last executing test programs: 8.735399163s ago: executing program 3 (id=12416): socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4040044) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000006800010002000000fcffdf7f00000000000000000c0002000100"], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mtu(r4, 0x29, 0x17, 0x0, 0x3b) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x70bd67, 0x0, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x1, 0x20000d00}, [@RTA_NH_ID={0x8, 0x1e, 0x8000002}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) 7.608877824s ago: executing program 3 (id=12425): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x3c0, 0x108, 0xffffffff, 0xffffffff, 0x108, 0xffffffff, 0x2f0, 0xffffffff, 0xffffffff, 0x2f0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast1, @mcast2, [0xff000000, 0x0, 0xff000000, 0xffffffff], [0xff, 0xffffff00, 0xffffffff, 0xffffff00], 'bond_slave_0\x00', 'team_slave_1\x00', {}, {}, 0x3a, 0x2, 0x6, 0x8}, 0x0, 0xe0, 0x108, 0x60030000, {0x0, 0xff000000}, [@common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x8, {0xffc0000000}}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x3b}}}, {{@ipv6={@remote, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'syzkaller0\x00', 'bridge_slave_1\x00', {}, {}, 0x2b, 0x2, 0x5, 0x5}, 0x0, 0x1c8, 0x1e8, 0x0, {}, [@common=@ipv6header={{0x28}, {0x2c, 0x10, 0x1}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x6, 0x4, 0x0, 'syz0\x00'}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x420) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000004580)={0x1, 0x1f, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000010000000000009f09002318110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000200000008500000086000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000060000008500000006000000bf91000000000000b70200000000000085000000d4000000b70000000064000095"], &(0x7f0000004380)='syzkaller\x00', 0x6, 0x20, &(0x7f0000000000)=""/32, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 7.526706758s ago: executing program 3 (id=12426): r0 = bpf$TOKEN_CREATE(0x24, 0x0, 0x0) ioctl$XFS_IOC_SCRUBV_METADATA(r0, 0xc0285840, &(0x7f0000000080)={0x7, 0x4, 0x9, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000000)=[{0x13, 0xfe, 0x8}, {0x18, 0x0, 0xfffffffd}, {0x15, 0xfe, 0xd06}, {0x15, 0x101, 0x24}, {0x6, 0xfe, 0xc}]}) 7.410406091s ago: executing program 3 (id=12427): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x600) r5 = socket(0x22, 0x2, 0x4) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r5, 0x84, 0x77, 0x0, &(0x7f0000000200)) r6 = socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0x4}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) ioctl$XFS_IOC_START_COMMIT(r6, 0x80585882, &(0x7f0000000140)={0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24041004) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x60010000, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x18, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd8}}, 0x0) listen(0xffffffffffffffff, 0x0) epoll_create1(0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r10, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0, 0x1}, 0x8) sendmsg$NL80211_CMD_SET_CHANNEL(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x38, r8, 0x10, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xff, 0x20}}}}, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x14}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x400}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x40) socket$nl_route(0x10, 0x3, 0x0) socket(0x21, 0x3, 0x4) 7.01677156s ago: executing program 3 (id=12428): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(khazad)\x00'}, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000240)="112efc61dfb89b674a9c6721decb", 0xe, 0x8010, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), r4) sendmsg$DEVLINK_CMD_GET(r1, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x54, r7, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x44090}, 0x6800) close(r6) r8 = socket$unix(0x1, 0x2, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x2, 0x76e, 0x2, 0x10001, 0x24, 0x2c, 0x2, 0x4dd, 0x1000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r10, {0x0, 0x5}, {0x2, 0xb}, {0xffe0, 0xa}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x34f}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x4000800) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r1) 5.784190297s ago: executing program 3 (id=12438): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0xe, 0x40, 0x3, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000040), 0x1003, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r0, &(0x7f0000000300), 0x0}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f00000003c0)={0x0, 0xfffffffffffffe69, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x20040024}, 0x8040) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x28, 0x26, 0xa01, 0xfffffffc, 0x0, {0xd}, [@typed={0x11, 0x5e, 0x0, 0x0, @binary="5a907b02448c79c7572371ae9b"}]}, 0x28}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES32=r1], 0xa4}, 0x1, 0x0, 0x0, 0x48005}, 0x801) 4.38314989s ago: executing program 1 (id=12451): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r1, 0x0, 0x8, &(0x7f0000000000)=0x1ff, 0x4) getsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000480)=""/37, &(0x7f0000000340)=0x25) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) bind$packet(r0, &(0x7f0000000100), 0x14) 3.078284591s ago: executing program 1 (id=12460): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000000000007111c300000000008510000002000000850000000000000095000000000000009500b0059d350000f8eb70c3d9330b16491e095815635bf7490c180e3be703966bd8fdc277008531ccb9d9ae8dc9e78d9dc5311486fd1d2bfab99b08b4d46852f103d4ed539d04b034d645e2ea69674b1749efdc6a03ab8d5c3d2a2ed722271db8f4b166d4a579abbfc27974"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x6}, 0x70) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000000000007111c300000000008510000002000000850000000000000095000000000000009500b0059d350000f8eb70c3d9330b16491e095815635bf7490c180e3be703966bd8fdc277008531ccb9d9ae8dc9e78d9dc5311486fd1d2bfab99b08b4d46852f103d4ed539d04b034d645e2ea69674b1749efdc6a03ab8d5c3d2a2ed722271db8f4b166d4a579abbfc27974"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x6}, 0x70) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) socket$netlink(0x10, 0x3, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) socket$key(0xf, 0x3, 0x2) (async) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="020300021c000000000003a715cd0c001200080008040000d7884a389e967b9e894705b077c135fd1c4a37d5988b140936aefd5769368f40653727f7526af11d10fafc11b91ced9d4ae3916383fb98fc275e11f5bed4ec3469dd878bea99164e2f6bc329d7acd8a89b2b2917fdeb71d607edd3d677414d4e22f99e072d04ea919734bc15cbfbbf5004f18378a4cc482d747ef47e91ccbd3d6200000000000000030006000000000002000000ac141400000000000000000002000100000000000000060000000000030005000000000002"], 0xe0}, 0x1, 0x7}, 0x8800) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x3}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x80, '\x00', 0x8, 0x461b, 0xa, 0xfffffff9}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x480d8}, 0x4000000) socket$unix(0x1, 0x1, 0x0) (async) r12 = socket$unix(0x1, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0xa, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x31}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0xb}, 0x97) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x3}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x4}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0x38}}, 0x8000002) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x4}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0x38}}, 0x8000002) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 2.418350512s ago: executing program 4 (id=12464): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x48) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000000)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, &(0x7f0000000040)=[0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0], 0x0, 0x52, &(0x7f00000000c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0x83, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000440), &(0x7f0000000480)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x14, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}], {{0x7, 0x1, 0xc, 0x9, 0x4}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) 2.315682907s ago: executing program 1 (id=12466): unshare(0x6a040000) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa, 0x8031, r0, 0x47523000) r1 = socket(0x2b, 0x80801, 0x1) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "e2fa08", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x14, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'pimreg0\x00', 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r5, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x13, r5, 0x1000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0x20, &(0x7f0000000440)={&(0x7f0000000340)=""/107, 0x6b, 0x0, &(0x7f0000000400)=""/64, 0x40}}, 0x10) r7 = bpf$ITER_CREATE(0x21, &(0x7f00000004c0), 0x8) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="12000000400000000400000002"], 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r8, &(0x7f00000003c0), &(0x7f0000000580)=@tcp6=r9}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000002080)={r8, &(0x7f0000001f80), &(0x7f00000008c0)=""/33}, 0x20) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001580)={0x1b, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x1}, 0x50) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001600)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x6, '\x00', 0x0, r2, 0x3, 0x4, 0x4}, 0x50) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000001740)={r0, &(0x7f0000000500)='\xaa\xaa\xaa\xaa\xaa', 0x404000, &(0x7f0000001680)={@_ha_fsid, {0x7f, 0x2, 0x7, 0x3}}, 0x9, &(0x7f00000016c0), &(0x7f0000001700)=0x7fff}) r13 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000017c0)=@generic={&(0x7f0000001780)='./file0\x00', 0x0, 0x10}, 0x18) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_int(r15, &(0x7f0000000000)=0x8, 0x12) close(r15) splice(r14, 0x0, r15, 0x0, 0x1000000000006, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x8, 0xa, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x75}, [@generic={0x1, 0xe, 0x1, 0x0, 0x8}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}]}, &(0x7f0000000280)='syzkaller\x00', 0x746159c1, 0x0, 0x0, 0x41000, 0xbf6e2bed0308e8ba, '\x00', r4, @cgroup_skb=0x1, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x3, 0x2, 0x9, 0x8001}, 0x10, r6, r7, 0x7, &(0x7f0000001800)=[r8, r10, 0xffffffffffffffff, r11, r12, r1, r13, r15], &(0x7f0000001840)=[{0x1, 0x5, 0x10, 0x1}, {0x5, 0x1, 0x7, 0xa}, {0x2, 0x3, 0x6, 0x5}, {0x3, 0x5, 0xc, 0x3}, {0x2, 0x4, 0xa, 0x7}, {0x3, 0x5, 0xd, 0x9}, {0x4, 0x1, 0x6, 0x8}], 0x10, 0xe6}, 0x94) 2.22083954s ago: executing program 4 (id=12468): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'netdevsim0\x00', &(0x7f0000002fc0)=@ethtool_wolinfo={0x3, 0x8, 0xfffffffd, "050000009582"}}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_DEL_MFC(r2, 0x0, 0xcd, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000001580)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000540)=0x9c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x1c, 0x5, 0x0, 0x1, @meta={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x19}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0xb, 0x4, 0x2}, 0x50) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000580)={0x6c, 0x0, 0x1, 0x201, 0x0, 0x0, {0x6, 0x0, 0x7}, [@CTA_TUPLE_REPLY={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x4}, @CTA_ID={0x8}, @CTA_ID={0x8}, @CTA_LABELS={0x28, 0x16, 0x1, 0x0, [0x5, 0x8001, 0xffff, 0xa, 0x4, 0x3, 0x1, 0x0, 0x10000]}, @CTA_LABELS={0xc, 0x16, 0x1, 0x0, [0x6, 0x9]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4001}, 0x40000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r6}, &(0x7f0000000440), &(0x7f0000000480)=r5}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000900)={r6, &(0x7f00000006c0), 0x0}, 0x20) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) writev(r4, &(0x7f0000000640)=[{&(0x7f00000011c0)="000000c3", 0x4}, {0x0, 0xfffffec3}, {&(0x7f0000000140)="df282030f97816377056", 0xa}], 0x3) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x6, 0x0) connect$bt_l2cap(r7, &(0x7f0000000280)={0x1f, 0x1422, @none, 0x3}, 0xe) ioctl(r4, 0x9, &(0x7f0000000040)="c18295202b26a465af72fcbb765b319efae94e1eb8f2d2e4aab5583d29aeee19593e5e7ca4d69f5d99edac99a9e135092a5588767495bfe6136ccb30868ba5060d28669fe943c925cf546e804802b23322ff0ee2c209b17dcf8968444936350ea94fcb9c0f7e15a6270b793a34593d0b427ff7aaf34da5e1114134271cadb046e9fa0880b299a18a14ac21ac5f60a9302a88f948b54e24d40239d1b91129c84cc4c99eca55cd798ce4672fe24762232f444fadee96") bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, [@ldst={0x3, 0x0, 0x6, 0x1, 0x0, 0x21}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) 1.698070406s ago: executing program 2 (id=12470): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_devices(r2, &(0x7f0000000080)=ANY=[@ANYBLOB='b '], 0x47) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) splice(r1, 0x0, r4, 0x0, 0x7, 0xd) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x54, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x24, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x17efb}, @TCA_FLOW_MASK={0x8, 0x6, 0x8001}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_XOR={0x8, 0x7, 0x1}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) 1.562756326s ago: executing program 4 (id=12471): bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)='%pB \x00'}, 0x20) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000280)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r1, 0x0) (async) mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'pimreg\x00', 0x100}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) 1.490137788s ago: executing program 2 (id=12472): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000540)={&(0x7f00000000c0)={0x478, r1, 0x400, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x55}}}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x8, 0xcd, [0x7fff, 0x1000]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_FRAME={0x42f, 0x33, @assoc_resp={{{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x9}, @device_b, @device_a, @initial, {0x2, 0x7f}}, 0x8440, 0x16, @random=0x3, @void, @val={0x2d, 0x1a, {0x2, 0x3, 0x1, 0x0, {0x6, 0x1db5, 0x0, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1}, 0x400, 0x1185, 0xa}}, [{0xdd, 0xe1, "e3f0ae7aa3aa52dfeebf92c4461ae488c29e3b96950d2c6f8ca8e58f100a340af82a1273d4b3ff29737f8956ae5fa88aaa47291e30a7a68dc51ae515f5ef2a74a054772ec882b6149e9036625291159d95e97357a293adcaa453b955afab0c5e7bb588bd7ccf14eeac642e32366fb7bd30d634e01153725542c348527482b5153d9a4c8c595cdfc2e0877608eba195f2f1f49baa9347ef5800a8e1e31daa979761dcedbb07b3f18f539bd6749428c3fee5e763a4cbb318082d41fff128bba2c7711570c1241cfd7a7a02fe708ce960585be8c29a24e2b6426f830d77a6081f84c5"}, {0xdd, 0x6b, "23166035a433f18f38f8f87cf58a0d724f35155bb07a087fe0484e467bbef7b81c2a13cfaf87e6d83a8cdfba875d764e708cfc9d8fce524be215be6d3f453e605ef44b7437cf9f6aeebc19346846c30f68f3b96d0bbfa2ad02838d04eff86745fcfbd7dc08443334fe98b5"}, {0xdd, 0x5b, "53fe48e38c6547d33c12b5bd38a8f740c450c151f4812dfdaf306b64708ad635b5a77f9b67a70e58d432aa34265c1c93d48e6ef0f473a645d7985beefb67536eb15a376aa65d1fa5ae5d178e26a2ad3a4e507420e4f22d0cd46fd4"}, {0xdd, 0xf2, "f72b1e12d96e22fb93920a88125387081813beee84916c46603595583deb99cd56e3c4d191b56e80997985a952761abfa5de661792755e3d841a73531977478f0b14185572150a5fe32c4d0f827c552fe4315afd188aa856eb1e524f3ffd8955286f7d3135c2e950fccad7472e00a604387e1f6fee234f6b9fd8486316e1682293506a03b154e184d729c9f778dc66410dd7e1c9e45d5067d75d2e97878e002ad52369b11cd02395335b73d9c46ed69901b9e2f7a99ac37b25da97832c9a46fb4633d75a5deec1802a138dbf3aa06f69b4e9a9895a7fc5da2798ae829153bed0a446b20536157eb98e8c5bcc8785639cbcca"}, {0xdd, 0xc0, "ed7f45ee560800ef2c2cbc8b2091f1e322eb8846e661841ae195ec8f7fe89be2ed5dce60c2c541f8ca11b8df4cf4cf41f6e6af09a9880adbf301d667a2701e2d71784e081081714ae7680bb34188fa5e81ce5ee565fd90fdb00ea86bf8d0200963a45dfab9a0e238467a3a1647d525b03192d697eb0f7b0ae2c4fb6b9930a24d323d6352fa3b63318f5801ecfa194451a465beeeac50ee6b35662da5f8c28e1a128986b7c9b802ef71585ccb1b4a31fff9b800e2e0dc0ee0d6d47ce9ccdb86db"}, {0xdd, 0x1e, "1d1933ad66a4285df777075383a538524977257a98eb0786418493364fa9"}, {0xdd, 0x6c, "c97e7c7c54d4d7b077f9117c13edd09ac945b1061f57aec90b8bae000ef286fec1c05a643d966e0410c9e55d6953c6182b69bebe28d424fc50715342d8a31986f617cde98b6b6c214526683749956c2635f46f751e272d4cb4db63c0366a8df5e141e3f8d65a544419fda889"}]}}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x478}}, 0x0) sendmsg$NL80211_CMD_GET_MPATH(r0, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x5c, r1, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x5c}, 0x1, 0x0, 0x0, 0x48044}, 0x20000001) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000700)={r0}) sendmsg$NL80211_CMD_SET_PMK(r0, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)={0x94, r1, 0x4, 0x70bd2d, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x5, 0x1a}}}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "8020e578a1b0ae965805241b57d4aacf"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "526d58f41f56cace81e8fc24bc04d5b8"}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PMK={0x14, 0xfe, "695c72171fe192d9960819bdeffcb75e"}, @NL80211_ATTR_PMK={0x14, 0xfe, "751f06cbbbe1cc3ff0b45e591b85bc25"}, @NL80211_ATTR_MAC={0xa}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000900), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_REMOVEDEF(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x70, r5, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @loopback}, @NLBL_MGMT_A_DOMAIN={0xa, 0x1, 'wlan1\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}, @NLBL_MGMT_A_DOMAIN={0xa, 0x1, '\xff\xff\xff\xff\xff\xff'}, @NLBL_MGMT_A_DOMAIN={0x7, 0x1, '[@\x00'}, @NLBL_MGMT_A_DOMAIN={0xa, 0x1, 'wlan1\x00'}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x2}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000015}, 0x20004000) ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000a40)={{r3}, 0x0, 0xd, 0x6}) socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$kcm(0x29, 0x5, 0x0) r7 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000001040)={'ip6gre0\x00', &(0x7f0000000fc0)={'syztnl2\x00', 0x0, 0x0, 0x9b, 0x6f, 0x7, 0x66, @private2, @empty, 0x20, 0x8000, 0x51b8, 0xfffffff7}}) sendmsg$inet(r7, &(0x7f0000001140)={&(0x7f0000000a80)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000f40)=[{&(0x7f0000000ac0)="2051b1f899287b1fcb7a60ab255d362c5922f6ee24bc59a574c3e2bba565aebb2ac262dd7630f59abcbf30bbf8d86c0268fd7256f7486000589e03d06569b2a183798324a9bb6aa57a2fba75bc6d84f880727169061dd0cf8dce8cbbbd02e70c408915d37b18deaeec44c701df6006f75d05aa3b6831df4004efe86da114e87dc56b6184e4e6fa35347170e1cfddc7c9806aeadc159cf509eecc88165b7ee828cced93d526e4accf11709af7be015e58bc94b6a178cd0ed15274e3f625b05e288f9d", 0xc2}, {&(0x7f0000000bc0)="8747", 0x2}, {&(0x7f0000000c00)="11282f942aa5de1ec357a2e8153c24de37d72e4b18109afa87e717c6c6f046b4ec94a82ddec491a760555f724ddc97f15d2f5a4710286371e296ee137baab5a7fd11776e38a6904d64674a0681703f21452e2c0d595be95df7ae75e7f14870e8c29ccd", 0x63}, {&(0x7f0000000c80)="b4431210a6df8c67b2dba1c3958ee186bf57fa29b4bd758d168f76f746846f7d5d6545c2145d1ac3c000ece062545a7fb97a27b8a4846448fe6d1131330ea0b48edc1c4cf1bb8058c5ab941699123010b34563f22ade733741445736ddce9df64613425481ff5b56659e844f3967254936a7bed2ed969774c17330d4dff0cd66105c1c451024b51266a88da3420287862a536e0f3569d31d66ad6a3e2ebf", 0x9e}, {&(0x7f0000000d40)="14194112734975418ffe4bcb86a7e28ae1f9e0070a99549f21d7fa180674e66e40045f29bbda4b", 0x27}, {&(0x7f0000000d80)="a52d804dd586d1bc7f578863e6a9a62196bb7100835853370ddd6f7407105592080bf012354f27f8f499f149b115d6722179c1e226196fa77e6d1b01d40148e87056ed896a8d6e1ebd22addf57dedac368b3d978b0b9a8afb69f3a58c6b67d38a2", 0x61}, {&(0x7f0000000e00)="8fce0f5edeeb907de53e21ab113d9980b3a1af694c75fd29d90ce028b696e1caca76f0ba937de6563d17f6668cee0614980e269b5b3b8bdfcbd54514bd9f8f70216fc938eb10eb", 0x47}, {&(0x7f0000000e80)="1f1341bdbd60a6bba811c5f0be6524434e2eeed7c6fc0def252f975eeed2a2572da96c0449fae48bd48fd64014a9d80c4e1a0b53173d505c8998fe280ca97de7b271cd299250284d75bd0e7dfd14872127373379002e40d302152b43d58becbbbe3720a68bd8096a3d72344c665ab55a8d9c46461a998f21191f3a9424fe706b217ec19c36", 0x85}], 0x8, &(0x7f0000001080)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0xd}}}}, @ip_retopts={{0x54, 0x0, 0x7, {[@ra={0x94, 0x4}, @lsrr={0x83, 0x1f, 0xb5, [@empty, @multicast2, @local, @multicast1, @local, @private=0xa010100, @rand_addr=0x64010101]}, @generic={0x82, 0xb, "eb1c6485f7daf10e83"}, @timestamp_prespec={0x44, 0x14, 0xeb, 0x3, 0x8, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x11}, 0x8}]}]}}}], 0x90}, 0x40000c4) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r6, 0x6612) writev(r6, &(0x7f0000001200)=[{&(0x7f0000001180)="1920d34cf386a57503cd8f6647c6a6e27840bd2600807b1f7f2f87ea920a10ea0a39eccd6c1c069356331d6ad2c68fb0475a2f59aa1c0d3e22f56300bc9aa0229a89fed6", 0x44}], 0x1) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r3, 0x84, 0x74, &(0x7f0000001240)=""/185, &(0x7f0000001300)=0xb9) ioctl$BTRFS_IOC_LOGICAL_INO(r7, 0xc0389424, &(0x7f0000001380)={0xb1, 0x30, '\x00', 0x0, &(0x7f0000001340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r9 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000013c0)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f00000014c0)={'gretap0\x00', &(0x7f0000001400)={'erspan0\x00', r8, 0x20, 0x80, 0x6, 0x5, {{0x27, 0x4, 0x1, 0x6, 0x9c, 0x68, 0x0, 0x5, 0x4, 0x0, @loopback, @loopback, {[@timestamp={0x44, 0x1c, 0xfd, 0x0, 0x9, [0xfffffffb, 0x7, 0x2, 0xd4e3, 0x6, 0xffff]}, @cipso={0x86, 0x18, 0x1, [{0x1, 0x6, "4b43d351"}, {0x0, 0x8, "0b3995e9f474"}, {0x7, 0x4, "b1c1"}]}, @timestamp_addr={0x44, 0x54, 0x70, 0x1, 0xd, [{@multicast2}, {@remote, 0x5a8}, {@dev={0xac, 0x14, 0x14, 0x25}}, {@multicast2}, {@remote, 0xf}, {@remote, 0x80}, {@rand_addr=0x64010101, 0x2}, {@remote, 0x7ff}, {@private=0xa010101, 0x6}, {@multicast2, 0x2}]}]}}}}}) bind$xdp(r7, &(0x7f0000001500)={0x2c, 0xc, r10, 0x22, r9}, 0x10) syz_extract_tcp_res(&(0x7f0000001540), 0x5, 0x2) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000001580), 0x4) sendmsg$NL80211_CMD_GET_COALESCE(r3, &(0x7f0000001680)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)={0x1c, r1, 0x10, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x65}, @void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x404c805) setsockopt$bt_rfcomm_RFCOMM_LM(r9, 0x12, 0x3, &(0x7f00000016c0)=0x10, 0x4) getsockopt$inet_opts(r9, 0x0, 0x0, &(0x7f0000001700)=""/75, &(0x7f0000001780)=0x4b) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TEAM_CMD_PORT_LIST_GET(r11, &(0x7f0000001c80)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001c40)={&(0x7f0000001840)={0x3f8, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [{{0x8, 0x1, r10}, {0xb8, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xa0}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r10}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r10}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfffffff8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r8}, {0x21c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xd4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r10}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r10}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r10}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0x3f8}, 0x1, 0x0, 0x0, 0x64048005}, 0x10) 1.37939329s ago: executing program 1 (id=12473): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x88, 0x0, 0x0, 0x0, 0xffffff8d}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x500}, {0x85, 0x0, 0x0, 0x86}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0xb, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x25}, 0x94) bind$netlink(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}}, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'fpu(pcbc(aes))\x00'}, 0x58) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x27}, 0x62) listen(r6, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$packet(0x11, 0x3, 