010000000a0000000000000203000000000000000500000d00000000060000000100000000000000000000000000000000800000090000000000000001000000030010"], 0x0, 0x6a, 0x0, 0x0, 0x7fffffff}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r10, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r9, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) write$tun(r8, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) r12 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r12, 0x10f, 0x85) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0xf0b, 0xfffffffe, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xb, 0x9}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_ALPHA={0x8, 0x4, 0x20}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2004c084}, 0xd0) socket$nl_route(0x10, 0x3, 0x0) 1.30866151s ago: executing program 2 (id=7373): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) sendmsg$NL80211_CMD_REGISTER_FRAME(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x20, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x0) 1.123452363s ago: executing program 4 (id=7374): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0), 0xc, 0x0}, 0x110) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000026c0), r1) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028ad7000fbdbdf25030000000c00040043060000000000000800010000000000100007800c00018008000100", @ANYRES32, @ANYBLOB="0c0002000053a3966a7789ede9"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x20040840) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="24000000680001"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000a00000006110600000000000c6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x25}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@map=r4, r3, 0x5}, 0x10) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 896.63548ms ago: executing program 1 (id=7375): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000080)="7cd3596d306598d047d07b1295fa1a8aafdd81ceec1704af51cd39fade1a58947ba4b6dad831df9bebe1af4c02904e20e12c6a2448393fe23bf56bae350d0e4c27c23370a6d016d4c32a937e3fd5eac42497bb57ff584fcbdbee8ca19352a3c4b3c8a5bd8cd9f8410e234f66f69d7a85cda40d12574a14c6e6ae") r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000040)=@get={0x1, 0x0, 0x6}) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r3, 0x6, 0x3, &(0x7f0000000340), 0x4) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x37}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x18, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa4}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) write$6lowpan_control(r1, &(0x7f0000000040)='disconnect aa:aa:aa:aa:aa:10 2', 0x1e) 854.040528ms ago: executing program 2 (id=7376): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000001a40)=[{{&(0x7f0000000240)={0xa, 0x4e20, 0x1, @private0, 0x3}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6119aedd5) (async) shutdown(r0, 0x1) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x1000, 0xb88, 0x2, 0x8, 0x5, 0xbad, 0x9, 0x7f}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x3c1, 0x3, 0x388, 0x158, 0xc8, 0x8, 0x0, 0x5803, 0x2b8, 0x2e8, 0x2e8, 0x2b8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, [0x0, 0xff, 0x0, 0xff], [], 'pimreg0\x00', 'geneve1\x00', {}, {}, 0x0, 0x4, 0x0, 0x55}, 0x0, 0x118, 0x158, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@ipvs={{0x48}, {@ipv6=@mcast2, [0xffffff00, 0x0, 0xffffff00, 0xffffff], 0x4e21, 0xff, 0x2, 0x4e24, 0x20, 0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x8, 0x18, "d05511d4053fa80d56e441286224250ca2535f0c8aa13a6276593694a239"}}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xe}}, @common=@icmp6={{0x28}, {0x10, "5bbf", 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x10, 0x0, 0x7, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) (async) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0, 0x0, 0x100058d1}, 0x0) (async, rerun: 32) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 32) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e"], 0x1c}}, 0x0) (async) setsockopt$MRT6_PIM(r3, 0x29, 0xcf, &(0x7f0000000000)=0x2, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001c00c92429bd70000000020007000000", @ANYRES32=r4, @ANYBLOB="80008f0b0a000200aaaaaaaaaaaa000008000f"], 0x30}, 0x1, 0x0, 0x0, 0xc0041}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) 610.026662ms ago: executing program 4 (id=7377): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000), &(0x7f0000000080)=0xe) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r2 = socket(0x1e, 0x805, 0x0) connect$tipc(r2, &(0x7f0000000000)=@id, 0x10) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x58, 0x7, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x4}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x400}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x40800}, 0x4000) r3 = accept4(r1, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x170, 0x2f, 0x2, 0x70bd27, 0x25dfdbff, {0x1b}, [@nested={0x145, 0x23, 0x0, 0x1, [@typed={0x8, 0x77, 0x0, 0x0, @fd=r2}, @generic="e8250c98c7a8c705a110c0e2f367d00312e39de0483119d9cabed7e7758458e6543212c7c4a7ec06ee1e978833a8f11ceac8f2abfab78422d23427ac9f", @typed={0x8, 0x6b, 0x0, 0x0, @u32=0xd344}, @typed={0x9, 0x7b, 0x0, 0x0, @str='syz2\x00'}, @generic="b18c905227fb1aa7320e94b627a2", @nested={0x4, 0x2d}, @generic="920a641477190205e8eb563b0d207596c72a86ecf01cf4ccf146f7b7708321c2def99fb14bf40d7f8746f006eb21cf9b8754b36f75ed4e9942a1058c301eedb0713f10be8d43d465bab56559713d6834115a49502dc9caef1152de29cd5677f1b5a2f08974f0effe6fa203567eac93c6ce53cf97f58666f83001f230c82a8d49585347993829bac62f8cd6568ff05ef9de0e464902d840c520ab43d8f11f28a86259a091fa4025047bceee46a7837e7cd890e103852140fb051d05354c38dbf8db839064fb1f58b6da0803164d4b", @nested={0x4, 0x8a}, @nested={0x4, 0xee}]}, @typed={0x14, 0x1b, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x170}, 0x1, 0x0, 0x0, 0x4001000}, 0x8800) syz_genetlink_get_family_id$devlink(&(0x7f0000000680), r3) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_buf(r5, 0x29, 0x11, 0x0, &(0x7f00000001c0)) sendmsg$alg(r3, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000880)="99", 0x1}], 0x1, 0x0, 0x0, 0x8890}, 0x1) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f0000000240)=""/14, &(0x7f0000000280)=0xe) 577.843668ms ago: executing program 2 (id=7378): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/233, 0xe9}], 0x1, &(0x7f0000001d00)=""/4080, 0xff0}, 0x0) close(r1) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 371.367077ms ago: executing program 4 (id=7379): r0 = socket(0x2a, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept$netrom(r0, &(0x7f0000000080)={{0x3, @null}, [@null, @netrom, @rose, @remote, @netrom, @netrom, @remote, @null]}, &(0x7f0000000000)=0x48) ioctl$FIONCLEX(r2, 0x5450) recvfrom(r1, 0x0, 0x0, 0x2020, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=@newtfilter={0xe4, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r3, {0x5, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0xfffffe49, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0xc, 0x6}}, @TCA_U32_SEL={0xa4, 0x5, {0x7, 0x2, 0x9, 0x0, 0x8, 0x200, 0x9, 0x2, [{0xffff0001, 0xffff, 0x9, 0x7}, {0xe, 0x2c3, 0xb526, 0x110}, {0xc, 0x6, 0xfffff65d, 0x2}, {0x3, 0x9, 0x3ff, 0x6}, {0x7, 0x5b, 0x8, 0x6}, {0x4, 0x7, 0x0, 0x4}, {0x6, 0x4, 0x7, 0x4}, {0x4, 0x2, 0xffff6d1b, 0x3}, {0x3, 0x1, 0xaf, 0x401}]}}, @TCA_U32_LINK={0x8, 0x3, 0x1}]}}]}, 0xe4}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0xe) r5 = socket(0x2d, 0x2, 0x0) connect$qrtr(r5, &(0x7f00000002c0)={0x2d, 0x0, 0x8000}, 0xc) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 237.159488ms ago: executing program 2 (id=7380): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x28, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_MULTIPATH={0xc, 0x12, {0xa}}]}, 0x28}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e21, @multicast2}, 0x10) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x168, 0x2c, 0xd27, 0x70bd25, 0xa000, {0x0, 0x0, 0x0, r6, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x138, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x1c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x49}]}]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xec, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3000000}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xc00}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xff}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5ac}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x6a, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x7}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xf7}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0xfc}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x2c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x24, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x7fffffff}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x78}]}]}, @TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @local}]}}]}, 0x168}, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000854000000800000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000107010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="6ce5ec00100037040000800000000000000000008451cfaa414f09d4893f2d6a32bf56d83f6c4075cb480cf5397e6beb", @ANYRES32=r7, @ANYBLOB="c3040500000000004c0012800b00010067726574617000003c0002800400120005001700d9000000080005000600000008000600ac141427060018000500000005000900b5000000080014000400000004001200"], 0x6c}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmmsg$inet(r1, &(0x7f0000000300)=[{{&(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @empty, @remote}}}], 0x20}}], 0x1, 0x40000) 0s ago: executing program 4 (id=7381): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000480)={0x0, 0x1, 0x74, 0x1}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000880)={r1, 0x9, 0xffffffffffffffff, 0x1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@ETHTOOL_A_PAUSE_TX={0x5, 0x4, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040004}, 0x20048800) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x58, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_ID={0x8}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc}]}]}], {0x14, 0x10}}, 0xa0}}, 0x4) kernel console output (not intermixed with test programs): ss `syz.0.5955'. [ 700.347251][T28517] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 700.390995][T28641] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 700.424185][T28517] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 700.464692][T28633] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5953'. [ 700.554264][T28649] validate_nla: 1 callbacks suppressed [ 700.554285][T28649] netlink: 'syz.3.5958': attribute type 10 has an invalid length. [ 700.591321][T28629] syzkaller0: entered promiscuous mode [ 700.597752][T28629] syzkaller0: entered allmulticast mode [ 700.637051][T28649] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 701.742227][ T5835] Bluetooth: hci1: command tx timeout [ 702.643655][T19117] IPVS: stop unused estimator thread 0... [ 702.651564][T28517] hsr_slave_0: entered promiscuous mode [ 702.660019][T28517] hsr_slave_1: entered promiscuous mode [ 702.670641][T28517] debugfs: 'hsr0' already exists in 'hsr' [ 702.676775][T28517] Cannot create hsr debugfs directory [ 702.691273][T28655] IPv6: sit1: Disabled Multicast RS [ 702.705507][T28655] sit1: entered allmulticast mode [ 702.789153][T28664] ieee802154 phy1 wpan1: encryption failed: -22 [ 703.132270][T28679] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5968'. [ 703.191606][T28681] xt_l2tp: missing protocol rule (udp|l2tpip) [ 703.419410][T28699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5973'. [ 703.451127][T28699] ksmbd: Unknown IPC event: 0, ignore. [ 703.485123][T28699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5973'. [ 703.533967][T28699] ksmbd: Unknown IPC event: 0, ignore. [ 703.774918][T28711] syzkaller0: entered promiscuous mode [ 703.784307][T28711] syzkaller0: entered allmulticast mode [ 703.822133][ T5835] Bluetooth: hci1: command tx timeout [ 703.991639][T28517] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 704.036876][T28517] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 704.067398][T28517] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 704.091395][T28517] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 704.147195][T28719] netlink: 'syz.4.5978': attribute type 5 has an invalid length. [ 704.374013][T28517] 8021q: adding VLAN 0 to HW filter on device bond0 [ 704.383714][T28705] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 704.389685][T28705] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 704.418723][T28746] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5984'. [ 704.455897][T28517] 8021q: adding VLAN 0 to HW filter on device team0 [ 704.466623][T28747] netlink: 'syz.4.5983': attribute type 1 has an invalid length. [ 704.492952][T28747] netlink: 228 bytes leftover after parsing attributes in process `syz.4.5983'. [ 704.634661][T28747] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5983'. [ 704.646621][T28742] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5983'. [ 704.659863][T28705] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 704.675715][T19109] bridge0: port 1(bridge_slave_0) entered blocking state [ 704.682959][T19109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 704.690779][T28705] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 704.700163][T28751] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5985'. [ 704.700295][T19109] bridge0: port 2(bridge_slave_1) entered blocking state [ 704.716512][T19109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 704.746535][T28751] x_tables: unsorted entry at hook 3 [ 704.911255][T28763] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5988'. [ 705.157624][T28773] openvswitch: netlink: Missing key (keys=40, expected=100) [ 705.413131][T28517] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 705.476399][T28517] veth0_vlan: entered promiscuous mode [ 705.491415][T28517] veth1_vlan: entered promiscuous mode [ 705.557076][T28517] veth0_macvtap: entered promiscuous mode [ 705.581826][T28517] veth1_macvtap: entered promiscuous mode [ 705.610054][T28517] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 705.641493][T28517] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 705.690681][T19109] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.707370][T19109] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.725972][T19109] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.099550][T28793] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5996'. [ 706.214509][T19109] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.231223][T28795] mac80211_hwsim hwsim75 syzkaller0: entered promiscuous mode [ 706.304137][T28795] mac80211_hwsim hwsim75 syzkaller0: entered allmulticast mode [ 706.711746][ T146] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 706.740290][ T146] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 706.764606][T28821] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 706.771949][T28821] IPv6: NLM_F_CREATE should be set when creating new route [ 706.848917][T19116] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 706.882088][T19116] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 707.289893][T26285] IPVS: starting estimator thread 0... [ 707.393665][T28855] IPVS: using max 28 ests per chain, 67200 per kthread [ 707.485609][T28866] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 708.087687][T26285] IPVS: starting estimator thread 0... [ 708.182381][T28901] IPVS: using max 25 ests per chain, 60000 per kthread [ 708.344979][T28911] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 708.449683][T28920] gtp0: entered promiscuous mode [ 708.481795][T28920] gtp0: entered allmulticast mode [ 708.518129][T28922] __nla_validate_parse: 9 callbacks suppressed [ 708.518151][T28922] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6032'. [ 708.533598][T28923] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6031'. [ 708.615887][T28923] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6031'. [ 709.118295][T28961] netlink: 'syz.1.6041': attribute type 4 has an invalid length. [ 709.404588][T28978] netlink: 'syz.4.6046': attribute type 5 has an invalid length. [ 709.741020][T28991] netlink: 192 bytes leftover after parsing attributes in process `syz.1.6052'. [ 709.793300][T28994] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6052'. [ 709.873877][T19117] tipc: Subscription rejected, illegal request [ 709.914312][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 709.932467][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 709.941249][ T5837] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 709.954068][ T5837] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 709.962481][ T5837] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 710.295446][T29012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6057'. [ 710.440939][T29008] nbd: must specify an index to disconnect [ 710.488461][T29021] netlink: 144 bytes leftover after parsing attributes in process `syz.3.6061'. [ 710.572983][T29024] netlink: 'syz.1.6062': attribute type 1 has an invalid length. [ 710.651226][T28999] chnl_net:caif_netlink_parms(): no params data found [ 710.750466][T29029] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 711.174033][T28999] bridge0: port 1(bridge_slave_0) entered blocking state [ 711.197267][T28999] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.214977][T28999] bridge_slave_0: entered allmulticast mode [ 711.243810][T28999] bridge_slave_0: entered promiscuous mode [ 711.278577][T28999] bridge0: port 2(bridge_slave_1) entered blocking state [ 711.289573][T28999] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.299337][T28999] bridge_slave_1: entered allmulticast mode [ 711.308060][T28999] bridge_slave_1: entered promiscuous mode [ 711.403238][T29074] netlink: 'syz.4.6073': attribute type 28 has an invalid length. [ 711.422865][T29075] netlink: 'syz.4.6073': attribute type 28 has an invalid length. [ 711.451529][T28999] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 711.471322][T29074] netlink: 'syz.4.6073': attribute type 3 has an invalid length. [ 711.483985][T29075] netlink: 'syz.4.6073': attribute type 3 has an invalid length. [ 711.498612][T29075] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6073'. [ 711.498858][T29074] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6073'. [ 711.528499][T28999] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 711.679243][T29087] netlink: 'syz.4.6078': attribute type 2 has an invalid length. [ 711.697059][T28999] team0: Port device team_slave_0 added [ 711.706064][T19118] bridge_slave_1: left allmulticast mode [ 711.713379][T29087] netlink: 'syz.4.6078': attribute type 2 has an invalid length. [ 711.719501][T19118] bridge_slave_1: left promiscuous mode [ 711.737165][T19118] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.773654][T29090] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6077'. [ 711.795977][T19118] bridge_slave_0: left allmulticast mode [ 711.804975][T19118] bridge_slave_0: left promiscuous mode [ 711.817657][T19118] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.860752][T19118] veth5: left allmulticast mode [ 711.866928][T19118] veth5: left promiscuous mode [ 711.875008][T19118] bridge2: port 2(veth5) entered disabled state [ 711.886088][T19118] veth3: left allmulticast mode [ 711.891021][T19118] veth3: left promiscuous mode [ 711.917690][T19118] bridge2: port 1(veth3) entered disabled state [ 712.054268][ T5837] Bluetooth: hci3: command tx timeout [ 712.067724][T29105] netlink: 'syz.1.6082': attribute type 5 has an invalid length. [ 712.241789][T19118] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 712.315076][T19118] bond7 (unregistering): (slave ip6erspan0): Releasing active interface [ 712.384318][T19118] bond8 (unregistering): (slave ip6gretap2): Releasing active interface [ 712.648819][T19118] bond3 (unregistering): (slave geneve2): Releasing active interface [ 712.896578][T19118] bond1 (unregistering): Released all slaves [ 712.911586][T19118] bond0 (unregistering): Released all slaves [ 712.927488][T19118] bond2 (unregistering): Released all slaves [ 712.951558][T19118] bond3 (unregistering): Released all slaves [ 712.975195][T19118] bond4 (unregistering): (slave veth0_to_bond): Releasing active interface [ 712.990201][T19118] bond4 (unregistering): Released all slaves [ 713.005589][T19118] bond5 (unregistering): Released all slaves [ 713.022124][T19118] bond6 (unregistering): Released all slaves [ 713.037379][T19118] bond7 (unregistering): Released all slaves [ 713.058387][T19118] bond8 (unregistering): Released all slaves [ 713.083692][T28999] team0: Port device team_slave_1 added [ 713.089501][T29114] netlink: 'syz.2.6083': attribute type 11 has an invalid length. [ 713.170597][T29110] syzkaller1: entered promiscuous mode [ 713.192285][T29110] syzkaller1: entered allmulticast mode [ 713.245630][T28999] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 713.282457][T28999] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 713.341999][T28999] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 713.443400][T19118] : left promiscuous mode [ 713.457908][T29140] ieee802154 phy1 wpan1: encryption failed: -22 [ 713.465063][T29140] x_tables: duplicate underflow at hook 1 [ 713.485332][T28999] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 713.493475][T28999] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 713.523492][T28999] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 713.668335][T19118] tipc: Disabling bearer [ 713.676049][T19118] tipc: Left network mode [ 713.891007][T28999] hsr_slave_0: entered promiscuous mode [ 713.915374][T28999] hsr_slave_1: entered promiscuous mode [ 713.927750][T28999] debugfs: 'hsr0' already exists in 'hsr' [ 713.958048][T28999] Cannot create hsr debugfs directory [ 714.132107][ T5837] Bluetooth: hci3: command tx timeout [ 714.282439][T29171] __nla_validate_parse: 1 callbacks suppressed [ 714.282461][T29171] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6095'. [ 714.364424][T29172] netlink: 'syz.1.6096': attribute type 12 has an invalid length. [ 714.374881][T29172] netlink: 'syz.1.6096': attribute type 29 has an invalid length. [ 714.386220][T29172] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6096'. [ 714.398236][T29172] netlink: 59 bytes leftover after parsing attributes in process `syz.1.6096'. [ 714.525368][T29182] netlink: 'syz.2.6099': attribute type 1 has an invalid length. [ 714.605160][T29182] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 714.615758][T29186] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6101'. [ 714.742027][T29193] netlink: 'syz.2.6102': attribute type 12 has an invalid length. [ 714.811330][T29198] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 714.899197][T28999] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 714.912757][T28999] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 714.927102][T28999] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.939266][T28999] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 714.950881][T28999] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 714.965483][T29203] Bluetooth: MGMT ver 1.23 [ 715.171485][T28999] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 715.243345][T28999] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 715.278428][T29217] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6108'. [ 715.296216][T29222] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 715.310993][T28999] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.357392][T28999] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 715.419864][T28999] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 715.679748][T28999] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 715.695968][T28999] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 715.707907][T28999] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.718837][T28999] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 715.729783][T28999] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 715.800756][T29229] syzkaller0: entered promiscuous mode [ 715.808144][T29229] syzkaller0: entered allmulticast mode [ 715.851734][T28999] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 715.866421][T28999] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 715.877401][T28999] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.888962][T28999] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 715.894277][T29255] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6115'. [ 715.910716][T28999] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 715.924867][T29255] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6115'. [ 715.944373][T29257] openvswitch: netlink: Unexpected mask (mask=201040, allowed=10048) [ 715.970523][T29254] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 715.983359][T29254] bond2 (unregistering): Released all slaves [ 716.213287][ T5837] Bluetooth: hci3: command tx timeout [ 716.390250][T29273] netlink: 'syz.3.6121': attribute type 2 has an invalid length. [ 716.399109][T29273] netlink: 'syz.3.6121': attribute type 2 has an invalid length. [ 716.409514][T29273] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6121'. [ 716.420134][T19118] hsr_slave_0: left promiscuous mode [ 716.429543][T19118] hsr_slave_1: left promiscuous mode [ 716.443926][T19118] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 716.451588][T19118] batadv0: mtu less than device minimum [ 716.460316][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.473138][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.485090][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.497034][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.508933][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.520976][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.532899][T19118] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 716.562418][T19118] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 716.571122][T19118] batman_adv: batadv0: Interface deactivated: dummy0 [ 716.577988][T19118] batman_adv: batadv0: Removing interface: dummy0 [ 716.589478][T19118] veth1_macvtap: left promiscuous mode [ 716.595258][T19118] veth0_macvtap: left promiscuous mode [ 716.600856][T19118] veth1_vlan: left promiscuous mode [ 716.700491][T19118] pim6reg (unregistering): left allmulticast mode [ 716.710776][T19118] pim6reg527 (unregistering): left allmulticast mode [ 717.085564][T28999] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 717.229507][T28999] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 717.287647][T28999] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 717.322898][T28999] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 717.407220][T29297] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6129'. [ 717.465145][T29297] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6129'. [ 717.758614][T28999] 8021q: adding VLAN 0 to HW filter on device bond0 [ 717.971213][T28999] 8021q: adding VLAN 0 to HW filter on device team0 [ 717.984406][T29329] syzkaller1: entered promiscuous mode [ 718.010307][T29329] syzkaller1: entered allmulticast mode [ 718.041171][T19118] veth5: left allmulticast mode [ 718.061247][T19118] veth5: left promiscuous mode [ 718.083490][T19118] bridge4: port 2(veth5) entered disabled state [ 718.123837][T19118] veth3: left allmulticast mode [ 718.129690][T19118] veth3: left promiscuous mode [ 718.137882][T19118] bridge4: port 1(veth3) entered disabled state [ 718.159575][T19118] tipc: Resetting bearer [ 718.292791][ T5837] Bluetooth: hci3: command tx timeout [ 718.306791][T19118] bond6 (unregistering): (slave vti0): Releasing backup interface [ 718.322698][T19118] vti0 (unregistering): left promiscuous mode [ 718.360552][T19118] tipc: Disabling bearer [ 718.397372][T19118] bond9 (unregistering): (slave gretap2): Releasing active interface [ 718.417977][T19118] dvmrp0 (unregistering): left allmulticast mode [ 718.435822][T19118] bond11 (unregistering): (slave geneve4): Releasing active interface [ 718.783070][T19118] bond0 (unregistering): Released all slaves [ 718.799822][T19118] bond1 (unregistering): (slave lo): Releasing backup interface [ 718.812816][T19118] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 718.830264][T19118] bond1 (unregistering): Released all slaves [ 718.847806][T19118] bond2 (unregistering): Released all slaves [ 718.869684][T19118] bond3 (unregistering): Released all slaves [ 718.885949][T19118] bond4 (unregistering): Released all slaves [ 718.903328][T19118] bond5 (unregistering): Released all slaves [ 718.921246][T19118] bond6 (unregistering): Released all slaves [ 718.936702][T19118] bond7 (unregistering): Released all slaves [ 718.953890][T19118] bond8 (unregistering): Released all slaves [ 718.983630][T19118] bond9 (unregistering): Released all slaves [ 719.000986][T19118] bond10 (unregistering): Released all slaves [ 719.018495][T19118] bond11 (unregistering): Released all slaves [ 719.045689][T29338] vlan0: entered allmulticast mode [ 719.050854][T29338] bond0: entered allmulticast mode [ 719.056603][T29338] bond_slave_0: entered allmulticast mode [ 719.062619][T29338] bond_slave_1: entered allmulticast mode [ 719.068549][T29338] batadv0: entered allmulticast mode [ 719.077425][T29314] syzkaller1: left promiscuous mode [ 719.083214][T29314] syzkaller1: left allmulticast mode [ 719.150722][T29341] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 719.171402][T29341] bond_slave_0: left allmulticast mode [ 719.212995][T29341] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 719.230903][T29341] bond_slave_1: left allmulticast mode [ 719.246175][T29341] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 719.260568][T29341] batadv0: left allmulticast mode [ 719.279392][T29341] bond0 (unregistering): Released all slaves [ 719.316680][T29346] netlink: 'syz.3.6133': attribute type 4 has an invalid length. [ 719.336956][ T1727] block nbd1: Possible stuck request ffff8880268e8000: control (read@0,1024B). Runtime 150 seconds [ 719.348480][ T1727] block nbd1: Possible stuck request ffff8880268e8200: control (read@1024,1024B). Runtime 150 seconds [ 719.355818][T19105] bond1: (slave veth0_to_bond): link status definitely down, disabling slave [ 719.359737][ T1727] block nbd1: Possible stuck request ffff8880268e8400: control (read@2048,1024B). Runtime 150 seconds [ 719.380230][ T1727] block nbd1: Possible stuck request ffff8880268e8600: control (read@3072,1024B). Runtime 150 seconds [ 719.413185][T19105] bond1: now running without any active interface! [ 719.487761][T19118] : left promiscuous mode [ 719.567535][T19116] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.574883][T19116] bridge0: port 1(bridge_slave_0) entered forwarding state [ 719.608051][T19116] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.615433][T19116] bridge0: port 2(bridge_slave_1) entered forwarding state [ 719.627102][T19118] tipc: Left network mode [ 719.788549][T29373] TCP: TCP_TX_DELAY enabled [ 719.881649][T29378] netlink: 'syz.1.6151': attribute type 12 has an invalid length. [ 720.538112][T28999] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 720.723486][T29414] __nla_validate_parse: 3 callbacks suppressed [ 720.723507][T29414] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6160'. [ 720.741194][T29417] syz.2.6162: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 720.758073][T29417] CPU: 0 UID: 0 PID: 29417 Comm: syz.2.6162 Not tainted syzkaller #0 PREEMPT(full) [ 720.758104][T29417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 720.758119][T29417] Call Trace: [ 720.758127][T29417] [ 720.758138][T29417] dump_stack_lvl+0xe8/0x150 [ 720.758181][T29417] warn_alloc+0x249/0x340 [ 720.758209][T29417] ? stack_trace_save+0xa9/0x100 [ 720.758238][T29417] ? __pfx_warn_alloc+0x10/0x10 [ 720.758271][T29417] ? kasan_save_track+0x4f/0x80 [ 720.758294][T29417] ? kasan_save_track+0x3e/0x80 [ 720.758317][T29417] ? __kasan_kmalloc+0x93/0xb0 [ 720.758341][T29417] ? __kmalloc_cache_noprof+0x31c/0x660 [ 720.758365][T29417] ? xskq_create+0x56/0x170 [ 720.758387][T29417] ? xsk_setsockopt+0x54c/0x990 [ 720.758419][T29417] ? do_sock_setsockopt+0x17c/0x1b0 [ 720.758443][T29417] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 720.758466][T29417] ? do_syscall_64+0x14d/0xf80 [ 720.758498][T29417] __vmalloc_node_range_noprof+0x132/0x1730 [ 720.758558][T29417] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 720.758592][T29417] ? __kasan_kmalloc+0x93/0xb0 [ 720.758624][T29417] vmalloc_user_noprof+0xad/0xe0 [ 720.758650][T29417] ? xskq_create+0xbf/0x170 [ 720.758673][T29417] xskq_create+0xbf/0x170 [ 720.758699][T29417] xsk_init_queue+0x8a/0xe0 [ 720.758730][T29417] xsk_setsockopt+0x54c/0x990 [ 720.758768][T29417] ? __pfx_xsk_setsockopt+0x10/0x10 [ 720.758802][T29417] ? __pfx_aa_sk_perm+0x10/0x10 [ 720.758839][T29417] ? aa_sock_opt_perm+0xff/0x1a0 [ 720.758876][T29417] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 720.758902][T29417] ? __pfx_xsk_setsockopt+0x10/0x10 [ 720.758939][T29417] do_sock_setsockopt+0x17c/0x1b0 [ 720.758971][T29417] __x64_sys_setsockopt+0x13d/0x1b0 [ 720.759003][T29417] do_syscall_64+0x14d/0xf80 [ 720.759038][T29417] ? trace_irq_disable+0x3b/0x150 [ 720.759058][T29417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.759081][T29417] ? clear_bhb_loop+0x40/0x90 [ 720.759108][T29417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.759129][T29417] RIP: 0033:0x7ff407d9c819 [ 720.759151][T29417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 720.759170][T29417] RSP: 002b:00007ff408b75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 720.759194][T29417] RAX: ffffffffffffffda RBX: 00007ff408015fa0 RCX: 00007ff407d9c819 [ 720.759210][T29417] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 720.759223][T29417] RBP: 00007ff407e32c91 R08: 0000000000000004 R09: 0000000000000000 [ 