last executing test programs: 22.143009357s ago: executing program 4 (id=3971): syz_emit_ethernet(0x30, &(0x7f0000000200)={@local, @empty, @void, {@generic={0x88f7, "687bd9a5746cf006080dca43afb8bf90a7dde3d2386674b67087bf65fd777a1a5cb7"}}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=ANY=[@ANYBLOB="180000001500010029bd7000fedbdf252d"], 0x18}}, 0x20000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r3, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) r6 = socket$inet(0x2, 0x2, 0x6) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e21, 0x1, @mcast1, 0x7}}, 0xf86, 0xd4, 0x1000, 0x3, 0x92, 0x2, 0x7}, &(0x7f0000000500)=0x9c) recvmsg$kcm(r1, &(0x7f0000005140)={0x0, 0x0, &(0x7f0000005000)=[{&(0x7f0000000340)=""/182, 0xb6}], 0x1}, 0x10000) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r5, &(0x7f00000000c0)}, 0x20) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r7, &(0x7f0000001240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911af2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb56343", 0xa7}, {&(0x7f0000001300)="e0cda6472d1ccfb4d1d4", 0xa}, {&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af84202254eadfd12b56f2ebc32396500466e9f16d358dd5354ef69bb8caedf66a220372311a092a4f03a336f27222302c6364b738a58c3b8e99d1a40552dfad46ba272544c0b39ebbca7d1da95fc74f6010956a8bb3165ee8db3867d1f92176de044693fa090b97bcadedd59b7e509e0d60017b6a3b025aac6650826d7f3406d4206b4d714c620225b5797e60513988e244874ac2a0ac80d18c707edf4999d1beaf841f2b8dd9a3da66e193ef2ab6ddba5185b5fd322187b4ff2f9677ecd725eaf86412158b744e32abb8ee3c039cce34f129d6f2665630931a5e03fc6984278e20e320318b0aa676822c2f732337cc75a858a07ed8c17b323d52ee421e79cff1800d1da3f311699f5eb8792f6d67c035ea9348f7f6ff81b9143db4742618e5ffbe48865d787e0a31f8e4d9e7895eb15c36ba4a81355080818efd3cd792293ec3e8cdc577f5c42abbb74331b352f17772ea7cdab8bb640b11db772baa4b32069b99e4cc43118257afa84eff7c8eb2c585da8e8e76404312b55db433c7365a866bc2a678f4817ba7b0838d63eaca429ce563fe8adfe7f114a941f629017d6f0ae80d2c0952ff5550bf361bda46eca47e1c271e0241d60290b9f8e1261b447ad0ba09fab7881291f7c2792537e7a5948eaba0235472406903f1d7095800da3aeb07e914868f2e75208b7354bd8118e91f1a8324c2dac24d633bedadd5b1fa6f2a2df302b7c7516f7f87fe570807fb205b287da3f3a1d4f66cade6cf61922cfa0f23212e282e260655a1d7dffd3be5e2c87ed16b6132de36d46240b76e0ae38e9ba2ba8655672a994adb8f", 0x2b7}], 0x3}}], 0x2, 0x0) sendto$inet(r7, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 20.685420261s ago: executing program 3 (id=3974): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c2020cc5a4d9b739b280b580000", @ANYRES16=r1, @ANYBLOB="0b092abd7000fedbdf251200000008000300", @ANYRES32=r2, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x4000000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) socket$kcm(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYRES64=r3], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf25010000004c000280bc00018008000100040000000800010002000000080001000600000008000100070000000800010006000000080001000700000008000100070000000c0001000000000000000000100002800c0001"], 0x70}, 0x1, 0x0, 0x0, 0x40005}, 0x4000040) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x108, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, 0x0, {0x2, 0xb}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xe20}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x9}, @TCA_STAB={0xcc, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x52, 0xd, 0x80, 0x0, 0x1, 0xfffffffe, 0x5}}, {0xe, 0x2, [0x0, 0x5, 0x40, 0x7fff, 0x6]}}, {{0x1c, 0x1, {0x5f, 0x3, 0x0, 0xfffff800, 0x2, 0x9, 0x6, 0x7}}, {0x12, 0x2, [0x3, 0x7, 0xe, 0x4, 0x1, 0x8c, 0x2]}}, {{0x1c, 0x1, {0x0, 0x45, 0x1, 0xa4, 0x0, 0x5, 0x6, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0x7f, 0x7, 0x7, 0x1, 0x3, 0x7f, 0x2}}, {0x4}}, {{0x1c, 0x1, {0x3, 0x81, 0xe, 0x9, 0x1, 0xb4, 0x2, 0x3}}, {0xa, 0x2, [0xf, 0x1, 0x40]}}]}, @TCA_RATE={0x6, 0x5, {0x2, 0x4}}]}, 0x108}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0xc}, {0x0, 0xd}, {0x0, 0xffff}}, [{0x8, 0xb, 0x3}]}, 0x2c}}, 0x40004) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r7 = socket$netlink(0x10, 0x3, 0xf) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r8) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r8, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB="18006bf9a0a38e92cc686b3f4f161ff0ce61277ba2e4ab8a6a7efe51be80c096ffffc8fc5182dd9eb36f894893a3be201c3569ab240900000000000000b857f49f", @ANYRES16=0x0, @ANYBLOB="00012cbd7000ffdbdf25110000d421000180"], 0x18}, 0x1, 0x0, 0x0, 0xc8}, 0x5) bind$netlink(r7, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbf4, 0x4}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) 20.507292189s ago: executing program 4 (id=3978): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000002000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}, 0x94) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0xffffffff, 0x0, {0x0, 0x0, 0x74, r2, {0x0, 0x7}, {0x0, 0x4}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x40600, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) (async) ioctl$TUNSETDEBUG(r4, 0x400454c9, 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), r5) (async) ioctl$TUNSETLINK(r4, 0x400454cd, 0x325) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000040)={0x23, 0x14}, 0x10) (async) bind$phonet(r6, &(0x7f0000000000)={0x23, 0x4}, 0x10) close(0x4) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000880)={r3, 0x0, 0x0}, 0x10) 20.297340332s ago: executing program 3 (id=3980): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000001940)={'filter\x00', 0x0, 0x3, 0x1000, [0x1000, 0x10001, 0x401, 0x10001, 0x7, 0x8000000000000001], 0x1, &(0x7f00000001c0)=[{}], &(0x7f0000000940)=""/4096}, &(0x7f00000019c0)=0x78) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180)=r8, 0x4) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0x14, 0x0, &(0x7f0000000080)="259a001471a76d2688a24e6588a8fb5e0af66395", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56561, 0x70bd2b, 0x1, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0x3, 0x8}, {0x7, 0x10}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x5, 0x7}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20002000}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 20.023287093s ago: executing program 4 (id=3983): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e0000000400000004"], 0x48) r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1040, 0x44100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @random="977774604b7e"}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit, @initr0, @exit, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @exit], &(0x7f00000000c0)='GPL\x00'}, 0x78) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r2, 0x0, 0x0}, 0x10) r3 = socket(0x10, 0x3, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000005c0), 0x10) recvmmsg(r4, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0x4251}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) readv(r4, &(0x7f0000000440)=[{&(0x7f0000000100)=""/160, 0xa0}], 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r9}, @IFLA_ADDRESS={0xa, 0x1, @random="baeead4459ac"}]}, 0x48}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) getsockopt$inet6_mptcp_buf(r6, 0x11c, 0x4, &(0x7f0000000180)=""/16, &(0x7f0000000200)=0x10) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) ioctl$SIOCGSTAMPNS(r5, 0x8907, &(0x7f0000000380)) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newtfilter={0x70, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x8}, {0xfff2}, {0xfff1, 0x10}}, [@filter_kind_options=@f_bpf={{0x8}, {0x44, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_vlan={0x30, 0x9, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd23, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x35a38, 0x4522f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040044) 19.700195722s ago: executing program 2 (id=3984): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e0000000400000004"], 0x48) r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1040, 0x44100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @random="977774604b7e"}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit, @initr0, @exit, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @exit], &(0x7f00000000c0)='GPL\x00'}, 0x78) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r2, 0x0, 0x0}, 0x10) r3 = socket(0x10, 0x3, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000005c0), 0x10) recvmmsg(r4, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0x4251}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) readv(r4, &(0x7f0000000440)=[{&(0x7f0000000100)=""/160, 0xa0}], 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r9}, @IFLA_ADDRESS={0xa, 0x1, @random="baeead4459ac"}]}, 0x48}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) getsockopt$inet6_mptcp_buf(r6, 0x11c, 0x4, &(0x7f0000000180)=""/16, &(0x7f0000000200)=0x10) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) ioctl$SIOCGSTAMPNS(r5, 0x8907, &(0x7f0000000380)) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newtfilter={0x70, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x8}, {0xfff2}, {0xfff1, 0x10}}, [@filter_kind_options=@f_bpf={{0x8}, {0x44, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_vlan={0x30, 0x9, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd23, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x35a38, 0x4522f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040044) 19.378113883s ago: executing program 1 (id=3985): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv4=@empty, [0x0, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0x101000000], 0x80, 0x54, 0x0, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x8, 0x0, 0x0, 0x7, 0x3ff, 0x18}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x9000000000000, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3, 0x18}, {0x8000000000000}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x8a, &(0x7f00000005c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x54, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x15, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x2, 0x98ca}, @sack_perm={0x4, 0x2}, @window={0x3, 0x3, 0xd7}, @fastopen={0x22, 0x4, "914f"}, @sack={0x5, 0x2}, @sack={0x5, 0x1a, [0x5, 0x3, 0x5, 0x401, 0x519d, 0x0]}, @sack={0x5, 0xe, [0x1, 0xfffffffe, 0x3]}]}}}}}}}}, 0x0) 19.354959164s ago: executing program 4 (id=3986): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000082c0), &(0x7f0000008300)=0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x456f, 0x4) sendmmsg$inet(r3, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) recvmmsg(r4, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/111, 0x6f}, 0xf}], 0x1, 0x22, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x40, &(0x7f00000000c0)=0xfd, 0x4) sendmsg$NFT_BATCH(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="02000000040000000800"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000001600)=ANY=[@ANYBLOB="18000000010000000000000000000000b7080000000000007baaf8ff00000000b5080000ffffffff7b8af0ff00000000bfa000000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000b3000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000000600000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="180000004f0c00001c000000fc0317b77109bfffff81162f0000000000950259f210000000"], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r7, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) recvfrom(r3, &(0x7f0000000200)=""/131, 0xf92e58a67d38802c, 0x2101, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000008200)={r8, @in6={{0xa, 0x4e23, 0x7, @mcast1, 0xe44f53c}}}, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) recvmmsg(r0, &(0x7f0000007f40)=[{{&(0x7f0000000180)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000200)=""/54, 0x36}], 0x1, &(0x7f00000002c0)=""/176, 0xb0}, 0x3}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)}], 0x1, &(0x7f0000000400)=""/34, 0x22}, 0x9}, {{&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001740)=[{&(0x7f00000004c0)=""/230, 0xe6}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/72, 0x48}, {&(0x7f0000001680)}, {&(0x7f00000016c0)=""/68, 0x44}], 0x5, &(0x7f00000017c0)=""/4096, 0x1000}, 0x10001}, {{&(0x7f00000027c0)=@x25, 0x80, &(0x7f0000002a80)=[{&(0x7f0000002840)=""/130, 0x82}, {&(0x7f0000002900)=""/52, 0x34}, {&(0x7f0000002940)=""/89, 0x59}, {&(0x7f00000029c0)=""/177, 0xb1}], 0x4, &(0x7f0000002ac0)=""/34, 0x22}, 0x9}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000002b00)=""/132, 0x84}, {&(0x7f0000002bc0)=""/51, 0x33}, {&(0x7f0000002c00)=""/152, 0x98}, {&(0x7f0000002cc0)=""/85, 0x55}, {&(0x7f0000002d40)=""/133, 0x85}, {&(0x7f0000002e00)=""/220, 0xdc}], 0x6, &(0x7f0000002f80)=""/134, 0x86}, 0xa}, {{&(0x7f0000003040)=@ethernet={0x0, @random}, 0x80, &(0x7f00000032c0)=[{&(0x7f00000030c0)=""/59, 0x3b}, {&(0x7f0000003100)=""/181, 0xb5}, {&(0x7f00000031c0)=""/4, 0x4}, {&(0x7f0000003200)=""/137, 0x89}], 0x4, &(0x7f0000003300)=""/252, 0xfc}, 0x8}, {{&(0x7f0000003400)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000003600)=[{&(0x7f0000003480)=""/234, 0xea}, {&(0x7f0000003580)=""/76, 0x4c}], 0x2}, 0x3ff}, {{&(0x7f0000003640)=@alg, 0x80, &(0x7f00000046c0)=[{&(0x7f00000036c0)=""/4096, 0x1000}], 0x1, &(0x7f0000004700)=""/9, 0x9}, 0x2}, {{&(0x7f0000004740)=@sco, 0x80, &(0x7f0000006ac0)=[{&(0x7f00000047c0)=""/188, 0xbc}, {&(0x7f0000004880)=""/127, 0x7f}, {&(0x7f0000004900)=""/128, 0x80}, {&(0x7f0000004980)=""/24, 0x18}, {&(0x7f00000049c0)=""/4096, 0x1000}, {&(0x7f00000059c0)=""/237, 0xed}, {&(0x7f0000005ac0)=""/4096, 0x1000}], 0x7, &(0x7f0000006b40)=""/196, 0xc4}}, {{&(0x7f0000006c40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000006f00)=[{&(0x7f0000006cc0)=""/7, 0x7}, {&(0x7f0000006d00)=""/216, 0xd8}, {0x0}, {&(0x7f0000006ec0)=""/39, 0x27}], 0x4, &(0x7f0000006f40)=""/4096, 0x1000}, 0x6}], 0xa, 0x2, &(0x7f00000081c0)) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0x4c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}}, 0x0) getsockopt$inet6_buf(r11, 0x29, 0x4, 0xfffffffffffffffd, &(0x7f00000000c0)=0xfffffecb) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r9, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) 19.123316891s ago: executing program 3 (id=3988): syz_emit_ethernet(0x30, &(0x7f0000000200)={@local, @empty, @void, {@generic={0x88f7, "687bd9a5746cf006080dca43afb8bf90a7dde3d2386674b67087bf65fd777a1a5cb7"}}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=ANY=[@ANYBLOB="180000001500010029bd7000fedbdf252d"], 0x18}}, 0x20000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r3, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) r6 = socket$inet(0x2, 0x2, 0x6) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e21, 0x1, @mcast1, 0x7}}, 0xf86, 0xd4, 0x1000, 0x3, 0x92, 0x2, 0x7}, &(0x7f0000000500)=0x9c) recvmsg$kcm(r1, &(0x7f0000005140)={0x0, 0x0, &(0x7f0000005000)=[{&(0x7f0000000340)=""/182, 0xb6}], 0x1}, 0x10000) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r5, &(0x7f00000000c0)}, 0x20) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r7, &(0x7f0000001240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911af2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb56343", 0xa7}, {&(0x7f0000001300)="e0cda6472d1ccfb4d1d4", 0xa}, {&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af84202254eadfd12b56f2ebc32396500466e9f16d358dd5354ef69bb8caedf66a220372311a092a4f03a336f27222302c6364b738a58c3b8e99d1a40552dfad46ba272544c0b39ebbca7d1da95fc74f6010956a8bb3165ee8db3867d1f92176de044693fa090b97bcadedd59b7e509e0d60017b6a3b025aac6650826d7f3406d4206b4d714c620225b5797e60513988e244874ac2a0ac80d18c707edf4999d1beaf841f2b8dd9a3da66e193ef2ab6ddba5185b5fd322187b4ff2f9677ecd725eaf86412158b744e32abb8ee3c039cce34f129d6f2665630931a5e03fc6984278e20e320318b0aa676822c2f732337cc75a858a07ed8c17b323d52ee421e79cff1800d1da3f311699f5eb8792f6d67c035ea9348f7f6ff81b9143db4742618e5ffbe48865d787e0a31f8e4d9e7895eb15c36ba4a81355080818efd3cd792293ec3e8cdc577f5c42abbb74331b352f17772ea7cdab8bb640b11db772baa4b32069b99e4cc43118257afa84eff7c8eb2c585da8e8e76404312b55db433c7365a866bc2a678f4817ba7b0838d63eaca429ce563fe8adfe7f114a941f629017d6f0ae80d2c0952ff5550bf361bda46eca47e1c271e0241d60290b9f8e1261b447ad0ba09fab7881291f7c2792537e7a5948eaba0235472406903f1d7095800da3aeb07e914868f2e75208b7354bd8118e91f1a8324c2dac24d633bedadd5b1fa6f2a2df302b7c7516f7f87fe570807fb205b287da3f3a1d4f66cade6cf61922cfa0f23212e282e260655a1d7dffd3be5e2c87ed16b6132de36d46240b76e0ae38e9ba2ba8655672a994adb8f", 0x2b7}], 0x3}}], 0x2, 0x0) sendto$inet(r7, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 18.982457642s ago: executing program 1 (id=3989): pipe(0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfe, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8a1, 0x2, 0x2, 0x4, 0x7}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$OCFS2_IOC_REFLINK(r1, 0x40186f04, &(0x7f00000003c0)={&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000380)='\x00', 0x762}) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40010}, 0x0) close(r3) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@gettaction={0xf0, 0x32, 0xe72c5f922f23cad9, 0x70bd2a, 0x25dfdbf7}, 0xf0}, 0x1, 0x0, 0x0, 0x8080}, 0x10000084) r4 = socket(0x10, 0x3, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x6}, {0x0, [0x0, 0x0, 0x0, 0x30]}}, &(0x7f0000000140)=""/246, 0x1e, 0xf6, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x7, 0x87, &(0x7f0000000480)=""/135}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, r5, 0x0, 0x1}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r4, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000009110009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)={0x68, 0x2d, 0x107, 0x0, 0x25dfdbff, {0xb, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0xa}]}, @nested={0x4, 0x2}, @nested={0x45, 0x3, 0x0, 0x1, [@generic="282bf8850cdb49521ee6188ba3b22f7bbc02ecfc1a8a2c15d7f52bfe2e6411b3eb5f88dbd5dae8f2d6ea3a3c23e4b8d92d51f7a0614c2e1bf8a9d579f25c7f9a74"]}]}, 0x68}, 0x1, 0x0, 0x0, 0xc004}, 0xc010) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000000000)={r9, 0x0, 0x7, 0x3}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000040)={r9, 0x101, 0x10}, 0xc) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) 18.636791212s ago: executing program 2 (id=3990): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c2020cc5a4d9b739b280b580000", @ANYRES16=r1, @ANYBLOB="0b092abd7000fedbdf251200000008000300", @ANYRES32=r2, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x4000000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) socket$kcm(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYRES64=r3], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf25010000004c000280bc00018008000100040000000800010002000000080001000600000008000100070000000800010006000000080001000700000008000100070000000c0001000000000000000000100002800c0001"], 0x70}, 0x1, 0x0, 0x0, 0x40005}, 0x4000040) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x108, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, 0x0, {0x2, 0xb}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xe20}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x9}, @TCA_STAB={0xcc, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x52, 0xd, 0x80, 0x0, 0x1, 0xfffffffe, 0x5}}, {0xe, 0x2, [0x0, 0x5, 0x40, 0x7fff, 0x6]}}, {{0x1c, 0x1, {0x5f, 0x3, 0x0, 0xfffff800, 0x2, 0x9, 0x6, 0x7}}, {0x12, 0x2, [0x3, 0x7, 0xe, 0x4, 0x1, 0x8c, 0x2]}}, {{0x1c, 0x1, {0x0, 0x45, 0x1, 0xa4, 0x0, 0x5, 0x6, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0x7f, 0x7, 0x7, 0x1, 0x3, 0x7f, 0x2}}, {0x4}}, {{0x1c, 0x1, {0x3, 0x81, 0xe, 0x9, 0x1, 0xb4, 0x2, 0x3}}, {0xa, 0x2, [0xf, 0x1, 0x40]}}]}, @TCA_RATE={0x6, 0x5, {0x2, 0x4}}]}, 0x108}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0xc}, {0x0, 0xd}, {0x0, 0xffff}}, [{0x8, 0xb, 0x3}]}, 0x2c}}, 0x40004) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r7 = socket$netlink(0x10, 0x3, 0xf) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r8) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r8, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB="18006bf9a0a38e92cc686b3f4f161ff0ce61277ba2e4ab8a6a7efe51be80c096ffffc8fc5182dd9eb36f894893a3be201c3569ab240900000000000000b857f49f", @ANYRES16=0x0, @ANYBLOB="00012cbd7000ffdbdf25110000d421000180"], 0x18}, 0x1, 0x0, 0x0, 0xc8}, 0x5) bind$netlink(r7, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbf4, 0x4}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) 18.603750771s ago: executing program 1 (id=3991): bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f00000025c0)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x40000002, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, &(0x7f0000000040)=0x8, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4d, &(0x7f0000000000)=0x8, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x3000, 0x0, 0x0, 0x0) 18.550935927s ago: executing program 0 (id=3992): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000001000000049cf446064a0000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES16=r0, @ANYBLOB="0000000000000000b7080000000000007b8bf8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='scalable', 0xfffd) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) r5 = socket$inet6(0xa, 0x80003, 0x6) r6 = socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[], 0x2c}}, 0x20008801) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004e00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x4}], 0x30}], 0x1, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/47, 0x2f}], 0x1}, 0x2140) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x44, 0x6, 0x480, 0xc0, 0x0, 0x2b0, 0x0, 0xc0, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x6, 0x0, {[{{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}, {{@ip={@private=0xa010101, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@inet=@socket2={{0x28}, 0x4}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x10, 0x7, 0x1100]}, {0x0, [0x2, 0x0, 0x0, 0x2, 0x4]}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x6, 0x0, 0x6, 0x2, 0x1], 0x6, 0x5}, {0x3, [0x3, 0x4, 0x3, 0x0, 0x7], 0x4, 0x6}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x8000, 0x400, @remote, 0x4e24}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4e0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) r8 = socket(0xb, 0xa, 0xffffffff) shutdown(r8, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r8, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet6_buf(r5, 0x29, 0x6, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r4, @ANYBLOB="0500060001000000050007a10000000005000300df00000008000200", @ANYRES64=r2], 0x68}}, 0x0) 18.441474488s ago: executing program 2 (id=3993): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = socket$l2tp6(0xa, 0x2, 0x73) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x2, @local, 0x8ac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b9312948f6651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267513308a3d40aa1c788df6"}, 0xd8) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r2, 0x5421, &(0x7f0000000140)=0xffff) writev(r2, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(0x4) bind$l2tp6(r1, &(0x7f0000000080)={0xa, 0x0, 0xffffff92, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x40, 0x4}, 0x20) 18.439406542s ago: executing program 1 (id=4003): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c2020cc5a4d9b739b280b580000", @ANYRES16=r1, @ANYBLOB="0b092abd7000fedbdf251200000008000300", @ANYRES32=r2, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x4000000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) socket$kcm(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYRES64=r3], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf25010000004c000280bc00018008000100040000000800010002000000080001000600000008000100070000000800010006000000080001000700000008000100070000000c0001000000000000000000100002800c0001"], 0x70}, 0x1, 0x0, 0x0, 0x40005}, 0x4000040) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x108, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, 0x0, {0x2, 0xb}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xe20}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x9}, @TCA_STAB={0xcc, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x52, 0xd, 0x80, 0x0, 0x1, 0xfffffffe, 0x5}}, {0xe, 0x2, [0x0, 0x5, 0x40, 0x7fff, 0x6]}}, {{0x1c, 0x1, {0x5f, 0x3, 0x0, 0xfffff800, 0x2, 0x9, 0x6, 0x7}}, {0x12, 0x2, [0x3, 0x7, 0xe, 0x4, 0x1, 0x8c, 0x2]}}, {{0x1c, 0x1, {0x0, 0x45, 0x1, 0xa4, 0x0, 0x5, 0x6, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0x7f, 0x7, 0x7, 0x1, 0x3, 0x7f, 0x2}}, {0x4}}, {{0x1c, 0x1, {0x3, 0x81, 0xe, 0x9, 0x1, 0xb4, 0x2, 0x3}}, {0xa, 0x2, [0xf, 0x1, 0x40]}}]}, @TCA_RATE={0x6, 0x5, {0x2, 0x4}}]}, 0x108}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0xc}, {0x0, 0xd}, {0x0, 0xffff}}, [{0x8, 0xb, 0x3}]}, 0x2c}}, 0x40004) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r7 = socket$netlink(0x10, 0x3, 0xf) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r8) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r8, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB="18006bf9a0a38e92cc686b3f4f161ff0ce61277ba2e4ab8a6a7efe51be80c096ffffc8fc5182dd9eb36f894893a3be201c3569ab240900000000000000b857f49f", @ANYRES16=0x0, @ANYBLOB="00012cbd7000ffdbdf25110000d421000180"], 0x18}, 0x1, 0x0, 0x0, 0xc8}, 0x5) bind$netlink(r7, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbf4, 