last executing test programs: 10m24.187974641s ago: executing program 1 (id=416): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={0x18c, r1, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x4}, {0x6, 0x11, 0x3}, {0x8, 0x13, 0x10001}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xfffd}, {0x8, 0x13, 0x400}, {0x5, 0x14, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xe8}, {0x6, 0x11, 0x447}, {0x8, 0x13, 0x2c3}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0xb}, {0x8, 0x13, 0x8000}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xac}, {0x6, 0x11, 0x8000}, {0x8, 0x13, 0x6e}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xffff}, {0x8, 0x13, 0x1}, {0x5}}]}, 0x18c}, 0x1, 0x0, 0x0, 0x40800}, 0x600000b1) socket$qrtr(0x2a, 0x2, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x15, 0x8, 0x4, 0x8a, 0x0, 0x1}, 0x48) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x2, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000000400000000000000c3a00000e100000095000000000000001a42d4f421a7be9b3315accb3048c4aca6d08ff8060f28a9ab63efab0e68b1dab174155a4874249ec6ee0299ede615a47b6f5e6e12de1d93761314b902a35ba0ff45a45140eab714fd3c798dba30e44ef0f8369fa7ca53174073ffefad22dc7ac1feb6a2d62f635f3f45f57e8d431d1bd13b622cc5d83f7095a2f41f7115f06dc82e3937edb9fce1e5ee3e0d198cfccf754a6efbef781839e37a7d087dcfb469e403c9dde48816"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x27, &(0x7f0000000640)=""/159, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x17, 0x10, 0x0, 0x0, 0x61e5cc96}, 0x43) 10m24.115644146s ago: executing program 1 (id=419): r0 = epoll_create1(0x80000) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x54, 0x54, 0x3, [@union={0xf, 0x6, 0x0, 0x5, 0x0, 0x6, [{0x7, 0x1, 0x1}, {0x9, 0x1, 0xab1}, {0xf, 0x0, 0x3}, {0xd, 0x2, 0x7fffffff}, {0x8, 0x1}, {0x0, 0x2, 0xc}]}]}, {0x0, [0x0]}}, &(0x7f0000000080)=""/4096, 0x6f, 0x1000, 0x0, 0x5c0}, 0x28) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f00000010c0)={0x20000002}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f0000001100)) r3 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000001140)={0x28, 0x0, 0x0, @local}, 0x10, 0x0) listen(r3, 0x4) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001180)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f00000011c0)=0x8, 0x4) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000001200), 0x2, 0x0) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000001240)=0xfffffffffffffff1) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000001280)={0x0, 0x0, 0x3, 0x0, '\x00', [{0x4, 0x8, 0x0, 0xd, 0x0, 0xfe}, {0x6, 0x6, 0x2, 0x5, 0x90f4, 0x2}], ['\x00', '\x00', '\x00']}) ioctl$AUTOFS_IOC_EXPIRE(r2, 0x810c9365, &(0x7f0000001400)={{0x7, 0x5}, 0x100, './file0\x00'}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000001540)={0x2003}) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000015c0), r4) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r4, &(0x7f0000001780)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001740)={&(0x7f0000001600)={0x120, r5, 0x100, 0x70bd25, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x4}, {0x6, 0x11, 0x7ff}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x200}, {0x6, 0x11, 0x4887}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x401}}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000000}, 0x40040) sendmsg$nl_route(r4, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)=@delnexthop={0x20, 0x69, 0x2, 0x70bd28, 0x25dfdbfb, {}, [{0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x44000000) socket$l2tp(0x2, 0x2, 0x73) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x2, 0xd, &(0x7f00000018c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x9}, @jmp={0x5, 0x1, 0x9, 0x8, 0xe, 0x30, 0x8}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0xef}, @alu={0xf87e56a65289f084, 0x1, 0x1, 0x8, 0x2, 0x18, 0x8}]}, &(0x7f0000001940)='syzkaller\x00', 0x3, 0x27, &(0x7f0000001980)=""/39, 0x41100, 0x4b, '\x00', 0x0, @fallback=0x7, r1, 0x8, &(0x7f00000019c0)={0x1, 0x3}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1ff}, 0x94) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000001ac0)={0x80002014}) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000001b00)={0x0, 0x5, 0x7ff, 0x0, 0x678, 0x101}, &(0x7f0000001b40)=0x14) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000001b80)={r6, 0x1}, 0x8) setsockopt$MRT_DEL_MFC_PROXY(r4, 0x0, 0xd3, &(0x7f0000001bc0)={@private=0xa010100, @local, 0xffffffffffffffff, "981dc65ab538792f05ecb4de058ed9391b9dbf1d631bf564fab0c723f42253cc", 0x9f21eaae, 0x5, 0x8, 0x5}, 0x3c) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001c40), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000001c80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_POWER_SAVE(r7, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001d00)={&(0x7f0000001cc0)={0x1c, r8, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4) write$cgroup_type(r4, &(0x7f0000001d80), 0x9) sendmsg$nl_generic(r4, &(0x7f0000002100)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000020c0)={&(0x7f0000001e00)={0x2ac, 0x33, 0x1, 0x70bd29, 0x25dfdbfc, {0x11}, [@generic="0f305577ea559716f2ca8e61b028be305c80f52d6758e44ba4cf4c24970b1fbdca0fb47eb532a2ae051802d75b2be52dd4979dd12843bb06ff0d7d747e577efeb012a2ad07748ec38b10cbf0b96bc8b048c02bf2a6dd63a095874c1a89baefa258317832ba345f16831695f04b3bfe1413a5f07308b947dc8f32cb87cd245de51b37ae14b721ae90f569755667ab5e0bcb38b3c96104f7546f385f43a67ca8adb0b7c0ab83e661b0239a8937bb83d1ab1f7980cafae7442e9a010d33fbb22bd4ee", @typed={0x8, 0x11f, 0x0, 0x0, @fd=r2}, @nested={0xdb, 0x41, 0x0, 0x1, [@generic="bfff07ee2d482c820e7334dbe3f8e9bd5b6722a26bd4e3ed351d483a17143e0ad5e8f1a0fc60b6f82a93c8060d845e82e7bd819ba44734694dd4c06eb3b0f7b9f8e7873d71ea378413bf0654520e058e0257bbf5300aeff326e2ed9067870fa86aa85c809f803b07d32569f698455b4d802d0a4dfc8b87c554d8", @generic="a230157ed57360e24bc3106d3719d90eb752063d99f431326b93cf7952c231787a90a0135ef23766729b56452e22485ba74a3401b78883be2d16106234464c384eda18d93f78a19df3f1ada7ffa1d2f2498365a2f18d331934", @nested={0x4, 0x13c}]}, @nested={0x9a, 0x118, 0x0, 0x1, [@nested={0x4, 0xf4}, @generic="a8d70a1ef1c81b91e12b5833965309903eb5055db53fabac526b35288ffc836530a812aa115b2c84455e678dc8c44e9fe1861fc2b658f568b5d588a2dd910216d5c5c3e71f7b0bc1c220cf3bf420", @typed={0x14, 0x41, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @generic="65bc6b172349d2ff6480dfbf2da8ba5b0130cc5d706fe47df59eb1db7e4dc3d313aa413c3aa37476dc5d6bcb8b19bb52"]}, @generic="0fb21bf4b8dbe825324e5d25fb6304e5b120c6722757da334fd5bb8640338ad4389adf114c2d30c5cf25a1b300679b256b348b9f25c05617290745e08a8738cd909acf104795281f0cd33e54454abfac4bee279855b0"]}, 0x2ac}, 0x1, 0x0, 0x0, 0x4048084}, 0x8000) ioctl$sock_inet_SIOCSIFPFLAGS(r3, 0x8934, &(0x7f0000002140)={'ipvlan1\x00', 0x51}) 10m23.960776571s ago: executing program 1 (id=421): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000030000000100000080"], 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$l2tp(0x2, 0x2, 0x73) recvfrom$l2tp(r1, 0x0, 0x0, 0x40000060, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000100), &(0x7f0000000140)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10m23.868980723s ago: executing program 1 (id=423): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000400)={'batadv_slave_1\x00'}) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1, 0xffffffffffffffff}, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={r2, 0x0}, 0x20) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x581, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_USE_CARRIER={0x5, 0x6, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000002, 0x42073, 0xffffffffffffffff, 0xaba00000) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@updsa={0x13c, 0x10, 0x1, 0x0, 0x0, {{@in=@remote, @in=@local}, {@in=@empty, 0x0, 0x33}, @in6=@private2, {}, {}, {}, 0x0, 0x0, 0x2, 0x1}, [@algo_auth_trunc={0x4c, 0x14, {{'sm3\x00'}}}]}, 0x13c}}, 0x0) (async) r6 = socket$inet6(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="48000000140009052abd7000fddbdf25021000ff", @ANYRES32=r8, @ANYBLOB="08000900530a000008000200fffffff708000400ac1414aa0800040064010103080001000a01010408000900"], 0x48}, 0x1, 0x0, 0x0, 0x24048881}, 0x0) (async) sendto$inet6(r6, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) (async) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x0, r10, 0x3f, 0x0, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @empty}, @NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}]}, 0x30}}, 0x4000004) mmap(&(0x7f0000137000/0x4000)=nil, 0x4000, 0x5, 0x810, r2, 0xcd7f7000) (async) r11 = socket(0x5, 0x4, 0xf765) sendmsg$AUDIT_USER_AVC(r11, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x140000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0xb4, 0x453, 0x4, 0x70bd29, 0x25dfdbff, "87a0a1a7c6268201f31ecd0450211a0fc40f044fc1916b043946889fcf398372bed66d57bffdd066a6f2abb46986a0d93b9ce51f2e2fd21a5a49ceeb6f7462fda42b6ac3b6bda64be0e16ca75e85cd4f72ebe0d995b0615ef490045ff64d6f9aa040e019543531bc6950c6db8bfd4cade572c23aa4aa8ed7642193fbf207be389ff63570ad7766777156aadfeafe85f9621e2c830bea01752a4acc17beb70a5bace9", ["", "", "", "", "", "", "", "", ""]}, 0xb4}, 0x1, 0x0, 0x0, 0x40800}, 0x40) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) (async) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0xa0, r14, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_FRAME={0x74, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_a, @initial, {0xf, 0x5}}, 0xffffffffffffffff, @default, 0x1000, @val={0x0, 0x6, @default_ap_ssid}, @void, @val={0x3, 0x1, 0x2c}, @void, @val={0x6, 0x2, 0x9fc}, @val={0x5, 0x3, {0x5, 0x97, 0x5}}, @void, @val={0x2a, 0x1, {0x0, 0x0, 0x1}}, @void, @val={0x2d, 0x1a, {0x400, 0x2, 0x5, 0x0, {0x6, 0x8, 0x0, 0x347, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x300, 0x100}}, @val={0x72, 0x6}, @val={0x71, 0x7, {0x69, 0x0, 0x1, 0xffffffffffffffff, 0x1, 0x9, 0x20}}, @val={0x76, 0x6, {0x3, 0x0, 0x2f, 0x6}}}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x1048}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1707}]]}, 0xa0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) sendmsg$nl_route(r11, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=@newneigh={0x44, 0x1c, 0x200, 0x70bd2d, 0x25dfdbfd, {0x7, 0x0, 0x0, r10, 0x1, 0x0, 0x6}, [@NDA_FDB_EXT_ATTRS={0x18, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x4}, @NFEA_DONT_REFRESH={0x4}, @NFEA_DONT_REFRESH={0x4}, @NFEA_DONT_REFRESH={0x4}]}, @NDA_SRC_VNI={0x8, 0xb, 0x5}, @NDA_PROBES={0x8, 0x4, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x9}, 0x4040040) 10m23.755406376s ago: executing program 1 (id=425): socket(0x10, 0x803, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfb, {{@in6=@private0, @in=@broadcast, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$igmp6(0xa, 0x3, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c00068008"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r7, r9, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000b00)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x7, 0x0, 0x3}}}}}}}, 0x0) write$tun(r2, &(0x7f0000000080)={@val={0x0, 0xc}, @void, @eth={@empty, @random="8bc6002500", @val={@val, {0x8100, 0x0, 0x0, 0x1}}, {@mpls_mc={0x8848, {[], @llc={@llc={0xd4, 0x8, "d3"}}}}}}}, 0x1d) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e00"], 0xb8}}, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000140)={'ip6_vti0\x00'}) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a00", @ANYRESOCT], 0xb8}}, 0x4000) 10m23.228534518s ago: executing program 1 (id=436): ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000180)) r0 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r1 = socket(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000006800010000000000000000000a00000000000000080006000100000004000b"], 0x24}}, 0x0) (async) r2 = socket$igmp6(0xa, 0x3, 0x3a) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r3, 0x8982, &(0x7f0000001780)={0x1, 'vlan1\x00', {}, 0x8}) getsockopt$MRT6(r2, 0x29, 0xd0, 0xffffffffffffffff, &(0x7f0000000640)=0x3) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000002000010029bd7000000000000a000064000000070000000035c5225f28e3abbe0500150002000000"], 0x2c}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x7, 'veth0_macvtap\x00', {0x6}, 0x4}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'veth1_to_hsr\x00'}) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet(0x2, 0x80001, 0x84) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r6}, &(0x7f0000000340), &(0x7f0000000380)=r7}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async, rerun: 32) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (rerun: 32) r8 = socket$inet(0x2, 0x3, 0x33) getsockopt$inet_mreqsrc(r8, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}, 0x1, 0x0, 0x0, 0x4091}, 0x0) 10m8.202596203s ago: executing program 32 (id=436): ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000180)) r0 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r1 = socket(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000006800010000000000000000000a00000000000000080006000100000004000b"], 0x24}}, 0x0) (async) r2 = socket$igmp6(0xa, 0x3, 0x3a) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r3, 0x8982, &(0x7f0000001780)={0x1, 'vlan1\x00', {}, 0x8}) getsockopt$MRT6(r2, 0x29, 0xd0, 0xffffffffffffffff, &(0x7f0000000640)=0x3) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000002000010029bd7000000000000a000064000000070000000035c5225f28e3abbe0500150002000000"], 0x2c}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x7, 'veth0_macvtap\x00', {0x6}, 0x4}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'veth1_to_hsr\x00'}) (async, rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet(0x2, 0x80001, 0x84) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r6}, &(0x7f0000000340), &(0x7f0000000380)=r7}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async, rerun: 32) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (rerun: 32) r8 = socket$inet(0x2, 0x3, 0x33) getsockopt$inet_mreqsrc(r8, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}, 0x1, 0x0, 0x0, 0x4091}, 0x0) 2.031805784s ago: executing program 2 (id=7509): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e22, 0x3, 'rr\x00', 0x1e, 0x4, 0x68}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e21, 0x3, 'lc\x00', 0x11, 0x3240, 0x3d}, {@loopback, 0x4e23, 0x4, 0x8628, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) r2 = socket$inet(0x2, 0x3, 0x8) getsockopt$inet_buf(r2, 0x0, 0x50, 0x0, &(0x7f0000000100)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'syztnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x20, 0x8000, 0x0, 0x3800000, {{0x14, 0x4, 0x3, 0x24, 0x50, 0x68, 0x0, 0x1, 0x4, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x19}, {[@timestamp_prespec={0x44, 0x3c, 0xa1, 0x3, 0x4, [{@broadcast, 0x7b9f}, {@multicast1, 0xc}, {@remote, 0xfffff187}, {@multicast2, 0x2}, {@private=0xa010101, 0xa960}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}]}]}}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000240)=ANY=[@ANYBLOB="85000000000000009500000000000000094f9b24d94341e0d6f085d9f17f703cc0f722757e84d31691ff5f97d521d46f5bda394901ae04ead83efa479f588112bbc4ac331cb8e4a1e8ea17722b3f0b45c4d4e4b937d8586e473fc040f55e026f10bbde99d56dd83bc28b02403a3cc3d3dab8008476859bfa516604aa08b82b9937e89b5a0bcefe4cf5068821bb22d5978d52af55474e2b277f7bb3e1fd06c04156de8877d5f33c606c1a4323a4b0ba1fcae8398518c5dc2f9af9d41baa3dce809f61a5b0e9d7b9476505cf8b990863dac48cf0666379a60ca320c9bfad7f6623587225b40394e828b6ec971d6143ee11832ef6cd3e3c500cbd6ec4b10899afccdb"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13, '\x00', r3, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff0b, 0x0, 0x0, 0x10, 0x3}, 0x94) 1.902024841s ago: executing program 2 (id=7511): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0000000000000000000200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x17) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x4e21, @empty}}, 0x0, 0x0, 0x0, 0xba, 0xce02cd}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x9, 0x81, 0xffffffff, 0x6940000, 0x80, 0x9, 0x77}, &(0x7f0000000940)=0x9c) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000d00)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1c, 0xf, &(0x7f0000000200)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x422c, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x4055, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000740)=@framed={{}, [@map_fd={0x18, 0x0, 0x2, 0x0, r0}, @call={0x85, 0x0, 0x0, 0x9e}]}, &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x41, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b000000070000000f0000000900000005"], 0x50) bpf$MAP_LOOKUP_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000001840), 0xfffffff7, r5}, 0x38) pipe(&(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(0xffffffffffffffff, &(0x7f00000007c0)=[{&(0x7f00000010c0)="4191062c1421f8d286fea25179d3bff47ffb95a24f597e0388f330e7dfb81fde917ae89f97c5fde0855ce2942ff541f21652a7409dad35f8886d587bb6e698986ca5f808b1b92c1a374dbc7424a26c0ad2b6840cf304a5531393272ebf0fc388dca33df607009efd43ccbd58a93f146ce183a410b8959fe192652e32068e0d8e24d8eab4ecbd5ebaa165771a07c890804037074a1ebad3bcdd46b8f34ecb2f4a6e1bbc6ac3d80ea44fbfedf338583f63ba4607f430acc0a98b4fcbb501006052cb83625cbf4debf28e9095458c1e9971417b2912bbe30037dd5c1ac06f612816e97ac304404619b0c75222e9339f6ba14eac3c1486ac997f919248490b14a5e12ef47e09857f6d43ebc490155bf06e801547ed96f1264b5c220cf3f66d2d9cc295bb9427a37151ccef04acb72afd4ba90528c349c06073cf798e2f2f084711f343c6be0a87269f19d9194fa5742acc493371d9d717a4f23e5ace5fe3ec7704de1e5bf67efeeaa94a338394ff4adf0d9bdf1beea748b1e9735f89625bd11188fb30ab3eade8b8fcf552dc63e1c777", 0x18e}, {&(0x7f0000000880)="09ec8b684fbd9f0a18960e84defd08b28dc2f98b5aad5cfeb075441d6d15233b802af831523479391b7297416ddff60a6500da9864b042a3105e6ff295aaff14d9077735f34eaec042e8252a6456999297ed02a01da56a3809f0c58184192ebf4bead7e8618412536273bf08e0f6847e436dc74f9afe55639834dc4c941dfb330a7b92b049700cb67e0f14337d8390091514253c2f2d4499d89b5f04759319e2c7b6856f03c69029b689f0be37093c79e8ff2405eb93cbfe5487143a294c3e61b0c9be8323cd4d01c37e5f5d4bf94546d02d4dc988dbb47ee61e5be16f4c7701cc671d25000000000000aeebbef22d7f2d931c963877fead2ab06279afc4ae478a7078a7bbdac4c800a22f128ee9bc899bfd5deb66020573afcc8defb54a535ea2b58349463561392e0524203e7be632e162559fc3b538b8338b4bf1e6de1bc735612bb2fc209ba7eb2dbdd06fed65af89e8b314b5a6b309e10c4a50d56fafac82f33c79cd5b0d4324fd65e76f059f29ab898eeacc72ff0299a6c434fda16e04721b0a4b6ff9698edda863d6511e6b5a531197b508318d6ccaaac93baed37b29d42ba4f7bcec7bf73b01f307ce317774f78b245f53a1b2a746c2af035728f4cd2c1a25e1", 0x1c4}, {&(0x7f0000000080)="6a5b3986af4597e55298f14c7f201f060fe2bafbdf16a0ace97ea54e624ac84ccc7fc7f393c4ece5273773faa8c63f157edf2a0d41a7c6340c630b50b30c42d156fa375b30d31bf6a611fd29e60958434b6f595565bc1d534aae4c0693aebccc5caa31bf5b1c194f52f63257b81e71d68ab2fd00"/128, 0x80}, {&(0x7f0000000400)="f3ba9e8346ddfd46f5ba7fbc25c6aed71214dcfaa44b98dfdbc07b1c8dc80c42d5501285b1bc305d7f699524d78bca1a151bfd74ca3d4f468f1244e6951083a7e19dec", 0x43}, {&(0x7f0000001780)="12dfbd793db81fe455d97618c2aedf67f1b166ec59876a1fbbe13986e69655d6f600262371ef8dae091786d7f9a4d7ca234f8852df8f05000f02b5258ec56ec5fdd5f3531f795bf2f172d6fb23f3549b9734f2eef416b7698a93335a94b8cda61325b62cda1807b03675c6347b431f2d78baa6bc59e9047069153d70f5d1a06eb6047dc5ffba20956e58971501c2d9f299fdfa3a38fa73a5", 0x98}, {&(0x7f0000000280)="2ee97d629c7e44f81166cb7f6ff136f276b93d54b74333781a4c68225b61bae19833da1ace561825cbfe", 0x2a}, {&(0x7f0000000b00)="ed48f08c19f5d937ff3f92802a25b07496a34825b6d3fbf57fec343be7e4b6531b0e0f0637b3c46e072578521ad417549bae2e00ad7b67f769ec533e3c9c62b6955e9005ca02506938aeb5adac5798e85f440385c7f26cced77e12ecffa7b98c962259e08cffa0eb0ad803bfdf8336da8df2e85a2a8b407329650ee71f68ca7de83df1c45914bedd1b8add5bc677e5590af05aea657a8b2b7dd4fc76010e259917ab727d4065cee39115ca3d322533bb48b5b8a23e8557688d783d0e5c444fd5ae3e02d7245c498d9c6675c8a9626ecde62915d6ada50bb3a0496c87f77457a664a250ba9d437a463f44057ad767bb933fa0790f660401baa2575729ec0306acedbdda2144218960158223a8759efb5bb977d9ff572bd597b13cf7b1647ffe268d5951288ca88461e1d8739e5aa3c6efda01a565dd2db4eb927815060123eb9d2b945305cad0caef49497b593f4b9f17db2323ffcbc7d702000000", 0x15b}, {0x0}], 0x8, 0x5) r8 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)=@newspdinfo={0x1c, 0x24, 0x10, 0x70bd26, 0x25dfdbff, 0x50, [@XFRMA_SPD_IPV4_HTHRESH={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c081}, 0x20004800) bind$inet(r8, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000780)=@generic={&(0x7f0000000640)='./file0\x00', 0x0, 0x18}, 0x18) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r10 = accept4(r9, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) setsockopt$sock_int(r6, 0x1, 0x2b, &(0x7f00000004c0)=0x5, 0x4) connect$inet(r8, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r6, 0x8982, &(0x7f0000000480)) splice(r6, 0x0, r8, 0x0, 0x2000000002ffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x19, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="8520000002000000ad08fcff000000003494c0ff00000000003300000300000018210000", @ANYRES32=r0, @ANYBLOB="160000009b000000"], &(0x7f0000000080)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @fallback=0x1, r4, 0x8, &(0x7f0000000100)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000140)={0x2, 0x9, 0x9, 0x10}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x7, &(0x7f0000000180)=[r3, r5, r3, r3, r3], &(0x7f00000002c0)=[{0x4, 0x3, 0x6, 0xb}, {0x4, 0x3, 0x8, 0x3}, {0x3, 0x3, 0xc, 0x4}, {0x0, 0x3, 0xc, 0x1}, {0x5, 0x3, 0x5, 0x3}, {0x5, 0x1, 0x10, 0x6}, {0x3, 0x3, 0x80000000, 0x4}], 0x10, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x4, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000061107e000000000095"], &(0x7f00000005c0)='GPL\x00', 0x5}, 0x90) 1.892306733s ago: executing program 5 (id=7513): sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$key(0xf, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x80) sendmmsg(r0, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0x4e, &(0x7f0000000640)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x18, 0x2c, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0x6, '\x00', @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}}}, 0x0) pipe(&(0x7f0000000540)) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r3], 0x3c}}, 0x10) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="000000001600"], 0x10}], 0x1}, 0x0) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bind$nfc_llcp(r7, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) r9 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r10 = socket(0x15, 0x5, 0x0) getsockopt(r10, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) bind$nfc_llcp(r9, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x3, 0x0, 0x5, "750538440ff92fe2aaf1beea7cdcc151042cd9893bc31f80716a120d8be6d7f81cd81ec275000386e7255f0669b740a5418d69d00000d51de08a00ee1d9a34", 0x400000011}, 0x60) close(r8) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x44, 0x4, 0x8, 0x101, 0x0, 0x0, {0x5}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}, @CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x26c}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xb09d}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7}]}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @sctp}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x8844) 1.62000279s ago: executing program 5 (id=7517): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) openat$cgroup_pressure(r0, &(0x7f00000000c0)='cpu.pressure\x00', 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbf6, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.540799881s ago: executing program 5 (id=7519): r0 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000003140)=""/4095, &(0x7f0000000000)=0xfff) getsockopt$bt_hci(r0, 0x84, 0x76, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r7, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r7, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x12, @mcast2}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)='B', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)="85b632a7a37adee4b14e931c21865b46fc33702952b3a91def2830db4418a85d76fb3fe6f0007ccbc98f6ed11f4833ac561b10420eb1eb0c0000ce8d56336ed5afeb953043a82a5cb775c666966d1523acc45a9348ffcace11cc5555147f2ce6ba1eb1949b44d4f713136d3898ade4a751a4a4f73d48a0462e7004a556ddd70c2975767c3524f533b2deb66e733e916fc42b47c99f", 0x95}], 0x1}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000280)="02c5be3c8c3036", 0x7}, {&(0x7f00000014c0)="03fe62190d30c5266fecee89914547e2f7b4a027049e2e1a5f83155978a78bbdad6455463d1cf596b04e732b6208f7c2052499aeef053781fbcdade1e4509b96442dfeafff2d34ca74ba872f741bbfffb78009ba745cfae12435500f1548f44c78a2836904c1ea9465ff82cb288006c8b5c825f6e663221b67557c1a53955db404b3085745aa93be94c608c017ab4764a52e05dbd67f25f8e41ff55982990488669a5f80e6e42ebfbd55ceb2c27f0fa69f747f4d483ec4b65af86c376e247ae4ab495dd8f7c0d8e6104642b2e43821297f235302198b83cce600f79b7fafa02050af352e7fe2bf1f0fed3684b62c375dcb08b279e4ad209e087e9f90856fc28dcc1df7ff5275e5b006e6b8b805d1e8c7bfdb9c8c77037566567c0ec3629789917cbacbca99bcc7e0b4a8be600f139af8b95ba2b96c04e3f42399ee18b61475963296f6c91cad4b61365e0cc818b1e1652a7da261d5d9417aa190a14344b33f187f8471ae22630602748c55fc6cdfdc3b9e314e2b3ba81bb7419e32d19e5941307b57963f2111206605791ee926d1bec8311ef95d0dcbd58f4b89170627dc5b61f821ef31c5ab23c2d6fe6a329c7c9894be247401fd97bc780ab214110ed5964afa26473f6f5746eb2b4d2ac1bd24572187252841894553f50897a289af17a94b7c33cc71f242bb7e10fea955117bef8610512b1ff43dec43b8431de3dad13d796b7c9ed0cccc7cadf43bed753f7005f3d1744853b7c73b534673fcdb64ca2c7c729ccff8dc45cc970b38d5838b5bcdbab648e1ccc89f59c1702dce2848814ce9fc9ec3abc06ec9a130b0c9253d9f21853b36330d6b1018d096f50c4a979e4be4648d96b0929bffb0668f1933888b9536cd1fac764c507e65858ae5cda4f89c8aa0f3778c47313fcc06b5c994d9961c47541506864558931c33b25a0239c16802f530cef88b41964a49d2b98c21e7dc13e202db638dbf8d47f7260d807a91c91037428d78c3e72c22778c7e3c92159e4c12201c2da39273ae41a8677d571ad85cd58f7d6dec1d03e8bb1057ba35f77c4e79820fa3f1183aa09e05572bef1503552170d1120322fcaa9887f6df62e977ddeeebc9e70e9083d6a661735c99b954b03d2e4c3f1490ae4c75ed4ac71486f3ac9fc69fe8835f11b29703d454332b7b1d6aeb7761af88be69aea7b185557fde17f2af18a859e10dd220d0404e94002ceea33236868251c11fb74ead121c80650bc001190db40801562d74537cca121c12f199e945321431320d44eaf4e03ff155e643ade3902a256265f4ce7fa94e2c4edd4bdf233391bac97b407b72b31a27937f9791a4d2ccbc37daeb16fd3f61ff5b9754b1fec793c102d34c237a5f57cc6742856dc820de9f6dc0a95d1c96d4451aa3a9603e3fc3f978275f918e4f16e20a7bcfed8a38c1ac4e72d3177e969058756f68b3d44e14da109e0937f4a887a9c2799572cfa9c09a065cad9904b5f9347203352b393f557cae24d1233080f1dbdbd66570d6856785b6e33d13d5f8bdd170df6b38912a3fde22b04058e5cf22b18c6e960b6b9e9bcb77accb8a8c5693f94a949080e474d58e020e0d457fbe99f3fe62eb86ed4dbea50793b32a12dc48fcd8a88ff9f553809f0d8e02f8ded798cdd35bd365b2e48cd5a15fdc6c33762d29edf4a9ef6e525acc55132f190c1ecbd4688410584a334c6150bf878b1311ffff8b201647243fd27d22c7f41e9f89d598cd7b44cafe4f45f9478cb91ac773fbe16d5bb911b5f960aba523893e37b3b21b9a30aa2fa597d2e02d2b8161ca50b719d83a49c878ccce0cf6212b5f386673", 0x50e}], 0x2}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)="c0b4", 0x2}], 0x1}}], 0x4, 0x400c404) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x4c, 0x0, 0x100, 0x70bd28, 0xfffffffc, {0x4f}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8}, {0x6, 0x11, 0x1}}]}, 0x4c}}, 0x20000011) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newtfilter={0x54, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xd, 0x4}, {0x0, 0x9}, {0xfff3, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x18, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_TTL={0x5, 0x2, 0x9}, @TCA_FLOWER_KEY_MPLS_OPT_LSE_TTL={0x5, 0x2, 0x6}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) 1.354474293s ago: executing program 4 (id=7523): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8}]}, 0x34}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x2e, &(0x7f0000000000)=0x80000001, 0x4) (async) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) (async) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r4, 0x2) (async) sendmsg$inet(r4, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x20004000) 1.268820308s ago: executing program 0 (id=7524): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0) (async) r1 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) getsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x5c, 0x5c, 0x2, [@func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0x1, 0x5}, {0x4}, {0x1}, {0xc, 0x2}, {0xc, 0x4}, {0xf, 0x4}, {0x1, 0xfffffffd}, {0x10, 0x1}, {0xc, 0x4}, {0xb, 0x2}]}]}}, 0x0, 0x76}, 0x28) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xc03, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x11, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r3, 0x58, &(0x7f0000000300)}, 0x10) (async) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r3, &(0x7f0000000300), 0x0}, 0x20) (async) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 1.155925078s ago: executing program 4 (id=7525): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r0) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7", 0x3}], 0x1, 0x0) write$cgroup_int(r2, &(0x7f0000000100)=0x3, 0x12) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x14, r1, 0x303, 0x0, 0xfffffffc}, 0x14}, 0x1, 0x0, 0x0, 0x60008800}, 0x0) (async) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x14, r1, 0x303, 0x0, 0xfffffffc}, 0x14}, 0x1, 0x0, 0x0, 0x60008800}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000050000000000000000000024000a20000000000a1f000000000000000000010000000900010073797a300000000058000000030a0104000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c08000140000000020800014000000030080002400000000308000140000000120800034000000000080003400000000a"], 0x122}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x5}]}, 0x3c}}, 0x0) socket$netlink(0x10, 0x3, 0x13) 1.133693787s ago: executing program 0 (id=7526): r0 = socket(0x10, 0x803, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="18743000fffeffff00000000090000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) (async) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c0000001400b59500000000000000000a400000185f6ca9b5806e7aa4352293b4ac34dba98909d09f0089a23884f8066c89f0ec6b74e6809da3f8e51cde24606ebb8703420301eceebd105e490b9d882fe4e0cb6c900a6edf9bd8ec3e093c5ee0fc567999f35a836cac14686af26347ac5ec77fca521b9b7f6df8d7559d3340f360cea73e3719bc8cbe5fd8471a2a32aad0466a32b942d9a8821037c459d3f1fd7796795e31d01361793080fd8e7795180183cdb85130f76f2b81e4a125be2c5385a8d80bd0a51797b209348cd64c10767e8e9a84d2fc09971e0832de8b0a96fa3ab25741ad09dde40e11ff8185add6b96cfb38dd36aa41478753db1369b9", @ANYRES32=r2, @ANYBLOB="1400020000000000000000000000ffff00000000"], 0x2c}}, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x370}]}, 0x34}}, 0x0) 1.124890962s ago: executing program 5 (id=7527): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=@framed={{0x18, 0x8, 0x0, 0x0, 0x3ffffffe}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @generic={0x66, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1000}, @exit, @exit, @call={0x85, 0x0, 0x0, 0x41}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "5193bb672965593497c186a80e00", '\x00\x00=*', "1202000000040030"}, 0x38) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x45, @loopback}, 0x1c) (async) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x45, @loopback}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x11, 0x4, 0x4, 0x9}, 0x50) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000200)=""/133, 0x85}, {&(0x7f0000000100)=""/16, 0x10}], 0x2) (async) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000200)=""/133, 0x85}, {&(0x7f0000000100)=""/16, 0x10}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x2, 0x4, 0x1, 0x0, r2}, 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x2, 0x4, 0x1, 0x0, r2}, 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0xa, 0x7, 0x2, 0x4}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0xa, 0x7, 0x2, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2, 0x1000000}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000002c0)={0x3, 'pimreg0\x00', {0xaf82}, 0x40}) 995.66396ms ago: executing program 0 (id=7529): r0 = socket(0x10, 0x3, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r2 = socket(0x400000000010, 0x3, 0x0) (async) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {}, {0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) (async) r5 = socket(0x400000000010, 0x3, 0x0) (async) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0xd4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x4, 0x8}, {}, {0xfff3, 0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa8, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0xe, 0x4, 0x9, 0x1, 0x4, 0x5, 0x1, 0x9d0, [{0x8001, 0x7fff, 0x4a84e8d5, 0xfffffffb}, {0x9, 0x6, 0x4, 0x5}, {0x8, 0x8a, 0x4, 0x8}, {0x80, 0xbf1f, 0x6, 0x5}, {0xe, 0x8, 0x7, 0x58c}, {0x6, 0x9, 0x6, 0x4}, {0x3, 0xde03, 0xe, 0x7}, {0x9aae, 0x1, 0x7, 0x97}, {0x5, 0x8001, 0x10000}]}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x5d, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd26, 0x25dfdafd, {0x0, 0x0, 0x0, r7, {0xe, 0x8}, {0x10, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001a000100000000000000000081"], 0x1c}}, 0x0) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r9, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000005c0)=""/151, 0x97}], 0x1, &(0x7f0000002f40)=""/229, 0xe5}, 0x0) sendmsg$tipc(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="b8d3d8e4", 0x4}], 0x1, 0x0, 0x0, 0x84}, 0x8084) (async) close(r10) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x3, 0x0, 0x4, 0x0, 0x44}, 0x48) (async) r11 = socket$netlink(0x10, 0x3, 0x0) (async) r12 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r12, 0x0, 0x700) (async) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ARP_VALIDATE={0x8}]}}}]}, 0x44}}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) (async) r14 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001480), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r13, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000000)={0x18, r14, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x18}}, 0x0) r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ASSOCIATE(r13, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x5c, r15, 0x400, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r16}, @void}}, [@NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x40, 0x2, 0x1, 0x0, {0x2, 0x5, 0x0, 0x35b, 0x0, 0x1, 0x1}, 0x300, 0x4, 0xab}}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x2, 0x1, 0x5, 0x0, {0x25, 0x9, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x400, 0x7, 0x9}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x20000) 933.659442ms ago: executing program 3 (id=7530): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f0000013c00)={0x0, 0x0, &(0x7f0000013bc0)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001b140100000000000d000000080004"], 0x28}, 0x1, 0x0, 0x0, 0x4855}, 0x0) 875.656981ms ago: executing program 4 (id=7531): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x5) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@o_path={&(0x7f0000000180)='./file0\x00', 0x0, 0x0, r0}, 0x18) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x15, 0x80000000, 0x9, 0x2, 0x3082, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x5}, 0x50) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x20, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x3}}, @map_val={0x18, 0x2, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000380)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000003c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000400)={0x5, 0x6, 0x200, 0xef40}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000440)=[{0x1, 0x1, 0x9, 0x5}, {0x1, 0x5, 0x5, 0x2}, {0x0, 0x2, 0x6, 0x1}, {0x2, 0x2, 0xf, 0xd}, {0x4, 0x5, 0x9, 0x8}, {0x1, 0x1, 0x2, 0x8}, {0x2, 0x3, 0xa, 0x3}], 0x10, 0x8000}, 0x94) ioctl$BTRFS_IOC_SYNC(r2, 0x9408, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000680)={@fallback=r0, 0xe, 0x1, 0x9, &(0x7f0000000580)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0], 0x0}, 0x40) getsockname$packet(r2, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000740)=0x14) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000006c0)={@ifindex=r9, r2, 0x11, 0x8, r6, @void, @value=r2, @void, @void, r8}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a40)={{r7, 0xffffffffffffffff}, &(0x7f00000009c0), &(0x7f0000000a00)='%pK \x00'}, 0x20) r11 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000ac0)=@generic={&(0x7f0000000a80)='./file0\x00', 0x0, 0x8}, 0x18) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@bloom_filter={0x1e, 0xcd, 0xfffffff8, 0xf, 0x1580, r2, 0x9cf, '\x00', r1, r2, 0x5, 0x1, 0x4, 0xf}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x12, 0x1e, &(0x7f0000000780)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0xa}, @cb_func={0x18, 0x6, 0x4, 0x0, 0xfffffffffffffffc}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, @alu={0x4, 0x1, 0x7, 0x4, 0x5, 0xfffffffffffffff0, 0xfffffffffffffff0}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], &(0x7f0000000880)='GPL\x00', 0x6, 0x71, &(0x7f00000008c0)=""/113, 0x41100, 0xd, '\x00', 0x0, @fallback=0x6, r2, 0x8, &(0x7f0000000940)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000980)={0x0, 0x6, 0x10000, 0x2}, 0x10, 0x0, r2, 0x0, &(0x7f0000000b80)=[r2, r10, r4, r5, r3, r7, r11, r12, r5], &(0x7f0000000bc0), 0x10, 0x5}, 0x94) r13 = socket(0x3, 0x3, 0x1400000) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000dc0)={@map=r11, 0x33, 0x0, 0x800, &(0x7f0000000cc0)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000d00)=[0x0], &(0x7f0000000d40)=[0x0], &(0x7f0000000d80)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r15 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000e40)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000e00)={@cgroup=r15, r10, 0x1a, 0x4, 0x0, @void, @value=r7, @void, @void, r14}, 0x20) r16 = openat$cgroup_procs(r7, &(0x7f0000000e80)='cgroup.threads\x00', 0x2, 0x0) ioctl$F2FS_IOC_SEC_TRIM_FILE(r16, 0x4018f514, &(0x7f0000000ec0)={0xbc7, 0x100000001, 0x2}) getsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000f00), &(0x7f0000000f40)=0x4) r17 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001200)={0x11, 0x14, &(0x7f0000000f80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@map_idx_val={0x18, 0xb, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfa}, @jmp={0x5, 0x1, 0x2, 0x3, 0x8, 0x8, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001040)='GPL\x00', 0x16e, 0x62, &(0x7f0000001080)=""/98, 0x40f00, 0x1, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000001100)={0x0, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000001140)=[0xffffffffffffffff, r7, 0xffffffffffffffff], &(0x7f0000001180)=[{0x1, 0x1, 0x10, 0x3}, {0x0, 0x3, 0xf, 0xc}, {0x2, 0x2, 0x3, 0xa}, {0x2, 0x5, 0x4}, {0x2, 0x1, 0x4, 0xc}, {0x0, 0x1, 0x1, 0x9}], 0x10, 0x7}, 0x94) write(r0, &(0x7f00000012c0), 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000001300)={'batadv0\x00', 0x0}) r19 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001380), r7) sendmsg$ETHTOOL_MSG_WOL_SET(r17, &(0x7f0000001480)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001440)={&(0x7f00000013c0)={0x4c, r19, 0x200, 0x70bd25, 0x25dfdbff, {}, [@ETHTOOL_A_WOL_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r18}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}]}, @ETHTOOL_A_WOL_MODES={0x10, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x2}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x52}, 0x84) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r13, 0x84, 0x18, &(0x7f00000014c0)={0x0}, &(0x7f0000001500)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000001540)={r20, @in={{0x2, 0x4e21, @loopback}}}, 0x84) 875.112208ms ago: executing program 5 (id=7532): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'erspan0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x8, 0x40, 0xffff, 0x4, {{0x21, 0x4, 0x0, 0x4, 0x84, 0x66, 0x0, 0x1, 0x29, 0x0, @remote, @loopback, {[@timestamp={0x44, 0x8, 0xa5, 0x0, 0x1, [0x3]}, @timestamp_addr={0x44, 0x24, 0xeb, 0x1, 0x1, [{@rand_addr=0x64010101, 0x5}, {@local, 0x80000001}, {@empty, 0x10000}, {@local, 0x5}]}, @timestamp_prespec={0x44, 0x14, 0x98, 0x3, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfff}, {@local, 0xd35}]}, @generic={0x83, 0x5, "3558dc"}, @end, @ssrr={0x89, 0x7, 0x6a, [@dev={0xac, 0x14, 0x14, 0x43}]}, @ssrr={0x89, 0x23, 0x29, [@private=0xa010102, @local, @local, @empty, @private=0xa010101, @loopback, @empty, @rand_addr=0x64010100]}]}}}}}) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000001c0)={0x1, 0x4, 0x6, 0x2, @vifc_lcl_ifindex=r1, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 874.590151ms ago: executing program 2 (id=7533): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000d40)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b70600007fffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e0794ba217d24cb1dd5eab952f7a5004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a6dc4facc231ab7ea0c34f17e3946e0ebc622003b538dfc8e012e79578e51bc5f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b803000000661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148be3b2e6ea09c346dfebd38608b32a0080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e14861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16b089f37b3591a15c0a9be6eb18208404c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979009857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef09eecfc3344b8d3d524a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef568fc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b625491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd907000000000000000d9cae846bcbfa8cce7b893e578af7dc7d5e8732cac2d114b1457261bc5dfb508078d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000ff0300000000000000000000000000000000005205000000dc1c010100000000000052a93466ae595c6a8cda6d0d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd5236460000000000000000000000000000000000000000000000ff01000000000000ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f764992218c2d40624152c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f65167300000000d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0a16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fca4d97a0ae75ccf11e29aea7779355ecba6efa1517ec40bb3fa44f99596ad67ccaba76408da35e9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff173291dda5867947257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efd7b65f04aa7e72588757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b7202cf40db74a4c1c219d8ddec8f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e150695ffae3a676555b10da11751865126d19336116a1e58ab784b4000043cc97f9479136a66f551c2abf8fe3d134f6d69df1cffe6740f90735f66ca54fd87800b4bda4db5e68aaccf44d24e09f8a769e3ae7bf246661f15e3d1adae4384bdb7cd30a33e30466b421feb96006c810fd3830a1c75af2580727ffc604d2b04f476acc21419fad9b1baec88974da2db29b80859bde08b85c8086e4b7f1fd568042ad5396d3179c71b1dc43291e450ce9b8d7d80fcb44966d7ad4691a37870000000000000000000000000000000000000000000000000000000000000000000083a55b5d06da91165d24bc316607e2d69344aa1c07ff7cd7bc3d17f122478b6e81077782b9c298edc2546045feff90e7aa7da88d2489fb000a4aa838f911c1a869fa55e979e033b7707df75b93cf5b8d25242741a88f2d54a7107375b25911aa11efa3a4f87fc14f180e353615b3cb9a5cf5ea843014a277c3694a5a83266f73ef039dd739187923715548d58ff43be997e357e0cbed29faef19c0082e26fb867bf0ff32c403c0ecabaa78148be8eeee2711a65629e1e8be9dc213e77d8acf6bb01677dce314a973bb2aea3cc0449edf06342d676cbfc38dc03c68f197ae08aee4e2a9031f05e6741629b50dcd4e795d6f1ea4643760e96a8d5f6fdfd68d39d6870c0e3e5fa0e2b798d28231a786a0dd12a079860000000000f02ec9a8f4af0117974bbf00bba7c708dae1f6854f6a0f13399ef22983d0d5c59e91bcb61ba59cfa9ae1ac144c448ab77784b6e79d5560f812e56c13d8b3ea87d71f35d38c80ad839b6aed72534cb8a0613fc15dc6f573d485f8479668bd8dd2b4f9789a343380f24e199e88372fdbfcb7068555ed85a5e5d53b65e1d786497278e531d96795863c8373dc371e431f87a662605ab26e82bdd7e51adbcc27e9a5f2b772aeae63a66ea985daf7b109553a8957779fe94371c38f4dadfeef505bc4b0fbf52873fca552af2b433826f4d1c5e8b17a5f7999674b095a33b005338542014c85ae9be79e962801e3703273b0500a809a2e839930677fae0a26d610eba974a9ea230a8b9eb84ab283639ad299aaa36d16a9bd4aca745f40ab694cc903e4588bf29c44d97d9c1a58f9edfbaba158a53606656f4fe93d881021b54f32344d0685ff772c9d606295fa75907b2c97b1be63dd74bd6308d1be4e50fc648c601e23c1d090b981397cfc9aae3cd044a0b1a1b1ea"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000010000000900010073797a300000000070000000090a010400000000000000000100000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021340011800a0001006c696d6974000000240002800c000240000000000000008108000340fffffffd0c0001400000000000000007"], 0xb8}}, 0x0) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) sendmmsg$sock(r2, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000440)="588addb04cdce4", 0x7}], 0x1}}], 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x6000002c, &(0x7f0000000100)="b9ff03316844268cb89e14f088484ce0050000000000000177fbac141416e000000107079ffeb18000440f050f00845002f2075f0039010586038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014c0000c0adc043084617d7ecf41effff38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d7da058f6efa6d1f5f7ff400"/254, 0x0, 0xfe, 0x60000000, 0x0, 0xfffffffe}, 0x2c) 777.273656ms ago: executing program 3 (id=7534): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4002, 0x1000, @empty}, 0x1c) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x15, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079100800000000001ea00000000000009500000002000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x4000000}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) (async) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff0180c240000086dd61fbddf000083aff0000000000a7bb0000000000ffffac1e0001ff02ebffffffffffffff000000000001810090780002"], 0x0) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x404100, 0x0) close(0x3) r2 = socket$inet6(0xa, 0x80002, 0x0) (async) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x10}, 0x5}, 0x1c) (async) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r3, &(0x7f0000000200), 0xf000) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) r6 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_WOWLAN(r4, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01032bbd7000fcdbdf250500000008000300", @ANYRES32=r7, @ANYBLOB="0c0099000620000078000000"], 0x28}, 0x1, 0x0, 0x0, 0x24004000}, 0x20000010) (async) r8 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r8, 0x40088a01, &(0x7f0000000000)=0x100) (async) r9 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000040)={0x1}) (async) ioctl$AUTOFS_IOC_PROTOVER(r8, 0x80049363, &(0x7f0000000100)) (async) unshare(0x6020400) (async) r10 = gettid() syz_open_procfs$namespace(r10, &(0x7f0000000040)='ns/cgroup\x00') unshare(0x2020000) (async) close(0x3) 741.547206ms ago: executing program 4 (id=7535): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[], 0x10}, 0x1, 0x0, 0x0, 0x4008808}, 0x880) 549.364201ms ago: executing program 5 (id=7536): r0 = socket(0x2, 0x3, 0x100000001) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0xfffd}, 0x90) sendmmsg(r1, &(0x7f0000003ac0)=[{{&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @local, 0x8}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000380)='[', 0x1}], 0x1}}], 0x1, 0x0) setsockopt(r0, 0xff, 0x1, &(0x7f0000000100)='O', 0x1) syz_emit_ethernet(0x3e, &(0x7f00000007c0)={@link_local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x0, 0x3f18, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty}}}}}}, 0x0) 548.067499ms ago: executing program 2 (id=7537): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000680)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x4, [@float={0x2, 0x0, 0x0, 0x10, 0x4}, @typedef={0x5, 0x0, 0x0, 0x8, 0x5}, @decl_tag={0xf, 0x0, 0x0, 0x11, 0x4, 0x5}, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{0xc, 0x3}, {0x10, 0x5}, {0xf, 0x5}, {0x2}, {0x9, 0x1}, {0xc, 0x5}]}, @enum64={0xa, 0x3, 0x0, 0x13, 0x1, 0x4, [{0x2, 0x5, 0x4}, {0xc, 0x3, 0x10001}, {0x3, 0x5, 0xb}]}]}, {0x0, [0x0, 0x0]}}, &(0x7f0000000040)=""/7, 0xb0, 0x7, 0x0, 0x8}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000340)=ANY=[@ANYBLOB="b40800000000000073114300000000070000000000000000b700a500000000009500c200000000009500001200000000577f98b2049127eb8d42889df15e1b3c0ba7c924d0fe1f34355792a06afe631a2d645f10f852a976361794979a15b8fa57e80c31a3"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f0000000780)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, r0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ee0000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c000c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05af3a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e4e4e29d8b33fbdd02e86a6432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3ce8f530ffff19a6471bf5abc742d9cbcfb964b13831034694a6aad84cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df871a8e782339bc424d1bafe5725c8a404724f8a4f1cda7997b65954f74097579b91da309b887af2485c2d9ab09b506000000000000000bf7b2ff4602aec1eea200000064881c5630521a08e051374cf05c921a06fb78183e7e68de9dc8d95e0e5b365d10e1004dae58b3b5b89709b0ff47b200000000004000cbefd9a6bb70f60eb9c01dd2fc79b85e4d961498f3a80131d21d85618ba2189f45d011ef1da5c6d57bb8fd387ccea9c3899a914e47e82f040000009de2323f927355408f87264797d3fa970949793b94329d580500d1f91c0d22587e05a61e3d8576ca168e88d7a9af95b04a37c27bfffab9abbb31fa8c0080258cfa6d3f166e695f3c56490aeef464d9965d70a50f1282619344f223548e75fa39643adac1322c87ca253ff2fb1882760d6feab16bacdf83c11816dbe959ebc5ec479c8319f73e2249eab0486b110702a481d3b51976a52303056e800b4ae5acc2df636a65eb1d672bf2000000cda8462cc9b16624998be65683321e970000000009b8e20762c1bf4a3eb6769f2b23e842bacd9c685edea0ffa3e975424f8ede49e61a4de808a38ba3512d64dc71867df4eee3f1ff791cf7c9862f98b45852e4b2f78721b978addf2f2a29a387c6f0576b36038f819286eea99a6a434811cf2a117d775fe986a49fb82cf5f15972d55185ab18f1045384501adabb20f7b0e15ff47f1744e2341b59034959a1289ba6e243668e671d305707e3de7652bfc5b60c76deff43a1d6fd6a4180ab723735abbeffe7f2ec3a0bb86f9eddfc0f3d1d503d7a540f64000000000000fbb4c256409e54daefbb107c381fa729ff5fe607d93430da178d685d7730f5e129438a5214f722096d2986334c25e454474f92e65828b018174a9f4738b8c71fbdead06ab95e02f9a847182766964976b1fccdb9f35721e43e33883cf16ed1343fb7429eb395123b0a4262b7023c22039b9002589a379ed4c6267965af78b861bd335312538cec97966b8973d4e299d9802264d06e40ae118e1d242d1128dcedeb44030df12ef68ffce8d141e8960ef790fb0078215d65f96eb55db8cbcb060000000d988374e45451a694ffe38a1d03912b31c98d42e1a1bda1290de1a499a5d6849914c1788a7aca37177cc34102f44fec5c5e0abae01c439a1b0311e074e81ae9993b5b3459553ecece78d4c1541c70f5d81e0725d5b273755c0000000000000000aa4234e282182952a76233d18e7d49638aeb04e7a9e9e7eafb7c255372795d2d192a0a33cab0f5bf2e93e0544fcdf2df2bc6ce96e5a7d72fcdb0a11993d54d97a23754ac828674dbb93c0ad345715be4a13678b01edf76d8a9236558fea2c88cce004505ab45d8f5f88aa887bbce5c18970428516f6099bdbb2cd7a2356397f1a0a23e662e2a6c4834400cbaa41c3c574ea68da5ec1ae49f968bbe0e0bf9878516f553639f5b4828e92019b61f5874be1c7cdd9482df50bc24a8a1fa10d291390eb84e26a2e8dbeaa45604b05a116c1210a7540bf81005044273f5a8ffc538db289350eb248e483bd8920efcf30a798c2b636243e0a37262ca47dfeefa1ce69b4475d7d714ba0c636e6ae9f710411d30ef424aeaabe057c7df6ff8f767bcd9012e1047c686f5ccb76ab3a5df53cbc22ba7ea8f6a8edc19d6c1be841503850803bc2c2d5e0e34270a7f1cca0c6c53a8e5f891f7a793a70da62d6d88fbb90d220acc687931b42d6be83ab870da3c0a567f5e65ec0457f4ad2a4ec0b671b36388afd5520a8483a4b11f7d02a41b315f0f9e59f47668d68a74838d6976e12fd45200014041dffacbf60892ec8bd7560686f137a806d3dfaba900b47cac62f828342fff009adb5b2251461a1b9d6ba625b8fe04e69a1a4be2696f24bb68f486e172932e03000000000000005942e1b9d6dc28ab8e19e1111dd893e8d5bc5642faf21eef40d6e7de3ef62c4bc5ff17e7aeb2841098f0cf74f845d1cc9ec4eee79c290fb0ba939b13707004e2e9cc0d350538c1c8c6bb9a38c6ac5ca07df32601240ea3f160d3a7b83ecd0509ce9eba0c7bf7843799b1b56a234f9eaab8a3f14f1472bb6aaeb8ac9ee4055f05558ab31f339f6a4caf2ee2fd01f34dca330000000000000000000000000000000000000000000000000000000000000000000000000095e6f945ba9a941cef5e70b8c152321e24b5b29bcf374dcf5a29a35d76e6e2bf8df95462690a4fc9ec8129e92b6ebb4b40a992a75d3c5954d0bfc87db24d856359079b29b3c374d081c300b2cfaa596d24e800ef8e2201f2fb7a9946f89f9f31f7cbd6f7fd7f8898c70b5c65f2e28f22e983892c383882809f557affbda5e1850d66a4a1ee73b2084681f880a754acddcdafe3ceeeebc0b5f2fedfe7d198e3067f3dbac9441a9ab8409cbbb7e15b9ae3944097de34de2001c8533a3766e6e4c4c4702ccb932a27a3962814cd6aa8fc684beeaa3932efae9052be8eec1e95f6ad8d41dd34829504ba4b66e27154cb6e34aa13450522df1723130b6fe347c93f00e40e293c98d849a33f773c743728992f40faccd5c23130a1c6bfd6fc661bca1598137ddd1090ded672f5a48a40cab3f640c8241a364cbdd3f188eec7da7bccafbd5bf28a46f0eecc6b550471b06a5a411c0e0b19e15a461e7c6833ba936e214b013f2819ec6572a43b5cd32b11d7e4f8dcf8f7820a17b7b2ee6178a03351dd31091e46bfd82a3979b9cad109fd6217cd52aa81bdabd50826a474bd16b8f7e6aed12a305366599f5f029a7b24558c02750500002f1c19d16a6f391906000000cc03bbfb8c698ecc137d96711100e01031aa74fad86b99eebf0527552a9331e646c424b14ffbb815622bfd2f635855bed1b164d0a56bd104be069854111c5b26ec3c652b5f0a6b9676dae987ec23456ba05a4dfb15321ef6b76e7e547a688c67ab531cfc86784c9f940d9fb0464a72ce635e14b80dc5c1c64e8f58c570e7afd83ee77f157c146aa747b728969aeb4aba1d8f9de1b3fb8ab6ea50e884c2ea98e6400bf0c5ae2887cd1da0e57ccfdf5eca2b455247efcc13102846c0a85f20c80007c0ce6efce627b95b8ad3003385de97101678fb2163ecea6e70a77a6fbc089e31a5ccece932229b8f79faa6863d6857c3d9a9710f938ad16eeb8342278f1c1cbc226498028234d21466892983378fe64acbb44f694cd78e43c74aa75505cb1c91b189f8f89f233a05f5cd4e173a373178557843dd705268f74a9e5429945503195aefd6706e587f7ee8375fa559c3ad195d3795df1a8364cd13acc3256ee4634c73eeb6954d0fcf09ab84df0b8900e0c6fea2cc0e7c207b8942fafd70530a0fc4622ecf132d1d5bdc9ffc79f0549b82df521817651d5fead5128205b92ccdccc69407ab556217af277af999dbd456dfc43dd061b6c91485dcc208cf0b3d0bf851de413f5de5ec015e296914afab6411109355e027ce04990d9aae251b9deb11b7db45b9f15b7b55d8fdbedd9e6cf891205694f02be8b9ea8ecd41308a0e1b93ae3435bfa88b440b1f701b4d0fc49c82193f27f8023b630ea97edbf3bf421a0a1a2b4ac7bb30bcd1cdd172c0df37408fd6827bb03e8742fc1c7a2be0d1299928c5f79e846a8dc7ca648d960a759e6711b69776896a9656d59af6d44bff348229fa84034faf8421a22c4b4c17a3d24a4aeee0d0850371feefd77cc4eef51c2b417c8c7458ddd7dd9d1a863bf0a9e1a30a19020490038017a5c7e474c83302a2b59654d49a11c6736ac63e8eb383760fc2b5c976dacf3dda7191c757f28e44f6a5f95db7055f7ed983f5665210f20a494fabb0dbcd335700000000000000000000000000000086666201251aa4f139d0485ffcf89f01639fd1579a3802f720a0215c720a97071f5065a23642a5826fdbca444b00e2e5835185d5d5b2796eb0fe32cf3b0633f58ecc7648c3c6efe82f93a3008052416512eea30ea9472e0b456a652883c0907323cf03be193ad0438cdef7a98a1671a1918df310dc4bfd61c3db3c22673884dca370558936b85737e14819ab1c57b348a8ff16d36364a20fe846d11d045de81f069bac8425b31c5d08b433562ffb318c1285011f9b78b2401989384311101e452f54661ecdb251ab9eefc8e400191f0f0f8c679b0000000000000000000000b41b0ae67d9351c49e1ff285d05a3cc39a5b0cd20afe0a00086650f8fad20c0e1e7131836c85b2cbacd41593928207312189fdd66abc45a139f0c9dbcc58237cec5bd56ffe0c6de23254a7951a298501ca04ab30b5723df6dd01d0b1a87c197b83b286374ba9a9dd1bd09ea1b71b24a1f527bf59d9633e3d15ed3757acc494f464482e49884c13780cc392bfe67b5d91e5b513daea48cac7645db35f07ba41aa187f65c5344717d7a0ee353a7e36b14fdce5898a613cef224d3addb3d2de74cef73f7520dc8cc8ffaa62cbd25e691ef4c45fdd25675b32c129a8464f08c4da9c08713b54416f3b56a04086dab1d196884e062287ad4758e883d2f99833d8aaf0c56718f6b0434740900faf4ab824662a719bf370fd0b2de04c1455ec14908ce5cbec79466f2f2cc337c53437d626254e00000000000000000000000000000000c34646f8ae68c095e7298300feab8a3dfe2c43fc971385b13b4f3b61ddbf5044ff572defcc67930f0e715774e1e970751534398faf79350255cfa9021378f10c2043e7ecd5649c9720530da7ea227b792f31cb5d688b5f1eba9ff5f85c97b35e00ecf76282912b483e31c76e303e527e98a9ca14f718d495ad45db16c4500011de506f0ca35f7ea96ed1831e3c1219f985b26cb8a70e7c8efcb287984871e0fed3f1985cf63f00289292b378188ad0dfae12c265b88961a9223b48cf7055d641595e0cb926d63c1f8a207f48bd482290b79867285c2155e655e017bca6cbba43f9b49042fb2fb390c436b3306e8a0800000090d159004da838a50235b91f5273c1fe083067ce1e2d8011c9e2b6d3ea69dfc3712e5ce440432fbd29ffd004000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x20e, 0x5ee, 0xfd000004, &(0x7f00000004c0)="b9180bb7600a070c009e40f088f71fff310005e03300ff010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d7472be0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0x31, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, &(0x7f0000000540)=""/228, 0x26, 0xe4, 0x1}, 0x28) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f00000001c0), &(0x7f00000003c0)=0x4) write$tun(r4, &(0x7f00000000c0)={@val={0x1c, 0xf5}, @val={0x0, 0x0, 0x0, 0x4}, @mpls}, 0xe) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x4, 0x8, 0xb}, 0x48) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r8, 0x0, 0x30, &(0x7f00000005c0)="24c953b63aa7367371e40e2f77289af6f77255af4579998d8084439a4f01d08744af804f5c577341527f9016351ca51aca6dc3ee89d01acb5ec2d9aebccf1c787c182c518cf2660d8734193dfadd1bad2f206a9faf061c1bd30e8d728f53bd6c7e2887271ba52e2882753ab7b87d5b45bd5cc93b7cb3b84ad1c5730cfdfbddd4865ec1ef316d70a383eb6da0a7144e94cd", 0x91) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000740)={@map=r7, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c328d1493d3664edca87d9f3cfa9ec91159ef0366f674979fb3ab3359d1f7370f2a78a68eb61f286bd54634b0ded0a083f7f0edb93a2e6c35d9c7a9fea641e0593b699064332ed8d98d1c1d4de3bf8c36d1646866665565fe58cd0e79f0e52ad74b97355557ad13c3eceea4f22ffd5c13", @ANYRES16=r3, @ANYBLOB="010028bd7000fedbdf250700000008000300", @ANYRES32, @ANYBLOB="0400cc001400040070696d726567000000000000000000000500530001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 547.580453ms ago: executing program 0 (id=7538): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) recvmsg$can_raw(r0, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x40010020) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b49fa7c4", @ANYRES16=r3, @ANYBLOB="29032bbd7000fbdbdf250f000000180001801400020067656e65766530000000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x40010) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="000000e3ff000000280012800b00010067d9a15a670dc65fc6d725ccf5c240656e657665fc000000000000000000000000020000140003006765"], 0x5c}}, 0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) pread64(r4, &(0x7f00000005c0)=""/145, 0x91, 0x1e) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r6, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r7, 0x1, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000380)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)={0xa8, r7, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x4c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc866}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_SOCK={0x48, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xb608}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4f1eaee7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ff}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0xc1}, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000140)={r9, 0x4}, &(0x7f0000000180)=0x8) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000100)=0x0) syz_emit_ethernet(0x46, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd60cedd0000103afffee000000000000000000000000000bbff0200000000000000000000000000018900907800"/70], 0x0) syz_open_procfs$namespace(r10, &(0x7f00000001c0)='ns/time\x00') 547.281353ms ago: executing program 3 (id=7539): r0 = socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0x8, 0x1, 'udp\x00'}, @NFTA_MATCH_INFO={0xe, 0x3, "7acc6338a90000b03bd9"}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x355c32cef104cbbc}, @NFTA_RULE_COMPAT_FLAGS={0x8}]}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 545.8861ms ago: executing program 4 (id=7540): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f0000000080)='/', 0x1}], 0x1) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) listen(r3, 0x7) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000500)={0x38, r4, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @handle=@pci={{0x8}, {0x11}}]}, 0x38}, 0x1, 0x0, 0x0, 0x22000092}, 0x10) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r4, 0x400, 0x70bd26, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x3}}, {@pci={{0x8}, {0x11}}, {0x8}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000084) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x9, 0x4, &(0x7f0000000000)=ANY=[@ANYRESDEC], &(0x7f0000000100)='GPL\x00', 0x400000, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x52}, 0x94) 456.630728ms ago: executing program 3 (id=7541): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xed27c9fa5277b9b7}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ALPHA={0x8, 0x5, 0xd}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0xfffffff8}]}}]}, 0x44}}, 0x20008000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x40, 0x25dfdbfb, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048050}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40100000000000061110a0d0000000016000000000000009500740000000000"], &(0x7f0000000400)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1802000000000000000000000000000a85000000ce0000009500000000000000"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) r4 = accept(0xffffffffffffffff, &(0x7f0000000080)=@qipcrtr, &(0x7f0000000000)=0x80) recvmsg(r4, &(0x7f00000006c0)={&(0x7f0000000100)=@phonet, 0x80, &(0x7f0000000540)=[{&(0x7f0000000180)=""/22, 0x16}, {&(0x7f00000001c0)=""/84, 0x54}, {&(0x7f0000000240)=""/200, 0xc8}, {&(0x7f0000000340)=""/155, 0x9b}, {&(0x7f0000000400)}, {&(0x7f0000000440)}, {&(0x7f0000000480)=""/167, 0xa7}], 0x7, &(0x7f00000005c0)=""/193, 0xc1}, 0x40002003) 281.578649ms ago: executing program 4 (id=7542): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={0x0, 0x0, 0x18}, 0x18) listen(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x1, 0x0], &(0x7f0000000700), 0x0, 0x100000}}, 0x40) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0xf, 0x12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) sendmmsg$inet6(r0, &(0x7f0000002000)=[{{0x0, 0x0, &(0x7f0000000180), 0x1}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000009c0)='.', 0xc400}], 0x7}}], 0x44, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5800000010000104000000000300000000000000", @ANYRES32=0x0, @ANYBLOB="fab0817db4b5f31a24001280110001006272696467655f736c617665000000000c0005800800250000000000140003006272696467655f736c6176655f300000ad2b950dead4ceecabab5b673bf8d8c4582701ae0447624a34a45dac"], 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff000000007110bc000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) 278.805917ms ago: executing program 0 (id=7543): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e60, 0x22, @mcast2, 0xd}, 0x1c) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ppoll(&(0x7f0000000100)=[{r1, 0x2}, {r1, 0xa063}], 0x2, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) sendto$inet6(r0, &(0x7f00000001c0)="805ef154", 0x4, 0x3b00, 0x0, 0x0) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={0x0, @in={0x2, 0x4e23, @empty}, @ethernet={0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}}, @hci={0x1f, 0x1, 0x3}, 0x9c0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='pimreg1\x00', 0x3, 0x3}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x20) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e60, 0x22, @mcast2, 0xd}, 0x1c) (async) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) (async) ppoll(&(0x7f0000000100)=[{r1, 0x2}, {r1, 0xa063}], 0x2, 0x0, 0x0, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) (async) sendto$inet6(r0, &(0x7f00000001c0)="805ef154", 0x4, 0x3b00, 0x0, 0x0) (async) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={0x0, @in={0x2, 0x4e23, @empty}, @ethernet={0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}}, @hci={0x1f, 0x1, 0x3}, 0x9c0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='pimreg1\x00', 0x3, 0x3}) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x20) (async) 224.443952ms ago: executing program 3 (id=7544): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000240)={0x1100, 0x2, 0x8000000b, 0x8}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x1, 0x4, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="28010000100007000000000000000000ff020000000000000000000000000001e0000002000000000000004e2000000000000000000000020000000000000000489a1ae1a6de03fe410afeca7c5e1993bf4b03b8af01fc060d06447be8e6a2e73f66f8156e8360c9c06119bcfa3474646cd43ad6b0588856425b384cc6f245edb1bb8c2909fa6425099707f98db9e5f5f232ee9e487731c31baa657d3665c516d705f389c91722c346b2e7baf07a8cb320ca43ad16ec4362a147216a7c4636020e68da2a37d96d91d7fb8b3f5961766e1ea11557239061f2e5eb237d580b62746e5f1cf0bdaf8bcfc4402b2f0a84b9e3594e6f0b3af836fad858c339d5ed5b96a813f518e48fc204e5bf87be2804e059b28f4d620c18", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000001000000000ad0000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a000200740000000000000014000e00fe8000000000000000000000000000bb2400090000000000010000000100000000000080b4000000000000000500000000000000"], 0x128}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), 0xffffffffffffffff) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x28, 0x2, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELTABLE={0x8c, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_TABLE_USERDATA={0x69, 0x6, "e62807258a6d38caf4cb1d7a776a7a05e57912414e63207c5e61d47bb4016b21bd5593b033b0968722f2f0f4818a1a13fbb43e79d0ae674d071c0164df9d3701cc15211300766b6ebe326ada9e49cca5c2a074e0e46e35eabfb48a4cd2cd8379a97e705b01"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x1c, 0x9, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x89}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xf8}, 0x1, 0x0, 0x0, 0x2000c814}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a3100000000140003800800014000000000"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd0002800800"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x3c, r5, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x3c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a0000000000006111770000000000850000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) sendmsg$nl_xfrm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0xb400, 0x2, 0xfeffff7f00000000}, {0x100, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x4cc00) 195.391448ms ago: executing program 2 (id=7545): r0 = socket$nl_route(0x10, 0x3, 0x0) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1", 0xc}], 0x1) r1 = socket(0x1d, 0x2, 0x6) setsockopt$llc_int(r1, 0x6a, 0x6, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getneightbl={0x14, 0x42, 0x400, 0x70bd27, 0x25dfdbff, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0xb780a6ad0b9e7b6f}, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000005c0)={0x0, 0x1, {0x100000001, @usage=0x2, 0x0, 0x8078, 0xa4, 0xa, 0xc449, 0xffff, 0x42a, @struct={0x9, 0x7}, 0x100, 0x9, [0x2, 0x18, 0x80, 0x4, 0x40, 0xfd4]}, {0xffffffffffffff00, @usage=0xe2, 0x0, 0x6af5, 0x2, 0x7, 0xabb, 0x8, 0x422, @usage=0xffff, 0x5, 0xcb5, [0x0, 0x9, 0x2, 0x1, 0x4, 0x20f]}, {0x5, @struct={0x8000, 0x800}, 0x0, 0x3, 0x0, 0x1, 0x1, 0x0, 0x0, @struct={0x28, 0x3}, 0x0, 0x2, [0x706, 0xffffffffffffffff, 0x8, 0xf6, 0x2f37, 0x1]}, {0x7, 0x5, 0x7}}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x8000}, 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1d, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x91}}]}, &(0x7f0000000180)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00}, 0x94) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f00000009c0)={r3, 0x9, 0x0, [0x1004000000000000, 0x1, 0x7fffffffffffffff, 0x5, 0x6], [0x5, 0x800, 0x7, 0xa1, 0x10001, 0x4, 0x8, 0x8, 0x0, 0x2, 0x1, 0x8, 0x100, 0x1ff, 0x8, 0x4, 0x7, 0x5, 0x8, 0x0, 0x1000, 0xf04, 0x3, 0xea3, 0xf, 0x2c, 0x39, 0x6, 0x1000, 0x432a2a33, 0x8000000000000000, 0x6, 0xffffffffffffff80, 0x4, 0x8, 0x10, 0x7, 0x7, 0xf0c, 0xf817, 0x9, 0xffffffffffffff26, 0x306, 0x8, 0x2, 0x5, 0x9, 0x8, 0x0, 0x1, 0x10000, 0x6, 0xfffffffffffffffe, 0x9, 0xcb, 0x3, 0x6cbd, 0x8e26, 0x1, 0x7fffffff, 0x401, 0x6, 0x7, 0xa, 0x4, 0x75, 0x7fffffffffffffff, 0x100000000, 0x5, 0x8, 0x6, 0xf, 0x3, 0xd80, 0x2, 0x9, 0x1, 0x3, 0x81, 0x0, 0x5, 0x80, 0x5, 0x2, 0x7226, 0x4, 0x4, 0xd, 0x5, 0x100000001, 0x9, 0xfffffffffffffffb, 0x9, 0x8000000000000001, 0xa76, 0x7, 0x5, 0x3, 0x3, 0x2, 0x6, 0xce01, 0x4, 0x6, 0x5, 0x4baf, 0x100, 0x80000001, 0x0, 0xfffffffffffffff8, 0x3f5a4ca3, 0x4, 0x0, 0xa2, 0x5, 0x4, 0x1, 0x4, 0x7fffffff, 0x9, 0xcf34]}) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000580)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x10}}], 0x1, 0x45) r6 = socket$l2tp6(0xa, 0x2, 0x73) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000ec0)={@cgroup, 0x5, 0x1, 0xbc, &(0x7f0000000380)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000e00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000e40)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000e80)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000f00)={@cgroup, r5, 0x9, 0x4, 0x0, @void, @value=r5, @void, @void, r7}, 0x20) sendto$inet6(r6, &(0x7f00000004c0)="c6dfa41799ecab6c96085a4ae5e0b8f1c2bec606aef1c751721e06aa85b661fe1784d132dea16270d1af72e67c5a99464a40ec245cc13f22384019e32535595104b5074bb0207e4fa4a9fe829e4226ae2ea09fd4118e7555567fb314244db61230b043c68f2644a150ab12657f7979f89077f797a000db02780ce0faebbbcf7b2cafb7c232b9aac5b7273417296b2cab1e39186faa514028081d751ba5fee27511b4111957c80b27e9b4283f411c03f7bbb6af9558", 0xb5, 0x4000005, &(0x7f0000000340)={0xa, 0x4e22, 0x9, @loopback, 0x2}, 0x1c) ioctl$BTRFS_IOC_LOGICAL_INO(r5, 0xc0389424, &(0x7f0000000f80)={0x8, 0x8, '\x00', 0x0, &(0x7f0000000f40)=[0x0]}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r8, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2a4022c0}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x40, 0x1412, 0x300, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x4}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x2}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x54}, 0x2000c019) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=@newtaction={0x8c, 0x30, 0xb, 0x0, 0x0, {}, [{0x78, 0x1, [@m_ct={0x74, 0x1, 0x0, 0x0, {{0x7}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_LABELS={0x14, 0x7, "4614c334e344ae53204373dc0ddeb17f"}, @TCA_CT_LABELS_MASK={0x14, 0x8, "eb6404074c369780d3df843c4e5e039f"}, @TCA_CT_ZONE={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x8c}}, 0x0) 72.231942ms ago: executing program 3 (id=7546): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000240)="2d625d3e476b40cd9484d15dd8d19e2400", 0x11}, {&(0x7f0000001900)="deaf4fc4ee821b63ce227b98191f745c98435aa3d735cc0619d4e7ecd67047f325b3042d8ee2d9207b245fb7bdf108704c214931413aff8193a543977ff54058af708d3b203d5a77cb7a00bf08a9c17ff4c127423ccf3d4138d5dede338f3884a6b27b14aff1e263cc6028c8fb15b69c76a96d82e4de28fc011dadb01331d183a210b9636f33cdd230ead30c2c438bad92dc8d372bbf527272529af2a1feb9683dcfe6f7de32789a98bcd553248244e00d844fecfed73b6d4ce9998eedcabbc648e09f7c3a432c4d28d9c7a6e00fe50a24cf05acc19b1558f9524102fbbc40a788bc9009d966eb557d7c5c8ec39fd725af5debf7accb43c8ed24240f2b29662329133b44f6b4ca60fc6e86e040c420e5040e8402967a2f6d8818dbb2bd1dfe44ec85df7c22022b4c5fb54497ac205b0aa7f9f248e6cfa78a83cb426299a1644707c061c1801604b462583a725e897eac72f22fee9d93d42738504730dfd72be2bd4550a4b94aa7868e1bad1fd09bd747aea57fc978d22994f7a2bf278189425a3c893cdeabe541739d263f89c46a283c56874c90dc460ff623a0091c3475c483d151db40530ef4590565d2b456714ff716e1115938d83dbc238edb3634d2f752b32b3a49d3c425dea5756a8ac7df08096f222d83b758e3c75ba64da542d70d765961e0e17169cf6c3f013448e22efd6c4a82b4f38376d3e74c7c6fddb2bcbe3c75af81275d1c0ac015623cbc801c635d1c919ef72aaf1ae52be0a4d8f34bb1a8dda56856fbff480b4a27b7a94cb8ce354d6ce973e68675cb496738400068ef9240f233936268c413d896f9a5bfd8e8cf87d454e593deeed55287593ca36dd35c5cc2b71d71b8f7a24ab4e861505434c42617e928d98650c15a75088390178ffcfab2d30eab51f3a5b957597c198af98e7b86bb7e18ab67d518e1bdbf7e04c3d8ace4c36dcd37bddb71235f12c6f5f4b945f99418", 0x2b4}], 0x2) writev(r1, &(0x7f00000005c0)=[{&(0x7f0000000080)='/', 0x1}], 0x1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_RATE_SAMPLE_INTERVAL={0x8, 0x17, 0x25}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES={0x8}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_LOW={0x8, 0xf, 0x400}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x51) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x8, 0x3, 0x440, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x370, 0xffffffff, 0xffffffff, 0x370, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [0x0, 0x0, 0x0, 0xff], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x1}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x200, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x4, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0xfffb, 0x10000, 0x3b84, 'snmp_trap\x00', {0x7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4a0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610418000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000001c0)={'veth1_to_bridge\x00', 0x20}) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r2, 0x4) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) 398.004µs ago: executing program 0 (id=7547): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x5}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xfffd, 'syz0\x00', @default, 0xfffffdb8, 0x2, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x10001, 'syz1\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c0100001000130700000000fcdbdf25e0000001000000000000000000000000ff020000000000000000000000000001000400004e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000004d632000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f000000000000000001000000000000000000000000000000000000002cbd70000035000002000000500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r6], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 0s ago: executing program 2 (id=7548): syz_genetlink_get_family_id$nfc(&(0x7f0000000400), 0xffffffffffffffff) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x49920d862a92153b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x441, 0x15001}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5}]}}}]}, 0x44}}, 0x0) mmap(&(0x7f0000d30000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000400), 0xffffffffffffffff) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)) (async) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x49920d862a92153b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x441, 0x15001}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5}]}}}]}, 0x44}}, 0x0) (async) mmap(&(0x7f0000d30000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) (async) kernel console output (not intermixed with test programs): tent configuration, please check. [ 576.192552][T27146] netlink: 284 bytes leftover after parsing attributes in process `syz.4.5791'. [ 576.361245][T27161] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5795'. [ 576.462401][T27168] netlink: 212304 bytes leftover after parsing attributes in process `syz.4.5796'. [ 576.476471][T27171] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5797'. [ 576.495482][T27171] veth1_macvtap: left promiscuous mode [ 576.925603][T27198] batman_adv: batadv0: Adding interface: netdevsim0 [ 576.946135][T27198] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 576.975126][T27198] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 577.001141][T27209] openvswitch: netlink: IPv4 tunnel dst address is zero [ 577.068536][T27213] delete_channel: no stack [ 577.324123][T27229] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 577.340351][T27231] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 577.385731][T27234] ipt_rpfilter: unknown options [ 578.008715][T27283] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 578.165385][T27296] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 578.312323][T27301] openvswitch: netlink: Key 19 has unexpected len 174 expected 4 [ 578.575013][T27315] syzkaller1: entered promiscuous mode [ 578.595468][T27315] syzkaller1: entered allmulticast mode [ 578.846637][T27337] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 578.991601][T27341] validate_nla: 7 callbacks suppressed [ 578.991622][T27341] netlink: 'syz.2.5854': attribute type 26 has an invalid length. [ 579.030318][T27341] netlink: 'syz.2.5854': attribute type 26 has an invalid length. [ 579.444867][T27359] xfrm1: entered allmulticast mode [ 579.538947][T27366] bond10 (unregistering): Released all slaves [ 580.090886][ T53] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 580.105942][ T53] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 580.116954][ T53] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 580.127216][ T53] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 580.137880][ T53] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 580.941934][T15871] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 580.987371][T15871] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 581.001726][T15871] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.066813][T27448] __nla_validate_parse: 18 callbacks suppressed [ 581.066833][T27448] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.5884'. [ 581.192119][T15871] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 581.232637][T15871] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 581.301428][T15871] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.663547][T15871] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 581.687862][T15871] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 581.720338][T15871] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 581.923237][T15871] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 581.953972][T15871] bridge0: port 3(netdevsim0) entered disabled state [ 582.061199][T27480] dvmrp1: entered allmulticast mode [ 582.219424][ T53] Bluetooth: hci1: command tx timeout [ 582.226612][T27400] chnl_net:caif_netlink_parms(): no params data found [ 582.440706][T27494] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5894'. [ 582.482694][T27494] netlink: 35 bytes leftover after parsing attributes in process `syz.2.5894'. [ 582.518316][T27494] netlink: 'syz.2.5894': attribute type 5 has an invalid length. [ 582.530998][T27494] netlink: 'syz.2.5894': attribute type 6 has an invalid length. [ 582.579341][T27494] netlink: 35 bytes leftover after parsing attributes in process `syz.2.5894'. [ 582.632977][T27507] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5895'. [ 582.852301][T27500] bridge0: port 1(ip6gretap1) entered disabled state [ 582.859456][T27500] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.056708][T27500] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 583.181021][ T7412] bond9: (slave vlan2): link status definitely down, disabling slave [ 583.191814][ T7412] bond9: now running without any active interface! [ 583.240378][T27518] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5901'. [ 583.243979][T15871] bridge_slave_1: left allmulticast mode [ 583.273528][T15871] bridge_slave_1: left promiscuous mode [ 583.282892][T15871] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.314889][T15871] bridge_slave_0: left allmulticast mode [ 583.324191][T15871] bridge_slave_0: left promiscuous mode [ 583.335598][T15871] bridge0: port 1(bridge_slave_0) entered disabled state [ 583.410806][T27523] netlink: 'syz.2.5900': attribute type 11 has an invalid length. [ 583.830232][T15871] gretap0 (unregistering): left promiscuous mode [ 583.948604][T15871] bond7 (unregistering): (slave gretap2): Releasing active interface [ 584.289537][ T53] Bluetooth: hci1: command tx timeout [ 584.374356][T15871] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 584.391778][T15871] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 584.406043][T15871] bond0 (unregistering): Released all slaves [ 584.568431][T15871] bond1 (unregistering): Released all slaves [ 584.745667][T15871] bond2 (unregistering): Released all slaves [ 584.940559][T15871] bond3 (unregistering): Released all slaves [ 585.125360][T15871] bond4 (unregistering): Released all slaves [ 585.138433][T15871] bond5 (unregistering): Released all slaves [ 585.152601][T15871] bond6 (unregistering): Released all slaves [ 585.165925][T15871] bond7 (unregistering): Released all slaves [ 585.365211][T15871] bond8 (unregistering): Released all slaves [ 585.381454][T15871] bond9 (unregistering): Released all slaves [ 585.426442][T27537] : entered promiscuous mode [ 585.564098][T27546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5907'. [ 585.607519][T27400] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.644486][T27400] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.680740][T27400] bridge_slave_0: entered allmulticast mode [ 585.751337][T27400] bridge_slave_0: entered promiscuous mode [ 585.764573][T15871] : left promiscuous mode [ 585.817652][T27400] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.836104][T27400] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.863556][T27400] bridge_slave_1: entered allmulticast mode [ 585.891143][T27400] bridge_slave_1: entered promiscuous mode [ 585.920814][T15871] tipc: Disabling bearer [ 585.933123][T15871] tipc: Disabling bearer [ 585.961165][T15871] tipc: Left network mode [ 586.084988][T15871] IPVS: stopping backup sync thread 19639 ... [ 586.134037][T27400] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 586.193867][T27400] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 586.239806][T27578] : renamed from bond0 (while UP) [ 586.370313][ T53] Bluetooth: hci1: command tx timeout [ 586.403695][T27595] netlink: 'syz.4.5917': attribute type 58 has an invalid length. [ 586.451967][T27595] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5917'. [ 586.474634][T27400] team0: Port device team_slave_0 added [ 586.614531][T27400] team0: Port device team_slave_1 added [ 586.839328][T27400] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 586.847365][T27400] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 586.916278][T27400] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 586.954098][T27606] syzkaller0: entered promiscuous mode [ 586.963353][T27606] syzkaller0: entered allmulticast mode [ 586.982234][T27606] tipc: Enabled bearer , priority 0 [ 586.996798][T27400] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 587.008513][T27400] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.045818][T27400] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 587.156479][T27604] tipc: Resetting bearer [ 587.220922][T27604] tipc: Disabling bearer [ 587.534358][T27400] hsr_slave_0: entered promiscuous mode [ 587.558447][T27400] hsr_slave_1: entered promiscuous mode [ 587.571226][T27400] debugfs: 'hsr0' already exists in 'hsr' [ 587.578318][T27400] Cannot create hsr debugfs directory [ 587.633014][T27637] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5927'. [ 587.665317][T15871] team0: left promiscuous mode [ 587.680039][T15871] team_slave_0: left promiscuous mode [ 587.693183][T15871] team_slave_1: left promiscuous mode [ 587.716308][T15871] hsr_slave_0: left promiscuous mode [ 587.724469][T15871] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.736570][T15871] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 587.757150][T15871] veth1_macvtap: left promiscuous mode [ 587.768208][T15871] veth0_macvtap: left promiscuous mode [ 587.785557][T15871] veth1_vlan: left promiscuous mode [ 588.124378][T15871] pim6reg527 (unregistering): left allmulticast mode [ 588.214569][T15871] pim6reg (unregistering): left allmulticast mode [ 588.449507][ T53] Bluetooth: hci1: command tx timeout [ 588.897333][T15871] team0 (unregistering): Port device team_slave_1 removed [ 588.964177][T15871] team0 (unregistering): Port device team_slave_0 removed [ 589.469938][T27643] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5928'. [ 589.796622][T27677] bond0: entered promiscuous mode [ 589.803249][T27677] bond0: entered allmulticast mode [ 589.810578][T27677] 8021q: adding VLAN 0 to HW filter on device bond0 [ 590.013085][T27685] netlink: 348 bytes leftover after parsing attributes in process `syz.0.5937'. [ 590.195758][T15871] IPVS: stop unused estimator thread 0... [ 590.269554][T27701] veth3: entered promiscuous mode [ 590.575252][T27723] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5946'. [ 590.982024][T27759] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5950'. [ 591.940658][T27787] lec:lec_atm_send: lec0: Unknown message type -2073076513 [ 591.969432][T27774] lec:lec_atm_close: lec0: Shut down! [ 592.540167][T27819] xt_hashlimit: size too large, truncated to 1048576 [ 593.625596][T27729] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 593.664517][T27400] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 593.734592][T27400] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 593.805556][T27400] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 593.845965][T27400] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 593.859998][T27853] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5962'. [ 593.985111][T27868] FAULT_INJECTION: forcing a failure. [ 593.985111][T27868] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 594.064367][T27868] CPU: 0 UID: 0 PID: 27868 Comm: syz.0.5965 Not tainted syzkaller #0 PREEMPT(full) [ 594.064396][T27868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 594.064407][T27868] Call Trace: [ 594.064415][T27868] [ 594.064424][T27868] dump_stack_lvl+0xe8/0x150 [ 594.064450][T27868] should_fail_ex+0x412/0x560 [ 594.064482][T27868] _copy_from_user+0x2d/0xb0 [ 594.064508][T27868] core_sys_select+0x578/0xc30 [ 594.064543][T27868] ? __pfx_core_sys_select+0x10/0x10 [ 594.064583][T27868] ? __pfx_set_user_sigmask+0x10/0x10 [ 594.064609][T27868] __se_sys_pselect6+0x267/0x320 [ 594.064632][T27868] ? __pfx___se_sys_pselect6+0x10/0x10 [ 594.064649][T27868] ? __pfx_ksys_write+0x10/0x10 [ 594.064676][T27868] ? __x64_sys_pselect6+0x21/0xf0 [ 594.064696][T27868] do_syscall_64+0xe2/0xf80 [ 594.064719][T27868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.064735][T27868] ? trace_irq_disable+0x37/0x100 [ 594.064752][T27868] ? clear_bhb_loop+0x60/0xb0 [ 594.064771][T27868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.064786][T27868] RIP: 0033:0x7fab1c99aeb9 [ 594.064803][T27868] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.064825][T27868] RSP: 002b:00007fab1d7f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 594.064845][T27868] RAX: ffffffffffffffda RBX: 00007fab1cc15fa0 RCX: 00007fab1c99aeb9 [ 594.064858][T27868] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 594.064869][T27868] RBP: 00007fab1d7f1090 R08: 0000000000000000 R09: 0000000000000000 [ 594.064880][T27868] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 594.064891][T27868] R13: 00007fab1cc16038 R14: 00007fab1cc15fa0 R15: 00007ffd98a73298 [ 594.064920][T27868] [ 594.200110][T27878] netlink: 184 bytes leftover after parsing attributes in process `syz.5.5966'. [ 594.227606][T27883] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 594.394090][T27400] 8021q: adding VLAN 0 to HW filter on device bond0 [ 594.492883][T27400] 8021q: adding VLAN 0 to HW filter on device team0 [ 594.566776][T22687] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.574654][T22687] bridge0: port 1(bridge_slave_0) entered forwarding state [ 594.723051][T15887] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.732756][T15887] bridge0: port 2(bridge_slave_1) entered forwarding state [ 594.925810][T27400] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 595.378016][T27938] FAULT_INJECTION: forcing a failure. [ 595.378016][T27938] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 595.420712][T27938] CPU: 0 UID: 0 PID: 27938 Comm: syz.4.5979 Not tainted syzkaller #0 PREEMPT(full) [ 595.420738][T27938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 595.420750][T27938] Call Trace: [ 595.420757][T27938] [ 595.420764][T27938] dump_stack_lvl+0xe8/0x150 [ 595.420792][T27938] should_fail_ex+0x412/0x560 [ 595.420818][T27938] _copy_from_user+0x2d/0xb0 [ 595.420843][T27938] core_sys_select+0x6fd/0xc30 [ 595.420877][T27938] ? __pfx_core_sys_select+0x10/0x10 [ 595.420917][T27938] ? __pfx_set_user_sigmask+0x10/0x10 [ 595.420945][T27938] __se_sys_pselect6+0x267/0x320 [ 595.420968][T27938] ? __pfx___se_sys_pselect6+0x10/0x10 [ 595.420986][T27938] ? __pfx_ksys_write+0x10/0x10 [ 595.421013][T27938] ? __x64_sys_pselect6+0x21/0xf0 [ 595.421033][T27938] do_syscall_64+0xe2/0xf80 [ 595.421051][T27938] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.421066][T27938] ? trace_irq_disable+0x37/0x100 [ 595.421082][T27938] ? clear_bhb_loop+0x60/0xb0 [ 595.421111][T27938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.421127][T27938] RIP: 0033:0x7fad8619aeb9 [ 595.421144][T27938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.421158][T27938] RSP: 002b:00007fad87106028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 595.421177][T27938] RAX: ffffffffffffffda RBX: 00007fad86415fa0 RCX: 00007fad8619aeb9 [ 595.421187][T27938] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 595.421196][T27938] RBP: 00007fad87106090 R08: 0000000000000000 R09: 0000000000000000 [ 595.421205][T27938] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 595.421215][T27938] R13: 00007fad86416038 R14: 00007fad86415fa0 R15: 00007ffe33ac7a38 [ 595.421241][T27938] [ 595.705753][T27400] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.765724][T27400] veth0_vlan: entered promiscuous mode [ 595.796255][T27400] veth1_vlan: entered promiscuous mode [ 595.830282][T27400] veth0_macvtap: entered promiscuous mode [ 595.865059][T27400] veth1_macvtap: entered promiscuous mode [ 595.962260][T27952] ip6t_srh: unknown srh invflags 4000 [ 596.015329][T27400] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.044753][T27400] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.716632][T27957] bridge6: entered promiscuous mode [ 596.725571][T27957] bridge6: entered allmulticast mode [ 596.741779][ T5491] lec:lec_start_xmit: lec0:No lecd attached [ 596.790157][T27976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5983'. [ 596.803072][T27976] bond0: entered allmulticast mode [ 596.829034][T27976] bond_slave_0: entered allmulticast mode [ 596.837928][T27976] bond_slave_1: entered allmulticast mode [ 596.869618][T27976] syz_tun: entered allmulticast mode [ 596.878182][T27976] bond3: entered allmulticast mode [ 596.901763][T27976] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 596.951066][T27982] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5988'. [ 596.965344][T27982] bridge: RTM_NEWNEIGH with invalid ether address [ 596.980386][T22673] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.001714][T22673] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.037922][T27984] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5988'. [ 597.061000][T27984] bridge: RTM_NEWNEIGH with invalid ether address [ 597.116045][T15871] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.151076][T15871] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.229383][T27989] Cannot find set identified by id 0 to match [ 597.338401][T27989] syzkaller1: entered promiscuous mode [ 597.367811][T27989] syzkaller1: entered allmulticast mode [ 597.452940][T15871] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.471718][T15871] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.525876][T15871] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.546062][T15871] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.823989][T28030] netlink: 'syz.3.5998': attribute type 3 has an invalid length. [ 597.953081][T28038] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6001'. [ 598.122818][T28047] syzkaller1: entered promiscuous mode [ 598.147118][T28047] syzkaller1: entered allmulticast mode [ 598.234087][T28005] FAULT_INJECTION: forcing a failure. [ 598.234087][T28005] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 598.290223][T28005] CPU: 0 UID: 0 PID: 28005 Comm: syz.0.5992 Not tainted syzkaller #0 PREEMPT(full) [ 598.290249][T28005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 598.290259][T28005] Call Trace: [ 598.290265][T28005] [ 598.290280][T28005] dump_stack_lvl+0xe8/0x150 [ 598.290307][T28005] should_fail_ex+0x412/0x560 [ 598.290336][T28005] core_sys_select+0x8dd/0xc30 [ 598.290383][T28005] ? __pfx_core_sys_select+0x10/0x10 [ 598.290422][T28005] ? __pfx_set_user_sigmask+0x10/0x10 [ 598.290443][T28005] __se_sys_pselect6+0x267/0x320 [ 598.290462][T28005] ? __pfx___se_sys_pselect6+0x10/0x10 [ 598.290478][T28005] ? __pfx_ksys_write+0x10/0x10 [ 598.290503][T28005] ? __x64_sys_pselect6+0x21/0xf0 [ 598.290520][T28005] do_syscall_64+0xe2/0xf80 [ 598.290536][T28005] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.290552][T28005] ? trace_irq_disable+0x37/0x100 [ 598.290567][T28005] ? clear_bhb_loop+0x60/0xb0 [ 598.290586][T28005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.290599][T28005] RIP: 0033:0x7fab1c99aeb9 [ 598.290614][T28005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 598.290633][T28005] RSP: 002b:00007fab1d7f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 598.290658][T28005] RAX: ffffffffffffffda RBX: 00007fab1cc15fa0 RCX: 00007fab1c99aeb9 [ 598.290671][T28005] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 598.290686][T28005] RBP: 00007fab1d7f1090 R08: 0000000000000000 R09: 0000000000000000 [ 598.290697][T28005] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 598.290707][T28005] R13: 00007fab1cc16038 R14: 00007fab1cc15fa0 R15: 00007ffd98a73298 [ 598.290731][T28005] [ 598.657890][T28074] : entered promiscuous mode [ 598.739821][T28079] netlink: 'syz.4.6012': attribute type 1 has an invalid length. [ 598.899623][T28079] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6012'. [ 598.961155][T28088] 8021q: adding VLAN 0 to HW filter on device bond11 [ 598.970227][T28094] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6015'. [ 599.016651][T28088] bond10: (slave bond11): making interface the new active one [ 599.027583][T28088] bond10: (slave bond11): Enslaving as an active interface with an up link [ 599.214825][T28115] syzkaller0: entered promiscuous mode [ 599.227619][T28115] syzkaller0: entered allmulticast mode [ 599.272172][T28114] netlink: 'syz.4.6020': attribute type 1 has an invalid length. [ 599.347546][T28117] .: renamed from bridge_slave_1 (while UP) [ 599.473329][T28129] netlink: 'syz.4.6025': attribute type 1 has an invalid length. [ 599.492470][T28129] netlink: 96 bytes leftover after parsing attributes in process `syz.4.6025'. [ 599.506733][T28129] netlink: 1 bytes leftover after parsing attributes in process `syz.4.6025'. [ 599.514984][T28127] syzkaller0: entered promiscuous mode [ 599.521448][T28129] netlink: 'syz.4.6025': attribute type 1 has an invalid length. [ 599.521479][T28129] netlink: 'syz.4.6025': attribute type 8 has an invalid length. [ 599.521490][T28129] netlink: 606 bytes leftover after parsing attributes in process `syz.4.6025'. [ 599.565559][T28127] syzkaller0: entered allmulticast mode [ 599.734406][T28144] netlink: 'syz.0.6029': attribute type 4 has an invalid length. [ 599.743465][T28144] netlink: 17 bytes leftover after parsing attributes in process `syz.0.6029'. [ 600.079152][T28162] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6034'. [ 600.203634][T28170] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6039'. [ 600.520747][T28196] bond4: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 600.541720][T28196] bond4 (unregistering): Released all slaves [ 600.568085][T28201] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6046'. [ 600.583229][T28200] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6047'. [ 600.624008][T28203] tipc: Enabling of bearer rejected, already enabled [ 600.632894][T28204] tipc: Enabling of bearer rejected, already enabled [ 601.036917][ T5844] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 601.052581][ T5844] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 601.064008][ T5844] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 601.073747][ T5844] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 601.084497][ T5844] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 601.492267][T17970] bond0: (slave syz_tun): Releasing backup interface [ 601.529656][T17970] syz_tun (unregistering): left allmulticast mode [ 601.733613][T15871] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.759960][T15871] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.858906][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5110 ms [ 601.868028][ C0] lec:lec_tx_timeout: lec0 [ 601.873390][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 601.980334][T15871] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.012583][T15871] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.150220][T15871] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.161438][T15871] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.204306][T28222] chnl_net:caif_netlink_parms(): no params data found [ 602.288060][T15871] bond0: (slave netdevsim0): Releasing backup interface [ 602.298695][T15871] netdevsim netdevsim4 netdevsim0 (unregistering): left allmulticast mode [ 602.471465][T28288] netlink: 'syz.3.6074': attribute type 10 has an invalid length. [ 602.485836][T28288] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 602.516782][T28288] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 602.570941][T28288] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 602.579771][T28288] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 602.642990][T28288] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 602.681675][T28288] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 602.761727][T28288] bond0: (slave batadv0): Releasing backup interface [ 602.849684][T28309] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 602.911490][T28222] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.931235][T28222] bridge0: port 1(bridge_slave_0) entered disabled state [ 602.951757][T28222] bridge_slave_0: entered allmulticast mode [ 602.962407][T28222] bridge_slave_0: entered promiscuous mode [ 603.006454][T28222] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.023194][T28222] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.031517][T28222] bridge_slave_1: entered allmulticast mode [ 603.040780][T28222] bridge_slave_1: entered promiscuous mode [ 603.154727][T15871] bridge0: port 1(ip6gretap1) entered disabled state [ 603.176134][T28321] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 603.184636][ T5844] Bluetooth: hci2: command tx timeout [ 603.194969][T15871] bridge_slave_1: left allmulticast mode [ 603.201417][T15871] bridge_slave_1: left promiscuous mode [ 603.207857][T15871] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.683866][T15871] dvmrp1 (unregistering): left allmulticast mode [ 604.081227][T15871] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 604.092916][T15871] bond_slave_0: left allmulticast mode [ 604.104773][T15871] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 604.116900][T15871] bond_slave_1: left allmulticast mode [ 604.125231][T15871] bond0 (unregistering): (slave bond3): Releasing backup interface [ 604.135167][T15871] bond3 (unregistering): left allmulticast mode [ 604.142519][T15871] bond0 (unregistering): Released all slaves [ 604.280430][T15871] bond1 (unregistering): Released all slaves [ 604.293154][T15871] bond2 (unregistering): Released all slaves [ 604.438704][T15871] bond3 (unregistering): Released all slaves [ 604.454016][T15871] bond4 (unregistering): (slave bond5): Releasing backup interface [ 604.464040][T15871] bond4 (unregistering): Released all slaves [ 604.619520][T15871] bond5 (unregistering): Released all slaves [ 604.774375][T15871] bond6 (unregistering): Released all slaves [ 604.787242][T15871] bond7 (unregistering): Released all slaves [ 604.957435][T15871] bond8 (unregistering): (slave veth7): Releasing active interface [ 604.971463][T15871] bond8 (unregistering): Released all slaves [ 605.132288][T15871] bond9 (unregistering): (slave veth9): Releasing active interface [ 605.144644][T15871] bond9 (unregistering): (slave vlan2): Releasing active interface [ 605.154861][T15871] bond9 (unregistering): Released all slaves [ 605.170098][T15871] bond10 (unregistering): (slave bond11): Releasing backup interface [ 605.182659][T15871] bond10 (unregistering): Released all slaves [ 605.252256][ T5844] Bluetooth: hci2: command tx timeout [ 605.340983][T15871] bond11 (unregistering): Released all slaves [ 605.360304][T28222] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 605.441276][T28331] tipc: Enabling of bearer rejected, media not registered [ 605.490610][T28222] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 605.648544][T15871] : left promiscuous mode [ 605.712781][T28359] __nla_validate_parse: 11 callbacks suppressed [ 605.712803][T28359] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6090'. [ 605.767093][T28222] team0: Port device team_slave_0 added [ 605.775068][T28365] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.6091'. [ 605.844239][T28371] mac80211_hwsim hwsim41 wlan1: Caught tx_queue_len zero misconfig [ 605.901335][T28222] team0: Port device team_slave_1 added [ 605.988289][T15871] tipc: Disabling bearer [ 606.006803][T15871] tipc: Left network mode [ 606.056816][T28222] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 606.073872][T15871] IPVS: stopping backup sync thread 19112 ... [ 606.102506][T28222] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 606.166408][T28222] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 606.189654][T28222] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 606.197439][T28222] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 606.227608][T28222] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 606.345854][T28393] x_tables: unsorted entry at hook 2 [ 606.472418][T28222] hsr_slave_0: entered promiscuous mode [ 606.485542][T28222] hsr_slave_1: entered promiscuous mode [ 606.493974][T28222] debugfs: 'hsr0' already exists in 'hsr' [ 606.503065][T28222] Cannot create hsr debugfs directory [ 606.868910][T28423] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 606.928844][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5050 ms [ 606.937895][ C0] lec:lec_tx_timeout: lec0 [ 606.942618][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 607.333605][ T5844] Bluetooth: hci2: command tx timeout [ 607.385320][T15871] hsr_slave_0: left promiscuous mode [ 607.421906][T15871] hsr_slave_1: left promiscuous mode [ 607.467585][T15871] veth1_macvtap: left promiscuous mode [ 607.482141][T15871] veth1_vlan: left promiscuous mode [ 607.487903][T15871] veth0_vlan: left promiscuous mode [ 607.743006][T28460] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6114'. [ 607.847853][T15871] pimreg3 (unregistering): left allmulticast mode [ 607.874266][T15871] pim6reg527 (unregistering): left allmulticast mode [ 608.415964][T28472] netlink: 'syz.2.6118': attribute type 1 has an invalid length. [ 608.417222][T28473] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6117'. [ 608.697916][T15871] team0 (unregistering): Port device team_slave_1 removed [ 608.746957][T15871] team0 (unregistering): Port device team_slave_0 removed [ 609.376788][T28472] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 609.409171][ T5844] Bluetooth: hci2: command tx timeout [ 609.580156][T28496] netlink: 'syz.0.6122': attribute type 10 has an invalid length. [ 609.623489][T28496] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 609.679695][T28505] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6122'. [ 609.706050][T28496] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 609.750086][T28511] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6126'. [ 610.027466][T28505] bond0: (slave batadv0): Releasing backup interface [ 610.197899][T28531] : rxe_newlink: already configured on ipvlan0 [ 610.252178][T28533] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6129'. [ 610.318229][T28531] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6129'. [ 610.574206][T28222] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 610.635285][T28546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6132'. [ 610.648891][T28222] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 610.715830][T28222] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 610.746809][T28222] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 610.761355][T28550] syzkaller1: entered promiscuous mode [ 610.771572][T28550] syzkaller1: entered allmulticast mode [ 610.832301][T28556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6135'. [ 610.840251][T28566] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6137'. [ 610.951886][T28560] netlink: 148 bytes leftover after parsing attributes in process `syz.3.6135'. [ 611.053179][T28556] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.114689][T28579] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6135'. [ 611.139918][T28574] bond4: option miimon: invalid value (18446744073709551585) [ 611.150181][T28574] bond4: option miimon: allowed values 0 - 2147483647 [ 611.163575][T28574] bond4 (unregistering): Released all slaves [ 611.280349][T28556] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.420516][T28556] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.632157][T28556] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.721734][T28600] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6144'. [ 611.853480][T28222] 8021q: adding VLAN 0 to HW filter on device bond0 [ 611.958834][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 611.968316][ C0] lec:lec_tx_timeout: lec0 [ 611.974107][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 612.020308][T15887] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.150084][T22673] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.180716][T28622] netlink: 'syz.0.6149': attribute type 1 has an invalid length. [ 612.181473][T28222] 8021q: adding VLAN 0 to HW filter on device team0 [ 612.231907][ T67] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.277138][T28626] sctp: [Deprecated]: syz.2.6150 (pid 28626) Use of int in max_burst socket option deprecated. [ 612.277138][T28626] Use struct sctp_assoc_value instead [ 612.285826][T22673] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 612.339535][T28626] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6150'. [ 612.364313][ T7412] bridge0: port 1(bridge_slave_0) entered blocking state [ 612.372383][ T7412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 612.461180][ T7412] bridge0: port 2(bridge_slave_1) entered blocking state [ 612.469767][ T7412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 612.835325][T28647] openvswitch: netlink: Message has 1 unknown bytes. [ 612.879024][T28647] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 613.015007][T28634] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 613.041190][T28634] gretap1: left promiscuous mode [ 613.047098][T28634] gretap1: left allmulticast mode [ 613.111072][T28634] macvtap1: left promiscuous mode [ 613.123809][T28634] macvtap1: left allmulticast mode [ 613.138665][T28634] veth1_vlan: left allmulticast mode [ 613.146633][T28634] macvtap2: left promiscuous mode [ 613.152153][T28634] macvtap2: left allmulticast mode [ 613.216153][T28634] veth0_macvtap: left allmulticast mode [ 613.239750][T28634] macvtap3: left allmulticast mode [ 613.261820][T28634] vlan3: left promiscuous mode [ 613.267898][T28634] vlan3: left allmulticast mode [ 613.276909][T28634] hsr_slave_1: left allmulticast mode [ 613.333376][T28634] bond9: left promiscuous mode [ 613.339628][T28634] bond9: left allmulticast mode [ 613.354157][T28634] bridge6: left promiscuous mode [ 613.362644][T28634] bridge6: left allmulticast mode [ 613.422807][T22673] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.434127][T22673] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.447606][T22673] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.460322][T22673] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.528295][ T7412] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.563732][ T7412] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.626704][ T7412] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 613.659425][ T7412] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 614.120754][T28705] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6166'. [ 614.231877][T15887] team0: left allmulticast mode [ 614.243256][T15887] team_slave_0: left allmulticast mode [ 614.266185][T15887] team_slave_1: left allmulticast mode [ 614.301022][T15887] team0: left promiscuous mode [ 614.323117][T15887] team_slave_0: left promiscuous mode [ 614.339736][T15887] team_slave_1: left promiscuous mode [ 614.354135][T15887] bridge0: port 3(team0) entered disabled state [ 614.378988][T15887] .: left allmulticast mode [ 614.392385][T15887] .: left promiscuous mode [ 614.409124][T15887] bridge0: port 2(.) entered disabled state [ 614.440967][T15887] bridge_slave_0: left allmulticast mode [ 614.461845][T15887] bridge_slave_0: left promiscuous mode [ 614.473007][T15887] bridge0: port 1(bridge_slave_0) entered disabled state [ 614.565311][T28733] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6171'. [ 614.585346][T28733] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6171'. [ 614.631512][T15887] bond1 (unregistering): (slave ip6gretap2): Releasing active interface [ 614.660831][T15887] bond4 (unregistering): (slave ip6gretap3): Removing an active aggregator [ 614.671637][T15887] bond4 (unregistering): (slave ip6gretap3): Releasing backup interface [ 614.683490][T15887] bond4 (unregistering): (slave ip6gretap3): the permanent HWaddr of slave - a6:a8:f0:a7:79:fb - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 614.902484][T15887] dvmrp6 (unregistering): left allmulticast mode [ 615.524003][T15887] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 615.535072][T15887] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 615.545986][T15887] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 615.557041][T15887] bond0 (unregistering): Released all slaves [ 615.568325][T15887] bond1 (unregistering): Released all slaves [ 615.584535][T15887] bond2 (unregistering): Released all slaves [ 615.750947][T15887] bond3 (unregistering): Released all slaves [ 615.915361][T15887] bond4 (unregistering): (slave veth3): Releasing backup interface [ 615.925321][T15887] bond4 (unregistering): Released all slaves [ 616.062551][T15887] : left promiscuous mode [ 616.183728][T15887] 9: left promiscuous mode [ 616.239829][T28748] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6173'. [ 616.293745][T28222] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 616.386953][T28747] bridge8: port 1(veth7) entered blocking state [ 616.406852][T28747] bridge8: port 1(veth7) entered disabled state [ 616.416276][T28747] veth7: entered allmulticast mode [ 616.436285][T28747] veth7: entered promiscuous mode [ 616.446015][T15887] tipc: Disabling bearer [ 616.485411][T15887] tipc: Disabling bearer [ 616.508620][T15887] tipc: Left network mode [ 616.648107][T28772] netlink: 212344 bytes leftover after parsing attributes in process `syz.0.6178'. [ 616.998827][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 617.007783][ C0] lec:lec_tx_timeout: lec0 [ 617.013759][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 617.196721][T28777] syzkaller1: entered promiscuous mode [ 617.208995][T28777] syzkaller1: entered allmulticast mode [ 617.497937][T28222] veth0_vlan: entered promiscuous mode [ 617.576448][T28222] veth1_vlan: entered promiscuous mode [ 617.701956][T28222] veth0_macvtap: entered promiscuous mode [ 617.752467][T28222] veth1_macvtap: entered promiscuous mode [ 617.770920][T28817] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6187'. [ 617.949368][T15887] hsr_slave_0: left promiscuous mode [ 617.969644][T15887] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 617.983312][T15887] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 618.028659][T28834] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6191'. [ 618.211522][T28834] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6191'. [ 618.417569][T15887] vlan1 (unregistering): left allmulticast mode [ 618.425829][T15887] veth0_vlan (unregistering): left allmulticast mode [ 618.945745][T15887] team0 (unregistering): Port device team_slave_1 removed [ 619.001988][T15887] team0 (unregistering): Port device team_slave_0 removed [ 619.444109][T28817] netlink: 'syz.2.6187': attribute type 1 has an invalid length. [ 619.478402][T28857] tipc: Enabling of bearer rejected, failed to enable media [ 619.497122][T28858] tipc: Enabling of bearer rejected, failed to enable media [ 619.557763][T28222] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 619.591611][T28868] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0x2 [ 619.596313][T28222] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 619.655340][T15871] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.682528][T15871] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.708594][T15871] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.850256][T28885] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6200'. [ 619.909047][T15871] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.937755][T28873] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6198'. [ 619.952919][T28893] dvmrp6: entered allmulticast mode [ 620.023672][T28889] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6198'. [ 620.075286][T28897] netlink: 165 bytes leftover after parsing attributes in process `syz.2.6199'. [ 620.103010][T28897] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6199'. [ 620.281475][T22687] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 620.296885][T22687] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 620.381182][ T7412] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 620.382402][T15887] IPVS: stop unused estimator thread 0... [ 620.407195][ T7412] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 620.861158][T28928] syzkaller0: entered promiscuous mode [ 620.878896][T28928] syzkaller0: entered allmulticast mode [ 620.925089][T28935] netlink: 'syz.2.6212': attribute type 7 has an invalid length. [ 620.956044][T28938] netlink: 'syz.3.6213': attribute type 33 has an invalid length. [ 620.986743][T28935] netlink: 'syz.2.6212': attribute type 7 has an invalid length. [ 621.014758][T28938] bond1: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 621.032066][T28938] bond1 (unregistering): Released all slaves [ 621.062682][T15887] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.072283][T15887] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.082239][T15887] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.094227][T15887] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.373253][T28954] pim6reg1: entered promiscuous mode [ 621.403387][T28954] pim6reg1: entered allmulticast mode [ 621.541866][T28971] netlink: 'syz.4.6220': attribute type 13 has an invalid length. [ 621.606169][T28971] __nla_validate_parse: 3 callbacks suppressed [ 621.606190][T28971] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6220'. [ 621.787612][T28978] xt_hashlimit: size too large, truncated to 1048576 [ 622.000713][T28971] syz_tun: refused to change device tx_queue_len [ 622.025650][T28986] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6224'. [ 622.037543][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 622.037640][ C0] lec:lec_tx_timeout: lec0 [ 622.052123][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 622.067853][T28992] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6226'. [ 622.750341][T29029] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6235'. [ 622.761409][T29029] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6235'. [ 624.384972][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 625.265325][T29012] netlink: 256 bytes leftover after parsing attributes in process `syz.5.6231'. [ 625.296477][T15882] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.353077][T15882] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.375403][T15882] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.403032][T15882] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.504327][T29039] openvswitch: netlink: VXLAN extension 307 out of range max 1 [ 625.539822][T29039] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6237'. [ 625.625254][T29057] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6243'. [ 625.797248][T29069] netlink: 'syz.2.6249': attribute type 11 has an invalid length. [ 625.830044][T29066] delete_channel: no stack [ 625.836030][T29071] netlink: 'syz.0.6248': attribute type 11 has an invalid length. [ 625.854640][T29071] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6248'. [ 625.860915][T29073] netlink: 'syz.4.6250': attribute type 10 has an invalid length. [ 626.004280][T29073] team0 (unregistering): Port device team_slave_0 removed [ 626.073119][T29073] team0 (unregistering): Port device team_slave_1 removed [ 626.192870][T29091] C: entered promiscuous mode [ 626.199273][T29091] team_slave_1: entered promiscuous mode [ 626.283775][T29091] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 626.395643][T29095] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 626.608520][T29112] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6262'. [ 626.631030][T29112] hsr_slave_0: left promiscuous mode [ 626.651103][T29111] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6260'. [ 626.670190][T29116] xt_hashlimit: size too large, truncated to 1048576 [ 626.679855][T29112] hsr_slave_1: left promiscuous mode [ 627.058782][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 627.066901][ C0] lec:lec_tx_timeout: lec0 [ 627.072223][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 627.102536][T29143] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6266'. [ 627.143180][T29111] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 627.323209][T29152] netlink: 172 bytes leftover after parsing attributes in process `syz.3.6265'. [ 627.670851][T29166] netlink: 'syz.2.6272': attribute type 11 has an invalid length. [ 627.812989][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 627.843760][ T53] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 627.857735][ T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 627.880396][ T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 627.915717][ T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 628.100919][T29178] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6274'. [ 629.295452][T29232] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 629.598457][T29168] chnl_net:caif_netlink_parms(): no params data found [ 629.826258][T15882] veth7: left allmulticast mode [ 629.890849][T15882] veth7: left promiscuous mode [ 629.896297][T15882] bridge8: port 1(veth7) entered disabled state [ 629.982010][ T53] Bluetooth: hci0: command tx timeout [ 630.006497][T29265] xt_HMARK: spi-set and port-set can't be combined [ 630.042856][T29267] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6292'. [ 630.602841][T15882] dvmrp6 (unregistering): left allmulticast mode [ 631.113681][T15882] bond0 (unregistering): (slave bond7): Releasing backup interface [ 631.122511][T15882] bond0 (unregistering): Released all slaves [ 631.290995][T15882] bond1 (unregistering): Released all slaves [ 631.450640][T15882] bond2 (unregistering): Released all slaves [ 631.628909][T15882] bond3 (unregistering): Released all slaves [ 631.645629][T15882] bond4 (unregistering): Released all slaves [ 631.659865][T15882] bond5 (unregistering): (slave bond6): Releasing backup interface [ 631.670769][T15882] bond5 (unregistering): Released all slaves [ 631.845234][T15882] bond6 (unregistering): Released all slaves [ 632.016373][T15882] bond7 (unregistering): Released all slaves [ 632.028647][T15882] bond8 (unregistering): Released all slaves [ 632.052710][ T53] Bluetooth: hci0: command tx timeout [ 632.078874][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 632.089355][ C0] lec:lec_tx_timeout: lec0 [ 632.096768][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 632.249893][T15882] bond9 (unregistering): Released all slaves [ 632.263663][T15882] bond10 (unregistering): Released all slaves [ 632.276933][T29248] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6288'. [ 632.301026][T29256] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 632.475966][T15882] : left promiscuous mode [ 632.486247][T29289] netlink: 'syz.4.6298': attribute type 21 has an invalid length. [ 632.496640][T29289] IPv6: NLM_F_CREATE should be specified when creating new route [ 632.594859][T15882] : left promiscuous mode [ 632.673520][T29168] bridge0: port 1(bridge_slave_0) entered blocking state [ 632.699119][T29168] bridge0: port 1(bridge_slave_0) entered disabled state [ 632.706682][T29168] bridge_slave_0: entered allmulticast mode [ 632.716048][T29301] Bluetooth: MGMT ver 1.23 [ 632.721851][T29168] bridge_slave_0: entered promiscuous mode [ 632.740832][T29168] bridge0: port 2(bridge_slave_1) entered blocking state [ 632.752600][T29168] bridge0: port 2(bridge_slave_1) entered disabled state [ 632.762070][T29168] bridge_slave_1: entered allmulticast mode [ 632.775358][T29168] bridge_slave_1: entered promiscuous mode [ 632.904844][T15882] tipc: Disabling bearer [ 632.911181][T15882] tipc: Disabling bearer [ 632.922117][T15882] tipc: Left network mode [ 632.935081][T29307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6303'. [ 632.984488][T29309] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6303'. [ 632.989806][T29168] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 633.012207][T29168] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 633.289437][T29168] team0: Port device team_slave_0 added [ 633.320931][T29168] team0: Port device team_slave_1 added [ 633.490061][T29321] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6304'. [ 633.608313][T29168] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 633.635877][T29168] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 633.710338][T29168] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 633.740733][T29168] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 