0x300) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)={0x38, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x8, 0xcb, 0x0, 0x1, [@nested={0x4, 0x8}]}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@nested={0x4, 0x8}, @nested={0x4, 0xf}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$kcm(0x21, 0x2, 0x2) unshare(0x28000600) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r3, 0x89fb, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000280)={@private2={0xfc, 0x2, '\x00', 0x1}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x1, 0x2}}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r10, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c0002"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) 1.201878857s ago: executing program 2 (id=12475): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x339) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000a40)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x5, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xfffffffd, 0x3}, [@TCA_NETEM_ECN={0x8, 0x7, 0xfffffff8}, @TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0x2, 0x9, 0x3, 0xffffff2e}}]}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000440)="18", 0x1, 0x200000c1, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0x3}, 0x14) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) close(r0) 1.201618054s ago: executing program 4 (id=12476): syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbb89eda01daaaaaaaa08004510003e00660000070290780a010102ac0414aa11ff907800000000"], 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) (async) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000602000000000000000008e42295"], &(0x7f00000003c0)='GPL\x00', 0x1, 0x0, 0x0, 0x4341eff0c6b6f212}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) (async, rerun: 32) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0x1c, &(0x7f0000000900)=ANY=[@ANYBLOB="18080000e9ff0000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008000000bc0900000000000045080100002000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffffc40200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000eeffffff4608efff76000000bf9800000000000056090000000000008500000000020800b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000140)={r1, &(0x7f0000000040)='\x00', 0x501000, &(0x7f0000000080)={@align=0x6, {0x2, 0xd7, 0x9, 0x3}}, 0xfffffffb, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x4}) 1.105290432s ago: executing program 0 (id=12477): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x9, &(0x7f0000000100)=ANY=[@ANYBLOB="63b74ff79662000018000000ffff000000000000050000007f03000100de1768000006000000000000004400182000000000", @ANYRES32, @ANYBLOB="00000000ffff0000"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x12, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000080)={0x2, 0x6, 0x4, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)=[0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0xfffffc00}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r0, 0x0, 0x8f, 0xf0, &(0x7f0000000280)="b9362694cdbb64b10a38ec9f63cefb7041ee9889220e924e9bd2b3c22262d71a97dac2d51b71fdc38ec1864fe4866d3fd3061f3f755fe58f19057098f0e7c9cefb87c84d1b19b27c0d272e4dc6d4ed5ae035d4c41a46283f9c63b883eeb2583668fb53d1d51ff341f52c224e26637e58e46ce2d31fc85c1f297232dac9b8cd289d49735bdd813bfd62795de174015a", &(0x7f0000000340)=""/240, 0x7ff, 0x0, 0x32, 0xa, &(0x7f0000000440)="f6e730681aa03c62f13fc0e83b611ab69323394a7635c53c76760edddcd692defa3cbba492fb8f51622a44757877705ccbd7", &(0x7f0000000480)="3f59c2c5acf603f714b0", 0x3, 0x0, 0x9}, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000024c0)=ANY=[@ANYRES64=0x0], 0x7904}, 0x1, 0x0, 0x0, 0x4040}, 0x0) (async) r2 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r2, &(0x7f0000000740)={&(0x7f0000000140)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000540)="151216526e61caf0806b9190048999a8dcd5945bb24464152d46d923f2e7905f8e27a3e008740659cee4eabb41eb6172b32160bfc3c3db214a2e01e828569905d050f7067d8c2c59dabce8274a8ba4b915e46f47e63d088a2c127baf6b7e79e05807809f66f3f2ead8f1cd9a070d1259c19ee3826138c9c33fbbd8f9d0f99bb2d0ceebe81664dafc16f26e88e1a30b029d211392bc385b9af1b8a11b", 0x9c}, {&(0x7f0000000600)="16cb57555bda69d8345fe7a147741e3b83a646800903834597a93c1e3156023bd04502841687e075a8fc4a5b864bc80c6a827796d2d39d62541eada547f909d28745f41f7e40b4e62d77f192af5c1b36b3e42b519cd6e15b4b6a0a3b464fc771eaac8a27a113c2eae6ae0c12eac6df9a290b2b32", 0x74}, {&(0x7f0000000680)="78423be7642fbe9343cfce71a250bf634f9c02ccaaa81f63297ff8184ab2725710d80c91074d935b833c35893dd1bc86519da7991388566729a0250fc556eb0da631c973adcff019862c8163ff88f9624a30b87ad84f9dc55fafb51c21c7c7a69056a35bdf80f23d760dac92730276a32ef5e68de13c7828dd0895a4edb345", 0x7f}], 0x3, 0x0, 0x0, 0x4040000}, 0x40040) 987.242075ms ago: executing program 4 (id=12478): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071114e00000000008510000002000000850000000d00000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000007c0)=@newlink={0x50, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x10200}, [@IFLA_OPERSTATE={0x5, 0x10, 0x5}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe0}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000300)={0x34, r3, 0x607, 0x0, 0x0, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x40000) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'macvtap0\x00', &(0x7f0000000240)=@ethtool_dump={0x1f, 0x0, 0x1}}) 951.654137ms ago: executing program 0 (id=12479): pipe(&(0x7f0000000000)) unshare(0xc020680) socket$inet_smc(0x2b, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e65766500002000028014000700000000000000000002"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$netlink(r0, 0x10e, 0x9, 0x0, &(0x7f0000000040)) r3 = socket(0x10, 0x80000, 0x6) write(r3, &(0x7f0000000140)="240000005a001f001007f4d655c63589ce9e04020800038005000000ffc8bbb86ec81ffd", 0x24) 826.688309ms ago: executing program 4 (id=12480): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0xa0, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1c, 0x0, &(0x7f0000000040)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r2, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r3, 0x84, 0x75, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0x2, &(0x7f0000000780)=0x2, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001080)=ANY=[@ANYBLOB="b702000024000000bfa30000000000000703000000feffff7a0af0fff8bffffd79a4f0ff00000000b7060000ffffffff2d640500000000006502040001001f000404000001007d60b7030000000000006a0a00fefdff00008500000026000000b7000000000000009500000000000000c743a0c8e3ebbadc20e5a7efcc9ac1467fb2ea80dbcf8df265e1b40e4c8afd5c0c000000008da68076774bbcdb2c769937000090af27db5b56024db96bcbbbd2cb2000ce03000000000000007e357754508535766c80114604a86fe569b05614eab9297eb290a248a120c9c6e39f403ff065fd3052aae80675eeba68562eaeaea5fecf298ca20f274233106eab63ecf772de7b265040b6c50b7420b48a93fe94c756108afcd0b2eb78040000005f02a5a6474ae549070004000000001294fba0ed5020e6474ac921fee1f6d8ad6a80c0947cd6d4a561ced21a0b4a902be6af7ec2d1ba002e57f301000000000000000000000000100000aaf25343063e6581f9e6de14ad72e5ad84309f47f96a576cd20cef7ed951a73ea73d7c7f14e306f1f1d1377e57abb19700f0077e9d0000b93eb0f2c6f8141e350dc68147e5958128d22d58625cf9dba211bfff9c3709c9b134625d3d2369f516a49eeeb1a662c8dfb875bdf5c6ba73cccdfacb202994c40d322717faff03323dce8a34ee0ca2cf61efb4b30000642735d6d482ba98d252f36c54333aab1aa736369392b9067665339820f5f1557b0bf7cc06a5a13c714e0b1a1f000000ff3283076cda3d0b1a2905cfc3d04f1db264b530abcbe44bc405f600807970727fb819afa1907228fa9e83433eedb4ac88d0285594ffb0d14c09d5c77f33702822b02488ea570204c8441ced81cacf945dcb2486d65ceec8bcaffbe800a041a378b40dc9e3600e916ae6307bd8325a442095bc9a8b0c95905979f34adddbb26f0d24425c8ab9d937d84b521914f92eed3d3e9de82942a952e86b567aff5bc2e3c1fcc00f618363df5d0d181ee8f4b8fd356c9eb365adc037e443820c05c5db16ff07a9cf471e2ebf91ab00a05f88c1cd55f8c81f5eb1f8d615ca27efb2193bb61665a1ce37f30c2efc9c3b5a4a5d95479fac471ba60fbd0e50225563cd37343d09da72472efc2b2877fbab12a891513e5f0763ae06c0610a2869747c143d75007606000000b2310e19ac58bf29d7f178d09a9f634a3ae492f54649589e3692768a0f3a082c5242c8fa7f01e0873c9c5c604108ad85950d8e08465fa1067ea8f383b3e7a7ddf5977d46f4bc38f914b4a496426d8468f9ba618b6b2218b50c8fc9efbce3ba799cf70de7e13be871aa7eb402e2b11f440361e18d4e334bfc6ae54e62e67a0338c756c544189e4519a029674e2a2bbbc7f6600000000000800000e5e30b70b198246d3a62660600000030a0af132e680510811d3ab71af5d98e2d3d928a749e8b9402d14655612bd58fb40b4625cb69bf6cea97b447f2d970d99100000000086000001b881afb2cc500003a73562af4878f75b4c98274eeb666aa1f5fcf91990cf0dcfef9540057b8a3fff2bc02c5941626d2015f414546e87835ba18e9101734a9e9c6955fc6b9a25fe2a3dd8bab7f21beccba5493a164c663eceed401737c12c65804712236a9a29a43b1e27e9b6816f2328ea8423121f12b7b35aa721fef26934ccafde573bee5c33ef15309f43cbd5d61aa679a9c402d337ebf57a5eacb569401c1df7b9c45b09743c61d1db37f0000000000020000000000de00d23dd63b7761d7d6818db785d8ba13dc577fe61a68eb365de5661f43d4c789bb117a3d208ae44a38e7868dc32e132124ecf52327631b718b3157e218959156ff8e92b7e92bc275d2c9114547351a0d0f2a70d13be0194b6cb68b03000000000000004f153bbc7f52861e4e5df0d19e4e40ac44cfda6f87807e5b5ed7072c04da88afd3d4b79f060e004a0e2f00b9e726ac75d2ac0691314c627e9a8a07bdd607919fd48f01ad6d2f7621d9a75b134f1bc25ed7c33d411a5baa4daa3add16afc502b2b7629541d722e91d631e5ffb9d4beb5aa5a2c4e490a5bd038c1817f0d4652a29353b05b16b3c5cf4538ba310b8cbc221af38ea842d4cb908bcd574f794459fd54b58c6a791e6df625a47bade4ba41ee014184395a479544619f749ff70088b0fd115077f7eff7c5a3315ca604d110df1c54407f191a78d8362e4dc6e1138391c2a65246779bb76c9f1daea4f085f38810edef6dd047937c231cba791a4e7713c5b3b0a0b6ba37db5016e02d114d714459d065a79609fea4efebad04edac11aac0e53dd094827453144fa419ee81823d00a90a9058ba740d2f41253a8d01a8c1a7265a084e30ad10d412aee8170a7111d62473e7bd8f3d64fb7ebdd32aada331900000000000000000000000084ef49dd020000000000000000000000d9dcb285038ec38d5f4969ed0e98a71ac7bf8159a234833a5241722b2d24aa2fa4965d4eb7966fb27d118b6ef3308627e67d42f1041d5e92da28e0a7724ce715854775cbe06c5166f1dac0745f1373156a536cb6394c2c4473e2050cacf693fdf8e305080000001a901ecd90a5f53b8327a485557bc2a147b036477915e600000000034258ebbb6099b597d17ee2fc97ca850b8580b1337016a40566814594c13052b9d2b0741326825f19a244609ac04a0c29691a7c8f7a78c1a7590a293c561f304533c638ae635f5ce026f7fa034d8cfe0e11831d4829692beab26891ef583cfcb713a4d3a2d8b958c0875d7e4bdcf98802db086ebcbb9d82fa569a18f06facc2ffe1ea9ae4231e1e7a5dd7503faa2de7f898c97788c4b9c61c70ff92abdf7476cc351156d11c0ada7614f315f4c6cca119d16827d4e864f5a7a9b690272a510c451dc07f391309d02e31e53b2bf0b5f86e776b1bcfe6c85ccd7ddf8a9559d58bb5603895f265685fdd11263c946f8ef3ccec1b0d45a47a89b8237cbbdab14e4ca6dc76b2c41e071b93a065c0f5aa718e1cfab29beea78a6bd9a3114f0fb92be9a5862627b4bd99db2c08e4636e43f05f33535d5d1f9bb40e1fd8e5125a3d29b31dd94a6744bbc21722222b976089f073a4d3fcafc6d06518cf0c4fc6c8e3da0000000000000000000000007d3b60775243f2143d9f54804b11102cf0e4c641db1ba8bf75e46ab3a8fdece6562e7ebb3e407f3c7504dfa3da3aecbd49af3d1edeea11cc970416fadeedc8423bfdc85041ac4d8243a1130e6f4cb5bbfed9d095e18c98c7d690e4c491a7ddcd5635bc61dbed719ca28e8ca3f1fbbe588913ed057f1d6e34a79f4dc10df54d1993a5bc5f9ef6dbd339ee4b0b5764169f305e284ef82cc23e9366d4bc7eb45c7230b13433e5240657cb8eba33260147be8620b6d98cc48b000000000000000000000000c1ce872b18984f080100000000000000bd3fded92547d41809b398f36749083a147eb09ff1ed601bd36b873d3947fb223da647052528e0466cb917db7800f7c7000b593fca1903991cca1343882e3a1f60044f11c081dae4fc5bcf20efacdd2c577f4bcda2eea6f75a31dc90eebb6135b6fb824052181b0ad8a49ebf03ccf61d7e39bf6b0762d24d19796016301d1415b5110ba9df7f204aedb2a2e4e621c0553d312b309db67192f98ef7800000d629c04e216afc8fc66616bbf304e452373aa927c2ad6f5417f1b9bc322b802c1c42112a92a331cdc113b9ace3ff52ede7a853f9a89002ba070bac2f635a03db3375e5564f1a798bf9c0f8c72725d2eca9b0ec7e453d78ea20eca61530fe574299b393ca144adcb06108dfbb934065a87972739150a8752ac111c4d9062ccb95c54034fbdee131d94dfbaab1854d55665746fb7b47d25e54070b0d14c0a29c57bc4930075e1761913b036d43852c6df9f10e15105b2a18668298a3577943514db0dce953dcec62139ff3f16066efec5d8cbc0600000000007289be5883aab951ea67cf2ff691d05c1ea91dd569ed9897fe8d88a0a6977dc8955be17e8026aff11c61fa5cc76196c1423cd597345253baa1537eb6962a3ce1fe5d5ab46938e8fb23fa7047bc59c4345e912585a9adb5fe2ff51b64a326321b594e3f2d339f4090bdae6b30b62064bacbc155d3c930576f506b093ca7c60957bdfdd6536baaa871cf6a603c736b78761e6463b8ac503e219cc3d98f649602ad24d5667368290ee926fba76ee482a201a03efece3b236f4ee2ffcd5d90d92a2f0c5cfa48c87f27c2f1e92988a6508c12f6b7755cc48eb10edafca92cb0260c72295a27a24846d3a2334bd60e94c0fd07e5db0a4964a7fc4e89f11a300510776934e87bb3c21394f46954a012b2a3b0760f1bad1dbd6b466ed7153bd18ee2c0b2353c38df9e0782eb"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfe37}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000140)="b99cdfe10723f0f0c10400000000", 0x0, 0x800064fd, 0x18000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) socket(0x1e, 0x4, 0x0) (async) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0xa0, 0x1, 0x1}, 0x1c) (async) recvmmsg$unix(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) (async) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1c, 0x0, &(0x7f0000000040)) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r2, 0x0) (async) socket(0x2, 0x80805, 0x0) (async) getsockopt$bt_hci(r3, 0x84, 0x75, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0x2, &(0x7f0000000780)=0x2, 0x4) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001080)=ANY=[@ANYBLOB="b702000024000000bfa30000000000000703000000feffff7a0af0fff8bffffd79a4f0ff00000000b7060000ffffffff2d640500000000006502040001001f000404000001007d60b7030000000000006a0a00fefdff00008500000026000000b7000000000000009500000000000000c743a0c8e3ebbadc20e5a7efcc9ac1467fb2ea80dbcf8df265e1b40e4c8afd5c0c000000008da68076774bbcdb2c769937000090af27db5b56024db96bcbbbd2cb2000ce03000000000000007e357754508535766c80114604a86fe569b05614eab9297eb290a248a120c9c6e39f403ff065fd3052aae80675eeba68562eaeaea5fecf298ca20f274233106eab63ecf772de7b265040b6c50b7420b48a93fe94c756108afcd0b2eb78040000005f02a5a6474ae549070004000000001294fba0ed5020e6474ac921fee1f6d8ad6a80c0947cd6d4a561ced21a0b4a902be6af7ec2d1ba002e57f301000000000000000000000000100000aaf25343063e6581f9e6de14ad72e5ad84309f47f96a576cd20cef7ed951a73ea73d7c7f14e306f1f1d1377e57abb19700f0077e9d0000b93eb0f2c6f8141e350dc68147e5958128d22d58625cf9dba211bfff9c3709c9b134625d3d2369f516a49eeeb1a662c8dfb875bdf5c6ba73cccdfacb202994c40d322717faff03323dce8a34ee0ca2cf61efb4b30000642735d6d482ba98d252f36c54333aab1aa736369392b9067665339820f5f1557b0bf7cc06a5a13c714e0b1a1f000000ff3283076cda3d0b1a2905cfc3d04f1db264b530abcbe44bc405f600807970727fb819afa1907228fa9e83433eedb4ac88d0285594ffb0d14c09d5c77f33702822b02488ea570204c8441ced81cacf945dcb2486d65ceec8bcaffbe800a041a378b40dc9e3600e916ae6307bd8325a442095bc9a8b0c95905979f34adddbb26f0d24425c8ab9d937d84b521914f92eed3d3e9de82942a952e86b567aff5bc2e3c1fcc00f618363df5d0d181ee8f4b8fd356c9eb365adc037e443820c05c5db16ff07a9cf471e2ebf91ab00a05f88c1cd55f8c81f5eb1f8d615ca27efb2193bb61665a1ce37f30c2efc9c3b5a4a5d95479fac471ba60fbd0e50225563cd37343d09da72472efc2b2877fbab12a891513e5f0763ae06c0610a2869747c143d75007606000000b2310e19ac58bf29d7f178d09a9f634a3ae492f54649589e3692768a0f3a082c5242c8fa7f01e0873c9c5c604108ad85950d8e08465fa1067ea8f383b3e7a7ddf5977d46f4bc38f914b4a496426d8468f9ba618b6b2218b50c8fc9efbce3ba799cf70de7e13be871aa7eb402e2b11f440361e18d4e334bfc6ae54e62e67a0338c756c544189e4519a029674e2a2bbbc7f6600000000000800000e5e30b70b198246d3a62660600000030a0af132e680510811d3ab71af5d98e2d3d928a749e8b9402d14655612bd58fb40b4625cb69bf6cea97b447f2d970d99100000000086000001b881afb2cc500003a73562af4878f75b4c98274eeb666aa1f5fcf91990cf0dcfef9540057b8a3fff2bc02c5941626d2015f414546e87835ba18e9101734a9e9c6955fc6b9a25fe2a3dd8bab7f21beccba5493a164c663eceed401737c12c65804712236a9a29a43b1e27e9b6816f2328ea8423121f12b7b35aa721fef26934ccafde573bee5c33ef15309f43cbd5d61aa679a9c402d337ebf57a5eacb569401c1df7b9c45b09743c61d1db37f0000000000020000000000de00d23dd63b7761d7d6818db785d8ba13dc577fe61a68eb365de5661f43d4c789bb117a3d208ae44a38e7868dc32e132124ecf52327631b718b3157e218959156ff8e92b7e92bc275d2c9114547351a0d0f2a70d13be0194b6cb68b03000000000000004f153bbc7f52861e4e5df0d19e4e40ac44cfda6f87807e5b5ed7072c04da88afd3d4b79f060e004a0e2f00b9e726ac75d2ac0691314c627e9a8a07bdd607919fd48f01ad6d2f7621d9a75b134f1bc25ed7c33d411a5baa4daa3add16afc502b2b7629541d722e91d631e5ffb9d4beb5aa5a2c4e490a5bd038c1817f0d4652a29353b05b16b3c5cf4538ba310b8cbc221af38ea842d4cb908bcd574f794459fd54b58c6a791e6df625a47bade4ba41ee014184395a479544619f749ff70088b0fd115077f7eff7c5a3315ca604d110df1c54407f191a78d8362e4dc6e1138391c2a65246779bb76c9f1daea4f085f38810edef6dd047937c231cba791a4e7713c5b3b0a0b6ba37db5016e02d114d714459d065a79609fea4efebad04edac11aac0e53dd094827453144fa419ee81823d00a90a9058ba740d2f41253a8d01a8c1a7265a084e30ad10d412aee8170a7111d62473e7bd8f3d64fb7ebdd32aada331900000000000000000000000084ef49dd020000000000000000000000d9dcb285038ec38d5f4969ed0e98a71ac7bf8159a234833a5241722b2d24aa2fa4965d4eb7966fb27d118b6ef3308627e67d42f1041d5e92da28e0a7724ce715854775cbe06c5166f1dac0745f1373156a536cb6394c2c4473e2050cacf693fdf8e305080000001a901ecd90a5f53b8327a485557bc2a147b036477915e600000000034258ebbb6099b597d17ee2fc97ca850b8580b1337016a40566814594c13052b9d2b0741326825f19a244609ac04a0c29691a7c8f7a78c1a7590a293c561f304533c638ae635f5ce026f7fa034d8cfe0e11831d4829692beab26891ef583cfcb713a4d3a2d8b958c0875d7e4bdcf98802db086ebcbb9d82fa569a18f06facc2ffe1ea9ae4231e1e7a5dd7503faa2de7f898c97788c4b9c61c70ff92abdf7476cc351156d11c0ada7614f315f4c6cca119d16827d4e864f5a7a9b690272a510c451dc07f391309d02e31e53b2bf0b5f86e776b1bcfe6c85ccd7ddf8a9559d58bb5603895f265685fdd11263c946f8ef3ccec1b0d45a47a89b8237cbbdab14e4ca6dc76b2c41e071b93a065c0f5aa718e1cfab29beea78a6bd9a3114f0fb92be9a5862627b4bd99db2c08e4636e43f05f33535d5d1f9bb40e1fd8e5125a3d29b31dd94a6744bbc21722222b976089f073a4d3fcafc6d06518cf0c4fc6c8e3da0000000000000000000000007d3b60775243f2143d9f54804b11102cf0e4c641db1ba8bf75e46ab3a8fdece6562e7ebb3e407f3c7504dfa3da3aecbd49af3d1edeea11cc970416fadeedc8423bfdc85041ac4d8243a1130e6f4cb5bbfed9d095e18c98c7d690e4c491a7ddcd5635bc61dbed719ca28e8ca3f1fbbe588913ed057f1d6e34a79f4dc10df54d1993a5bc5f9ef6dbd339ee4b0b5764169f305e284ef82cc23e9366d4bc7eb45c7230b13433e5240657cb8eba33260147be8620b6d98cc48b000000000000000000000000c1ce872b18984f080100000000000000bd3fded92547d41809b398f36749083a147eb09ff1ed601bd36b873d3947fb223da647052528e0466cb917db7800f7c7000b593fca1903991cca1343882e3a1f60044f11c081dae4fc5bcf20efacdd2c577f4bcda2eea6f75a31dc90eebb6135b6fb824052181b0ad8a49ebf03ccf61d7e39bf6b0762d24d19796016301d1415b5110ba9df7f204aedb2a2e4e621c0553d312b309db67192f98ef7800000d629c04e216afc8fc66616bbf304e452373aa927c2ad6f5417f1b9bc322b802c1c42112a92a331cdc113b9ace3ff52ede7a853f9a89002ba070bac2f635a03db3375e5564f1a798bf9c0f8c72725d2eca9b0ec7e453d78ea20eca61530fe574299b393ca144adcb06108dfbb934065a87972739150a8752ac111c4d9062ccb95c54034fbdee131d94dfbaab1854d55665746fb7b47d25e54070b0d14c0a29c57bc4930075e1761913b036d43852c6df9f10e15105b2a18668298a3577943514db0dce953dcec62139ff3f16066efec5d8cbc0600000000007289be5883aab951ea67cf2ff691d05c1ea91dd569ed9897fe8d88a0a6977dc8955be17e8026aff11c61fa5cc76196c1423cd597345253baa1537eb6962a3ce1fe5d5ab46938e8fb23fa7047bc59c4345e912585a9adb5fe2ff51b64a326321b594e3f2d339f4090bdae6b30b62064bacbc155d3c930576f506b093ca7c60957bdfdd6536baaa871cf6a603c736b78761e6463b8ac503e219cc3d98f649602ad24d5667368290ee926fba76ee482a201a03efece3b236f4ee2ffcd5d90d92a2f0c5cfa48c87f27c2f1e92988a6508c12f6b7755cc48eb10edafca92cb0260c72295a27a24846d3a2334bd60e94c0fd07e5db0a4964a7fc4e89f11a300510776934e87bb3c21394f46954a012b2a3b0760f1bad1dbd6b466ed7153bd18ee2c0b2353c38df9e0782eb"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfe37}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000140)="b99cdfe10723f0f0c10400000000", 0x0, 0x800064fd, 0x18000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (async) 723.985842ms ago: executing program 0 (id=12481): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x60, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x11, 0x2, {0x5, "0000000000000000000500"}}}, @qdisc_kind_options=@q_blackhole={0xe}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x100}]}, 0x60}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x301, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x5, [@datasec={0x2, 0x0, 0x0, 0xf, 0x3, [], "44942d"}, @datasec={0x5, 0x0, 0x0, 0xf, 0x1, [], "84"}]}, {0x0, [0x2e, 0x61, 0x61]}}, &(0x7f00000014c0)=""/2, 0x39, 0x2, 0x1}, 0x28) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@typed={0x5, 0x4, 0x0, 0x0, @str='\x00'}, @generic="3104d072"]}]}, @typed={0x8, 0x2, 0x0, 0x0, @uid}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x24}}, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0xec, r7, 0xe00, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010102}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xe}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x28}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x70, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x811}, 0x44804) 634.027031ms ago: executing program 2 (id=12482): socket$nl_crypto(0x10, 0x3, 0x15) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xf8, 0x33, 0x100, 0x70bd2d, 0x25dfdbff, {0xb}, [@typed={0xc, 0xd6, 0x0, 0x0, @u64=0x2}, @nested={0xd5, 0x144, 0x0, 0x1, [@generic="7e69d755ff3d838cd3e91ddf8268fb48c164c0e125a3538ab7c2c4ce3f2ee3c9d2feafb820273e1bf0fe05cc6f4f729d1ad4ecefb70a93be7c9d940f330ac367d4d2f5b8a30e42f9c96b393a704ea9e43f90832d3c70e6a97ed08b7902d615655e407ddc077c8d5cfe451905d9bd9646b490feec37a3c8ab78bb29a9c5d4ce8d007551f65ddf9da6ea5d38184268cf8e93f43c25220a440ecd26a248ce2f0d196b4d55a1a1e6206d72819cb6e1afef409a85f66ecb374cb2969595e31d8cb72272014c21a82a3bc91c3d785320281d9d70"]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x1}, 0x40800) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async) listen(r2, 0x0) (async) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x8, 0x4) (async, rerun: 32) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r3, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x80004}, 0x1c) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) (async) listen(r3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES16=r0], 0x54}, 0x1, 0x0, 0x0, 0x200004c1}, 0x0) 590.845884ms ago: executing program 0 (id=12483): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb8, r1, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xa}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7ff}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_NODE={0x18, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3b}]}, @TIPC_NLA_BEARER={0x1c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x44801}, 0x88020) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="450a0000000000006111b4000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) sendmsg$unix(r3, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@rights={{0x18, 0x1, 0x1, [r2, r3]}}], 0x18, 0xcc040}, 0x64004084) close(r3) r4 = socket(0x400000000010, 0x3, 0x0) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @dev}, &(0x7f0000000240)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x13c, 0x0, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0xf8, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x9e, 0x5, "c9709e68203818614578cd27e4fdfa6910e5da879c15a1c9d617d8ec2236c6c7be2975fc313a173fde3ded9c9ccbb638095fc812726c5432310256acb9cd4885cc8eb18b9daf22fb5ed8535a394a0e63f0aef46baa8794afffe865fe6f8057a1191a40572a51ce95424504621aa15446b1a24d7b6800451b13f1117f19a165fdfac12c8f57d531701881281a16ea31e8277a1b26f227525d899c"}, @ETHTOOL_A_BITSET_VALUE={0x4c, 0x4, "06aa8fb3c1f2718bfb242d95729c3355e7fc2b43e933fad87990c51b31ec2a5aa331a8e8ad03389e64feb086d8b2a58bbd9dd2524b538453b429f4cf1ca07560f01071f248336764"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x10}]}, @ETHTOOL_A_DEBUG_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x80}, 0x8814) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x2, 0xffff}, {}, {0x7, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x240088b0}, 0x4041080) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000600)={&(0x7f0000000800)={0x180, r8, 0x200, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x6, 0x22}}}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x80000001}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_TX_RATES={0x90, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0xdb1, 0x8e3, 0x0, 0xe, 0x7, 0x2, 0x4]}}]}, @NL80211_BAND_2GHZ={0x74, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x4, 0x3}, {0x7, 0x2}, {0x3, 0x2}, {0x5, 