0x4}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) 18.390452619s ago: executing program 4 (id=3994): bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xe, 0x4, &(0x7f00000007c0)=ANY=[@ANYBLOB="b4050000fdff7f006110580003000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xbf, &(0x7f00000006c0)=""/191, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x1000000, 0x0, 0x5}, 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r1, 0x5, 0x0, @void}, 0x10) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00'}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={r2, r0, 0x4, r3}, 0x10) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x15, 0x0, 0x0, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000340)={0x1d, r7, 0x1, {0x1, 0xff, 0x1}, 0x3}, 0x18) connect$can_j1939(r6, &(0x7f00000000c0)={0x1d, r7, 0x0, {0x0, 0x0, 0x3}, 0xff}, 0x18) 18.275370858s ago: executing program 2 (id=3995): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x34}, 0x28) r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000380)="4e813cbfba79", 0x6, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000014c0)='dctcp', 0xfc56) shutdown(r1, 0x1) getsockopt$bt_hci(r1, 0x0, 0x1, &(0x7f00000003c0)=""/4096, &(0x7f00000013c0)=0x1000) connect$can_bcm(r0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000003780)=[{0x0, 0x0, &(0x7f0000001a80), 0x0, 0x0, 0x0, 0x200008c0}], 0x1, 0x44840) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000300)}, 0x1) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000040)="2b1c52ac82e71ea05b0c5e43ede4", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)=ANY=[@ANYBLOB="1c000000020303000000000000000011000000100800010001"], 0x1c}}, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001580)=ANY=[@ANYBLOB="11fe6aee51000187920000000000f3636bfa0000a59f13d9bc7c45a28b4aca0e07497d86392052104cd33189a2ad39bd84fd15cce4efa6637c32b028d5ad286630fdc9db478da9c4773c428f66312c4bddb4be0d0157782c0712b008004bd4d5ad000000005abe07cfdb7b14c889556c9d8561e5d840144bab441e3be355744395af73d800000000ffffffffffffff65f2af4f431bdb6657e19b0403ccb4f1f35b3b28d2a151d100ed55f94bf5674ef9e2afed54ce01bce44c61ef895ce0301b499a7bf65ba79ad6be2c51c92f9cee0a32b035d90356916352347c0c46890a793dc1c8bc34c0a94a94075fb87cf5de75a49095fa08cb08b0c15e130b00fcd0792a4e242e387e920aa24344feeeba72f20352b514fadb5b6f4256474af4bcc82b89cfbdc3f90d68368f63de107c794d4c18acf2422674365bb07fc6bd161d81374e0d99a08448e29a508080c25d85c01d280fb4ed7a089feee2a3f88d5ef04f6660435957aaedb169825ca8e87a463c059e433cd16f4ec762c872d21acedff402716b057f6da2ed36d719ec8e134d4c426e9b0cee5af82cb3d5391be685e30ee17e70d0ca82ff34a0587672bdc0827c5bcca7140c1d72dd18c0faf5083a826df074b4027af2c47608ffb4d338857669a435d9b042f6cdedf01d871d738302822e06d5914200"/494], 0x14}, 0x1, 0x0, 0x0, 0x24004004}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000000203030000000000000000000a00001043000200000000090100000037bc"], 0x20}, 0x1, 0x0, 0x0, 0x4000054}, 0x4040004) ioctl$XFS_IOC_INUMBERS(r2, 0x80405880, &(0x7f0000000100)={{0xfffffffeffffffff, 0x7, 0x9, 0x6, 0x10000}, [{0x80, 0x4, 0xa, 0xc}, {0x9, 0x7fffffff, 0x6, 0x8}, {0x1, 0x0, 0x47, 0x1}, {0x401, 0x8001, 0xd, 0x8}]}) recvfrom$packet(0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0) 18.244496324s ago: executing program 0 (id=3996): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="180000ff950000000000000000000000850000000e00000018110000", @ANYBLOB="0000000000000000bf080000000000007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 18.212926038s ago: executing program 1 (id=3997): epoll_create(0x9660) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='vlan0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000002680)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000002b40)=[{&(0x7f0000000000)="0085cd2f341c2000eb", 0x9}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1}}], 0x3, 0x119e75c40277adee) 18.137375835s ago: executing program 4 (id=3998): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x121800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x24, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0xffffffffffffffd7}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x6}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x3}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f0000000280)="05", 0x1, 0x4009, &(0x7f0000000140)={0x11, 0x86dd, 0x0, 0x1, 0x3, 0x6, @remote}, 0x14) 18.136376467s ago: executing program 3 (id=3999): unshare(0x20010000) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e24}, 0x6e) bind$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x2) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x200000c, 0x32, 0xffffffffffffffff, 0x41e90000) (async) r1 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e1f, 0xffffffff, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x5}, 0x1c) (async) setsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000140)=0xfb78, 0x4) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r2, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x1002, &(0x7f00000014c0)=""/4098, 0x0, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 18.124510573s ago: executing program 0 (id=4000): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r0, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000840)=[{0x0}, {&(0x7f0000000680)="3780", 0xfffe}], 0x2}}], 0x1, 0x4c0a5) 17.461327296s ago: executing program 3 (id=4001): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x4004010) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0xd2}, 0x9c) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (fail_nth: 87) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 16.97301488s ago: executing program 1 (id=4002): pipe(0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfe, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8a1, 0x2, 0x2, 0x4, 0x7}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$OCFS2_IOC_REFLINK(r1, 0x40186f04, &(0x7f00000003c0)={&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000380)='\x00', 0x762}) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40010}, 0x0) close(r3) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@gettaction={0xf0, 0x32, 0xe72c5f922f23cad9, 0x70bd2a, 0x25dfdbf7}, 0xf0}, 0x1, 0x0, 0x0, 0x8080}, 0x10000084) r4 = socket(0x10, 0x3, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x6}, {0x0, [0x0, 0x0, 0x0, 0x30]}}, &(0x7f0000000140)=""/246, 0x1e, 0xf6, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x7, 0x87, &(0x7f0000000480)=""/135}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, r5, 0x0, 0x1}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r4, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000009110009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)={0x68, 0x2d, 0x107, 0x0, 0x25dfdbff, {0xb, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0xa}]}, @nested={0x4, 0x2}, @nested={0x45, 0x3, 0x0, 0x1, [@generic="282bf8850cdb49521ee6188ba3b22f7bbc02ecfc1a8a2c15d7f52bfe2e6411b3eb5f88dbd5dae8f2d6ea3a3c23e4b8d92d51f7a0614c2e1bf8a9d579f25c7f9a74"]}]}, 0x68}, 0x1, 0x0, 0x0, 0xc004}, 0xc010) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000000000)={r9, 0x0, 0x7, 0x3}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000040)={r9, 0x101, 0x10}, 0xc) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) 16.972640093s ago: executing program 0 (id=4004): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000015c0)={&(0x7f0000001140)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1c00000000000000000000000700000086"], 0x20}, 0x4000004) 16.971801208s ago: executing program 3 (id=4005): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000082c0), &(0x7f0000008300)=0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x456f, 0x4) sendmmsg$inet(r3, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) recvmmsg(r4, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/111, 0x6f}, 0xf}], 0x1, 0x22, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x40, &(0x7f00000000c0)=0xfd, 0x4) sendmsg$NFT_BATCH(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="02000000040000000800"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000001600)=ANY=[@ANYBLOB="18000000010000000000000000000000b7080000000000007baaf8ff00000000b5080000ffffffff7b8af0ff00000000bfa000000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000b3000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000000600000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="180000004f0c00001c000000fc0317b77109bfffff81162f0000000000950259f210000000"], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r7, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) recvfrom(r3, &(0x7f0000000200)=""/131, 0xf92e58a67d38802c, 0x2101, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000008200)={r8, @in6={{0xa, 0x4e23, 0x7, @mcast1, 0xe44f53c}}}, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) recvmmsg(r0, &(0x7f0000007f40)=[{{&(0x7f0000000180)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000200)=""/54, 0x36}], 0x1, &(0x7f00000002c0)=""/176, 0xb0}, 0x3}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)}], 0x1, &(0x7f0000000400)=""/34, 0x22}, 0x9}, {{&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001740)=[{&(0x7f00000004c0)=""/230, 0xe6}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/72, 0x48}, {&(0x7f0000001680)}, {&(0x7f00000016c0)=""/68, 0x44}], 0x5, &(0x7f00000017c0)=""/4096, 0x1000}, 0x10001}, {{&(0x7f00000027c0)=@x25, 0x80, &(0x7f0000002a80)=[{&(0x7f0000002840)=""/130, 0x82}, {&(0x7f0000002900)=""/52, 0x34}, {&(0x7f0000002940)=""/89, 0x59}, {&(0x7f00000029c0)=""/177, 0xb1}], 0x4, &(0x7f0000002ac0)=""/34, 0x22}, 0x9}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000002b00)=""/132, 0x84}, {&(0x7f0000002bc0)=""/51, 0x33}, {&(0x7f0000002c00)=""/152, 0x98}, {&(0x7f0000002cc0)=""/85, 0x55}, {&(0x7f0000002d40)=""/133, 0x85}, {&(0x7f0000002e00)=""/220, 0xdc}], 0x6, &(0x7f0000002f80)=""/134, 0x86}, 0xa}, {{&(0x7f0000003040)=@ethernet={0x0, @random}, 0x80, &(0x7f00000032c0)=[{&(0x7f00000030c0)=""/59, 0x3b}, {&(0x7f0000003100)=""/181, 0xb5}, {&(0x7f00000031c0)=""/4, 0x4}, {&(0x7f0000003200)=""/137, 0x89}], 0x4, &(0x7f0000003300)=""/252, 0xfc}, 0x8}, {{&(0x7f0000003400)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000003600)=[{&(0x7f0000003480)=""/234, 0xea}, {&(0x7f0000003580)=""/76, 0x4c}], 0x2}, 0x3ff}, {{&(0x7f0000003640)=@alg, 0x80, &(0x7f00000046c0)=[{&(0x7f00000036c0)=""/4096, 0x1000}], 0x1, &(0x7f0000004700)=""/9, 0x9}, 0x2}, {{&(0x7f0000004740)=@sco, 0x80, &(0x7f0000006ac0)=[{&(0x7f00000047c0)=""/188, 0xbc}, {&(0x7f0000004880)=""/127, 0x7f}, {&(0x7f0000004900)=""/128, 0x80}, {&(0x7f0000004980)=""/24, 0x18}, {&(0x7f00000049c0)=""/4096, 0x1000}, {&(0x7f00000059c0)=""/237, 0xed}, {&(0x7f0000005ac0)=""/4096, 0x1000}], 0x7, &(0x7f0000006b40)=""/196, 0xc4}}, {{&(0x7f0000006c40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000006f00)=[{&(0x7f0000006cc0)=""/7, 0x7}, {&(0x7f0000006d00)=""/216, 0xd8}, {0x0}, {&(0x7f0000006ec0)=""/39, 0x27}], 0x4, &(0x7f0000006f40)=""/4096, 0x1000}, 0x6}], 0xa, 0x2, &(0x7f00000081c0)) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0x4c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}}, 0x0) getsockopt$inet6_buf(r11, 0x29, 0x4, 0xfffffffffffffffd, &(0x7f00000000c0)=0xfffffecb) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r9, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) 16.968347578s ago: executing program 0 (id=4006): r0 = socket$netlink(0x10, 0x3, 0x6) (async) ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d2, &(0x7f0000000140)="80863194cf91cccab299e1eb5a8c91102597c885eb937a51c520822895add22262483d48116405d6588eb2a9bdc19e3106b2df96df94151c85314cd8537084eda07015a64d1d56b7ed27313431c35446ec3886336a47acb22c3da9426f8fa126b733d0d714d532a7ff266a22c96f148aa52c37bfe2c90aa99e0333d9f674eeeb56467f99018b5a2436118bc2f9c1df97058e1922ae238460571521019659e5ad350f103d178d2433a8029d1b8afcc0bb44fb1fa71b27e4") (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$inet6(r1, &(0x7f0000001840)=[{{&(0x7f0000000400)={0xa, 0x4e22, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xb}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="cebe84dc4dfdba5c1d8de92fa62498088b615e69c9db001f7ed6c67f7d937e6eabf76c91309aa3ded9cc313e89e5ffaac591d61bf6f65ffe577a8e84a6a74feea426e871edb5b1add3dd14ea6ff98d1be8aef576fd13990d41d340e3bfde7efda66b5f204641ccae65a3456b80c7fd56d324af2d58f829", 0x77}, {&(0x7f0000000ac0)="9f65512266c5eeb52a1d43ac5ceb769c0621933a10d62d9567e4e63bfcef24a414a942fc0284f3b3555272b931160663583f9b015bd1c97f9e3942e2c15e476c51d2e4d922500b96f712ad124f4840561631679de77a087a2b5e341d10ec06ac", 0x60}], 0x2, &(0x7f0000000b80)=[@rthdrdstopts={{0x68, 0x29, 0x37, {0x1, 0x9, '\x00', [@pad1, @ra={0x5, 0x2, 0xbda2}, @enc_lim={0x4, 0x1, 0x4}, @calipso={0x7, 0x40, {0x2, 0xe, 0x3, 0x2, [0x1c0000000000000, 0xf, 0x0, 0x3, 0x7, 0x4449, 0x2]}}]}}}, @hopopts_2292={{0x38, 0x29, 0x36, {0x1, 0x3, '\x00', [@padn={0x1, 0x1, [0x0]}, @enc_lim={0x4, 0x1, 0x7}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x10, {0x2, 0x2, 0x1, 0x6, [0x3]}}]}}}], 0xa0}}, {{&(0x7f0000000c40)={0xa, 0x4e21, 0x9, @private2, 0x8}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f0000000c80)="d326de9f56655dedfbd385f9719a93bd34bb6c48ba42fed655e03f29fb56f917adbfb0f45d", 0x25}], 0x1, &(0x7f0000000d00)=[@hoplimit={{0x14, 0x29, 0x34, 0xfffffffb}}], 0x18}}, {{&(0x7f0000000d40)={0xa, 0x4e23, 0x3, @private0, 0x8}, 0x1c, &(0x7f0000001200)=[{&(0x7f0000000d80)="336c84d6abb6112938aa0a62fb6b64bd548024eb9ae700ed4a06c527eb438913d8db81d3aa74987c797b323d9236c32a40647d2495f21fda071f5be29d88eabe9cd11c2b98031b7f86c0063118ce1f541ebd44c1fc02a680b03b38e0b7f5bba9740eb374bba08045f2a4e8cb51f59e269a341eb71526f29692d92bb2c5bface6913366ae4514cb7970ca163f83cf2956fb7c5c3860d575b6856d71c09603196f3ed085d51cd94b16f37c1469d1eb996e44154b70bb55f1ce5ef78433ef54441d03f1460d4513935003383a01e6437e868c8242b3abb97fe1c784d11739a01ea7f8fd6477cd06f2c00c773b5a6df8309f6722a72ef48cee81", 0xf8}, {&(0x7f0000000e80)="48670e0a191782fc88a69fade709aa9fb00010afbccf6001ecbb91f10e185d4e1f0c3e67664248337a3e0da03103506a1e668644e5e4a15a1f0cec575adac1e78410760fe67b4bfa743743046e23487572130525d239a54c478acc202c6c8c6d7b42f7b1724bed8a2044a605b5bd8b712610eecffa0c189cb06624657599724fec06937afaf642c316916988af61c82abc4ebddbb4c90e010d2fc0dfa13fe91f93a30baad0a909ef1e68d4e00e52fa70a529c4f2a4604ea7efb345058e1282787ef8905e27e74d36d17389da12074e2041c93a6ea9c42c590ddb042740da5a8d6205a5366f", 0xe5}, {&(0x7f0000000f80)="4d4d611f6f7cc19b579d2a70433460880e273f1b9508430a9d0fdd93815901c3062963ec8e8b072794e6342258383c56226645f51244f6a67335f98149508d95bc58034b330cefb22f5e3539be605af5f32b326ab2c91853e2870896946762688f15642bd6df83c3a46cc2c7a32dd8d45676c2613970cc27f2", 0x79}, {&(0x7f0000001000)="593ebd7bf7fd9cf658d677ef68e7a6b506f270d92508449350bc82b25c6a9a01a8d68eec4624ffa0dff0cbafe122c9bdbb5f73675908b04490cebdabc844397c7786e53999114b3f6662461b3762c25fc98eeecbec200f5491498adb279be46d67b213c2628f338af733fb4dca7497b7f95c05054cf865206ceb3300e6017620ffdd2bdb9f21a67d970bf09a11322ffc32ebdd9fd923c217a5dded81325bb69aaf13b936a5e773550f121caddc88a84cd796a4717e5b1a324a860f3a17e92b5226497f4a9b36f996f94b7ff88db6b4800ecc92414175d8e513b8dd07eccf7cdc31bbc5d1c2f91ef2762a0573c0dab8a8fdb60f915d1b04e58d93c5cc2bb3", 0xfe}, {&(0x7f0000001100)="2529617af623a96ae4107c2702967ccdba40aa3788efaa0fb52596fba74f0df74e25ea1832a97597a026a019e2ae7fe54930aef8337c597ba0d84fbf5832b038075ae89e9c0d1e67d8442fbfce6a0bb51cd22dc4663177abf2cfc25d2f1434abb7180f0f9226c4111dbab1ec156bdf7a7f4fc32987f5a8246a83e7535def92ad3b1f1b96b68114813515ef4fa3dc2aea0ddf390b5f0148bd812b843d1cdcffa53bdafb08ad03d16aa04d93aaf64e5bfbfebaa9e9eaec0268918b9ba66de7d03325cc76e508362c3a99a751045257d51753a38c259f5d3a7054d8e1fe32ed23", 0xdf}], 0x5, &(0x7f0000001280)}}, {{&(0x7f00000012c0)={0xa, 0x4e22, 0x37b39f1a, @dev={0xfe, 0x80, '\x00', 0x1f}, 0x5}, 0x1c, &(0x7f0000001600)=[{&(0x7f0000001300)="7195bb59b360d6ce141b7b4cc7bfeb36ed618b83b22183e0cc5a4ffc023ad423b7fe6854f531e00e6e524418164a9c5c3fb0f30828227842e748b2c0c35c5e5339ff647dbb8220d5dd11dbb05e60fe468f340036177fccc34a7298c92a605c8a4d22e138a904e41b261b903d175326768094d0171b871713b5096b95e82928d498ef1a650a1d1baaf121a2782446fa11e33ee0", 0x93}, {&(0x7f00000013c0)="2053b0cf47794a569f67aa039d62e6007ca58d9407c61b1702951bf47c752f8f64b50e0ec01d391c75e43563df550f3d24e02d382b196e4a28a3176d998d537a7256b2422e42aecc1df54660eeea132d2e1f0ede141f0351ba3b254f5585915bb1efd3cbc8e9ba6c5824c71767112b2bea45d0a670f872d4f3521981d0d242deb2fc1894651682c1", 0x88}, {&(0x7f0000001480)="6c59183a66a291ac5f9b9072db1fe7db95065523720d12c933230712343d12864423b4e3e1ca75f9f6d90fdcc842ece6fecc8f30325efffb077355a78209692b9fb12739aefb9a7d8a1ccf521a0a6b4073b9dddff912dc6a4c05a96fc1c9bd17a735e9f9c906fc5de6b764c86482a375713fdabe3ccd53b24b0a4015326562ea286e", 0x82}, {&(0x7f0000001540)="94d57082fc0bdf7bcd4b5a7ac5fb91fb35275da6a3165942dc13b2d6a5698b9a6edf355dd2eaa42ec4994fb94b33b3ffcfd11c4d54c1cfef5fa9d82d5de8312fa45d63927b39a1af14da7771e42c06f02cd45be9da1ccc072224db73e3007cdfb7aded8e74b2d3a76ec0b652b20e7e13fc1d6b9c1c5501a8012debc1d3d42499b3c94fbc208bb6e0fcc6395b4e574b278aa406f2402a33082381bc2fcaab", 0x9e}], 0x4, &(0x7f0000001640)=[@hopopts={{0x118, 0x29, 0x36, {0x16, 0x1f, '\x00', [@generic={0x7f, 0x1a, "cc74730d94d0e45bb481a1587ff00601721b76543a1492b9f7ca"}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0x21}}, @hao={0xc9, 0x10, @mcast2}, @generic={0x1, 0xae, "651bf40c1d096d0bb05e0b710ced450fa67bc127b7bca3d9eefa5cde11ab658dfc68a11479f596ea5f851e7962de47094c276b3c061b6e3cb36fff76165c42ede4bb6a7fb95da882edc1f0a2ae24e8a0f3bb14cd035d88691f5551cea9c1f3bec57808ca0143e8b80c91715183552cab0bc6904017bfde14d3cb2d8296ba6962aff634cf9c3d1858e8128fe194c5bcaeabadce488ca42495a8c24ba2f4295596b68ba0294b189b854e264e97ef66"}, @ra={0x5, 0x2, 0x1}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}}}, @dstopts={{0x20, 0x29, 0x37, {0x16, 0x0, '\x00', [@padn={0x1, 0x1, [0x0]}, @pad1]}}}, @dstopts={{0x30, 0x29, 0x37, {0x3c, 0x3, '\x00', [@jumbo={0xc2, 0x4, 0x5}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}]}}}, @rthdr={{0x58, 0x29, 0x39, {0x4, 0x8, 0x1, 0x22, 0x0, [@loopback, @ipv4={'\x00', '\xff\xff', @local}, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x6}}], 0x1d8}}], 0x4, 0x400c0) (async) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$key(0xf, 0x3, 0x2) (async) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) (async) r3 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'}) (async) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f0000001280), &(0x7f0000001940)=0x4) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000001000/0xe000)=nil, 0xe000, 0x1000001, 0x32, r4, 0x3263a000) (async) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x20, "9595f429ae08a5654664601e3b70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000004000000000000000000000300000000030000000300000000000101010000000000000800000000010000000100000506000004000000000200000000000000005f"], 0x0, 0x58, 0x0, 0xa}, 0x28) (async) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000047c0)={0x60, r7, 0x405, 0x70bd2b, 0x25dfdbfe, {}, [{{0x8, 0x1, r8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) (async) r9 = socket$kcm(0x21, 0x2, 0xa) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001980)={0x1, 0xffffffffffffffff}, 0x4) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x30, 0x2e, &(0x7f0000001e80)=ANY=[@ANYBLOB="18000000007000000000000007000000cd58f2ffffffffffb7080000000000007b8af8ff00000000b7080000090000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7050085000000a50000008a530200f8ffffff1800000001000000000000000600000085000000010000c4700100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008501000006000000b7080000000000007b8af8ff00000000b708000088c500007b8af06b001e5c2374bf72000080000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000e8a9774b5ac8f6a18d935246700c0f00000000001de54f746ec2ca084c1b3acbd3f423fe135fdffad632d0dfe8e3229c38a1779280136cc8ca9708bc72adab5ea905b4f7", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000018270000", @ANYRES32, @ANYBLOB="000000000b000000850000007300000085200000030000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f0000000340)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x3, 0x4, 0x196}, 0x10, 0x0, 0x0, 0x8, &(0x7f00000003c0)=[0x1, 0xffffffffffffffff, r9, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, r10, r4], &(0x7f0000000880)=[{0x4, 0x1, 0x1, 0x5}, {0x3, 0x3, 0xb, 0x3}, {0x2, 0x1, 0x6, 0x9}, {0x1, 0x4, 0xe, 0xc}, {0x2, 0x5, 0x6, 0x7}, {0x2, 0x5, 0x8, 0x8}, {0x4, 0x4, 0x0, 0x2}, {0x2, 0x1, 0xa, 0x4}], 0x10, 0x1ff}, 0x94) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000a00)={r11}, 0xc) (async) sendmsg$kcm(r9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1000000000000000100100000b00000037ada1e0a50163e301152f62afcc138950c2b8c43186c9b8938c33ecb2e63c"], 0x10}, 0xfc40) (async) r12 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r12, 0x0, 0x40, &(0x7f0000000440)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x1c8, 0x1c8, 0x98, 0x0, 0x98, 0x330, 0x330, 0x330, 0x330, 0x330, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@private=0xa010100, @local, 0x7fffff80, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x10, 0x0, 0x2}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0xff, 0x2, [0x4, 0x36, 0x1d, 0x1c, 0x23, 0x1e, 0x2c, 0x7, 0x1e, 0x7, 0x2d, 0x37, 0x30, 0x9, 0x3b, 0x16], 0x0, 0x6, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$netlink(r13, &(0x7f0000000040)=@unspec, 0xc) (async) sendmsg$nl_xfrm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac01000017000100010000000000000000000000160000001300fe8000000000000000000000000000bbffffffff000000000000000000000000ffffffff0000000000000000000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d3320000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c0000000a000000ac1414bb000000000000000000000000053500000301f900090000020300000000020000"], 0x1ac}}, 0x0) 16.262973442s ago: executing program 2 (id=4007): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0xfffffff4, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x5}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd8}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) 15.534593154s ago: executing program 0 (id=4008): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000001000000049cf446064a0000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES16=r0, @ANYBLOB="0000000000000000b7080000000000007b8bf8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='scalable', 0xfffd) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) r5 = socket$inet6(0xa, 0x80003, 0x6) r6 = socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[], 0x2c}}, 0x20008801) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004e00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x4}], 0x30}], 0x1, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/47, 0x2f}], 0x1}, 0x2140) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x44, 0x6, 0x480, 0xc0, 0x0, 0x2b0, 0x0, 0xc0, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x6, 0x0, {[{{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}, {{@ip={@private=0xa010101, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@inet=@socket2={{0x28}, 0x4}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x10, 0x7, 0x1100]}, {0x0, [0x2, 0x0, 0x0, 0x2, 0x4]}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x6, 0x0, 0x6, 0x2, 0x1], 0x6, 0x5}, {0x3, [0x3, 0x4, 0x3, 0x0, 0x7], 0x4, 0x6}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x8000, 0x400, @remote, 0x4e24}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4e0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) r8 = socket(0xb, 0xa, 0xffffffff) shutdown(r8, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r8, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet6_buf(r5, 0x29, 0x6, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r4, @ANYBLOB="0500060001000000050007a10000000005000300df00000008000200", @ANYRES64=r2], 0x68}}, 0x0) 15.53410209s ago: executing program 2 (id=4009): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000180)=""/197, 0xc5}, {&(0x7f0000000040)=""/139, 0x8b}, {&(0x7f0000000340)=""/209, 0xd1}, {&(0x7f0000000500)=""/167, 0xa7}, {&(0x7f00000005c0)=""/4082, 0xff2}], 0x5}, 0x2}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}}], 0x6, 0x100, 0x0) 2.101680322s ago: executing program 32 (id=3998): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x121800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x24, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0xffffffffffffffd7}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x6}, @TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x3}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f0000000280)="05", 0x1, 0x4009, &(0x7f0000000140)={0x11, 0x86dd, 0x0, 0x1, 0x3, 0x6, @remote}, 0x14) 1.535654245s ago: executing program 33 (id=4002): pipe(0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfe, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8a1, 0x2, 0x2, 0x4, 0x7}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$OCFS2_IOC_REFLINK(r1, 0x40186f04, &(0x7f00000003c0)={&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000380)='\x00', 0x762}) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40010}, 0x0) close(r3) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@gettaction={0xf0, 0x32, 0xe72c5f922f23cad9, 0x70bd2a, 0x25dfdbf7}, 0xf0}, 0x1, 0x0, 