720.759237][T29417] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 720.759251][T29417] R13: 00007ff408016038 R14: 00007ff408015fa0 R15: 00007ffde71495f8 [ 720.759287][T29417] [ 720.759374][T29417] Mem-Info: [ 721.049408][T29417] active_anon:6279 inactive_anon:0 isolated_anon:0 [ 721.049408][T29417] active_file:3343 inactive_file:40185 isolated_file:0 [ 721.049408][T29417] unevictable:768 dirty:79 writeback:0 [ 721.049408][T29417] slab_reclaimable:13345 slab_unreclaimable:117575 [ 721.049408][T29417] mapped:29493 shmem:1368 pagetables:1397 [ 721.049408][T29417] sec_pagetables:0 bounce:0 [ 721.049408][T29417] kernel_misc_reclaimable:0 [ 721.049408][T29417] free:1289507 free_pcp:18778 free_cma:0 [ 721.115353][T29417] Node 0 active_anon:25168kB inactive_anon:0kB active_file:13372kB inactive_file:160548kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:76992kB dirty:324kB writeback:0kB shmem:3936kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15472kB pagetables:5388kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 721.148042][T29417] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:40960kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 721.182560][T29417] Node 0 DMA free:11256kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 721.216876][T29417] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 721.226650][T29417] Node 0 DMA32 free:1342032kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25212kB inactive_anon:0kB active_file:13372kB inactive_file:160548kB unevictable:1536kB writepending:348kB zspages:0kB present:3129332kB managed:2552656kB mlocked:0kB bounce:0kB free_pcp:34500kB local_pcp:18360kB free_cma:0kB [ 721.268511][T29417] lowmem_reserve[]: 0 0 0 0 0 [ 721.273831][T29417] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:880kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 721.303927][T29417] lowmem_reserve[]: 0 0 0 0 0 [ 721.308852][T29417] Node 1 Normal free:3804984kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:39864kB local_pcp:7156kB free_cma:0kB [ 721.360108][T29417] lowmem_reserve[]: 0 0 0 0 0 [ 721.366734][T29417] Node 0 DMA: [ 721.392724][T28999] veth0_vlan: entered promiscuous mode [ 721.432407][T29417] 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 11256kB [ 721.467925][T28999] veth1_vlan: entered promiscuous mode [ 721.479321][T29417] Node 0 DMA32: 10584*4kB (UME) 7876*8kB (UME) 3733*16kB (UME) 414*32kB (UME) 253*64kB (UME) 482*128kB (UME) 660*256kB (UM) 488*512kB (UM) 322*1024kB (UME) 163*2048kB (UM) 1*4096kB (M) = 1342672kB [ 721.529962][T29417] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 721.569938][T19118] hsr_slave_0: left promiscuous mode [ 721.582477][T29417] Node 1 Normal: 3*4kB (UM) 6*8kB (UM) 13*16kB (UM) 9*32kB (UM) 9*64kB (UM) 6*128kB (UM) 4*256kB (UM) 4*512kB (UM) 1*1024kB (M) 3*2048kB (U) 926*4096kB (UM) = 3805036kB [ 721.604889][T29417] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 721.622358][T29429] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6164'. [ 721.631815][T19118] hsr_slave_1: left promiscuous mode [ 721.638856][T29417] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 721.651383][T19118] veth0_macvtap: left promiscuous mode [ 721.658411][T19118] veth1_vlan: left promiscuous mode [ 721.674095][T29417] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 721.692474][T29417] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 721.702745][T29417] 44894 total pagecache pages [ 721.707477][T29417] 0 pages in swap cache [ 721.711711][T29417] Free swap = 124996kB [ 721.717493][T29417] Total swap = 124996kB [ 721.721807][T29417] 2097051 pages RAM [ 721.726183][T29417] 0 pages HighMem/MovableOnly [ 721.731083][T29417] 427052 pages reserved [ 721.736819][T29417] 0 pages cma reserved [ 721.861416][T29439] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6167'. [ 721.949287][T19118] pim6reg527 (unregistering): left allmulticast mode [ 722.422331][T19118] team0 (unregistering): Port device vxcan1 removed [ 722.560822][T29430] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 722.780758][T28999] veth0_macvtap: entered promiscuous mode [ 722.796735][T19119] nci: nci_ntf_packet: unknown ntf opcode 0xe27 [ 722.812959][T29480] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6172'. [ 722.858045][T29483] netlink: 'syz.1.6170': attribute type 21 has an invalid length. [ 722.873379][T29480] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6172'. [ 722.892771][T29480] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6172'. [ 722.904752][T29480] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6172'. [ 722.915179][T29480] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6172'. [ 722.927692][T29483] netlink: 156 bytes leftover after parsing attributes in process `syz.1.6170'. [ 722.942783][T29480] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6172'. [ 722.971311][T29486] gretap0: entered promiscuous mode [ 723.011336][T29486] vlan0: entered promiscuous mode [ 723.093440][T28999] veth1_macvtap: entered promiscuous mode [ 723.208466][T28999] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 723.227139][T28999] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 723.249217][T19123] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.284511][T19123] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.299797][T19123] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.319048][T19123] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.386335][T19118] IPVS: stop unused estimator thread 0... [ 723.394259][T29463] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 723.654574][T19119] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 723.669557][T19119] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 723.745003][T19117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 723.763121][T19117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 724.650912][ T5835] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 724.664021][ T5835] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 724.673423][ T5835] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 724.703452][ T5835] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 724.722648][ T5835] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 724.814206][T29567] x_tables: unsorted underflow at hook 1 [ 725.141056][T29579] net_ratelimit: 12 callbacks suppressed [ 725.141079][T29579] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 725.640369][T29561] chnl_net:caif_netlink_parms(): no params data found [ 725.794565][T29618] IPVS: length: 24 != 410706591768 [ 725.841203][T29622] __nla_validate_parse: 36 callbacks suppressed [ 725.841225][T29622] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6203'. [ 725.931403][T29561] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.938862][T29561] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.947034][T29561] bridge_slave_0: entered allmulticast mode [ 725.955291][T29561] bridge_slave_0: entered promiscuous mode [ 725.966539][T29561] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.973939][T29561] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.981813][T29561] bridge_slave_1: entered allmulticast mode [ 725.990278][T29561] bridge_slave_1: entered promiscuous mode [ 726.036365][T29561] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 726.049771][T29561] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 726.161687][T29561] team0: Port device team_slave_0 added [ 726.200104][T29561] team0: Port device team_slave_1 added [ 726.246480][T29643] netlink: 13 bytes leftover after parsing attributes in process `syz.3.6208'. [ 726.313864][T29561] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 726.322789][T29646] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6209'. [ 726.338911][T29561] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.382012][T29646] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6209'. [ 726.407676][T29561] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 726.430407][T29561] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 726.462793][T29561] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.540488][T29561] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 726.635325][T29561] hsr_slave_0: entered promiscuous mode [ 726.654646][T29561] hsr_slave_1: entered promiscuous mode [ 726.673079][T29561] debugfs: 'hsr0' already exists in 'hsr' [ 726.678959][T29561] Cannot create hsr debugfs directory [ 726.772380][ T5837] Bluetooth: hci4: command tx timeout [ 726.830117][T29667] netlink: 232 bytes leftover after parsing attributes in process `syz.0.6213'. [ 727.009330][T29676] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6216'. [ 727.057109][T29676] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6216'. [ 727.089501][T29676] netlink: 'syz.1.6216': attribute type 3 has an invalid length. [ 727.310514][T29692] netlink: 'syz.1.6221': attribute type 21 has an invalid length. [ 727.348488][T29692] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6221'. [ 727.728144][T29712] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6226'. [ 727.746045][T29714] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6227'. [ 727.903000][T29712] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 727.913853][T29712] team0: Port device batadv1 added [ 727.938999][T29725] mac80211_hwsim hwsim79 ÿ: renamed from wlan1 (while UP) [ 728.325514][T29561] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 728.368466][T29561] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 728.414209][T29561] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 728.447413][T29561] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 728.616158][T25543] IPVS: starting estimator thread 0... [ 728.702417][T29768] IPVS: using max 25 ests per chain, 60000 per kthread [ 728.855899][ T5837] Bluetooth: hci4: command tx timeout [ 729.143319][T29561] 8021q: adding VLAN 0 to HW filter on device bond0 [ 729.196480][T29793] netlink: 'syz.3.6241': attribute type 13 has an invalid length. [ 729.204658][T29561] 8021q: adding VLAN 0 to HW filter on device team0 [ 729.245165][T29793] netlink: 'syz.3.6241': attribute type 58 has an invalid length. [ 729.256691][T19119] bridge0: port 1(bridge_slave_0) entered blocking state [ 729.263921][T19119] bridge0: port 1(bridge_slave_0) entered forwarding state [ 729.330022][T19119] bridge0: port 2(bridge_slave_1) entered blocking state [ 729.337273][T19119] bridge0: port 2(bridge_slave_1) entered forwarding state [ 729.643949][T29561] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 729.750489][T29815] netlink: 'syz.4.6247': attribute type 11 has an invalid length. [ 730.276558][T29561] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 730.496500][T29561] veth0_vlan: entered promiscuous mode [ 730.567329][T29561] veth1_vlan: entered promiscuous mode [ 730.663411][T29561] veth0_macvtap: entered promiscuous mode [ 730.710406][T29561] veth1_macvtap: entered promiscuous mode [ 730.794400][T29561] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 730.885147][T29561] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 730.916082][T19105] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.933340][ T5837] Bluetooth: hci4: command tx timeout [ 730.959470][T29885] __nla_validate_parse: 7 callbacks suppressed [ 730.959490][T29885] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6264'. [ 730.983001][T19116] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.992187][T29885] netlink: 43 bytes leftover after parsing attributes in process `syz.3.6264'. [ 731.019729][T29885] netlink: 'syz.3.6264': attribute type 5 has an invalid length. [ 731.031805][T29888] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 731.039945][T29888] team0: Device macvlan2 is already an upper device of the team interface [ 731.053954][T29885] netlink: 43 bytes leftover after parsing attributes in process `syz.3.6264'. [ 731.083611][T19116] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.166516][T19116] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.348718][T29903] netlink: 'syz.0.6267': attribute type 4 has an invalid length. [ 731.370626][T19116] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.391744][T19116] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.475620][T29909] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6268'. [ 731.622328][T19116] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.632253][T19116] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.808753][T29926] "syz.1.6271" (29926) uses obsolete ecb(arc4) skcipher [ 732.116362][ T29] audit: type=1107 audit(1774892337.341:8): pid=29948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 732.182067][T29951] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6275'. [ 732.385941][T29960] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6277'. [ 732.421603][T29962] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6278'. [ 732.504375][T29966] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6279'. [ 732.775890][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.816032][T29981] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6284'. [ 732.949202][ T5835] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 732.960318][ T5835] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 732.972914][ T5835] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 732.992343][ T5835] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 733.000239][ T5835] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 733.018419][ T5835] Bluetooth: hci4: command tx timeout [ 733.567928][T29984] chnl_net:caif_netlink_parms(): no params data found [ 733.577006][T30007] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6290'. [ 733.740834][T30008] tunl0: entered promiscuous mode [ 733.765322][T30008] netlink: 'syz.0.6289': attribute type 3 has an invalid length. [ 733.846569][T29984] bridge0: port 1(bridge_slave_0) entered blocking state [ 733.854818][T29984] bridge0: port 1(bridge_slave_0) entered disabled state [ 733.864600][T29984] bridge_slave_0: entered allmulticast mode [ 733.873378][T29984] bridge_slave_0: entered promiscuous mode [ 733.897436][T29984] bridge0: port 2(bridge_slave_1) entered blocking state [ 733.905736][T29984] bridge0: port 2(bridge_slave_1) entered disabled state [ 733.913440][T29984] bridge_slave_1: entered allmulticast mode [ 733.936567][T29984] bridge_slave_1: entered promiscuous mode [ 734.083478][T29984] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 734.123710][T29984] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 734.213440][T30032] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 734.233221][T30032] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 734.241339][T30032] gretap1: entered promiscuous mode [ 734.247971][T30032] gretap1: entered allmulticast mode [ 734.296347][T29984] team0: Port device team_slave_0 added [ 734.314610][T29984] team0: Port device team_slave_1 added [ 734.414391][T29984] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 734.442011][T29984] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 734.496823][T29984] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 734.552913][T29984] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 734.571569][T29984] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 734.661952][T29984] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 734.747884][T29984] hsr_slave_0: entered promiscuous mode [ 734.754993][T29984] hsr_slave_1: entered promiscuous mode [ 734.761671][T29984] debugfs: 'hsr0' already exists in 'hsr' [ 734.767644][T29984] Cannot create hsr debugfs directory [ 734.931669][T30077] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 735.094794][ T5837] Bluetooth: hci5: command tx timeout [ 735.443901][T29984] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.462394][T29984] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.599198][T30102] team_slave_0: mtu less than device minimum [ 735.642004][T30105] netlink: 'syz.1.6312': attribute type 1 has an invalid length. [ 735.703167][T30105] IPVS: set_ctl: invalid protocol: 8 0.0.0.16:2048 [ 735.733504][T29984] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.760709][T29984] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.948357][T29984] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.974292][T29984] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 736.068196][T30117] pim6reg: entered allmulticast mode [ 736.244372][T29984] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 736.256019][T29984] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 736.540736][T30142] __nla_validate_parse: 3 callbacks suppressed [ 736.540758][T30142] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6322'. [ 736.686027][T30150] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6324'. [ 736.751765][T29984] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 736.780207][T29984] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 736.813681][T29984] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 736.836203][T29984] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 