0x1}, {0x7, 0x8}, {0x7, 0x4}, {0x3, 0x4}, {0x0, 0xa}, {0x0, 0x6}, {0x0, 0x7}, {0x0, 0x9}, {0x1, 0x5}, {0x3, 0xa}, {0x7, 0x2}, {0x1, 0x6}, {0x1, 0x2}, {0x0, 0xa}, {0x0, 0x5}]}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x4, 0xa}, {0x0, 0x2}, {0x1, 0x2}, {0x0, 0x7}, {0x7, 0x8}, {0x7, 0x1}, {0x0, 0xa}, {0x7, 0xa}, {0x7, 0x4}, {0x5, 0x2}, {0x5, 0x3}, {0x7}, {0x1, 0x6}, {0x4, 0x9}, {0x1, 0x9}, {0x2}, {0x7, 0x9}, {0x6, 0x3}, {0x0, 0x9}, {0x1, 0x4}, {0x0, 0x4}, {0x0, 0x4}]}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x12, 0x18, 0x1b, 0x2, 0x2, 0xc, 0x4, 0x6, 0x6c, 0x2, 0x16, 0x12, 0x25, 0x60, 0x48, 0x18]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xe89c, 0x2, 0x4, 0x8000, 0x60d3, 0x1, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x3, 0x3, 0x0, 0x5, 0x0, 0x8, 0x9]}}]}]}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x7}, @NL80211_ATTR_TX_RATES={0x94, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x48, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x1b, 0xc, 0x6c, 0xb, 0x5, 0x50, 0x3e, 0x6c, 0x0, 0x3, 0x3, 0x24, 0x30, 0xc, 0x48, 0x24, 0x1, 0x6c, 0x60, 0xb, 0x12, 0x48, 0x30, 0xc, 0x60, 0x1]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x7fff, 0x3, 0x200, 0x6, 0x4, 0x2, 0x7]}}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x12, 0x9, 0x9, 0x1b, 0xb, 0x3, 0x6, 0x6, 0x23, 0x1b]}]}, @NL80211_BAND_6GHZ={0x48, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4e6, 0x5, 0xf001, 0x100, 0x753e, 0xd, 0x80, 0x2]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5}]}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x40000}, 0x4000800) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r11) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000440)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="0100ffffffff000000003900000008000300", @ANYRES32=r13, @ANYBLOB="18005a801400018005000a"], 0x34}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x100, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x4c}}, 0x4) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 452.11489ms ago: executing program 2 (id=12484): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[@ANYBLOB="b702000010000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db76cf059f40fa2640b6bfb74dd35391b8fa18479da9f4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847db97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ccfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000000000000000000003ba34b611569a451564d3a5400f9097ffe7a37e765be352be71ee24250d6828562c7e24cb763062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89a0000bde05c114e7a020fc1a5fd3eeeb822008b2d7d1cc062b51b0aca4956b557e51a1385cc572b0074b0950fb1437de2590bf99ec7ceb69e1fe2465fce099c992d57b804a22e148ae3411523814aee03ee2df877edfabf4aa94f07c6fdd127e57a8bf7975f2e606c25a299980a6e52fcf7849d45bb38573fbba8afef1aa7a24c805f7aee3e39a3000000000000000000000000000000000000878f88c4742ac490951c36c610a0d266588ec6a0bd300cf160b5a5d9e9fafa49ecc8430832d795e727b7fc2b76e7fc4141fdbb82f45d3cdd3fb8d4b443ab4954fdf5c1b9a6ab3e457f098329307ccb0a1989b6c37509692e952e7244f48bc12569ff8eb30d0f887b85b5ef44fb9a7571319190be0c226ed72f346cc4aa071ae0c72fa8bd00d5590c4f4ba65d0c8e1f4870fe3c414681e41b40163eb1aa2a7429a2208cd6e69c7d959e87da3fd0101159a03ab7fe78881ee7a1ee7a2edff75fb18a181e0c54352be2b7a5b5273198291c28d9141deeb3cdba5d414ae4b0000000000000000000000000009eacd83458d8a606be71970497a4fd4ca3b48ca482ab3804e2fac216b3ba613608b1a465456a33fd08491d337d7344c01cfc9e73"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r0, 0x0, 0xe, 0x0, &(0x7f0000000040)="77d2bcbdedb6eddc072584bc4ed3", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000000)) read(r1, 0x0, 0xff40) 417.966649ms ago: executing program 1 (id=12485): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x50}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)=r0}, 0x20) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000200)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000007c0), 0xffffffffffffffff) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000800)={@multicast2, @local, 0x0}, &(0x7f0000000840)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'gre0\x00', 0x0, 0x18, 0x1, 0x9, 0x3, {{0x6, 0x4, 0x1, 0x2, 0x18, 0x65, 0x0, 0x8, 0x29, 0x0, @empty, @remote, {[@end]}}}}}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r3, &(0x7f0000000a00)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x64, r4, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x44, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x14) r7 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000c80)={{r0, &(0x7f0000000a40)='mptcp_pm\x00', 0x0, &(0x7f0000000ac0)={@align=0x2, {0x1, 0x7, 0x7, 0x4}}, 0x10001, &(0x7f0000000b00), &(0x7f0000000b40)=0x8001}, {[0x1, 0x10000]}, 0xfffff801, 0xd6, &(0x7f0000000b80)=""/214}) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x6, 0x8, 0x8, 0x40}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000480850000002d00000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000d40)=@generic={&(0x7f0000000d00)='./file0\x00', 0x0, 0x18}, 0x18) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0x18, &(0x7f0000000d80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffc00}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r9}}, @alu={0x4, 0x0, 0x0, 0x9, 0x9, 0x51, 0x8}, @map_fd={0x18, 0x7, 0x1, 0x0, r10}, @jmp={0x5, 0x1, 0xc, 0x0, 0x8, 0xffffffffffffffe7, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r11, 0x0, 0xe, 0x0, &(0x7f00000008c0)="e02742e8680d85ff9782762f86dd", 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) connect$can_bcm(r7, &(0x7f0000000140)={0x1d, r12}, 0x10) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000480)={r0, 0x8000000000000001, 0x5, 0xec}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0x20, &(0x7f0000000600)={&(0x7f0000000e40)=""/80, 0xfffffffffffffc7d, 0x0, &(0x7f00000005c0)=""/1, 0x1}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xf, 0x1f, &(0x7f0000000280)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0x9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9502, 0x0, 0x0, 0x0, 0x9}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0x9, 0x5, 0x0, 0xa}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}, @jmp={0x5, 0x0, 0x5, 0x8, 0x3, 0x50}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_val={0x18, 0x9, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x6}, @ringbuf_query], &(0x7f0000000380)='GPL\x00', 0x6, 0x84, &(0x7f00000003c0)=""/132, 0x41100, 0x3a, '\x00', r12, @fallback=0xc, r13, 0x8, &(0x7f00000004c0)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000500)={0x1, 0xf, 0xffffffff, 0xfffffffb}, 0x10, r14, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000680)=[{0x5, 0x2, 0x10, 0x5}], 0x10, 0x4b}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x50}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{}, &(0x7f0000000080), &(0x7f00000000c0)=r0}, 0x20) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000200)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2}, 0x50) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000007c0), 0xffffffffffffffff) (async) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000800)={@multicast2, @local}, &(0x7f0000000840)=0xc) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'gre0\x00', 0x0, 0x18, 0x1, 0x9, 0x3, {{0x6, 0x4, 0x1, 0x2, 0x18, 0x65, 0x0, 0x8, 0x29, 0x0, @empty, @remote, {[@end]}}}}}) (async) sendmsg$MPTCP_PM_CMD_GET_ADDR(r3, &(0x7f0000000a00)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x64, r4, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x44, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x14) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000c80)={{r0, &(0x7f0000000a40)='mptcp_pm\x00', 0x0, &(0x7f0000000ac0)={@align=0x2, {0x1, 0x7, 0x7, 0x4}}, 0x10001, &(0x7f0000000b00), &(0x7f0000000b40)=0x8001}, {[0x1, 0x10000]}, 0xfffff801, 0xd6, &(0x7f0000000b80)=""/214}) (async) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x6, 0x8, 0x8, 0x40}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000480850000002d00000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000d40)=@generic={&(0x7f0000000d00)='./file0\x00', 0x0, 0x18}, 0x18) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0x18, &(0x7f0000000d80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffc00}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r9}}, @alu={0x4, 0x0, 0x0, 0x9, 0x9, 0x51, 0x8}, @map_fd={0x18, 0x7, 0x1, 0x0, r10}, @jmp={0x5, 0x1, 0xc, 0x0, 0x8, 0xffffffffffffffe7, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r11, 0x0, 0xe, 0x0, &(0x7f00000008c0)="e02742e8680d85ff9782762f86dd", 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) (async) connect$can_bcm(r7, &(0x7f0000000140)={0x1d, r12}, 0x10) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000480)={r0, 0x8000000000000001, 0x5, 0xec}) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0x20, &(0x7f0000000600)={&(0x7f0000000e40)=""/80, 0xfffffffffffffc7d, 0x0, &(0x7f00000005c0)=""/1, 0x1}}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xf, 0x1f, &(0x7f0000000280)=@raw=[@map_idx={0x18, 0x2, 0x5, 0x0, 0x9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9502, 0x0, 0x0, 0x0, 0x9}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0x9, 0x5, 0x0, 0xa}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}, @jmp={0x5, 0x0, 0x5, 0x8, 0x3, 0x50}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_val={0x18, 0x9, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x6}, @ringbuf_query], &(0x7f0000000380)='GPL\x00', 0x6, 0x84, &(0x7f00000003c0)=""/132, 0x41100, 0x3a, '\x00', r12, @fallback=0xc, r13, 0x8, &(0x7f00000004c0)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000500)={0x1, 0xf, 0xffffffff, 0xfffffffb}, 0x10, r14, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000680)=[{0x5, 0x2, 0x10, 0x5}], 0x10, 0x4b}, 0x94) (async) 265.5092ms ago: executing program 0 (id=12486): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000042000100fffffffffddbdf250200000018003880140003801000060000007e00ac66d0741d000000100001800c00c800020000000000000004000480ae3900000000000000000734bd00a3d372ff16e66f082e2183d8f475dfb893fc4ff4d1e2ee665a4638f4cd3ab19076e4c3beac15b89b8f24d847320c8b7eba881256ff71b7da9e3c3f752e315f456e75b5625f97d639f7fc53547d962303de0c74da3a98da70db46afd42db6fc"], 0x40}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) 196.253689ms ago: executing program 2 (id=12487): mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000400000/0x3000)=nil, 0x3000, 0x2000009, 0x4d032, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x204000) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x4}, 0x4) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000080)) (async) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000080)) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 163.554729ms ago: executing program 1 (id=12488): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0xfffffffe, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5}, @IFLA_BOND_AD_ACTOR_SYS_PRIO={0x6, 0x18, 0x696}]}}}]}, 0x44}}, 0x40000c0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000ac0)=@deltclass={0xdc, 0x29, 0x100, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x10, 0xfff1}, {0xfff2, 0x3}, {0x0, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x80}}, @tclass_kind_options=@c_hfsc={{0x9}, {0x64, 0x2, [@TCA_HFSC_USC={0x10, 0x3, {0x8, 0xffffffff, 0xfffffff9}}, @TCA_HFSC_USC={0x10, 0x3, {0x7, 0xa76, 0xa}}, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x9, 0x8bc}}, @TCA_HFSC_FSC={0x10, 0x2, {0x80, 0xffffffff, 0x10001}}, @TCA_HFSC_RSC={0x10, 0x1, {0x3, 0x3, 0xd390}}, @TCA_HFSC_USC={0x10, 0x3, {0x4, 0x9, 0xffff0001}}]}}, @TCA_RATE={0x6, 0x5, {0x40, 0x5}}, @tclass_kind_options=@c_qfq={{0x8}, {0x14, 0x2, [@TCA_QFQ_LMAX={0x8, 0x2, 0x4}, @TCA_QFQ_LMAX={0x8, 0x2, 0x7fff}]}}, @TCA_RATE={0x6, 0x5, {0x1, 0x3}}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @tclass_kind_options=@c_skbprio={0xc}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$unix(0x1, 0x1, 0x0) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x4a, &(0x7f00000003c0)=""/74, 0x40f00, 0x3, '\x00', 0x0, 0x0, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000480)={0x5, 0x1, 0x18c9d50b, 0x3}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa1c}, 0x94) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r10, 0x0, 0x0, 0x24048000, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x41, &(0x7f0000002000)=0x4080, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newtfilter={0x168, 0x2c, 0xd27, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x134, 0x2, [@TCA_MATCHALL_ACT={0x130, 0x2, [@m_tunnel_key={0x12c, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x7cff, 0xbd, 0x1, 0x6, 0x1ff}, 0x2}}]}, {0xdd, 0x6, "bb5b2a0d3ed842621b2d33b7e6c1af88d4a8d4733de633d2557123eeb57ddd0b30f5af4154afcd643df3fe853e826e0a4b0f182c950f8f0b59c98742cd1692291a3d62429abc48b282c70d65e5ced578d06868dd051c1b13af7d6e60c30d2c35392aa023e3a284606907c49987189e3545de32ad6424714128e3eda3c72cec8cd0d8db1789f6ed24e5dfe7d9960b83652e139ee4b8aa20a3fdd5b118685f0bd5c4122a45a2fea8833568a40278ddf3c7a20c8fcf38b7dd87038da78acbde6fcf8d7aa0e4a639dd44dcb09900"/217}, {0x8, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x168}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) r13 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$kcm(r13, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r12, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000900)="c1141c54d564933891486dd0edb868a509000f352cce1efe0a207b8f953b31d64fa9b9366ebb9228ab1a8490e52a171d5eede0277ec7d4a243fde1670e406e3c42f5799d41d21a3d444f59b4bbd6d76292cc4001505c4c20c886393d3d654c5e1585b5ce6dfe45e6638928ba3fb40abba5fffd8c3760d95be7b008f9f388b36b05000000000000003cc064060b2ac35d9b273b1f25c42c40671e0dd4d0d20a329afc4891dbf19551042c7d8a97d147d444258cc20eb60c9ceea11e6fd8e1b0e49487d399d50df0a77e54673f53c976db5e0b6c6deaa75a897c534414d25b99a910db88625dfa5c95a3adce", 0xeb}], 0x2}, 0x5) r14 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_FW_DOWNLOAD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x30, r14, 0x100, 0x70bd27, 0x25dfdbff, {}, [@NFC_ATTR_FIRMWARE_NAME={0x6, 0x14, '#+'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r15}, @NFC_ATTR_FIRMWARE_NAME={0x9, 0x14, 'bond\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x20044004}, 0x24008890) 0s ago: executing program 0 (id=12489): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newqdisc={0x70, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r6, {}, {0xfff2, 0x2}, {0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x9c4}, @TCA_TBF_PBURST={0x8, 0x7, 0x1fc0}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x1, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x5, 0x4, 0x3}, 0xfffffffd, 0x7f, 0xfffffffd}}]}}, @TCA_INGRESS_BLOCK={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000080) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r3, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@dellinkprop={0x20, 0x6d, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0xa, 0x22000}}, 0x20}, 0x1, 0x0, 0x0, 0x4000005}, 0x40000) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfd9f7, {0x0, 0x0, 0x0, 0x0, 0x2813, 0x2c21}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, r8, 0x2882, 0x10401}}}}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) getsockopt$bt_BT_SNDMTU(r5, 0x112, 0xc, &(0x7f00000001c0)=0x3, &(0x7f0000000240)=0x2) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x20, r9, 0x10, 0x1000, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x20044050}, 0x80) kernel console output (not intermixed with test programs): sed all slaves [ 1332.528974][T14221] bond1 (unregistering): Released all slaves [ 1332.543037][T14221] bond2 (unregistering): Released all slaves [ 1332.557530][T14221] bond3 (unregistering): Released all slaves [ 1332.579330][T14221] bond4 (unregistering): Released all slaves [ 1332.592648][T14221] bond5 (unregistering): Released all slaves [ 1332.607145][T14221] bond6 (unregistering): Released all slaves [ 1332.621024][T14221] bond7 (unregistering): Released all slaves [ 1332.641087][T14221] bond8 (unregistering): Released all slaves [ 1332.671845][T16698] : entered promiscuous mode [ 1332.827796][T14221] : left promiscuous mode [ 1332.953659][T14221] tipc: Left network mode [ 1333.154111][T16743] netlink: 'syz.0.11067': attribute type 10 has an invalid length. [ 1333.162231][T16733] wlan1 speed is unknown, defaulting to 1000 [ 1333.212206][T16733] lo speed is unknown, defaulting to 1000 [ 1333.222099][T16746] netlink: 'syz.4.11068': attribute type 29 has an invalid length. [ 1333.236506][T16733] wg1 speed is unknown, defaulting to 1000 [ 1333.262299][T16746] netlink: 'syz.4.11068': attribute type 29 has an invalid length. [ 1333.272364][T16746] netlink: 500 bytes leftover after parsing attributes in process `syz.4.11068'. [ 1333.455171][T16751] netlink: 104 bytes leftover after parsing attributes in process `syz.4.11069'. [ 1333.507217][T16752] netlink: 104 bytes leftover after parsing attributes in process `syz.4.11069'. [ 1333.829396][T16766] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1333.864055][T14221] batadv0: left promiscuous mode [ 1333.966880][T14221] hsr_slave_0: left promiscuous mode [ 1333.980684][T14221] hsr_slave_1: left promiscuous mode [ 1334.299309][T16795] netlink: 'syz.0.11081': attribute type 10 has an invalid length. [ 1334.741095][T16796] netlink: 'syz.2.11080': attribute type 3 has an invalid length. [ 1334.763838][T16795] team0: Cannot enslave team device to itself [ 1334.999105][T16812] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11084'. [ 1335.273808][T16820] netlink: 'syz.1.11086': attribute type 21 has an invalid length. [ 1335.282413][T16823] rdma_rxe: rxe_newlink: failed to add lo [ 1335.297727][T16822] rdma_rxe: rxe_newlink: failed to add lo [ 1335.355718][T16820] netlink: 132 bytes leftover after parsing attributes in process `syz.1.11086'. [ 1335.629934][T16833] netlink: 'syz.1.11088': attribute type 1 has an invalid length. [ 1335.658214][T14221] IPVS: stop unused estimator thread 0... [ 1335.667529][T16833] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 1336.009138][T16850] netlink: 176 bytes leftover after parsing attributes in process `syz.0.11092'. [ 1336.186154][T16843] wlan1 speed is unknown, defaulting to 1000 [ 1336.206071][T16857] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11093'. [ 1336.290861][T16856] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1336.293889][T16851] wlan1 speed is unknown, defaulting to 1000 [ 1336.308950][T16843] lo speed is unknown, defaulting to 1000 [ 1336.339537][T16843] wg1 speed is unknown, defaulting to 1000 [ 1336.355639][T16851] lo speed is unknown, defaulting to 1000 [ 1336.438245][T16851] wg1 speed is unknown, defaulting to 1000 [ 1337.648753][T16921] netlink: 'syz.3.11108': attribute type 9 has an invalid length. [ 1337.784303][T16926] syzkaller0: entered promiscuous mode [ 1337.791040][T16926] syzkaller0: entered allmulticast mode [ 1337.808621][T16928] tunl0: Caught tx_queue_len zero misconfig [ 1337.828327][T16932] netlink: 160 bytes leftover after parsing attributes in process `syz.4.11111'. [ 1338.073233][T16928] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1338.087119][T16928] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1338.120540][T16940] netlink: 666 bytes leftover after parsing attributes in process `syz.1.11110'. [ 1338.222750][T16928] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1338.254497][T16928] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1338.398105][T16955] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11114'. [ 1338.436031][T16928] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1338.472841][T16928] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1338.527748][T16964] netlink: 292 bytes leftover after parsing attributes in process `syz.2.11116'. [ 1338.558255][T16955] veth0_to_team: entered promiscuous mode [ 1338.605451][T16955] veth0_to_team: left promiscuous mode [ 1338.630268][T16970] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11115'. [ 1338.717481][T16974] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11117'. [ 1338.747247][T16928] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1338.758550][T16928] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1339.021970][T16983] sch_tbf: burst 1447 is lower than device macvtap0 mtu (1514) ! [ 1339.373643][T25354] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1339.383484][T25354] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1339.440055][T25354] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1339.476876][T25354] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1339.511081][T17005] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11125'. [ 1339.550780][T14221] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1339.569453][T14221] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1339.628748][T14221] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1339.646654][T14221] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1339.938573][T17025] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11128'. [ 1340.067056][T17001] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11122'. [ 1340.117913][T17001] netlink: 68 bytes leftover after parsing attributes in process `syz.2.11122'. [ 1340.135173][T17032] netlink: 'syz.1.11129': attribute type 11 has an invalid length. [ 1340.148394][T17032] netlink: 'syz.1.11129': attribute type 4 has an invalid length. [ 1340.750780][T17043] syzkaller1: entered promiscuous mode [ 1340.768805][T17043] syzkaller1: entered allmulticast mode [ 1340.965258][T17053] netlink: 'syz.3.11133': attribute type 3 has an invalid length. [ 1341.480790][T17085] wlan1 speed is unknown, defaulting to 1000 [ 1341.489325][T17085] lo speed is unknown, defaulting to 1000 [ 1341.498315][T17085] wg1 speed is unknown, defaulting to 1000 [ 1342.091606][T17105] wlan1 speed is unknown, defaulting to 1000 [ 1342.111139][T17105] lo speed is unknown, defaulting to 1000 [ 1342.126919][T17107] netlink: 'syz.2.11150': attribute type 58 has an invalid length. [ 1342.137913][T17105] wg1 speed is unknown, defaulting to 1000 [ 1342.356626][T17122] wlan1 speed is unknown, defaulting to 1000 [ 1342.372554][T17127] netlink: 'syz.4.11154': attribute type 4 has an invalid length. [ 1342.384472][T17125] macsec0: entered allmulticast mode [ 1342.393019][T17125] veth1_macvtap: entered allmulticast mode [ 1342.423557][T17125] macsec0: left allmulticast mode [ 1342.433457][T17125] veth1_macvtap: left allmulticast mode [ 1342.439855][T17122] lo speed is unknown, defaulting to 1000 [ 1342.448846][T17122] wg1 speed is unknown, defaulting to 1000 [ 1342.676603][T17144] netlink: 'syz.0.11158': attribute type 16 has an invalid length. [ 1343.067518][T17163] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1343.097221][T17166] __nla_validate_parse: 6 callbacks suppressed [ 1343.097242][T17166] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11164'. [ 1343.123542][T17166] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11164'. [ 1343.548863][T17179] bond7: invalid ARP target 0.0.0.0 specified for addition [ 1343.563781][T17179] bond7: option arp_ip_target: invalid value (0) [ 1343.592456][T17179] bond7 (unregistering): Released all slaves [ 1343.689113][T17190] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11170'. [ 1343.752024][ T30] audit: type=1107 audit(1771451618.722:35): pid=17192 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 1343.952127][T17208] netlink: 84 bytes leftover after parsing attributes in process `syz.4.11175'. [ 1344.129468][T17216] netlink: 'syz.0.11178': attribute type 1 has an invalid length. [ 1344.217265][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11178'. [ 1344.221950][T17216] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1344.254077][T17222] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11180'. [ 1344.254609][T17221] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11180'. [ 1344.303969][T17225] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11178'. [ 1344.377106][T17224] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 1344.546361][T17240] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11183'. [ 1344.568852][T17244] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11185'. [ 1344.600765][T17243] netlink: 'syz.2.11184': attribute type 1 has an invalid length. [ 1344.609928][T17245] netlink: 'syz.2.11184': attribute type 1 has an invalid length. [ 1344.831096][T17265] netlink: 'syz.0.11188': attribute type 9 has an invalid length. [ 1347.195669][T17224] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1347.481286][T17282] syzkaller0: entered promiscuous mode [ 1347.488978][T17282] syzkaller0: entered allmulticast mode [ 1347.505686][T17292] pimreg: tun_chr_ioctl cmd 1074025677 [ 1347.521188][T17292] pimreg: linktype set to 1 [ 1349.925837][T17339] __nla_validate_parse: 5 callbacks suppressed [ 1349.925857][T17339] netlink: 584 bytes leftover after parsing attributes in process `syz.3.11209'. [ 1350.195324][T17357] netlink: 'syz.0.11216': attribute type 2 has an invalid length. [ 1350.286235][T17367] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11214'. [ 1350.295372][T17360] wlan1 speed is unknown, defaulting to 1000 [ 1350.297103][T17360] lo speed is unknown, defaulting to 1000 [ 1350.353131][T17360] wg1 speed is unknown, defaulting to 1000 [ 1350.433010][T17375] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11219'. [ 1350.486561][T17377] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11218'. [ 1350.549116][T17380] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11220'. [ 1350.561919][T17380] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11220'. [ 1350.705268][T17388] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1351.042040][T17404] netlink: 'syz.1.11226': attribute type 6 has an invalid length. [ 1351.096774][T17404] netlink: 'syz.1.11226': attribute type 83 has an invalid length. [ 1351.162401][T17408] syzkaller0: entered promiscuous mode [ 1351.170722][T17408] syzkaller0: entered allmulticast mode [ 1351.248677][T17418] syz_tun: entered promiscuous mode [ 1351.268093][T17421] Cannot find add_set index 1 as target [ 1351.269939][T17418] syz_tun: entered allmulticast mode [ 1351.282257][T17412] tipc: Enabled bearer , priority 0 [ 1351.394589][T17412] syzkaller0: entered promiscuous mode [ 1351.406995][T17412] syzkaller0: entered allmulticast mode [ 1351.416619][T17412] tipc: Resetting bearer [ 1351.465942][T17433] FAULT_INJECTION: forcing a failure. [ 1351.465942][T17433] name failslab, interval 1, probability 0, space 0, times 0 [ 1351.480797][T17433] CPU: 0 UID: 0 PID: 17433 Comm: syz.1.11235 Not tainted syzkaller #0 PREEMPT(full) [ 1351.480826][T17433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1351.480839][T17433] Call Trace: [ 1351.480847][T17433] [ 1351.480856][T17433] dump_stack_lvl+0xe8/0x150 [ 1351.480888][T17433] should_fail_ex+0x412/0x560 [ 1351.480923][T17433] should_failslab+0xa8/0x100 [ 1351.480954][T17433] __kvmalloc_node_noprof+0x178/0x8a0 [ 1351.480982][T17433] ? alloc_netdev_mqs+0xc89/0x11b0 [ 1351.481010][T17433] ? alloc_netdev_mqs+0xbf8/0x11b0 [ 1351.481043][T17433] alloc_netdev_mqs+0xc89/0x11b0 [ 1351.481077][T17433] rtnl_create_link+0x31f/0xd70 [ 1351.481113][T17433] rtnl_newlink_create+0x277/0xb70 [ 1351.481137][T17433] ? __pfx___nla_validate_parse+0x10/0x10 [ 1351.481168][T17433] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1351.481196][T17433] ? __pfx___mutex_lock+0x10/0x10 [ 1351.481235][T17433] ? ns_capable+0x89/0xe0 [ 1351.481260][T17433] rtnl_newlink+0x1666/0x1be0 [ 1351.481300][T17433] ? __pfx_rtnl_newlink+0x10/0x10 [ 1351.481319][T17433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.481379][T17433] ? kasan_quarantine_put+0xbb/0x1f0 [ 1351.481398][T17433] ? lockdep_hardirqs_on+0x7a/0x110 [ 1351.481421][T17433] ? nlmon_xmit+0xb0/0x100 [ 1351.481442][T17433] ? kmem_cache_free+0x180/0x610 [ 1351.481473][T17433] ? __lock_acquire+0x6b5/0x2cf0 [ 1351.481504][T17433] ? __local_bh_enable_ip+0xd0/0x130 [ 1351.481525][T17433] ? lockdep_hardirqs_on+0x7a/0x110 [ 1351.481547][T17433] ? __dev_queue_xmit+0x274/0x3850 [ 1351.481571][T17433] ? __local_bh_enable_ip+0xd0/0x130 [ 1351.481599][T17433] ? __dev_queue_xmit+0x274/0x3850 [ 1351.481630][T17433] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1351.481667][T17433] ? __pfx_rtnl_newlink+0x10/0x10 [ 1351.481686][T17433] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1351.481711][T17433] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1351.481731][T17433] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1351.481748][T17433] ? ref_tracker_free+0x693/0x840 [ 1351.481774][T17433] ? __copy_skb_header+0xa3/0x4a0 [ 1351.481800][T17433] ? __pfx_ref_tracker_free+0x10/0x10 [ 1351.481836][T17433] netlink_rcv_skb+0x232/0x4b0 [ 1351.481857][T17433] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1351.481880][T17433] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1351.481911][T17433] ? netlink_deliver_tap+0x2e/0x1b0 [ 1351.481940][T17433] netlink_unicast+0x80f/0x9b0 [ 1351.481976][T17433] ? __pfx_netlink_unicast+0x10/0x10 [ 1351.482004][T17433] ? netlink_sendmsg+0x650/0xb40 [ 1351.482020][T17433] ? skb_put+0x11b/0x210 [ 1351.482045][T17433] netlink_sendmsg+0x813/0xb40 [ 1351.482075][T17433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1351.482100][T17433] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1351.482126][T17433] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1351.482155][T17433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1351.482174][T17433] ____sys_sendmsg+0xa68/0xad0 [ 1351.482198][T17433] ? __might_fault+0xaf/0x130 [ 1351.482229][T17433] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1351.482262][T17433] ? import_iovec+0x73/0xa0 [ 1351.482287][T17433] ___sys_sendmsg+0x2a5/0x360 [ 1351.482308][T17433] ? __lock_acquire+0x6b5/0x2cf0 [ 1351.482331][T17433] ? __pfx____sys_sendmsg+0x10/0x10 [ 1351.482394][T17433] ? __fget_files+0x2a/0x420 [ 1351.482414][T17433] ? __fget_files+0x3a0/0x420 [ 1351.482446][T17433] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1351.482472][T17433] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1351.482508][T17433] ? __pfx_ksys_write+0x10/0x10 [ 1351.482544][T17433] do_syscall_64+0x14d/0xf80 [ 1351.482568][T17433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.482595][T17433] ? trace_irq_disable+0x37/0x100 [ 1351.482616][T17433] ? clear_bhb_loop+0x40/0x90 [ 1351.482640][T17433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.482659][T17433] RIP: 0033:0x7f75e579c629 [ 1351.482678][T17433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1351.482695][T17433] RSP: 002b:00007f75e66bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1351.482717][T17433] RAX: ffffffffffffffda RBX: 00007f75e5a15fa0 RCX: 00007f75e579c629 [ 1351.482732][T17433] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 1351.482743][T17433] RBP: 00007f75e66bc090 R08: 0000000000000000 R09: 0000000000000000 [ 1351.482755][T17433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1351.482767][T17433] R13: 00007f75e5a16038 R14: 00007f75e5a15fa0 R15: 00007fff6a3a0e58 [ 1351.482800][T17433] [ 1351.960522][T17429] tipc: Resetting bearer [ 1353.995097][T17429] tipc: Disabling bearer [ 1354.040567][T17447] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1354.054698][ T7423] tipc: Node number set to 1919029847 [ 1354.137789][T17458] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11240'. [ 1354.168643][T17462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11241'. [ 1354.223872][T17462] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11241'. [ 1354.255303][T17462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11241'. [ 1354.369920][T17470] 8021q: VLANs not supported on ip_vti0 [ 1354.388056][ T30] audit: type=1800 audit(1771451629.342:36): pid=17470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.11244" name="memory.events" dev="tmpfs" ino=2215 res=0 errno=0 [ 1354.446396][ T30] audit: type=1804 audit(1771451629.362:37): pid=17470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.11244" name="/newroot/432/memory.events" dev="tmpfs" ino=2215 res=1 errno=0 [ 1354.542413][T17486] mac80211_hwsim hwsim113 wlan0: entered promiscuous mode [ 1355.151313][T17532] __nla_validate_parse: 2 callbacks suppressed [ 1355.151333][T17532] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11260'. [ 1355.201124][T17535] batadv_slave_1: entered promiscuous mode [ 1355.245537][T17540] netlink: 64 bytes leftover after parsing attributes in process `syz.2.11262'. [ 1355.363286][T17535] batadv_slave_1: left promiscuous mode [ 1355.700678][T17571] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11272'. [ 1355.714739][T17569] wlan1 speed is unknown, defaulting to 1000 [ 1355.723241][T17569] lo speed is unknown, defaulting to 1000 [ 1355.740957][T17569] wg1 speed is unknown, defaulting to 1000 [ 1356.030704][T17584] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11275'. [ 1356.058849][T17584] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11275'. [ 1356.101983][T17588] netlink: 'syz.3.11274': attribute type 1 has an invalid length. [ 1356.116584][T17589] netlink: 44 bytes leftover after parsing attributes in process `syz.1.11276'. [ 1356.241450][T17592] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11278'. [ 1356.342053][T17596] wlan1 speed is unknown, defaulting to 1000 [ 1356.350814][T17596] lo speed is unknown, defaulting to 1000 [ 1356.362696][T17596] wg1 speed is unknown, defaulting to 1000 [ 1356.408000][T17599] wlan1 speed is unknown, defaulting to 1000 [ 1356.433132][T17599] lo speed is unknown, defaulting to 1000 [ 1356.462619][T17599] wg1 speed is unknown, defaulting to 1000 [ 1356.638454][T17613] mac80211_hwsim hwsim121 syzkaller0: entered promiscuous mode [ 1356.646320][T17613] mac80211_hwsim hwsim121 syzkaller0: entered allmulticast mode [ 1356.675897][T17613] geneve0: entered promiscuous mode [ 1356.682709][T14218] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20002 - 0 [ 1356.705935][T14220] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20002 - 0 [ 1356.719465][T14220] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20002 - 0 [ 1356.882827][T17621] netlink: 156 bytes leftover after parsing attributes in process `syz.2.11286'. [ 1356.883688][T17619] netlink: 44 bytes leftover after parsing attributes in process `syz.0.11285'. [ 1356.998654][T17627] ip6gre2: entered promiscuous mode [ 1357.018717][T17627] ip6gre2: entered allmulticast mode [ 1357.037984][T17626] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11287'. [ 1357.161321][T17643] RDS: rds_bind could not find a transport for fc02::, load rds_tcp or rds_rdma? [ 1357.856514][T14218] ip6_tnl_xmit_ctl: 3 callbacks suppressed [ 1357.856533][T14218] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1357.872334][T14218] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1357.883875][ T1197] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1357.943629][ T5892] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1358.183690][ T5892] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1359.833821][T17619] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1361.861400][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 1361.933611][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1367.133683][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5270 ms [ 1367.141706][ C0] lec:lec_tx_timeout: lec0 [ 1370.173675][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1375.362394][T14653] lec:lec_start_xmit: lec0:No lecd attached [ 1381.133437][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5770 ms [ 1381.141617][ C0] lec:lec_tx_timeout: lec0 [ 1384.478227][T17667] bridge0: entered promiscuous mode [ 1384.619197][T17675] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11300'. [ 1384.643853][T17676] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11300'. [ 1384.893869][T17684] netlink: 'syz.3.11302': attribute type 8 has an invalid length. [ 1384.915318][T17684] tipc: Enabling of bearer rejected, failed to enable media [ 1385.086282][T17707] tipc: Enabled bearer , priority 0 [ 1385.095549][T17706] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11309'. [ 1385.157266][T17707] tipc: Resetting bearer [ 1385.533547][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1386.039285][T17761] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.11317'. [ 1386.165567][ T5892] tipc: Node number set to 1227104411 [ 1386.242375][T17775] nbd: couldn't find device at index 536870912 [ 1386.357652][T17765] wlan1 speed is unknown, defaulting to 1000 [ 1386.369878][T17779] netlink: 132 bytes leftover after parsing attributes in process `syz.3.11320'. [ 1386.391052][T17765] lo speed is unknown, defaulting to 1000 [ 1386.409969][T17765] wg1 speed is unknown, defaulting to 1000 [ 1386.930373][ T5484] veth0_macvtap: left promiscuous mode [ 1386.936591][T17809] netlink: 64 bytes leftover after parsing attributes in process `syz.0.11326'. [ 1386.964674][T17810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11324'. [ 1387.295852][T17821] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11328'. [ 1387.336339][T17824] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1388.836766][T17880] pim6reg: entered allmulticast mode [ 1389.092638][T17892] netlink: 'syz.1.11342': attribute type 1 has an invalid length. [ 1389.111348][T17892] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11342'. [ 1389.202022][T17898] netlink: 32 bytes leftover after parsing attributes in process `syz.2.11345'. [ 1389.279253][T17902] netlink: 'syz.0.11346': attribute type 4 has an invalid length. [ 1389.481008][T17910] syzkaller0: entered promiscuous mode [ 1389.491026][T17910] syzkaller0: entered allmulticast mode [ 1389.611475][T17924] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1389.633734][T17924] syzkaller1: linktype set to 778 [ 1389.984291][T17940] __nla_validate_parse: 3 callbacks suppressed [ 1389.984326][T17940] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.11355'. [ 1390.200144][T17967] wlan1 speed is unknown, defaulting to 1000 [ 1390.225350][T17973] netlink: 52 bytes leftover after parsing attributes in process `syz.1.11361'. [ 1390.236351][T17967] lo speed is unknown, defaulting to 1000 [ 1390.307825][T17979] netlink: 76 bytes leftover after parsing attributes in process `syz.1.11361'. [ 1390.316624][T17978] netlink: 'syz.4.11363': attribute type 1 has an invalid length. [ 1390.337082][T17967] wg1 speed is unknown, defaulting to 1000 [ 1390.349560][T17979] bridge0: left promiscuous mode [ 1390.375404][T17979] bridge0: left allmulticast mode [ 1390.384127][T17979] bridge0: entered promiscuous mode [ 1390.398573][T17979] netlink: 52 bytes leftover after parsing attributes in process `syz.1.11361'. [ 1390.457846][T17977] netlink: 52 bytes leftover after parsing attributes in process `syz.2.11362'. [ 1390.548345][T17987] syzkaller0: entered promiscuous mode [ 1390.631624][T17987] syzkaller0: entered allmulticast mode [ 1391.007678][T18001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11369'. [ 1391.070959][T18004] netlink: 56 bytes leftover after parsing attributes in process `syz.1.11370'. [ 1391.216600][T18007] netlink: 56 bytes leftover after parsing attributes in process `syz.4.11371'. [ 1391.249849][T18007] tipc: Enabling of bearer rejected, failed to enable media [ 1391.281140][T18012] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11373'. [ 1391.468708][T18012] bond4 (unregistering): Released all slaves [ 1391.755068][T18033] syzkaller1: entered promiscuous mode [ 1391.783394][T18033] syzkaller1: entered allmulticast mode [ 1391.805125][T18042] wlan1 speed is unknown, defaulting to 1000 [ 1391.906816][T18042] lo speed is unknown, defaulting to 1000 [ 1391.958900][T18042] wg1 speed is unknown, defaulting to 1000 [ 1392.084063][T18063] netlink: 'syz.1.11381': attribute type 10 has an invalid length. [ 1392.109878][T18062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11382'. [ 1392.158265][T18062] 8021q: VLANs not supported on bond0 [ 1392.531568][T18086] vlan4: entered promiscuous mode [ 1392.542405][T18086] gretap0: entered promiscuous mode [ 1393.214867][T18107] tipc: Enabling of bearer rejected, failed to enable media [ 1393.548616][T18121] syzkaller1: entered promiscuous mode [ 1393.555485][T18121] syzkaller1: entered allmulticast mode [ 1393.770658][T18127] wlan1 speed is unknown, defaulting to 1000 [ 1393.797349][T18127] lo speed is unknown, defaulting to 1000 [ 1393.826436][T18127] wg1 speed is unknown, defaulting to 1000 [ 1394.239993][T18154] netlink: 'syz.0.11403': attribute type 13 has an invalid length. [ 1394.407649][T18151] wlan1 speed is unknown, defaulting to 1000 [ 1394.417795][T18170] netlink: 'syz.1.11401': attribute type 2 has an invalid length. [ 1394.438794][T18151] lo speed is unknown, defaulting to 1000 [ 1394.458976][T18151] wg1 speed is unknown, defaulting to 1000 [ 1394.909678][T18183] mac80211_hwsim hwsim121 syzkaller0: Caught tx_queue_len zero misconfig [ 1394.927000][T18183] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1394.934404][T18183] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1394.942243][T18183] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1395.235740][T18196] netlink: 'syz.0.11412': attribute type 4 has an invalid length. [ 1395.291209][T18199] netlink: 'syz.0.11412': attribute type 4 has an invalid length. [ 1395.429555][T18209] __nla_validate_parse: 3 callbacks suppressed [ 1395.429576][T18209] netlink: 32 bytes leftover after parsing attributes in process `syz.1.11415'. [ 1395.466033][T18210] netlink: 32 bytes leftover after parsing attributes in process `syz.1.11415'. [ 1395.502427][T18212] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11416'. [ 1395.669225][T18225] netlink: 140 bytes leftover after parsing attributes in process `syz.3.11419'. [ 1395.695161][T18225] openvswitch: netlink: Flow key attr not present in new flow. [ 1395.754309][T18228] netlink: 7060 bytes leftover after parsing attributes in process `syz.2.11421'. [ 1395.770814][T18226] wlan1 speed is unknown, defaulting to 1000 [ 1395.804002][T18228] netlink: 32 bytes leftover after parsing attributes in process `syz.2.11421'. [ 1395.806230][T18226] lo speed is unknown, defaulting to 1000 [ 1395.823748][T18232] xt_bpf: check failed: parse error [ 1395.854742][T18226] wg1 speed is unknown, defaulting to 1000 [ 1396.232396][T18248] macsec1: entered allmulticast mode [ 1396.245639][T18248] macsec0: entered allmulticast mode [ 1396.262395][T18248] veth1_macvtap: entered allmulticast mode [ 1396.285757][T18258] netlink: 44 bytes leftover after parsing attributes in process `syz.4.11431'. [ 1396.708693][T18272] netlink: 'syz.3.11435': attribute type 1 has an invalid length. [ 1396.804814][T18274] bond8: entered promiscuous mode [ 1396.809907][T18274] bond8: entered allmulticast mode [ 1396.848930][T18274] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1396.878443][T18272] bridge13: entered promiscuous mode [ 1396.884130][T18272] bridge13: entered allmulticast mode [ 1396.890457][T18272] bond8: (slave bridge13): Enslaving as a backup interface with an up link [ 1396.914860][T14217] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1396.936556][T18272] bridge14: entered promiscuous mode [ 1396.945716][T18272] bridge14: entered allmulticast mode [ 1396.956642][T18272] bond8: (slave bridge14): Enslaving as a backup interface with a down link [ 1396.969278][T18282] netlink: 40 bytes leftover after parsing attributes in process `syz.2.11436'. [ 1397.040597][T18283] syzkaller1: entered promiscuous mode [ 1397.066145][T14220] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1397.073638][T18283] syzkaller1: entered allmulticast mode [ 1397.140964][T18285] netlink: 'syz.2.11438': attribute type 13 has an invalid length. [ 1397.266021][ T30] audit: type=1800 audit(1771451672.242:38): pid=18268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.11433" name="memory.events" dev="tmpfs" ino=2172 res=0 errno=0 [ 1397.388495][T18285] veth1_macvtap: left allmulticast mode [ 1397.638782][T18285] macsec0: left allmulticast mode [ 1398.100335][T18293] syzkaller0: entered promiscuous mode [ 1398.121315][T18293] syzkaller0: entered allmulticast mode [ 1400.258831][T18327] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1400.266447][T18327] team0: Device macvlan0 is already an upper device of the team interface [ 1400.280837][T18332] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 1400.364090][T18344] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11445'. [ 1400.386662][T18344] netlink: 'syz.1.11445': attribute type 2 has an invalid length. [ 1400.408252][T18344] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11445'. [ 1400.432812][T18337] wlan1 speed is unknown, defaulting to 1000 [ 1400.455454][T18337] lo speed is unknown, defaulting to 1000 [ 1400.484165][T18337] wg1 speed is unknown, defaulting to 1000 [ 1400.839517][T18367] netlink: 'syz.3.11451': attribute type 1 has an invalid length. [ 1400.864870][T18368] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11450'. [ 1400.912853][T18367] bond9: (slave gretap2): making interface the new active one [ 1400.941970][T18367] bond9: (slave gretap2): Enslaving as an active interface with an up link [ 1400.971400][T18373] netlink: 5 bytes leftover after parsing attributes in process `syz.0.11452'. [ 1401.059154][T18377] ipvlan2: entered promiscuous mode [ 1401.065372][T18377] bridge0: port 3(ipvlan2) entered blocking state [ 1401.075246][T18377] bridge0: port 3(ipvlan2) entered disabled state [ 1401.081888][T18377] ipvlan2: entered allmulticast mode [ 1401.087880][T18377] bridge0: entered allmulticast mode [ 1401.087921][T18333] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1401.106912][T18377] ipvlan2: left allmulticast mode [ 1401.112067][T18377] bridge0: left allmulticast mode [ 1401.272911][T18386] netlink: 132 bytes leftover after parsing attributes in process `syz.4.11455'. [ 1401.481546][T18398] netlink: 'syz.0.11460': attribute type 15 has an invalid length. [ 1401.489805][T18398] netlink: 666 bytes leftover after parsing attributes in process `syz.0.11460'. [ 1401.571137][T18403] netlink: 232 bytes leftover after parsing attributes in process `syz.1.11461'. [ 1401.599667][T18401] delete_channel: no stack [ 1402.164901][T18422] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11466'. [ 1402.772419][T18406] tunl0: Caught tx_queue_len zero misconfig [ 1402.809676][T25354] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1402.846919][T25354] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1402.871525][T25354] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1402.907433][T25354] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1402.960887][T18441] netlink: 'syz.3.11470': attribute type 11 has an invalid length. [ 1402.974607][T25354] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1402.996567][T25354] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1403.032030][T25354] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1403.069774][T25354] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1403.141948][T18447] wlan1 speed is unknown, defaulting to 1000 [ 1403.202246][T18458] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11475'. [ 1403.220582][T18447] lo speed is unknown, defaulting to 1000 [ 1403.234283][T18458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11475'. [ 1403.300986][T18458] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for erspan1 [ 1403.324355][T18468] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11473'. [ 1403.335095][T18458] erspan1: entered allmulticast mode [ 1403.359284][T18447] wg1 speed is unknown, defaulting to 1000 [ 1403.360352][T18465] wlan1 speed is unknown, defaulting to 1000 [ 1403.420680][T18459] netlink: 32 bytes leftover after parsing attributes in process `syz.3.11474'. [ 1403.431090][T18459] netem: unknown loss type 13 [ 1403.436366][T18459] netem: change failed [ 1403.731099][T18465] lo speed is unknown, defaulting to 1000 [ 1403.737205][T18478] lo: Caught tx_queue_len zero misconfig [ 1403.922815][T18465] wg1 speed is unknown, defaulting to 1000 [ 1403.956725][T18486] team1: entered promiscuous mode [ 1403.961895][T18486] team1: entered allmulticast mode [ 1403.973976][T18486] 8021q: adding VLAN 0 to HW filter on device team1 [ 1403.984857][T18489] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 1404.069693][T18489] team2: entered promiscuous mode [ 1404.077174][T18489] team2: entered allmulticast mode [ 1404.082936][T18489] 8021q: adding VLAN 0 to HW filter on device team2 [ 1404.397295][T18507] wlan1 speed is unknown, defaulting to 1000 [ 1404.505931][T18507] lo speed is unknown, defaulting to 1000 [ 1404.597789][T18513] bond6: option mode: invalid value (254) [ 1404.625856][T18513] bond6 (unregistering): Released all slaves [ 1404.703646][T18507] wg1 speed is unknown, defaulting to 1000 [ 1404.932635][T18524] wlan1 speed is unknown, defaulting to 1000 [ 1404.998379][T18524] lo speed is unknown, defaulting to 1000 [ 1405.027573][T18524] wg1 speed is unknown, defaulting to 1000 [ 1405.526643][T18531] team_slave_1: Caught tx_queue_len zero misconfig [ 1405.969345][T18568] syz_tun: left promiscuous mode [ 1405.999133][T18568] syz_tun: left allmulticast mode [ 1406.029757][T18568] geneve1: left promiscuous mode [ 1406.035480][T18568] geneve2: left promiscuous mode [ 1406.042702][T18568] gre1: left allmulticast mode [ 1406.049092][T18568] xfrm1: left allmulticast mode [ 1406.055676][T18568] ip6gre1: left allmulticast mode [ 1406.563249][T18592] __nla_validate_parse: 6 callbacks suppressed [ 1406.563271][T18592] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11498'. [ 1407.066689][T18631] xt_hashlimit: size too large, truncated to 1048576 [ 1407.390304][T18655] siw: device registration error -23 [ 1407.589814][T18669] ipt_ECN: cannot use operation on non-tcp rule [ 1407.851895][T18676] netlink: 'syz.0.11515': attribute type 1 has an invalid length. [ 1408.030412][T18680] ip6gre2: entered allmulticast mode [ 1408.439389][T18699] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11519'. [ 1408.687571][T18716] wlan1 speed is unknown, defaulting to 1000 [ 1408.727379][T18716] lo speed is unknown, defaulting to 1000 [ 1408.768423][T18716] wg1 speed is unknown, defaulting to 1000 [ 1408.945958][T18725] syzkaller0: entered promiscuous mode [ 1408.961992][T18725] syzkaller0: entered allmulticast mode [ 1409.290515][T18748] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11529'. [ 1409.611687][T18752] netlink: 99 bytes leftover after parsing attributes in process `syz.0.11531'. [ 1411.252666][T18762] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1411.266254][T18765] netlink: 732 bytes leftover after parsing attributes in process `syz.0.11535'. [ 1411.334892][T18765] netlink: 732 bytes leftover after parsing attributes in process `syz.0.11535'. [ 1411.507534][T18780] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11536'. [ 1411.656976][T18789] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11539'. [ 1411.667250][T18789] netlink: 'syz.2.11539': attribute type 3 has an invalid length. [ 1412.058747][T18811] netlink: 'syz.4.11543': attribute type 5 has an invalid length. [ 1412.085797][T18811] netlink: 3581 bytes leftover after parsing attributes in process `syz.4.11543'. [ 1412.149327][T18811] tipc: Enabled bearer , priority 0 [ 1412.188851][T18811] syzkaller0: entered promiscuous mode [ 1412.217849][T18811] syzkaller0: entered allmulticast mode [ 1412.288699][T18811] netlink: 124 bytes leftover after parsing attributes in process `syz.4.11543'. [ 1412.352847][T18810] tipc: Resetting bearer [ 1412.374187][T18833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11545'. [ 1412.432505][T18810] tipc: Disabling bearer [ 1412.714946][T18855] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11548'. [ 1412.750794][T18855] netlink: 32 bytes leftover after parsing attributes in process `syz.2.11548'. [ 1412.828860][T18860] IPVS: length: 24 != 36888 [ 1412.869924][T18852] wlan1 speed is unknown, defaulting to 1000 [ 1412.886505][T18852] lo speed is unknown, defaulting to 1000 [ 1412.929443][T18852] wg1 speed is unknown, defaulting to 1000 [ 1413.011093][T18867] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11551'. [ 1413.252801][T18881] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11554'. [ 1413.283577][T18881] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11554'. [ 1413.338007][T18881] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11554'. [ 1413.524646][T14220] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1413.529991][T18901] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1413.544469][T18903] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1413.553726][T14220] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1413.608989][T14220] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1413.676951][T14220] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1413.771391][T18912] netlink: 'syz.0.11561': attribute type 32 has an invalid length. [ 1413.847552][T18912] bond3: Setting coupled_control to off (0) [ 1413.965565][T18913] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1414.461113][T18963] tipc: Enabled bearer , priority 10 [ 1414.479567][T18966] netlink: 'syz.3.11572': attribute type 4 has an invalid length. [ 1414.925565][T18998] openvswitch: netlink: EtherType 0 is less than min 600 [ 1415.212583][T19010] netlink: 'syz.0.11583': attribute type 11 has an invalid length. [ 1415.546028][T19023] netlink: 'syz.1.11588': attribute type 5 has an invalid length. [ 1415.787782][T19039] tap0: tun_chr_ioctl cmd 35111 [ 1416.108692][T19052] wlan1 speed is unknown, defaulting to 1000 [ 1416.151561][T19052] lo speed is unknown, defaulting to 1000 [ 1416.172155][T19052] wg1 speed is unknown, defaulting to 1000 [ 1416.359308][T19080] sctp: [Deprecated]: syz.3.11601 (pid 19080) Use of int in max_burst socket option. [ 1416.359308][T19080] Use struct sctp_assoc_value instead [ 1416.672240][T19092] __nla_validate_parse: 11 callbacks suppressed [ 1416.672265][T19092] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11606'. [ 1416.719200][T19099] netlink: 176 bytes leftover after parsing attributes in process `syz.0.11604'. [ 1416.746796][T19102] syzkaller1: entered promiscuous mode [ 1416.793564][T19102] syzkaller1: entered allmulticast mode [ 1416.840544][T19107] tipc: Started in network mode [ 1416.846915][T19107] tipc: Node identity ac14140f, cluster identity 4711 [ 1416.854362][T19107] tipc: New replicast peer: 255.255.255.255 [ 1416.860775][T19107] tipc: Enabled bearer , priority 10 [ 1416.920859][T19109] netlink: 'syz.1.11607': attribute type 13 has an invalid length. [ 1416.979298][T19107] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11607'. [ 1417.498855][T19150] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11620'. [ 1417.570459][T19155] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11620'. [ 1417.582777][T19143] bond7: option mode: invalid value (254) [ 1417.666021][T19143] bond7 (unregistering): Released all slaves [ 1417.735721][T19146] dvmrp0: entered allmulticast mode [ 1417.766565][T19151] wlan1 speed is unknown, defaulting to 1000 [ 1417.787289][T19151] lo speed is unknown, defaulting to 1000 [ 1417.865789][T19151] wg1 speed is unknown, defaulting to 1000 [ 1417.989220][T18435] tipc: Node number set to 2886997007 [ 1418.014944][T19170] netlink: 52 bytes leftover after parsing attributes in process `syz.1.11623'. [ 1418.206741][T19177] netlink: 5 bytes leftover after parsing attributes in process `syz.2.11624'. [ 1418.457892][T19177] ..0Єо{X№¦: renamed from gretap0 [ 1418.504954][T19177] ..0Єо{X№¦: entered allmulticast mode [ 1418.552194][T19177] A link change request failed with some changes committed already. Interface ..0Єо{X№¦ may have been left with an inconsistent configuration, please check. [ 1419.057942][T19220] netlink: 'syz.3.11629': attribute type 1 has an invalid length. [ 1419.088346][T19220] netlink: 224 bytes leftover after parsing attributes in process `syz.3.11629'. [ 1419.286046][T19243] xt_TCPMSS: Only works on TCP SYN packets [ 1419.328643][T19245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11636'. [ 1419.340644][T19245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11636'. [ 1419.355961][T19242] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1419.431505][T19251] syzkaller0: entered promiscuous mode [ 1419.437639][T19251] syzkaller0: entered allmulticast mode [ 1420.091233][T19293] bridge15: entered promiscuous mode [ 1420.100647][T19293] bridge15: entered allmulticast mode [ 1420.548706][ C1] vcan0: j1939_tp_rxtimer: 0xffff888057304400: rx timeout, send abort [ 1420.557654][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888057304400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1420.590841][T19318] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1420.869236][T19327] bond10: entered promiscuous mode [ 1420.901836][T19327] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1421.118030][T19318] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1421.278504][T19318] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1421.437077][T19367] bridge_slave_1: left allmulticast mode [ 1421.442946][T19367] bridge_slave_1: left promiscuous mode [ 1421.451007][T19367] bridge0: port 2(bridge_slave_1) entered disabled state [ 1421.467042][T19367] bridge_slave_0: left allmulticast mode [ 1421.473077][T19367] bridge0: port 1(bridge_slave_0) entered disabled state [ 1421.612396][ T7563] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20002 - 0 [ 1421.647046][ T7563] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20002 - 0 [ 1421.667703][ T7563] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20002 - 0 [ 1421.716814][ T7563] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20002 - 0 [ 1421.927450][T19391] __nla_validate_parse: 10 callbacks suppressed [ 1421.927469][T19391] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11676'. [ 1421.949958][ T7563] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1421.950020][T19391] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11676'. [ 1421.959214][ T7563] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1421.976138][ T7563] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1421.986553][ T7563] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1422.037817][T19400] siw: device registration error -23 [ 1422.045298][T19400] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11675'. [ 1422.084565][T19400] bond7: Invalid ad_actor_system MAC address. [ 1422.091576][T19400] bond7: option ad_actor_system: invalid value (7) [ 1422.105911][T19400] bond7 (unregistering): Released all slaves [ 1422.178646][T19400] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11675'. [ 1422.260480][T19400] bond7: Invalid ad_actor_system MAC address. [ 1422.277243][T19400] bond7: option ad_actor_system: invalid value (7) [ 1422.308237][T19400] bond7 (unregistering): Released all slaves [ 1422.471592][T19416] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11680'. [ 1422.690920][T19420] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11682'. [ 1422.795641][T19420] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1422.965933][T19431] wlan1 speed is unknown, defaulting to 1000 [ 1423.004946][T19431] lo speed is unknown, defaulting to 1000 [ 1423.011806][T19431] wg1 speed is unknown, defaulting to 1000 [ 1423.079070][T19437] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11686'. [ 1423.108983][T19437] netlink: 348 bytes leftover after parsing attributes in process `syz.0.11686'. [ 1423.113899][T19427] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11684'. [ 1423.134572][T19437] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11686'. [ 1423.308011][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 1424.406484][T19487] netlink: 'syz.0.11696': attribute type 10 has an invalid length. [ 1424.711006][T19494] wlan1 speed is unknown, defaulting to 1000 [ 1424.724898][T19494] lo speed is unknown, defaulting to 1000 [ 1424.746291][T19494] wg1 speed is unknown, defaulting to 1000 [ 1424.905909][T19509] syzkaller0: entered promiscuous mode [ 1424.921665][T19509] syzkaller0: entered allmulticast mode [ 1425.049777][T19509] tipc: Enabled bearer , priority 0 [ 1425.116294][T19509] tipc: Resetting bearer [ 1425.133355][T19509] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1425.142103][T19509] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1425.161553][T19508] tipc: Resetting bearer [ 1425.174114][T19518] netlink: 'syz.2.11708': attribute type 10 has an invalid length. [ 1425.206453][T19508] tipc: Disabling bearer [ 1425.318934][T19516] wlan1 speed is unknown, defaulting to 1000 [ 1425.344379][T19496] lec:lec_atm_close: lec0: Shut down! [ 1425.355692][T19516] lo speed is unknown, defaulting to 1000 [ 1425.363817][T19516] wg1 speed is unknown, defaulting to 1000 [ 1426.051214][T19561] sctp: [Deprecated]: syz.2.11717 (pid 19561) Use of int in max_burst socket option. [ 1426.051214][T19561] Use struct sctp_assoc_value instead [ 1426.121932][T19567] wlan1 speed is unknown, defaulting to 1000 [ 1426.130771][T19567] lo speed is unknown, defaulting to 1000 [ 1426.140969][T19567] wg1 speed is unknown, defaulting to 1000 [ 1426.327762][T19582] wlan1 speed is unknown, defaulting to 1000 [ 1426.391807][T19582] lo speed is unknown, defaulting to 1000 [ 1426.420135][T19582] wg1 speed is unknown, defaulting to 1000 [ 1427.040493][T19608] __nla_validate_parse: 67 callbacks suppressed [ 1427.040515][T19608] netlink: 400 bytes leftover after parsing attributes in process `syz.1.11730'. [ 1427.367429][T19629] netlink: 36 bytes leftover after parsing attributes in process `syz.3.11733'. [ 1427.380919][T19627] wlan1 speed is unknown, defaulting to 1000 [ 1427.421742][T19627] lo speed is unknown, defaulting to 1000 [ 1427.428587][T19631] netlink: 568 bytes leftover after parsing attributes in process `syz.1.11738'. [ 1427.442684][T19627] wg1 speed is unknown, defaulting to 1000 [ 1427.478134][T19621] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11734'. [ 1427.569255][T19638] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11739'. [ 1427.731137][T19638] syzkaller0: entered promiscuous mode [ 1427.748779][T19638] syzkaller0: entered allmulticast mode [ 1427.781791][T19638] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11739'. [ 1428.018204][T19659] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11749'. [ 1428.028249][T19660] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11749'. [ 1428.401905][T19684] gretap0: entered promiscuous mode [ 1428.428397][ T30] audit: type=1804 audit(1771451703.402:39): pid=19686 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.11754" name="/newroot/533/cgroup.controllers" dev="tmpfs" ino=2733 res=1 errno=0 [ 1428.491088][T19681] wlan1 speed is unknown, defaulting to 1000 [ 1428.514500][ T30] audit: type=1800 audit(1771451703.402:40): pid=19686 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.11754" name="cgroup.controllers" dev="tmpfs" ino=2733 res=0 errno=0 [ 1428.568780][T19681] lo speed is unknown, defaulting to 1000 [ 1428.577782][T19681] wg1 speed is unknown, defaulting to 1000 [ 1429.835387][T19766] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1429.892868][T19769] mac80211_hwsim hwsim121 syzkaller0: Caught tx_queue_len zero misconfig [ 1429.929224][T19774] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11777'. [ 1430.064182][T19781] ip6tnl0: Caught tx_queue_len zero misconfig [ 1430.121228][T19785] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11782'. [ 1430.196420][T19787] IPVS: Error connecting to the multicast addr [ 1430.613572][T19822] netlink: 'syz.1.11788': attribute type 33 has an invalid length. [ 1430.721419][T19818] wlan1 speed is unknown, defaulting to 1000 [ 1430.754198][T19818] lo speed is unknown, defaulting to 1000 [ 1430.775418][T19818] wg1 speed is unknown, defaulting to 1000 [ 1430.787911][T19836] netlink: 'syz.2.11792': attribute type 5 has an invalid length. [ 1430.816443][T19836] netlink: 'syz.2.11792': attribute type 5 has an invalid length. [ 1430.966515][T19843] IPVS: Error connecting to the multicast addr [ 1431.143536][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5800 ms [ 1431.151745][ C0] lec:lec_tx_timeout: lec0 [ 1431.190041][T19845] vti1: entered promiscuous mode [ 1431.222311][T19845] vti1: entered allmulticast mode [ 1431.530659][T19872] wlan1 speed is unknown, defaulting to 1000 [ 1431.555595][T19872] lo speed is unknown, defaulting to 1000 [ 1431.578610][T19872] wg1 speed is unknown, defaulting to 1000 [ 1431.679376][T19882] syzkaller1: entered promiscuous mode [ 1431.685133][T19882] syzkaller1: entered allmulticast mode [ 1432.108483][T19904] mac80211_hwsim hwsim121 syzkaller0: Caught tx_queue_len zero misconfig [ 1432.233778][T19913] netlink: 'syz.2.11814': attribute type 39 has an invalid length. [ 1432.428426][T19923] __nla_validate_parse: 5 callbacks suppressed [ 1432.428448][T19923] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11813'. [ 1432.617460][T19909] bridge4: port 1(veth13) entered blocking state [ 1432.658582][T19909] bridge4: port 1(veth13) entered disabled state [ 1432.689780][T19909] veth13: entered allmulticast mode [ 1432.712991][T19909] veth13: entered promiscuous mode [ 1432.731115][T19909] bridge4: port 1(veth13) entered blocking state [ 1432.737683][T19909] bridge4: port 1(veth13) entered forwarding state [ 1432.859058][T19940] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11820'. [ 1432.885716][T19938] wlan1 speed is unknown, defaulting to 1000 [ 1432.922178][T19943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11821'. [ 1432.935270][T19938] lo speed is unknown, defaulting to 1000 [ 1432.943033][T19938] wg1 speed is unknown, defaulting to 1000 [ 1432.963905][T19940] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11820'. [ 1432.968042][T19943] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11821'. [ 1433.276448][T19957] IPVS: Error connecting to the multicast addr [ 1433.540182][T25354] bridge4: port 1(veth13) entered disabled state [ 1433.579033][T19982] openvswitch: netlink: Multiple metadata blocks provided [ 1433.597931][T19983] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11831'. [ 1433.609730][T19978] netlink: 180 bytes leftover after parsing attributes in process `syz.0.11830'. [ 1433.640571][T19978] netlink: 40 bytes leftover after parsing attributes in process `syz.0.11830'. [ 1433.696239][T19978] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11830'. [ 1433.745795][T19988] sctp: [Deprecated]: syz.3.11833 (pid 19988) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1433.745795][T19988] Use struct sctp_sack_info instead [ 1433.746848][T19985] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11830'. [ 1434.627021][T20001] wlan1 speed is unknown, defaulting to 1000 [ 1434.687863][T20001] lo speed is unknown, defaulting to 1000 [ 1434.744124][T20001] wg1 speed is unknown, defaulting to 1000 [ 1435.680573][T20084] wlan1 speed is unknown, defaulting to 1000 [ 1435.689971][T20084] lo speed is unknown, defaulting to 1000 [ 1435.698618][T20084] wg1 speed is unknown, defaulting to 1000 [ 1437.467722][T20030] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1437.539948][T20094] netlink: 'syz.3.11853': attribute type 1 has an invalid length. [ 1437.548905][T20094] netlink: 'syz.3.11853': attribute type 11 has an invalid length. [ 1437.615613][T20094] __nla_validate_parse: 5 callbacks suppressed [ 1437.615633][T20094] netlink: 224 bytes leftover after parsing attributes in process `syz.3.11853'. [ 1437.719478][T20114] netlink: 'syz.4.11854': attribute type 83 has an invalid length. [ 1437.735613][T20113] netlink: 'syz.2.11856': attribute type 21 has an invalid length. [ 1437.764048][T20113] netlink: 156 bytes leftover after parsing attributes in process `syz.2.11856'. [ 1437.773236][T20113] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11856'. [ 1437.840955][T20101] wlan1 speed is unknown, defaulting to 1000 [ 1437.850697][T20101] lo speed is unknown, defaulting to 1000 [ 1437.872152][T20101] wg1 speed is unknown, defaulting to 1000 [ 1438.004855][T20124] netlink: 'syz.2.11861': attribute type 1 has an invalid length. [ 1438.032079][ T1201] IPVS: starting estimator thread 0... [ 1438.115286][T20129] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11862'. [ 1438.133576][T20127] IPVS: using max 25 ests per chain, 60000 per kthread [ 1438.199985][T20132] bond7: (slave gretap0): making interface the new active one [ 1438.233839][T20132] bond7: (slave gretap0): Enslaving as an active interface with an up link [ 1438.327629][T20124] vlan2: entered allmulticast mode [ 1438.344224][T20124] bond7: entered allmulticast mode [ 1438.350037][T20124] gretap0: entered allmulticast mode [ 1438.386695][T20124] bond7: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1438.477995][T20138] tipc: Invalid UDP bearer configuration [ 1438.478929][T20138] tipc: Enabling of bearer rejected, failed to enable media [ 1438.716220][T20157] bridge0: entered allmulticast mode [ 1438.731015][T20155] xt_hashlimit: size too large, truncated to 1048576 [ 1439.080040][T20179] netlink: 32 bytes leftover after parsing attributes in process `syz.4.11870'. [ 1439.318625][T20188] vlan2: entered allmulticast mode [ 1439.540290][T20203] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11877'. [ 1439.552870][T20201] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11874'. [ 1439.565196][T20204] netlink: 'syz.0.11876': attribute type 7 has an invalid length. [ 1439.575609][T20192] team0 (unregistering): Port device team_slave_0 removed [ 1439.611412][T20192] team0 (unregistering): Port device team_slave_1 removed [ 1439.969869][T20230] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11881'. [ 1440.015305][T20230] netlink: 56 bytes leftover after parsing attributes in process `syz.0.11881'. [ 1440.138643][T20239] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11886'. [ 1440.228748][T20243] bridge10: entered promiscuous mode [ 1440.357040][T14653] lec:lec_start_xmit: lec0:No lecd attached [ 1440.384856][T20255] wlan1 speed is unknown, defaulting to 1000 [ 1440.393214][T20255] lo speed is unknown, defaulting to 1000 [ 1440.405312][T20255] wg1 speed is unknown, defaulting to 1000 [ 1440.554654][T20264] netlink: 'syz.4.11891': attribute type 8 has an invalid length. [ 1440.756847][T20261] netlink: 'syz.3.11890': attribute type 2 has an invalid length. [ 1440.975388][T20276] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1441.140841][T20281] xt_CT: No such helper "snmp_trap" [ 1441.224179][T20294] tipc: Enabling of bearer rejected, already enabled [ 1441.242881][T20295] tipc: New replicast peer: 172.30.1.2 [ 1441.791970][ T30] audit: type=1800 audit(1771451716.762:41): pid=20323 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.11907" name="memory.events" dev="tmpfs" ino=2670 res=0 errno=0 [ 1441.899955][T20330] wlan1 speed is unknown, defaulting to 1000 [ 1441.908484][T20323] openvswitch: netlink: IP tunnel TTL not specified. [ 1441.908511][T20330] lo speed is unknown, defaulting to 1000 [ 1441.960742][T20330] wg1 speed is unknown, defaulting to 1000 [ 1442.426236][T20340] SET target dimension over the limit! [ 1442.432110][T20339] SET target dimension over the limit! [ 1442.475258][T20343] netlink: 'syz.2.11912': attribute type 1 has an invalid length. [ 1442.658580][T20349] __nla_validate_parse: 3 callbacks suppressed [ 1442.658603][T20349] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11914'. [ 1442.787489][T20354] netlink: 'syz.1.11915': attribute type 11 has an invalid length. [ 1442.806735][T20354] netlink: 'syz.1.11915': attribute type 4 has an invalid length. [ 1442.815322][T20357] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11916'. [ 1442.827362][T20354] netlink: 199768 bytes leftover after parsing attributes in process `syz.1.11915'. [ 1442.928050][T20362] netlink: 'syz.2.11918': attribute type 8 has an invalid length. [ 1443.068715][T20370] xt_ecn: cannot match TCP bits for non-tcp packets [ 1443.187350][T20375] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1443.340236][T20375] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1443.426041][T20375] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1443.438406][T20385] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 1443.530452][T20375] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1443.569306][T20390] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11926'. [ 1443.635650][T20399] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11926'. [ 1443.736042][T20389] pimreg: tun_chr_ioctl cmd 1074025677 [ 1443.815247][T20389] pimreg: linktype set to 0 [ 1443.936781][T14216] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1443.973679][T20412] netlink: 9 bytes leftover after parsing attributes in process `syz.4.11932'. [ 1443.998475][ T7563] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1444.085641][T14216] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1444.120972][T14216] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1444.143815][T20415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11932'. [ 1444.188767][T20412] netlink: 9 bytes leftover after parsing attributes in process `syz.4.11932'. [ 1444.245503][T20415] netlink: 'syz.4.11932': attribute type 2 has an invalid length. [ 1444.267575][T20415] netlink: 40 bytes leftover after parsing attributes in process `syz.4.11932'. [ 1444.328807][T20419] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11934'. [ 1444.595442][T20430] IPVS: sh: SCTP 172.20.20.187:0 - no destination available [ 1445.038511][T20437] wlan1 speed is unknown, defaulting to 1000 [ 1445.088069][T20437] lo speed is unknown, defaulting to 1000 [ 1445.118530][T20437] wg1 speed is unknown, defaulting to 1000 [ 1445.196909][T20444] tipc: Enabled bearer , priority 0 [ 1445.255764][T20444] syzkaller0: entered promiscuous mode [ 1445.261325][T20444] syzkaller0: entered allmulticast mode [ 1445.445283][T20444] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1445.465983][T20455] xt_nat: multiple ranges no longer supported [ 1445.472698][T20452] xt_nat: multiple ranges no longer supported [ 1445.625552][T20455] gre2: entered allmulticast mode [ 1445.689058][T20444] tipc: Resetting bearer [ 1445.747972][T20442] tipc: Resetting bearer [ 1445.847384][T20442] tipc: Disabling bearer [ 1446.086779][T20480] netlink: 'syz.3.11948': attribute type 10 has an invalid length. [ 1446.095190][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 1446.095223][ C0] lec:lec_tx_timeout: lec0 [ 1446.326821][T20484] netlink: 'syz.2.11950': attribute type 10 has an invalid length. [ 1446.485546][T20495] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1446.823879][T20518] bond0: mtu less than device minimum [ 1447.067327][T20536] syzkaller1: entered promiscuous mode [ 1447.072864][T20536] syzkaller1: entered allmulticast mode [ 1447.824334][T20565] x_tables: duplicate underflow at hook 2 [ 1447.909018][T20568] netlink: 'syz.1.11973': attribute type 21 has an invalid length. [ 1447.932630][T20568] __nla_validate_parse: 13 callbacks suppressed [ 1447.932653][T20568] netlink: 132 bytes leftover after parsing attributes in process `syz.1.11973'. [ 1448.001728][T20570] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1448.027098][T20570] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11974'. [ 1448.058913][T20570] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11974'. [ 1448.117106][T20570] xfrm1: entered allmulticast mode [ 1448.122899][T20574] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11974'. [ 1448.350716][T20584] lo: entered allmulticast mode [ 1448.369829][T20586] bridge19: entered promiscuous mode [ 1448.382129][T20584] nbd: must specify a device to reconfigure [ 1448.468841][T20592] netlink: 64 bytes leftover after parsing attributes in process `syz.3.11979'. [ 1448.480266][T20592] block nbd0: reconnected socket [ 1448.486134][T20592] nbd: socks must be embedded in a SOCK_ITEM attr [ 1448.595073][T32347] block nbd0: Receive control failed (result -32) [ 1448.702697][T20604] netlink: 'syz.3.11982': attribute type 10 has an invalid length. [ 1448.743744][T20604] syz_tun: entered promiscuous mode [ 1448.765743][T20604] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1448.810890][T20611] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1448.946793][T20621] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11985'. [ 1448.957978][T20621] IPv6: Can't replace route, no match found [ 1448.960773][T20624] netlink: 'syz.0.11987': attribute type 1 has an invalid length. [ 1448.984703][T20620] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1449.033116][T20624] bond5: entered promiscuous mode [ 1449.040022][T20624] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1449.060952][T20620] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1449.264526][T20636] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11989'. [ 1449.265082][T20620] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1449.428527][T20620] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1449.468862][T20632] wlan1 speed is unknown, defaulting to 1000 [ 1449.480986][T20632] lo speed is unknown, defaulting to 1000 [ 1449.489477][T20632] wg1 speed is unknown, defaulting to 1000 [ 1449.787969][ T7563] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1449.807735][ T7563] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1449.925979][ T7563] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1449.937123][T20664] nbd9: detected capacity change from 0 to 127 [ 1450.006423][ T2993] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1450.184728][T20671] syzkaller0: entered promiscuous mode [ 1450.190790][T20671] syzkaller0: entered allmulticast mode [ 1450.562943][T20695] wlan1 speed is unknown, defaulting to 1000 [ 1450.572284][T20695] lo speed is unknown, defaulting to 1000 [ 1450.586792][T20695] wg1 speed is unknown, defaulting to 1000 [ 1450.780181][T32347] block nbd9: Receive control failed (result -104) [ 1450.966035][T20693] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12005'. [ 1450.975463][T20693] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12005'. [ 1450.985338][T20693] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12005'. [ 1451.312643][T20724] wlan1 speed is unknown, defaulting to 1000 [ 1451.370720][T20724] lo speed is unknown, defaulting to 1000 [ 1451.388384][T20724] wg1 speed is unknown, defaulting to 1000 [ 1451.661107][T20743] tipc: Enabled bearer , priority 0 [ 1451.676810][T20743] syzkaller0: entered promiscuous mode [ 1451.682553][T20743] syzkaller0: entered allmulticast mode [ 1451.725133][T20743] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1451.934443][T20766] ip6tnl6: entered promiscuous mode [ 1452.030934][T20743] tipc: Resetting bearer [ 1452.083425][T20743] tipc: Disabling bearer [ 1452.111936][T20776] team0 (unregistering): Port device team_slave_0 removed [ 1452.124167][T20776] team0 (unregistering): Port device team_slave_1 removed [ 1452.167937][T20775] gre0: entered promiscuous mode [ 1452.243960][T20775] syzkaller0: entered promiscuous mode [ 1452.249599][T20775] syzkaller0: entered allmulticast mode [ 1452.320296][T20791] sctp: [Deprecated]: syz.3.12028 (pid 20791) Use of int in max_burst socket option deprecated. [ 1452.320296][T20791] Use struct sctp_assoc_value instead [ 1452.662133][T20810] ip6tnl7: entered allmulticast mode [ 1452.818140][T20822] netlink: 'syz.4.12036': attribute type 1 has an invalid length. [ 1452.851573][T20822] bond7: entered promiscuous mode [ 1452.857559][T20822] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1452.911803][T20822] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1452.926028][T20822] bond7: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1452.937154][T20822] bond7: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 1452.978998][T20829] netlink: 'syz.0.12039': attribute type 2 has an invalid length. [ 1452.983462][T20822] bond7: (slave wireguard0): making interface the new active one [ 1453.010616][T20822] wireguard0: entered promiscuous mode [ 1453.027339][T20822] bond7: (slave wireguard0): Enslaving as an active interface with an up link [ 1453.072342][T20829] hmac(sha224: entered promiscuous mode [ 1453.272260][T20668] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1453.285712][T20668] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1453.296524][ T1750] block nbd9: Connection timed out, retrying (0/1 alive) [ 1453.306781][ T1750] block nbd9: Connection timed out, retrying (0/1 alive) [ 1453.314567][ T1750] block nbd9: Connection timed out, retrying (0/1 alive) [ 1453.323072][ T1750] block nbd9: Connection timed out, retrying (0/1 alive) [ 1453.331081][ T1750] block nbd9: Dead connection, failed to find a fallback [ 1453.340393][ T1750] block nbd9: shutting down sockets [ 1453.346665][ T1750] blk_print_req_error: 138 callbacks suppressed [ 1453.346684][ T1750] I/O error, dev nbd9, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.364982][T20668] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1453.383443][ T1750] buffer_io_error: 138 callbacks suppressed [ 1453.383461][ T1750] Buffer I/O error on dev nbd9, logical block 3, async page read [ 1453.395201][T20668] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1453.397627][ T1750] I/O error, dev nbd9, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.413750][ T1750] Buffer I/O error on dev nbd9, logical block 2, async page read [ 1453.421519][ T1750] I/O error, dev nbd9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.422656][T20668] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1453.431676][ T1750] Buffer I/O error on dev nbd9, logical block 1, async page read [ 1453.446753][ T1750] I/O error, dev nbd9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.457012][ T1750] Buffer I/O error on dev nbd9, logical block 0, async page read [ 1453.467523][T17682] I/O error, dev nbd9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.477266][T17682] Buffer I/O error on dev nbd9, logical block 0, async page read [ 1453.485164][T17682] I/O error, dev nbd9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.499065][T17682] Buffer I/O error on dev nbd9, logical block 1, async page read [ 1453.507230][T17682] I/O error, dev nbd9, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.517037][T17682] Buffer I/O error on dev nbd9, logical block 2, async page read [ 1453.525006][T17682] I/O error, dev nbd9, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.539614][T17682] Buffer I/O error on dev nbd9, logical block 3, async page read [ 1453.568337][T17682] I/O error, dev nbd9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.602094][T20835] wlan1 speed is unknown, defaulting to 1000 [ 1453.603376][T17682] Buffer I/O error on dev nbd9, logical block 0, async page read [ 1453.657521][T20835] lo speed is unknown, defaulting to 1000 [ 1453.680674][T17682] I/O error, dev nbd9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1453.687747][T20851] __nla_validate_parse: 10 callbacks suppressed [ 1453.687767][T20851] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12045'. [ 1453.711300][T20835] wg1 speed is unknown, defaulting to 1000 [ 1453.715575][T17682] Buffer I/O error on dev nbd9, logical block 1, async page read [ 1453.735184][T17682] ldm_validate_partition_table(): Disk read failed. [ 1453.769461][T17682] Dev nbd9: unable to read RDB block 0 [ 1453.842350][T17682] nbd9: unable to read partition table [ 1453.872310][T17682] ldm_validate_partition_table(): Disk read failed. [ 1453.890757][T17682] Dev nbd9: unable to read RDB block 0 [ 1453.897382][T17682] nbd9: unable to read partition table [ 1453.932765][T20862] netlink: 76 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.092759][T20835] chnl_net:caif_netlink_parms(): no params data found [ 1454.223412][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.252233][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.272947][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.308387][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.331216][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.347329][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.357174][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.386922][T20872] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12047'. [ 1454.999932][T20835] bridge0: port 1(bridge_slave_0) entered blocking state [ 1455.012039][T20835] bridge0: port 1(bridge_slave_0) entered disabled state [ 1455.030131][T20835] bridge_slave_0: entered allmulticast mode [ 1455.042244][T20835] bridge_slave_0: entered promiscuous mode [ 1455.061478][T20835] bridge0: port 2(bridge_slave_1) entered blocking state [ 1455.078888][T20835] bridge0: port 2(bridge_slave_1) entered disabled state [ 1455.094452][T20835] bridge_slave_1: entered allmulticast mode [ 1455.124921][T20835] bridge_slave_1: entered promiscuous mode [ 1455.227526][T20835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1455.267639][T20835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1455.395355][T20907] syzkaller0: entered allmulticast mode [ 1455.405979][T20835] team0: Port device team_slave_0 added [ 1455.411764][T20907] syzkaller0: entered promiscuous mode [ 1455.439555][T20907] syzkaller0 (unregistering): left promiscuous mode [ 1455.450801][T20907] syzkaller0 (unregistering): left allmulticast mode [ 1455.468467][T20899] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1455.484710][T20835] team0: Port device team_slave_1 added [ 1455.503007][T20908] gretap3: entered promiscuous mode [ 1455.536429][T20668] Bluetooth: hci0: command tx timeout [ 1455.621692][T20835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1455.629263][T20835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1455.657015][T20835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1455.685091][T20835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1455.692102][T20835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1455.782174][T20835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1455.791977][T20925] netlink: 'syz.0.12059': attribute type 32 has an invalid length. [ 1455.877151][T20925] bond6: option coupled_control: invalid value (12) [ 1455.892708][T20925] bond6 (unregistering): Released all slaves [ 1455.932718][T20927] tipc: Enabling of bearer rejected, failed to enable media [ 1456.037027][T20835] hsr_slave_0: entered promiscuous mode [ 1456.050194][T20835] hsr_slave_1: entered promiscuous mode [ 1456.065021][T20935] »»»»»»: renamed from vlan1 [ 1456.208101][T20949] netlink: 'syz.0.12067': attribute type 6 has an invalid length. [ 1456.220459][T20941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1456.262261][T20952] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1456.374233][T20961] netlink: 'syz.1.12069': attribute type 11 has an invalid length. [ 1456.581640][T20835] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1456.585733][T20967] netlink: 'syz.1.12072': attribute type 4 has an invalid length. [ 1456.600122][T20967] netlink: 'syz.1.12072': attribute type 1 has an invalid length. [ 1456.615221][T20967] netlink: 'syz.1.12072': attribute type 1 has an invalid length. [ 1456.704204][T20835] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1456.900869][T20835] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1457.014920][T20835] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1457.482436][T20835] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1457.522476][T20835] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1457.545789][T20835] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1457.617893][T20668] Bluetooth: hci0: command tx timeout [ 1457.626777][T20835] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1457.655065][T21006] netlink: 'syz.3.12081': attribute type 16 has an invalid length. [ 1457.873020][T21016] wlan1 speed is unknown, defaulting to 1000 [ 1457.937156][T21016] lo speed is unknown, defaulting to 1000 [ 1458.023674][T21016] wg1 speed is unknown, defaulting to 1000 [ 1458.040155][T20835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1458.086586][T21030] tipc: Enabled bearer , priority 0 [ 1458.105865][T21030] syzkaller0: entered promiscuous mode [ 1458.111563][T21030] syzkaller0: entered allmulticast mode [ 1458.192739][T21030] tipc: Resetting bearer [ 1458.269336][T20835] 8021q: adding VLAN 0 to HW filter on device team0 [ 1458.283844][ T7563] bridge0: port 1(bridge_slave_0) entered blocking state [ 1458.291125][ T7563] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1458.320064][ T2993] bridge0: port 2(bridge_slave_1) entered blocking state [ 1458.327293][ T2993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1458.369738][T21029] tipc: Resetting bearer [ 1458.405489][T21049] openvswitch: netlink: Actions may not be safe on all matching packets [ 1458.488040][T21029] tipc: Disabling bearer [ 1458.641080][T21054] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1458.816429][T21073] netlink: 'syz.3.12097': attribute type 1 has an invalid length. [ 1458.844923][T21076] x_tables: duplicate underflow at hook 1 [ 1458.876303][T21073] __nla_validate_parse: 231 callbacks suppressed [ 1458.876327][T21073] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12097'. [ 1458.886489][T21076] No such timeout policy "syz1" [ 1458.932849][T21073] bond12: (slave bridge17): making interface the new active one [ 1458.948595][T21073] bond12: (slave bridge17): Enslaving as an active interface with an up link [ 1459.011329][T20835] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1459.096807][T21081] openvswitch: netlink: VXLAN extension message has 3 unknown bytes. [ 1459.186088][T21094] netlink: 'syz.1.12102': attribute type 1 has an invalid length. [ 1459.261480][T21094] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1459.305890][T21097] macvlan3: entered promiscuous mode [ 1459.331616][T21097] macvlan3: entered allmulticast mode [ 1459.365667][T21097] bond5: entered allmulticast mode [ 1459.380294][T21097] bond5: entered promiscuous mode [ 1459.398022][T21097] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1459.429769][T21097] team0: Port device macvlan3 added [ 1459.489386][T21094] bond5: (slave ip6gretap3): making interface the new active one [ 1459.511511][T21094] ip6gretap3: entered promiscuous mode [ 1459.551173][T21094] ip6gretap3: entered allmulticast mode [ 1459.571675][T21094] bond5: (slave ip6gretap3): Enslaving as an active interface with an up link [ 1459.713394][T20668] Bluetooth: hci0: command tx timeout [ 1459.759108][T21104] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12104'. [ 1459.787100][T21104] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12104'. [ 1459.810661][T20835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1459.896891][T20835] veth0_vlan: entered promiscuous mode [ 1459.918994][T20835] veth1_vlan: entered promiscuous mode [ 1459.979428][T20835] veth0_macvtap: entered promiscuous mode [ 1459.994619][T20835] veth1_macvtap: entered promiscuous mode [ 1460.031637][T20835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1460.052679][T20835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1460.071359][ T2993] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1460.083008][ T2993] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1460.158944][ T2993] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1460.190996][ T2993] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1460.422928][T21116] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12107'. [ 1460.790405][T14218] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1460.824054][T14218] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1460.960418][ T2993] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1460.975278][ T2993] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1461.071165][T21147] netlink: 'syz.3.12113': attribute type 11 has an invalid length. [ 1461.361681][T21155] Bluetooth: MGMT ver 1.23 [ 1461.387093][T21160] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12115'. [ 1461.530692][T21168] wlan1 speed is unknown, defaulting to 1000 [ 1461.557142][T21168] lo speed is unknown, defaulting to 1000 [ 1461.598447][T21168] wg1 speed is unknown, defaulting to 1000 [ 1461.775080][T20668] Bluetooth: hci0: command tx timeout [ 1462.006908][T21187] bridge0: port 2(bridge_slave_1) entered disabled state [ 1462.014844][T21187] bridge0: port 1(bridge_slave_0) entered disabled state [ 1462.024628][T21187] bridge0: entered allmulticast mode [ 1462.066518][T21187] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 1462.176735][T21189] bond0: (slave bond_slave_1): Releasing backup interface [ 1462.294841][T21195] IPVS: set_ctl: invalid protocol: 4 172.20.20.187:20004 [ 1462.349991][T21197] : renamed from bond_slave_0 (while UP) [ 1462.376901][T21176] netlink: 'syz.4.12120': attribute type 2 has an invalid length. [ 1462.435061][T21200] syzkaller1: entered promiscuous mode [ 1462.437017][T21173] Bluetooth: MGMT ver 1.23 [ 1462.440699][T21200] syzkaller1: entered allmulticast mode [ 1463.096964][T21236] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12136'. [ 1463.111504][T21241] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12134'. [ 1463.367351][T21247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12139'. [ 1463.782013][T21270] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12145'. [ 1463.815478][T21273] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12146'. [ 1463.900419][T21280] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12147'. [ 1464.095621][T21285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12149'. [ 1464.120218][T21287] netlink: 'syz.2.12150': attribute type 2 has an invalid length. [ 1464.124132][T21285] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12149'. [ 1464.138149][T21287] netlink: 40 bytes leftover after parsing attributes in process `syz.2.12150'. [ 1464.356587][T21299] bridge1: entered promiscuous mode [ 1464.357120][T32347] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1464.362569][T21299] bridge1: entered allmulticast mode [ 1464.374507][T32347] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1464.379734][T21299] team0: Port device bridge1 added [ 1464.383166][T32347] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1464.396070][T32347] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1464.404162][T32347] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1464.542102][T21301] wlan1 speed is unknown, defaulting to 1000 [ 1464.582259][T21301] lo speed is unknown, defaulting to 1000 [ 1464.615917][T21301] wg1 speed is unknown, defaulting to 1000 [ 1464.798497][T21309] netlink: 'syz.2.12155': attribute type 1 has an invalid length. [ 1464.817133][T21309] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12155'. [ 1466.493703][T32347] Bluetooth: hci2: command tx timeout [ 1467.582524][T21314] netlink: 60 bytes leftover after parsing attributes in process `syz.1.12156'. [ 1467.592760][T21314] netlink: 60 bytes leftover after parsing attributes in process `syz.1.12156'. [ 1467.605728][T21314] netlink: 32 bytes leftover after parsing attributes in process `syz.1.12156'. [ 1467.792608][T21319] netlink: 32 bytes leftover after parsing attributes in process `syz.1.12156'. [ 1467.797568][T21323] Cannot find del_set index 4 as target [ 1467.818632][T21301] chnl_net:caif_netlink_parms(): no params data found [ 1468.239263][T21343] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12163'. [ 1468.258481][T21301] bridge0: port 1(bridge_slave_0) entered blocking state [ 1468.268732][T21301] bridge0: port 1(bridge_slave_0) entered disabled state [ 1468.278700][T21346] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1468.291079][T21301] bridge_slave_0: entered allmulticast mode [ 1468.300112][T21301] bridge_slave_0: entered promiscuous mode [ 1468.311502][T21346] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1468.327470][T21348] netlink: 'syz.0.12162': attribute type 1 has an invalid length. [ 1468.343209][T21353] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1468.350514][T21353] IPv6: NLM_F_CREATE should be set when creating new route [ 1468.357810][T21353] IPv6: NLM_F_CREATE should be set when creating new route [ 1468.374954][T21353] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1468.429285][T21343] bond6: entered promiscuous mode [ 1468.436307][T21343] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1468.446168][T21301] bridge0: port 2(bridge_slave_1) entered blocking state [ 1468.453600][T21301] bridge0: port 2(bridge_slave_1) entered disabled state [ 1468.461623][T21301] bridge_slave_1: entered allmulticast mode [ 1468.469296][T21301] bridge_slave_1: entered promiscuous mode [ 1468.492098][T21353] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 1468.583562][T32347] Bluetooth: hci2: command tx timeout [ 1468.737643][T21360] bond13: (slave bridge18): Enslaving as an active interface with an up link [ 1468.797218][T21301] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1468.874844][T21301] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1468.937708][T21375] ip6_vti0: entered allmulticast mode [ 1468.978555][T21301] team0: Port device team_slave_0 added [ 1468.989128][T21301] team0: Port device team_slave_1 added [ 1469.102707][T21384] tipc: Started in network mode [ 1469.108062][T21384] tipc: Node identity 763471c3f628, cluster identity 4711 [ 1469.124543][T21384] tipc: Enabled bearer , priority 0 [ 1469.132882][T21301] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1469.154227][T21301] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1469.210092][T21301] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1469.237536][T21384] syzkaller0: entered promiscuous mode [ 1469.243057][T21384] syzkaller0: entered allmulticast mode [ 1469.254469][T21385] tipc: Resetting bearer [ 1469.318400][T21385] tipc: Disabling bearer [ 1469.354806][T21301] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1469.361841][T21301] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1469.407884][T21301] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1469.514414][T21301] hsr_slave_0: entered promiscuous mode [ 1469.521621][T21301] hsr_slave_1: entered promiscuous mode [ 1469.531878][T21301] debugfs: 'hsr0' already exists in 'hsr' [ 1469.545961][T21301] Cannot create hsr debugfs directory [ 1469.864637][T21382] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1469.979675][T21413] __nla_validate_parse: 3 callbacks suppressed [ 1469.979698][T21413] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12170'. [ 1470.022816][T21416] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12178'. [ 1470.032040][T21416] netlink: 64 bytes leftover after parsing attributes in process `syz.2.12178'. [ 1470.290220][T21301] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1470.351872][T21428] netlink: 52 bytes leftover after parsing attributes in process `syz.0.12182'. [ 1470.361475][T21428] netlink: 52 bytes leftover after parsing attributes in process `syz.0.12182'. [ 1470.373020][T21428] netlink: 52 bytes leftover after parsing attributes in process `syz.0.12182'. [ 1470.555196][T21301] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1470.613471][T21439] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12181'. [ 1470.664791][T32347] Bluetooth: hci2: command tx timeout [ 1470.751756][T21301] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1470.879673][T21301] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1471.006100][T21459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12189'. [ 1471.024118][T21459] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12189'. [ 1471.041117][T21448] wlan1 speed is unknown, defaulting to 1000 [ 1471.070816][T21448] lo speed is unknown, defaulting to 1000 [ 1471.096696][T21448] wg1 speed is unknown, defaulting to 1000 [ 1471.848066][T21466] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1471.860046][T21466] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 1471.960307][T21468] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12193'. [ 1472.117211][T21468] syzkaller1: entered promiscuous mode [ 1472.130708][T21468] syzkaller1: entered allmulticast mode [ 1472.200893][T21301] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1472.229685][T21301] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1472.259598][T21301] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1472.282955][T21301] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1472.565803][T32347] block nbd10: Receive control failed (result -32) [ 1472.646540][T21301] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1472.702578][T21301] 8021q: adding VLAN 0 to HW filter on device team0 [ 1472.725652][ T2993] bridge0: port 1(bridge_slave_0) entered blocking state [ 1472.732878][ T2993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1472.743854][T32347] Bluetooth: hci2: command tx timeout [ 1472.777964][ T7563] bridge0: port 2(bridge_slave_1) entered blocking state [ 1472.785150][ T7563] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1473.276704][T21301] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1474.213945][T21566] syzkaller0: entered promiscuous mode [ 1474.219489][T21566] syzkaller0: entered allmulticast mode [ 1474.296440][T21301] veth0_vlan: entered promiscuous mode [ 1474.353624][T21301] veth1_vlan: entered promiscuous mode [ 1474.423942][T21580] bond14: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1474.449957][T21580] bond14 (unregistering): Released all slaves [ 1474.452574][T21582] netlink: 'syz.3.12218': attribute type 1 has an invalid length. [ 1474.621504][T21584] tipc: Enabled bearer , priority 0 [ 1474.711930][T21584] syzkaller0: entered promiscuous mode [ 1474.718419][T21584] syzkaller0: entered allmulticast mode [ 1474.728694][T21584] tipc: Resetting bearer [ 1474.746869][T21301] veth0_macvtap: entered promiscuous mode [ 1474.768124][T21595] syz_tun: entered promiscuous mode [ 1474.795743][T21583] tipc: Resetting bearer [ 1475.233218][T21604] netlink: 'syz.2.12224': attribute type 2 has an invalid length. [ 1475.289425][T21608] __nla_validate_parse: 5 callbacks suppressed [ 1475.289446][T21608] netlink: 64 bytes leftover after parsing attributes in process `syz.3.12225'. [ 1477.070331][T21583] tipc: Disabling bearer [ 1477.082710][T21301] veth1_macvtap: entered promiscuous mode [ 1477.107662][ T7567] tipc: Resetting bearer [ 1477.155164][T21612] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12226'. [ 1477.170136][T21612] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12226'. [ 1477.195863][T21301] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1477.254838][T21301] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1477.289370][T14219] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.315650][T14219] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.342601][T14219] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.369216][T14219] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.503609][T21626] syzkaller0: entered promiscuous mode [ 1477.512157][T21626] syzkaller0: entered allmulticast mode [ 1477.629797][ T7567] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1477.667978][ T7567] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1477.760923][T14218] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1477.793960][T14218] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1477.883815][T21641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12234'. [ 1478.096080][T21653] syzkaller0: entered promiscuous mode [ 1478.101616][T21653] syzkaller0: entered allmulticast mode [ 1478.168729][T21656] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12238'. [ 1479.381796][T21684] netlink: 'syz.2.12242': attribute type 1 has an invalid length. [ 1479.391986][T21684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12242'. [ 1480.671748][T21653] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12237'. [ 1480.682274][T21673] syzkaller1: entered promiscuous mode [ 1480.688217][T21673] syzkaller1: entered allmulticast mode [ 1480.851035][T21686] netlink: 'syz.3.12243': attribute type 1 has an invalid length. [ 1480.887868][T21686] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12243'. [ 1480.902654][T21682] wlan1 speed is unknown, defaulting to 1000 [ 1480.920590][T21682] lo speed is unknown, defaulting to 1000 [ 1480.928627][T21686] netlink: 'syz.3.12243': attribute type 1 has an invalid length. [ 1480.938387][T21682] wg1 speed is unknown, defaulting to 1000 [ 1481.009440][T21695] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12245'. [ 1481.048896][T21695] netlink: 64 bytes leftover after parsing attributes in process `syz.1.12245'. [ 1481.236967][T21700] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12247'. [ 1481.301455][T21700] gtp3: entered allmulticast mode [ 1481.310154][T21705] netlink: 'syz.0.12248': attribute type 9 has an invalid length. [ 1481.557270][T21719] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12251'. [ 1481.638616][T21722] IPVS: set_ctl: invalid protocol: 92 127.0.0.1:20000 [ 1482.044314][T21739] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12257'. [ 1482.064141][T20668] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1482.088329][T20668] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1482.098570][T20668] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1482.109228][T20668] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1482.117402][T20668] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1482.172847][T21739] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12257'. [ 1482.252246][T21740] wlan1 speed is unknown, defaulting to 1000 [ 1482.311047][T21740] lo speed is unknown, defaulting to 1000 [ 1482.324785][T21746] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12259'. [ 1482.325290][T21740] wg1 speed is unknown, defaulting to 1000 [ 1482.344042][T21748] x_tables: duplicate underflow at hook 2 [ 1482.485104][T21756] netlink: 'syz.4.12258': attribute type 21 has an invalid length. [ 1482.672591][T21756] netlink: 132 bytes leftover after parsing attributes in process `syz.4.12258'. [ 1483.108286][T21740] chnl_net:caif_netlink_parms(): no params data found [ 1483.242116][T21740] bridge0: port 1(bridge_slave_0) entered blocking state [ 1483.251059][T21740] bridge0: port 1(bridge_slave_0) entered disabled state [ 1483.258891][T21740] bridge_slave_0: entered allmulticast mode [ 1483.267730][T21740] bridge_slave_0: entered promiscuous mode [ 1483.277498][T21740] bridge0: port 2(bridge_slave_1) entered blocking state [ 1483.285257][T21740] bridge0: port 2(bridge_slave_1) entered disabled state [ 1483.292692][T21740] bridge_slave_1: entered allmulticast mode [ 1483.301862][T21740] bridge_slave_1: entered promiscuous mode [ 1483.487817][T21740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1483.560388][T21740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1483.694439][T21740] team0: Port device team_slave_0 added [ 1483.782061][T21807] syzkaller0: entered promiscuous mode [ 1483.788380][T21807] syzkaller0: entered allmulticast mode [ 1483.809927][T21740] team0: Port device team_slave_1 added [ 1484.086129][T21821] netlink: 'syz.4.12276': attribute type 1 has an invalid length. [ 1484.183584][T32347] Bluetooth: hci4: command tx timeout [ 1484.742357][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 1486.255814][T32347] Bluetooth: hci4: command tx timeout [ 1486.698098][T21740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1486.706201][T21740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1486.732683][T21740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1486.756679][T21740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1486.763919][T21740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1486.791363][T21740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1486.919966][T21833] syzkaller0: entered promiscuous mode [ 1486.954483][T21833] syzkaller0: entered allmulticast mode [ 1487.001666][T21841] __nla_validate_parse: 5 callbacks suppressed [ 1487.001686][T21841] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12281'. [ 1487.064222][T21846] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12281'. [ 1487.090150][T21740] hsr_slave_0: entered promiscuous mode [ 1487.115154][T21740] hsr_slave_1: entered promiscuous mode [ 1487.121828][T21740] debugfs: 'hsr0' already exists in 'hsr' [ 1487.145548][T21740] Cannot create hsr debugfs directory [ 1487.243945][T21851] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12284'. [ 1487.323858][T21856] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12285'. [ 1487.396495][T21862] ip6t_REJECT: ECHOREPLY is not supported [ 1487.616247][T21861] wlan1 speed is unknown, defaulting to 1000 [ 1487.707438][T21861] lo speed is unknown, defaulting to 1000 [ 1487.756610][T21861] wg1 speed is unknown, defaulting to 1000 [ 1487.906111][T21883] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12292'. [ 1487.996440][T21873] wlan1 speed is unknown, defaulting to 1000 [ 1488.027426][T21883] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1488.155616][T21873] lo speed is unknown, defaulting to 1000 [ 1488.218951][T21873] wg1 speed is unknown, defaulting to 1000 [ 1488.336736][T32347] Bluetooth: hci4: command tx timeout [ 1488.466598][T21901] wlan1 speed is unknown, defaulting to 1000 [ 1488.688858][T21901] lo speed is unknown, defaulting to 1000 [ 1488.726438][T21901] wg1 speed is unknown, defaulting to 1000 [ 1488.751214][T21915] netlink: 68 bytes leftover after parsing attributes in process `syz.4.12297'. [ 1488.824924][T21740] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1488.879745][T21740] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1488.929700][T21740] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1489.060221][T21740] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1489.539963][T21941] netlink: 216 bytes leftover after parsing attributes in process `syz.3.12301'. [ 1489.548637][T21740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1489.580566][T21941] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12301'. [ 1489.619976][T21740] 8021q: adding VLAN 0 to HW filter on device team0 [ 1489.643953][T21941] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12301'. [ 1489.667839][T25354] bridge0: port 1(bridge_slave_0) entered blocking state [ 1489.675147][T25354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1489.737123][T25354] bridge0: port 2(bridge_slave_1) entered blocking state [ 1489.744351][T25354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1489.919713][T21945] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1490.011626][T21957] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12305'. [ 1490.093361][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5350 ms [ 1490.101473][ C0] lec:lec_tx_timeout: lec0 [ 1490.110318][T21945] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1490.179337][T21968] syzkaller0: entered promiscuous mode [ 1490.191456][T21968] syzkaller0: entered allmulticast mode [ 1490.194003][T21970] delete_channel: no stack [ 1490.207298][T21967] m1Ie5ияб: entered promiscuous mode [ 1490.271608][T21945] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1490.307169][T21960] tipc: Enabled bearer , priority 0 [ 1490.386726][T21945] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1490.420975][T32347] Bluetooth: hci4: command tx timeout [ 1490.444206][T21959] tipc: Resetting bearer [ 1490.522642][T21959] tipc: Disabling bearer [ 1490.768339][ T7563] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1490.791706][ T7563] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1490.860363][ T7563] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1490.908379][ T7567] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.122391][T21740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1491.342589][T21740] veth0_vlan: entered promiscuous mode [ 1491.396910][T21740] veth1_vlan: entered promiscuous mode [ 1491.460460][T21740] veth0_macvtap: entered promiscuous mode [ 1491.473303][T21740] veth1_macvtap: entered promiscuous mode [ 1491.522043][T21740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1491.548046][T21740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1491.586765][ T7567] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.628561][ T7567] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.633941][T22017] netlink: 'syz.4.12319': attribute type 2 has an invalid length. [ 1491.670075][ T7567] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.748807][ T7567] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1491.909160][T14218] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1491.923599][T14218] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1492.088450][ T7563] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1492.114299][ T7563] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1492.321156][T22030] sch_tbf: burst 7 is lower than device tunl0 mtu (1480) ! [ 1492.868663][T22035] sctp: [Deprecated]: syz.1.12253 (pid 22035) Use of int in maxseg socket option. [ 1492.868663][T22035] Use struct sctp_assoc_value instead [ 1492.911681][T22051] __nla_validate_parse: 2 callbacks suppressed [ 1492.911711][T22051] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12328'. [ 1492.963601][T22051] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12328'. [ 1493.106448][T22054] wlan1 speed is unknown, defaulting to 1000 [ 1493.229316][T22054] lo speed is unknown, defaulting to 1000 [ 1493.252703][T22059] mac80211_hwsim hwsim121 syzkaller0: left promiscuous mode [ 1493.265632][T22059] mac80211_hwsim hwsim121 syzkaller0: left allmulticast mode [ 1493.274735][T22059] tipc: Resetting bearer [ 1493.310554][T22054] wg1 speed is unknown, defaulting to 1000 [ 1493.382610][T22060] syzkaller0: entered promiscuous mode [ 1493.388592][T22060] syzkaller0: entered allmulticast mode [ 1493.576413][T22077] netlink: 72 bytes leftover after parsing attributes in process `syz.1.12336'. [ 1493.770376][T22077] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1493.968088][T22077] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.232794][T22077] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.528637][T22077] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.557591][T22105] netlink: 'syz.2.12344': attribute type 10 has an invalid length. [ 1494.566003][T22105] netlink: 228 bytes leftover after parsing attributes in process `syz.2.12344'. [ 1494.581953][T22106] netlink: 'syz.2.12344': attribute type 10 has an invalid length. [ 1494.634079][T22106] netlink: 228 bytes leftover after parsing attributes in process `syz.2.12344'. [ 1494.726929][ T7563] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1494.739605][T22118] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12346'. [ 1494.762897][ T2993] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1494.807203][ T7567] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1494.847830][ T7567] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1494.928101][T22134] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12350'. [ 1494.939187][T22132] lo: Caught tx_queue_len zero misconfig [ 1494.945237][T22134] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12350'. [ 1494.953816][T22134] netlink: 'syz.4.12350': attribute type 10 has an invalid length. [ 1494.969543][T22134] netlink: 55 bytes leftover after parsing attributes in process `syz.4.12350'. [ 1495.308053][T22151] 8021q: VLANs not supported on lo [ 1495.419106][T22153] ip6gre0: Caught tx_queue_len zero misconfig [ 1495.482589][T22159] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12357'. [ 1495.705914][T22164] syzkaller0: entered promiscuous mode [ 1495.717565][T22164] syzkaller0: entered allmulticast mode [ 1498.191773][T22196] __nla_validate_parse: 1 callbacks suppressed [ 1498.191814][T22196] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12365'. [ 1498.483214][T22220] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12369'. [ 1498.534614][T22207] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12369'. [ 1498.543432][T22216] netlink: 128 bytes leftover after parsing attributes in process `syz.3.12372'. [ 1498.619032][T22216] syzkaller0: entered promiscuous mode [ 1498.637364][T22216] syzkaller0: entered allmulticast mode [ 1498.700467][T22207] bridge0: entered promiscuous mode [ 1498.723847][T22207] macvtap1: entered promiscuous mode [ 1498.729382][T22207] macvtap1: entered allmulticast mode [ 1498.764767][T22207] bridge0: entered allmulticast mode [ 1498.796440][T22207] bridge0: port 3(macvtap1) entered blocking state [ 1498.803687][T22207] bridge0: port 3(macvtap1) entered disabled state [ 1498.819933][T22207] bridge0: left allmulticast mode [ 1498.825760][T22207] bridge0: left promiscuous mode [ 1498.865183][T22215] wlan1 speed is unknown, defaulting to 1000 [ 1501.443967][T22215] lo speed is unknown, defaulting to 1000 [ 1501.465073][T22215] wg1 speed is unknown, defaulting to 1000 [ 1501.655225][T22263] netlink: 76 bytes leftover after parsing attributes in process `syz.0.12377'. [ 1501.805485][T22269] netlink: 'syz.3.12378': attribute type 1 has an invalid length. [ 1501.824298][T22269] netlink: 174 bytes leftover after parsing attributes in process `syz.3.12378'. [ 1502.203176][T22286] netlink: 'syz.3.12383': attribute type 21 has an invalid length. [ 1502.233754][T22286] netlink: 'syz.3.12383': attribute type 22 has an invalid length. [ 1502.241708][T22286] netlink: 'syz.3.12383': attribute type 23 has an invalid length. [ 1502.316365][T22286] netlink: 136 bytes leftover after parsing attributes in process `syz.3.12383'. [ 1502.501824][T20668] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1502.516033][T20668] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1502.526273][T20668] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1502.537296][T20668] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1502.546023][T20668] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1502.700093][T22307] netlink: 68 bytes leftover after parsing attributes in process `syz.3.12386'. [ 1502.741015][T22305] bond1: option all_slaves_active: invalid value (13) [ 1502.761650][T22305] bond1 (unregistering): Released all slaves [ 1502.903380][T22297] wlan1 speed is unknown, defaulting to 1000 [ 1502.916161][T22297] lo speed is unknown, defaulting to 1000 [ 1502.940886][T22297] wg1 speed is unknown, defaulting to 1000 [ 1503.335587][T22297] chnl_net:caif_netlink_parms(): no params data found [ 1503.481858][T22297] bridge0: port 1(bridge_slave_0) entered blocking state [ 1503.493425][T22297] bridge0: port 1(bridge_slave_0) entered disabled state [ 1503.500824][T22297] bridge_slave_0: entered allmulticast mode [ 1503.509661][T22297] bridge_slave_0: entered promiscuous mode [ 1503.522855][T22297] bridge0: port 2(bridge_slave_1) entered blocking state [ 1503.530830][T22297] bridge0: port 2(bridge_slave_1) entered disabled state [ 1503.538303][T22297] bridge_slave_1: entered allmulticast mode [ 1503.547352][T22297] bridge_slave_1: entered promiscuous mode [ 1503.614134][T22338] tipc: Enabled bearer , priority 0 [ 1503.625839][T22297] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1503.636626][T22338] syzkaller0: entered promiscuous mode [ 1503.642133][T22338] syzkaller0: entered allmulticast mode [ 1503.666977][T22297] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1503.687933][T22340] netlink: 624 bytes leftover after parsing attributes in process `syz.2.12392'. [ 1503.730331][T22297] team0: Port device team_slave_0 added [ 1503.759416][T22344] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12394'. [ 1503.773979][T14653] lec:lec_start_xmit: lec0:No lecd attached [ 1503.794356][T22297] team0: Port device team_slave_1 added [ 1503.853112][T22341] syzkaller1: entered promiscuous mode [ 1503.867339][T22346] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12394'. [ 1503.878707][T22346] netlink: 32 bytes leftover after parsing attributes in process `syz.3.12394'. [ 1503.891408][T22341] syzkaller1: entered allmulticast mode [ 1503.953662][T22297] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1503.972250][T22297] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1504.001955][T22297] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1504.015297][T22344] wlan1 speed is unknown, defaulting to 1000 [ 1504.049062][T22297] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1504.056764][T22344] lo speed is unknown, defaulting to 1000 [ 1504.062652][T22297] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1504.089068][T22297] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1504.127234][T22348] wlan1 speed is unknown, defaulting to 1000 [ 1504.135711][T22344] wg1 speed is unknown, defaulting to 1000 [ 1504.189022][T22348] lo speed is unknown, defaulting to 1000 [ 1504.217481][T22297] hsr_slave_0: entered promiscuous mode [ 1504.225778][T22297] hsr_slave_1: entered promiscuous mode [ 1504.233022][T22297] debugfs: 'hsr0' already exists in 'hsr' [ 1504.241124][T22297] Cannot create hsr debugfs directory [ 1504.259953][T22361] netlink: 'syz.2.12398': attribute type 2 has an invalid length. [ 1504.277039][T22348] wg1 speed is unknown, defaulting to 1000 [ 1504.287027][T22361] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12398'. [ 1504.398645][T22364] netlink: 'syz.2.12399': attribute type 1 has an invalid length. [ 1504.417397][T22337] tipc: Resetting bearer [ 1504.438651][T22337] tipc: Disabling bearer [ 1504.464224][T22367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12399'. [ 1504.477917][T22367] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12399'. [ 1504.487776][T22364] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1504.659951][T20668] Bluetooth: hci1: command tx timeout [ 1505.272274][T22297] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1505.427202][T22297] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1505.576954][T22297] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1505.640459][T22414] wlan1 speed is unknown, defaulting to 1000 [ 1505.644114][T22417] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12407'. [ 1505.685578][T22297] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 1505.737420][T22414] lo speed is unknown, defaulting to 1000 [ 1505.750793][T22414] wg1 speed is unknown, defaulting to 1000 [ 1505.778698][T22419] : entered promiscuous mode [ 1506.112818][T22436] tipc: Enabling of bearer rejected, failed to enable media [ 1506.360550][T22297] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1506.429589][T22297] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1506.523590][T22297] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1506.557764][T22297] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1506.733680][T20668] Bluetooth: hci1: command tx timeout [ 1506.763814][T22452] wlan1 speed is unknown, defaulting to 1000 [ 1506.772179][T22452] lo speed is unknown, defaulting to 1000 [ 1506.842618][T22473] wlan1 speed is unknown, defaulting to 1000 [ 1506.890805][T22452] wg1 speed is unknown, defaulting to 1000 [ 1506.921311][T22297] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1506.954941][T22473] lo speed is unknown, defaulting to 1000 [ 1507.026331][T22473] wg1 speed is unknown, defaulting to 1000 [ 1507.097790][T22480] netlink: 40 bytes leftover after parsing attributes in process `syz.1.12421'. [ 1507.187106][T22297] 8021q: adding VLAN 0 to HW filter on device team0 [ 1507.239854][T14218] bridge0: port 1(bridge_slave_0) entered blocking state [ 1507.247128][T14218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1507.367920][ T7563] bridge0: port 2(bridge_slave_1) entered blocking state [ 1507.375179][ T7563] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1507.421186][T22297] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1507.771430][T22508] netlink: 'syz.2.12424': attribute type 61 has an invalid length. [ 1507.822528][T22508] netlink: 'syz.2.12424': attribute type 62 has an invalid length. [ 1507.976724][T22513] netlink: 192 bytes leftover after parsing attributes in process `syz.2.12424'. [ 1508.102976][T22508] wlan1 speed is unknown, defaulting to 1000 [ 1508.116729][T22297] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1508.144806][T22508] lo speed is unknown, defaulting to 1000 [ 1508.188726][T22508] wg1 speed is unknown, defaulting to 1000 [ 1508.400947][T22297] veth0_vlan: entered promiscuous mode [ 1508.436903][T22297] veth1_vlan: entered promiscuous mode [ 1508.476813][T22297] veth0_macvtap: entered promiscuous mode [ 1508.491230][T22297] veth1_macvtap: entered promiscuous mode [ 1508.525067][T22297] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1508.679271][T22297] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1508.691741][T22535] bridge0: port 2(bridge_slave_1) entered disabled state [ 1508.723216][T22540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12432'. [ 1508.733786][T22535] bridge_slave_1: left allmulticast mode [ 1508.751444][T22535] bridge_slave_1: left promiscuous mode [ 1508.772067][T22535] bridge0: port 2(bridge_slave_1) entered disabled state [ 1508.814852][T20668] Bluetooth: hci1: command tx timeout [ 1508.840389][T22535] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1508.865077][T22539] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12432'. [ 1508.969799][ T7553] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1508.990542][T14216] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x61 [ 1509.013206][ T7553] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1509.022457][ T7553] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1509.033151][T14216] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x61 [ 1509.061597][T22544] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12433'. [ 1509.086600][ T7553] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1509.100861][T22544] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12433'. [ 1509.133390][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5360 ms [ 1509.141459][ C0] lec:lec_tx_timeout: lec0 [ 1509.411592][ T7553] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1509.445047][ T7553] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1509.536392][ T7553] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1509.574879][ T7553] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1509.765078][T22566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12439'. [ 1509.786422][T22578] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1509.789710][T22571] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1509.812510][T22575] wlan1 speed is unknown, defaulting to 1000 [ 1509.821345][T22575] lo speed is unknown, defaulting to 1000 [ 1509.832933][T22575] wg1 speed is unknown, defaulting to 1000 [ 1510.050867][T22587] netlink: 'syz.0.12442': attribute type 10 has an invalid length. [ 1510.071092][T22587] netlink: 228 bytes leftover after parsing attributes in process `syz.0.12442'. [ 1510.228204][T22593] xt_bpf: check failed: parse error [ 1510.429299][T22597] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1510.649373][T22603] xt_connbytes: Forcing CT accounting to be enabled [ 1510.729870][T22606] x_tables: duplicate underflow at hook 1 [ 1510.791801][T32347] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1510.807645][T32347] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1510.829563][T32347] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1510.846564][T32347] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1510.856042][T32347] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1510.894183][T20668] Bluetooth: hci1: command tx timeout [ 1510.902096][T22607] wlan1 speed is unknown, defaulting to 1000 [ 1510.910565][T22607] lo speed is unknown, defaulting to 1000 [ 1510.946226][T22607] wg1 speed is unknown, defaulting to 1000 [ 1511.572869][ T9795] bond0: (slave syz_tun): Releasing backup interface [ 1511.740809][T22638] ip6gre1: entered promiscuous mode [ 1511.746683][T22638] ip6gre1: entered allmulticast mode [ 1511.805572][T22607] chnl_net:caif_netlink_parms(): no params data found [ 1512.156174][T22607] bridge0: port 1(bridge_slave_0) entered blocking state [ 1512.175230][T22607] bridge0: port 1(bridge_slave_0) entered disabled state [ 1512.189374][T22607] bridge_slave_0: entered allmulticast mode [ 1512.204537][T22607] bridge_slave_0: entered promiscuous mode [ 1512.215469][T22607] bridge0: port 2(bridge_slave_1) entered blocking state [ 1512.222720][T22607] bridge0: port 2(bridge_slave_1) entered disabled state [ 1512.230650][T22607] bridge_slave_1: entered allmulticast mode [ 1512.240053][T22607] bridge_slave_1: entered promiscuous mode [ 1512.247831][T22650] wlan1 speed is unknown, defaulting to 1000 [ 1512.306184][T22650] lo speed is unknown, defaulting to 1000 [ 1512.359186][T22607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1512.389095][T22650] wg1 speed is unknown, defaulting to 1000 [ 1512.398901][T22607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1512.492429][T22607] team0: Port device team_slave_0 added [ 1512.542144][T22607] team0: Port device team_slave_1 added [ 1512.549098][T22661] netlink: 14 bytes leftover after parsing attributes in process `syz.1.12460'. [ 1512.620746][T22661] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1512.645431][T22661] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1512.667136][T22661] bond0 (unregistering): Released all slaves [ 1512.673875][T22667] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12462'. [ 1512.722236][T22607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1512.749091][T22607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1512.777022][T22607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1512.869825][T22607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1512.884044][T22607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1512.923646][T20668] Bluetooth: hci5: command tx timeout [ 1512.953335][T22607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1513.158634][T22681] Cannot find del_set index 1 as target [ 1513.355494][T22607] hsr_slave_0: entered promiscuous mode [ 1513.386137][T22607] hsr_slave_1: entered promiscuous mode [ 1513.392862][T22607] debugfs: 'hsr0' already exists in 'hsr' [ 1513.413383][T22607] Cannot create hsr debugfs directory [ 1513.490224][T22680] wlan1 speed is unknown, defaulting to 1000 [ 1513.532347][T22680] lo speed is unknown, defaulting to 1000 [ 1513.565958][T22680] wg1 speed is unknown, defaulting to 1000 [ 1513.798258][T22607] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1513.990101][T22607] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1514.136496][T22713] netlink: 'syz.0.12474': attribute type 13 has an invalid length. [ 1514.201962][T22607] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1514.280477][T22607] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1514.327446][T22718] syzkaller0: entered promiscuous mode [ 1514.342816][T22718] syzkaller0: entered allmulticast mode [ 1514.376487][T22718] pim6reg1: entered promiscuous mode [ 1514.381908][T22718] pim6reg1: entered allmulticast mode [ 1514.461770][T22726] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12479'. [ 1514.471372][T22726] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12479'. [ 1514.634887][T22731] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12481'. [ 1514.662127][T22731] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1514.704186][T22607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1514.742592][T22607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1514.788675][T22607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1514.852787][T22607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1514.973590][T20668] Bluetooth: hci5: command tx timeout [ 1515.166320][T22607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1515.214655][T22761] netlink: 'syz.0.12486': attribute type 1 has an invalid length. [ 1515.216167][T22607] 8021q: adding VLAN 0 to HW filter on device team0 [ 1515.277617][T14218] bridge0: port 1(bridge_slave_0) entered blocking state [ 1515.284841][T14218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1515.322767][ T7563] bridge0: port 2(bridge_slave_1) entered blocking state [ 1515.330328][ T7563] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1515.453746][ C0] ------------[ cut here ]------------ [ 1515.459743][ C0] ODEBUG: free active (active state 0) object: ffff8880519db490 object type: timer_list hint: rose_t0timer_expiry+0x0/0x560 [ 1515.472701][ C0] WARNING: lib/debugobjects.c:615 at debug_check_no_obj_freed+0x405/0x550, CPU#0: syz.4.12480/22729 [ 1515.483549][ C0] Modules linked in: [ 1515.487847][ C0] CPU: 0 UID: 0 PID: 22729 Comm: syz.4.12480 Not tainted syzkaller #0 PREEMPT(full) [ 1515.497396][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1515.507610][ C0] RIP: 0010:debug_check_no_obj_freed+0x44a/0x550 [ 1515.514034][ C0] Code: 89 44 24 20 e8 b7 6b 7e fd 48 8b 44 24 20 4c 8b 4d 00 4c 89 ef 48 c7 c6 40 6b 27 8c 48 c7 c2 c0 70 27 8c 8b 0c 24 4d 89 f8 50 <67> 48 0f b9 3a 48 83 c4 08 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc [ 1515.533961][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00010246 [ 1515.540069][ C0] RAX: ffffffff8a888d00 RBX: ffffffff9a4a8c58 RCX: 0000000000000000 [ 1515.548216][ C0] RDX: ffffffff8c2770c0 RSI: ffffffff8c276b40 RDI: ffffffff901b4570 [ 1515.556274][ C0] RBP: ffffffff8bcf4a00 R08: ffff8880519db490 R09: ffffffff8bcf5d20 [ 1515.564431][ C0] R10: dffffc0000000000 R11: ffffffff81b099e0 R12: ffff8880519db600 [ 1515.572429][ C0] R13: ffffffff901b4570 R14: ffff8880519db000 R15: ffff8880519db490 [ 1515.580464][ C0] FS: 00007f8d6d8ea6c0(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000 [ 1515.589483][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1515.596242][ C0] CR2: 0000555580dd39e8 CR3: 000000008f2da000 CR4: 00000000003526f0 [ 1515.600341][T22763] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1515.604378][ C0] Call Trace: [ 1515.604418][ C0] [ 1515.604427][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1515.626754][ C0] kfree+0x13a/0x610 [ 1515.630684][ C0] ? rose_timer_expiry+0x4cb/0x600 [ 1515.635171][T22768] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12489'. [ 1515.635868][ C0] rose_timer_expiry+0x4cb/0x600 [ 1515.649902][ C0] ? call_timer_fn+0x178/0x5a0 [ 1515.654755][ C0] call_timer_fn+0x192/0x5a0 [ 1515.659376][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1515.665017][ C0] ? call_timer_fn+0xd4/0x5a0 [ 1515.669737][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 1515.675265][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1515.680476][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1515.685993][ C0] __run_timer_base+0x652/0x8b0 [ 1515.690871][ C0] ? ktime_get+0x45/0x200 [ 1515.695276][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 1515.700685][ C0] ? sched_clock_cpu+0x74/0x440 [ 1515.705602][ C0] run_timer_softirq+0xb7/0x170 [ 1515.710565][ C0] handle_softirqs+0x22a/0x7c0 [ 1515.715409][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 1515.720222][ C0] __irq_exit_rcu+0x5f/0x150 [ 1515.724993][ C0] irq_exit_rcu+0x9/0x30 [ 1515.729268][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1515.734987][ C0] [ 1515.737944][ C0] [ 1515.740902][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1515.746971][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 1515.753469][ C0] Code: f7 e8 5d 21 00 f6 f7 c3 00 02 00 00 74 05 e8 40 35 2b f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 e4 f5 f1 f5 65 8b 05 3d 21 76 07 85 c0 74 18 5b 41 5e c3 cc cc [ 1515.773280][ C0] RSP: 0018:ffffc900032873d8 EFLAGS: 00000206 [ 1515.779398][ C0] RAX: 0000000000000006 RBX: 0000000000000296 RCX: 0000000080000001 [ 1515.787451][ C0] RDX: 0000000000000000 RSI: ffffffff8dee2508 RDI: 0000000000000001 [ 1515.795497][ C0] RBP: 0000000000000000 R08: ffffffff90109077 R09: 1ffffffff202120e [ 1515.803546][ C0] R10: dffffc0000000000 R11: fffffbfff202120f R12: ffff88805334c000 [ 1515.811553][ C0] R13: ffff88805334b000 R14: ffffffff9a511390 R15: 0000000000000001 [ 1515.819622][ C0] debug_check_no_obj_freed+0x52e/0x550 [ 1515.825252][ C0] free_unref_folios+0x4d2/0x1510 [ 1515.830332][ C0] folios_put_refs+0x789/0x8d0 [ 1515.835164][ C0] ? __pfx_folios_put_refs+0x10/0x10 [ 1515.840569][ C0] ? folio_batch_remove_exceptionals+0x18c/0x1f0 [ 1515.846984][ C0] shmem_undo_range+0x52c/0x1660 [ 1515.852030][ C0] ? reweight_entity+0x8f1/0xb90 [ 1515.857042][ C0] ? __pfx_shmem_undo_range+0x10/0x10 [ 1515.862494][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1515.867536][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1515.872519][ C0] ? percpu_counter_add_batch+0xea/0x1d0 [ 1515.878232][ C0] shmem_evict_inode+0x240/0x9e0 [ 1515.883222][ C0] ? inode_wait_for_writeback+0x16d/0x3b0 [ 1515.889015][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1515.894607][ C0] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 1515.900729][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1515.905827][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 1515.910962][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1515.916488][ C0] evict+0x61e/0xb10 [ 1515.920440][ C0] ? __pfx_evict+0x10/0x10 [ 1515.924973][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 1515.930141][ C0] ? _raw_spin_unlock+0x28/0x50 [ 1515.935074][ C0] ? iput+0xb25/0xe80 [ 1515.939116][ C0] __dentry_kill+0x1a2/0x5e0 [ 1515.943774][ C0] ? finish_dput+0xad/0x480 [ 1515.948312][ C0] finish_dput+0xc9/0x480 [ 1515.952675][ C0] __fput+0x691/0xa70 [ 1515.956751][ C0] task_work_run+0x1d9/0x270 [ 1515.961492][ C0] ? __pfx_task_work_run+0x10/0x10 [ 1515.966708][ C0] exit_to_user_mode_loop+0xed/0x480 [ 1515.972031][ C0] ? rcu_is_watching+0x15/0xb0 [ 1515.976872][ C0] do_syscall_64+0x32d/0xf80 [ 1515.981511][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1515.987751][ C0] ? trace_irq_disable+0x37/0x100 [ 1515.992822][ C0] ? clear_bhb_loop+0x40/0x90 [ 1515.997594][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.003555][ C0] RIP: 0033:0x7f8d6c99c629 [ 1516.008005][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1516.028005][ C0] RSP: 002b:00007f8d6d8ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1516.036515][ C0] RAX: 0000200000000000 RBX: 00007f8d6cc15fa0 RCX: 00007f8d6c99c629 [ 1516.044585][ C0] RDX: 0000000000000002 RSI: 0000000000fbe000 RDI: 0000200000000000 [ 1516.052594][ C0] RBP: 00007f8d6ca32b39 R08: ffffffffffffffff R09: 0000000000000000 [ 1516.060659][ C0] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000000 [ 1516.069034][ C0] R13: 00007f8d6cc16038 R14: 00007f8d6cc15fa0 R15: 00007ffcbf9395e8 [ 1516.077111][ C0] [ 1516.080166][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1516.087468][ C0] CPU: 0 UID: 0 PID: 22729 Comm: syz.4.12480 Not tainted syzkaller #0 PREEMPT(full) [ 1516.096937][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1516.106994][ C0] Call Trace: [ 1516.110277][ C0] [ 1516.113122][ C0] vpanic+0x1e0/0x670 [ 1516.117115][ C0] panic+0xc5/0xd0 [ 1516.120841][ C0] ? __pfx_panic+0x10/0x10 [ 1516.125274][ C0] __warn+0x315/0x4a0 [ 1516.129259][ C0] ? debug_check_no_obj_freed+0x405/0x550 [ 1516.134990][ C0] ? debug_check_no_obj_freed+0x405/0x550 [ 1516.140714][ C0] __report_bug+0x29a/0x540 [ 1516.145222][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1516.151120][ C0] ? debug_check_no_obj_freed+0x405/0x550 [ 1516.156845][ C0] ? __pfx___report_bug+0x10/0x10 [ 1516.161881][ C0] ? kfree+0x1c1/0x610 [ 1516.165953][ C0] ? rose_timer_expiry+0x4c3/0x600 [ 1516.171079][ C0] ? call_timer_fn+0x192/0x5a0 [ 1516.175843][ C0] ? __run_timer_base+0x652/0x8b0 [ 1516.180867][ C0] ? run_timer_softirq+0xb7/0x170 [ 1516.185890][ C0] ? handle_softirqs+0x22a/0x7c0 [ 1516.190833][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 1516.195600][ C0] ? sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1516.201441][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1516.207601][ C0] ? _raw_spin_unlock_irqrestore+0x47/0x80 [ 1516.213409][ C0] ? debug_check_no_obj_freed+0x52e/0x550 [ 1516.219149][ C0] ? free_unref_folios+0x4d2/0x1510 [ 1516.224358][ C0] report_bug_entry+0x19a/0x290 [ 1516.229215][ C0] ? debug_check_no_obj_freed+0x44a/0x550 [ 1516.235021][ C0] ? debug_check_no_obj_freed+0x44f/0x550 [ 1516.240760][ C0] handle_bug+0xca/0x200 [ 1516.245096][ C0] exc_invalid_op+0x1a/0x50 [ 1516.249780][ C0] asm_exc_invalid_op+0x1a/0x20 [ 1516.254634][ C0] RIP: 0010:debug_check_no_obj_freed+0x44a/0x550 [ 1516.260969][ C0] Code: 89 44 24 20 e8 b7 6b 7e fd 48 8b 44 24 20 4c 8b 4d 00 4c 89 ef 48 c7 c6 40 6b 27 8c 48 c7 c2 c0 70 27 8c 8b 0c 24 4d 89 f8 50 <67> 48 0f b9 3a 48 83 c4 08 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc [ 1516.280595][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00010246 [ 1516.286670][ C0] RAX: ffffffff8a888d00 RBX: ffffffff9a4a8c58 RCX: 0000000000000000 [ 1516.294736][ C0] RDX: ffffffff8c2770c0 RSI: ffffffff8c276b40 RDI: ffffffff901b4570 [ 1516.302721][ C0] RBP: ffffffff8bcf4a00 R08: ffff8880519db490 R09: ffffffff8bcf5d20 [ 1516.310698][ C0] R10: dffffc0000000000 R11: ffffffff81b099e0 R12: ffff8880519db600 [ 1516.318713][ C0] R13: ffffffff901b4570 R14: ffff8880519db000 R15: ffff8880519db490 [ 1516.326704][ C0] ? __pfx_timer_debug_hint+0x10/0x10 [ 1516.332169][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1516.337820][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1516.343657][ C0] kfree+0x13a/0x610 [ 1516.347571][ C0] ? rose_timer_expiry+0x4cb/0x600 [ 1516.352713][ C0] rose_timer_expiry+0x4cb/0x600 [ 1516.357680][ C0] ? call_timer_fn+0x178/0x5a0 [ 1516.362468][ C0] call_timer_fn+0x192/0x5a0 [ 1516.367067][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1516.372538][ C0] ? call_timer_fn+0xd4/0x5a0 [ 1516.377218][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 1516.382346][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1516.387556][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1516.393040][ C0] __run_timer_base+0x652/0x8b0 [ 1516.397894][ C0] ? ktime_get+0x45/0x200 [ 1516.402329][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 1516.407714][ C0] ? sched_clock_cpu+0x74/0x440 [ 1516.412575][ C0] run_timer_softirq+0xb7/0x170 [ 1516.417427][ C0] handle_softirqs+0x22a/0x7c0 [ 1516.422204][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 1516.426977][ C0] __irq_exit_rcu+0x5f/0x150 [ 1516.431573][ C0] irq_exit_rcu+0x9/0x30 [ 1516.435824][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1516.441475][ C0] [ 1516.444407][ C0] [ 1516.447351][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1516.453335][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 1516.459754][ C0] Code: f7 e8 5d 21 00 f6 f7 c3 00 02 00 00 74 05 e8 40 35 2b f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 e4 f5 f1 f5 65 8b 05 3d 21 76 07 85 c0 74 18 5b 41 5e c3 cc cc [ 1516.479565][ C0] RSP: 0018:ffffc900032873d8 EFLAGS: 00000206 [ 1516.485643][ C0] RAX: 0000000000000006 RBX: 0000000000000296 RCX: 0000000080000001 [ 1516.493618][ C0] RDX: 0000000000000000 RSI: ffffffff8dee2508 RDI: 0000000000000001 [ 1516.501596][ C0] RBP: 0000000000000000 R08: ffffffff90109077 R09: 1ffffffff202120e [ 1516.509569][ C0] R10: dffffc0000000000 R11: fffffbfff202120f R12: ffff88805334c000 [ 1516.517628][ C0] R13: ffff88805334b000 R14: ffffffff9a511390 R15: 0000000000000001 [ 1516.525715][ C0] debug_check_no_obj_freed+0x52e/0x550 [ 1516.531283][ C0] free_unref_folios+0x4d2/0x1510 [ 1516.536338][ C0] folios_put_refs+0x789/0x8d0 [ 1516.541112][ C0] ? __pfx_folios_put_refs+0x10/0x10 [ 1516.546401][ C0] ? folio_batch_remove_exceptionals+0x18c/0x1f0 [ 1516.552735][ C0] shmem_undo_range+0x52c/0x1660 [ 1516.557683][ C0] ? reweight_entity+0x8f1/0xb90 [ 1516.562716][ C0] ? __pfx_shmem_undo_range+0x10/0x10 [ 1516.568112][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1516.573174][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1516.578115][ C0] ? percpu_counter_add_batch+0xea/0x1d0 [ 1516.583756][ C0] shmem_evict_inode+0x240/0x9e0 [ 1516.588707][ C0] ? inode_wait_for_writeback+0x16d/0x3b0 [ 1516.594431][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1516.599903][ C0] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 1516.606158][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1516.611233][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 1516.616372][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1516.621847][ C0] evict+0x61e/0xb10 [ 1516.625760][ C0] ? __pfx_evict+0x10/0x10 [ 1516.630182][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 1516.635309][ C0] ? _raw_spin_unlock+0x28/0x50 [ 1516.640166][ C0] ? iput+0xb25/0xe80 [ 1516.644161][ C0] __dentry_kill+0x1a2/0x5e0 [ 1516.648860][ C0] ? finish_dput+0xad/0x480 [ 1516.653374][ C0] finish_dput+0xc9/0x480 [ 1516.657819][ C0] __fput+0x691/0xa70 [ 1516.661823][ C0] task_work_run+0x1d9/0x270 [ 1516.666427][ C0] ? __pfx_task_work_run+0x10/0x10 [ 1516.671563][ C0] exit_to_user_mode_loop+0xed/0x480 [ 1516.676870][ C0] ? rcu_is_watching+0x15/0xb0 [ 1516.681642][ C0] do_syscall_64+0x32d/0xf80 [ 1516.686239][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.692321][ C0] ? trace_irq_disable+0x37/0x100 [ 1516.697872][ C0] ? clear_bhb_loop+0x40/0x90 [ 1516.702648][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.708680][ C0] RIP: 0033:0x7f8d6c99c629 [ 1516.713191][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1516.732883][ C0] RSP: 002b:00007f8d6d8ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1516.741337][ C0] RAX: 0000200000000000 RBX: 00007f8d6cc15fa0 RCX: 00007f8d6c99c629 [ 1516.749318][ C0] RDX: 0000000000000002 RSI: 0000000000fbe000 RDI: 0000200000000000 [ 1516.757296][ C0] RBP: 00007f8d6ca32b39 R08: ffffffffffffffff R09: 0000000000000000 [ 1516.765358][ C0] R10: 0000000000000031 R11: 0000000000000246 R12: 0000000000000000 [ 1516.773435][ C0] R13: 00007f8d6cc16038 R14: 00007f8d6cc15fa0 R15: 00007ffcbf9395e8 [ 1516.781521][ C0] [ 1516.784974][ C0] Kernel Offset: disabled [ 1516.789297][ C0] Rebooting in 86400 seconds..