0x0, 0x8080}, 0x10000084) r4 = socket(0x10, 0x3, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x6}, {0x0, [0x0, 0x0, 0x0, 0x30]}}, &(0x7f0000000140)=""/246, 0x1e, 0xf6, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x7, 0x87, &(0x7f0000000480)=""/135}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, r5, 0x0, 0x1}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r4, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000009110009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)={0x68, 0x2d, 0x107, 0x0, 0x25dfdbff, {0xb, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0xa}]}, @nested={0x4, 0x2}, @nested={0x45, 0x3, 0x0, 0x1, [@generic="282bf8850cdb49521ee6188ba3b22f7bbc02ecfc1a8a2c15d7f52bfe2e6411b3eb5f88dbd5dae8f2d6ea3a3c23e4b8d92d51f7a0614c2e1bf8a9d579f25c7f9a74"]}]}, 0x68}, 0x1, 0x0, 0x0, 0xc004}, 0xc010) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000000000)={r9, 0x0, 0x7, 0x3}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000040)={r9, 0x101, 0x10}, 0xc) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1.445783336s ago: executing program 34 (id=4005): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000082c0), &(0x7f0000008300)=0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x456f, 0x4) sendmmsg$inet(r3, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) recvmmsg(r4, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/111, 0x6f}, 0xf}], 0x1, 0x22, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x40, &(0x7f00000000c0)=0xfd, 0x4) sendmsg$NFT_BATCH(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="02000000040000000800"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000001600)=ANY=[@ANYBLOB="18000000010000000000000000000000b7080000000000007baaf8ff00000000b5080000ffffffff7b8af0ff00000000bfa000000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000b3000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000000600000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="180000004f0c00001c000000fc0317b77109bfffff81162f0000000000950259f210000000"], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r7, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) recvfrom(r3, &(0x7f0000000200)=""/131, 0xf92e58a67d38802c, 0x2101, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000008200)={r8, @in6={{0xa, 0x4e23, 0x7, @mcast1, 0xe44f53c}}}, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) recvmmsg(r0, &(0x7f0000007f40)=[{{&(0x7f0000000180)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000200)=""/54, 0x36}], 0x1, &(0x7f00000002c0)=""/176, 0xb0}, 0x3}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)}], 0x1, &(0x7f0000000400)=""/34, 0x22}, 0x9}, {{&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001740)=[{&(0x7f00000004c0)=""/230, 0xe6}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/72, 0x48}, {&(0x7f0000001680)}, {&(0x7f00000016c0)=""/68, 0x44}], 0x5, &(0x7f00000017c0)=""/4096, 0x1000}, 0x10001}, {{&(0x7f00000027c0)=@x25, 0x80, &(0x7f0000002a80)=[{&(0x7f0000002840)=""/130, 0x82}, {&(0x7f0000002900)=""/52, 0x34}, {&(0x7f0000002940)=""/89, 0x59}, {&(0x7f00000029c0)=""/177, 0xb1}], 0x4, &(0x7f0000002ac0)=""/34, 0x22}, 0x9}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000002b00)=""/132, 0x84}, {&(0x7f0000002bc0)=""/51, 0x33}, {&(0x7f0000002c00)=""/152, 0x98}, {&(0x7f0000002cc0)=""/85, 0x55}, {&(0x7f0000002d40)=""/133, 0x85}, {&(0x7f0000002e00)=""/220, 0xdc}], 0x6, &(0x7f0000002f80)=""/134, 0x86}, 0xa}, {{&(0x7f0000003040)=@ethernet={0x0, @random}, 0x80, &(0x7f00000032c0)=[{&(0x7f00000030c0)=""/59, 0x3b}, {&(0x7f0000003100)=""/181, 0xb5}, {&(0x7f00000031c0)=""/4, 0x4}, {&(0x7f0000003200)=""/137, 0x89}], 0x4, &(0x7f0000003300)=""/252, 0xfc}, 0x8}, {{&(0x7f0000003400)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000003600)=[{&(0x7f0000003480)=""/234, 0xea}, {&(0x7f0000003580)=""/76, 0x4c}], 0x2}, 0x3ff}, {{&(0x7f0000003640)=@alg, 0x80, &(0x7f00000046c0)=[{&(0x7f00000036c0)=""/4096, 0x1000}], 0x1, &(0x7f0000004700)=""/9, 0x9}, 0x2}, {{&(0x7f0000004740)=@sco, 0x80, &(0x7f0000006ac0)=[{&(0x7f00000047c0)=""/188, 0xbc}, {&(0x7f0000004880)=""/127, 0x7f}, {&(0x7f0000004900)=""/128, 0x80}, {&(0x7f0000004980)=""/24, 0x18}, {&(0x7f00000049c0)=""/4096, 0x1000}, {&(0x7f00000059c0)=""/237, 0xed}, {&(0x7f0000005ac0)=""/4096, 0x1000}], 0x7, &(0x7f0000006b40)=""/196, 0xc4}}, {{&(0x7f0000006c40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000006f00)=[{&(0x7f0000006cc0)=""/7, 0x7}, {&(0x7f0000006d00)=""/216, 0xd8}, {0x0}, {&(0x7f0000006ec0)=""/39, 0x27}], 0x4, &(0x7f0000006f40)=""/4096, 0x1000}, 0x6}], 0xa, 0x2, &(0x7f00000081c0)) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0x4c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}}, 0x0) getsockopt$inet6_buf(r11, 0x29, 0x4, 0xfffffffffffffffd, &(0x7f00000000c0)=0xfffffecb) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r9, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) 374.665792ms ago: executing program 35 (id=4008): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000001000000049cf446064a0000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES16=r0, @ANYBLOB="0000000000000000b7080000000000007b8bf8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='scalable', 0xfffd) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) r5 = socket$inet6(0xa, 0x80003, 0x6) r6 = socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[], 0x2c}}, 0x20008801) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004e00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x4}], 0x30}], 0x1, 0x0) recvmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/47, 0x2f}], 0x1}, 0x2140) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x44, 0x6, 0x480, 0xc0, 0x0, 0x2b0, 0x0, 0xc0, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x6, 0x0, {[{{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}, {{@ip={@private=0xa010101, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@inet=@socket2={{0x28}, 0x4}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x10, 0x7, 0x1100]}, {0x0, [0x2, 0x0, 0x0, 0x2, 0x4]}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x6, 0x0, 0x6, 0x2, 0x1], 0x6, 0x5}, {0x3, [0x3, 0x4, 0x3, 0x0, 0x7], 0x4, 0x6}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x8000, 0x400, @remote, 0x4e24}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4e0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) r8 = socket(0xb, 0xa, 0xffffffff) shutdown(r8, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r8, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet6_buf(r5, 0x29, 0x6, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r4, @ANYBLOB="0500060001000000050007a10000000005000300df00000008000200", @ANYRES64=r2], 0x68}}, 0x0) 0s ago: executing program 36 (id=4009): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000180)=""/197, 0xc5}, {&(0x7f0000000040)=""/139, 0x8b}, {&(0x7f0000000340)=""/209, 0xd1}, {&(0x7f0000000500)=""/167, 0xa7}, {&(0x7f00000005c0)=""/4082, 0xff2}], 0x5}, 0x2}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}}], 0x6, 0x100, 0x0) kernel console output (not intermixed with test programs): erface activated: batadv_slave_0 [ 460.363138][T16767] CPU: 0 UID: 0 PID: 16767 Comm: syz.2.3177 Not tainted syzkaller #0 PREEMPT(full) [ 460.363166][T16767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 460.363180][T16767] Call Trace: [ 460.363188][T16767] [ 460.363196][T16767] dump_stack_lvl+0xe8/0x150 [ 460.363237][T16767] should_fail_ex+0x40c/0x560 [ 460.363271][T16767] _copy_from_user+0x2d/0xb0 [ 460.363293][T16767] ___sys_recvmsg+0x173/0x5a0 [ 460.363327][T16767] ? __pfx____sys_recvmsg+0x10/0x10 [ 460.363358][T16767] ? __fget_files+0x2a/0x420 [ 460.363420][T16767] do_recvmmsg+0x31a/0x7f0 [ 460.363454][T16767] ? __pfx_do_recvmmsg+0x10/0x10 [ 460.363489][T16767] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 460.363520][T16767] ? __fget_files+0x3a2/0x420 [ 460.363560][T16767] __x64_sys_recvmmsg+0x198/0x250 [ 460.363589][T16767] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 460.363625][T16767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.363649][T16767] do_syscall_64+0x174/0x580 [ 460.363674][T16767] ? trace_irq_disable+0x3b/0x140 [ 460.363704][T16767] ? clear_bhb_loop+0x40/0x90 [ 460.363740][T16767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.363762][T16767] RIP: 0033:0x7fd29479de99 [ 460.363782][T16767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 460.363800][T16767] RSP: 002b:00007fd295581028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 460.363822][T16767] RAX: ffffffffffffffda RBX: 00007fd294a25fa0 RCX: 00007fd29479de99 [ 460.363837][T16767] RDX: 000000000000074e RSI: 0000200000001140 RDI: 0000000000000005 [ 460.363851][T16767] RBP: 00007fd295581090 R08: 0000000000000000 R09: 0000000000000000 [ 460.363863][T16767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 460.363875][T16767] R13: 00007fd294a26038 R14: 00007fd294a25fa0 R15: 00007ffe777fbcf8 [ 460.363909][T16767] [ 460.557636][T16508] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 460.599999][ T7323] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.627749][ T7323] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.637430][ T7323] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.706566][ T7323] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.893778][ T7318] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 460.908976][ T7318] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.018758][T16789] IPv6: NLM_F_CREATE should be specified when creating new route [ 461.045006][T16791] IPv6: NLM_F_CREATE should be specified when creating new route [ 461.077041][T16789] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 461.085355][T16789] IPv6: NLM_F_CREATE should be set when creating new route [ 461.092794][T16789] IPv6: NLM_F_CREATE should be set when creating new route [ 461.100124][T16789] IPv6: NLM_F_CREATE should be set when creating new route [ 461.107652][T16791] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 461.117193][T16783] macvtap2: entered promiscuous mode [ 461.132715][T16793] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3183'. [ 461.270686][T16789] netlink: 766 bytes leftover after parsing attributes in process `syz.2.3184'. [ 461.313734][ T7323] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 461.335734][ T7323] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.462449][T16802] tipc: Enabled bearer , priority 0 [ 461.486475][T16802] syzkaller0: entered promiscuous mode [ 461.494384][T16802] syzkaller0: entered allmulticast mode [ 461.507340][T16802] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 461.721021][T16814] tipc: Resetting bearer [ 461.776250][T16801] tipc: Resetting bearer [ 461.830440][T16801] tipc: Disabling bearer [ 462.131052][T16829] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3195'. [ 462.156418][T16829] tc_dump_action: action bad kind [ 462.186423][T16831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3196'. [ 462.198691][T16829] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3195'. [ 462.220118][T16829] netlink: 'syz.2.3195': attribute type 30 has an invalid length. [ 462.232771][T16831] xt_hashlimit: size too large, truncated to 1048576 [ 462.360897][ T5637] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 462.374771][ T5637] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 462.383310][ T5637] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 462.395565][ T5637] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 462.411019][ T5637] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 462.747274][T16846] x_tables: duplicate entry at hook 3 [ 462.832946][T16848] syzkaller1: entered promiscuous mode [ 462.856687][T16848] syzkaller1: entered allmulticast mode [ 462.994987][T16843] macvtap2: entered promiscuous mode [ 463.527767][T16874] xt_hashlimit: size too large, truncated to 1048576 [ 463.713613][T16882] netlink: 'syz.4.3205': attribute type 30 has an invalid length. [ 463.797654][ T48] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.831852][ T48] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.919805][ T48] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 463.948679][ T48] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 464.104365][T16896] __nla_validate_parse: 8 callbacks suppressed [ 464.104386][T16896] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3210'. [ 464.120916][T16896] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3210'. [ 464.133970][T16896] xt_hashlimit: size too large, truncated to 1048576 [ 464.176765][T16900] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3212'. [ 464.183412][ T24] net_ratelimit: 59 callbacks suppressed [ 464.183464][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.187172][T16900] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3212'. [ 464.224264][T16897] syzkaller0: entered promiscuous mode [ 464.242717][T16897] syzkaller0: entered allmulticast mode [ 464.250339][T16906] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3211'. [ 464.324449][ T5353] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.342597][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.375442][T16908] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.385559][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.446756][T16906] 8021q: adding VLAN 0 to HW filter on device bond1 [ 464.455620][T16900] syzkaller1: entered promiscuous mode [ 464.483076][T16900] syzkaller1: entered allmulticast mode [ 464.489078][ T4937] Bluetooth: hci0: command tx timeout [ 464.500053][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.718683][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.728853][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.850363][T16920] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 464.867357][T16925] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3217'. [ 464.877187][T16920] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3216'. [ 464.896267][T16925] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3217'. [ 464.908878][T16925] netlink: 'syz.1.3217': attribute type 30 has an invalid length. [ 464.961841][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.984198][T16934] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3216'. [ 465.014659][T16931] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3219'. [ 465.047799][T16835] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.067216][T16835] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.077937][T16835] bridge_slave_0: entered allmulticast mode [ 465.112440][T16931] netlink: 'syz.4.3219': attribute type 30 has an invalid length. [ 465.135462][T16835] bridge_slave_0: entered promiscuous mode [ 465.220612][T16835] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.228124][T16835] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.235902][T16835] bridge_slave_1: entered allmulticast mode [ 465.245230][T16835] bridge_slave_1: entered promiscuous mode [ 465.414276][T16835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 465.459406][T16835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 465.611122][T16835] team0: Port device team_slave_0 added [ 465.618273][T16954] syzkaller1: entered promiscuous mode [ 465.634945][T16954] syzkaller1: entered allmulticast mode [ 465.650209][T16835] team0: Port device team_slave_1 added [ 465.697445][T16956] tipc: Enabled bearer , priority 0 [ 465.715397][T16960] syzkaller0: entered promiscuous mode [ 465.721649][T16960] syzkaller0: entered allmulticast mode [ 465.777738][T16956] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 465.811247][T16835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 465.820876][T16835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 465.853210][T16835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 465.867975][T16835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 465.875191][T16835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 465.906036][T16835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 465.910919][T16965] netlink: 'syz.2.3229': attribute type 30 has an invalid length. [ 466.202009][T16973] tipc: Resetting bearer [ 466.257309][T16953] tipc: Resetting bearer [ 466.355441][T16953] tipc: Disabling bearer [ 466.423354][T16835] hsr_slave_0: entered promiscuous mode [ 466.438987][T16835] hsr_slave_1: entered promiscuous mode [ 466.455785][T16835] debugfs: 'hsr0' already exists in 'hsr' [ 466.472793][T16835] Cannot create hsr debugfs directory [ 466.562760][ T4937] Bluetooth: hci0: command tx timeout [ 466.601990][T16987] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 466.636037][T16987] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 467.117417][T16835] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.132689][T16835] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 467.143299][T16835] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.297334][T17001] xt_socket: unknown flags 0x4 [ 467.325860][T16835] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.340841][T16835] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 467.352300][T16835] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.495498][T16835] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.509330][T16835] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 467.539679][T16835] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.613745][T17008] netlink: 'syz.3.3243': attribute type 30 has an invalid length. [ 467.762207][T16835] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.794643][T16835] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 467.830111][T16835] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.053317][T17024] macvtap2: entered promiscuous mode [ 468.355418][T17040] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 468.405417][T17040] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 468.602343][T17053] FAULT_INJECTION: forcing a failure. [ 468.602343][T17053] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 468.623256][T17047] syzkaller0: entered promiscuous mode [ 468.628921][T17053] CPU: 0 UID: 0 PID: 17053 Comm: syz.4.3255 Not tainted syzkaller #0 PREEMPT(full) [ 468.628958][T17053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 468.628972][T17053] Call Trace: [ 468.628980][T17053] [ 468.628989][T17053] dump_stack_lvl+0xe8/0x150 [ 468.629027][T17053] should_fail_ex+0x40c/0x560 [ 468.629094][T17053] _copy_from_user+0x2d/0xb0 [ 468.629178][T17053] ___sys_recvmsg+0x173/0x5a0 [ 468.629270][T17053] ? __pfx____sys_recvmsg+0x10/0x10 [ 468.629354][T17053] ? __fget_files+0x2a/0x420 [ 468.629517][T17053] do_recvmmsg+0x31a/0x7f0 [ 468.629620][T17053] ? __pfx_do_recvmmsg+0x10/0x10 [ 468.629725][T17053] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 468.629799][T17053] ? __fget_files+0x3a2/0x420 [ 468.629905][T17053] __x64_sys_recvmmsg+0x198/0x250 [ 468.629989][T17053] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 468.630083][T17053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.630147][T17053] do_syscall_64+0x174/0x580 [ 468.630218][T17053] ? trace_irq_disable+0x3b/0x140 [ 468.630291][T17053] ? clear_bhb_loop+0x40/0x90 [ 468.630364][T17053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.630418][T17053] RIP: 0033:0x7f0c8359de99 [ 468.630485][T17053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 468.630550][T17053] RSP: 002b:00007f0c8444b028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 468.630624][T17053] RAX: ffffffffffffffda RBX: 00007f0c83826090 RCX: 00007f0c8359de99 [ 468.630673][T17053] RDX: 0000000000003aa0 RSI: 00002000000047c0 RDI: 0000000000000006 [ 468.630706][T17053] RBP: 00007f0c8444b090 R08: 0000000000000000 R09: 0000000000000000 [ 468.630739][T17053] R10: 0000000060002000 R11: 0000000000000246 R12: 0000000000000002 [ 468.630772][T17053] R13: 00007f0c83826128 R14: 00007f0c83826090 R15: 00007ffe258646b8 [ 468.630856][T17053] [ 468.645934][ T4937] Bluetooth: hci0: command tx timeout [ 468.777307][T17047] syzkaller0: entered allmulticast mode [ 468.836851][T17057] netlink: 'syz.2.3256': attribute type 30 has an invalid length. [ 468.849905][T16835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 468.864608][T16835] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 468.888645][T16835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 468.904481][T16835] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 468.914383][T16835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 468.931229][T16835] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 468.947199][T16835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 468.967831][T16835] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 469.080667][T17059] xt_hashlimit: size too large, truncated to 1048576 [ 469.200424][ T10] net_ratelimit: 70 callbacks suppressed [ 469.200444][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.452329][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.682332][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.790344][T17086] xt_socket: unknown flags 0x4 [ 470.087804][ T5353] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.101074][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.478800][ T5353] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.495786][ T5353] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.728835][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.732115][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.737670][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.798651][ T4937] Bluetooth: hci0: command tx timeout [ 470.873240][T17092] __nla_validate_parse: 19 callbacks suppressed [ 470.873260][T17092] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3264'. [ 471.721621][T17101] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3265'. [ 471.860321][T16835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 471.890117][T17108] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3268'. [ 471.920850][T17108] tc_dump_action: action bad kind [ 471.936904][T16835] 8021q: adding VLAN 0 to HW filter on device team0 [ 471.946209][T17108] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3268'. [ 471.957239][T17108] netlink: 'syz.2.3268': attribute type 30 has an invalid length. [ 471.982289][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.989584][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 472.035156][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.042422][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 472.211957][T17121] xt_socket: unknown flags 0x4 [ 472.398301][T17130] sctp: [Deprecated]: syz.4.3275 (pid 17130) Use of int in max_burst socket option. [ 472.398301][T17130] Use struct sctp_assoc_value instead [ 472.575719][T17133] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3275'. [ 472.588241][T17133] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.597275][T17133] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.693525][T16835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 472.749767][T17136] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3276'. [ 472.779230][T16835] veth0_vlan: entered promiscuous mode [ 472.847978][T17136] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 472.900486][T17136] bond1 (unregistering): Released all slaves [ 472.922693][T16835] veth1_vlan: entered promiscuous mode [ 472.975669][T16835] veth0_macvtap: entered promiscuous mode [ 473.010839][T16835] veth1_macvtap: entered promiscuous mode [ 473.067933][T16835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 473.093242][T16835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 473.111645][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.137251][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.156058][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.176272][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.193842][T17145] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3277'. [ 473.229390][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807fb28c00: rx timeout, send abort [ 473.441519][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 473.460748][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 473.510675][ T7318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 473.521077][ T7318] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 473.720898][T17164] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3284'. [ 473.734195][T17164] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3284'. [ 473.743501][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807fb28c00: abort rx timeout. Force session deactivation [ 473.904231][T17164] syzkaller1: entered promiscuous mode [ 473.914383][T17173] xt_socket: unknown flags 0x4 [ 473.927646][T17164] syzkaller1: entered allmulticast mode [ 474.002882][T17179] sctp: [Deprecated]: syz.1.3289 (pid 17179) Use of int in max_burst socket option. [ 474.002882][T17179] Use struct sctp_assoc_value instead [ 474.087978][T17177] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3287'. [ 474.186881][T17177] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 474.274624][T17177] bond2 (unregistering): Released all slaves [ 474.315920][T17185] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.457354][T17189] xt_hashlimit: size too large, truncated to 1048576 [ 474.660819][T16489] net_ratelimit: 18 callbacks suppressed [ 