737.030017][T30166] netlink: 9 bytes leftover after parsing attributes in process `syz.0.6326'. [ 737.168939][T29984] 8021q: adding VLAN 0 to HW filter on device bond0 [ 737.176401][ T5837] Bluetooth: hci5: command tx timeout [ 737.187944][T30174] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6330'. [ 737.244370][T29984] 8021q: adding VLAN 0 to HW filter on device team0 [ 737.276778][T19123] bridge0: port 1(bridge_slave_0) entered blocking state [ 737.284064][T19123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 737.347076][T19116] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.354333][T19116] bridge0: port 2(bridge_slave_1) entered forwarding state [ 737.483474][T30180] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6333'. [ 737.588576][T30188] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6336'. [ 737.609824][T30187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6336'. [ 737.646487][T30188] syzkaller0: entered promiscuous mode [ 737.652724][T30188] syzkaller0: entered allmulticast mode [ 737.724138][T30187] bond1: entered promiscuous mode [ 737.751174][T30187] bond1: entered allmulticast mode [ 737.759781][T30187] 8021q: adding VLAN 0 to HW filter on device bond1 [ 737.854377][T30192] bond1: option arp_all_targets: invalid value (18446744073709551613) [ 737.880364][T30192] bond1 (unregistering): Released all slaves [ 737.894802][T19116] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.231758][T30215] netlink: 'syz.0.6345': attribute type 1 has an invalid length. [ 738.396134][T29984] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 738.447603][T30222] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6347'. [ 738.499366][T30224] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6346'. [ 738.640875][T30227] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6349'. [ 739.231430][T29984] veth0_vlan: entered promiscuous mode [ 739.248891][T29984] veth1_vlan: entered promiscuous mode [ 739.256393][ T5837] Bluetooth: hci5: command tx timeout [ 739.296064][T29984] veth0_macvtap: entered promiscuous mode [ 739.310225][T29984] veth1_macvtap: entered promiscuous mode [ 739.347448][T29984] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 739.359993][T29984] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 739.390103][T30269] netlink: 'syz.1.6360': attribute type 1 has an invalid length. [ 739.526266][T19118] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 739.560083][T19118] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 739.618984][T19118] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 739.670760][T19118] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 739.864263][T19116] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 739.874578][T19116] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 739.985981][T19123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 739.995140][T19123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 740.709307][T30339] netlink: 'syz.3.6381': attribute type 4 has an invalid length. [ 740.864615][T30346] syz.4.6384: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 740.914760][T30346] CPU: 1 UID: 0 PID: 30346 Comm: syz.4.6384 Not tainted syzkaller #0 PREEMPT(full) [ 740.914794][T30346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 740.914808][T30346] Call Trace: [ 740.914817][T30346] [ 740.914826][T30346] dump_stack_lvl+0xe8/0x150 [ 740.914863][T30346] warn_alloc+0x249/0x340 [ 740.914892][T30346] ? stack_trace_save+0xa9/0x100 [ 740.914919][T30346] ? __pfx_warn_alloc+0x10/0x10 [ 740.914952][T30346] ? kasan_save_track+0x4f/0x80 [ 740.914975][T30346] ? kasan_save_track+0x3e/0x80 [ 740.914996][T30346] ? __kasan_kmalloc+0x93/0xb0 [ 740.915019][T30346] ? __kmalloc_cache_noprof+0x31c/0x660 [ 740.915042][T30346] ? xskq_create+0x56/0x170 [ 740.915064][T30346] ? xsk_setsockopt+0x54c/0x990 [ 740.915095][T30346] ? do_sock_setsockopt+0x17c/0x1b0 [ 740.915118][T30346] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 740.915140][T30346] ? do_syscall_64+0x14d/0xf80 [ 740.915169][T30346] __vmalloc_node_range_noprof+0x132/0x1730 [ 740.915228][T30346] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 740.915261][T30346] ? __kasan_kmalloc+0x93/0xb0 [ 740.915294][T30346] vmalloc_user_noprof+0xad/0xe0 [ 740.915318][T30346] ? xskq_create+0xbf/0x170 [ 740.915341][T30346] xskq_create+0xbf/0x170 [ 740.915367][T30346] xsk_init_queue+0x8a/0xe0 [ 740.915390][T30346] xsk_setsockopt+0x54c/0x990 [ 740.915427][T30346] ? __pfx_xsk_setsockopt+0x10/0x10 [ 740.915462][T30346] ? __pfx_aa_sk_perm+0x10/0x10 [ 740.915497][T30346] ? aa_sock_opt_perm+0xff/0x1a0 [ 740.915532][T30346] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 740.915558][T30346] ? __pfx_xsk_setsockopt+0x10/0x10 [ 740.915593][T30346] do_sock_setsockopt+0x17c/0x1b0 [ 740.915630][T30346] __x64_sys_setsockopt+0x13d/0x1b0 [ 740.915662][T30346] do_syscall_64+0x14d/0xf80 [ 740.915686][T30346] ? trace_irq_disable+0x3b/0x150 [ 740.915705][T30346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.915728][T30346] ? clear_bhb_loop+0x40/0x90 [ 740.915755][T30346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.915777][T30346] RIP: 0033:0x7f046739c819 [ 740.915797][T30346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.915816][T30346] RSP: 002b:00007f0468281028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 740.915839][T30346] RAX: ffffffffffffffda RBX: 00007f0467615fa0 RCX: 00007f046739c819 [ 740.915855][T30346] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 740.915868][T30346] RBP: 00007f0467432c91 R08: 0000000000000004 R09: 0000000000000000 [ 740.915883][T30346] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 740.915896][T30346] R13: 00007f0467616038 R14: 00007f0467615fa0 R15: 00007ffca2dd74e8 [ 740.915931][T30346] [ 741.210633][T30346] Mem-Info: [ 741.214156][T30346] active_anon:6184 inactive_anon:0 isolated_anon:0 [ 741.214156][T30346] active_file:3343 inactive_file:40199 isolated_file:0 [ 741.214156][T30346] unevictable:768 dirty:63 writeback:0 [ 741.214156][T30346] slab_reclaimable:13271 slab_unreclaimable:122257 [ 741.214156][T30346] mapped:29483 shmem:1367 pagetables:1356 [ 741.214156][T30346] sec_pagetables:0 bounce:0 [ 741.214156][T30346] kernel_misc_reclaimable:0 [ 741.214156][T30346] free:1281075 free_pcp:20527 free_cma:0 [ 741.262011][T30346] Node 0 active_anon:24736kB inactive_anon:0kB active_file:13372kB inactive_file:160596kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:40108kB dirty:252kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15732kB pagetables:5244kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 741.295300][T30346] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:77824kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 741.326301][T30346] Node 0 DMA free:11256kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 741.359222][T30346] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 741.365365][T30346] Node 0 DMA32 free:1382556kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24736kB inactive_anon:0kB active_file:13372kB inactive_file:160596kB unevictable:1536kB writepending:252kB zspages:0kB present:3129332kB managed:2552656kB mlocked:0kB bounce:0kB free_pcp:44900kB local_pcp:20556kB free_cma:0kB [ 741.366573][ T5837] Bluetooth: hci5: command tx timeout [ 741.399562][T30346] lowmem_reserve[]: 0 0 0 0 0 [ 741.409674][T30346] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:880kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 741.441953][T30346] lowmem_reserve[]: 0 0 0 0 0 [ 741.446771][T30346] Node 1 Normal free:3730488kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:36580kB local_pcp:5644kB free_cma:0kB [ 741.480855][T30346] lowmem_reserve[]: 0 0 0 0 0 [ 741.486020][T30346] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 11256kB [ 741.503333][T30346] Node 0 DMA32: 11057*4kB (UME) 7543*8kB (UME) 3950*16kB (UME) 385*32kB (UME) 219*64kB (UME) 531*128kB (UME) 695*256kB (UM) 507*512kB (UM) 331*1024kB (UME) 166*2048kB (UM) 1*4096kB (U) = 1382588kB [ 741.523817][T30346] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 741.545188][T30346] Node 1 Normal: 2*4kB (UM) 4*8kB (UM) 11*16kB (UM) 9*32kB (UM) 9*64kB (UM) 6*128kB (UM) 5*256kB (UM) 6*512kB (UM) 3*1024kB (UM) 3*2048kB (U) 907*4096kB (M) = 3730488kB [ 741.612324][T30346] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 741.640141][T30346] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 741.651362][T30346] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 741.665267][T30346] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 741.709257][T30364] __nla_validate_parse: 6 callbacks suppressed [ 741.709278][T30364] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6389'. [ 741.713874][T30346] 44906 total pagecache pages [ 741.730196][T30346] 0 pages in swap cache [ 741.739361][T30346] Free swap = 124996kB [ 741.744899][T30366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6389'. [ 741.801210][T30346] Total swap = 124996kB [ 741.810930][T30346] 2097051 pages RAM [ 741.821089][T30346] 0 pages HighMem/MovableOnly [ 741.831267][T30346] 427052 pages reserved [ 741.835736][T30364] netlink: 'syz.2.6389': attribute type 10 has an invalid length. [ 741.841410][T30371] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6389'. [ 741.864045][T30346] 0 pages cma reserved [ 741.887926][T30364] team0: Device vxcan1 is of different type [ 742.020767][T30381] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6393'. [ 742.056307][T30381] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6393'. [ 742.123901][T30385] syzkaller0: entered promiscuous mode [ 742.129750][T30385] syzkaller0: entered allmulticast mode [ 742.448971][T30402] bond3 (unregistering): Released all slaves [ 742.477094][T30405] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6402'. [ 742.580957][T30409] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 742.650428][T30415] syzkaller1: entered promiscuous mode [ 742.671241][T30415] syzkaller1: entered allmulticast mode [ 742.678493][T30418] netlink: 'syz.1.6404': attribute type 2 has an invalid length. [ 742.688908][T30411] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6404'. [ 742.758903][T30421] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6406'. [ 742.823502][T30425] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6407'. [ 742.846057][T30426] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6408'. [ 742.847243][T30425] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 742.868038][T30425] team0: Failed to send port change of device batadv2 via netlink (err -105) [ 742.881684][T30425] team0: Failed to send options change via netlink (err -105) [ 742.895328][T30426] openvswitch: netlink: Flow actions attr not present in new flow. [ 742.901201][T30425] team0: Port device batadv2 added [ 743.019061][T19123] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.155293][ T6692] lec:lec_start_xmit: lec0:No lecd attached [ 743.407177][T30450] gtp0: entered promiscuous mode [ 743.412696][T30450] gtp0: entered allmulticast mode [ 743.627985][T30470] netlink: 'syz.0.6421': attribute type 16 has an invalid length. [ 743.642868][T30470] netlink: 'syz.0.6421': attribute type 3 has an invalid length. [ 744.439502][T30467] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 745.320435][T30563] netlink: 'syz.0.6446': attribute type 1 has an invalid length. [ 745.353926][T30557] veth3: entered promiscuous mode [ 745.359317][T30557] veth3: entered allmulticast mode [ 745.414713][T30563] 8021q: adding VLAN 0 to HW filter on device bond1 [ 745.476839][T30563] vlan2: entered promiscuous mode [ 745.540136][T30563] bond1: entered promiscuous mode [ 745.550986][T30563] vlan2: entered allmulticast mode [ 745.556716][T30563] bond1: entered allmulticast mode [ 745.614332][T30563] netlink: 'syz.0.6446': attribute type 1 has an invalid length. [ 745.638674][T30565] bond1: (slave bridge2): making interface the new active one [ 745.643285][T30563] netlink: 'syz.0.6446': attribute type 2 has an invalid length. [ 745.664914][T30565] bridge2: entered promiscuous mode [ 745.671113][T30565] bridge2: entered allmulticast mode [ 745.678966][T30565] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 745.749174][T30569] bond1: option miimon: invalid value (18446744073709551585) [ 745.762872][T30569] bond1: option miimon: allowed values 0 - 2147483647 [ 745.775798][T30569] bond1 (unregistering): Released all slaves [ 746.028022][T30593] netlink: 'syz.2.6455': attribute type 2 has an invalid length. [ 746.247339][ T29] audit: type=1107 audit(1774892351.471:9): pid=30599 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Ù‹5ž÷Œ•%èÍUýAÊÃËÙ ë0ä™l…t¿Ý•/Öÿ Ž6òŠ¨Šç›' [ 746.363219][T30609] netlink: 'syz.3.6462': attribute type 1 has an invalid length. [ 746.371102][T30609] netlink: 'syz.3.6462': attribute type 1 has an invalid length. [ 746.385227][T30609] netlink: 'syz.3.6462': attribute type 8 has an invalid length. [ 746.857002][T30632] macvlan0: entered promiscuous mode [ 746.891292][T30634] bridge_slave_0: left allmulticast mode [ 746.897793][T30634] bridge_slave_0: left promiscuous mode [ 746.904992][T30634] bridge0: port 1(bridge_slave_0) entered disabled state [ 746.925824][T30634] bridge_slave_1: left allmulticast mode [ 746.931740][T30634] bridge_slave_1: left promiscuous mode [ 746.944374][T30634] bridge0: port 2(bridge_slave_1) entered disabled state [ 746.950436][T30638] __nla_validate_parse: 18 callbacks suppressed [ 746.950494][T30638] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6471'. [ 746.974906][T30634] bond0: (slave bond_slave_0): Releasing backup interface [ 746.993773][T30634] bond0: (slave bond_slave_1): Releasing backup interface [ 747.018172][T30634] team0: Port device team_slave_0 removed [ 747.049454][T30634] team0: Port device team_slave_1 removed [ 747.057168][T30634] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 747.065712][T30634] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 747.083991][T30634] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 747.103115][T30634] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 747.124169][T30634] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 747.156011][T30639] team0: Mode changed to "random" [ 747.385010][T30651] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6475'. [ 747.431429][T30651] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6475'. [ 747.497094][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.547222][T30655] bond2: entered promiscuous mode [ 747.552853][T30655] bond2: entered allmulticast mode [ 747.558663][T30655] 8021q: adding VLAN 0 to HW filter on device bond2 [ 747.740263][T30674] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6480'. [ 747.761674][T30674] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6480'. [ 747.766335][T30667] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6481'. [ 747.786510][T30678] netlink: 624 bytes leftover after parsing attributes in process `syz.0.6478'. [ 747.797193][T30678] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 747.810552][T30668] syzkaller0: entered promiscuous mode [ 747.817184][T30668] syzkaller0: entered allmulticast mode [ 748.053561][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.108649][T30690] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6486'. [ 748.162290][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 748.170485][ C1] lec:lec_tx_timeout: lec0 [ 748.175320][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 749.414583][ T1727] block nbd1: Possible stuck request ffff8880268e8000: control (read@0,1024B). Runtime 180 seconds [ 749.425571][ T1727] block nbd1: Possible stuck request ffff8880268e8200: control (read@1024,1024B). Runtime 180 seconds [ 749.438971][ T1727] block nbd1: Possible stuck request ffff8880268e8400: control (read@2048,1024B). Runtime 180 seconds [ 749.450335][ T1727] block nbd1: Possible stuck request ffff8880268e8600: control (read@3072,1024B). Runtime 180 seconds [ 750.655279][T30664] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 751.329369][T30751] netlink: 'syz.3.6501': attribute type 4 has an invalid length. [ 751.458103][T30756] netlink: 256 bytes leftover after parsing attributes in process `syz.1.6504'. [ 751.714538][T30768] netlink: 88 bytes leftover after parsing attributes in process `syz.1.6509'. [ 751.938303][T30775] syzkaller0: entered promiscuous mode [ 751.952783][T30775] syzkaller0: entered allmulticast mode [ 752.014758][T30783] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 753.103080][T19119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.186142][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 753.194350][ C1] lec:lec_tx_timeout: lec0 [ 754.592188][T30807] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6521'. [ 754.611536][T30807] nbd: couldn't find a device at index 0 [ 757.187962][T30823] veth3: entered promiscuous mode [ 757.398298][T30851] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6529'. [ 757.445397][T30851] netdevsim netdevsim0: Direct firmware