633.762250][T29168] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 633.843351][T29168] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 633.966713][T29336] pim6reg: entered allmulticast mode [ 634.135182][ T53] Bluetooth: hci0: command tx timeout [ 634.161998][T29168] hsr_slave_0: entered promiscuous mode [ 634.194084][T29168] hsr_slave_1: entered promiscuous mode [ 634.227510][T29168] debugfs: 'hsr0' already exists in 'hsr' [ 634.241679][T29168] Cannot create hsr debugfs directory [ 634.412371][T29368] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6315'. [ 634.425823][T29362] netlink: 'syz.4.6314': attribute type 2 has an invalid length. [ 634.457026][T29362] netlink: 244 bytes leftover after parsing attributes in process `syz.4.6314'. [ 634.470897][T29368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6315'. [ 634.514792][T29372] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 634.556161][T29372] netlink: 'syz.2.6316': attribute type 1 has an invalid length. [ 634.623506][T29374] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6316'. [ 634.647361][T29374] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6316'. [ 634.656568][T15882] hsr_slave_0: left promiscuous mode [ 634.680380][T15882] hsr_slave_1: left promiscuous mode [ 634.911162][T29385] netlink: 'syz.3.6318': attribute type 11 has an invalid length. [ 634.923803][T29385] netlink: 199828 bytes leftover after parsing attributes in process `syz.3.6318'. [ 635.167344][T29396] netlink: 'syz.3.6320': attribute type 1 has an invalid length. [ 635.315042][T29400] netlink: 'syz.3.6320': attribute type 4 has an invalid length. [ 635.552144][T29404] netlink: 'syz.3.6320': attribute type 1 has an invalid length. [ 635.562542][T29404] netlink: 'syz.3.6320': attribute type 2 has an invalid length. [ 636.218587][ T53] Bluetooth: hci0: command tx timeout [ 636.382829][T29372] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 636.442711][T29396] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 636.627104][T29417] tipc: Enabling of bearer rejected, failed to enable media [ 636.659364][T29415] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 636.765105][T29415] openvswitch: netlink: IP tunnel TTL not specified. [ 637.157964][T15882] IPVS: stop unused estimator thread 0... [ 637.376709][T29460] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 637.457443][T29469] netlink: 'syz.2.6336': attribute type 3 has an invalid length. [ 637.595864][T29474] __nla_validate_parse: 5 callbacks suppressed [ 637.595886][T29474] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6338'. [ 637.888819][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 637.898712][ C0] lec:lec_tx_timeout: lec0 [ 637.904637][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 638.085629][T29491] netlink: 'syz.2.6344': attribute type 2 has an invalid length. [ 638.134591][T29491] netlink: 'syz.2.6344': attribute type 4 has an invalid length. [ 638.216271][T29168] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 638.261938][T29500] netlink: 'syz.5.6347': attribute type 15 has an invalid length. [ 638.319092][T29168] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 638.339462][T29500] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6347'. [ 638.419042][T29168] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 638.575746][T29168] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 639.137925][T29168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 639.193197][T29168] 8021q: adding VLAN 0 to HW filter on device team0 [ 639.234390][T15871] bridge0: port 1(bridge_slave_0) entered blocking state [ 639.242193][T15871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 639.293965][T29558] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6355'. [ 639.330829][T15871] bridge0: port 2(bridge_slave_1) entered blocking state [ 639.341406][T15871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 639.376553][T29561] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6357'. [ 639.627595][T29574] syzkaller0: entered promiscuous mode [ 639.634506][T29576] siw: device registration error -23 [ 639.649332][T29574] syzkaller0: entered allmulticast mode [ 639.834585][T29581] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6361'. [ 640.025908][T29168] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 640.125758][T29168] veth0_vlan: entered promiscuous mode [ 640.183285][T29168] veth1_vlan: entered promiscuous mode [ 640.300099][T29168] veth0_macvtap: entered promiscuous mode [ 640.328198][T29168] veth1_macvtap: entered promiscuous mode [ 640.402725][T29168] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 640.446628][T29168] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 640.535784][ T7412] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.600405][ T7412] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.699384][ T67] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.739034][T22686] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.953377][T22687] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 641.014004][T22687] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 641.187699][T15871] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 641.207698][T15871] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 641.295319][T29647] xt_TCPMSS: Only works on TCP SYN packets [ 641.403743][T29655] netlink: 168 bytes leftover after parsing attributes in process `syz.0.6270'. [ 641.610067][T29664] ip6gre1: entered allmulticast mode [ 641.630535][T29669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6380'. [ 641.644126][T29671] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6380'. [ 641.698466][T29669] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6380'. [ 641.820297][T29680] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6383'. [ 641.867625][T29680] netlink: 'syz.3.6383': attribute type 5 has an invalid length. [ 642.495860][T29716] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 642.671576][T29730] x_tables: duplicate underflow at hook 3 [ 642.677938][T29730] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20003 [ 642.897785][T29750] netlink: 'syz.4.6400': attribute type 39 has an invalid length. [ 642.929319][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 642.940710][ C0] lec:lec_tx_timeout: lec0 [ 642.946043][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 643.110764][T29756] __nla_validate_parse: 7 callbacks suppressed [ 643.110782][T29756] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6403'. [ 643.153411][T29756] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 643.161425][T29758] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6404'. [ 643.171418][T29756] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 643.171565][T29756] team0: Failed to send options change via netlink (err -105) [ 643.171580][T29756] team0: Port device batadv1 added [ 643.201884][T29760] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6405'. [ 643.203845][T29758] bridge_slave_0: left allmulticast mode [ 643.223071][T29758] bridge_slave_0: left promiscuous mode [ 643.229396][T29758] bridge0: port 1(bridge_slave_0) entered disabled state [ 643.243224][T29758] bridge_slave_1: left allmulticast mode [ 643.249688][T29758] bridge_slave_1: left promiscuous mode [ 643.257507][T29758] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.306737][T29758] bond0: (slave bond_slave_0): Releasing backup interface [ 643.321462][T29758] bond0: (slave bond_slave_1): Releasing backup interface [ 643.336390][T29758] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.367948][T29758] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 643.392000][T29763] netlink: 'syz.0.6406': attribute type 3 has an invalid length. [ 643.410717][T29763] netlink: 766 bytes leftover after parsing attributes in process `syz.0.6406'. [ 643.446796][T29762] IPVS: length: 190 != 8 [ 643.511400][T29775] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6412'. [ 643.600123][T29775] macvtap1: entered promiscuous mode [ 643.608921][T29775] vlan0: entered promiscuous mode [ 643.625011][T29775] macvtap1: entered allmulticast mode [ 643.638707][T29775] vlan0: entered allmulticast mode [ 643.653227][T29775] veth0_vlan: entered allmulticast mode [ 643.822451][T29791] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6415'. [ 643.879142][T29791] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6415'. [ 643.954609][ T30] audit: type=1804 audit(1769761633.704:8): pid=29795 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.6418" name="/newroot/586/cgroup.controllers" dev="tmpfs" ino=3011 res=1 errno=0 [ 644.039949][ T30] audit: type=1800 audit(1769761633.704:9): pid=29795 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.6418" name="cgroup.controllers" dev="tmpfs" ino=3011 res=0 errno=0 [ 644.143468][T29805] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6421'. [ 644.197728][T29805] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6421'. [ 644.217026][T29805] gretap1: entered promiscuous mode [ 644.250946][T29805] gretap1: entered allmulticast mode [ 644.555800][T29826] tipc: Started in network mode [ 644.573582][T29828] IPVS: sync thread started: state = BACKUP, mcast_ifn = xfrm0, syncid = 4, id = 0 [ 644.588669][T29826] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 644.623935][T29826] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 644.646965][T29826] tipc: Enabled bearer , priority 10 [ 644.659727][T29833] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6431'. [ 644.673441][T29831] netlink: 'syz.2.6429': attribute type 5 has an invalid length. [ 644.703817][T29831] geneve2: entered promiscuous mode [ 644.719015][T29831] geneve2: entered allmulticast mode [ 644.728398][T22686] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 644.758021][T22686] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 644.799485][T22686] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 644.843256][T22686] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 645.054982][T29855] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 645.104793][ T7412] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 645.784053][ T1210] tipc: Node number set to 1 [ 645.792338][T29903] openvswitch: netlink: IPv6 tunnel dst address is zero [ 645.862113][T29912] sctp: [Deprecated]: syz.0.6455 (pid 29912) Use of int in max_burst socket option. [ 645.862113][T29912] Use struct sctp_assoc_value instead [ 645.938844][T29921] netlink: 'syz.5.6458': attribute type 21 has an invalid length. [ 646.432846][T29950] bond1: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 646.507836][T29950] bond1 (unregistering): Released all slaves [ 646.585344][T29968] syzkaller0: entered promiscuous mode [ 646.595816][T29968] syzkaller0: entered allmulticast mode [ 646.716832][T29976] netlink: 'syz.2.6474': attribute type 12 has an invalid length. [ 646.809624][T29980] x_tables: duplicate underflow at hook 3 [ 646.816356][T29980] netlink: 'syz.5.6475': attribute type 7 has an invalid length. [ 646.839778][T29980] netlink: 'syz.5.6475': attribute type 7 has an invalid length. [ 646.891353][T29982] vlan2: entered promiscuous mode [ 646.915685][T29982] geneve1: entered promiscuous mode [ 646.943326][T29982] vlan2: entered allmulticast mode [ 646.969451][T29982] geneve1: entered allmulticast mode [ 647.057207][T29995] netlink: 'syz.3.6481': attribute type 3 has an invalid length. [ 647.520679][T30024] netlink: 'syz.3.6493': attribute type 1 has an invalid length. [ 647.694529][T30024] 8021q: adding VLAN 0 to HW filter on device bond1 [ 647.736078][T30047] blkio.reset_stats is deprecated [ 647.797320][T30049] bond1: (slave veth0_to_bond): making interface the new active one [ 647.829763][T30049] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 647.958901][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 647.967465][ C0] lec:lec_tx_timeout: lec0 [ 647.972640][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 647.995908][T30024] 8021q: adding VLAN 0 to HW filter on device bond2 [ 648.086730][T30024] bond1: (slave bond2): Enslaving as an active interface with a down link [ 648.131915][ T5844] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 648.145355][ T5844] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 648.156619][ T5844] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 648.166364][ T5844] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 648.177360][ T5844] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 648.220951][T30067] __nla_validate_parse: 22 callbacks suppressed [ 648.220971][T30067] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6501'. [ 648.309321][T30068] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6501'. [ 648.337003][T30067] netlink: 'syz.2.6501': attribute type 1 has an invalid length. [ 648.395290][T30067] netlink: 'syz.2.6501': attribute type 2 has an invalid length. [ 648.424747][T30068] netlink: 'syz.2.6501': attribute type 1 has an invalid length. [ 648.468872][T30068] netlink: 'syz.2.6501': attribute type 2 has an invalid length. [ 648.542122][T30078] netlink: 'syz.4.6504': attribute type 1 has an invalid length. [ 648.683202][T30080] netlink: 'syz.2.6505': attribute type 11 has an invalid length. [ 648.752278][T30080] netlink: 'syz.2.6505': attribute type 4 has an invalid length. [ 648.818363][T30080] netlink: 'syz.2.6505': attribute type 5 has an invalid length. [ 648.826505][T30080] netlink: 'syz.2.6505': attribute type 6 has an invalid length. [ 648.827089][T30084] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6505'. [ 648.835313][T30080] netlink: 199748 bytes leftover after parsing attributes in process `syz.2.6505'. [ 648.884265][T30089] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 648.904415][T30091] netlink: 'syz.4.6508': attribute type 3 has an invalid length. [ 648.916242][T30083] netlink: 'syz.0.6506': attribute type 1 has an invalid length. [ 648.924284][T30091] netlink: 'syz.4.6508': attribute type 3 has an invalid length. [ 648.950404][T30083] netlink: 'syz.0.6506': attribute type 2 has an invalid length. [ 648.967226][T30089] netlink: 252 bytes leftover after parsing attributes in process `syz.0.6506'. [ 649.183622][T30107] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6511'. [ 649.271766][T30062] chnl_net:caif_netlink_parms(): no params data found [ 649.323311][T30114] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6513'. [ 649.414023][T22687] bond1: (slave netdevsim0): Releasing active interface [ 649.423011][T22687] macvlan2: entered promiscuous mode [ 649.479152][T30062] bridge0: port 1(bridge_slave_0) entered blocking state [ 649.486513][T30062] bridge0: port 1(bridge_slave_0) entered disabled state [ 649.495069][T30062] bridge_slave_0: entered allmulticast mode [ 649.504156][T30062] bridge_slave_0: entered promiscuous mode [ 649.514102][T30062] bridge0: port 2(bridge_slave_1) entered blocking state [ 649.522203][T30062] bridge0: port 2(bridge_slave_1) entered disabled state [ 649.530556][T30062] bridge_slave_1: entered allmulticast mode [ 649.538683][T30062] bridge_slave_1: entered promiscuous mode [ 649.596590][T30062] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 649.623653][T30062] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 649.922866][T22687] bond2 (unregistering): (slave gretap1): Releasing active interface [ 650.020157][T22687] dvmrp6 (unregistering): left allmulticast mode [ 650.219952][ T5844] Bluetooth: hci3: command tx timeout [ 650.553753][T22687] bond1 (unregistering): (slave macvlan2): Releasing active interface [ 650.563933][T22687] macvlan2 (unregistering): left promiscuous mode [ 650.574679][T22687] bond0 (unregistering): Released all slaves [ 650.751540][T22687] bond1 (unregistering): Released all slaves [ 650.764701][T22687] bond2 (unregistering): Released all slaves [ 650.777531][T22687] bond3 (unregistering): Released all slaves [ 650.811225][T30062] team0: Port device team_slave_0 added [ 650.823327][T30062] team0: Port device team_slave_1 added [ 650.872306][T30062] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 650.881849][T30062] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 650.917960][T30062] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 650.932291][T30062] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 650.940211][T30062] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 650.967181][T30062] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 650.979187][T22687] : left promiscuous mode [ 651.024827][T30062] hsr_slave_0: entered promiscuous mode [ 651.032524][T30062] hsr_slave_1: entered promiscuous mode [ 651.039570][T30062] debugfs: 'hsr0' already exists in 'hsr' [ 651.045881][T30062] Cannot create hsr debugfs directory [ 651.073462][T22687] tipc: Disabling bearer [ 651.081152][T22687] tipc: Left network mode [ 651.511467][T22687] hsr_slave_0: left promiscuous mode [ 651.518345][T22687] hsr_slave_1: left promiscuous mode [ 651.566029][T22687] pim6reg (unregistering): left allmulticast mode [ 651.732433][T15871] smc: removing ib device  [ 651.789097][T30086] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 652.101940][T30136] xt_ecn: cannot match TCP bits for non-tcp packets [ 652.297282][ T5844] Bluetooth: hci3: command tx timeout [ 652.988839][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 652.997079][ C0] lec:lec_tx_timeout: lec0 [ 653.001924][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 653.585377][T30176] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6528'. [ 653.621214][T30179] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6527'. [ 653.717169][T30179] validate_nla: 1 callbacks suppressed [ 653.717191][T30179] netlink: 'syz.4.6527': attribute type 9 has an invalid length. [ 653.798030][T30179] netlink: 'syz.4.6527': attribute type 11 has an invalid length. [ 653.870939][T30179] netlink: 'syz.4.6527': attribute type 12 has an invalid length. [ 653.905832][T30179] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.6527'. [ 653.949036][T30179] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6527'. [ 654.058868][T30062] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 654.169451][T30062] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 654.280498][T30062] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 654.307782][T30207] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6535'. [ 654.338637][T30062] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 654.357043][T30209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6535'. [ 654.368945][ T5844] Bluetooth: hci3: command tx timeout [ 654.912395][T30062] 8021q: adding VLAN 0 to HW filter on device bond0 [ 654.994727][T30062] 8021q: adding VLAN 0 to HW filter on device team0 [ 655.077506][T15882] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.085500][T15882] bridge0: port 1(bridge_slave_0) entered forwarding state [ 655.175089][ T7412] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.182332][ T7412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 655.443090][T30260] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6547'. [ 655.648399][T30268] IPv6: sit1: Disabled Multicast RS [ 655.717948][T30268] sit1: entered allmulticast mode [ 656.196209][T30062] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 656.448864][ T5844] Bluetooth: hci3: command tx timeout [ 657.114815][T30340] IPVS: length: 246 != 24 [ 657.249197][T30062] veth0_vlan: entered promiscuous mode [ 657.290420][T30062] veth1_vlan: entered promiscuous mode [ 657.502037][T30062] veth0_macvtap: entered promiscuous mode [ 657.533313][T30062] veth1_macvtap: entered promiscuous mode [ 657.590319][T30062] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 657.629806][T30062] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 657.677901][ T7412] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.692913][T22687] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.942894][T22687] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.952235][T22687] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.008830][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 658.017312][ C0] lec:lec_tx_timeout: lec0 [ 658.022395][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 658.102738][T22687] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.151284][T22687] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.236296][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.272102][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.563319][T30401] netlink: 'syz.3.6575': attribute type 2 has an invalid length. [ 658.692753][T30419] xt_limit: Overflow, try lower: 271964/0 [ 658.924348][T30436] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6584'. [ 658.986492][T30444] veth0: entered promiscuous mode [ 659.002826][T30447] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6584'. [ 659.226456][T30455] IPVS: stopping backup sync thread 29828 ... [ 659.393614][T30461] netlink: 14 bytes leftover after parsing attributes in process `syz.3.6590'. [ 659.733265][T30433] veth0: left promiscuous mode [ 659.966802][T30466] siw: device registration error -23 [ 660.014357][T30468] netlink: 172 bytes leftover after parsing attributes in process `syz.3.6593'. [ 660.041418][T30473] openvswitch: netlink: Key type 31 is not supported [ 660.052400][T30473] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6595'. [ 660.219877][T30473] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 660.227613][T30482] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6597'. [ 660.232289][T30473] netlink: 148 bytes leftover after parsing attributes in process `syz.5.6595'. [ 660.694523][T30506] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6605'. [ 660.711451][T30482] hsr_slave_0 (unregistering): left promiscuous mode [ 660.735411][T30511] netlink: 40 bytes leftover after parsing attributes in process `syz.5.6602'. [ 660.790781][T30504] netlink: 76 bytes leftover after parsing attributes in process `syz.5.6602'. [ 660.856384][T30517] netlink: 'syz.2.6607': attribute type 4 has an invalid length. [ 660.862480][T30518] netlink: 'syz.2.6607': attribute type 4 has an invalid length. [ 661.089752][ T53] Bluetooth: hci3: command 0x0405 tx timeout [ 661.555470][T30566] : entered promiscuous mode [ 661.823910][T30580] x_tables: duplicate entry at hook 2 [ 663.028781][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 663.037376][ C0] lec:lec_tx_timeout: lec0 [ 663.042469][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 663.095078][T30667] netlink: 'syz.0.6635': attribute type 1 has an invalid length. [ 663.167556][T30667] netlink: 'syz.0.6635': attribute type 1 has an invalid length. [ 663.284353][T30675] IPVS: set_ctl: invalid protocol: 46 172.30.0.6:20000 [ 663.485796][T30691] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 664.056289][T30727] pim6reg1: entered allmulticast mode [ 664.110824][T30733] __nla_validate_parse: 10 callbacks suppressed [ 664.110847][T30733] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6652'. [ 664.138667][T30735] netlink: 156 bytes leftover after parsing attributes in process `syz.0.6654'. [ 664.177949][T30733] openvswitch: netlink: Flow key attr not present in new flow. [ 664.329037][T30745] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6652'. [ 664.368289][T30745] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6652'. [ 664.819240][T30759] netlink: 5 bytes leftover after parsing attributes in process `syz.5.6659'. [ 664.959649][T30766] netlink: 'syz.4.6658': attribute type 1 has an invalid length. [ 665.550592][T30759] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 665.562576][T30759] 0ªî{X¹¦: entered allmulticast mode [ 665.573543][T30759] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 665.900694][T30804] netlink: 'syz.5.6668': attribute type 1 has an invalid length. [ 665.909047][T30803] netlink: 'syz.5.6668': attribute type 1 has an invalid length. [ 665.917349][T30805] 8021q: VLANs not supported on lo [ 665.934896][T30805] : renamed from dummy0 (while UP) [ 666.022983][T30807] netlink: 'syz.2.6669': attribute type 24 has an invalid length. [ 666.130710][T30813] netlink: 'syz.4.6671': attribute type 3 has an invalid length. [ 666.140884][T30813] netlink: 766 bytes leftover after parsing attributes in process `syz.4.6671'. [ 666.183631][T30810] syzkaller0: entered promiscuous mode [ 666.210215][T30810] syzkaller0: entered allmulticast mode [ 666.253878][T30818] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6672'. [ 666.596173][T30840] netlink: 380 bytes leftover after parsing attributes in process `syz.5.6675'. [ 666.717687][T30846] netlink: 348 bytes leftover after parsing attributes in process `syz.2.6678'. [ 667.387820][T30836] Can't find ip_set type [ 667.808496][T30908] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6688'. [ 668.010729][T30923] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 668.018003][T30921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 668.059033][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 668.067563][ C0] lec:lec_tx_timeout: lec0 [ 668.072910][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 668.126248][T30933] netlink: 'syz.5.6693': attribute type 1 has an invalid length. [ 668.436200][T30943] tc_dump_action: action bad kind [ 668.843292][T30969] syzkaller0: entered promiscuous mode [ 668.859022][T30969] syzkaller0: entered allmulticast mode [ 669.923588][T31054] __nla_validate_parse: 4 callbacks suppressed [ 669.923613][T31054] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.6718'. [ 670.297475][T31069] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6722'. [ 670.388071][T31076] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6724'. [ 670.481496][T31092] netlink: 212336 bytes leftover after parsing attributes in process `syz.4.6726'. [ 670.693533][T31098] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6728'. [ 671.059376][T31117] netlink: 'syz.5.6734': attribute type 1 has an invalid length. [ 671.095431][T31117] netlink: 'syz.5.6734': attribute type 4 has an invalid length. [ 671.123735][T31120] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6735'. [ 671.136813][T31117] netlink: 9422 bytes leftover after parsing attributes in process `syz.5.6734'. [ 671.157895][T31120] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6735'. [ 671.190748][T31120] netlink: 'syz.4.6735': attribute type 19 has an invalid length. [ 671.359508][T31135] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6739'. [ 671.642976][T31145] netlink: 1 bytes leftover after parsing attributes in process `syz.4.6741'. [ 671.694816][T31147] netlink: 'syz.5.6742': attribute type 27 has an invalid length. [ 672.090565][ T5491] veth0_vlan: left promiscuous mode [ 672.184230][ T5491] veth0_vlan: entered promiscuous mode [ 672.531228][T31202] sctp: [Deprecated]: syz.0.6754 (pid 31202) Use of int in maxseg socket option. [ 672.531228][T31202] Use struct sctp_assoc_value instead [ 672.710265][T31217] netlink: 'syz.2.6759': attribute type 1 has an invalid length. [ 672.722557][T31217] netlink: 'syz.2.6759': attribute type 1 has an invalid length. [ 672.939123][T31228] bridge2: entered promiscuous mode [ 672.945931][T31228] bridge2: entered allmulticast mode [ 672.996303][T31228] team0: Port device bridge2 added [ 673.047682][T31233] bridge0: port 1(team0) entered blocking state [ 673.066779][T31233] bridge0: port 1(team0) entered disabled state [ 673.088987][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 673.096249][T31233] team0: entered allmulticast mode [ 673.102316][ C0] lec:lec_tx_timeout: lec0 [ 673.102853][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 673.124557][T31233] C: entered allmulticast mode [ 673.151942][T31233] team_slave_1: entered allmulticast mode [ 673.175860][T31233] team0: left allmulticast mode [ 673.238918][T31233] C: left allmulticast mode [ 673.245959][T31233] team_slave_1: left allmulticast mode [ 673.957553][T31285] set match dimension is over the limit! [ 673.966497][T31285] openvswitch: netlink: Flow actions attr not present in new flow. [ 674.162329][T31294] bond0: entered promiscuous mode [ 674.167877][T31294] bond_slave_0: entered promiscuous mode [ 674.220739][T31294] bond_slave_1: entered promiscuous mode [ 674.271635][ T5844] block nbd0: Receive control failed (result -32) [ 674.825290][T31335] xt_CT: You must specify a L4 protocol and not use inversions on it [ 675.033333][T31343] netlink: 'syz.0.6789': attribute type 16 has an invalid length. [ 675.056496][T31343] netlink: 'syz.0.6789': attribute type 17 has an invalid length. [ 675.092369][T31345] __nla_validate_parse: 22 callbacks suppressed [ 675.092396][T31345] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6790'. [ 675.117672][T31346] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6789'. [ 675.197726][T31343] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 675.333529][T31345] 8021q: adding VLAN 0 to HW filter on device bond1 [ 675.477192][T31367] netlink: 'syz.4.6794': attribute type 32 has an invalid length. [ 676.328442][T31417] netlink: 14544 bytes leftover after parsing attributes in process `syz.2.6804'. [ 676.607464][T31444] syzkaller0: entered promiscuous mode [ 676.616760][T31444] syzkaller0: entered allmulticast mode [ 677.062722][T31463] netlink: 112 bytes leftover after parsing attributes in process `syz.5.6816'. [ 677.101392][T31463] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6816'. [ 677.111538][T31463] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6816'. [ 677.131676][T31463] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6816'. [ 677.140870][T31463] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6816'. [ 677.481778][T31482] openvswitch: netlink: Flow actions attr not present in new flow. [ 677.615965][T31492] nft_compat: unsupported protocol 0 [ 677.801767][T31504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6824'. [ 677.991076][T31507] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6825'. [ 678.562078][T31549] netlink: 'syz.3.6836': attribute type 10 has an invalid length. [ 678.785157][T31562] netlink: 'syz.4.6840': attribute type 1 has an invalid length. [ 678.814570][T31562] syz.4.6840: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 678.830345][T31562] CPU: 1 UID: 0 PID: 31562 Comm: syz.4.6840 Not tainted syzkaller #0 PREEMPT(full) [ 678.830376][T31562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 678.830387][T31562] Call Trace: [ 678.830395][T31562] [ 678.830402][T31562] dump_stack_lvl+0xe8/0x150 [ 678.830436][T31562] warn_alloc+0x249/0x340 [ 678.830459][T31562] ? stack_trace_save+0xa9/0x100 [ 678.830484][T31562] ? __pfx_warn_alloc+0x10/0x10 [ 678.830512][T31562] ? kasan_save_track+0x4f/0x80 [ 678.830529][T31562] ? kasan_save_track+0x3e/0x80 [ 678.830542][T31562] ? __kasan_kmalloc+0x93/0xb0 [ 678.830557][T31562] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 678.830575][T31562] ? xskq_create+0x56/0x170 [ 678.830592][T31562] ? xsk_setsockopt+0x54c/0x990 [ 678.830614][T31562] ? do_sock_setsockopt+0x17c/0x1b0 [ 678.830636][T31562] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 678.830654][T31562] ? do_syscall_64+0xe2/0xf80 [ 678.830677][T31562] __vmalloc_node_range_noprof+0x132/0x1730 [ 678.830729][T31562] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 678.830755][T31562] ? __kasan_kmalloc+0x93/0xb0 [ 678.830780][T31562] vmalloc_user_noprof+0xad/0xe0 [ 678.830799][T31562] ? xskq_create+0xbf/0x170 [ 678.830817][T31562] xskq_create+0xbf/0x170 [ 678.830836][T31562] xsk_init_queue+0xad/0x110 [ 678.830865][T31562] xsk_setsockopt+0x54c/0x990 [ 678.830892][T31562] ? __pfx_xsk_setsockopt+0x10/0x10 [ 678.830915][T31562] ? __pfx_aa_sk_perm+0x10/0x10 [ 678.830939][T31562] ? aa_sock_opt_perm+0xff/0x1a0 [ 678.830964][T31562] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 678.830982][T31562] ? __pfx_xsk_setsockopt+0x10/0x10 [ 678.831008][T31562] do_sock_setsockopt+0x17c/0x1b0 [ 678.831034][T31562] __x64_sys_setsockopt+0x13d/0x1b0 [ 678.831070][T31562] do_syscall_64+0xe2/0xf80 [ 678.831087][T31562] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.831106][T31562] ? trace_irq_disable+0x37/0x100 [ 678.831123][T31562] ? clear_bhb_loop+0x60/0xb0 [ 678.831145][T31562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.831162][T31562] RIP: 0033:0x7fe42339aeb9 [ 678.831179][T31562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.831195][T31562] RSP: 002b:00007fe42423b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 678.831220][T31562] RAX: ffffffffffffffda RBX: 00007fe423615fa0 RCX: 00007fe42339aeb9 [ 678.831235][T31562] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009 [ 678.831246][T31562] RBP: 00007fe423408c1f R08: 0000000000000004 R09: 0000000000000000 [ 678.831257][T31562] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 678.831269][T31562] R13: 00007fe423616038 R14: 00007fe423615fa0 R15: 00007fff9581e978 [ 678.831296][T31562] [ 678.831373][T31562] Mem-Info: [ 678.839799][T31567] netlink: 'syz.5.6841': attribute type 1 has an invalid length. [ 678.931984][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5810 ms [ 678.932025][ C0] lec:lec_tx_timeout: lec0 [ 678.939858][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 678.989013][T31562] active_anon:8768 inactive_anon:0 isolated_anon:0 [ 678.989013][T31562] active_file:2644 inactive_file:40652 isolated_file:0 [ 678.989013][T31562] unevictable:768 dirty:55 writeback:0 [ 678.989013][T31562] slab_reclaimable:13007 slab_unreclaimable:117204 [ 678.989013][T31562] mapped:29308 shmem:1398 pagetables:2599 [ 678.989013][T31562] sec_pagetables:0 bounce:0 [ 678.989013][T31562] kernel_misc_reclaimable:0 [ 678.989013][T31562] free:1288128 free_pcp:19302 free_cma:0 [ 679.261132][T31562] Node 0 active_anon:34960kB inactive_anon:0kB active_file:10576kB inactive_file:162412kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:96844kB dirty:220kB writeback:0kB shmem:4052kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15084kB pagetables:10052kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 679.353889][T31562] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:20480kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 679.452247][T31562] Node 0 DMA free:11248kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 679.507442][T31562] lowmem_reserve[]: 0 2494 2495 2495 2495 [ 679.528947][T31562] Node 0 DMA32 free:1309052kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:34660kB inactive_anon:0kB active_file:10576kB inactive_file:162412kB unevictable:1536kB writepending:220kB zspages:0kB present:3129332kB managed:2554124kB mlocked:0kB bounce:0kB free_pcp:45592kB local_pcp:25056kB free_cma:0kB [ 679.582971][T31562] lowmem_reserve[]: 0 0 1 1 1 [ 679.588040][T31562] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 679.625868][T31562] lowmem_reserve[]: 0 0 0 0 0 [ 679.631986][T31562] Node 1 Normal free:3835244kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:29704kB local_pcp:19268kB free_cma:0kB [ 679.671139][T31562] lowmem_reserve[]: 0 0 0 0 0 [ 679.677927][T31562] Node 0 DMA: 0*4kB 2*8kB (U) 2*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11248kB [ 679.696997][T31562] Node 0 DMA32: 9999*4kB (UM) 7826*8kB (UME) 4373*16kB (UME) 539*32kB (UME) 286*64kB (UME) 339*128kB (UME) 733*256kB (UM) 533*512kB (UME) 393*1024kB (UME) 81*2048kB (UM) 7*4096kB (UM) = 1309052kB [ 679.719281][T31562] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 679.733128][T31562] Node 1 Normal: 172*4kB (UM) 56*8kB (UME) 49*16kB (UME) 153*32kB (UME) 44*64kB (UME) 8*128kB (UME) 10*256kB (UME) 7*512kB (UM) 5*1024kB (UME) 4*2048kB (UE) 929*4096kB (UM) = 3835296kB [ 679.756104][T31562] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 679.766661][T31562] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 679.777270][T31562] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 679.788707][T31562] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 679.798522][T31562] 44689 total pagecache pages [ 679.810950][T31562] 0 pages in swap cache [ 679.815707][T31562] Free swap = 124996kB [ 679.820539][T31562] Total swap = 124996kB [ 679.825674][T31562] 2097051 pages RAM [ 679.831261][T31562] 0 pages HighMem/MovableOnly [ 679.836093][T31562] 426622 pages reserved [ 679.840725][T31562] 0 pages cma reserved [ 679.849333][T31585] 8021q: VLANs not supported on sit0 [ 680.047103][T31613] netlink: 'syz.3.6848': attribute type 15 has an invalid length. [ 682.936569][T31612] dvmrp0: entered allmulticast mode [ 682.945747][T31618] __nla_validate_parse: 4 callbacks suppressed [ 682.945767][T31618] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6851'. [ 682.996360][T31618] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6851'. [ 683.556549][T31655] openvswitch: netlink: IP tunnel dst address not specified [ 683.749185][T31661] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 683.885272][T31636] lec:lec_atm_close: lec0: Shut down! [ 683.913152][T31665] netlink: 96 bytes leftover after parsing attributes in process `syz.3.6864'. [ 683.923951][T31665] 8021q: VLANs not supported on gre0 [ 684.135609][T31684] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.6866'. [ 684.361233][T31700] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 684.747682][T31719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6875'. [ 684.840447][T31716] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6874'. [ 684.946704][T31725] openvswitch: netlink: Actions may not be safe on all matching packets [ 685.006400][T31727] dvmrp0: entered allmulticast mode [ 685.017813][T31727] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 685.100883][T31731] netlink: 144 bytes leftover after parsing attributes in process `syz.2.6879'. [ 685.218694][T31738] netlink: 212328 bytes leftover after parsing attributes in process `syz.2.6882'. [ 685.240320][T31738] netlink: Conntrack attr has 4 unknown bytes [ 685.503530][T31764] syzkaller0: entered promiscuous mode [ 685.509476][T31764] syzkaller0: entered allmulticast mode [ 685.813199][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 686.368935][ T5844] Bluetooth: hci0: command 0x0401 tx timeout [ 686.954872][T31671] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 687.223125][T31774] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6889'. [ 687.263519][T31776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6891'. [ 687.426872][T31790] openvswitch: netlink: Key type 177 is out of range max 32 [ 687.924898][T31824] batman_adv: batadv0: Adding interface: geneve2 [ 687.942384][T31824] batman_adv: batadv0: Interface activated: geneve2 [ 688.017445][T31831] netlink: 'syz.2.6902': attribute type 11 has an invalid length. [ 688.475299][T31864] netlink: 'syz.5.6907': attribute type 33 has an invalid length. [ 688.494592][T31862] Bluetooth: MGMT ver 1.23 [ 688.500583][T31862] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 688.540405][T31854] __nla_validate_parse: 2 callbacks suppressed [ 688.540428][T31854] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6907'. [ 688.620344][T31854] netlink: 'syz.5.6907': attribute type 3 has an invalid length. [ 688.679282][T31870] SET target dimension over the limit! [ 688.773729][T31873] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.6913'. [ 688.790286][T31878] sctp: [Deprecated]: syz.5.6915 (pid 31878) Use of int in max_burst socket option. [ 688.790286][T31878] Use struct sctp_assoc_value instead [ 688.813164][T31873] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 688.939029][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5060 ms [ 688.948537][ C0] lec:lec_tx_timeout: lec0 [ 688.953785][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 689.066744][T31900] xt_hashlimit: invalid interval [ 689.349026][T31914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6924'. [ 689.401142][T31914] netlink: 'syz.4.6924': attribute type 1 has an invalid length. [ 689.497834][T31921] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 690.197355][T31957] netlink: 324 bytes leftover after parsing attributes in process `syz.3.6930'. [ 690.205407][T31950] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 690.250056][T31950] bond3 (unregistering): Released all slaves [ 690.395126][T31958] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6930'. [ 690.445249][T31958] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6930'. [ 690.648513][T31980] veth0: entered promiscuous mode [ 690.691941][T31980] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6937'. [ 690.713893][T31985] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6939'. [ 690.810653][T31987] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6940'. [ 691.163114][T32017] syzkaller0: entered promiscuous mode [ 691.169235][T32017] syzkaller0: entered allmulticast mode [ 691.478488][T32039] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6949'. [ 691.634444][T32056] SET target dimension over the limit! [ 691.752760][T32061] syzkaller0: entered allmulticast mode [ 692.048223][T32081] netlink: 'syz.5.6962': attribute type 30 has an invalid length. [ 692.154662][T32081] bond1: option arp_missed_max: invalid value (0) [ 692.199011][T32081] bond1: option arp_missed_max: allowed values 1 - 255 [ 692.210305][T32081] bond1 (unregistering): Released all slaves [ 693.969039][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 693.977680][ C0] lec:lec_tx_timeout: lec0 [ 693.983462][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 694.961380][T32074] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 695.182437][T32171] __nla_validate_parse: 7 callbacks suppressed [ 695.182457][T32171] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6973'. [ 695.197280][T32175] netlink: 'syz.4.6974': attribute type 28 has an invalid length. [ 695.214595][T32176] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6975'. [ 695.221175][T32171] C: left promiscuous mode [ 695.225875][T32176] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6975'. [ 695.239071][T32171] team_slave_1: left promiscuous mode [ 695.268876][T32175] netlink: 'syz.4.6974': attribute type 3 has an invalid length. [ 695.279305][T32175] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6974'. [ 695.384773][T32175] syzkaller0: entered promiscuous mode [ 695.405344][T32175] syzkaller0: entered allmulticast mode [ 695.430465][T32186] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6977'. [ 695.435769][T32189] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6978'. [ 695.455983][T32186] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6977'. [ 695.544198][T32186] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6977'. [ 695.560453][T32186] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6977'. [ 695.797660][T32214] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6980'. [ 696.168170][T32233] xt_TCPMSS: Only works on TCP SYN packets [ 698.375260][T32184] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 698.998751][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 699.008464][ C0] lec:lec_tx_timeout: lec0 [ 699.013818][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 699.046900][T32299] tipc: Failed to remove unknown binding: 66,0,0/0:847839/847840 [ 699.056151][T32299] tipc: Failed to remove unknown binding: 66,0,0/0:847839/847840 [ 699.210705][T32308] nbd: must specify at least one socket [ 699.273730][T32304] netlink: 'syz.5.7002': attribute type 2 has an invalid length. [ 699.386942][T32322] pimreg: entered allmulticast mode [ 699.574303][T32332] IPv6: sit1: Disabled Multicast RS [ 699.597262][T32332] sit1: entered allmulticast mode [ 700.264157][T32380] __nla_validate_parse: 17 callbacks suppressed [ 700.264176][T32380] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7019'. [ 700.452075][T32388] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.7021'. [ 700.763170][T32404] bond17: Removing last ns target with arp_interval on [ 700.795368][T32417] netlink: 44 bytes leftover after parsing attributes in process `syz.5.7026'. [ 701.063700][T32407] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7024'. [ 701.461703][T32447] tipc: Enabling of bearer rejected, already enabled [ 701.480003][T32456] netlink: 44 bytes leftover after parsing attributes in process `syz.0.7033'. [ 701.522443][T32456] netlink: 43 bytes leftover after parsing attributes in process `syz.0.7033'. [ 701.550428][T32456] netlink: 'syz.0.7033': attribute type 6 has an invalid length. [ 701.571816][T32461] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7032'. [ 701.624937][T32456] netlink: 'syz.0.7033': attribute type 5 has an invalid length. [ 701.675072][T32462] syzkaller0: entered promiscuous mode [ 701.709132][T32456] netlink: 43 bytes leftover after parsing attributes in process `syz.0.7033'. [ 701.738011][T32462] syzkaller0: entered allmulticast mode [ 701.741931][T32472] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7037'. [ 701.873733][T32477] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7037'. [ 702.094636][T32483] bridge0: entered allmulticast mode [ 702.231926][T32483] syzkaller0: entered promiscuous mode [ 702.247415][T32483] syzkaller0: entered allmulticast mode [ 702.291365][T32497] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 702.326647][T32497] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 702.337620][T32497] gretap1: entered promiscuous mode [ 702.344504][T32497] gretap1: entered allmulticast mode [ 703.256937][ T53] Bluetooth: hci5: command 0x0406 tx timeout [ 704.029425][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 704.037626][ C0] lec:lec_tx_timeout: lec0 [ 704.042245][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 704.139046][ T5844] Bluetooth: hci3: command 0x0405 tx timeout [ 705.302151][T32525] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7049'. [ 705.419309][T32539] netlink: 100 bytes leftover after parsing attributes in process `syz.4.7052'. [ 705.807182][T32555] 8021q: adding VLAN 0 to HW filter on device bond18 [ 705.846032][T32559] syzkaller1: entered promiscuous mode [ 705.855409][T32559] syzkaller1: entered allmulticast mode [ 705.865115][T32566] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7061'. [ 705.884638][T32566] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7061'. [ 705.973997][T32566] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7061'. [ 706.036357][T32585] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7064'. [ 706.127298][T32585] netlink: 'syz.5.7064': attribute type 3 has an invalid length. [ 706.271486][T32598] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7066'. [ 706.385874][T32607] netlink: 'syz.2.7068': attribute type 11 has an invalid length. [ 706.424364][T32610] netlink: 88 bytes leftover after parsing attributes in process `syz.4.7070'. [ 706.708092][T32625] netlink: 'syz.0.7074': attribute type 1 has an invalid length. [ 706.802160][T32635] netlink: 36 bytes leftover after parsing attributes in process `syz.5.7077'. [ 707.212509][T32662] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7085'. [ 707.236449][T32665] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 707.282843][T32662] netlink: 'syz.4.7085': attribute type 2 has an invalid length. [ 707.786547][T32704] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 707.905285][T32707] tun0: tun_chr_ioctl cmd 1074025675 [ 707.913115][T32707] tun0: persist disabled [ 708.011906][T32707] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 708.105711][T32717] netlink: 'syz.0.7099': attribute type 1 has an invalid length. [ 708.224444][T32722] veth5: entered promiscuous mode [ 708.254893][T32722] bond19: (slave veth5): Enslaving as a backup interface with a down link [ 708.422243][T32721] netlink: ct family unspecified [ 709.058735][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 709.066856][ C0] lec:lec_tx_timeout: lec0 [ 709.072400][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 709.224624][ T308] erspan0: entered promiscuous mode [ 709.912299][ T338] bond0: (slave bond_slave_1): Releasing backup interface [ 711.399610][ T442] netlink: 'syz.4.7139': attribute type 10 has an invalid length. [ 711.424613][ T442] __nla_validate_parse: 8 callbacks suppressed [ 711.424634][ T442] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7139'. [ 711.678664][ T460] netlink: 'syz.5.7143': attribute type 1 has an invalid length. [ 711.712395][ T460] netlink: 'syz.5.7143': attribute type 1 has an invalid length. [ 711.807502][ T468] : (slave bond_slave_0): Releasing backup interface [ 711.865352][ T468] : (slave bond_slave_1): Releasing backup interface [ 711.912551][ T468] team0: Port device C removed [ 711.950709][ T468] team0: Port device team_slave_1 removed [ 711.980612][ T468] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 711.988068][ T468] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 712.025294][ T481] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7145'. [ 712.044848][ T468] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 712.058930][ T468] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 712.079863][ T468] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 712.120396][ T474] veth1_macvtap: left promiscuous mode [ 712.339439][ T495] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7150'. [ 712.366025][ T496] syzkaller1: entered promiscuous mode [ 712.382321][ T496] syzkaller1: entered allmulticast mode [ 712.504209][ T496] bond2: option lp_interval: invalid value (0) [ 712.560479][ T496] bond2: option lp_interval: allowed values 1 - 2147483647 [ 712.620971][ T496] bond2 (unregistering): Released all slaves [ 713.203616][ T524] 0ªî{X¹¦: left allmulticast mode [ 713.355572][ T544] netlink: 'syz.4.7159': attribute type 10 has an invalid length. [ 713.529896][ T554] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7162'. [ 713.609925][ T558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7163'. [ 713.648219][ T558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7163'. [ 713.772388][ T575] netlink: 'syz.0.7167': attribute type 1 has an invalid length. [ 713.791847][ T575] netlink: 'syz.0.7167': attribute type 3 has an invalid length. [ 713.817509][ T558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7163'. [ 713.839287][ T558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7163'. [ 713.850448][ T575] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7167'. [ 714.078901][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 714.087136][ C0] lec:lec_tx_timeout: lec0 [ 714.091821][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 714.147424][ T592] netlink: 'syz.5.7172': attribute type 64 has an invalid length. [ 714.166220][ T592] netlink: 5 bytes leftover after parsing attributes in process `syz.5.7172'. [ 714.350833][ T607] syzkaller1: entered promiscuous mode [ 714.356380][ T607] syzkaller1: entered allmulticast mode [ 715.608965][ T5897] IPVS: starting estimator thread 0... [ 715.677857][ T694] syzkaller1: entered promiscuous mode [ 715.714744][ T691] IPVS: using max 27 ests per chain, 64800 per kthread [ 715.733260][ T694] syzkaller1: entered allmulticast mode [ 715.833842][ T704] x_tables: duplicate entry at hook 3 [ 716.168655][ T727] ip6gre1: entered allmulticast mode [ 716.205778][ T730] bridge0: port 2(bridge_slave_1) entered disabled state [ 716.214835][ T730] bridge0: port 1(bridge_slave_0) entered disabled state [ 716.444867][ T747] block nbd3: Unsupported socket: should be TCP or UNIX. [ 716.462137][ T744] syzkaller0: entered promiscuous mode [ 716.485233][ T744] syzkaller0: entered allmulticast mode [ 716.506876][ T744] tipc: Started in network mode [ 716.521530][ T744] tipc: Node identity 063b3eb6ba31, cluster identity 7 [ 716.550127][ T744] tipc: Enabled bearer , priority 0 [ 716.655831][ T743] tipc: Resetting bearer [ 716.742333][ T743] tipc: Disabling bearer [ 717.114882][ T794] __nla_validate_parse: 10 callbacks suppressed [ 717.114904][ T794] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7227'. [ 717.186327][ T797] netlink: 368 bytes leftover after parsing attributes in process `syz.2.7228'. [ 717.230395][ T797] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 717.279850][ T797] netlink: 'syz.2.7228': attribute type 83 has an invalid length. [ 717.289195][ T803] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7230'. [ 717.298465][ T803] netlink: 128 bytes leftover after parsing attributes in process `syz.5.7230'. [ 717.340392][ T803] netlink: 'syz.5.7230': attribute type 1 has an invalid length. [ 717.565221][ T829] x_tables: ip6_tables: SYNPROXY target: used from hooks OUTPUT, but only usable from INPUT/FORWARD [ 717.815935][ T843] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7240'. [ 717.859012][ T843] netlink: 'syz.4.7240': attribute type 7 has an invalid length. [ 717.887666][ T843] netlink: 'syz.4.7240': attribute type 8 has an invalid length. [ 717.900844][ T848] netlink: 401 bytes leftover after parsing attributes in process `syz.3.7242'. [ 717.912453][ T843] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7240'. [ 717.970302][ T843] erspan0: entered promiscuous mode [ 717.992517][ T843] batadv_slave_1: entered promiscuous mode [ 718.000105][ T843] batadv_slave_1: left promiscuous mode [ 718.028852][ T843] erspan0: left promiscuous mode [ 718.285006][ T878] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7249'. [ 718.311198][ T876] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7248'. [ 718.556710][ T893] netlink: 7064 bytes leftover after parsing attributes in process `syz.5.7251'. [ 718.609107][ T53] Bluetooth: hci1: command 0x0406 tx timeout [ 718.678990][ T893] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 718.687992][ T898] netlink: 'syz.2.7253': attribute type 10 has an invalid length. [ 718.809147][ T898] syz_tun: entered promiscuous mode [ 718.815077][ T914] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 718.837135][ T898] : (slave syz_tun): Enslaving as an active interface with an up link [ 718.929889][ T921] netlink: 'syz.5.7255': attribute type 1 has an invalid length. [ 718.958159][ T921] netlink: 'syz.5.7255': attribute type 11 has an invalid length. [ 719.098767][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 719.107159][ C0] lec:lec_tx_timeout: lec0 [ 719.112487][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 719.134085][ T921] tipc: Enabled bearer , priority 0 [ 719.181095][ T921] syzkaller0: entered promiscuous mode [ 719.231330][ T921] syzkaller0: entered allmulticast mode [ 719.371394][ T921] tipc: Resetting bearer [ 719.402761][ T915] tipc: Resetting bearer [ 719.531266][ T915] tipc: Disabling bearer [ 719.815314][ T969] can: request_module (can-proto-0) failed. [ 719.977648][ T993] block nbd0: Unsupported socket: should be TCP or UNIX. [ 720.308497][ T1020] sch_tbf: burst 1885 is lower than device lo mtu (65550) ! [ 720.487985][ T1020] xt_CT: You must specify a L4 protocol and not use inversions on it [ 720.879156][ T1061] lec:lec_atm_send: lec0: Unknown message type 12 [ 720.914835][ T1066] netem: incorrect gi model size [ 720.929177][ T1066] netem: change failed [ 720.955954][ T1022] lec:lec_atm_close: lec0: Shut down! [ 721.273851][ T1082] xt_bpf: check failed: parse error [ 721.316539][ T1090] netlink: 'syz.3.7292': attribute type 23 has an invalid length. [ 721.445900][ T1098] netlink: 'syz.2.7294': attribute type 1 has an invalid length. [ 721.559732][ T1098] 8021q: adding VLAN 0 to HW filter on device bond2 [ 721.667713][ T1098] xt_l2tp: unknown flags: 10 [ 721.744337][ T1103] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 722.461017][ T5897] IPVS: starting estimator thread 0... [ 722.607019][ T1154] IPVS: using max 37 ests per chain, 88800 per kthread [ 722.676290][ T1162] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 722.683685][ T1162] IPv6: NLM_F_CREATE should be set when creating new route [ 722.691229][ T1162] IPv6: NLM_F_CREATE should be set when creating new route [ 722.945884][ T1185] __nla_validate_parse: 11 callbacks suppressed [ 722.945904][ T1185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7315'. [ 723.005195][ T1189] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 723.081445][ T1194] netlink: 'syz.0.7316': attribute type 2 has an invalid length. [ 723.513502][ T1225] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 723.633264][ T1225] bond3 (unregistering): Released all slaves [ 723.737931][ T53] Bluetooth: hci2: command 0x0406 tx timeout [ 724.064769][ T1267] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7331'. [ 724.093942][ T1267] openvswitch: netlink: Flow key attr not present in new flow. [ 724.260340][ T1277] netlink: 84 bytes leftover after parsing attributes in process `syz.5.7332'. [ 724.443144][ T1282] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7332'. [ 724.458590][ T1288] tc_dump_action: action bad kind [ 724.558069][ T1282] netlink: 'syz.5.7332': attribute type 1 has an invalid length. [ 724.599496][ T1282] netlink: 228 bytes leftover after parsing attributes in process `syz.5.7332'. [ 724.657542][ T1308] gre0: entered promiscuous mode [ 724.663015][ T1308] gre0: entered allmulticast mode [ 724.682580][ T1305] netlink: 'syz.3.7340': attribute type 3 has an invalid length. [ 724.691733][ T1305] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7340'. [ 725.010148][ T1330] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7345'. [ 725.112199][ T1338] netlink: 'syz.0.7347': attribute type 29 has an invalid length. [ 725.161287][ T1344] netlink: 'syz.0.7347': attribute type 29 has an invalid length. [ 725.197164][ T1346] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.7349'. [ 725.274175][ T1346] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7349'. [ 725.487861][ T1363] syzkaller1: entered promiscuous mode [ 725.497634][ T1363] syzkaller1: entered allmulticast mode [ 725.507958][ T1371] netlink: 'syz.5.7356': attribute type 5 has an invalid length. [ 725.868274][ T1387] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7359'. [ 725.968731][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 725.977753][ C0] lec:lec_tx_timeout: lec0 [ 725.982719][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 726.229670][ T1413] netlink: 'syz.5.7368': attribute type 1 has an invalid length. [ 726.415936][ T1413] bond3: (slave xfrm1): The slave device specified does not support setting the MAC address [ 726.427171][ T1413] bond3: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 726.440297][ T1413] bond3: (slave xfrm1): making interface the new active one [ 726.471391][ T1413] bond3: (slave xfrm1): Enslaving as an active interface with an up link [ 726.559676][ T1428] bond3 (unregistering): (slave xfrm1): Releasing backup interface [ 726.597249][ T1428] bond3 (unregistering): Released all slaves [ 726.861659][ T1455] SET target dimension over the limit! [ 727.565612][ T1482] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 727.950645][ T1506] netlink: 'syz.4.7386': attribute type 1 has an invalid length. [ 727.971620][ T1506] netlink: 'syz.4.7386': attribute type 2 has an invalid length. [ 727.982113][ T1502] netlink: 'syz.2.7385': attribute type 13 has an invalid length. [ 728.046847][ T1506] __nla_validate_parse: 5 callbacks suppressed [ 728.046875][ T1506] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7386'. [ 728.303598][ T1530] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7392'. [ 728.477902][ T1539] netlink: 'syz.3.7395': attribute type 10 has an invalid length. [ 728.495481][ T1541] netlink: 1 bytes leftover after parsing attributes in process `syz.3.7395'. [ 728.574247][ T1539] team0: Device veth1_macvtap failed to register rx_handler [ 728.604408][ T1544] netlink: 'syz.4.7397': attribute type 13 has an invalid length. [ 728.613437][ T1544] netlink: 164 bytes leftover after parsing attributes in process `syz.4.7397'. [ 728.620876][ T1546] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 728.633678][ T1544] syz_tun: refused to change device tx_queue_len [ 728.643537][ T1544] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7397'. [ 728.694794][ T1547] netlink: 88 bytes leftover after parsing attributes in process `syz.4.7397'. [ 728.784063][ T1553] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 728.843056][ T1553] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7400'. [ 728.881027][ T1555] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7401'. [ 728.904063][ T1555] openvswitch: netlink: Flow key attr not present in new flow. [ 729.178007][ T1575] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 729.186062][ T1575] IPv6: NLM_F_CREATE should be set when creating new route [ 729.273206][ T1575] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7406'. [ 729.477889][ T1591] xt_hashlimit: size too large, truncated to 1048576 [ 729.533282][ T1596] xt_hashlimit: size too large, truncated to 1048576 [ 729.556924][ T1594] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 729.643128][ T1608] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7411'. [ 729.757251][ T1608] netlink: 'syz.0.7411': attribute type 1 has an invalid length. [ 730.079067][ T1629] netlink: 'syz.4.7417': attribute type 1 has an invalid length. [ 730.242070][ T1639] openvswitch: netlink: Flow key attr not present in new flow. [ 730.281867][ T1639] netlink: 'syz.3.7421': attribute type 12 has an invalid length. [ 730.297955][ T1639] netlink: 'syz.3.7421': attribute type 29 has an invalid length. [ 730.575634][ T1662] netlink: 'syz.4.7429': attribute type 3 has an invalid length. [ 730.915806][ T1689] xt_TPROXY: Can be used only with -p tcp or -p udp [ 730.998907][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 731.007928][ C0] lec:lec_tx_timeout: lec0 [ 731.013521][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 732.562761][T15871] tipc: Subscription rejected, illegal request [ 732.616157][ T1758] bond0 (unregistering): Released all slaves [ 732.769649][ T1800] netlink: 'syz.4.7459': attribute type 3 has an invalid length. [ 732.807220][ T1797] syzkaller0: entered promiscuous mode [ 732.815129][ T1797] syzkaller0: entered allmulticast mode [ 733.186550][ T1828] netlink: 'syz.4.7468': attribute type 1 has an invalid length. [ 733.270737][ T1828] veth9: entered promiscuous mode [ 733.306870][ T7122] IPVS: starting estimator thread 0... [ 733.431216][ T1833] IPVS: using max 28 ests per chain, 67200 per kthread [ 733.587644][ T1849] pim6reg: entered allmulticast mode [ 733.877252][ T1863] __nla_validate_parse: 21 callbacks suppressed [ 733.877273][ T1863] netlink: 182752 bytes leftover after parsing attributes in process `syz.0.7474'. [ 733.934027][ T1864] netlink: 182752 bytes leftover after parsing attributes in process `syz.0.7474'. [ 734.400339][ T1884] bond20: ARP target 1.0.0.0 is already present [ 734.427876][ T1884] bond20: option arp_ip_target: invalid value (1) [ 734.443691][ T1884] bond20 (unregistering): Released all slaves [ 734.462276][ T1888] x_tables: duplicate underflow at hook 2 [ 736.038785][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 736.046853][ C0] lec:lec_tx_timeout: lec0 [ 736.052519][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 741.068756][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 741.076981][ C0] lec:lec_tx_timeout: lec0 [ 741.081782][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 746.098760][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 746.107018][ C0] lec:lec_tx_timeout: lec0 [ 746.116871][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 747.254020][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 752.371835][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6250 ms [ 752.380039][ C0] lec:lec_tx_timeout: lec0 [ 752.385177][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 754.452659][ T53] Bluetooth: hci0: command 0x0401 tx timeout [ 756.192196][ T2767] netlink: 'syz.0.7480': attribute type 21 has an invalid length. [ 756.227985][ T2778] bridge0: port 3(syz_tun) entered blocking state [ 756.239135][ T2768] netlink: 'syz.0.7480': attribute type 21 has an invalid length. [ 756.247016][ T2768] netlink: 128 bytes leftover after parsing attributes in process `syz.0.7480'. [ 756.251732][ T2778] bridge0: port 3(syz_tun) entered disabled state [ 756.273089][ T2767] netlink: 128 bytes leftover after parsing attributes in process `syz.0.7480'. [ 756.274911][ T2778] syz_tun: entered allmulticast mode [ 756.300612][ T2781] netlink: 'syz.4.7484': attribute type 13 has an invalid length. [ 756.317311][ T2778] syz_tun: entered promiscuous mode [ 756.324794][ T2778] bridge0: port 3(syz_tun) entered blocking state [ 756.331814][ T2778] bridge0: port 3(syz_tun) entered forwarding state [ 756.566165][ T2767] netlink: 'syz.0.7480': attribute type 4 has an invalid length. [ 756.576419][ T2767] netlink: 'syz.0.7480': attribute type 5 has an invalid length. [ 756.587605][ T2767] netlink: 3 bytes leftover after parsing attributes in process `syz.0.7480'. [ 756.598854][ T2768] netlink: 'syz.0.7480': attribute type 4 has an invalid length. [ 756.607528][ T2768] netlink: 'syz.0.7480': attribute type 5 has an invalid length. [ 756.616302][ T2768] netlink: 3 bytes leftover after parsing attributes in process `syz.0.7480'. [ 756.626537][ T2775] lo: Caught tx_queue_len zero misconfig [ 757.302989][ T2844] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7491'. [ 757.522131][ T2862] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7494'. [ 757.595455][ T2862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7494'. [ 757.630441][ T2862] netlink: 112 bytes leftover after parsing attributes in process `syz.2.7494'. [ 758.128713][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 758.137600][ C0] lec:lec_tx_timeout: lec0 [ 758.144043][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 758.908958][ T2954] netlink: 120 bytes leftover after parsing attributes in process `syz.4.7515'. [ 758.945907][ T2954] netlink: 'syz.4.7515': attribute type 1 has an invalid length. [ 758.998823][ T2954] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7515'. [ 759.124007][ T2963] netlink: 'syz.5.7519': attribute type 17 has an invalid length. [ 759.173900][ T2970] sit0: entered promiscuous mode [ 759.194200][ T2970] netlink: 'syz.4.7523': attribute type 1 has an invalid length. [ 759.658603][ T3010] pimreg: entered allmulticast mode [ 759.926581][ T3021] sctp: [Deprecated]: syz.2.7537 (pid 3021) Use of int in max_burst socket option. [ 759.926581][ T3021] Use struct sctp_assoc_value instead [ 760.332067][ T3054] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 760.345327][ T3054] netlink: Conntrack attr has 4 unknown bytes [ 760.457962][ T3060] xt_hashlimit: overflow, try lower: 3/0 [ 760.524428][ T3064] [ 760.526814][ T3064] ====================================================== [ 760.533851][ T3064] WARNING: possible circular locking dependency detected [ 760.541252][ T3064] syzkaller #0 Not tainted [ 760.545744][ T3064] ------------------------------------------------------ [ 760.553297][ T3064] syz.0.7547/3064 is trying to acquire lock: [ 760.559905][ T3064] ffffffff8fb283d8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 760.569318][ T3064] [ 760.569318][ T3064] but task is already holding lock: [ 760.576776][ T3064] ffff88807caaa370 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 760.586376][ T3064] [ 760.586376][ T3064] which lock already depends on the new lock. [ 760.586376][ T3064] [ 760.597455][ T3064] [ 760.597455][ T3064] the existing dependency chain (in reverse order) is: [ 760.606731][ T3064] [ 760.606731][ T3064] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 760.614932][ T3064] _raw_spin_lock_bh+0x36/0x50 [ 760.620289][ T3064] nr_rt_device_down+0x153/0x860 [ 760.625765][ T3064] nr_device_event+0x137/0x150 [ 760.631249][ T3064] notifier_call_chain+0x19d/0x3a0 [ 760.637003][ T3064] __dev_notify_flags+0x16d/0x310 [ 760.642686][ T3064] netif_change_flags+0xe8/0x1a0 [ 760.648169][ T3064] dev_change_flags+0x130/0x260 [ 760.653734][ T3064] dev_ioctl+0x7b4/0x1150 [ 760.658705][ T3064] sock_do_ioctl+0x23e/0x320 [ 760.664747][ T3064] sock_ioctl+0x5c6/0x7f0 [ 760.669627][ T3064] __se_sys_ioctl+0xfc/0x170 [ 760.674918][ T3064] do_syscall_64+0xe2/0xf80 [ 760.679957][ T3064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.686368][ T3064] [ 760.686368][ T3064] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 760.694991][ T3064] _raw_spin_lock_bh+0x36/0x50 [ 760.700416][ T3064] nr_rt_device_down+0xbe/0x860 [ 760.705808][ T3064] nr_device_event+0x137/0x150 [ 760.711313][ T3064] notifier_call_chain+0x19d/0x3a0 [ 760.717069][ T3064] __dev_notify_flags+0x16d/0x310 [ 760.722615][ T3064] netif_change_flags+0xe8/0x1a0 [ 760.728182][ T3064] dev_change_flags+0x130/0x260 [ 760.733602][ T3064] dev_ioctl+0x7b4/0x1150 [ 760.738548][ T3064] sock_do_ioctl+0x23e/0x320 [ 760.743966][ T3064] sock_ioctl+0x5c6/0x7f0 [ 760.749272][ T3064] __se_sys_ioctl+0xfc/0x170 [ 760.754954][ T3064] do_syscall_64+0xe2/0xf80 [ 760.760175][ T3064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.766860][ T3064] [ 760.766860][ T3064] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 760.775003][ T3064] __lock_acquire+0x15a5/0x2cf0 [ 760.780667][ T3064] lock_acquire+0x106/0x330 [ 760.785974][ T3064] _raw_spin_lock_bh+0x36/0x50 [ 760.791276][ T3064] nr_remove_neigh+0x25/0xe0 [ 760.796418][ T3064] nr_add_node+0x1e41/0x2630 [ 760.802083][ T3064] nr_rt_ioctl+0xe59/0xf90 [ 760.807169][ T3064] sock_do_ioctl+0x101/0x320 [ 760.812382][ T3064] sock_ioctl+0x5c6/0x7f0 [ 760.817246][ T3064] __se_sys_ioctl+0xfc/0x170 [ 760.822468][ T3064] do_syscall_64+0xe2/0xf80 [ 760.827511][ T3064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.834033][ T3064] [ 760.834033][ T3064] other info that might help us debug this: [ 760.834033][ T3064] [ 760.844649][ T3064] Chain exists of: [ 760.844649][ T3064] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 760.844649][ T3064] [ 760.858833][ T3064] Possible unsafe locking scenario: [ 760.858833][ T3064] [ 760.866469][ T3064] CPU0 CPU1 [ 760.872716][ T3064] ---- ---- [ 760.878176][ T3064] lock(&nr_node->node_lock); [ 760.883173][ T3064] lock(nr_node_list_lock); [ 760.890376][ T3064] lock(&nr_node->node_lock); [ 760.898567][ T3064] lock(nr_neigh_list_lock); [ 760.903348][ T3064] [ 760.903348][ T3064] *** DEADLOCK *** [ 760.903348][ T3064] [ 760.911605][ T3064] 1 lock held by syz.0.7547/3064: [ 760.916727][ T3064] #0: ffff88807caaa370 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 760.927364][ T3064] [ 760.927364][ T3064] stack backtrace: [ 760.933276][ T3064] CPU: 1 UID: 0 PID: 3064 Comm: syz.0.7547 Not tainted syzkaller #0 PREEMPT(full) [ 760.933300][ T3064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 760.933311][ T3064] Call Trace: [ 760.933320][ T3064] [ 760.933328][ T3064] dump_stack_lvl+0xe8/0x150 [ 760.933351][ T3064] print_circular_bug+0x2e1/0x300 [ 760.933370][ T3064] check_noncircular+0x12e/0x150 [ 760.933388][ T3064] __lock_acquire+0x15a5/0x2cf0 [ 760.933417][ T3064] ? nr_remove_neigh+0x25/0xe0 [ 760.933437][ T3064] lock_acquire+0x106/0x330 [ 760.933455][ T3064] ? nr_remove_neigh+0x25/0xe0 [ 760.933476][ T3064] ? do_raw_spin_lock+0x12b/0x2f0 [ 760.933493][ T3064] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 760.933510][ T3064] ? nr_remove_neigh+0x25/0xe0 [ 760.933529][ T3064] _raw_spin_lock_bh+0x36/0x50 [ 760.933550][ T3064] ? nr_remove_neigh+0x25/0xe0 [ 760.933569][ T3064] nr_remove_neigh+0x25/0xe0 [ 760.933590][ T3064] nr_add_node+0x1e41/0x2630 [ 760.933612][ T3064] ? dev_get_by_name+0x21/0x200 [ 760.933632][ T3064] ? dev_get_by_name+0x21/0x200 [ 760.933651][ T3064] ? nr_call_to_digi+0x136/0x1b0 [ 760.933671][ T3064] nr_rt_ioctl+0xe59/0xf90 [ 760.933695][ T3064] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 760.933718][ T3064] ? apparmor_capable+0x137/0x1a0 [ 760.933742][ T3064] ? capable+0x88/0xe0 [ 760.933756][ T3064] ? nr_ioctl+0x1b1/0x3b0 [ 760.933773][ T3064] sock_do_ioctl+0x101/0x320 [ 760.933788][ T3064] ? __pfx_sock_do_ioctl+0x10/0x10 [ 760.933801][ T3064] ? do_futex+0x395/0x420 [ 760.933826][ T3064] sock_ioctl+0x5c6/0x7f0 [ 760.933848][ T3064] ? __pfx_sock_ioctl+0x10/0x10 [ 760.933869][ T3064] ? __fget_files+0x2a/0x420 [ 760.933885][ T3064] ? __fget_files+0x3a0/0x420 [ 760.933900][ T3064] ? __fget_files+0x2a/0x420 [ 760.933916][ T3064] ? bpf_lsm_file_ioctl+0x9/0x20 [ 760.933934][ T3064] ? __pfx_sock_ioctl+0x10/0x10 [ 760.933954][ T3064] __se_sys_ioctl+0xfc/0x170 [ 760.933975][ T3064] do_syscall_64+0xe2/0xf80 [ 760.933991][ T3064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.934007][ T3064] ? clear_bhb_loop+0x60/0xb0 [ 760.934023][ T3064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.934038][ T3064] RIP: 0033:0x7fcd6fd9aeb9 [ 760.934063][ T3064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 760.934076][ T3064] RSP: 002b:00007fcd70ccf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 760.934094][ T3064] RAX: ffffffffffffffda RBX: 00007fcd70015fa0 RCX: 00007fcd6fd9aeb9 [ 760.934107][ T3064] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000004 [ 760.934117][ T3064] RBP: 00007fcd6fe08c1f R08: 0000000000000000 R09: 0000000000000000 [ 760.934127][ T3064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 760.934137][ T3064] R13: 00007fcd70016038 R14: 00007fcd70015fa0 R15: 00007ffd13823768 [ 760.934156][ T3064] [ 763.898728][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 763.906786][ C0] lec:lec_tx_timeout: lec0 [ 763.911599][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 768.928802][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 768.937225][ C0] lec:lec_tx_timeout: lec0 [ 768.942075][ C0] lec:lec_start_xmit: lec0:No lecd attached