474.660865][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.860551][T17203] xt_hashlimit: size too large, truncated to 1048576 [ 474.887736][T17201] macvlan2: entered promiscuous mode [ 474.900945][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.942646][T17201] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 475.009391][T17201] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 475.056285][T17201] team0: Port device macvlan2 added [ 475.092947][T17213] IPv6: addrconf: prefix option has invalid lifetime [ 475.282292][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.472569][T17232] sctp: [Deprecated]: syz.2.3305 (pid 17232) Use of int in max_burst socket option. [ 475.472569][T17232] Use struct sctp_assoc_value instead [ 475.623238][T17239] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.631820][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.685843][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.717973][T17229] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 475.768687][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.806422][T17244] xt_hashlimit: size too large, truncated to 1048576 [ 475.860235][T17229] bond1 (unregistering): Released all slaves [ 475.932703][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.174894][T17255] xt_socket: unknown flags 0x4 [ 476.548711][T17267] __nla_validate_parse: 3 callbacks suppressed [ 476.548734][T17267] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3315'. [ 476.577833][T17267] netlink: 'syz.1.3315': attribute type 32 has an invalid length. [ 476.735777][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.265656][T17284] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3319'. [ 477.353617][T17296] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3321'. [ 477.410289][T17284] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 477.507540][T17284] bond1 (unregistering): Released all slaves [ 477.674600][T17301] netlink: 216 bytes leftover after parsing attributes in process `syz.4.3323'. [ 477.685240][T17301] tc_dump_action: action bad kind [ 477.694575][T17301] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3323'. [ 477.703734][T17301] netlink: 'syz.4.3323': attribute type 30 has an invalid length. [ 478.074011][T17318] xt_socket: unknown flags 0x4 [ 478.387702][T17326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 478.476247][T17334] xt_hashlimit: size too large, truncated to 1048576 [ 478.625601][T17340] sctp: [Deprecated]: syz.4.3336 (pid 17340) Use of int in max_burst socket option. [ 478.625601][T17340] Use struct sctp_assoc_value instead [ 478.760927][T17343] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3336'. [ 478.975523][T17355] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3343'. [ 478.993774][T17355] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3343'. [ 479.013808][T17356] xt_socket: unknown flags 0x4 [ 479.048084][T17355] syzkaller1: entered promiscuous mode [ 479.064883][T17355] syzkaller1: entered allmulticast mode [ 479.210652][T17365] netlink: 216 bytes leftover after parsing attributes in process `syz.4.3346'. [ 479.220886][T17365] tc_dump_action: action bad kind [ 479.234045][T17365] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3346'. [ 479.251551][T17365] netlink: 'syz.4.3346': attribute type 30 has an invalid length. [ 479.531897][T17381] netlink: 'syz.0.3351': attribute type 30 has an invalid length. [ 479.564152][ T7318] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 479.580315][ T7318] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 479.603523][ T48] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 479.621734][ T48] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 479.685548][ T809] net_ratelimit: 12 callbacks suppressed [ 479.685571][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.748275][T17389] sctp: [Deprecated]: syz.0.3354 (pid 17389) Use of int in max_burst socket option. [ 479.748275][T17389] Use struct sctp_assoc_value instead [ 479.842857][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.852697][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.879532][T17393] bond0: entered promiscuous mode [ 479.891183][T17397] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.901390][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.907391][T17393] bond_slave_0: entered promiscuous mode [ 479.916239][T17393] bond_slave_1: entered promiscuous mode [ 479.927142][T17393] batadv0: entered promiscuous mode [ 479.961226][T17396] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.963543][T17394] IPVS: Scheduler module ip_vs_sip not found [ 479.969032][T17396] bridge0: port 1(bridge_slave_0) entered disabled state [ 479.993714][T17399] xt_hashlimit: size too large, truncated to 1048576 [ 480.081977][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 480.126239][T17403] xt_hashlimit: size too large, truncated to 1048576 [ 480.322640][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 480.419603][T17412] netlink: 'syz.2.3360': attribute type 30 has an invalid length. [ 480.487491][T17406] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 480.566695][T17406] bond1 (unregistering): Released all slaves [ 480.647129][T17420] tipc: Enabled bearer , priority 0 [ 480.672137][T17421] syzkaller0: entered promiscuous mode [ 480.698567][T17421] syzkaller0: entered allmulticast mode [ 480.773624][T17415] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 480.833452][T17427] openvswitch: netlink: Tunnel attr 3 has unexpected len 0 expected 1 [ 480.884091][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 480.925029][T17417] tipc: Resetting bearer [ 480.935962][T17434] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.048590][T17438] xt_socket: unknown flags 0x4 [ 481.185215][T17414] tipc: Resetting bearer [ 481.238174][T17414] tipc: Disabling bearer [ 481.377675][T17451] xt_hashlimit: size too large, truncated to 1048576 [ 481.443646][T17456] sctp: [Deprecated]: syz.3.3373 (pid 17456) Use of int in max_burst socket option. [ 481.443646][T17456] Use struct sctp_assoc_value instead [ 481.608256][T17459] __nla_validate_parse: 10 callbacks suppressed [ 481.608281][T17459] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3373'. [ 481.637204][T17459] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.645028][T17459] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.941391][T17476] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3381'. [ 482.012346][T17482] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3381'. [ 482.197197][T17488] tipc: Enabled bearer , priority 0 [ 482.204596][T17485] tipc: Started in network mode [ 482.218493][T17485] tipc: Node identity eec866b39c81, cluster identity 4711 [ 482.227506][T17485] tipc: Enabled bearer , priority 0 [ 482.237872][T17488] syzkaller0: entered promiscuous mode [ 482.256895][T17488] syzkaller0: entered allmulticast mode [ 482.272973][T17485] syzkaller0: entered promiscuous mode [ 482.287657][T17485] syzkaller0: entered allmulticast mode [ 482.323270][T17488] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 482.375553][T17493] xt_hashlimit: size too large, truncated to 1048576 [ 482.667873][T17485] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 482.881931][T17500] tipc: Resetting bearer [ 482.893323][T17504] tipc: Resetting bearer [ 482.911208][T17511] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3388'. [ 482.933667][T17483] tipc: Resetting bearer [ 482.948952][T17510] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3388'. [ 482.988514][T17510] netlink: 'syz.0.3388': attribute type 30 has an invalid length. [ 483.000639][T17483] tipc: Disabling bearer [ 483.043674][T17487] tipc: Resetting bearer [ 483.088763][T17487] tipc: Disabling bearer [ 483.181273][T17518] xt_socket: unknown flags 0x4 [ 483.312427][T17524] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3392'. [ 483.327083][T17524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3392'. [ 483.338620][T17524] netlink: 'syz.2.3392': attribute type 30 has an invalid length. [ 483.441094][T17528] sctp: [Deprecated]: syz.0.3396 (pid 17528) Use of int in max_burst socket option. [ 483.441094][T17528] Use struct sctp_assoc_value instead [ 483.461789][T17529] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3395'. [ 483.533875][T17533] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3395'. [ 483.596171][T17532] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3396'. [ 483.730804][T17536] xt_hashlimit: size too large, truncated to 1048576 [ 484.083749][T17545] xt_hashlimit: size too large, truncated to 1048576 [ 484.475741][T17562] netlink: 'syz.0.3405': attribute type 30 has an invalid length. [ 484.506735][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880674a3400: rx timeout, send abort [ 484.722809][T17575] xt_hashlimit: size too large, truncated to 1048576 [ 484.904924][T17581] netlink: 'syz.2.3412': attribute type 30 has an invalid length. [ 485.015755][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880674a3400: abort rx timeout. Force session deactivation [ 485.048798][ T42] net_ratelimit: 66 callbacks suppressed [ 485.048818][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.126125][T17590] xt_hashlimit: size too large, truncated to 1048576 [ 485.283463][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.293024][T17599] netlink: 'syz.2.3418': attribute type 30 has an invalid length. [ 485.638199][T17612] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 485.648160][T17612] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 485.944210][T17628] netlink: 'syz.4.3429': attribute type 30 has an invalid length. [ 486.101405][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.131019][T17632] netlink: 'syz.4.3430': attribute type 30 has an invalid length. [ 486.138181][T17624] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 486.273560][T17624] bond1 (unregistering): Released all slaves [ 486.303124][T17630] tc_dump_action: action bad kind [ 486.318655][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.332954][T17638] netlink: 'syz.3.3432': attribute type 30 has an invalid length. [ 486.416429][T17640] netlink: 'syz.1.3433': attribute type 30 has an invalid length. [ 486.761899][T17659] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.770580][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.784981][T17660] xt_hashlimit: size too large, truncated to 1048576 [ 486.903385][T17668] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.911974][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.988615][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.999152][ T7318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.346323][T17673] __nla_validate_parse: 18 callbacks suppressed [ 487.346346][T17673] netlink: 220 bytes leftover after parsing attributes in process `syz.4.3444'. [ 487.372561][T17673] tc_dump_action: action bad kind [ 487.390113][T17673] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3444'. [ 487.399370][T17673] netlink: 'syz.4.3444': attribute type 30 has an invalid length. [ 487.610360][T17683] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 487.622826][T17675] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3446'. [ 487.645789][T17683] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 487.692213][T17675] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 487.757962][T17675] bond1 (unregistering): Released all slaves [ 487.806182][T17687] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3449'. [ 487.817537][T17687] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3449'. [ 487.845552][T17687] syzkaller1: entered promiscuous mode [ 487.851830][T17687] syzkaller1: entered allmulticast mode [ 488.325334][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888029311400: rx timeout, send abort [ 488.833778][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888029311400: abort rx timeout. Force session deactivation [ 489.035554][T17715] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.090580][T17715] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.125236][T17722] xt_hashlimit: size too large, truncated to 1048576 [ 489.266243][T17715] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.294691][T17715] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.527664][T17715] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.539043][T17715] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.652711][T17730] syzkaller0: entered promiscuous mode [ 489.658278][T17730] syzkaller0: entered allmulticast mode [ 489.733886][T17715] team0: Port device macvlan2 removed [ 489.748590][T17715] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.760995][T17715] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.083896][ T5827] net_ratelimit: 14 callbacks suppressed [ 490.083919][ T5827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.249707][T17737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.258839][T17737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.267328][T17737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.277061][T17737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.413386][T17742] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.429732][T17742] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.439999][T17742] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.451857][T17742] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.482395][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.070391][T17737] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 492.093333][T17740] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 492.246765][ T1179] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.256338][ T1179] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.263967][T17758] sctp: [Deprecated]: syz.4.3470 (pid 17758) Use of int in max_burst socket option. [ 492.263967][T17758] Use struct sctp_assoc_value instead [ 492.300569][ T7323] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.309606][ T7323] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.362876][ T1009] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.374977][ T1009] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.415011][ T1009] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.425841][ T1009] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.436142][T17763] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3470'. [ 492.516876][T17767] xt_hashlimit: size too large, truncated to 1048576 [ 493.126285][T17777] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3475'. [ 493.197414][T17782] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3475'. [ 493.469556][T17791] netlink: 220 bytes leftover after parsing attributes in process `syz.1.3480'. [ 493.478819][T17791] tc_dump_action: action bad kind [ 493.490555][T17791] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3480'. [ 493.499855][T17791] netlink: 'syz.1.3480': attribute type 30 has an invalid length. [ 493.663017][T17796] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3482'. [ 493.735492][T17801] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3482'. [ 493.912329][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888030604000: rx timeout, send abort [ 493.923282][T17803] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3484'. [ 494.065921][T17811] sctp: [Deprecated]: syz.0.3487 (pid 17811) Use of int in max_burst socket option. [ 494.065921][T17811] Use struct sctp_assoc_value instead [ 494.203813][T17817] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3487'. [ 494.420833][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888030604000: abort rx timeout. Force session deactivation [ 494.971702][T17825] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3490'. [ 495.029798][T17827] tc_dump_action: action bad kind [ 495.056677][T17827] netlink: 'syz.0.3491': attribute type 30 has an invalid length. [ 495.165289][T17833] tipc: Started in network mode [ 495.180300][T17833] tipc: Node identity d2dddb262e76, cluster identity 4711 [ 495.192818][T17833] tipc: Enabled bearer , priority 0 [ 495.211443][T17833] syzkaller0: entered promiscuous mode [ 495.217142][T17833] syzkaller0: entered allmulticast mode [ 495.269190][T17836] net_ratelimit: 19 callbacks suppressed [ 495.269212][T17836] openvswitch: netlink: Flow key attr not present in new flow. [ 495.295411][T17838] tipc: Resetting bearer [ 495.416311][T17830] tipc: Resetting bearer [ 495.462316][T17830] tipc: Disabling bearer [ 495.651771][T17847] syzkaller1: entered promiscuous mode [ 495.666823][T17847] syzkaller1: entered allmulticast mode [ 495.681150][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.697061][T17850] sctp: [Deprecated]: syz.2.3501 (pid 17850) Use of int in max_burst socket option. [ 495.697061][T17850] Use struct sctp_assoc_value instead [ 495.803640][T17856] tipc: Started in network mode [ 495.809402][T17856] tipc: Node identity 6e9a76fe4b8f, cluster identity 4711 [ 495.816918][T17856] tipc: Enabled bearer , priority 0 [ 495.827352][T17852] syzkaller0: entered promiscuous mode [ 495.834162][T17852] syzkaller0: entered allmulticast mode [ 495.865117][T17852] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 495.966761][T17860] batman_adv: batadv0: Adding interface: vlan2 [ 495.976359][T17861] sctp: [Deprecated]: syz.2.3513 (pid 17861) Use of int in max_burst socket option. [ 495.976359][T17861] Use struct sctp_assoc_value instead [ 495.991417][T17860] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 496.021350][T17860] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 496.037413][T17862] netlink: 'syz.4.3503': attribute type 1 has an invalid length. [ 496.118850][T17863] tipc: Resetting bearer [ 496.171495][T17851] tipc: Resetting bearer [ 496.227256][T17851] tipc: Disabling bearer [ 496.254171][T17866] FAULT_INJECTION: forcing a failure. [ 496.254171][T17866] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 496.267552][T17866] CPU: 0 UID: 0 PID: 17866 Comm: syz.2.3504 Not tainted syzkaller #0 PREEMPT(full) [ 496.267581][T17866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 496.267595][T17866] Call Trace: [ 496.267603][T17866] [ 496.267612][T17866] dump_stack_lvl+0xe8/0x150 [ 496.267652][T17866] should_fail_ex+0x40c/0x560 [ 496.267686][T17866] _copy_from_user+0x2d/0xb0 [ 496.267708][T17866] __copy_msghdr+0x390/0x590 [ 496.267738][T17866] ___sys_sendmsg+0x213/0x360 [ 496.267762][T17866] ? __lock_acquire+0x683/0x2cf0 [ 496.267799][T17866] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.267863][T17866] ? __fget_files+0x2a/0x420 [ 496.267893][T17866] ? __fget_files+0x3a2/0x420 [ 496.267934][T17866] __x64_sys_sendmsg+0x1b1/0x290 [ 496.267964][T17866] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 496.268010][T17866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.268034][T17866] do_syscall_64+0x174/0x580 [ 496.268061][T17866] ? trace_irq_disable+0x3b/0x140 [ 496.268090][T17866] ? clear_bhb_loop+0x40/0x90 [ 496.268117][T17866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.268140][T17866] RIP: 0033:0x7fd29479de99 [ 496.268161][T17866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.268180][T17866] RSP: 002b:00007fd295581028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 496.268203][T17866] RAX: ffffffffffffffda RBX: 00007fd294a25fa0 RCX: 00007fd29479de99 [ 496.268226][T17866] RDX: 0000000004000004 RSI: 00002000000015c0 RDI: 0000000000000003 [ 496.268241][T17866] RBP: 00007fd295581090 R08: 0000000000000000 R09: 0000000000000000 [ 496.268255][T17866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.268268][T17866] R13: 00007fd294a26038 R14: 00007fd294a25fa0 R15: 00007ffe777fbcf8 [ 496.268305][T17866] [ 496.498435][T17870] tc_dump_action: action bad kind [ 496.507654][T17870] netlink: 'syz.4.3505': attribute type 30 has an invalid length. [ 496.571165][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.623708][T17876] xt_socket: unknown flags 0x4 [ 496.686773][T17874] syzkaller0: entered promiscuous mode [ 496.719031][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.728517][T17874] syzkaller0: entered allmulticast mode [ 497.009688][T17893] syzkaller1: entered promiscuous mode [ 497.015508][T17893] syzkaller1: entered allmulticast mode [ 497.168081][T17897] xt_socket: unknown flags 0x4 [ 497.387871][T17899] sctp: [Deprecated]: syz.1.3516 (pid 17899) Use of int in max_burst socket option. [ 497.387871][T17899] Use struct sctp_assoc_value instead [ 497.479622][T17899] __nla_validate_parse: 12 callbacks suppressed [ 497.479642][T17899] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3516'. [ 497.666956][T17908] netlink: 220 bytes leftover after parsing attributes in process `syz.1.3520'. [ 497.676555][T17908] tc_dump_action: action bad kind [ 497.689486][T17908] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3520'. [ 497.698670][T17908] netlink: 'syz.1.3520': attribute type 30 has an invalid length. [ 497.762489][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.897497][T17912] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3531'. [ 497.910246][T17912] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3531'. [ 497.966504][T17915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.976991][T17915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.985388][T17915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.995055][T17915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.003755][T17915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.018808][T17912] syzkaller1: entered promiscuous mode [ 498.038446][T17912] syzkaller1: entered allmulticast mode [ 498.155725][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88807c751400: rx timeout, send abort [ 498.664204][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88807c751400: abort rx timeout. Force session deactivation [ 498.883646][T17931] sctp: [Deprecated]: syz.3.3528 (pid 17931) Use of int in max_burst socket option. [ 498.883646][T17931] Use struct sctp_assoc_value instead [ 498.963394][T17931] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3528'. [ 499.034165][T17936] netlink: 140 bytes leftover after parsing attributes in process `syz.3.3529'. [ 499.053124][T17936] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3529'. [ 499.062254][T17936] netlink: 'syz.3.3529': attribute type 30 has an invalid length. [ 499.178987][T17940] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3532'. [ 499.188630][T17940] tc_dump_action: action bad kind [ 499.193830][T17939] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3530'. [ 499.208998][T17940] netlink: 'syz.3.3532': attribute type 30 has an invalid length. [ 499.427300][T17950] IPVS: length: 15 != 8 [ 499.449290][T17948] can: request_module (can-proto-0) failed. [ 499.730039][T17959] syzkaller1: entered promiscuous mode [ 499.735755][T17959] syzkaller1: entered allmulticast mode [ 499.832665][T17964] sctp: [Deprecated]: syz.1.3540 (pid 17964) Use of int in max_burst socket option. [ 499.832665][T17964] Use struct sctp_assoc_value instead [ 500.032648][T17971] tc_dump_action: action bad kind [ 500.042934][T17971] netlink: 'syz.1.3543': attribute type 30 has an invalid length. [ 500.517028][T17994] xt_socket: unknown flags 0x4 [ 500.701012][T17998] syzkaller1: entered promiscuous mode [ 500.706757][T17998] syzkaller1: entered allmulticast mode [ 500.799256][ C1] net_ratelimit: 57 callbacks suppressed [ 500.799278][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.814259][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.823802][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.833849][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.842160][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.850534][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.858797][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.867041][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.875348][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.883619][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.972318][T18003] sctp: [Deprecated]: syz.0.3553 (pid 18003) Use of int in max_burst socket option. [ 500.972318][T18003] Use struct sctp_assoc_value instead [ 501.136081][T18010] tc_dump_action: action bad kind [ 501.145566][T18010] netlink: 'syz.0.3556': attribute type 30 has an invalid length. [ 501.259919][T18008] macvtap2: entered promiscuous mode [ 501.443496][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.700142][T18026] xt_socket: unknown flags 0x4 [ 501.749541][T18020] macvtap1: entered promiscuous mode [ 501.777561][T18020] bridge0: entered promiscuous mode [ 502.132238][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888053902800: rx timeout, send abort [ 502.234661][T18043] tipc: Enabled bearer , priority 0 [ 502.250264][T18043] syzkaller0: entered promiscuous mode [ 502.256145][T18043] syzkaller0: entered allmulticast mode [ 502.346972][T18045] tipc: Resetting bearer [ 502.421838][T18042] tipc: Resetting bearer [ 502.457522][T18042] tipc: Disabling bearer [ 502.583822][T18047] xt_socket: unknown flags 0x4 [ 502.640633][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888053902800: abort rx timeout. Force session deactivation [ 502.694723][T18049] xt_hashlimit: size too large, truncated to 1048576 [ 502.787436][T18058] __nla_validate_parse: 20 callbacks suppressed [ 502.787458][T18058] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3572'. [ 