load for .. @ failed with error -2 [ 757.467259][T30853] syzkaller0: entered promiscuous mode [ 757.484022][T30853] syzkaller0: entered allmulticast mode [ 757.485969][T30851] netdevsim netdevsim0: Falling back to sysfs fallback for: .. @ [ 757.684205][T30864] bond3: option mode: invalid value (133) [ 757.709275][T30864] bond3 (unregistering): Released all slaves [ 758.064926][T30886] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6539'. [ 758.222614][T30899] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6539'. [ 758.459955][T30917] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6546'. [ 758.496241][T30920] netlink: 'syz.1.6547': attribute type 1 has an invalid length. [ 758.504736][T30918] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6546'. [ 758.535860][T30923] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 758.625681][T30920] bond5: entered promiscuous mode [ 758.631384][T30920] 8021q: adding VLAN 0 to HW filter on device bond5 [ 758.709025][T30928] bond5: (slave bridge3): making interface the new active one [ 758.745394][T30928] bridge3: entered promiscuous mode [ 758.789560][T30928] bridge3: left promiscuous mode [ 758.983227][T30950] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6551'. [ 759.015565][T19116] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.030036][T30950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6551'. [ 759.166846][T30961] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6554'. [ 759.261061][T30972] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6557'. [ 759.374513][T30972] pim6reg1: entered promiscuous mode [ 759.379942][T30972] pim6reg1: entered allmulticast mode [ 759.408201][T30976] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 761.980930][T30983] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6562'. [ 762.003459][T30983] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6562'. [ 762.227122][T31023] netlink: 'syz.4.6570': attribute type 10 has an invalid length. [ 762.302460][T31023] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 762.413715][T31035] SET target dimension over the limit! [ 762.479016][T31038] netlink: 'syz.3.6576': attribute type 1 has an invalid length. [ 762.488317][T31038] netlink: 'syz.3.6576': attribute type 1 has an invalid length. [ 762.496703][T31038] netlink: 'syz.3.6576': attribute type 1 has an invalid length. [ 762.508622][T31038] netlink: 'syz.3.6576': attribute type 2 has an invalid length. [ 762.516716][T31038] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6576'. [ 762.581484][T31045] IPv6: addrconf: prefix option has invalid lifetime [ 762.621907][T31051] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6579'. [ 762.673856][T31053] IPv6: addrconf: prefix option has invalid lifetime [ 762.941732][T31064] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6582'. [ 763.006252][T31067] netlink: 'syz.1.6584': attribute type 1 has an invalid length. [ 763.107177][T31064] 8021q: adding VLAN 0 to HW filter on device bond1 [ 763.363197][T31064] bond1: entered promiscuous mode [ 763.368361][T31064] bond1: entered allmulticast mode [ 763.389504][T31070] vxcan3: entered promiscuous mode [ 763.429844][T31070] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 763.496712][T31070] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 763.536999][T31088] netlink: 'syz.2.6590': attribute type 1 has an invalid length. [ 763.591237][T31088] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6590'. [ 764.031236][T31109] netlink: 'syz.4.6595': attribute type 4 has an invalid length. [ 764.057655][T31109] netlink: 17 bytes leftover after parsing attributes in process `syz.4.6595'. [ 764.116475][T31115] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 764.186851][T31114] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 764.293503][T31122] netlink: 176 bytes leftover after parsing attributes in process `syz.4.6599'. [ 764.304937][T31122] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6599'. [ 764.353125][T31122] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6599'. [ 764.400445][T31122] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 764.423533][T31123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 764.777796][T19117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.245037][T31187] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 766.174527][T31235] netlink: 'syz.1.6634': attribute type 1 has an invalid length. [ 766.229014][T31236] netlink: 'syz.1.6634': attribute type 21 has an invalid length. [ 766.246025][T31236] netlink: 'syz.1.6634': attribute type 5 has an invalid length. [ 766.786359][T31268] veth0_macvtap: left promiscuous mode [ 766.792696][T31268] macvtap0: entered allmulticast mode [ 767.163790][T31284] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 767.388014][T31294] sctp: [Deprecated]: syz.2.6656 (pid 31294) Use of int in max_burst socket option. [ 767.388014][T31294] Use struct sctp_assoc_value instead [ 767.529838][T31304] __nla_validate_parse: 13 callbacks suppressed [ 767.529863][T31304] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6658'. [ 767.575470][T31304] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6658'. [ 767.607141][T31308] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6658'. [ 767.634608][T31308] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6658'. [ 767.818808][T31330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6664'. [ 767.831466][T31330] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6664'. [ 767.869739][ T146] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.870078][T31330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6664'. [ 767.918656][T31330] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6664'. [ 767.923149][ T146] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.977053][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.996281][ T146] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 768.029440][T31337] sock: sock_set_timeout: `syz.2.6669' (pid 31337) tries to set negative timeout [ 768.040192][T31337] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6669'. [ 768.051572][ T146] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 768.072961][T31332] netlink: 'syz.4.6667': attribute type 13 has an invalid length. [ 768.097741][T31339] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6671'. [ 768.130304][T31332] gretap0: refused to change device tx_queue_len [ 768.184859][T31332] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 768.395266][T31358] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 768.453408][T31354] netlink: 'syz.3.6670': attribute type 13 has an invalid length. [ 768.486818][T31351] netlink: 'syz.0.6672': attribute type 1 has an invalid length. [ 768.644726][T31366] nbd: couldn't find a device at index 0 [ 769.039878][T31400] netlink: 'syz.3.6688': attribute type 11 has an invalid length. [ 769.278635][T31421] netlink: 'syz.4.6694': attribute type 1 has an invalid length. [ 769.345449][T31421] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 769.346263][ T146] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.387529][ T146] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.436817][ T146] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.452249][ T146] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.462684][T31429] netlink: 'syz.1.6695': attribute type 11 has an invalid length. [ 769.494078][ T146] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.507786][T31429] netlink: 'syz.1.6695': attribute type 11 has an invalid length. [ 769.528520][ T146] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.558580][ T146] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.588670][ T146] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.948144][T31463] netlink: 'syz.3.6704': attribute type 2 has an invalid length. [ 769.988941][T31448] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 770.274889][T31479] ipt_ECN: cannot use operation on non-tcp rule [ 770.282193][T31483] netlink: 'syz.0.6711': attribute type 4 has an invalid length. [ 770.389394][T31488] hsr_slave_0: left promiscuous mode [ 770.414320][T31488] hsr_slave_1: left promiscuous mode [ 770.433984][T31490] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 770.472758][T31496] netlink: 'syz.3.6715': attribute type 29 has an invalid length. [ 770.505214][T31498] syz.0.6716: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 770.539906][T19118] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.550226][T31498] CPU: 0 UID: 0 PID: 31498 Comm: syz.0.6716 Not tainted syzkaller #0 PREEMPT(full) [ 770.550260][T31498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 770.550275][T31498] Call Trace: [ 770.550285][T31498] [ 770.550296][T31498] dump_stack_lvl+0xe8/0x150 [ 770.550336][T31498] warn_alloc+0x249/0x340 [ 770.550364][T31498] ? stack_trace_save+0xa9/0x100 [ 770.550391][T31498] ? __pfx_warn_alloc+0x10/0x10 [ 770.550425][T31498] ? kasan_save_track+0x4f/0x80 [ 770.550447][T31498] ? kasan_save_track+0x3e/0x80 [ 770.550477][T31498] ? __kasan_kmalloc+0x93/0xb0 [ 770.550501][T31498] ? __kmalloc_cache_noprof+0x31c/0x660 [ 770.550528][T31498] ? xskq_create+0x56/0x170 [ 770.550558][T31498] ? xsk_setsockopt+0x54c/0x990 [ 770.550598][T31498] ? do_sock_setsockopt+0x17c/0x1b0 [ 770.550623][T31498] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 770.550646][T31498] ? do_syscall_64+0x14d/0xf80 [ 770.550678][T31498] __vmalloc_node_range_noprof+0x132/0x1730 [ 770.550737][T31498] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 770.550772][T31498] ? __kasan_kmalloc+0x93/0xb0 [ 770.550806][T31498] vmalloc_user_noprof+0xad/0xe0 [ 770.550832][T31498] ? xskq_create+0xbf/0x170 [ 770.550858][T31498] xskq_create+0xbf/0x170 [ 770.550884][T31498] xsk_init_queue+0x8a/0xe0 [ 770.550912][T31498] xsk_setsockopt+0x54c/0x990 [ 770.550952][T31498] ? __pfx_xsk_setsockopt+0x10/0x10 [ 770.550985][T31498] ? __pfx_aa_sk_perm+0x10/0x10 [ 770.551022][T31498] ? aa_sock_opt_perm+0xff/0x1a0 [ 770.551060][T31498] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 770.551092][T31498] ? __pfx_xsk_setsockopt+0x10/0x10 [ 770.551128][T31498] do_sock_setsockopt+0x17c/0x1b0 [ 770.551162][T31498] __x64_sys_setsockopt+0x13d/0x1b0 [ 770.551194][T31498] do_syscall_64+0x14d/0xf80 [ 770.551219][T31498] ? trace_irq_disable+0x3b/0x150 [ 770.551245][T31498] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.551268][T31498] ? clear_bhb_loop+0x40/0x90 [ 770.551294][T31498] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.551316][T31498] RIP: 0033:0x7f817199c819 [ 770.551355][T31498] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 770.551374][T31498] RSP: 002b:00007f817282d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 770.551398][T31498] RAX: ffffffffffffffda RBX: 00007f8171c15fa0 RCX: 00007f817199c819 [ 770.551416][T31498] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 770.551429][T31498] RBP: 00007f8171a32c91 R08: 0000000000000004 R09: 0000000000000000 [ 770.551442][T31498] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 770.551456][T31498] R13: 00007f8171c16038 R14: 00007f8171c15fa0 R15: 00007fffca2a3398 [ 770.551491][T31498] [ 770.843426][T31498] Mem-Info: [ 770.846626][T31498] active_anon:6377 inactive_anon:0 isolated_anon:0 [ 770.846626][T31498] active_file:3343 inactive_file:40211 isolated_file:0 [ 770.846626][T31498] unevictable:777 dirty:68 writeback:0 [ 770.846626][T31498] slab_reclaimable:13197 slab_unreclaimable:123248 [ 770.846626][T31498] mapped:29568 shmem:1367 pagetables:1461 [ 770.846626][T31498] sec_pagetables:0 bounce:0 [ 770.846626][T31498] kernel_misc_reclaimable:0 [ 770.846626][T31498] free:1282177 free_pcp:17372 free_cma:0 [ 770.902880][T31498] Node 0 active_anon:25508kB inactive_anon:0kB active_file:13372kB inactive_file:160644kB unevictable:1572kB isolated(anon):0kB isolated(file):0kB mapped:40548kB dirty:272kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16204kB pagetables:5664kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 770.947612][T31498] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:77824kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 771.001657][T31498] Node 0 DMA free:11256kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 771.072234][T31498] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 771.078201][T31498] Node 0 DMA32 free:1382028kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25208kB inactive_anon:0kB active_file:13372kB inactive_file:160644kB unevictable:1572kB writepending:272kB zspages:0kB present:3129332kB managed:2552656kB mlocked:36kB bounce:0kB free_pcp:38140kB local_pcp:18600kB free_cma:0kB [ 771.112759][T31498] lowmem_reserve[]: 0 0 0 0 0 [ 771.117562][T31498] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:880kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 771.212185][T31498] lowmem_reserve[]: 0 0 0 0 0 [ 771.217268][T31498] Node 1 Normal free:3735476kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:31528kB local_pcp:28416kB free_cma:0kB [ 771.290699][T31498] lowmem_reserve[]: 0 0 0 0 0 [ 771.307950][T31498] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 11256kB [ 771.379225][T31498] Node 0 DMA32: 11931*4kB (UME) 8018*8kB (UM) 4037*16kB (UME) 452*32kB (UME) 102*64kB (UME) 477*128kB (UME) 699*256kB (UM) 507*512kB (UM) 333*1024kB (UME) 166*2048kB (UM) 1*4096kB (U) = 1382092kB [ 771.401246][T31514] Bluetooth: hci2: Opcode 0x0c1a failed: -22 [ 771.423826][T31498] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 771.512569][T31498] Node 1 Normal: 2*4kB (UM) 6*8kB (UM) 13*16kB (UM) 9*32kB (UM) 9*64kB (UM) 7*128kB (UM) 4*256kB (UM) 4*512kB (UM) 1*1024kB (M) 3*2048kB (U) 909*4096kB (UM) = 3735528kB [ 771.593756][T31498] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 771.630126][T31498] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 771.640001][T31498] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 771.655461][T31498] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 771.665602][T31498] 44916 total pagecache pages [ 771.670338][T31498] 0 pages in swap cache [ 771.675063][T31498] Free swap = 124996kB [ 771.679439][T31498] Total swap = 124996kB [ 771.683966][T31498] 2097051 pages RAM [ 771.687990][T31498] 0 pages HighMem/MovableOnly [ 771.692947][T31498] 427052 pages reserved [ 771.697140][T31498] 0 pages cma reserved [ 772.001236][T31544] syzkaller0: entered promiscuous mode [ 772.017339][T31544] syzkaller0: entered allmulticast mode [ 772.368756][T31563] delete_channel: no stack [ 772.757744][T31583] __nla_validate_parse: 18 callbacks suppressed [ 772.757767][T31583] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6741'. [ 772.778864][T31590] netlink: 'syz.1.6744': attribute type 10 has an invalid length. [ 772.820026][T31583] vlan2: entered allmulticast mode [ 772.871988][T31583] bridge4: entered allmulticast mode [ 772.878970][T31594] bridge4: port 1(erspan0) entered blocking state [ 772.886370][T31594] bridge4: port 1(erspan0) entered disabled state [ 772.894329][T31594] erspan0: entered allmulticast mode [ 772.901822][T31594] erspan0: entered promiscuous mode [ 772.939677][T31594] bridge4: port 1(erspan0) entered blocking state [ 772.946336][T31594] bridge4: port 1(erspan0) entered forwarding state [ 773.071692][T31583] syzkaller0: entered promiscuous mode [ 773.077846][T31583] syzkaller0: entered allmulticast mode [ 775.312566][T31617] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6751'. [ 775.397828][T31622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6752'. [ 775.429555][T31627] netlink: 4552 bytes leftover after parsing attributes in process `syz.0.6754'. [ 775.452585][T31627] netlink: 4552 bytes leftover after parsing attributes in process `syz.0.6754'. [ 775.729150][T31635] netlink: 'syz.4.6756': attribute type 8 has an invalid length. [ 776.298316][T19118] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.308422][T31633] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 777.427445][T31645] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 777.798085][T31665] netlink: 'syz.3.6764': attribute type 8 has an invalid length. [ 777.837112][T31666] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6762'. [ 777.848478][T31666] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6762'. [ 777.984337][T31679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6766'. [ 777.994801][T31680] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.005949][T31679] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.042581][T31680] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.055163][T31680] netlink: 'syz.3.6766': attribute type 15 has an invalid length. [ 778.063645][T31679] netlink: 'syz.3.6766': attribute type 15 has an invalid length. [ 778.092242][T19105] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 778.102223][T31679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.134316][T19118] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 778.144171][T31680] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.147726][T19118] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 