502.805804][T18058] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3572'. [ 502.834899][T18058] syzkaller1: entered promiscuous mode [ 502.840977][T18058] syzkaller1: entered allmulticast mode [ 503.160328][T18063] macvtap2: entered promiscuous mode [ 503.166847][T18067] xt_hashlimit: size too large, truncated to 1048576 [ 503.505591][T18076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3578'. [ 503.738926][T18081] xt_socket: unknown flags 0x4 [ 503.989852][T18090] netlink: 216 bytes leftover after parsing attributes in process `syz.0.3584'. [ 504.009212][T18090] tc_dump_action: action bad kind [ 504.030398][T18090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3584'. [ 504.050232][T18090] netlink: 'syz.0.3584': attribute type 30 has an invalid length. [ 504.059965][T18094] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3583'. [ 504.433453][T18111] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3592'. [ 504.457276][T18111] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3592'. [ 504.485407][T18111] syzkaller1: entered promiscuous mode [ 504.491831][T18111] syzkaller1: entered allmulticast mode [ 504.701867][T18119] xt_hashlimit: size too large, truncated to 1048576 [ 504.930324][T18124] netlink: 140 bytes leftover after parsing attributes in process `syz.3.3596'. [ 504.951981][T18124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3596'. [ 504.961818][T18124] netlink: 'syz.3.3596': attribute type 30 has an invalid length. [ 505.027354][T18127] netlink: 'syz.2.3597': attribute type 3 has an invalid length. [ 505.096491][T18130] FAULT_INJECTION: forcing a failure. [ 505.096491][T18130] name failslab, interval 1, probability 0, space 0, times 0 [ 505.110067][T18130] CPU: 0 UID: 0 PID: 18130 Comm: syz.2.3597 Not tainted syzkaller #0 PREEMPT(full) [ 505.110097][T18130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 505.110111][T18130] Call Trace: [ 505.110119][T18130] [ 505.110128][T18130] dump_stack_lvl+0xe8/0x150 [ 505.110168][T18130] should_fail_ex+0x40c/0x560 [ 505.110202][T18130] should_failslab+0xa8/0x100 [ 505.110238][T18130] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 505.110267][T18130] ? local_lock_release+0x9c/0x160 [ 505.110291][T18130] ? __alloc_skb+0x1d7/0x7a0 [ 505.110311][T18130] ? __alloc_skb+0x1d7/0x7a0 [ 505.110340][T18130] __alloc_skb+0x1d7/0x7a0 [ 505.110367][T18130] netlink_sendmsg+0x5d4/0xb40 [ 505.110407][T18130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 505.110438][T18130] ? aa_sock_msg_perm+0xf1/0x1b0 [ 505.110470][T18130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 505.110496][T18130] sock_sendmsg_nosec+0x13a/0x180 [ 505.110531][T18130] ____sys_sendmsg+0x54e/0x850 [ 505.110563][T18130] ? __pfx_____sys_sendmsg+0x10/0x10 [ 505.110599][T18130] ? import_iovec+0x73/0xa0 [ 505.110637][T18130] ___sys_sendmsg+0x2a5/0x360 [ 505.110662][T18130] ? __lock_acquire+0x683/0x2cf0 [ 505.110699][T18130] ? __pfx____sys_sendmsg+0x10/0x10 [ 505.110772][T18130] ? __fget_files+0x2a/0x420 [ 505.110806][T18130] ? __fget_files+0x3a2/0x420 [ 505.110848][T18130] __x64_sys_sendmsg+0x1b1/0x290 [ 505.110878][T18130] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 505.110923][T18130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.110949][T18130] do_syscall_64+0x174/0x580 [ 505.110977][T18130] ? trace_irq_disable+0x3b/0x140 [ 505.111006][T18130] ? clear_bhb_loop+0x40/0x90 [ 505.111034][T18130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.111057][T18130] RIP: 0033:0x7fd29479de99 [ 505.111077][T18130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 505.111097][T18130] RSP: 002b:00007fd2929d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 505.111122][T18130] RAX: ffffffffffffffda RBX: 00007fd294a26180 RCX: 00007fd29479de99 [ 505.111137][T18130] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 0000000000000008 [ 505.111152][T18130] RBP: 00007fd2929d5090 R08: 0000000000000000 R09: 0000000000000000 [ 505.111166][T18130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 505.111179][T18130] R13: 00007fd294a26218 R14: 00007fd294a26180 R15: 00007ffe777fbcf8 [ 505.111213][T18130] [ 505.515344][T18136] xt_socket: unknown flags 0x4 [ 505.654879][T18145] tipc: Enabling of bearer rejected, failed to enable media [ 505.727209][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880674de800: rx timeout, send abort [ 505.822010][T18151] xt_hashlimit: size too large, truncated to 1048576 [ 506.078802][ T42] net_ratelimit: 88 callbacks suppressed [ 506.078819][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.235657][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880674de800: abort rx timeout. Force session deactivation [ 506.249567][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.381697][T18164] netlink: 'syz.3.3608': attribute type 30 has an invalid length. [ 506.399444][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.568075][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.849396][T18177] openvswitch: netlink: IPv4 tunnel dst address is zero [ 507.035136][T18173] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 507.119995][T18173] bond1 (unregistering): Released all slaves [ 507.127391][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.201467][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.211596][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.220996][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.267067][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.323356][T18184] FAULT_INJECTION: forcing a failure. [ 507.323356][T18184] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 507.350736][T18184] CPU: 1 UID: 0 PID: 18184 Comm: syz.0.3615 Not tainted syzkaller #0 PREEMPT(full) [ 507.350767][T18184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 507.350781][T18184] Call Trace: [ 507.350790][T18184] [ 507.350799][T18184] dump_stack_lvl+0xe8/0x150 [ 507.350838][T18184] should_fail_ex+0x40c/0x560 [ 507.350872][T18184] _copy_from_user+0x2d/0xb0 [ 507.350902][T18184] __sys_bpf+0x2e7/0xd90 [ 507.350947][T18184] ? __pfx___sys_bpf+0x10/0x10 [ 507.350989][T18184] ? __fget_files+0x2a/0x420 [ 507.351039][T18184] ? ksys_write+0x242/0x270 [ 507.351064][T18184] ? __pfx_ksys_write+0x10/0x10 [ 507.351093][T18184] __x64_sys_bpf+0xba/0xd0 [ 507.351120][T18184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.351146][T18184] do_syscall_64+0x174/0x580 [ 507.351173][T18184] ? trace_irq_disable+0x3b/0x140 [ 507.351202][T18184] ? clear_bhb_loop+0x40/0x90 [ 507.351230][T18184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.351253][T18184] RIP: 0033:0x7fd04ad9de99 [ 507.351274][T18184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.351294][T18184] RSP: 002b:00007fd04bbd7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 507.351318][T18184] RAX: ffffffffffffffda RBX: 00007fd04b025fa0 RCX: 00007fd04ad9de99 [ 507.351334][T18184] RDX: 0000000000000020 RSI: 00002000000001c0 RDI: 0000000000000004 [ 507.351349][T18184] RBP: 00007fd04bbd7090 R08: 0000000000000000 R09: 0000000000000000 [ 507.351363][T18184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 507.351376][T18184] R13: 00007fd04b026038 R14: 00007fd04b025fa0 R15: 00007fff3a196d48 [ 507.351420][T18184] [ 507.528934][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88801eed9c00: rx timeout, send abort [ 507.588287][T18187] FAULT_INJECTION: forcing a failure. [ 507.588287][T18187] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 507.604518][T18187] CPU: 0 UID: 0 PID: 18187 Comm: syz.2.3616 Not tainted syzkaller #0 PREEMPT(full) [ 507.604550][T18187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 507.604564][T18187] Call Trace: [ 507.604573][T18187] [ 507.604582][T18187] dump_stack_lvl+0xe8/0x150 [ 507.604620][T18187] should_fail_ex+0x40c/0x560 [ 507.604652][T18187] _copy_from_user+0x2d/0xb0 [ 507.604675][T18187] ___sys_recvmsg+0x173/0x5a0 [ 507.604710][T18187] ? __pfx____sys_recvmsg+0x10/0x10 [ 507.604741][T18187] ? __fget_files+0x2a/0x420 [ 507.604800][T18187] do_recvmmsg+0x31a/0x7f0 [ 507.604837][T18187] ? __pfx_do_recvmmsg+0x10/0x10 [ 507.604875][T18187] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 507.604907][T18187] ? __fget_files+0x3a2/0x420 [ 507.604947][T18187] __x64_sys_recvmmsg+0x198/0x250 [ 507.604978][T18187] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 507.605012][T18187] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.605036][T18187] do_syscall_64+0x174/0x580 [ 507.605071][T18187] ? trace_irq_disable+0x3b/0x140 [ 507.605101][T18187] ? clear_bhb_loop+0x40/0x90 [ 507.605127][T18187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.605149][T18187] RIP: 0033:0x7fd29479de99 [ 507.605170][T18187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.605190][T18187] RSP: 002b:00007fd295581028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 507.605211][T18187] RAX: ffffffffffffffda RBX: 00007fd294a25fa0 RCX: 00007fd29479de99 [ 507.605227][T18187] RDX: 000000000000074e RSI: 0000200000001140 RDI: 0000000000000005 [ 507.605240][T18187] RBP: 00007fd295581090 R08: 0000000000000000 R09: 0000000000000000 [ 507.605253][T18187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 507.605266][T18187] R13: 00007fd294a26038 R14: 00007fd294a25fa0 R15: 00007ffe777fbcf8 [ 507.605300][T18187] [ 507.893276][T18196] __nla_validate_parse: 8 callbacks suppressed [ 507.893296][T18196] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3620'. [ 507.896207][T18198] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3618'. [ 507.923498][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3620'. [ 507.932636][T18196] netlink: 'syz.2.3620': attribute type 30 has an invalid length. [ 507.941595][T18194] x_tables: duplicate underflow at hook 2 [ 508.695044][T18235] netlink: 140 bytes leftover after parsing attributes in process `syz.3.3632'. [ 508.736780][T18235] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3632'. [ 508.747623][T18235] netlink: 'syz.3.3632': attribute type 30 has an invalid length. [ 508.890981][T18244] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3636'. [ 508.904317][T18244] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3636'. [ 508.926491][T18245] netlink: 'syz.1.3635': attribute type 3 has an invalid length. [ 509.050911][T18253] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3639'. [ 509.072697][T18253] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3639'. [ 509.143809][T18253] syzkaller1: entered promiscuous mode [ 509.161891][T18253] syzkaller1: entered allmulticast mode [ 509.219657][T18255] netlink: 'syz.3.3638': attribute type 1 has an invalid length. [ 509.228508][T18255] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3638'. [ 509.778861][T18277] 8021q: adding VLAN 0 to HW filter on device bond1 [ 509.837881][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888026130800: rx timeout, send abort [ 510.133611][T18291] sctp: [Deprecated]: syz.1.3648 (pid 18291) Use of int in max_burst socket option. [ 510.133611][T18291] Use struct sctp_assoc_value instead [ 510.226176][T18293] syzkaller0: entered promiscuous mode [ 510.231964][T18293] syzkaller0: entered allmulticast mode [ 510.346883][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888026130800: abort rx timeout. Force session deactivation [ 510.731960][T18312] FAULT_INJECTION: forcing a failure. [ 510.731960][T18312] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.788690][T18312] CPU: 1 UID: 0 PID: 18312 Comm: syz.2.3653 Not tainted syzkaller #0 PREEMPT(full) [ 510.788720][T18312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 510.788734][T18312] Call Trace: [ 510.788743][T18312] [ 510.788753][T18312] dump_stack_lvl+0xe8/0x150 [ 510.788793][T18312] should_fail_ex+0x40c/0x560 [ 510.788826][T18312] _copy_from_user+0x2d/0xb0 [ 510.788849][T18312] do_sock_getsockopt+0x200/0x7e0 [ 510.788882][T18312] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 510.788925][T18312] ? __fget_files+0x3a2/0x420 [ 510.788955][T18312] ? __fget_files+0x2a/0x420 [ 510.788993][T18312] __x64_sys_getsockopt+0x1a4/0x240 [ 510.789027][T18312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.789052][T18312] do_syscall_64+0x174/0x580 [ 510.789080][T18312] ? trace_irq_disable+0x3b/0x140 [ 510.789109][T18312] ? clear_bhb_loop+0x40/0x90 [ 510.789138][T18312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.789160][T18312] RIP: 0033:0x7fd29479de99 [ 510.789180][T18312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.789214][T18312] RSP: 002b:00007fd2929f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 510.789238][T18312] RAX: ffffffffffffffda RBX: 00007fd294a26090 RCX: 00007fd29479de99 [ 510.789254][T18312] RDX: 0000000000000016 RSI: 0000000000000084 RDI: 0000000000000003 [ 510.789266][T18312] RBP: 00007fd2929f6090 R08: 00002000000001c0 R09: 0000000000000000 [ 510.789281][T18312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.789294][T18312] R13: 00007fd294a26128 R14: 00007fd294a26090 R15: 00007ffe777fbcf8 [ 510.789330][T18312] [ 511.278775][ T42] net_ratelimit: 13 callbacks suppressed [ 511.278796][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.320568][T18321] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 511.371799][T18321] bond1 (unregistering): Released all slaves [ 511.595875][T18327] xt_socket: unknown flags 0x4 [ 511.679478][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.733849][T18329] syzkaller0: entered promiscuous mode [ 511.744748][T18332] RDS: rds_bind could not find a transport for ::ffff:100.1.1.2, load rds_tcp or rds_rdma? [ 511.755851][T18329] syzkaller0: entered allmulticast mode [ 511.762801][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.771473][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.144770][T18341] netlink: 'syz.2.3665': attribute type 30 has an invalid length. [ 512.216226][T18346] sctp: [Deprecated]: syz.3.3666 (pid 18346) Use of int in max_burst socket option. [ 512.216226][T18346] Use struct sctp_assoc_value instead [ 512.233799][T18346] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.319038][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.321188][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.339137][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.639631][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.799542][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.620268][T18380] __nla_validate_parse: 9 callbacks suppressed [ 513.620285][T18380] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3677'. [ 513.648572][T18380] netlink: 'syz.4.3677': attribute type 30 has an invalid length. [ 513.804509][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888012264400: rx timeout, send abort [ 513.911332][T18387] xt_socket: unknown flags 0x4 [ 513.927093][T18389] macvlan2: entered promiscuous mode [ 513.933378][T18389] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 513.945533][T18389] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 513.958115][T18389] team0: Port device macvlan2 added [ 514.077180][T18390] Cannot find set identified by id 0 to match [ 514.311222][T18400] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3684'. [ 514.312964][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888012264400: abort rx timeout. Force session deactivation [ 514.364623][T18402] sctp: [Deprecated]: syz.3.3685 (pid 18402) Use of int in max_burst socket option. [ 514.364623][T18402] Use struct sctp_assoc_value instead [ 514.492846][T18403] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3685'. [ 514.842582][T18405] tipc: Enabled bearer , priority 0 [ 514.850355][T18405] syzkaller0: entered promiscuous mode [ 514.855911][T18405] syzkaller0: entered allmulticast mode [ 514.866726][T18405] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 515.030542][T18411] tipc: Resetting bearer [ 515.045941][T18404] tipc: Resetting bearer [ 515.068115][T18404] tipc: Disabling bearer [ 515.182571][T18416] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3690'. [ 515.192084][T18416] netlink: 'syz.1.3690': attribute type 30 has an invalid length. [ 515.499659][T18433] FAULT_INJECTION: forcing a failure. [ 515.499659][T18433] name failslab, interval 1, probability 0, space 0, times 0 [ 515.522259][T18433] CPU: 1 UID: 0 PID: 18433 Comm: syz.3.3695 Not tainted syzkaller #0 PREEMPT(full) [ 515.522290][T18433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 515.522312][T18433] Call Trace: [ 515.522320][T18433] [ 515.522330][T18433] dump_stack_lvl+0xe8/0x150 [ 515.522370][T18433] should_fail_ex+0x40c/0x560 [ 515.522404][T18433] should_failslab+0xa8/0x100 [ 515.522440][T18433] __kmalloc_noprof+0xfe/0x720 [ 515.522471][T18433] ? sock_kmalloc+0xd6/0x160 [ 515.522497][T18433] ? sock_kmalloc+0xd6/0x160 [ 515.522530][T18433] sock_kmalloc+0xd6/0x160 [ 515.522561][T18433] hash_recvmsg+0x1d0/0x860 [ 515.522596][T18433] ? __pfx_hash_recvmsg+0x10/0x10 [ 515.522627][T18433] sock_recvmsg_nosec+0x130/0x170 [ 515.522662][T18433] ____sys_recvmsg+0x3e3/0x4a0 [ 515.522700][T18433] ? __pfx_____sys_recvmsg+0x10/0x10 [ 515.522748][T18433] ? import_iovec+0x73/0xa0 [ 515.522787][T18433] ___sys_recvmsg+0x213/0x5a0 [ 515.522820][T18433] ? __pfx____sys_recvmsg+0x10/0x10 [ 515.522852][T18433] ? __fget_files+0x2a/0x420 [ 515.522916][T18433] do_recvmmsg+0x31a/0x7f0 [ 515.522954][T18433] ? __pfx_do_recvmmsg+0x10/0x10 [ 515.522994][T18433] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 515.523025][T18433] ? __fget_files+0x3a2/0x420 [ 515.523067][T18433] __x64_sys_recvmmsg+0x198/0x250 [ 515.523099][T18433] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 515.523137][T18433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.523162][T18433] do_syscall_64+0x174/0x580 [ 515.523189][T18433] ? trace_irq_disable+0x3b/0x140 [ 515.523218][T18433] ? clear_bhb_loop+0x40/0x90 [ 515.523246][T18433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.523268][T18433] RIP: 0033:0x7f1a7779de99 [ 515.523289][T18433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 515.523316][T18433] RSP: 002b:00007f1a785e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 515.523340][T18433] RAX: ffffffffffffffda RBX: 00007f1a77a26090 RCX: 00007f1a7779de99 [ 515.523355][T18433] RDX: 0000000000003aa0 RSI: 00002000000047c0 RDI: 0000000000000006 [ 515.523369][T18433] RBP: 00007f1a785e5090 R08: 0000000000000000 R09: 0000000000000000 [ 515.523382][T18433] R10: 0000000060002000 R11: 0000000000000246 R12: 0000000000000002 [ 515.523395][T18433] R13: 00007f1a77a26128 R14: 00007f1a77a26090 R15: 00007ffcdfd986b8 [ 515.523430][T18433] [ 515.596748][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888012264000: rx timeout, send abort [ 515.793766][T18436] xt_hashlimit: size too large, truncated to 1048576 [ 516.139840][T18451] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3702'. [ 516.182376][T18453] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3700'. [ 516.199952][T18451] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3702'. [ 516.229799][T18456] xt_hashlimit: size too large, truncated to 1048576 [ 516.390304][T18464] syzkaller1: entered promiscuous mode [ 516.405831][T18464] syzkaller1: entered allmulticast mode [ 516.482517][ T55] net_ratelimit: 20 callbacks suppressed [ 516.482540][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.750497][T18474] syzkaller0: entered promiscuous mode [ 516.756288][T18474] syzkaller0: entered allmulticast mode [ 516.801559][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.959683][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.055749][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.069910][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.092769][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.105298][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.115271][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.128109][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.150013][T18478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.181002][T18479] xt_socket: unknown flags 0x4 [ 517.327220][T18487] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 517.337789][T18487] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 517.747194][T18497] xt_hashlimit: size too large, truncated to 1048576 [ 518.222984][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88804de2d400: rx timeout, send abort [ 518.247962][T18512] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3721'. [ 518.259219][T18512] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3721'. [ 518.289862][T18512] syzkaller1: entered promiscuous mode [ 518.297660][T18512] syzkaller1: entered allmulticast mode [ 518.440994][T18519] xt_hashlimit: size too large, truncated to 1048576 [ 518.509581][T18523] syzkaller0: entered promiscuous mode [ 518.528950][T18523] syzkaller0: entered allmulticast mode [ 518.739737][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88804de2d400: abort rx timeout. Force session deactivation [ 518.835791][T18525] macvtap1: entered promiscuous mode [ 518.842677][T18529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3726'. [ 518.847509][T18525] bridge0: entered promiscuous mode [ 518.962547][ T7318] IPVS: starting estimator thread 0... [ 519.068515][T18532] IPVS: using max 27 ests per chain, 64800 per kthread [ 519.091552][T18534] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3729'. [ 519.129453][T18534] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3729'. [ 519.169996][T18538] tipc: Enabled bearer , priority 0 [ 519.178190][T18538] syzkaller0: entered promiscuous mode [ 519.183974][T18538] syzkaller0: entered allmulticast mode [ 519.194223][T18538] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 519.240421][T18534] syzkaller1: entered promiscuous mode [ 519.247947][T18534] syzkaller1: entered allmulticast mode [ 519.300190][T18545] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 519.310104][T18545] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 519.397920][T18546] tipc: Resetting bearer [ 519.515710][T18537] tipc: Resetting bearer [ 519.559517][T18537] tipc: Disabling bearer [ 519.683771][T18550] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3734'. [ 519.697912][T18550] netlink: 'syz.3.3734': attribute type 30 has an invalid length. [ 519.845280][T18557] xt_hashlimit: size too large, truncated to 1048576 [ 520.179579][T18568] tipc: Enabled bearer , priority 0 [ 520.199412][T18568] syzkaller0: entered promiscuous mode [ 520.212462][T18568] syzkaller0: entered allmulticast mode [ 520.235127][T18561] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3738'. [ 520.271560][T18565] macvtap3: entered promiscuous mode [ 520.302191][T18574] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3741'. [ 520.763460][T18595] x_tables: duplicate underflow at hook 3 [ 520.786689][T18568] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 520.893865][T18582] tipc: Resetting bearer [ 520.999511][T18567] tipc: Resetting bearer [ 521.023867][T18567] tipc: Disabling bearer [ 521.105342][T18601] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 521.132463][T18601] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3747'. [ 521.221944][T18607] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3747'. [ 521.300255][T18601] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 521.316741][T18614] xt_socket: unknown flags 0x4 [ 521.326882][T18601] bond1 (unregistering): Released all slaves [ 521.386615][T18618] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3749'. [ 521.417739][T18620] xt_socket: unknown flags 0x4 [ 521.427836][T18611] bridge3: entered promiscuous mode [ 521.433565][T18620] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3753'. [ 521.460843][T18613] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 521.493184][T18616] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 521.680350][ T24] net_ratelimit: 73 callbacks suppressed [ 521.680373][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.766124][T18623] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 521.795235][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805429e400: rx timeout, send abort [ 521.841375][T18623] bond1 (unregistering): Released all slaves [ 522.097645][T18637] netlink: 'syz.4.3757': attribute type 32 has an invalid length. [ 522.138575][T18637] bond1: Setting coupled_control to off (0) [ 522.177695][T18637] ip6t_srh: unknown srh invflags BA61 [ 522.280090][T18646] sctp: [Deprecated]: syz.3.3758 (pid 18646) Use of int in max_burst socket option. [ 522.280090][T18646] Use struct sctp_assoc_value instead [ 522.303798][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805429e400: abort rx timeout. Force session deactivation [ 522.337663][T18645] tipc: Enabled bearer , priority 0 [ 522.362746][T18645] syzkaller0: entered promiscuous mode [ 522.380676][T18645] syzkaller0: entered allmulticast mode [ 522.411990][T18645] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 522.413411][T18650] xt_hashlimit: size too large, truncated to 1048576 [ 522.638161][T18656] tipc: Resetting bearer [ 522.659169][T18644] tipc: Resetting bearer [ 522.708077][T18644] tipc: Disabling bearer [ 522.722075][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.741060][T18659] tipc: Enabled bearer , priority 0 [ 522.749382][T18659] syzkaller0: entered promiscuous mode [ 522.755067][T18659] syzkaller0: entered allmulticast mode [ 522.769988][T18659] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 522.898877][T18667] tipc: Resetting