778.192926][T31679] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.205029][T31680] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6766'. [ 778.216070][T31679] netlink: 'syz.3.6766': attribute type 15 has an invalid length. [ 778.224629][T31680] netlink: 'syz.3.6766': attribute type 15 has an invalid length. [ 778.313749][T19118] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 779.270720][T31749] netlink: 'syz.2.6787': attribute type 11 has an invalid length. [ 779.323046][T31749] netlink: 'syz.2.6787': attribute type 64 has an invalid length. [ 779.459801][T31755] nbd: must specify an index to disconnect [ 779.471361][T31759] netlink: 'syz.1.6789': attribute type 1 has an invalid length. [ 779.492535][ T1727] block nbd1: Possible stuck request ffff8880268e8000: control (read@0,1024B). Runtime 210 seconds [ 779.505279][ T1727] block nbd1: Possible stuck request ffff8880268e8200: control (read@1024,1024B). Runtime 210 seconds [ 779.516540][ T1727] block nbd1: Possible stuck request ffff8880268e8400: control (read@2048,1024B). Runtime 210 seconds [ 779.527834][ T1727] block nbd1: Possible stuck request ffff8880268e8600: control (read@3072,1024B). Runtime 210 seconds [ 779.540586][T31760] netlink: 'syz.1.6789': attribute type 1 has an invalid length. [ 779.603705][T31759] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 779.608599][T31760] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 779.800658][T31778] netlink: 'syz.0.6793': attribute type 1 has an invalid length. [ 780.098524][T31798] xfrm1: entered promiscuous mode [ 780.106346][T31798] xfrm1: entered allmulticast mode [ 780.859320][T31844] hsr_slave_0: left promiscuous mode [ 780.894618][T31844] hsr_slave_1: left promiscuous mode [ 781.096632][T31863] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 781.423612][T19119] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.455760][T31877] syzkaller0: entered promiscuous mode [ 781.461388][T31877] syzkaller0: entered allmulticast mode [ 782.211465][T31908] validate_nla: 1 callbacks suppressed [ 782.211490][T31908] netlink: 'syz.2.6824': attribute type 1 has an invalid length. [ 783.929802][T31887] geneve2: entered promiscuous mode [ 783.952834][T31908] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 784.335243][T31937] tipc: Started in network mode [ 784.353921][T31937] tipc: Node identity 080211000001, cluster identity 4711 [ 784.383868][T31937] tipc: Enabled bearer , priority 0 [ 784.397014][T31940] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 784.554201][T31955] __nla_validate_parse: 12 callbacks suppressed [ 784.554223][T31955] netlink: 144 bytes leftover after parsing attributes in process `syz.4.6838'. [ 784.785560][T31971] netlink: 'syz.2.6841': attribute type 2 has an invalid length. [ 784.812059][T31971] netlink: 'syz.2.6841': attribute type 1 has an invalid length. [ 784.892684][T31975] netlink: 'syz.4.6843': attribute type 2 has an invalid length. [ 784.934255][T31975] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6843'. [ 784.972321][T31975] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6843'. [ 784.997497][T31980] syzkaller0: entered promiscuous mode [ 785.003135][T31980] syzkaller0: entered allmulticast mode [ 785.017138][T31981] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6844'. [ 785.027496][T31981] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6844'. [ 785.041628][T31980] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6844'. [ 785.055074][T31980] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6844'. [ 785.088475][T31987] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6847'. [ 785.113329][T31984] netlink: 'syz.2.6846': attribute type 1 has an invalid length. [ 785.149164][T31990] netlink: 512 bytes leftover after parsing attributes in process `syz.1.6848'. [ 785.230947][T31990] netlink: 'syz.1.6848': attribute type 25 has an invalid length. [ 785.289936][T31991] bond6: Unable to set down delay as MII monitoring is disabled [ 785.324528][T32001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6851'. [ 785.350122][T31991] bond6 (unregistering): Released all slaves [ 785.416853][ T5929] tipc: Node number set to 134418688 [ 785.549368][T32006] bond2: entered promiscuous mode [ 785.558982][T32006] bond2: entered allmulticast mode [ 785.567401][T32006] 8021q: adding VLAN 0 to HW filter on device bond2 [ 786.399163][T32063] netlink: 'syz.4.6867': attribute type 2 has an invalid length. [ 786.535238][T19109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.818322][T32083] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:20000 [ 787.375934][T32114] x_tables: duplicate underflow at hook 1 [ 787.690359][T32132] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 787.840244][T32146] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 787.992170][T32153] netlink: 'syz.0.6892': attribute type 1 has an invalid length. [ 788.044440][T32157] netlink: 'syz.4.6893': attribute type 5 has an invalid length. [ 788.888188][T32204] ip6gretap1: entered promiscuous mode [ 788.896321][T32204] ip6gretap1: entered allmulticast mode [ 789.410942][T32238] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 789.612440][T32245] __nla_validate_parse: 46 callbacks suppressed [ 789.612463][T32245] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6919'. [ 789.660938][T32247] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6919'. [ 789.679552][T32241] erspan0: mtu less than device minimum [ 789.726498][T32255] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.6920'. [ 789.732834][T32249] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6917'. [ 790.021713][T32272] x_tables: duplicate underflow at hook 1 [ 790.224636][T32282] ieee802154 phy1 wpan1: encryption failed: -22 [ 790.294861][T32287] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6928'. [ 790.305527][T32287] netlink: 'syz.0.6928': attribute type 1 has an invalid length. [ 790.313520][T32287] netlink: 2108 bytes leftover after parsing attributes in process `syz.0.6928'. [ 790.716501][T32299] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 790.756972][T32299] xt_l2tp: invalid flags combination: 8 [ 790.848391][T32302] syzkaller1: entered promiscuous mode [ 790.857605][T32302] syzkaller1: entered allmulticast mode [ 791.029293][T32308] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6932'. [ 791.039109][T32308] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6932'. [ 791.063288][T32308] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 791.184829][T32314] netlink: 'syz.3.6933': attribute type 12 has an invalid length. [ 791.198102][T32312] sctp: [Deprecated]: syz.0.6935 (pid 32312) Use of struct sctp_assoc_value in delayed_ack socket option. [ 791.198102][T32312] Use struct sctp_sack_info instead [ 791.236603][T32314] bond3: option primary_reselect: invalid value (255) [ 791.246651][T32314] bond3 (unregistering): Released all slaves [ 791.461635][T32328] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6937'. [ 791.610858][T32334] syzkaller0: entered promiscuous mode [ 791.639062][T32334] syzkaller0: entered allmulticast mode [ 791.672535][T32332] tipc: Resetting bearer [ 791.704120][T32304] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 791.712792][T32304] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 791.948810][T32347] lo: entered promiscuous mode [ 791.958673][T32347] netlink: 'syz.1.6945': attribute type 2 has an invalid length. [ 791.968609][T32350] netlink: 'syz.4.6946': attribute type 1 has an invalid length. [ 791.984324][T32347] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 792.081168][T32354] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6946'. [ 792.182012][T32353] bond3: (slave geneve2): making interface the new active one [ 792.190848][T32353] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 792.294316][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.313911][T32354] 8021q: adding VLAN 0 to HW filter on device bond3 [ 792.342334][T19119] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 792.460687][T19119] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 792.491379][T19119] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 792.538180][T32370] delete_channel: no stack [ 792.558247][T19118] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 792.568930][T32374] lo: entered promiscuous mode [ 792.575791][T32374] tunl0: entered promiscuous mode [ 792.585123][T32374] gre0: entered promiscuous mode [ 792.629418][T32374] gretap0: entered promiscuous mode [ 792.655353][T32374] erspan0: entered promiscuous mode [ 792.682802][T32374] ip_vti0: entered promiscuous mode [ 792.944634][T32380] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.093856][T32389] netlink: 'syz.0.6956': attribute type 4 has an invalid length. [ 793.127470][T32389] netlink: 'syz.0.6956': attribute type 4 has an invalid length. [ 793.213813][T32372] lec:lec_atm_send: lec0: Unknown message type 36 [ 793.234049][T32371] lec:lec_atm_close: lec0: Shut down! [ 793.314330][T32404] block nbd0: NBD_DISCONNECT [ 793.509166][T32410] netlink: 'syz.3.6962': attribute type 8 has an invalid length. [ 793.594388][T32416] netlink: 'syz.3.6963': attribute type 1 has an invalid length. [ 793.664501][T32418] bond4: option miimon: invalid value (18446744073709551585) [ 793.674768][T32418] bond4: option miimon: allowed values 0 - 2147483647 [ 793.687662][T32418] bond4 (unregistering): Released all slaves [ 793.788880][T32425] FAULT_INJECTION: forcing a failure. [ 793.788880][T32425] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 793.802456][T32425] CPU: 1 UID: 0 PID: 32425 Comm: syz.3.6966 Not tainted syzkaller #0 PREEMPT(full) [ 793.802486][T32425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 793.802502][T32425] Call Trace: [ 793.802512][T32425] [ 793.802522][T32425] dump_stack_lvl+0xe8/0x150 [ 793.802560][T32425] should_fail_ex+0x412/0x560 [ 793.802598][T32425] _copy_from_user+0x2d/0xb0 [ 793.802625][T32425] ___sys_sendmsg+0x1c6/0x360 [ 793.802660][T32425] ? __pfx____sys_sendmsg+0x10/0x10 [ 793.802726][T32425] ? __fget_files+0x2a/0x420 [ 793.802758][T32425] ? __fget_files+0x3a0/0x420 [ 793.802803][T32425] __x64_sys_sendmsg+0x1bd/0x2a0 [ 793.802834][T32425] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 793.802871][T32425] ? __pfx_ksys_write+0x10/0x10 [ 793.802908][T32425] do_syscall_64+0x14d/0xf80 [ 793.802935][T32425] ? trace_irq_disable+0x3b/0x150 [ 793.802954][T32425] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.802976][T32425] ? clear_bhb_loop+0x40/0x90 [ 793.803003][T32425] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.803024][T32425] RIP: 0033:0x7eff1d19c819 [ 793.803044][T32425] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.803064][T32425] RSP: 002b:00007eff1dfa8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 793.803086][T32425] RAX: ffffffffffffffda RBX: 00007eff1d415fa0 RCX: 00007eff1d19c819 [ 793.803102][T32425] RDX: 0000000000002014 RSI: 0000200000000000 RDI: 0000000000000003 [ 793.803116][T32425] RBP: 00007eff1dfa8090 R08: 0000000000000000 R09: 0000000000000000 [ 793.803129][T32425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 793.803143][T32425] R13: 00007eff1d416038 R14: 00007eff1d415fa0 R15: 00007fff1b0251b8 [ 793.803178][T32425] [ 794.296533][T32445] bridge0: port 2(bridge_slave_1) entered disabled state [ 794.305409][T32445] bridge0: port 1(bridge_slave_0) entered disabled state [ 794.442748][T32453] x_tables: unsorted entry at hook 1 [ 794.644262][T32465] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 794.751591][T32473] __nla_validate_parse: 7 callbacks suppressed [ 794.751613][T32473] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6985'. [ 794.773932][T32473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6985'. [ 794.785309][T32473] netlink: 'syz.0.6985': attribute type 12 has an invalid length. [ 794.793689][T32473] netlink: 'syz.0.6985': attribute type 11 has an invalid length. [ 794.806587][T32474] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6985'. [ 795.181281][T32492] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6992'. [ 795.398060][T32503] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6995'. [ 795.422807][T32506] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6996'. [ 795.648330][T32511] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6998'. [ 795.980556][T32523] netlink: 'syz.1.7002': attribute type 4 has an invalid length. [ 796.253824][T32529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7003'. [ 796.312156][T32532] netlink: 'syz.2.7005': attribute type 1 has an invalid length. [ 796.723356][T32551] 8021q: VLANs not supported on lo [ 796.877370][T32563] netlink: 'syz.4.7015': attribute type 1 has an invalid length. [ 796.987113][T32563] 8021q: adding VLAN 0 to HW filter on device bond4 [ 797.009432][T32574] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7019'. [ 797.024825][T32572] bond4: (slave geneve3): making interface the new active one [ 797.036682][T32572] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 797.078407][T32574] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7019'. [ 797.170252][T32577] mac80211_hwsim hwsim75 syzkaller0: left promiscuous mode [ 797.201640][T32577] mac80211_hwsim hwsim75 syzkaller0: left allmulticast mode [ 797.626808][T32604] syzkaller0: entered promiscuous mode [ 797.642839][T32604] syzkaller0: entered allmulticast mode [ 797.918216][T32618] netlink: 'syz.2.7034': attribute type 10 has an invalid length. [ 797.935579][T32618] bridge0: port 2(bridge_slave_1) entered disabled state [ 797.943429][T32618] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.055051][T19123] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.086538][T32618] bridge0: port 2(bridge_slave_1) entered blocking state [ 798.094012][T32618] bridge0: port 2(bridge_slave_1) entered forwarding state [ 798.101647][T32618] bridge0: port 1(bridge_slave_0) entered blocking state [ 798.108997][T32618] bridge0: port 1(bridge_slave_0) entered forwarding state [ 798.148249][T32618] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 798.242295][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 798.250401][ C1] lec:lec_tx_timeout: lec0 [ 798.405763][T32631] bridge0: port 2(bridge_slave_1) entered disabled state [ 798.413124][T32631] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.638800][T32646] FAULT_INJECTION: forcing a failure. [ 798.638800][T32646] name failslab, interval 1, probability 0, space 0, times 0 [ 798.670647][T32646] CPU: 0 UID: 0 PID: 32646 Comm: syz.3.7043 Not tainted syzkaller #0 PREEMPT(full) [ 798.670678][T32646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 798.670692][T32646] Call Trace: [ 798.670701][T32646] [ 798.670711][T32646] dump_stack_lvl+0xe8/0x150 [ 798.670747][T32646] should_fail_ex+0x412/0x560 [ 798.670787][T32646] should_failslab+0xa8/0x100 [ 798.670816][T32646] ? skb_clone+0x212/0x3a0 [ 798.670844][T32646] kmem_cache_alloc_noprof+0x87/0x650 [ 798.670867][T32646] ? __netlink_lookup+0xc6/0x8b0 [ 798.670919][T32646] skb_clone+0x212/0x3a0 [ 798.670950][T32646] __netlink_deliver_tap+0x404/0x850 [ 798.670997][T32646] ? netlink_deliver_tap+0x2e/0x1b0 [ 798.671034][T32646] netlink_deliver_tap+0x19c/0x1b0 [ 798.671070][T32646] netlink_unicast+0x7e3/0x9b0 [ 798.671112][T32646] ? __pfx_netlink_unicast+0x10/0x10 [ 798.671145][T32646] ? netlink_sendmsg+0x650/0xb40 [ 798.671164][T32646] ? skb_put+0x11b/0x210 [ 798.671190][T32646] netlink_sendmsg+0x813/0xb40 [ 798.671222][T32646] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.671248][T32646] ? aa_sock_msg_perm+0xf1/0x1b0 [ 798.671282][T32646] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 798.671313][T32646] ____sys_sendmsg+0x972/0x9f0 [ 798.671350][T32646] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.671386][T32646] ? import_iovec+0x73/0xa0 [ 798.671415][T32646] ___sys_sendmsg+0x2a5/0x360 [ 798.671448][T32646] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.671515][T32646] ? __fget_files+0x2a/0x420 [ 798.671547][T32646] ? __fget_files+0x3a0/0x420 [ 798.671593][T32646] __x64_sys_sendmsg+0x1bd/0x2a0 [ 798.671623][T32646] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 798.671662][T32646] ? __pfx_ksys_write+0x10/0x10 [ 798.671701][T32646] do_syscall_64+0x14d/0xf80 [ 798.671727][T32646] ? trace_irq_disable+0x3b/0x150 [ 798.671747][T32646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.671769][T32646] ? clear_bhb_loop+0x40/0x90 [ 798.671797][T32646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.671824][T32646] RIP: 0033:0x7eff1d19c819 [ 798.671844][T32646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 798.671863][T32646] RSP: 002b:00007eff1dfa8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 798.671892][T32646] RAX: ffffffffffffffda RBX: 00007eff1d415fa0 RCX: 00007eff1d19c819 [ 798.671909][T32646] RDX: 0000000000002014 RSI: 0000200000000000 RDI: 0000000000000003 [ 798.671922][T32646] RBP: 00007eff1dfa8090 R08: 0000000000000000 R09: 0000000000000000 [ 798.671936][T32646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 