bearer [ 523.023244][T18672] xt_hashlimit: size too large, truncated to 1048576 [ 523.062066][T18657] tipc: Resetting bearer [ 523.092824][T18657] tipc: Disabling bearer [ 523.336642][T18680] xt_socket: unknown flags 0x4 [ 523.758708][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.857408][T18704] sctp: [Deprecated]: syz.0.3777 (pid 18704) Use of int in max_burst socket option. [ 523.857408][T18704] Use struct sctp_assoc_value instead [ 523.922251][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.994447][T18707] __nla_validate_parse: 6 callbacks suppressed [ 523.994464][T18707] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3777'. [ 524.249155][T18721] syzkaller0: entered promiscuous mode [ 524.254956][T18721] syzkaller0: entered allmulticast mode [ 524.796116][T18738] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3789'. [ 524.800485][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.825053][T18739] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3791'. [ 524.916839][T18743] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3792'. [ 524.982755][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888055452400: rx timeout, send abort [ 525.146304][T18753] xt_hashlimit: size too large, truncated to 1048576 [ 525.350856][T18761] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3797'. [ 525.373618][T18761] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3797'. [ 525.386262][T18761] netlink: 'syz.0.3797': attribute type 18 has an invalid length. [ 525.402879][T18764] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3797'. [ 525.420590][ T1009] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 26469 - 0 [ 525.420794][T18764] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3797'. [ 525.441174][ T1009] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 26469 - 0 [ 525.448238][T18764] netlink: 'syz.0.3797': attribute type 18 has an invalid length. [ 525.464773][ T1009] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 26469 - 0 [ 525.482388][ T1009] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 26469 - 0 [ 525.491441][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888055452400: abort rx timeout. Force session deactivation [ 525.618786][T18768] sctp: [Deprecated]: syz.1.3800 (pid 18768) Use of int in max_burst socket option. [ 525.618786][T18768] Use struct sctp_assoc_value instead [ 525.639174][T18770] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3801'. [ 525.665436][T18770] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x1 [ 525.700690][T18772] syzkaller0: entered promiscuous mode [ 525.709908][T18770] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3801'. [ 525.713553][T18772] syzkaller0: entered allmulticast mode [ 525.826008][T18766] macvtap3: entered promiscuous mode [ 525.843701][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.887617][T18780] netlink: 'syz.3.3803': attribute type 30 has an invalid length. [ 526.490592][T18803] xt_hashlimit: size too large, truncated to 1048576 [ 526.538812][T18797] nbd0: detected capacity change from 0 to 127 [ 526.614064][ T4937] block nbd0: Receive control failed (result -104) [ 526.879486][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.958773][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.246958][T18826] syzkaller0: entered promiscuous mode [ 527.262155][T18826] syzkaller0: entered allmulticast mode [ 527.572611][T18838] openvswitch: netlink: IPv4 tunnel dst address is zero [ 527.679279][ T5827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.766765][T18845] bridge4: entered promiscuous mode [ 527.772311][T18845] bridge4: entered allmulticast mode [ 527.783850][T18845] team0: Port device bridge4 added [ 527.792850][T18845] bridge0: port 3(team0) entered blocking state [ 527.799854][T18845] bridge0: port 3(team0) entered disabled state [ 527.807789][T18845] team0: entered allmulticast mode [ 527.814459][T18845] team_slave_0: entered allmulticast mode [ 527.823525][T18845] team_slave_1: entered allmulticast mode [ 527.837770][T18845] team0: entered promiscuous mode [ 527.844607][T18845] team_slave_0: entered promiscuous mode [ 527.851622][T18845] team_slave_1: entered promiscuous mode [ 527.918771][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.976532][T18852] syzkaller1: entered promiscuous mode [ 527.984825][T18852] syzkaller1: entered allmulticast mode [ 528.021938][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888034b86c00: rx timeout, send abort [ 528.393674][T18868] FAULT_INJECTION: forcing a failure. [ 528.393674][T18868] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 528.415442][T18868] CPU: 0 UID: 0 PID: 18868 Comm: syz.2.3832 Not tainted syzkaller #0 PREEMPT(full) [ 528.415475][T18868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 528.415489][T18868] Call Trace: [ 528.415498][T18868] [ 528.415508][T18868] dump_stack_lvl+0xe8/0x150 [ 528.415547][T18868] should_fail_ex+0x40c/0x560 [ 528.415581][T18868] _copy_from_user+0x2d/0xb0 [ 528.415604][T18868] ___sys_sendmsg+0x1c6/0x360 [ 528.415630][T18868] ? __lock_acquire+0x683/0x2cf0 [ 528.415666][T18868] ? __pfx____sys_sendmsg+0x10/0x10 [ 528.415730][T18868] ? __fget_files+0x2a/0x420 [ 528.415760][T18868] ? __fget_files+0x3a2/0x420 [ 528.415800][T18868] __x64_sys_sendmsg+0x1b1/0x290 [ 528.415830][T18868] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 528.415876][T18868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.415901][T18868] do_syscall_64+0x174/0x580 [ 528.415928][T18868] ? trace_irq_disable+0x3b/0x140 [ 528.415958][T18868] ? clear_bhb_loop+0x40/0x90 [ 528.415988][T18868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.416011][T18868] RIP: 0033:0x7fd29479de99 [ 528.416032][T18868] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 528.416052][T18868] RSP: 002b:00007fd295581028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 528.416075][T18868] RAX: ffffffffffffffda RBX: 00007fd294a25fa0 RCX: 00007fd29479de99 [ 528.416101][T18868] RDX: 0000000000000800 RSI: 00002000000001c0 RDI: 0000000000000003 [ 528.416116][T18868] RBP: 00007fd295581090 R08: 0000000000000000 R09: 0000000000000000 [ 528.416130][T18868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 528.416144][T18868] R13: 00007fd294a26038 R14: 00007fd294a25fa0 R15: 00007ffe777fbcf8 [ 528.416179][T18868] [ 528.596340][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888034b86c00: abort rx timeout. Force session deactivation [ 528.623048][T18872] xt_socket: unknown flags 0x4 [ 528.704752][T18876] FAULT_INJECTION: forcing a failure. [ 528.704752][T18876] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 528.723023][T18876] CPU: 1 UID: 0 PID: 18876 Comm: syz.2.3835 Not tainted syzkaller #0 PREEMPT(full) [ 528.723054][T18876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 528.723069][T18876] Call Trace: [ 528.723078][T18876] [ 528.723088][T18876] dump_stack_lvl+0xe8/0x150 [ 528.723133][T18876] should_fail_ex+0x40c/0x560 [ 528.723168][T18876] prepare_alloc_pages+0x230/0x650 [ 528.723209][T18876] __alloc_frozen_pages_noprof+0x12f/0x380 [ 528.723245][T18876] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 528.723280][T18876] ? __pfx_policy_nodemask+0x10/0x10 [ 528.723316][T18876] ? __lock_acquire+0x683/0x2cf0 [ 528.723350][T18876] alloc_pages_mpol+0x212/0x380 [ 528.723386][T18876] folio_alloc_mpol_noprof+0x39/0x160 [ 528.723421][T18876] vma_alloc_folio_noprof+0xe1/0x1e0 [ 528.723457][T18876] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 528.723490][T18876] ? __pte_offset_map+0x29/0x240 [ 528.723514][T18876] ? __pte_offset_map+0x29/0x240 [ 528.723541][T18876] do_pte_missing+0x173a/0x34b0 [ 528.723590][T18876] handle_mm_fault+0x1b36/0x3080 [ 528.723631][T18876] ? handle_mm_fault+0xec/0x3080 [ 528.723674][T18876] ? __pfx_handle_mm_fault+0x10/0x10 [ 528.723697][T18876] ? lock_vma_under_rcu+0x45a/0x500 [ 528.723724][T18876] ? __fget_files+0x2a/0x420 [ 528.723783][T18876] do_user_addr_fault+0xa4d/0x1340 [ 528.723864][T18876] ? trace_page_fault_user+0x84/0x1e0 [ 528.723902][T18876] exc_page_fault+0x6a/0xc0 [ 528.723932][T18876] asm_exc_page_fault+0x26/0x30 [ 528.723954][T18876] RIP: 0033:0x7fd29465f60b [ 528.723976][T18876] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 528.723994][T18876] RSP: 002b:00007fd29557ffa0 EFLAGS: 00010206 [ 528.724014][T18876] RAX: 0000000000000000 RBX: 00007fd294a25fa0 RCX: 0000000000000000 [ 528.724029][T18876] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000200000000240 [ 528.724044][T18876] RBP: 00007fd295581090 R08: 0000000000000000 R09: 0000000000000000 [ 528.724058][T18876] R10: 0000200000000240 R11: 0000000000000000 R12: 0000000000000001 [ 528.724071][T18876] R13: 00007fd294a26038 R14: 00007fd294a25fa0 R15: 00007ffe777fbcf8 [ 528.724107][T18876] [ 528.724442][T18876] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 528.915924][T18880] openvswitch: netlink: IPv4 tunnel dst address is zero [ 528.970782][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.045105][T18881] __nla_validate_parse: 12 callbacks suppressed [ 529.045128][T18881] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3836'. [ 529.092425][T18884] syzkaller0: entered promiscuous mode [ 529.111271][T18884] syzkaller0: entered allmulticast mode [ 529.132022][T18884] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 529.580735][T18901] Bluetooth: MGMT ver 1.23 [ 529.683447][T18903] xt_socket: unknown flags 0x4 [ 529.801267][T18913] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3849'. [ 529.817277][T18913] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3849'. [ 529.921177][ T2119] block nbd0: Connection timed out, retrying (0/1 alive) [ 529.932311][ T2119] block nbd0: Connection timed out, retrying (0/1 alive) [ 529.939847][ T2119] block nbd0: Connection timed out, retrying (0/1 alive) [ 529.947928][ T2119] block nbd0: Connection timed out, retrying (0/1 alive) [ 529.961982][ T2119] block nbd0: Dead connection, failed to find a fallback [ 529.970690][ T2119] block nbd0: shutting down sockets [ 529.977708][ T2119] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 529.990151][ T2119] Buffer I/O error on dev nbd0, logical block 3, async page read [ 530.006434][ T2119] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 530.016334][ T2119] Buffer I/O error on dev nbd0, logical block 2, async page read [ 530.024213][ T5838] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.032608][ T2119] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 530.042246][ T2119] Buffer I/O error on dev nbd0, logical block 1, async page read [ 530.050308][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 530.054617][T18920] syzkaller1: entered promiscuous mode [ 530.059926][ T2119] Buffer I/O error on dev nbd0, logical block 0, async page read [ 530.066578][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.088567][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 530.098604][ T2119] Buffer I/O error on dev nbd0, logical block 0, async page read [ 530.107899][ T2119] Buffer I/O error on dev nbd0, logical block 1, async page read [ 530.115858][ T2119] Buffer I/O error on dev nbd0, logical block 2, async page read [ 530.123715][ T2119] Buffer I/O error on dev nbd0, logical block 3, async page read [ 530.135925][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 530.146388][ T2119] Buffer I/O error on dev nbd0, logical block 0, async page read [ 530.154243][ T2119] Buffer I/O error on dev nbd0, logical block 1, async page read [ 530.165288][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 530.177438][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 530.187504][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 530.197354][ T2119] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 530.207297][T15574] ldm_validate_partition_table(): Disk read failed. [ 530.219823][T15574] Dev nbd0: unable to read RDB block 0 [ 530.228162][T15574] nbd0: unable to read partition table [ 530.244428][T15574] ldm_validate_partition_table(): Disk read failed. [ 530.251499][T18920] syzkaller1: entered allmulticast mode [ 530.258659][T15574] Dev nbd0: unable to read RDB block 0 [ 530.267395][T15574] nbd0: unable to read partition table [ 530.344802][T18931] openvswitch: netlink: IPv4 tunnel dst address is zero [ 530.374457][T18931] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3853'. [ 530.482944][T18937] syzkaller0: entered promiscuous mode [ 530.510781][T18937] syzkaller0: entered allmulticast mode [ 530.543093][T18937] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 530.774097][T18951] netlink: 'syz.2.3856': attribute type 1 has an invalid length. [ 530.866661][T18951] 8021q: adding VLAN 0 to HW filter on device bond1 [ 530.895532][T18956] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3856'. [ 530.942603][T18953] bond1: (slave veth3): Enslaving as an active interface with a down link [ 531.004099][T18948] bond1: (slave veth5): Enslaving as an active interface with a down link [ 531.014579][T18955] FAULT_INJECTION: forcing a failure. [ 531.014579][T18955] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 531.045132][T18955] CPU: 1 UID: 0 PID: 18955 Comm: syz.4.3857 Not tainted syzkaller #0 PREEMPT(full) [ 531.045164][T18955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 531.045178][T18955] Call Trace: [ 531.045187][T18955] [ 531.045197][T18955] dump_stack_lvl+0xe8/0x150 [ 531.045237][T18955] should_fail_ex+0x40c/0x560 [ 531.045271][T18955] _copy_from_user+0x2d/0xb0 [ 531.045300][T18955] do_mcast_group_source+0x261/0x550 [ 531.045333][T18955] ? __pfx_do_mcast_group_source+0x10/0x10 [ 531.045372][T18955] ? do_raw_spin_lock+0x12b/0x2f0 [ 531.045411][T18955] ? __lock_acquire+0x683/0x2cf0 [ 531.045478][T18955] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 531.045509][T18955] ? do_ip_setsockopt+0x1556/0x2e30 [ 531.045537][T18955] ? __local_bh_enable_ip+0xd0/0x130 [ 531.045570][T18955] do_ip_setsockopt+0x1a25/0x2e30 [ 531.045603][T18955] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 531.045631][T18955] ? aa_sk_perm+0x6d5/0x900 [ 531.045655][T18955] ? __fget_files+0x2a/0x420 [ 531.045691][T18955] ? __pfx_aa_sk_perm+0x10/0x10 [ 531.045716][T18955] ? __fget_files+0x2a/0x420 [ 531.045744][T18955] ? aa_sock_opt_perm+0xff/0x1a0 [ 531.045772][T18955] ip_setsockopt+0x66/0x110 [ 531.045804][T18955] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 531.045841][T18955] do_sock_setsockopt+0x17c/0x1b0 [ 531.045871][T18955] __x64_sys_setsockopt+0x13d/0x1b0 [ 531.045900][T18955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.045925][T18955] do_syscall_64+0x174/0x580 [ 531.045952][T18955] ? trace_irq_disable+0x3b/0x140 [ 531.045981][T18955] ? clear_bhb_loop+0x40/0x90 [ 531.046009][T18955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.046031][T18955] RIP: 0033:0x7f0c8359de99 [ 531.046052][T18955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 531.046072][T18955] RSP: 002b:00007f0c8446c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 531.046095][T18955] RAX: ffffffffffffffda RBX: 00007f0c83825fa0 RCX: 00007f0c8359de99 [ 531.046111][T18955] RDX: 000000000000002b RSI: 0000000000000000 RDI: 0000000000000003 [ 531.046125][T18955] RBP: 00007f0c8446c090 R08: 0000000000000108 R09: 0000000000000000 [ 531.046139][T18955] R10: 00002000000004c0 R11: 0000000000000246 R12: 0000000000000001 [ 531.046153][T18955] R13: 00007f0c83826038 R14: 00007f0c83825fa0 R15: 00007ffe258646b8 [ 531.046189][T18955] [ 531.445122][T18966] xt_socket: unknown flags 0x4 [ 531.513364][T18968] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3863'. [ 531.525236][T18968] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3863'. [ 531.538381][T18968] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3863'. [ 531.547539][T18968] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3863'. [ 531.557041][T18968] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3863'. [ 531.644551][T18972] netlink: 'syz.3.3862': attribute type 30 has an invalid length. [ 532.404767][T16489] net_ratelimit: 2 callbacks suppressed [ 532.404788][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.538201][T19015] syzkaller0: entered promiscuous mode [ 532.544025][T19015] syzkaller0: entered allmulticast mode [ 532.793752][T19019] netlink: 'syz.2.3878': attribute type 30 has an invalid length. [ 532.922680][T19026] netlink: 'syz.2.3881': attribute type 83 has an invalid length. [ 533.015104][T19028] openvswitch: netlink: IPv4 tunnel dst address is zero [ 533.038962][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.283157][T19046] netlink: 'syz.3.3888': attribute type 1 has an invalid length. [ 533.296209][T19047] sctp: [Deprecated]: syz.2.3889 (pid 19047) Use of int in max_burst socket option. [ 533.296209][T19047] Use struct sctp_assoc_value instead [ 533.301925][T19046] netlink: 'syz.3.3888': attribute type 3 has an invalid length. [ 533.444683][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.564208][T19059] syzkaller0: entered promiscuous mode [ 533.569977][T19059] syzkaller0: entered allmulticast mode [ 533.585304][T19060] netlink: 'syz.4.3892': attribute type 30 has an invalid length. [ 533.586805][T19061] xt_socket: unknown flags 0x4 [ 534.485246][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.523465][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.082801][ T5827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.377315][T19094] __nla_validate_parse: 80 callbacks suppressed [ 536.377337][T19094] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3900'. [ 536.395181][T19093] openvswitch: netlink: IPv4 tunnel dst address is zero [ 536.409908][T19093] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3902'. [ 536.564571][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.683327][T19101] macvtap3: entered promiscuous mode [ 536.824574][T19108] sctp: [Deprecated]: syz.0.3905 (pid 19108) Use of int in max_burst socket option. [ 536.824574][T19108] Use struct sctp_assoc_value instead [ 536.949573][T19109] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 537.042262][T19112] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3905'. [ 537.065076][T19109] bond2 (unregistering): Released all slaves [ 537.142124][T19116] syzkaller0: entered promiscuous mode [ 537.149410][T19116] syzkaller0: entered allmulticast mode [ 537.190165][T19116] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 537.286789][ T5838] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.307891][T19118] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3908'. [ 537.327716][T19118] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3908'. [ 537.608680][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.747356][T19142] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3912'. [ 537.772659][T19142] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3912'. [ 537.782391][T19142] netlink: 'syz.2.3912': attribute type 30 has an invalid length. [ 537.860013][T19141] syzkaller0: entered promiscuous mode [ 537.865561][T19141] syzkaller0: entered allmulticast mode [ 537.883208][T19137] macvtap3: entered promiscuous mode [ 538.337357][T19152] ip6t_srh: unknown srh invflags BA61 [ 538.346101][T19153] openvswitch: netlink: IPv4 tunnel dst address is zero [ 538.643678][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.124872][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.685933][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.456720][T19169] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 540.484171][T19169] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 540.690589][T19182] sctp: [Deprecated]: syz.3.3923 (pid 19182) Use of int in max_burst socket option. [ 540.690589][T19182] Use struct sctp_assoc_value instead [ 540.728269][ T55] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.737468][T19184] netlink: 'syz.1.3922': attribute type 3 has an invalid length. [ 540.751230][T19187] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3925'. [ 540.763537][T19187] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3925'. [ 540.882707][T19193] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3923'. [ 541.611591][T19212] syzkaller0: entered promiscuous mode [ 541.627944][T19212] syzkaller0: entered allmulticast mode [ 541.669263][T19220] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3933'. [ 541.749962][T19227] openvswitch: netlink: IPv4 tunnel dst address is zero [ 541.775268][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 542.165727][ T5827] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 542.247112][T19240] xt_socket: unknown flags 0x4 [ 542.304876][T19240] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3935'. [ 542.806504][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.849140][T16489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 544.059881][T19220] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 544.324656][ T48] dvmrp0: left allmulticast mode [ 544.411522][T19254] netlink: 'syz.4.3938': attribute type 1 has an invalid length. [ 544.444929][T19254] netlink: 232 bytes leftover after parsing attributes in process `syz.4.3938'. [ 544.476076][T19254] netlink: 'syz.4.3938': attribute type 1 has an invalid length. [ 544.497133][ T4937] Bluetooth: hci5: command 0x0406 tx timeout [ 544.563399][T19259] sctp: [Deprecated]: syz.1.3942 (pid 19259) Use of int in max_burst socket option. [ 544.563399][T19259] Use struct sctp_assoc_value instead [ 544.788246][T19268] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3942'. [ 545.163420][ T48] bond0 (unregistering): Released all slaves [ 545.175427][ T48] bond1 (unregistering): Released all slaves [ 545.199537][ T48] bond2 (unregistering): Released all slaves [ 545.324143][ T48] tipc: Left network mode [ 545.336385][T19273] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3944'. [ 545.345810][T19273] netlink: 'syz.0.3944': attribute type 30 has an invalid length. [ 545.694977][ T48] IPVS: stopping master sync thread 13964 ... [ 545.733559][T19287] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3950'. [ 545.744123][T19286] openvswitch: netlink: IPv4 tunnel dst address is zero [ 545.770381][T19287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3950'. [ 545.780566][T19286] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3949'. [ 545.790419][T19287] netlink: 'syz.4.3950': attribute type 30 has an invalid length. [ 546.005917][T19297] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3952'. [ 546.043455][T19297] FAULT_INJECTION: forcing a failure. [ 546.043455][T19297] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 546.059377][T19297] CPU: 0 UID: 0 PID: 19297 Comm: syz.4.3952 Not tainted syzkaller #0 PREEMPT(full) [ 546.059407][T19297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 546.059421][T19297] Call Trace: [ 546.059431][T19297] [ 546.059439][T19297] dump_stack_lvl+0xe8/0x150 [ 546.059486][T19297] should_fail_ex+0x40c/0x560 [ 546.059516][T19297] _copy_to_user+0x31/0xb0 [ 546.059533][T19297] simple_read_from_buffer+0xe1/0x170 [ 546.059559][T19297] proc_fail_nth_read+0x1bb/0x230 [ 546.059585][T19297] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 546.059610][T19297] ? rw_verify_area+0x24a/0x4c0 [ 546.059636][T19297] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 546.059658][T19297] vfs_read+0x213/0xa80 [ 546.059672][T19297] ? __pfx___sys_bpf+0x10/0x10 [ 546.059699][T19297] ? __pfx_vfs_read+0x10/0x10 [ 546.059731][T19297] ksys_read+0x150/0x270 [ 546.059748][T19297] ? __pfx_ksys_read+0x10/0x10 [ 546.059769][T19297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.059787][T19297] do_syscall_64+0x174/0x580 [ 546.059808][T19297] ? trace_irq_disable+0x3b/0x140 [ 546.059829][T19297] ? clear_bhb_loop+0x40/0x90 [ 546.059848][T19297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.059863][T19297] RIP: 0033:0x7f0c8355e6ce [ 546.059879][T19297] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 546.059893][T19297] RSP: 002b:00007f0c8446bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 546.059909][T19297] RAX: ffffffffffffffda RBX: 00007f0c8446c6c0 RCX: 00007f0c8355e6ce [ 546.059921][T19297] RDX: 000000000000000f RSI: 00007f0c8446c0a0 RDI: 0000000000000008 [ 546.059931][T19297] RBP: 00007f0c8446c090 R08: 0000000000000000 R09: 0000000000000000 [ 546.059940][T19297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.059949][T19297] R13: 00007f0c83826038 R14: 00007f0c83825fa0 R15: 00007ffe258646b8 [ 546.059975][T19297] [ 546.309836][ T48] hsr_slave_0: left promiscuous mode [ 546.326458][ T48] hsr_slave_1: left promiscuous mode [ 546.346746][ T48] veth1_macvtap: left promiscuous mode [ 546.356521][ T48] veth0_macvtap: left promiscuous mode [ 546.380741][ T48] veth1_vlan: left promiscuous mode [ 546.398464][ T48] veth0_vlan: left promiscuous mode [ 546.591170][T19307] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3954'. [ 546.634967][T19307] netlink: 'syz.2.3954': attribute type 30 has an invalid length. [ 546.696936][T19312] sctp: [Deprecated]: syz.1.3957 (pid 19312) Use of int in max_burst socket option. [ 546.696936][T19312] Use struct sctp_assoc_value instead [ 546.917097][T19325] xt_socket: unknown flags 0x4 [ 546.964973][T19329] __nla_validate_parse: 2 callbacks suppressed [ 546.965003][T19329] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3957'. [ 546.986048][T19330] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3960'. [ 547.332780][T19302] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3954'. [ 547.368968][T19315] syzkaller1: entered promiscuous mode [ 547.398907][T19315] syzkaller1: entered allmulticast mode [ 547.600044][T19335] FAULT_INJECTION: forcing a failure. [ 547.600044][T19335] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 547.658232][T19335] CPU: 0 UID: 0 PID: 19335 Comm: syz.2.3962 Not tainted syzkaller #0 PREEMPT(full) [ 547.658268][T19335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 547.658284][T19335] Call Trace: [ 547.658293][T19335] [ 547.658302][T19335] dump_stack_lvl+0xe8/0x150 [ 547.658338][T19335] should_fail_ex+0x40c/0x560 [ 547.658369][T19335] prepare_alloc_pages+0x230/0x650 [ 547.658405][T19335] __alloc_frozen_pages_noprof+0x12f/0x380 [ 547.658439][T19335] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 547.658473][T19335] ? __pfx_policy_nodemask+0x10/0x10 [ 547.658518][T19335] alloc_pages_mpol+0x212/0x380 [ 547.658554][T19335] alloc_pages_noprof+0xac/0x2a0 [ 547.658588][T19335] anon_pipe_write+0x1f0/0x1c30 [ 547.658614][T19335] ? kstrtoull+0x12f/0x1d0 [ 547.658648][T19335] ? get_pid_task+0x20/0x1f0 [ 547.658710][T19335] ? get_pid_task+0x20/0x1f0 [ 547.658750][T19335] ? __pfx_anon_pipe_write+0x10/0x10 [ 547.658783][T19335] ? apparmor_file_permission+0x1f4/0x300 [ 547.658816][T19335] ? bpf_lsm_file_permission+0x9/0x20 [ 547.658841][T19335] ? security_file_permission+0x75/0x260 [ 547.658879][T19335] vfs_write+0x612/0xba0 [ 547.658907][T19335] ? __pfx_vfs_write+0x10/0x10 [ 547.658936][T19335] ? __fget_files+0x2a/0x420 [ 547.658973][T19335] ksys_write+0x150/0x270 [ 547.658995][T19335] ? __pfx_ksys_write+0x10/0x10 [ 547.659023][T19335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.659046][T19335] do_syscall_64+0x174/0x580 [ 547.659071][T19335] ? trace_irq_disable+0x3b/0x140 [ 547.659097][T19335] ? clear_bhb_loop+0x40/0x90 [ 547.659121][T19335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.659141][T19335] RIP: 0033:0x7fd29479de99 [ 547.659161][T19335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.659179][T19335] RSP: 002b:00007fd2929f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 547.659200][T19335] RAX: ffffffffffffffda RBX: 00007fd294a26090 RCX: 00007fd29479de99 [ 547.659214][T19335] RDX: 00000000ffffff98 RSI: 0000200000000000 RDI: 0000000000000005 [ 547.659227][T19335] RBP: 00007fd2929f6090 R08: 0000000000000000 R09: 0000000000000000 [ 547.659240][T19335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.659253][T19335] R13: 00007fd294a26128 R14: 00007fd294a26090 R15: 00007ffe777fbcf8 [ 547.659285][T19335] [ 548.069376][T19353] openvswitch: netlink: IPv4 tunnel dst address is zero [ 548.322057][T19363] xt_hashlimit: size too large, truncated to 1048576 [ 548.604841][T19378] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3970'. [ 548.637837][T19378] netlink: 'syz.1.3970': attribute type 30 has an invalid length. [ 549.275114][T19402] sctp: [Deprecated]: syz.2.3973 (pid 19402) Use of int in max_burst socket option. [ 549.275114][T19402] Use struct sctp_assoc_value instead [ 549.307332][T19345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 549.349716][T19345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 549.482386][T19404] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3973'. [ 550.177750][T19356] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3965'. [ 550.200713][T19376] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3970'. [ 550.209951][ T48] IPVS: stop unused estimator thread 0... [ 550.283805][ T59] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.318236][ T59] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.358110][ T59] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.394352][ T59] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.421497][ T59] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.434279][T19407] netlink: 'syz.3.3974': attribute type 1 has an invalid length. [ 550.446217][ T59] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.464869][ T59] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.468143][T19407] netlink: 232 bytes leftover after parsing attributes in process `syz.3.3974'. [ 550.489239][ T59] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.539158][T19407] netlink: 'syz.3.3974': attribute type 1 has an invalid length. [ 550.570221][T19416] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3978'. [ 550.581961][T19414] xt_socket: unknown flags 0x4 [ 550.648836][T19422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3976'. [ 550.694493][T19416] hsr_slave_1 (unregistering): left promiscuous mode [ 550.780550][T19425] tipc: Enabled bearer , priority 0 [ 550.819128][T19425] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 550.832071][T19427] syzkaller0: entered promiscuous mode [ 550.843506][T19427] syzkaller0: entered allmulticast mode [ 551.169983][T19433] macvtap3: entered promiscuous mode [ 551.483831][T19424] tipc: Disabling bearer [ 551.536719][T19439] macvtap2: entered promiscuous mode [ 551.631527][T19445] xt_hashlimit: size too large, truncated to 1048576 [ 551.645940][T19447] sctp: [Deprecated]: syz.4.3986 (pid 19447) Use of int in max_burst socket option. [ 551.645940][T19447] Use struct sctp_assoc_value instead [ 551.880906][T19443] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 551.926008][T19457] openvswitch: netlink: IPv4 tunnel dst address is zero [ 552.059126][T19443] bond2 (unregistering): Released all slaves [ 552.157418][T19472] __nla_validate_parse: 2 callbacks suppressed [ 552.157441][T19472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3989'. [ 552.199489][T19472] netlink: 'syz.1.3989': attribute type 30 has an invalid length. [ 552.227209][T19468] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3989'. [ 552.384840][T19476] netlink: 'syz.2.3990': attribute type 1 has an invalid length. [ 552.410176][T19476] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3990'. [ 552.426995][T19476] netlink: 'syz.2.3990': attribute type 1 has an invalid length. [ 552.447744][T19481] xt_socket: unknown flags 0x4 [ 552.511983][T19483] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3992'. [ 552.573396][T19485] netlink: 'syz.1.4003': attribute type 1 has an invalid length. [ 552.581671][T19485] netlink: 232 bytes leftover after parsing attributes in process `syz.1.4003'. [ 552.591394][T19485] netlink: 'syz.1.4003': attribute type 1 has an invalid length. [ 552.737817][T19492] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3995'. [ 552.998833][T19498] syzkaller0: entered promiscuous mode [ 553.004792][T19498] syzkaller0: entered allmulticast mode [ 553.124260][T19509] FAULT_INJECTION: forcing a failure. [ 553.124260][T19509] name failslab, interval 1, probability 0, space 0, times 0 [ 553.139641][T19509] CPU: 0 UID: 0 PID: 19509 Comm: syz.3.4001 Not tainted syzkaller #0 PREEMPT(full) [ 553.139672][T19509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 553.139686][T19509] Call Trace: [ 553.139695][T19509] [ 553.139704][T19509] dump_stack_lvl+0xe8/0x150 [ 553.139745][T19509] should_fail_ex+0x40c/0x560 [ 553.139779][T19509] should_failslab+0xa8/0x100 [ 553.139824][T19509] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 553.139850][T19509] ? __kmalloc_node_track_caller_noprof+0x2fd/0x730 [ 553.139880][T19509] ? _sctp_make_chunk+0x59/0x290 [ 553.139905][T19509] ? sctp_chunkify+0x5a/0x260 [ 553.139928][T19509] ? sctp_chunkify+0x5a/0x260 [ 553.139959][T19509] sctp_chunkify+0x5a/0x260 [ 553.139995][T19509] _sctp_make_chunk+0x122/0x290 [ 553.140024][T19509] sctp_make_datafrag_empty+0x12a/0x240 [ 553.140048][T19509] ? __kasan_kmalloc+0x93/0xb0 [ 553.140081][T19509] ? __pfx_sctp_make_datafrag_empty+0x10/0x10 [ 553.140103][T19509] ? skb_put+0x112/0x210 [ 553.140131][T19509] ? sctp_user_addto_chunk+0x9c/0x230 [ 553.140161][T19509] sctp_datamsg_from_user+0x735/0xef0 [ 553.140208][T19509] sctp_sendmsg_to_asoc+0x13cf/0x1880 [ 553.140246][T19509] ? sctp_assoc_add_peer+0xcbd/0x1380 [ 553.140292][T19509] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 553.140321][T19509] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 553.140359][T19509] ? __local_bh_enable_ip+0xd0/0x130 [ 553.140384][T19509] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 553.140411][T19509] ? security_sctp_bind_connect+0x7e/0x2c0 [ 553.140448][T19509] sctp_sendmsg+0x1bb5/0x2d00 [ 553.140492][T19509] ? __pfx_sctp_sendmsg+0x10/0x10 [ 553.140528][T19509] ? aa_sk_perm+0x6d5/0x900 [ 553.140557][T19509] ? __might_fault+0xaf/0x130 [ 553.140587][T19509] ? sock_rps_record_flow+0x19/0x350 [ 553.140614][T19509] ? inet_sendmsg+0x298/0x320 [ 553.140639][T19509] ? __pfx_inet_sendmsg+0x10/0x10 [ 553.140660][T19509] sock_sendmsg_nosec+0x10e/0x180 [ 553.140695][T19509] __sys_sendto+0x408/0x5a0 [ 553.140718][T19509] ? ksys_write+0x1e6/0x270 [ 553.140743][T19509] ? __pfx___sys_sendto+0x10/0x10 [ 553.140764][T19509] ? __mutex_unlock_slowpath+0x731/0x900 [ 553.140831][T19509] ? __pfx_ksys_write+0x10/0x10 [ 553.140860][T19509] __x64_sys_sendto+0xde/0x100 [ 553.140883][T19509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.140908][T19509] do_syscall_64+0x174/0x580 [ 553.140934][T19509] ? trace_irq_disable+0x3b/0x140 [ 553.140963][T19509] ? clear_bhb_loop+0x40/0x90 [ 553.140990][T19509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.141013][T19509] RIP: 0033:0x7f1a7779de99 [ 553.141033][T19509] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.141053][T19509] RSP: 002b:00007f1a78606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 553.141077][T19509] RAX: ffffffffffffffda RBX: 00007f1a77a25fa0 RCX: 00007f1a7779de99 [ 553.141093][T19509] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000004 [ 553.141107][T19509] RBP: 00007f1a78606090 R08: 000020000005ffe4 R09: 000000000000001c [ 553.141122][T19509] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 553.141136][T19509] R13: 00007f1a77a26038 R14: 00007f1a77a25fa0 R15: 00007ffcdfd986b8 [ 553.141171][T19509] [ 553.493816][T19509] xt_hashlimit: size too large, truncated to 1048576 [ 553.875662][T19516] sctp: [Deprecated]: syz.3.4005 (pid 19516) Use of int in max_burst socket option. [ 553.875662][T19516] Use struct sctp_assoc_value instead [ 554.042010][T19528] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4002'. [ 554.090156][T19528] netlink: 'syz.1.4002': attribute type 30 has an invalid length. [ 554.130523][T19524] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4005'. [ 554.718738][ T4937] Bluetooth: hci4: command 0x0406 tx timeout [ 555.058321][T19536] xt_socket: unknown flags 0x4 [ 555.130549][T19540] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4008'. [ 563.097297][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.524483][ T4937] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 568.537301][ T4937] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 568.547140][ T4937] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 568.559772][ T4937] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 568.570829][ T4937] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 569.742261][ T4937] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 569.755013][ T4937] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 569.770566][ T4937] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 569.785352][ T4937] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 569.793534][ T4937] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 569.927845][T15863] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 569.941414][T15863] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 569.958783][T15863] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 569.975076][T15863] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 569.984887][T15863] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 570.162578][T15863] Bluetooth: hci1: command 0x0406 tx timeout [ 570.638603][T15863] Bluetooth: hci3: command tx timeout [ 570.947977][ T5637] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 570.980526][T19569] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 570.996608][T19569] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 571.006339][T15566] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 571.015506][T15566] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 571.023238][T15566] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 571.035654][T15566] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 571.043224][T15566] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 571.053030][T15566] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 571.060526][T19569] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 571.842229][ T4937] Bluetooth: hci6: command tx timeout [ 572.078555][ T4937] Bluetooth: hci7: command tx timeout [ 572.718561][ T4937] Bluetooth: hci3: command tx timeout [ 573.123358][T15863] Bluetooth: hci8: command tx timeout [ 573.198898][ T4937] Bluetooth: hci9: command tx timeout [ 573.921727][ T4937] Bluetooth: hci6: command tx timeout [ 574.158844][ T4937] Bluetooth: hci7: command tx timeout [ 574.816130][ T4937] Bluetooth: hci3: command tx timeout [ 575.198433][ T4937] Bluetooth: hci8: command tx timeout [ 575.278629][ T4937] Bluetooth: hci9: command tx timeout [ 575.448942][ T4937] Bluetooth: hci2: command 0x0406 tx timeout [ 576.001943][ T4937] Bluetooth: hci6: command tx timeout [ 576.240291][ T4937] Bluetooth: hci7: command tx timeout [ 576.878699][T15863] Bluetooth: hci3: command tx timeout [ 577.288650][T15863] Bluetooth: hci8: command tx timeout [ 577.358616][T15863] Bluetooth: hci9: command tx timeout [ 578.081870][T15863] Bluetooth: hci6: command tx timeout [ 578.318441][T15863] Bluetooth: hci7: command tx timeout [ 579.358542][T15863] Bluetooth: hci8: command tx timeout [ 579.438676][T15863] Bluetooth: hci9: command tx timeout [ 585.689097][ T4937] Bluetooth: hci0: command 0x0406 tx timeout [ 624.533956][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 628.649667][ T4937] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 628.667897][ T4937] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 628.694270][ T4937] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 628.702598][ T4937] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 628.710829][ T4937] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 629.653529][ T4937] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 629.675676][ T4937] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 629.690413][ T4937] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 629.700147][ T4937] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 629.709706][ T4937] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 630.691550][T15863] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 630.705500][T15863] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 630.714175][T15863] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 630.735479][T15863] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 630.743405][T15863] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 630.819452][T15566] Bluetooth: hci10: command tx timeout [ 631.437627][ T4937] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 631.456121][ T4937] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 631.464788][ T4937] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 631.475625][ T4937] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 631.487473][ T4937] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 631.566847][T15566] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 631.588475][T15566] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 631.602406][T15566] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 631.612250][T15566] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 631.620590][T15566] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 631.761707][ T4937] Bluetooth: hci11: command tx timeout [ 632.879026][T15566] Bluetooth: hci12: command tx timeout [ 632.886998][ T4937] Bluetooth: hci10: command tx timeout [ 633.598871][ T4937] Bluetooth: hci13: command tx timeout [ 633.679382][ T4937] Bluetooth: hci14: command tx timeout [ 633.838781][ T4937] Bluetooth: hci11: command tx timeout [ 634.960196][T15566] Bluetooth: hci12: command tx timeout [ 634.967193][ T4937] Bluetooth: hci10: command tx timeout [ 635.326526][T19520] netlink: 140 bytes leftover after parsing attributes in process `syz.1.4002'. [ 635.678971][ T4937] Bluetooth: hci13: command tx timeout [ 635.758992][ T4937] Bluetooth: hci14: command tx timeout [ 635.918691][ T4937] Bluetooth: hci11: command tx timeout [ 637.059952][ T4937] Bluetooth: hci10: command tx timeout [ 637.065567][ T4937] Bluetooth: hci12: command tx timeout [ 637.759373][ T4937] Bluetooth: hci13: command tx timeout [ 637.839198][ T4937] Bluetooth: hci14: command tx timeout [ 638.015215][ T4937] Bluetooth: hci11: command tx timeout [ 639.123903][ T4937] Bluetooth: hci12: command tx timeout [ 639.839025][ T4937] Bluetooth: hci13: command tx timeout [ 639.919164][ T4937] Bluetooth: hci14: command tx timeout [ 685.903805][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 687.198292][ C1] sched: DL replenish lagged too much [ 688.854089][T15566] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 688.866857][T15566] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 688.875112][T15566] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 688.890686][T15566] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 688.906347][T15566] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 689.807055][T15566] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 689.822617][T15566] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 689.831876][T15566] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 689.845562][T15566] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 689.856131][T15566] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 690.959082][T15863] Bluetooth: hci1: command tx timeout [ 691.203535][ T5637] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 691.215466][ T5637] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 691.223781][ T5637] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 691.234180][ T5637] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 691.244035][ T5637] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 691.686793][T15863] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 691.702130][T15863] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 691.710239][T15863] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 691.724067][T15863] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 691.736355][T15863] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 691.856455][ T5637] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 691.872314][ T5637] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 691.883387][ T5637] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 691.894065][ T5637] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 691.906249][ T5637] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 691.919400][ T5637] Bluetooth: hci2: command tx timeout [ 692.971137][T15863] Bluetooth: hci7: command 0x0406 tx timeout [ 692.981477][ T5637] Bluetooth: hci6: command 0x0406 tx timeout [ 692.987577][T19638] Bluetooth: hci3: command 0x0406 tx timeout [ 693.039208][T19638] Bluetooth: hci1: command tx timeout [ 693.358680][T19638] Bluetooth: hci4: command tx timeout [ 693.758440][T19569] Bluetooth: hci5: command tx timeout [ 693.998827][T19569] Bluetooth: hci15: command tx timeout [ 694.006288][T19638] Bluetooth: hci2: command tx timeout [ 695.119146][ T4937] Bluetooth: hci1: command tx timeout [ 695.438430][ T4937] Bluetooth: hci4: command tx timeout [ 695.838477][ T4937] Bluetooth: hci5: command tx timeout [ 696.078725][T15566] Bluetooth: hci2: command tx timeout [ 696.084231][T19569] Bluetooth: hci15: command tx timeout [ 697.198959][T19569] Bluetooth: hci1: command tx timeout [ 697.518562][T19569] Bluetooth: hci4: command tx timeout [ 697.918470][T19569] Bluetooth: hci5: command tx timeout [ 698.079182][T19569] Bluetooth: hci8: command 0x0406 tx timeout [ 698.085436][T15566] Bluetooth: hci9: command 0x0406 tx timeout [ 698.158687][T19569] Bluetooth: hci2: command tx timeout [ 698.164269][T15566] Bluetooth: hci15: command tx timeout [ 699.598383][ T4937] Bluetooth: hci4: command tx timeout [ 699.999968][ T4937] Bluetooth: hci5: command tx timeout [ 700.239042][ T4937] Bluetooth: hci15: command tx timeout [ 717.759142][ T30] INFO: task jbd2/sda1-8:4949 blocked in I/O wait for more than 143 seconds. [ 717.776457][ T30] Not tainted syzkaller #0 [ 717.783204][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 717.802894][ T30] task:jbd2/sda1-8 state:D stack:25136 pid:4949 tgid:4949 ppid:2 task_flags:0x240040 flags:0x00080000 [ 717.815717][ T30] Call Trace: [ 717.819319][ T30] [ 717.822321][ T30] __schedule+0x17d9/0x56c0 [ 717.826935][ T30] ? __pfx_blk_mq_submit_bio+0x10/0x10 [ 717.833185][ T30] ? __pfx___schedule+0x10/0x10 [ 717.838129][ T30] ? schedule+0x90/0x2b0 [ 717.848411][ T30] schedule+0x164/0x2b0 [ 717.855086][ T30] io_schedule+0x7f/0xd0 [ 717.859768][ T30] bit_wait_io+0x11/0xd0 [ 717.864119][ T30] __wait_on_bit+0xac/0x300 [ 717.869210][ T30] ? __pfx_bit_wait_io+0x10/0x10 [ 717.875885][ T30] out_of_line_wait_on_bit+0x13b/0x190 [ 717.884925][ T30] ? __pfx_bit_wait_io+0x10/0x10 [ 717.890349][ T30] ? __pfx_out_of_line_wait_on_bit+0x10/0x10 [ 717.896416][ T30] ? __pfx_wake_bit_function+0x10/0x10 [ 717.902438][ T30] ? __wait_on_buffer+0xe/0x80 [ 717.907315][ T30] jbd2_journal_commit_transaction+0x366f/0x5b70 [ 717.915069][ T30] ? trace_hrtimer_start+0x82/0x200 [ 717.929056][ T30] ? __pfx_jbd2_journal_commit_transaction+0x10/0x10 [ 717.938368][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 717.943491][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 717.950637][ T30] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 717.956534][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 717.962307][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 717.968189][ T30] ? __timer_delete_sync+0x4a3/0x520 [ 717.974099][ T30] kjournald2+0x3bc/0x750 [ 717.980448][ T30] ? __pfx_kjournald2+0x10/0x10 [ 717.985387][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 717.995196][ T30] ? __kthread_parkme+0x71/0x1f0 [ 718.003821][ T30] ? __kthread_parkme+0x196/0x1f0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 718.009338][ T30] kthread+0x388/0x470 [ 718.013524][ T30] ? __pfx_kjournald2+0x10/0x10 [ 718.019017][ T30] ? __pfx_kthread+0x10/0x10 [ 718.023695][ T30] ret_from_fork+0x514/0xb70 [ 718.028811][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 718.034003][ T30] ? __switch_to+0xc89/0x1420 [ 718.039449][ T30] ? __pfx_kthread+0x10/0x10 [ 718.044231][ T30] ret_from_fork_asm+0x1a/0x30 [ 718.049641][ T30] [ 718.052809][ T30] INFO: task syz-executor:19543 blocked for more than 143 seconds. [ 718.078318][ T30] Not tainted syzkaller #0 [ 718.087932][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 718.110553][ T30] task:syz-executor state:D stack:25608 pid:19543 tgid:19543 ppid:1 task_flags:0x400140 flags:0x00080002 [ 718.170698][ T30] Call Trace: [ 718.189204][ T30] [ 718.208543][ T30] __schedule+0x17d9/0x56c0 [ 718.240188][ T30] ? __lock_acquire+0x683/0x2cf0 [ 718.246499][ T30] ? __lock_acquire+0x683/0x2cf0 [ 718.256163][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 718.262141][ T30] ? __pfx___schedule+0x10/0x10 [ 718.267143][ T30] ? schedule+0x90/0x2b0 [ 718.271883][ T30] schedule+0x164/0x2b0 [ 718.276124][ T30] schedule_preempt_disabled+0x13/0x30 [ 718.284976][ T30] __mutex_lock+0x7bf/0x1550 [ 718.290122][ T30] ? __mutex_lock+0x5d4/0x1550 [ 718.294977][ T30] ? inet_rtm_newaddr+0x470/0x19f0 [ 718.300570][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 718.305681][ T30] ? __nla_parse+0x40/0x60 [ 718.310648][ T30] inet_rtm_newaddr+0x470/0x19f0 [ 718.315671][ T30] ? __kernel_text_address+0xd/0x30 [ 718.321940][ T30] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 718.328182][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 718.340076][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 718.345806][ T30] rtnetlink_rcv_msg+0x802/0xc00 [ 718.354015][ T30] ? netlink_sendmsg+0x5d4/0xb40 [ 718.364423][ T30] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 718.370058][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 718.375603][ T30] ? __lock_acquire+0x683/0x2cf0 [ 718.381054][ T30] netlink_rcv_skb+0x226/0x4a0 [ 718.387567][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 718.395236][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 718.404994][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 718.410687][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 718.415980][ T30] netlink_unicast+0x7bb/0x940 [ 718.421890][ T30] netlink_sendmsg+0x813/0xb40 [ 718.426741][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 718.432665][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 718.437682][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 718.443322][ T30] sock_sendmsg_nosec+0x13a/0x180 [ 718.449113][ T30] __sys_sendto+0x408/0x5a0 [ 718.453700][ T30] ? __pfx___sys_sendto+0x10/0x10 [ 718.461210][ T30] ? do_user_addr_fault+0xc4a/0x1340 [ 718.466599][ T30] __x64_sys_sendto+0xde/0x100 [ 718.472932][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.483524][ T30] do_syscall_64+0x174/0x580 [ 718.490169][ T30] ? trace_irq_disable+0x3b/0x140 [ 718.495280][ T30] ? clear_bhb_loop+0x40/0x90 [ 718.501980][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.508143][ T30] RIP: 0033:0x7fc7ae75e6ce [ 718.512918][ T30] RSP: 002b:00007ffc8d025328 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 718.521704][ T30] RAX: ffffffffffffffda RBX: 0000555577ce4500 RCX: 00007fc7ae75e6ce [ 718.530099][ T30] RDX: 0000000000000028 RSI: 00007fc7af554670 RDI: 0000000000000003 [ 718.538136][ T30] RBP: 0000000000000001 R08: 00007ffc8d0253a4 R09: 000000000000000c [ 718.546655][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 718.555584][ T30] R13: 0000000000000000 R14: 00007fc7af554670 R15: 0000000000000000 [ 718.564581][ T30] [ 718.567699][ T30] INFO: task syz-executor:19555 blocked for more than 144 seconds. [ 718.579465][ T30] Not tainted syzkaller #0 [ 718.584553][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 718.598254][ T30] task:syz-executor state:D stack:26792 pid:19555 tgid:19555 ppid:1 task_flags:0x400140 flags:0x00080002 [ 718.615273][ T30] Call Trace: [ 718.618878][ T30] [ 718.621873][ T30] __schedule+0x17d9/0x56c0 [ 718.626470][ T30] ? __lock_acquire+0x683/0x2cf0 [ 718.632038][ T30] ? __lock_acquire+0x683/0x2cf0 [ 718.637085][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 718.643255][ T30] ? __pfx___schedule+0x10/0x10 [ 718.648189][ T30] ? schedule+0x90/0x2b0 [ 718.653031][ T30] schedule+0x164/0x2b0 [ 718.657233][ T30] schedule_preempt_disabled+0x13/0x30 [ 718.663155][ T30] __mutex_lock+0x7bf/0x1550 [ 718.667850][ T30] ? __mutex_lock+0x5d4/0x1550 [ 718.673156][ T30] ? inet_rtm_newaddr+0x470/0x19f0 [ 718.680765][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 718.685885][ T30] ? __nla_parse+0x40/0x60 [ 718.698288][ T30] inet_rtm_newaddr+0x470/0x19f0 [ 718.704545][ T30] ? __kernel_text_address+0xd/0x30 [ 718.710158][ T30] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 718.716404][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 718.738340][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 718.743833][ T30] rtnetlink_rcv_msg+0x802/0xc00 [ 718.754412][ T30] ? netlink_sendmsg+0x5d4/0xb40 [ 718.768429][ T30] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 718.778297][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 718.790398][ T30] ? __lock_acquire+0x683/0x2cf0 [ 718.802886][ T30] netlink_rcv_skb+0x226/0x4a0 [ 718.807759][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 718.813820][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 718.819509][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 718.824782][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 718.833015][ T30] netlink_unicast+0x7bb/0x940 [ 718.837877][ T30] netlink_sendmsg+0x813/0xb40 [ 718.843351][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 718.849163][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 718.854199][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 718.860038][ T30] sock_sendmsg_nosec+0x13a/0x180 [ 718.865198][ T30] __sys_sendto+0x408/0x5a0 [ 718.870112][ T30] ? __pfx___sys_sendto+0x10/0x10 [ 718.875647][ T30] ? do_user_addr_fault+0xc4a/0x1340 [ 718.882307][ T30] __x64_sys_sendto+0xde/0x100 [ 718.887163][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.893976][ T30] do_syscall_64+0x174/0x580 [ 718.909471][ T30] ? trace_irq_disable+0x3b/0x140 [ 718.914882][ T30] ? clear_bhb_loop+0x40/0x90 [ 718.919987][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.925977][ T30] RIP: 0033:0x7f50ef55e6ce [ 718.931635][ T30] RSP: 002b:00007ffe383a3a68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 718.941959][ T30] RAX: ffffffffffffffda RBX: 000055557425f500 RCX: 00007f50ef55e6ce [ 718.950361][ T30] RDX: 0000000000000028 RSI: 00007f50f0354670 RDI: 0000000000000003 [ 718.961060][ T30] RBP: 0000000000000001 R08: 00007ffe383a3ae4 R09: 000000000000000c [ 718.969488][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 718.977861][ T30] R13: 0000000000000000 R14: 00007f50f0354670 R15: 0000000000000000 [ 718.986212][ T30] [ 718.989619][ T30] INFO: task syz-executor:19558 blocked for more than 144 seconds. [ 718.997589][ T30] Not tainted syzkaller #0 [ 719.004618][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 719.016641][ T30] task:syz-executor state:D stack:26792 pid:19558 tgid:19558 ppid:1 task_flags:0x400140 flags:0x00080002 [ 719.030168][ T30] Call Trace: [ 719.033516][ T30] [ 719.036485][ T30] __schedule+0x17d9/0x56c0 [ 719.044528][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.057057][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.062692][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 719.068166][ T30] ? __pfx___schedule+0x10/0x10 [ 719.073480][ T30] ? schedule+0x90/0x2b0 [ 719.077817][ T30] schedule+0x164/0x2b0 [ 719.082531][ T30] schedule_preempt_disabled+0x13/0x30 [ 719.088068][ T30] __mutex_lock+0x7bf/0x1550 [ 719.093196][ T30] ? __mutex_lock+0x5d4/0x1550 [ 719.098050][ T30] ? inet_rtm_newaddr+0x470/0x19f0 [ 719.111160][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 719.116706][ T30] ? __nla_parse+0x40/0x60 [ 719.127334][ T30] inet_rtm_newaddr+0x470/0x19f0 [ 719.133297][ T30] ? __kernel_text_address+0xd/0x30 [ 719.140106][ T30] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 719.146455][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 719.152407][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 719.157884][ T30] rtnetlink_rcv_msg+0x802/0xc00 [ 719.164993][ T30] ? netlink_sendmsg+0x5d4/0xb40 [ 719.170352][ T30] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 719.175550][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 719.181589][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.186645][ T30] netlink_rcv_skb+0x226/0x4a0 [ 719.191914][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 719.197632][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 719.206718][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.212602][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.217897][ T30] netlink_unicast+0x7bb/0x940 [ 719.223374][ T30] netlink_sendmsg+0x813/0xb40 [ 719.228440][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.234050][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 719.242488][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.247895][ T30] sock_sendmsg_nosec+0x13a/0x180 [ 719.254616][ T30] __sys_sendto+0x408/0x5a0 [ 719.259634][ T30] ? __pfx___sys_sendto+0x10/0x10 [ 719.264781][ T30] ? do_user_addr_fault+0xc4a/0x1340 [ 719.272005][ T30] __x64_sys_sendto+0xde/0x100 [ 719.277344][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.283936][ T30] do_syscall_64+0x174/0x580 [ 719.288976][ T30] ? trace_irq_disable+0x3b/0x140 [ 719.294122][ T30] ? clear_bhb_loop+0x40/0x90 [ 719.299363][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.305330][ T30] RIP: 0033:0x7f443595e6ce [ 719.311987][ T30] RSP: 002b:00007fffa1a213d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 719.320861][ T30] RAX: ffffffffffffffda RBX: 000055556c10c500 RCX: 00007f443595e6ce [ 719.329317][ T30] RDX: 0000000000000028 RSI: 00007f4436754670 RDI: 0000000000000003 [ 719.337365][ T30] RBP: 0000000000000001 R08: 00007fffa1a21454 R09: 000000000000000c [ 719.345936][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 719.356059][ T30] R13: 0000000000000000 R14: 00007f4436754670 R15: 0000000000000000 [ 719.366690][ T30] [ 719.370124][ T30] INFO: task syz-executor:19565 blocked for more than 144 seconds. [ 719.378103][ T30] Not tainted syzkaller #0 [ 719.385331][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 719.394491][ T30] task:syz-executor state:D stack:26792 pid:19565 tgid:19565 ppid:1 task_flags:0x400140 flags:0x00080002 [ 719.406868][ T30] Call Trace: [ 719.413438][ T30] [ 719.418631][ T30] __schedule+0x17d9/0x56c0 [ 719.423233][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.428716][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.433758][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 719.442332][ T30] ? __pfx___schedule+0x10/0x10 [ 719.447348][ T30] ? schedule+0x90/0x2b0 [ 719.452195][ T30] schedule+0x164/0x2b0 [ 719.456491][ T30] schedule_preempt_disabled+0x13/0x30 [ 719.464804][ T30] __mutex_lock+0x7bf/0x1550 [ 719.471897][ T30] ? __mutex_lock+0x5d4/0x1550 [ 719.476748][ T30] ? inet_rtm_newaddr+0x470/0x19f0 [ 719.482369][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 719.487495][ T30] ? __nla_parse+0x40/0x60 [ 719.494021][ T30] inet_rtm_newaddr+0x470/0x19f0 [ 719.499321][ T30] ? __kernel_text_address+0xd/0x30 [ 719.504589][ T30] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 719.512921][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 719.522285][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 719.527742][ T30] rtnetlink_rcv_msg+0x802/0xc00 [ 719.533329][ T30] ? netlink_sendmsg+0x5d4/0xb40 [ 719.538654][ T30] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 719.543852][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 719.549909][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.554959][ T30] netlink_rcv_skb+0x226/0x4a0 [ 719.560407][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 719.565951][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 719.573193][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.582065][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.589093][ T30] netlink_unicast+0x7bb/0x940 [ 719.593970][ T30] netlink_sendmsg+0x813/0xb40 [ 719.601593][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.606970][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 719.612480][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.619739][ T30] sock_sendmsg_nosec+0x13a/0x180 [ 719.624867][ T30] __sys_sendto+0x408/0x5a0 [ 719.630007][ T30] ? __pfx___sys_sendto+0x10/0x10 [ 719.635140][ T30] ? do_user_addr_fault+0xc4a/0x1340 [ 719.641061][ T30] __x64_sys_sendto+0xde/0x100 [ 719.645902][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.652516][ T30] do_syscall_64+0x174/0x580 [ 719.657187][ T30] ? trace_irq_disable+0x3b/0x140 [ 719.662699][ T30] ? clear_bhb_loop+0x40/0x90 [ 719.667464][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.673824][ T30] RIP: 0033:0x7fb06db5e6ce [ 719.685347][ T30] RSP: 002b:00007ffcf07ec7a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 719.696456][ T30] RAX: ffffffffffffffda RBX: 0000555586aef500 RCX: 00007fb06db5e6ce [ 719.704947][ T30] RDX: 0000000000000028 RSI: 00007fb06e954670 RDI: 0000000000000003 [ 719.714951][ T30] RBP: 0000000000000001 R08: 00007ffcf07ec824 R09: 000000000000000c [ 719.726163][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 719.738692][ T30] R13: 0000000000000000 R14: 00007fb06e954670 R15: 0000000000000000 [ 719.746861][ T30] [ 719.750450][ T30] INFO: task syz-executor:19566 blocked for more than 145 seconds. [ 719.758802][ T30] Not tainted syzkaller #0 [ 719.763799][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 719.773021][ T30] task:syz-executor state:D stack:26792 pid:19566 tgid:19566 ppid:1 task_flags:0x400140 flags:0x00080002 [ 719.785496][ T30] Call Trace: [ 719.790633][ T30] [ 719.793643][ T30] __schedule+0x17d9/0x56c0 [ 719.798657][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.803692][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.811531][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 719.817100][ T30] ? __pfx___schedule+0x10/0x10 [ 719.825733][ T30] ? schedule+0x90/0x2b0 [ 719.830409][ T30] schedule+0x164/0x2b0 [ 719.834639][ T30] schedule_preempt_disabled+0x13/0x30 [ 719.843118][ T30] __mutex_lock+0x7bf/0x1550 [ 719.847848][ T30] ? __mutex_lock+0x5d4/0x1550 [ 719.853231][ T30] ? inet_rtm_newaddr+0x470/0x19f0 [ 719.858714][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 719.864090][ T30] ? __nla_parse+0x40/0x60 [ 719.868912][ T30] inet_rtm_newaddr+0x470/0x19f0 [ 719.873929][ T30] ? __kernel_text_address+0xd/0x30 [ 719.879633][ T30] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 719.885973][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 719.891990][ T30] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 719.897449][ T30] rtnetlink_rcv_msg+0x802/0xc00 [ 719.903893][ T30] ? netlink_sendmsg+0x5d4/0xb40 [ 719.909251][ T30] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 719.914459][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 719.924624][ T30] ? __lock_acquire+0x683/0x2cf0 [ 719.937229][ T30] netlink_rcv_skb+0x226/0x4a0 [ 719.942437][ T30] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 719.947972][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 719.954438][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.960132][ T30] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.965425][ T30] netlink_unicast+0x7bb/0x940 [ 719.970847][ T30] netlink_sendmsg+0x813/0xb40 [ 719.975716][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.981732][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 719.986879][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.992602][ T30] sock_sendmsg_nosec+0x13a/0x180 [ 719.998034][ T30] __sys_sendto+0x408/0x5a0 [ 720.009580][ T30] ? __pfx___sys_sendto+0x10/0x10 [ 720.017396][ T30] ? do_user_addr_fault+0xc4a/0x1340 [ 720.024705][ T30] __x64_sys_sendto+0xde/0x100 [ 720.031129][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.037281][ T30] do_syscall_64+0x174/0x580 [ 720.045137][ T30] ? trace_irq_disable+0x3b/0x140 [ 720.050606][ T30] ? clear_bhb_loop+0x40/0x90 [ 720.055366][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.061735][ T30] RIP: 0033:0x7f3b2e95e6ce [ 720.066225][ T30] RSP: 002b:00007ffc8cb597e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 720.075309][ T30] RAX: ffffffffffffffda RBX: 0000555579f04500 RCX: 00007f3b2e95e6ce [ 720.087287][ T30] RDX: 0000000000000028 RSI: 00007f3b2f754670 RDI: 0000000000000003 [ 720.095721][ T30] RBP: 0000000000000001 R08: 00007ffc8cb59864 R09: 000000000000000c [ 720.104239][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 720.112603][ T30] R13: 0000000000000000 R14: 00007f3b2f754670 R15: 0000000000000000 [ 720.122180][ T30] [ 720.126963][ T30] [ 720.126963][ T30] Showing all locks held in the system: [ 720.138277][ T30] 5 locks held by kworker/1:0/24: [ 720.146131][ T30] 1 lock held by khungtaskd/30: [ 720.155293][ T30] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 720.170267][ T30] 3 locks held by kworker/u8:9/1179: [ 720.175638][ T30] #0: ffff888031d23140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 720.187861][ T30] #1: ffffc900059e7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 720.201325][ T30] #2: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 [ 720.211767][ T30] 2 locks held by getty/5376: [ 720.216512][ T30] #0: ffff8880359f60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 720.227116][ T30] #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 720.240532][ T30] 3 locks held by kworker/0:7/5838: [ 720.245851][ T30] #0: ffff88801b029d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 720.264638][ T30] #1: ffffc900049dfc40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 720.278715][ T30] #2: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xac/0x1110 [ 720.289170][ T30] 1 lock held by syz.4.3998/19497: [ 720.294361][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 720.304053][ T30] 1 lock held by syz.1.4002/19528: [ 720.309557][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 720.320314][ T30] 1 lock held by syz.3.4005/19519: [ 720.325512][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 720.336778][ T30] 3 locks held by syz.0.4008/19540: [ 720.342428][ T30] #0: ffffffff905989e8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 720.353533][ T30] #1: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 [ 720.363098][ T30] #2: ffffffff8e9e75f0 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many_notify+0xcac/0x2150 [ 720.377466][ T30] 1 lock held by syz.2.4009/19539: [ 720.384411][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 720.393921][ T30] 1 lock held by syz-executor/19543: [ 720.400197][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.410149][ T30] 1 lock held by syz-executor/19555: [ 720.415505][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.425584][ T30] 1 lock held by syz-executor/19558: [ 720.431457][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.442965][ T30] 1 lock held by syz-executor/19565: [ 720.449344][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.461055][ T30] 1 lock held by syz-executor/19566: [ 720.466418][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.476408][ T30] 1 lock held by syz-executor/19579: [ 720.488783][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.500026][ T30] 1 lock held by syz-executor/19587: [ 720.505421][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.515474][ T30] 1 lock held by syz-executor/19592: [ 720.521161][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.531024][ T30] 1 lock held by syz-executor/19598: [ 720.538151][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.547973][ T30] 1 lock held by syz-executor/19599: [ 720.554081][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.567477][ T30] 1 lock held by syz-executor/19613: [ 720.574218][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.584031][ T30] 1 lock held by syz-executor/19621: [ 720.592469][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.602358][ T30] 1 lock held by syz-executor/19626: [ 720.607704][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.618960][ T30] 1 lock held by syz-executor/19633: [ 720.624316][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.634350][ T30] 1 lock held by syz-executor/19636: [ 720.643991][ T30] #0: ffffffff9002d000 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 720.653887][ T30] [ 720.656273][ T30] ============================================= [ 720.656273][ T30] [ 720.665076][ T30] NMI backtrace for cpu 0 [ 720.665096][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 720.665120][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 720.665133][ T30] Call Trace: [ 720.665142][ T30] [ 720.665151][ T30] dump_stack_lvl+0xe8/0x150 [ 720.665190][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 720.665217][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 720.665253][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 720.665280][ T30] sys_info+0x135/0x170 [ 720.665312][ T30] watchdog+0xfd7/0x1030 [ 720.665375][ T30] ? watchdog+0x1c7/0x1030 [ 720.665410][ T30] kthread+0x388/0x470 [ 720.665443][ T30] ? __pfx_watchdog+0x10/0x10 [ 720.665468][ T30] ? __pfx_kthread+0x10/0x10 [ 720.665502][ T30] ret_from_fork+0x514/0xb70 [ 720.665538][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 720.665570][ T30] ? __switch_to+0xc89/0x1420 [ 720.665608][ T30] ? __pfx_kthread+0x10/0x10 [ 720.665641][ T30] ret_from_fork_asm+0x1a/0x30 [ 720.665679][ T30] [ 720.665688][ T30] Sending NMI from CPU 0 to CPUs 1: [ 720.778079][ C1] NMI backtrace for cpu 1 [ 720.778098][ C1] CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full) [ 720.778120][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 720.778134][ C1] Workqueue: events_power_efficient neigh_periodic_work [ 720.778161][ C1] RIP: 0010:__lock_acquire+0x468/0x2cf0 [ 720.778191][ C1] Code: 41 8d 5c 24 01 49 ff cc 89 d9 83 c1 fe 78 40 45 89 e7 41 81 e7 ff ff ff 7f 83 f9 31 73 1d 4b 8d 0c bf 41 8b 8c ce c0 0b 00 00 <31> c1 ff cb 49 ff cc f7 c1 00 60 00 00 74 cf eb 17 48 c7 c7 90 7f [ 720.778212][ C1] RSP: 0018:ffffc90000a08218 EFLAGS: 00000087 [ 720.778229][ C1] RAX: 0000000000022007 RBX: 0000000000000004 RCX: 0000000000022007 [ 720.778243][ C1] RDX: 0000000000000003 RSI: 0000000000002000 RDI: 0000000000000000 [ 720.778255][ C1] RBP: ffff88801e6ee940 R08: ffffffff8177827f R09: 0000000000000000 [ 720.778269][ C1] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000002 [ 720.778281][ C1] R13: 0000000000000000 R14: ffff88801e6edd00 R15: 0000000000000002 [ 720.778294][ C1] FS: 0000000000000000(0000) GS:ffff888125053000(0000) knlGS:0000000000000000 [ 720.778310][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 720.778323][ C1] CR2: 00007f1a78605ff8 CR3: 000000000e946000 CR4: 00000000003526f0 [ 720.778341][ C1] Call Trace: [ 720.778349][ C1] [ 720.778361][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778382][ C1] ? lock_acquire+0x106/0x350 [ 720.778410][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778428][ C1] ? lock_acquire+0x106/0x350 [ 720.778455][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778473][ C1] lock_acquire+0x106/0x350 [ 720.778498][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778521][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778540][ C1] ? can_receive+0x2c6/0x440 [ 720.778681][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778701][ C1] unwind_next_frame+0xac/0x2550 [ 720.778721][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778742][ C1] ? can_rcv_filter+0x126/0x7a0 [ 720.778770][ C1] ? unwind_next_frame+0x8f/0x2550 [ 720.778791][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 720.778816][ C1] arch_stack_walk+0x11b/0x150 [ 720.778839][ C1] ? can_receive+0x2c6/0x440 [ 720.778868][ C1] stack_trace_save+0xa9/0x100 [ 720.778891][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 720.778917][ C1] ? __lock_acquire+0x683/0x2cf0 [ 720.778945][ C1] kasan_save_track+0x3e/0x80 [ 720.778970][ C1] ? kasan_save_track+0x3e/0x80 [ 720.778994][ C1] ? kasan_save_free_info+0x40/0x50 [ 720.779014][ C1] ? __kasan_slab_free+0x5c/0x80 [ 720.779039][ C1] ? kmem_cache_free+0x182/0x650 [ 720.779071][ C1] ? enqueue_to_backlog+0x68c/0xef0 [ 720.779097][ C1] ? netif_rx_internal+0x120/0x550 [ 720.779115][ C1] ? netif_rx+0x59/0x90 [ 720.779135][ C1] ? can_send+0x9af/0xd30 [ 720.779159][ C1] ? can_can_gw_rcv+0xd09/0xfd0 [ 720.779180][ C1] ? can_rcv_filter+0x126/0x7a0 [ 720.779206][ C1] ? can_receive+0x2c6/0x440 [ 720.779252][ C1] ? enqueue_to_backlog+0x68c/0xef0 [ 720.779276][ C1] kasan_save_free_info+0x40/0x50 [ 720.779296][ C1] __kasan_slab_free+0x5c/0x80 [ 720.779322][ C1] kmem_cache_free+0x182/0x650 [ 720.779350][ C1] enqueue_to_backlog+0x68c/0xef0 [ 720.779379][ C1] netif_rx_internal+0x120/0x550 [ 720.779399][ C1] ? __pfx_netif_rx_internal+0x10/0x10 [ 720.779416][ C1] ? __skb_clone+0x449/0x6c0 [ 720.779438][ C1] ? rcu_is_watching+0x15/0xb0 [ 720.779458][ C1] netif_rx+0x59/0x90 [ 720.779478][ C1] can_send+0x9af/0xd30 [ 720.779508][ C1] ? __pfx_can_send+0x10/0x10 [ 720.779534][ C1] ? skb_ext_add+0x3b3/0x8e0 [ 720.779555][ C1] ? skb_clone+0x246/0x3a0 [ 720.779576][ C1] ? can_can_gw_rcv+0x48f/0xfd0 [ 720.779600][ C1] can_can_gw_rcv+0xd09/0xfd0 [ 720.779626][ C1] ? __pfx_can_can_gw_rcv+0x10/0x10 [ 720.779649][ C1] can_rcv_filter+0x126/0x7a0 [ 720.779677][ C1] ? can_receive+0x16c/0x440 [ 720.779705][ C1] can_receive+0x2c6/0x440 [ 720.779734][ C1] can_rcv+0x1f9/0x330 [ 720.779760][ C1] ? __pfx_can_rcv+0x10/0x10 [ 720.779788][ C1] process_backlog+0xbf0/0x1860 [ 720.779807][ C1] ? process_backlog+0x3c3/0x1860 [ 720.779831][ C1] __napi_poll+0xaa/0x330 [ 720.779860][ C1] net_rx_action+0x61d/0xf50 [ 720.779882][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 720.779913][ C1] handle_softirqs+0x225/0x840 [ 720.779937][ C1] ? do_softirq+0x76/0xd0 [ 720.779960][ C1] ? neigh_periodic_work+0xc23/0xe40 [ 720.779979][ C1] do_softirq+0x76/0xd0 [ 720.779999][ C1] [ 720.780006][ C1] [ 720.780013][ C1] __local_bh_enable_ip+0xf8/0x130 [ 720.780035][ C1] neigh_periodic_work+0xc23/0xe40 [ 720.780057][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 720.780085][ C1] process_scheduled_works+0xa8e/0x14e0 [ 720.780120][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 720.780144][ C1] ? assign_work+0x3cf/0x5d0 [ 720.780167][ C1] worker_thread+0xa47/0xfb0 [ 720.780201][ C1] kthread+0x388/0x470 [ 720.780228][ C1] ? __pfx_worker_thread+0x10/0x10 [ 720.780249][ C1] ? __pfx_kthread+0x10/0x10 [ 720.780276][ C1] ret_from_fork+0x514/0xb70 [ 720.780304][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 720.780331][ C1] ? __switch_to+0xc89/0x1420 [ 720.780355][ C1] ? __pfx_kthread+0x10/0x10 [ 720.780382][ C1] ret_from_fork_asm+0x1a/0x30 [ 720.780406][ C1] [ 721.323188][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 721.330152][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 721.339297][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 721.349481][ T30] Call Trace: [ 721.352801][ T30] [ 721.355794][ T30] vpanic+0x56c/0xa60 [ 721.359848][ T30] ? __pfx___schedule+0x10/0x10 [ 721.364759][ T30] ? __pfx_vpanic+0x10/0x10 [ 721.369329][ T30] panic+0xc5/0xd0 [ 721.373108][ T30] ? __pfx_panic+0x10/0x10 [ 721.377573][ T30] ? preempt_schedule_common+0x82/0xd0 [ 721.383079][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 721.388586][ T30] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 721.394778][ T30] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 721.401089][ T30] watchdog+0x1030/0x1030 [ 721.405470][ T30] ? watchdog+0x1c7/0x1030 [ 721.410451][ T30] kthread+0x388/0x470 [ 721.414568][ T30] ? __pfx_watchdog+0x10/0x10 [ 721.419316][ T30] ? __pfx_kthread+0x10/0x10 [ 721.423974][ T30] ret_from_fork+0x514/0xb70 [ 721.428632][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 721.433805][ T30] ? __switch_to+0xc89/0x1420 [ 721.438531][ T30] ? __pfx_kthread+0x10/0x10 [ 721.443182][ T30] ret_from_fork_asm+0x1a/0x30 [ 721.448171][ T30] [ 721.451863][ T30] Kernel Offset: disabled [ 721.456213][ T30] Rebooting in 86400 seconds..