798.671948][T32646] R13: 00007eff1d416038 R14: 00007eff1d415fa0 R15: 00007fff1b0251b8 [ 798.671982][T32646] [ 799.004198][T32657] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 799.705253][T32688] netlink: zone id is out of range [ 799.710636][T32688] netlink: zone id is out of range [ 799.719164][T32688] netlink: zone id is out of range [ 799.724902][T32688] netlink: zone id is out of range [ 799.730207][T32688] netlink: zone id is out of range [ 799.736172][T32688] netlink: zone id is out of range [ 799.741517][T32688] netlink: zone id is out of range [ 799.747627][T32688] netlink: zone id is out of range [ 799.755978][T32688] __nla_validate_parse: 7 callbacks suppressed [ 799.755999][T32688] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7058'. [ 799.772741][T32688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7058'. [ 802.058072][T32661] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 802.320643][T32713] pim6reg1: entered promiscuous mode [ 802.340403][T32713] pim6reg1: entered allmulticast mode [ 802.468695][T32727] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7068'. [ 802.683369][T32745] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.7074'. [ 802.861681][T32761] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7075'. [ 803.123906][ T313] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7085'. [ 803.244180][ T321] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7087'. [ 803.395474][ T330] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7091'. [ 803.409461][ T330] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7091'. [ 803.594327][ T338] bond0: option arp_validate: invalid value (55553) [ 803.649593][ T340] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input5 [ 803.719537][ T344] netlink: 164 bytes leftover after parsing attributes in process `syz.0.7098'. [ 803.731573][ T344] net_ratelimit: 702 callbacks suppressed [ 803.731596][ T344] openvswitch: netlink: Flow key attr not present in new flow. [ 803.816327][T19123] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.072938][ T366] team0: Device gtp0 is up. Set it down before adding it as a team port [ 804.231664][ T379] netlink: 'syz.2.7106': attribute type 1 has an invalid length. [ 804.383649][ T389] netlink: 'syz.3.7109': attribute type 5 has an invalid length. [ 804.661425][ T410] FAULT_INJECTION: forcing a failure. [ 804.661425][ T410] name failslab, interval 1, probability 0, space 0, times 0 [ 804.675103][ T410] CPU: 1 UID: 0 PID: 410 Comm: syz.1.7115 Not tainted syzkaller #0 PREEMPT(full) [ 804.675132][ T410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 804.675146][ T410] Call Trace: [ 804.675155][ T410] [ 804.675165][ T410] dump_stack_lvl+0xe8/0x150 [ 804.675209][ T410] should_fail_ex+0x412/0x560 [ 804.675248][ T410] should_failslab+0xa8/0x100 [ 804.675279][ T410] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 804.675306][ T410] ? __alloc_skb+0x1d0/0x7d0 [ 804.675327][ T410] ? __local_bh_enable_ip+0xd0/0x130 [ 804.675361][ T410] __alloc_skb+0x1d0/0x7d0 [ 804.675390][ T410] xfrm_alloc_compat+0x1a6/0x16f0 [ 804.675430][ T410] ? xfrm_get_translator+0x1b/0x240 [ 804.675467][ T410] dump_one_state+0x2c8/0x440 [ 804.675505][ T410] xfrm_state_walk+0x295/0xa60 [ 804.675540][ T410] ? __pfx_dump_one_state+0x10/0x10 [ 804.675578][ T410] xfrm_dump_sa+0x1f7/0x5e0 [ 804.675634][ T410] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 804.675720][ T410] ? __alloc_skb+0x4e5/0x7d0 [ 804.675748][ T410] netlink_dump+0x722/0xe80 [ 804.675796][ T410] ? __pfx_netlink_dump+0x10/0x10 [ 804.675827][ T410] ? __netlink_lookup+0x7e4/0x8b0 [ 804.675869][ T410] ? netlink_lookup+0x30/0x200 [ 804.675901][ T410] ? netlink_lookup+0x30/0x200 [ 804.675930][ T410] ? netlink_lookup+0x30/0x200 [ 804.675970][ T410] __netlink_dump_start+0x5cb/0x7e0 [ 804.676064][ T410] xfrm_user_rcv_msg+0x951/0xc40 [ 804.676104][ T410] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 804.676177][ T410] ? __pfx___mutex_trylock_common+0x10/0x10 [ 804.676222][ T410] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 804.676250][ T410] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 804.676283][ T410] ? trace_contention_end+0x3d/0x150 [ 804.676319][ T410] ? __mutex_lock+0x319/0x1300 [ 804.676355][ T410] netlink_rcv_skb+0x232/0x4b0 [ 804.676391][ T410] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 804.676425][ T410] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 804.676477][ T410] ? netlink_deliver_tap+0x2e/0x1b0 [ 804.676511][ T410] ? netlink_deliver_tap+0x2e/0x1b0 [ 804.676548][ T410] xfrm_netlink_rcv+0x79/0x90 [ 804.676579][ T410] netlink_unicast+0x80f/0x9b0 [ 804.676621][ T410] ? __pfx_netlink_unicast+0x10/0x10 [ 804.676655][ T410] ? netlink_sendmsg+0x650/0xb40 [ 804.676675][ T410] ? skb_put+0x11b/0x210 [ 804.676703][ T410] netlink_sendmsg+0x813/0xb40 [ 804.676737][ T410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 804.676763][ T410] ? aa_sock_msg_perm+0xf1/0x1b0 [ 804.676798][ T410] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 804.676827][ T410] ____sys_sendmsg+0x972/0x9f0 [ 804.676864][ T410] ? __pfx_____sys_sendmsg+0x10/0x10 [ 804.676901][ T410] ? import_iovec+0x73/0xa0 [ 804.676930][ T410] ___sys_sendmsg+0x2a5/0x360 [ 804.676964][ T410] ? __pfx____sys_sendmsg+0x10/0x10 [ 804.677035][ T410] ? __fget_files+0x2a/0x420 [ 804.677067][ T410] ? __fget_files+0x3a0/0x420 [ 804.677112][ T410] __x64_sys_sendmsg+0x1bd/0x2a0 [ 804.677144][ T410] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 804.677182][ T410] ? __pfx_ksys_write+0x10/0x10 [ 804.677228][ T410] do_syscall_64+0x14d/0xf80 [ 804.677255][ T410] ? trace_irq_disable+0x3b/0x150 [ 804.677274][ T410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.677297][ T410] ? clear_bhb_loop+0x40/0x90 [ 804.677325][ T410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.677348][ T410] RIP: 0033:0x7f716c99c819 [ 804.677370][ T410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.677390][ T410] RSP: 002b:00007f716d7bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 804.677414][ T410] RAX: ffffffffffffffda RBX: 00007f716cc15fa0 RCX: 00007f716c99c819 [ 804.677430][ T410] RDX: 0000000000002014 RSI: 0000200000000000 RDI: 0000000000000003 [ 804.677444][ T410] RBP: 00007f716d7bc090 R08: 0000000000000000 R09: 0000000000000000 [ 804.677458][ T410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 804.677472][ T410] R13: 00007f716cc16038 R14: 00007f716cc15fa0 R15: 00007fffdb317c18 [ 804.677509][ T410] [ 805.559075][ T441] __nla_validate_parse: 5 callbacks suppressed [ 805.559109][ T441] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.7124'. [ 805.616524][ T439] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7125'. [ 805.657893][ T441] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 805.754524][ T454] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7129'. [ 805.794186][ T459] xt_HMARK: spi-set and port-set can't be combined [ 805.889206][ T464] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 806.021664][ T466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7132'. [ 806.036526][ T466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7132'. [ 806.054114][ T466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7132'. [ 806.105864][ T470] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7134'. [ 806.176564][ T470] bond5: entered promiscuous mode [ 806.184010][ T470] 8021q: adding VLAN 0 to HW filter on device bond5 [ 806.232989][ T471] bridge6: entered promiscuous mode [ 806.239123][ T471] bond5: (slave bridge6): Enslaving as an active interface with an up link [ 806.348165][ T480] bridge7: entered promiscuous mode [ 806.384625][ T480] bond5: (slave bridge7): Enslaving as an active interface with an up link [ 806.563885][ T499] netlink: 172 bytes leftover after parsing attributes in process `syz.3.7138'. [ 806.769337][ T508] veth0_to_bridge: default FDB implementation only supports local addresses [ 806.840690][ T503] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7140'. [ 806.858055][ T509] syzkaller1: entered promiscuous mode [ 806.882165][ T509] syzkaller1: entered allmulticast mode [ 806.907385][ T509] netlink: 216 bytes leftover after parsing attributes in process `syz.3.7142'. [ 806.908951][ T6692] lec:lec_start_xmit: lec0:No lecd attached [ 806.945607][ T514] syzkaller0: entered promiscuous mode [ 806.951272][ T514] syzkaller0: entered allmulticast mode [ 806.963603][ T514] syzkaller0: left promiscuous mode [ 806.971091][ T514] syzkaller0: left allmulticast mode [ 807.013692][ T518] block nbd2: reconnected socket [ 807.026048][ T518] block nbd2: reconnected socket [ 807.033144][ T5835] block nbd2: Receive control failed (result -32) [ 807.044753][ T5837] block nbd2: Receive control failed (result -32) [ 807.705084][ T556] netlink: 'syz.4.7156': attribute type 21 has an invalid length. [ 808.726592][ T576] netlink: 'syz.4.7160': attribute type 22 has an invalid length. [ 808.726596][ T575] netlink: 'syz.4.7160': attribute type 22 has an invalid length. [ 808.746912][ T576] netlink: 'syz.4.7160': attribute type 22 has an invalid length. [ 808.747131][ T575] netlink: 'syz.4.7160': attribute type 22 has an invalid length. [ 808.761681][T19119] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 808.771763][T19119] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 808.787553][T19119] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 808.796865][T19119] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 808.935838][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.573407][T19123] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.573542][ T1727] block nbd1: Possible stuck request ffff8880268e8000: control (read@0,1024B). Runtime 240 seconds [ 809.592665][ T1727] block nbd1: Possible stuck request ffff8880268e8200: control (read@1024,1024B). Runtime 240 seconds [ 809.605108][ T1727] block nbd1: Possible stuck request ffff8880268e8400: control (read@2048,1024B). Runtime 240 seconds [ 809.617626][ T1727] block nbd1: Possible stuck request ffff8880268e8600: control (read@3072,1024B). Runtime 240 seconds [ 810.075420][ T520] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 810.364048][ T588] netlink: 'syz.0.7165': attribute type 29 has an invalid length. [ 810.373491][ T594] netlink: 'syz.0.7165': attribute type 29 has an invalid length. [ 810.405303][ T588] netlink: 'syz.0.7165': attribute type 32 has an invalid length. [ 810.821608][ T618] __nla_validate_parse: 9 callbacks suppressed [ 810.821632][ T618] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7173'. [ 810.840942][ T618] syzkaller0: entered promiscuous mode [ 810.873187][ T612] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 810.873286][ T618] syzkaller0: entered allmulticast mode [ 811.100172][ T628] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7174'. [ 811.246469][ T634] pim6reg: entered allmulticast mode [ 811.298486][ T635] pim6reg: left allmulticast mode [ 811.359310][ T642] IPVS: stopping backup sync thread 30923 ... [ 811.512214][ T654] bpq0: left promiscuous mode [ 811.533089][ T657] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 811.570793][ T642] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7180'. [ 811.609868][ T662] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7184'. [ 811.725819][ T671] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7186'. [ 811.798681][ T671] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7186'. [ 811.831035][ T679] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 811.843830][ T677] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7187'. [ 811.891521][ T686] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7189'. [ 811.911034][ T686] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7189'. [ 811.964758][ T686] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 812.131894][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5210 ms [ 812.140071][ C1] lec:lec_tx_timeout: lec0 [ 812.144853][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 812.254690][ T706] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7195'. [ 812.473525][ T712] netlink: 'syz.3.7197': attribute type 4 has an invalid length. [ 812.598309][ T714] sock: sock_timestamping_bind_phc: sock not bind to device [ 812.865806][ T717] 8021q: adding VLAN 0 to HW filter on device bond6 [ 812.961694][ T724] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 812.982352][ T724] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 812.990709][ T724] gretap2: entered promiscuous mode [ 813.010578][ T724] gretap2: entered allmulticast mode [ 813.274628][ T744] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 814.797856][ T678] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 815.026518][ T754] pim6reg: entered allmulticast mode [ 815.153529][ T761] x_tables: duplicate underflow at hook 2 [ 815.301563][ T772] netlink: 'syz.0.7215': attribute type 1 has an invalid length. [ 815.333144][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.395705][ T779] mac80211_hwsim hwsim75 syzkaller0: entered promiscuous mode [ 815.403613][ T779] mac80211_hwsim hwsim75 syzkaller0: entered allmulticast mode [ 815.694131][ T805] ieee802154 phy1 wpan1: encryption failed: -22 [ 815.733093][ T807] netlink: 'syz.2.7225': attribute type 4 has an invalid length. [ 815.907679][ T818] __nla_validate_parse: 7 callbacks suppressed [ 815.907703][ T818] netlink: 808 bytes leftover after parsing attributes in process `syz.2.7229'. [ 815.982466][ T823] syzkaller0: entered promiscuous mode [ 815.988013][ T823] syzkaller0: entered allmulticast mode [ 816.142646][ T832] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7233'. [ 816.477898][ T855] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7241'. [ 816.516792][ T856] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7241'. [ 816.692977][ T867] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 816.746610][ T872] netlink: 'syz.2.7246': attribute type 1 has an invalid length. [ 816.897038][ T884] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7249'. [ 816.908621][ T885] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7250'. [ 816.924247][ T884] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 817.151888][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 817.160051][ C1] lec:lec_tx_timeout: lec0 [ 817.170389][ T900] netlink: 'syz.1.7254': attribute type 11 has an invalid length. [ 817.195099][ T900] netlink: 199828 bytes leftover after parsing attributes in process `syz.1.7254'. [ 817.332322][ T905] netlink: 'syz.0.7256': attribute type 10 has an invalid length. [ 817.359004][ T905] team0: Port device dummy0 added [ 817.458131][ T903] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7255'. [ 817.531486][ T913] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7259'. [ 817.629033][ T920] lo: Caught tx_queue_len zero misconfig [ 817.773081][ T925] geneve2: entered promiscuous mode [ 817.999009][ T954] netlink: 'syz.2.7269': attribute type 12 has an invalid length. [ 818.014744][ T955] netlink: 'syz.4.7267': attribute type 1 has an invalid length. [ 818.023228][ T954] netlink: 'syz.2.7269': attribute type 29 has an invalid length. [ 818.034140][ T942] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7266'. [ 818.571754][ T973] netlink: 'syz.2.7273': attribute type 62 has an invalid length. [ 819.673356][ T992] openvswitch: netlink: Flow key attr not present in new flow. [ 820.629863][ T146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.906845][ T1028] sock: sock_set_timeout: `syz.1.7291' (pid 1028) tries to set negative timeout [ 821.464116][ T1042] __nla_validate_parse: 7 callbacks suppressed [ 821.464139][ T1042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7293'. [ 821.538042][ T1055] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7295'. [ 821.864353][ T1060] tipc: Enabling of bearer rejected, already enabled [ 821.945901][ T1076] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7299'. [ 822.032871][ T1074] netlink: 'syz.0.7299': attribute type 2 has an invalid length. [ 822.480063][ T1092] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7304'. [ 823.454079][ T1125] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7311'. [ 823.624439][ T1128] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7312'. [ 823.837657][ C0] sched: DL replenish lagged too much [ 824.126721][ T1136] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7314'. [ 824.515576][ T1141] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 824.525654][ T1141] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 826.097575][ T1146] netlink: 61 bytes leftover after parsing attributes in process `syz.1.7317'. [ 826.213818][T19109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 828.000249][ T1171] netlink: 190972 bytes leftover after parsing attributes in process `syz.1.7321'. [ 828.517245][ T1182] netlink: 160 bytes leftover after parsing attributes in process `syz.3.7325'. [ 828.723664][ T1188] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7326'. [ 828.796504][ T1195] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7327'. [ 828.882703][ T1196] batman_adv: batadv0: adding TT local entry ba:ba:05:00:07:00 to non-existent VLAN 1280 [ 828.900791][ T1201] netlink: 256 bytes leftover after parsing attributes in process `syz.3.7329'. [ 828.912685][ T1200] netlink: 44 bytes leftover after parsing attributes in process `syz.0.7327'. [ 830.104361][ T1228] netlink: 'syz.4.7337': attribute type 1 has an invalid length. [ 830.256394][ T1233] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7338'. [ 830.437626][ T1243] netlink: 48 bytes leftover after parsing attributes in process `syz.0.7338'. [ 830.535199][ T1246] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7342'. [ 830.834142][ T1253] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7344'. [ 831.685988][ T1277] netlink: 'syz.1.7352': attribute type 19 has an invalid length. [ 831.722751][ T1277] netlink: 'syz.1.7352': attribute type 19 has an invalid length. [ 831.811749][ T1282] netlink: 'syz.3.7353': attribute type 7 has an invalid length. [ 831.831227][ T1282] netlink: 'syz.3.7353': attribute type 8 has an invalid length. [ 832.228664][ T1287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 833.480430][ T1332] netlink: 'syz.0.7364': attribute type 11 has an invalid length. [ 833.537876][ T1332] netlink: 'syz.0.7364': attribute type 11 has an invalid length. [ 833.589848][ T1332] __nla_validate_parse: 5 callbacks suppressed [ 833.589872][ T1332] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7364'. [ 834.072469][ T1353] netlink: 45 bytes leftover after parsing attributes in process `syz.1.7368'. [ 834.483184][ T1361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7371'. [ 834.610381][ T1366] netlink: 'syz.1.7371': attribute type 21 has an invalid length. [ 834.658128][ T1366] IPv6: NLM_F_CREATE should be specified when creating new route [ 834.692617][ T1366] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 834.699962][ T1366] IPv6: NLM_F_CREATE should be set when creating new route [ 834.707435][ T1366] IPv6: NLM_F_CREATE should be set when creating new route [ 834.714749][ T1366] IPv6: NLM_F_CREATE should be set when creating new route [ 835.430669][ T1384] block nbd0: not configured, cannot reconfigure [ 835.478346][ T1384] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7374'. [ 836.617989][ T5835] Bluetooth: hci3: command 0x0406 tx timeout [ 836.662517][ T5837] [ 836.664912][ T5837] ====================================================== [ 836.671968][ T5837] WARNING: possible circular locking dependency detected [ 836.679027][ T5837] syzkaller #0 Not tainted [ 836.683478][ T5837] ------------------------------------------------------ [ 836.690525][ T5837] kworker/u9:3/5837 is trying to acquire lock: [ 836.696704][ T5837] ffff88801b6dda20 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x71/0x180 [ 836.707287][ T5837] [ 836.707287][ T5837] but task is already holding lock: [ 836.714688][ T5837] ffff88801b6dd988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 836.725010][ T5837] [ 836.725010][ T5837] which lock already depends on the new lock. [ 836.725010][ T5837] [ 836.735630][ T5837] [ 836.735630][ T5837] the existing dependency chain (in reverse order) is: [ 836.744678][ T5837] [ 836.744678][ T5837] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 836.752732][ T5837] down_write+0x96/0x200 [ 836.757549][ T5837] kernfs_add_one+0x41/0x5c0 [ 836.762716][ T5837] kernfs_create_dir_ns+0xde/0x130 [ 836.768408][ T5837] internal_create_group+0x425/0x1180 [ 836.774445][ T5837] cpuhp_invoke_callback+0x445/0x860 [ 836.780404][ T5837] cpuhp_issue_call+0x430/0x7a0 [ 836.785826][ T5837] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 836.792493][ T5837] __cpuhp_setup_state+0x3f/0x60 [ 836.798110][ T5837] do_one_initcall+0x250/0x8d0 [ 836.803498][ T5837] do_initcall_level+0x104/0x190 [ 836.809020][ T5837] do_initcalls+0x59/0xa0 [ 836.813964][ T5837] kernel_init_freeable+0x2a6/0x3e0 [ 836.819767][ T5837] kernel_init+0x1d/0x1d0 [ 836.824672][ T5837] ret_from_fork+0x51e/0xb90 [ 836.829916][ T5837] ret_from_fork_asm+0x1a/0x30 [ 836.835261][ T5837] [ 836.835261][ T5837] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 836.843211][ T5837] [ 836.843211][ T5837] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 836.850999][ T5837] cpus_read_lock+0x42/0x160 [ 836.856187][ T5837] static_key_slow_inc+0x12/0x30 [ 836.861705][ T5837] nbd_genl_reconfigure+0x132f/0x1ea0 [ 836.867648][ T5837] genl_family_rcv_msg_doit+0x22a/0x330 [ 836.873765][ T5837] genl_rcv_msg+0x61c/0x7a0 [ 836.879182][ T5837] netlink_rcv_skb+0x232/0x4b0 [ 836.884518][ T5837] genl_rcv+0x28/0x40 [ 836.889063][ T5837] netlink_unicast+0x80f/0x9b0 [ 836.894397][ T5837] netlink_sendmsg+0x813/0xb40 [ 836.899727][ T5837] ____sys_sendmsg+0x972/0x9f0 [ 836.905092][ T5837] ___sys_sendmsg+0x2a5/0x360 [ 836.910339][ T5837] __x64_sys_sendmsg+0x1bd/0x2a0 [ 836.915836][ T5837] do_syscall_64+0x14d/0xf80 [ 836.920984][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.927454][ T5837] [ 836.927454][ T5837] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 836.935249][ T5837] __mutex_lock+0x19f/0x1300 [ 836.940415][ T5837] nbd_queue_rq+0x37b/0x1100 [ 836.945569][ T5837] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 836.951671][ T5837] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 836.958563][ T5837] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 836.965114][ T5837] blk_mq_run_hw_queue+0x348/0x4f0 [ 836.970784][ T5837] blk_mq_dispatch_list+0xd16/0xe10 [ 836.976605][ T5837] blk_mq_flush_plug_list+0x48d/0x570 [ 836.982561][ T5837] __blk_flush_plug+0x3ed/0x4d0 [ 836.987985][ T5837] __submit_bio+0x28d/0x580 [ 836.993065][ T5837] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 836.999257][ T5837] block_read_full_folio+0x599/0x830 [ 837.005109][ T5837] filemap_read_folio+0x137/0x3b0 [ 837.010700][ T5837] do_read_cache_folio+0x358/0x590 [ 837.016373][ T5837] read_part_sector+0xb6/0x2b0 [ 837.021696][ T5837] adfspart_check_ICS+0xa5/0xa40 [ 837.027197][ T5837] bdev_disk_changed+0x7ba/0x1550 [ 837.032786][ T5837] blkdev_get_whole+0x380/0x510 [ 837.038206][ T5837] bdev_open+0x31e/0xd30 [ 837.043015][ T5837] blkdev_open+0x470/0x610 [ 837.048198][ T5837] do_dentry_open+0x785/0x14e0 [ 837.053614][ T5837] vfs_open+0x3b/0x340 [ 837.058258][ T5837] path_openat+0x2e08/0x3860 [ 837.063421][ T5837] do_file_open+0x23e/0x4a0 [ 837.068487][ T5837] do_sys_openat2+0x113/0x200 [ 837.073728][ T5837] __x64_sys_openat+0x138/0x170 [ 837.079151][ T5837] do_syscall_64+0x14d/0xf80 [ 837.084409][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.090870][ T5837] [ 837.090870][ T5837] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 837.098143][ T5837] __mutex_lock+0x19f/0x1300 [ 837.103303][ T5837] nbd_queue_rq+0xc6/0x1100 [ 837.108375][ T5837] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 837.114488][ T5837] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 837.121385][ T5837] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 837.127942][ T5837] blk_mq_run_hw_queue+0x348/0x4f0 [ 837.133629][ T5837] blk_mq_dispatch_list+0xd16/0xe10 [ 837.139397][ T5837] blk_mq_flush_plug_list+0x48d/0x570 [ 837.145332][ T5837] __blk_flush_plug+0x3ed/0x4d0 [ 837.150747][ T5837] __submit_bio+0x28d/0x580 [ 837.155818][ T5837] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 837.162015][ T5837] block_read_full_folio+0x599/0x830 [ 837.167870][ T5837] filemap_read_folio+0x137/0x3b0 [ 837.173455][ T5837] do_read_cache_folio+0x358/0x590 [ 837.179281][ T5837] read_part_sector+0xb6/0x2b0 [ 837.184615][ T5837] adfspart_check_ICS+0xa5/0xa40 [ 837.190207][ T5837] bdev_disk_changed+0x7ba/0x1550 [ 837.195798][ T5837] blkdev_get_whole+0x380/0x510 [ 837.201213][ T5837] bdev_open+0x31e/0xd30 [ 837.206022][ T5837] blkdev_open+0x470/0x610 [ 837.211003][ T5837] do_dentry_open+0x785/0x14e0 [ 837.216328][ T5837] vfs_open+0x3b/0x340 [ 837.220999][ T5837] path_openat+0x2e08/0x3860 [ 837.226153][ T5837] do_file_open+0x23e/0x4a0 [ 837.231220][ T5837] do_sys_openat2+0x113/0x200 [ 837.236484][ T5837] __x64_sys_openat+0x138/0x170 [ 837.241899][ T5837] do_syscall_64+0x14d/0xf80 [ 837.247054][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.253508][ T5837] [ 837.253508][ T5837] -> #4 (set->srcu){.+.+}-{0:0}: [ 837.260856][ T5837] __synchronize_srcu+0xca/0x300 [ 837.266365][ T5837] elevator_switch+0x1e8/0x7a0 [ 837.271695][ T5837] elevator_change+0x2cc/0x450 [ 837.277054][ T5837] elevator_set_default+0x36c/0x430 [ 837.282906][ T5837] blk_register_queue+0x366/0x430 [ 837.288508][ T5837] __add_disk+0x677/0xd50 [ 837.293413][ T5837] add_disk_fwnode+0xfb/0x480 [ 837.298659][ T5837] nbd_dev_add+0x72c/0xb50 [ 837.303672][ T5837] nbd_init+0x168/0x1f0 [ 837.308397][ T5837] do_one_initcall+0x250/0x8d0 [ 837.313743][ T5837] do_initcall_level+0x104/0x190 [ 837.319248][ T5837] do_initcalls+0x59/0xa0 [ 837.324138][ T5837] kernel_init_freeable+0x2a6/0x3e0 [ 837.329905][ T5837] kernel_init+0x1d/0x1d0 [ 837.334996][ T5837] ret_from_fork+0x51e/0xb90 [ 837.340153][ T5837] ret_from_fork_asm+0x1a/0x30 [ 837.345483][ T5837] [ 837.345483][ T5837] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 837.353351][ T5837] __mutex_lock+0x19f/0x1300 [ 837.358512][ T5837] elevator_change+0x1b3/0x450 [ 837.363839][ T5837] elevator_set_none+0xb5/0x140 [ 837.369337][ T5837] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 837.375708][ T5837] nbd_start_device+0x17f/0xb10 [ 837.381122][ T5837] nbd_genl_connect+0x165b/0x1cf0 [ 837.386870][ T5837] genl_family_rcv_msg_doit+0x22a/0x330 [ 837.392998][ T5837] genl_rcv_msg+0x61c/0x7a0 [ 837.398071][ T5837] netlink_rcv_skb+0x232/0x4b0 [ 837.403409][ T5837] genl_rcv+0x28/0x40 [ 837.407954][ T5837] netlink_unicast+0x80f/0x9b0 [ 837.413300][ T5837] netlink_sendmsg+0x813/0xb40 [ 837.418627][ T5837] ____sys_sendmsg+0x972/0x9f0 [ 837.423954][ T5837] ___sys_sendmsg+0x2a5/0x360 [ 837.429206][ T5837] __x64_sys_sendmsg+0x1bd/0x2a0 [ 837.434702][ T5837] do_syscall_64+0x14d/0xf80 [ 837.439857][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.446313][ T5837] [ 837.446313][ T5837] -> #2 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 837.454979][ T5837] blk_alloc_queue+0x546/0x680 [ 837.460394][ T5837] __blk_mq_alloc_disk+0x197/0x390 [ 837.466070][ T5837] nbd_dev_add+0x499/0xb50 [ 837.471040][ T5837] nbd_init+0x168/0x1f0 [ 837.475763][ T5837] do_one_initcall+0x250/0x8d0 [ 837.481097][ T5837] do_initcall_level+0x104/0x190 [ 837.486599][ T5837] do_initcalls+0x59/0xa0 [ 837.491511][ T5837] kernel_init_freeable+0x2a6/0x3e0 [ 837.497276][ T5837] kernel_init+0x1d/0x1d0 [ 837.502183][ T5837] ret_from_fork+0x51e/0xb90 [ 837.507348][ T5837] ret_from_fork_asm+0x1a/0x30 [ 837.512690][ T5837] [ 837.512690][ T5837] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 837.520009][ T5837] fs_reclaim_acquire+0x71/0x100 [ 837.525523][ T5837] kmem_cache_alloc_noprof+0x40/0x650 [ 837.531472][ T5837] __kernfs_iattrs+0xdf/0x340 [ 837.536725][ T5837] kernfs_iop_setattr+0xea/0x3f0 [ 837.542244][ T5837] notify_change+0xc1a/0xf40 [ 837.547400][ T5837] do_truncate+0x1c2/0x250 [ 837.552384][ T5837] path_openat+0x2f89/0x3860 [ 837.557534][ T5837] do_file_open+0x23e/0x4a0 [ 837.562602][ T5837] do_sys_openat2+0x113/0x200 [ 837.567906][ T5837] __x64_sys_openat+0x138/0x170 [ 837.573343][ T5837] do_syscall_64+0x14d/0xf80 [ 837.578508][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 837.584960][ T5837] [ 837.584960][ T5837] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 837.593701][ T5837] __lock_acquire+0x15a5/0x2cf0 [ 837.599120][ T5837] lock_acquire+0xf0/0x2e0 [ 837.604101][ T5837] down_write+0x96/0x200 [ 837.608937][ T5837] kernfs_unlink_sibling+0x71/0x180 [ 837.614703][ T5837] __kernfs_remove+0x3e7/0x660 [ 837.620122][ T5837] kernfs_remove_by_name_ns+0xaf/0x130 [ 837.626146][ T5837] sysfs_unmerge_group+0xd4/0x140 [ 837.631748][ T5837] dpm_sysfs_remove+0x76/0xd0 [ 837.636996][ T5837] device_del+0x250/0x8f0 [ 837.641890][ T5837] device_unregister+0x21/0xf0 [ 837.647218][ T5837] hci_conn_del+0xc36/0x1230 [ 837.652370][ T5837] hci_abort_conn_sync+0xdd0/0x1190 [ 837.658314][ T5837] hci_cmd_sync_work+0x213/0x400 [ 837.663825][ T5837] process_scheduled_works+0xb6e/0x18c0 [ 837.669937][ T5837] worker_thread+0xa53/0xfc0 [ 837.675089][ T5837] kthread+0x388/0x470 [ 837.679713][ T5837] ret_from_fork+0x51e/0xb90 [ 837.684870][ T5837] ret_from_fork_asm+0x1a/0x30 [ 837.690205][ T5837] [ 837.690205][ T5837] other info that might help us debug this: [ 837.690205][ T5837] [ 837.700456][ T5837] Chain exists of: [ 837.700456][ T5837] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 837.700456][ T5837] [ 837.714938][ T5837] Possible unsafe locking scenario: [ 837.714938][ T5837] [ 837.722418][ T5837] CPU0 CPU1 [ 837.727995][ T5837] ---- ---- [ 837.733384][ T5837] lock(&root->kernfs_rwsem); [ 837.738197][ T5837] lock(cpuhp_state_mutex); [ 837.745351][ T5837] lock(&root->kernfs_rwsem); [ 837.752676][ T5837] lock(&root->kernfs_iattr_rwsem); [ 837.758393][ T5837] [ 837.758393][ T5837] *** DEADLOCK *** [ 837.758393][ T5837] [ 837.766575][ T5837] 5 locks held by kworker/u9:3/5837: [ 837.772066][ T5837] #0: ffff88802b59a148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 837.783214][ T5837] #1: ffffc90003ce7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 837.795902][ T5837] #2: ffff88808b818ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 837.805937][ T5837] #3: ffff88808b8180c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 837.815856][ T5837] #4: ffff88801b6dd988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 837.826725][ T5837] [ 837.826725][ T5837] stack backtrace: [ 837.832665][ T5837] CPU: 1 UID: 0 PID: 5837 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 837.832695][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 837.832711][ T5837] Workqueue: hci3 hci_cmd_sync_work [ 837.832744][ T5837] Call Trace: [ 837.832752][ T5837] [ 837.832764][ T5837] dump_stack_lvl+0xe8/0x150 [ 837.832796][ T5837] print_circular_bug+0x2e1/0x300 [ 837.832833][ T5837] check_noncircular+0x12e/0x150 [ 837.832870][ T5837] __lock_acquire+0x15a5/0x2cf0 [ 837.832902][ T5837] ? __lock_acquire+0x6b5/0x2cf0 [ 837.832937][ T5837] lock_acquire+0xf0/0x2e0 [ 837.832963][ T5837] ? kernfs_unlink_sibling+0x71/0x180 [ 837.832993][ T5837] down_write+0x96/0x200 [ 837.833022][ T5837] ? kernfs_unlink_sibling+0x71/0x180 [ 837.833044][ T5837] ? __pfx_down_write+0x10/0x10 [ 837.833072][ T5837] ? kernfs_root+0x1c/0x230 [ 837.833102][ T5837] ? kernfs_root+0x1c/0x230 [ 837.833137][ T5837] ? kernfs_root+0x1c/0x230 [ 837.833167][ T5837] ? kernfs_root+0x1ea/0x230 [ 837.833198][ T5837] kernfs_unlink_sibling+0x71/0x180 [ 837.833223][ T5837] __kernfs_remove+0x3e7/0x660 [ 837.833256][ T5837] kernfs_remove_by_name_ns+0xaf/0x130 [ 837.833281][ T5837] sysfs_unmerge_group+0xd4/0x140 [ 837.833314][ T5837] dpm_sysfs_remove+0x76/0xd0 [ 837.833346][ T5837] device_del+0x250/0x8f0 [ 837.833373][ T5837] ? klist_iter_exit+0xc1/0x100 [ 837.833401][ T5837] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 837.833435][ T5837] ? __pfx_device_del+0x10/0x10 [ 837.833468][ T5837] device_unregister+0x21/0xf0 [ 837.833496][ T5837] hci_conn_del+0xc36/0x1230 [ 837.833530][ T5837] ? hci_abort_conn_sync+0xa7b/0x1190 [ 837.833562][ T5837] hci_abort_conn_sync+0xdd0/0x1190 [ 837.833598][ T5837] ? __pfx_hci_abort_conn_sync+0x10/0x10 [ 837.833632][ T5837] ? abort_conn_sync+0x26/0x210 [ 837.833657][ T5837] ? abort_conn_sync+0x26/0x210 [ 837.833679][ T5837] ? abort_conn_sync+0x19c/0x210 [ 837.833700][ T5837] ? __pfx_abort_conn_sync+0x10/0x10 [ 837.833724][ T5837] hci_cmd_sync_work+0x213/0x400 [ 837.833751][ T5837] ? process_scheduled_works+0xa8d/0x18c0 [ 837.833781][ T5837] process_scheduled_works+0xb6e/0x18c0 [ 837.833826][ T5837] ? __pfx_process_scheduled_works+0x10/0x10 [ 837.833858][ T5837] ? assign_work+0x3d5/0x5e0 [ 837.833888][ T5837] worker_thread+0xa53/0xfc0 [ 837.833931][ T5837] kthread+0x388/0x470 [ 837.833952][ T5837] ? __pfx_worker_thread+0x10/0x10 [ 837.833979][ T5837] ? __pfx_kthread+0x10/0x10 [ 837.834000][ T5837] ret_from_fork+0x51e/0xb90 [ 837.834030][ T5837] ? __pfx_ret_from_fork+0x10/0x10 [ 837.834056][ T5837] ? __switch_to+0xc7d/0x1450 [ 837.834082][ T5837] ? __pfx_kthread+0x10/0x10 [ 837.834103][ T5837] ret_from_fork_asm+0x1a/0x30 [ 837.834143][ T5837] [ 839.806674][ T1727] block nbd1: Possible stuck request ffff8880268e8000: control (read@0,1024B). Runtime 270 seconds [ 839.828838][ T1727] block nbd1: Possible stuck request ffff8880268e8200: control (read@1024,1024B). Runtime 270 seconds [ 839.849572][ T1727] block nbd1: Possible stuck request ffff8880268e8400: control (read@2048,1024B). Runtime 270 seconds [ 839.872883][ T1727] block nbd1: Possible stuck request ffff8880268e8600: control (read@3072,1024B). Runtime 270 seconds [ 841.722811][ T5194] udevd[5194]: worker [22821] /devices/virtual/block/nbd1 timeout; kill it [ 841.731713][ T5194] udevd[5194]: seq 25567 '/devices/virtual/block/nbd1' killed [ 845.414665][T19105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog