last executing test programs: 17.85941724s ago: executing program 4 (id=8467): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000640)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c9", 0x1) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYRESOCT=r1, @ANYRESHEX=r2], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x13}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) (async) sendto$inet6(r1, &(0x7f0000000200)="ead77b", 0x3, 0x8000, &(0x7f0000000080)={0xa, 0x4e24, 0x8b7a, @private1={0xfc, 0x1, '\x00', 0x1}, 0x6}, 0x1c) (async, rerun: 32) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) (rerun: 32) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}}, 0x800) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r4 = socket$rxrpc(0x21, 0x2, 0xa) sendto$rxrpc(r4, &(0x7f00000000c0)="3ad10e88f175ccf0497745e474ad356a9d57ae5dd738a5b0960d5c5a1498715524eb5ca8b04557bae5db3a2dc5d9a8f277d9a3c11fab57f15a19558b5304986002eb4086cc1a88d381b810ee4b31211b2dde452551910a0c50a165b3a9beebd31f9fe249ebdfe48bee485f", 0x6b, 0x40, &(0x7f0000000000)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e23, @loopback}}, 0x24) syz_init_net_socket$rose(0xb, 0x5, 0x0) 16.815385441s ago: executing program 4 (id=8480): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, @IFLA_BR_GROUP_FWD_MASK={0x6}]}}}]}, 0x48}}, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(r0, 0x80106720, &(0x7f0000000240)={0x3, &(0x7f0000000440)=[{0x401, 0x1e, &(0x7f0000000140)="a4f69ecab1ec49e9f12eed365ee9c066ae0eda7ba5161b16073c2353e402", 0x1}, {0x7, 0xd3, &(0x7f0000000340)="f1e91f20b21f750a51d9fd7242a725f188043f8cd2163c7d544172b9ed7f5afbf078f83f5ae8ed4ad5ac856ef6086dba79f33c46a56e73f7a49081e3c769aa47a34005ce09455ddd5a698917173b266856a63fd99b728a652abd63ecfb18caa1a8e514bbbcdc3d657e83d9e71c46a68cb5d02363172514bbd191cc80aab0b477ee5541039bf95eeaead30c5f2218fb2a1a4d30c1593d923473623b67a17b2d11c1d536d8e25cac20fba1b732e574b2630a3631f35e98b98ab640d4665c012ff9395a6d1d4110844a9178745efbabeaea5666a3", 0x1, 0x1}, {0xfffffe00, 0x50, &(0x7f0000000180)="1520d129e27f4f94c455c316b4693432d995f7a48f74e625751705d3dd8384a29ecf7ed17d1416b3653bab694b0cccfd7644190db498485172e50826266f6691a40e5be994f1ee4c2ce4fc2a9ce2ce5d", 0x1, 0x1}]}) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001040)={0x20, 0x52, 0x1, 0x0, 0x0, {0x1c}, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}]}, 0x20}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) r3 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f00000014c0), 0x2, 0x0) write$6lowpan_enable(r3, 0x0, 0x2b) sendmmsg$inet6(r2, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e24, 0x8, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x41) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x48, 0x14, 0x509, 0xfffffffe, 0x25dfdc01, {0x2, 0x0, 0x0, 0x36, r6}, [@IFA_BROADCAST={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x4}, @IFA_RT_PRIORITY={0x8, 0x9, 0x6}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x1}, @IFA_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3e}}, @IFA_RT_PRIORITY={0x8, 0x9, 0x103}]}, 0x48}, 0x1, 0x0, 0x0, 0x40020}, 0x20004000) sendmsg$inet(r1, &(0x7f0000000840)={&(0x7f0000000500)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000780)=[{&(0x7f00000005c0)="f80e4e3057cf3d04e154c03015fad738f3b1f235c2edc2512051acc44ebe15b5dd1f295dda82d1683c137f48e6353b52c7f57f3347629c8dfb3df16e015d3abf118ecea24296c0030aa35ce960", 0x4d}, {&(0x7f0000000640)="afa7f87e7218bc29b71f0607805b854d88e2fb53036dabae1613396fc964e687ae01a7cc3b6c27ea870aceadd7e0b611ef0d3f442c567742e153ed6dc47ca06af9dcfe70f0a513252db89ee6de91a6e43ba09a13137c49268a0a7df6eac02671d15c1061c92567fc3d40115e181d0d114c16", 0x72}, {&(0x7f0000000540)="c06b2c6545cb66055b55fba5d28520db828acdbd904af0a9d813077772be39824ae806add7c0ee84c8c617c0", 0x2c}, {&(0x7f00000006c0)="10ae48f6bf8326a3020efb824f9fc34ee04371420b7e888b429c3da28e6ac83bb0b1ca2e7cd9941a180345ace4791fe93e2fa73c455c985132c1b6b9455f02f1c784ca75a842e1898e431295bb510c966e6dcaf2343b178de18bc2657d757acaba0d3769e81f5e19c59d6587f6898f15c419a572fada831d2d951657df5562a603b8e49a045717d568274fd15aba60c9e436974237b7cc27eb691529732a75e0", 0xa0}], 0x4, &(0x7f00000007c0)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xb0}}, @ip_tos_u8={{0x11}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0xf}}}}], 0x80}, 0x40d1) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x421, 0x4, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x26d2}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_LINK={0x8, 0x1, 0x3}, @IFLA_XFRM_IF_ID={0x8, 0x2, 0x25}]}}}, @IFLA_BROADCAST={0xa}]}, 0x50}}, 0xc080) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000880), &(0x7f00000008c0)}, 0x20) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x1a, 0x6, &(0x7f0000000980)=@raw=[@map_idx={0x18, 0x1, 0x5, 0x0, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbaec}, @initr0={0x18, 0x0, 0x0, 0x0, 0xeb, 0x0, 0x0, 0x0, 0x81}], &(0x7f00000009c0)='syzkaller\x00', 0x0, 0x0, &(0x7f0000000a00), 0x40f00, 0x1, '\x00', r6, @fallback=0x38, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000a80)={0x1, 0x1, 0x5c6c, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000ac0)=[0x1, 0x1, 0x1, 0x1, r2, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x9}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000c00)={{r7}, &(0x7f0000000940), &(0x7f0000000bc0)=r8}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)) 16.495891533s ago: executing program 4 (id=8484): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x10) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x4}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={r0, 0xe0, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, &(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xdf, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000180), &(0x7f0000000300), 0x8, 0x100081, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000400)=@generic={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x18) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r1, &(0x7f00000004c0)="73ace89bac62de00e4be57b33863436e656f1b22a5ed63c58bf6973c619b2d6fe4ce3263299eef618d33e9d9b4cd6303e705a1e61e412443966e22dc190da347145163073a464ebe607ad84a2d961d3006551961d12f66618b11a02fae2fab950abe29ec13ab9ca4ccf4f9c0fb914e40c0aec85b778084d3b1ebb4501b3c4c1fed8fe08eb0a595464e474b8987e71d41297e63edacf07818f201a440ac57fec57124424ef5b1e57c4067e009ac2192f91faf963a7bc823e8f30f2f895f53eb747161072b47fb7f82dbbba069bbb79e30dddc36647985101f916e7faaa7616cd063e170945f3ebd452dbf8c0d7652e17550b890e5096260844dfbd025c0cbd55f88269005fec31356d88645c903784f5fb104b7eeab8d4dd918c41272ca7417882bb5f8a1224482134153e6bf540bd8f457ea6e273c35727bab90ef56323f2a1e924da668ea5265b8a1a52b8a4f7b83149b1b27bcdab19e7b83f5c27bff306a779846eaa205876307834a4af82b28fa06952db5f9ea0d5d82d37b878ebeb4b03590901ad66473c7c0c84848e5aeb3d1d9153f4f87582493d0332c9f2cfd8afb1955bdc43b9e73269c5143c6919183fe0e41edf7fbd2fc117b013613886943b72e276c1ce0ad3793612fe62352f09696c7b1431820c4daa34be264783ee871a6bade9a76ca57395256b91d0b33cf9b93a45fee11c176794b40c4cf44f2d94d42ed49d3f9d53563f9b8d31f0ca127d727886c6b0d8cc07e3500ce97724ea064584f0864f9eefa09d0940181d573cf3b66c35678c5985593d488adda7e53198e0c176c737eb4ae95870e0ba275cd2fcdaa021551688112c9ea02ee59b21e814a8cf7c183b7d41eb8b18339daa9fbdf429ed0e7b369908f694ceffe1a87ab945998ded4c891df97d96eebb6bc553b5b21b7973a3177391889b75e2eeb2462f351fae52a79468acea6e3f34b0c76ccc21aba016e6f1f966a04d4b1adf27274c03d1808cc6ad90aa76fa1de70fbf60e1ab78478dcf0c79460320a454ce3363f8e3db5845692d1c8c55a20f1922eee002606b3d039428822bad05144575d5db88ace6104c9a23d06735cf68ba8a5d8f0136c46629cdf0e749e594cedc802a86bf5134c98e974975488400011bb6e012e063e94352b3fc972740a286203802b7dd43c0ccaa4c70c25d612d8014739e7f5a6fa045dcffd5988160e19d409dcc83598042d3329a5566745251fc3883322b696d1aa3efb787263616c92ca474b4c736ff6cbca86df558bd5127d8d42e4d9dcb66c4defc942f0cd150a55197ca512887b86404ae4e099628b7d4258045a7574de776695015235203b6d2166e90e8776fd2d9253485912241dcd0c57fcf8eb9e9dbb43ae368264c31704f1745af789b4c3caec1409f7c62c0728f2d38d95c9e4f25f16cbc4a5192aed592b541e315aeb8a211f098efd7d2696e06da3871eefef3b88dca2f2c09d100385d7f8c2bb2d4134cb9b6dcfb9bfbcac31ba7bd3eb5499018bdafddc02945b2e2b8be37534ace99facf972d0a10920abc661e27f0fb3fb1867e06bb9b688839e21539dd18b2cc142e8e74d31c8d28eec10c7ecf3167eef0cbf8d999f363217e67a25ee5bfb82c21aee20b3a2f5676c6d3200934b1dbf1cafd6ba22424b77aa1fa99a2b67c138f36bc384b96248f79e639c1860bcf17242562689569b4d62ac2b767f30b1b778f7be6a6e2719b92653d9ecf05b41920966b89bfd7907b2eaa18e6abd0b7183a37ff7359a1876c761fb9c86f0a831af33e5d67b6227458030deb6be8621beb2f8bc36ed4541440a2fe7d0d04d766095fe1c0645238e78ad93e72b6a911b95fa92b02c5491a90dcbcb447fa56447f3b9ca48f9b844775e974d20eeb777075f0a2be2d6b710308faecb5ab54f1d1d116434d2ef537d32b458c4c4f1fd0bb940dcc73dca7a6caa0df6bdfcdf94adfb42aa7c402e894b842d3f3d70e838fe8fef9c8173035957770d368aba57e68be15d5c298801ae244cf26b67db7796940314779a9358bca05ee94e714ebdf7abe1644fb6deed6f2153b6bcd00ead7c70223d84260a468359b2fbf2b5a7d24a3a0864d46d0fc868a869a08c1c88bf6bb738a78d06795d846584595c3dbfb40cf800ef4b5f5aec4425645b66957605f2a06c4e4437ae6b17c54708dfe2bc5cf8178b7b3326d6339d834793792b6a55f2363784e70bfb4998986ce88ad2b1b538c28d138099306b7002c72b718fe2497119be3e7c6e8e13e6cc4d6f24c35448e08a059c29ef1d42ed82d4d6a9d8b8b3e0a33b4f6b50bff40f5c0c2f327e5ba45fa093d72fcc03c6a61c5e6aab06c082b68d70b770ecb00cc9f71a3dedfbe9a2a2b4d27a433682ffdd563479a291b9e5e2ca01160945c935fa21f5eefc8c13a1d8781412c773b3fb3928591572d10f7010947c6d9111f9c6d5bd521c894bbc1e74696438bb7433cad41cf8e92d099b21f7389503e79787fee91b4b5e07f98abbc0ff035566a9b64f17a6a8d0d1075d694e3760c2273eca1e70fe87ac5204f8121e525d5dc0868dd4f56d61956a8b0d32dc29c942f42ae541a2c49d00bacd0557454e78ca8d4ec49747129f1ed22c611b72433411b7ff91650688788f8d6d2c6939194a6e7162450a750d11cda0037913cf0248b894e5260b872ec6df0591a888005603d14d885604179ed5b9c319aac5357a358e6adff857574f2a2a35f08666e7fe802982b8e569504055b18a0deaa01aa914dca5250d390f0ee6e244fc47080300dc654bdc351cb32dd64db3c17d10ad91b9f1da053d2d68e33650d26eb0a41e0cd726e9d13f82125aea9259fa33f51c035801b92f778c224b2a2f74e86182add995f12c6f993622360eb6c6e2702050c4137aeffa0272f0768ff6411fc454142f9caf78052c3a3fc3b5447d60b175834090e283cbcc102da869544a125d586de58d9daf03f34de90c64291d428d700f7df505d106ab49fdcb6bfc5c92e06d137332807111ebd58a6be3de2503731e09a5678ea620ce5ccfbc15f1b05d60722a5b7d7bde6b19c38fcec1400b70e69bbf37dbeadc48d1ef9c84865f8c75cfe288c38eb6279a4b68591f7b9cb91839f77fa63cfd9710cbcb359db07975df56cb2b1f463dccc367fabce4e48fbafcaf27ac3e4f48b50ad14578bf5d08cc0e65ddb14069e9bdddcce34ac64ee15793f167328ec447139add08792c97d88d439dd6aaef7e9c373c2e55e356c5ccc12ece444daeef9f37f5a5945818240b42da84499964d7daeea3f63b9b498b01c85190d5e9919d2dc172cc02f792df3f8f3a7f25dfe7784b56b795a12d2691965de533559002e875353701dd69346b6b23a7fd4d6f12d25caf8756c3efa59b3c04b9fb2ea474355abe3c305bd4121835e31d1691716703281533f4c3ca3151807cbe903c9bf49d72a6c4acbc882ccf7c0d10c82bea37026839a1df18013ca2588ced904226bdd545b5b9ff52f1d2ae080ae5827311ca14ae60dd1a40d8476b517deff326cd73d7db23f3cfef2982c4ea206385b07eaf0f9dd00c0fe9e34d78202277d49b57e7ced3c8b635233374f084d1ddf9d865b3b746fff8032d49cfde21e677e4b87fbecc24c245763e63ca3809c80837d14429143a7c6c1258c12f66d8ccc0eb31db5255b1e02bd05e1fd1995e7079f6aee1c0b887fe00f5df5ce124393ac2309c2938e9327ace44b7ec5756067fbf68e12e26f315e5ce6e241478eb314e93c74e11828dc257b2fa46397f9cdc5cc80d0f5e4023ae60eb76701f8956959694939ad2014987f3e144226b33859c92da16fd2129914d759a1296c8ed56ecbe9a81d7a9e03dd36fe5eadde36c39feeb6c5ba4b5593d4757a18e8abdd4b1d30b7d038c197959bace2e39eafdee381baedd611e814befb6463db75ebeebc2cf5a07fe45e8599aece5a2fbac6d69ad0495f15a5c5fe69df66d141f8f42ae11a99d0bd5797ea2b04f57cbc439cbfa4853013c420fd8c6fc98e72a4032234759f2067830e30f9472ca454eb18a171e3732e6319d9c71443b138fac0e1a256db2f1f261e0283ca508cb22dc086f0bf3b9b17cd898da8ba7d4206ea923280db12417344d03b5901ec62b0b8a62c73c38832e0cd2dd61b2e95d7b654ded958fc581642ded9df7a1fc6ee5202ded6d02ffc9e5d015ba72824a4d9f3e89837249fdcae381c62fa7ff0a9ec68577787bcb33597993bce7f0e97c3ced5ac5a8da827ea93db7e69bff18eab3fb8387fd639cd50a94f1220f74f31ca26eeec3f1041c4f6eb5da3f1afc121ebd967bf2f93f8b8d67cfe02233e87ceac2d38ec5bafce80fc239f226338019342b53af6d671061f1b61b8f1f7ee6439250112c720c9d81364bc643f4620f82b0a11f8cb71969b5e7317a558c29ae931f3142d6543795d8903e5aaabacdf583401704c9c4d0428f15f184ceeb3a46dbf4ec08c4260a523eea159f296190189957cb9666e4e786f246bbec206b1e47dfa45943981de323f6a21150eef703b8b4089a3ea636ac0c662924f2dd239b7fb859836de5150c494f263803a800b2e3ab6b7dc86e83416fc99f0349a2eaa75ecef31f8395f39b8cf3b665a70d5b0af973763f949f550be25a1f5b0606c5f6fa403c9814e7faf81cedf36ba02984bce2753ca3955033e65d38a1eb018ff03c3b26a36c33308d89c12ce179266a61f9dcc8babd31b979a39e69220dada64dcbe8d9567b83f53ef724e512c5c29992ab97609d4d1f3f665d098cba52faa3a412e45a7166e85c4315d75577b78c8154d111082d0c17e5d100a5ff8595d44b04172cdc21378519e85413f0a0bf8e90a365b8e88c4343d3885fd54c873e16dc6c7068df95f0b3c0a6160ace4b38c165504f2edc516e9e914aa8fa412dd5f7828c9475fcf01b2aebb550d179191a1653be4bd724c024a549ee84183d09d8b5db40db3d8a7f8beb7191ab4f21edb73897a59f377c941e2a0df7bad8c577e47179eabcbde3d1f2a5e18ceb9ba7db8388f3a4bc97f6ae21b841d467fa1cb6d93bb6e3f73e2dc3dce11fd3a52f5a02846dc7be983b46c46af1aaa90854f4855b0de35252e35905a718f66154251d1260c594424de4d28d52ff0bf2a294faefa7b6e5a9079eb3020b3be3306a7958fb6f2c39bda124031807e1db5682a065bc4797aeb43d4dfcca019adc9fcee9b5c1bf87fb7f8431610874e6f280f9b504a7bc4fae0e8aa94b399d70b6df26e10c974d810b3f7cf21880b57c6ada10cbf200c68e4d8effe24d0d9445f3c9df808b80877fb24f8218b514f4e5efbbf7e0e76b9ee9028e0427cc10c9e9cb5440c30253a902166b5974955516f2d059189d95dcdad7a4b5ed7fdcd6d7b648f01bb17bd6c7d3697ca271c67d1098db8d9951c5cccd61ac8e2374f07a1b07ce4e1eb72154ba813c69c7a2a9aa8b4a6560436ecf5e4c27576e1d662f654700e54635fc0a5a2d6869ee4cc65a9899476d0143ae447818668a8b3c8d216ba239f9030f8f886690d03ba28b7dda57985c6ec98da21a44fcff1d75f9c7c86f4b386e6417af82dfe3b2f8a8910508b9fcba14803d370bc36f65d5c7685e88dd8b6925eaa5dec8c96a55e159a6ea469858dcd613e9b29c5e92f1261d23d7647f6911bf80b26543a98c48e21fa007105a247916f46ede062055d384c97c5f39ec9a0ece43cee881a7fa2e8c6746ecb310549c712b298c4a406a856e86d3380a8509d798e764e6e9ce9e4028f3e3c9d04b746900f0eb5ddf50cd4a60fef19f61e2a8fb4e2c5f136bdfe22120f8664835152065f653665cc0f909"}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x3) close(0x3) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@ipv6_newroute={0x44, 0x18, 0x1, 0x70bd2c, 0x0, {0xa, 0x10, 0x0, 0x0, 0x0, 0x2, 0xff}, [@RTA_OIF={0x8, 0x4, r3}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x1, {0x4, 0x0, 0x4, 0x0, 0x80, 0x30, 0xb9}}}}}]}, 0x44}}, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)={@cgroup=r6, 0xffffffffffffffff, 0x14}, 0x20) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0xff, 0x0, 0x0, 0x1, 0x2}}) 15.471047537s ago: executing program 4 (id=8502): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3a6168654", 0x6}, {&(0x7f0000000a80)='\x00\x00\x00egS!\x00', 0x8}], 0x2) r1 = socket(0x1e, 0x4, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) close(0x3) bind$alg(r2, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast6)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) accept4(r2, 0x0, 0x0, 0x0) pipe(&(0x7f0000000180)) recvmmsg$unix(r1, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000003100)=""/4096, 0x1000}], 0x1}}], 0x1, 0x400122a0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x84, 0x20, 0x0, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, 0x17, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) 14.483413871s ago: executing program 4 (id=8510): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dddbfb, "", [@nested={0x104, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac05}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x41}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001940)=@newlink={0x50, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x8, 0x0, 0x1, [@loopback]}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24048800}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_TX_TS(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000003c0)={0x1c, r4, 0x1, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x4) 14.293636074s ago: executing program 4 (id=8514): r0 = socket$inet6(0xa, 0x2, 0x3a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newtaction={0x78, 0x30, 0x10b, 0x0, 0x0, {}, [{0x64, 0x1, [@m_ife={0x60, 0x1, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x3, 0x800000}, 0x1}}, @TCA_IFE_DMAC={0xa, 0x3, @link_local}, @TCA_IFE_SMAC={0xa, 0x4, @link_local}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x78}}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$kcm(0x2, 0xa, 0x2) r4 = gettid() r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x38, 0x10, 0x403, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x10d39, 0x55223}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x406c406}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000002f40)={{{@in=@empty, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private1}, 0x0, @in6=@empty}}, &(0x7f0000003040)=0xe8) r7 = getgid() r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r8, 0x0, 0xb, &(0x7f0000001180)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r8, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYBLOB, @ANYBLOB="080003"], 0x78}}, 0x0) r10 = socket$inet_sctp(0x2, 0x1, 0x84) r11 = gettid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) r16 = syz_open_procfs$namespace(r13, &(0x7f0000001780)='ns/ipc\x00') r17 = getpid() sendmmsg$unix(r12, &(0x7f0000001b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r13, 0x0, 0xee00}}}], 0x20, 0x4044014}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c, 0x1, 0x2, {r13, 0x0, r15}}}, @cred={{0x1c, 0x1, 0x2, {r17, r14}}}, @rights={{0x18, 0x1, 0x1, [r16, 0xffffffffffffffff]}}], 0x58, 0x800}}], 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000003080)={0x0}, &(0x7f00000030c0)=0xc) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000003100)={{{@in6=@ipv4={""/10, ""/2, @loopback}, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@empty}}, &(0x7f0000003200)=0xe8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000003240)={0x0, 0x0, 0x0}, &(0x7f0000003280)=0xc) sendmsg$netlink(r1, &(0x7f0000003380)={&(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfc, 0x10000}, 0xc, &(0x7f0000002d80), 0x0, &(0x7f00000032c0)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r4, r6, r7}}}, @rights={{0x18, 0x1, 0x1, [r8, r1]}}, @rights={{0x28, 0x1, 0x1, [r0, r1, r9, r10, r2, r3]}}, @cred={{0x1c, 0x1, 0x2, {r11, r14, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {r18, r19, r20}}}], 0xc0, 0x4000}, 0x802) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r2, &(0x7f0000000400)=[{&(0x7f00000002c0)="2e9b5b0007e03dd65193dfb6c575963f88a8", 0x12}], 0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1={0xff, 0x3}}, 0x1c) 2.986791466s ago: executing program 0 (id=8589): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0xa, 0x3, 0x87) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) listen(r0, 0x7f) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x3, 0x100000000, 0x109, 0xfffffffffffffff9, 0x2, 0xc, 0x2800000000000009, 0x6}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_inet_SIOCGIFADDR(r4, 0x8915, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@getnexthop={0x20, 0x6a, 0x501, 0x0, 0x0, {}, [@NHA_MASTER={0x8, 0xa, 0xfffffff0}]}, 0x20}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) ioctl$FS_IOC_GETFSMAP(r7, 0x40305839, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @remote}]}, &(0x7f0000000240)=0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@map=r7, 0xc, 0x0, 0x5, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0], &(0x7f0000000440)=[0x0, 0x0], 0x0}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000500)={0x3, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000004c0)={@fallback=r3, r7, 0x0, 0x2030, 0x0, @void, @void, @value=r10, @void, r9}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000280)={r8, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x40, 0x101, 0xa3, 0x9, 0x80, 0x2}, 0x9c) r11 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_sctp_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000000340)={r8, 0x7, 0x0, 0x10001}, 0x10) sendto$packet(r11, &(0x7f0000000640)="e8b7", 0x2, 0x40, &(0x7f0000000200)={0x11, 0x86dd, r6, 0x1, 0x0, 0x6, @local}, 0x14) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRES32=r1, @ANYRES64=r11, @ANYRES16=r4, @ANYRES16=r3, @ANYRES8=r3], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0x4c004) 2.920757414s ago: executing program 3 (id=8590): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) (async) readv(r1, &(0x7f00000003c0)=[{&(0x7f0000001200)=""/4137, 0x1029}, {0x0}], 0x2) (async) r2 = socket$kcm(0x2, 0xa, 0x2) (async) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000100)=0x730) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) sendmsg$nl_xfrm(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000080)=ANY=[@ANYBLOB="c40000001900f3fe0000000000000000fe8000000000000000000000000000bbac1e000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000b86b6e0000000000000000000c0008"], 0xc4}}, 0x0) 2.747129043s ago: executing program 1 (id=8591): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="bc1400002e00090027bd70000000000004000000a51411804b8a9f750c996372b5b14b3a91a3ff88cca5dd0d428ddfdd02a37c0b93bcdade6c5307b79c2d122f"], 0x14bc}, 0x1, 0x0, 0x0, 0x42804}, 0x300) 1.910675874s ago: executing program 1 (id=8594): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r8 = socket(0x0, 0x5, 0xfefffffd) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x2, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x5, 0x20000000, 0xffffffff, 0x7ff}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) ioctl$sock_kcm_SIOCKCMATTACH(r8, 0x89e0, &(0x7f0000000180)={r4}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x3fff, 0x25dfdbfb, {0x0, 0x0, 0x0, r13, {0x4}, {0xffff, 0xffff}, {0xfff1, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0xdc}, 0x0) unshare(0x22020400) r14 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r14, 0x0, 0x1, 0x0, 0x2) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x70bd2d, 0xfffffdfb, {0x0, 0x0, 0x0, r3, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 1.872841025s ago: executing program 3 (id=8595): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f0000000040)=0x3, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x24, 0x3, "7339f2f30455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000"}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xc, 0x1, 'RATEEST\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) socket$can_raw(0x1d, 0x3, 0x1) (async) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x7, &(0x7f0000000040)=0x2, 0x4) (async) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x7, &(0x7f0000000040)=0x2, 0x4) setsockopt$CAN_RAW_FD_FRAMES(r2, 0x65, 0x5, &(0x7f0000000000), 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) (async) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000380)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000002100)={0x188c, 0xd, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14c0, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xffffffffffff2fed}]}, {0x14ac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x20, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x8, 0x1, "fa3d1de8"}]}, @NFTA_SET_ELEM_KEY_END={0x11f4, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xc1, 0x1, "e6025a7c3057f759819fea67fa64343d5d5a699a2a12931cdb3f9c1e9ffc24f2de0b029ae26542c8fa178b0c1f5efd9e6c34fd7fa46c4467599fd9698c43c733dbe8140cf0cd3121a9b1c91ab1b7ebc3b72f9a01aed17ee49b63193bc01dbb30f8df048468ca01ef6b3db0fb76e2da12a31d351135f150a7853593e6fe08df1228ceebaa33945646aca6a4f67f7d4d89ffc48b3f3f13a8b40545d5feba4bbab32460a6c3cdea22aba43a856ba418b6549bdd7ac2f76e37a0e46d5c93ba"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "42377bc1dee3a545923fe6168156a52fdcadbaaf5b4682095fcd7c253dc6c6d2768ceff871170869816d832e353441e9b45352aae0ef71d84a816b7c7ffa75d1ccfe9f35dea82bcce239b515be15946e98cb31239ce4694cce1e0b22d8559a6b09538e2ed958f7fbac8bad5681c5e2c0d27670fcbfe8ea1b6fb673bf44ec5631e22125ea1f1daebec756a73ddfe305662ff5d71349c682340704eb1404ed9d1135a4cd1b14ce64f7b07bca2253be7f95171bee790191abee0ad82580d2d9f1ed9fd2cff00519cb1d020fa0d8f084fd58c817a2643a4de4fdfe0fd5506505182016779cad00d1f5a942067548f152d731aea0743095212a66f82fa993373a35b1fd5f4d9ff509605b0ba9d5c4c5621c0d0c7b2e80bc1c008d5d866565393f6bdf307e49aa5ce95fdecd6f5fbc9219636b49c9e359af83f056c48a806f02765f2cd0d91139ad3a6ba12f42dbec1b69616f35003cfd90484255df765690545b33336abcbe102f9f7e4bb110e7053a6362b9c906f1fa62d7d79c68f1f307f55b2e6e0399a94be4d3f4dae8a1d81c700d0607e8cee4dc1aba1e5c90453a42a1f81ec684ea26cff34e4beaff09f35752b4e813f30fb670384ae099e800224f57e7a57d9df62e1648ec3cdf82601ed22777cf716bed5cceb490590b30abc3a51ec583b7a383cbc7c4e111b1e720ba798aea70bc39cccb378b7b94ec187aa759b54ee592daa4747e03f457b9afa9637714dbcfe99cf7221230ad0e87f8a7774ad2ffc68ea8a7492470c83d679614a2c6d12adb1c541fc9169eaaf6bcdda6828907fc511e512c05490bfd50cdac3ac42e693c46b6bf4a2fc126229c93c2c978a6c162a0a4a7b1c11ae1358ed594c58cd7e7f98a0fe0256b1956b1a8de182e3525cc0036d846b8fe63126a415809eb1f293c3744e2c25644893b55ab3f5c541d5717e5ded2068803c38445870096455af9573667b692b60dc2b35c9a19080a2bccadec1ff267823e90c830468d249656a31439a778f30df3edff3207ab96f61f63be7ea8b29290d77beb624f2062d7e9a389242cb2ac7a97148e461619b5d235be6628fba66107e8e006ef724467e29cfa1834e3fdaec81e750fafe26191d42a355006c96fbb6ce7282cfccb1096998067cfcf588fa54a0b847254c53c776b6407cbea4bf293f0cdcae8935339c352ee73dbdf2dffbfc65d9b6b366349fd56cefc689fee43160de924cb867da73d978e3d09dd6fac20d5317d37e2c2eb5bf92bc61752d9bb8e2ad0c803b690764d78eac83e2f6b7fa22911ade603c105e28a5b229f9b6314bbd38ff1c3a6f7db82374138c0795414d34286930bc79a6677ecd6ae548b69d27350c63d6232a84c2af01066300fa6e8f8597da068a0ccae7e179d4bff42a8ab129d59d7c1f40df04c6e129070c4869080776cf23509bfdf659d1a8a9ba7ebb19cd3498a63d9301622a92987734f3cefb61777212be7885b448932f3e2beb180f4dcdf66614c8e65c2b0a651ac2077355d183a9cb88507fcbb5a3e9e2d5286fb137012cf658405ac5c31e5eff23ca785bf5f2758457c806cb46aaca4c1c17207a33344608fc3f012f260cde3d738888b3b392019d2d90e764fb4e2603dd06c185369faa146754a5900fec0fdf1f26f2dda57416f72fa726d1ccf01f2c48f4dbdaba8731dab37d16e40a7b8c45fe651235feb95b614603ab9a5fadd029a601efbc5955d67c9999d2f2c03c4bda8df9b4af8df691dee0a10c17a5f15dc6666e8eca1f7bc8f0ba9f9d69a9e40d98343256a015727942d6c33694469c529754f978c19843af137bd0a5625c09771c0035e7d67aa95fde7fef239204e75d7739341a372f4a840527174adf19b2d462d8936a58ee7c9de9969f7245be21365d054d20ac5349426ff08a56ad4a4fdc7c35a043376aa85a0157c9dbb7f92f04b18ede3088ca8402e47b8c1e74f5064c4d8a5bf20d0c1a85410722481e71c951de9a1a844f723614c159deaa40fcf1cb230965f11635eed6cf50bb1c1c565058ce73ce5021da8212903c63335c00b43ddd2f28e0c830843df540e80cec40ea321644d296830480f603d910777513338e7df090c3ed1f61395498c84f82858cadb10829a2974c8a86dd47e805e396528530cd1e58b16b3a5a392ccaedb60f5c0e074e758e13e9149eb3b2448b5a186a186a2c9636acf9f1845b8d2238142fb6fecfc2ad5d2ce2ee7f82f8f4a1c2931b4a6e61a7c3afcef9410e01f20f3c58fe72c89d6354943e8be8bd2a75944926e72842956e553813227ca30bfe80b07ee2f996fae0ba106c034e9794692bf65a919649b54dd991f03c96b15d0130671814447828a26b3fcaf2809a09ed7e7328e6e413e61d6055d32c01ad21d9aa6fe4e6e4904b6917382752d53f1fbb80ef3aa54f8c98ec1a462450067a68333e79f6caf059f44fa323fc869d3a24421722e91f17b59edd865a15062e23a4b08572c339476b74b2160a8cb98590a93e585f6e955bbce7faf7580b6371a6746ec9d2e3b58ede2598f91338ad150da633bee8318ba1fc7c60ab7cdd4475d4b75ddedb07e883ce7c0c529002d06e1df5501508506b918cb9875cdb2374cd6024050c57c3f0d1a0ccf071d32b97f9fbad9f5ba9106696a70af4137a06a7decf806109eae5897e7d4c1e2fed7bc235e873b150dcc9e5ff09cce2c724c9cbd1be76b80b30ddb808df7ddf74f8ec8441cdd897d05a19ec772d1b930b49ac68ec27298c333c946f33e96116c9c3af158bf2278876e4afc1631a409ea071d081543cf8eb737a0e3f66de6ac964e4ca274471f686a8238043188aa5e64caf4e71c7945c7c6098fc4afdb1d0231d088029d788024ef172648e6c40c175d84be96388e65bc54abeafc753cf7b382cd1da2df3be19a7caca971182adf7166129a7769255f5a32fffd273a1f6df02f3a00dc3585ef53ed2e21e8656845f4ff962013c2506d634e2aa850e2c99a66c1ea965aa42055839e8a2ba4921aecf25a1ed1d75c126c68b556b052e7de51c99180c8e955b81040bcb1244fde3ab1372cb29ef001dc30abbd57093b8b5c1b72a1faa13494edab3288aae4c28167a77317f43f23d9253cfd7c429588cb51480602749d59516169ccdc55a13cca1d947b65edce61bb897e0a838f5c7a9585e0afaaf1c852f18e8a614d1ce1ba4791c1c346b652160e8918336edc037c4bb313d112617a1cf1bd181daef897fd05ed3cf3078e02481c6f961acaee669492ea7b9e8ae0faece929891dcb47553ff53ecab958e4131e0986be14821b195876b86fd9a3a6db034a0c6981cd6091eea3940c4656d08b63bf70d0f7aa1962b55e1db36754a762b86ccce453e94513fd0bb14849dc42a0ce750c664121ccc5849275737b838ea8a3273776a757396e6b71aea55c815e541046a02eed2d6c30ad8cc6fa77612cdfa5d1e03231fb425ec25356f5903f5331ed0a972dfcf804e9f2dc8d36ae9149aebec293ff31b80e48fef33c00893da2de1a4549677a6a8bae39249fde777a3daaf2bf42c494184f2ebc6b31540c22f78e856ed9f90a145bf761473f6fb813d47e9633eb1395390f7acbee1d6c4486ac2709df6356db50783f8b3c9bffa88f41805b083fe71e8815ea7cc636f365a6a7e80f30b9b741556c2b4bacdbea6107a587876629ee2997ba204ae12116d3a4988ef87d90d3308a5c2440cac0963e16ded328dc3f94c00fd06148796b3411ec123d9a47d18939fed342883a0364ca17f9e4800956a7e3eeca3edeaf71e6da8e1d0512c88792a8a75560a98adf9fd496823a8a9535f31b1c4e549615d1baf90e813fa1f53f44815ba392418cedbdb67bd6add60e601bcc8623a97c0cc98090cd63210bd12ffcb58768602fdd45059109058c34d2558a232c8fdb8c73d6d60a2a182dabcff0ed81ec228bb91986a4f506c32b2273190b82b4f91d78c8efb287ad52f757bc6fe990d8ce98461c37236fb82306796b482f3231f2b50aa8d11764965ea23be487496baee5908002a7e59e576ef9da9dba1a045d362673dd6d9f301759bb96117e5d5c059a376cfef4f229351fb57fb596ad8228225a2a2e06b39dcc1927ef9872595faf7565f333f509bef2e6ff27c3d0ef5481541237c704bdbdaf2b18ee07c86b29ff0823b5961e4b8a806921501e32085f093844033d9625f5a422e5f9fa652d9e347f04b3b3c9390ea1703aab6eda922ec76fa19ef2d53799f91ba422e374a13c994ca83bf18044041e7506494247d654eef6d4d2de82a187ef5e16d2d50143b7905c3c67536d4d383609bdfe8c0122e9c44ae5df100e17e34838b136baa11604869debf906ff9e44d15b10baebbba0a19f21cd8b831dc16111963d4bc3d3c29abedf2bd9a9864991a14050627ea81b62bbdca2fbb256b30796e5f468b397c42f6055986db34c26b20596f0ee822514966c806626896a3978d55d2994e20b71fefb67ad96c62eaf43de4d74302e7f91e27599f12c2a275aaf66dbf52fe07b1244c0ada0bf13b265c56237b37e18f5f102e41f5204d6adf2f0220e619fe1f26293bc2e780ec4d3d43cd4774ac2398f253c6e96c77d1ee8da2621df0a817df813910109f8dba2579f4f93de9cae798a589006d72a57add85ad2212487ced0d4f07da94f9f5eb17d5738092ae8ab08c91c6006e4f351390d675cb976abb33dd1837e8d568c71cdcdc592baf60fbf96d56d9c283019f7c2878f6ba7f267e2e9e770280aff51abd188aecb679dca10a14df7ee2a996c9eb0809173a9ceec1f526b2907844796bc81564bbacbc1086781bf1979287dce615d65d3d404fceeac5e6bb6ec6404c7835daddaf19cdbd694dc123ea2f1b0725568dd9246a1818858b778eb3fc8051af3d30fc5b21e60b593eafb806f7be7207d2cb2e27d1f1ecdc4fc7552f79d1c8c50f9c9d62710d78e17358e748bb61658a7147870a155fb67e23492efd5b1d48afa7228a7cd0d2106ce526c4c94e51441bfe05f154f7aabcda376e4b35798298cc075f963db3c4374a601d934f9b6ed53dcf5d672fc5aef24e310356751df0a98a71a721b08ccf3221a8dd0ff4aed2ef57f460467bfae5e18f234381106e8d06c0b77078baee0ad3ba929c03b5f1fded12f2d72109e297d70a012e505874b6600bf0cfeb8c87d66cd79217554ed526926a7ca993a94f27cf7c20997c3a0161477d460fba9a43015b6d968fe0d550e32904aa01e0fec88d9279a679fadfc821d8a1bdcb16e3487f2e30600d3daa61b6a01cc4a86175b9712c8692aae2be0c41355d3ca5365e8130f0d50ea100bbf77044216bb3242ac85396c7122a78d6ff364ad1fd5c4bb4feec92c9662c575646ea200b422cdd80ea80250e74a64b10d4185d35571462477862d29e59867e69877eb2e636e68ea86ea9ee35598636df0282ffb17b0ca134774a4b15d723671d6e8a788b790f5983de8d7749f12a0610154e50a97d6e654fa9d4a0c917c8cc818de132719e3d2daadd3687c0c7d193ee4aebf3d83ac85aa19c8122879692e450b6c3fb839cc735a713e29190a4ba5f3e244dfdaf374902bf48a023b8d987734ebd0300b3a5cf066519797f8a0c0d92717545fdd61d34fea768953eac8e85f8ed795eebb3a9b6d2418027412367229db5fedb22783229541e21d9f7a4a284427545d9274b2399e276ae401bc6bbba0fc70c33f87a0c49624de885cce4883614a7f2065ba15fc680a5dd07721e30e4d053d6a8996d4c4e77ff66e5d963be2cad42cf46203000854c3439654f2255aeb5f84b4033c272d448ffa5e78"}, @NFTA_DATA_VALUE={0x28, 0x1, "0681d60f8f216c6843db87e6f0610b22aa72a2fadf37c2a65eeea6c70c5f35461596a4ea"}, @NFTA_DATA_VALUE={0x6e, 0x1, "ed827530e361416bd39c1347ae17f0470e7de6b213f4d1029c33591f810408edf539aed080251604e6d2abe87c27656043a7da4af0e010395e21f8db4fd952a2f56fc6a97e1dbb3c3b8341e79e47fed3402160fc3847f6268e0bd3e3ee13f3faf3fcadede6da3e95adc7"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_USERDATA={0x49, 0x6, 0x1, 0x0, "f11c5c29345e156283e2ece43e68d567d4ade34357809bda246ac9f50aa2548928bfd382acb8aff636e8315ecc9caa8096c66b9c924fb47e21b7e9f420a86c55e05bdc4317"}, @NFTA_SET_ELEM_EXPRESSIONS={0x44, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, ["", ""]}}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0xc, 0x1, 0x0, 0x1, @fib={{0x8}, @void}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x36, 0x6, 0x1, 0x0, "16311b63bcfccf4f86ea5cc85a4d70cf4205fdcd98b5f49da6e154a23b23cd194cfe6d67f5a8ba4a686f20a669cc9ebb76c8"}, @NFTA_SET_ELEM_KEY_END={0x1a8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4b, 0x1, "3c4b44c61bd135074cd6ec245f3471fb8fc25c30e3561f561c9471af7adfbe3b9fe1e70633a93b907efcb7261c735c2bf3f95219f6cf7a3b92c573ca99da38d99fa95b0ca308ce"}, @NFTA_DATA_VALUE={0x9e, 0x1, "a3fafa17d7b56e730fc3c51334dbee783c9bfd92e0496a80b55c77a9490cffa278de957608f3bb57e41b04ea849e0662ebf04b9248e2d3cfef77769cbe61b68282ef051161082bb4fc6f6c7bd821d80f10607c33d66e160f96de8e7e4e787102126d390bf29c4742c99d13dea841d352538137b1a330035c7fecac48adb4c83feab8baffe962d9cfe9f36af45efa11eef4aa714ae07d5e8a97fc"}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0x74, 0x1, "4e93b3e9a267035b128205a41c55222cac180f5600c87b63b7b92ad40e40b583c980ba956bc400aad121a3572b0969a3783493f2aaf751aa635a33ae2f9a9c9836d9d670f98c894066bc3d06f29f26cb7b514689691f1c6f398c036ef39697b863c011f62dc10cd4a0d01d76190564db"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x36c, 0x3, 0x0, 0x1, [{0x15c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_KEY_END={0x40, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0xec, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xf}]}}}, {0x18, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}, {0x40, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x10001}, @NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0xffff}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x1}]}}}, {0x28, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LOG_SNAPLEN={0x8, 0x3, 0x1, 0x0, 0xfd11}, @NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0x4}, @NFTA_LOG_GROUP={0x6, 0x1, 0x1, 0x0, 0x2}]}}}, {0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0xee}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_CSUM_TYPE={0x8}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}]}, {0x20c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY_END={0x1fc, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x94, 0x1, "9c1f9a596cc551fd43c1f9657af0dfaa00a8bcd31ee04fccb386ce1d34b9ec2c417f0c063f510917e7e898c80c93cd1a5f60ae5347da17aa92bb47b15dab5cd0456cd95b5f294e408523f25346ad251baa0d6f5da6e01c057430e9b2dc2ec10a69fc1657e5353fe4e86a9c69f7b23152a1c48fc8a7545e24cf2d0781711d902f8a42c1ffae9c7a7732d4246b05d44613"}, @NFTA_DATA_VALUE={0x102, 0x1, "af3ab61c543879ffa61576c8ab32c182b778b0479269353f02b218bb39f16b95e768e6e12ca185023c16bc38231c49c61249c3ee15fd054753170791bd6af078fa245cc504d2dc98a55446a4c7303ed258f036f14b586652d3b98b928557f42941b99b5f4ed7b06009219bc1198268040715947513c21cb5046a019415ebce76307cd08e5d52a254b8d00ab6934bd3f3a6b565dc33deba721a93f7f31ec2d16a612538505c114afeff45c48b56a996f7cf475d9218a4570e9f3a974c861d75acc9de378e1ef687a80019103e4198f273aa40f9c27baf33131146048147bdeeb23cab1f27de33b07c1a66f08a1ee62c816f71ae87ad0a70d78d5337b601b0"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x188c}, 0x1, 0x0, 0x0, 0x800}, 0x20000001) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, 0x0, &(0x7f0000000200)) writev(r3, &(0x7f00000002c0)=[{&(0x7f0000000080)="290000001e00190f25003fffffffda060200000000e80001dd000804f4ff0800ea11c21d0005000000", 0x29}], 0x1) ioctl$sock_proto_private(r3, 0x89eb, &(0x7f0000000000)="c4bdf51201f66dfe7e6b2ee07fed7b85067a163085e17b64a7087874ccba0a") (async) ioctl$sock_proto_private(r3, 0x89eb, &(0x7f0000000000)="c4bdf51201f66dfe7e6b2ee07fed7b85067a163085e17b64a7087874ccba0a") ioctl$F2FS_IOC_SEC_TRIM_FILE(r3, 0x4018f514, &(0x7f00000001c0)={0x7, 0x9, 0x1}) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=@gettaction={0x74, 0x32, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xfffffff7}, @action_gd=@TCA_ACT_TAB={0x38, 0x1, [{0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x311}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x810}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=@gettaction={0x74, 0x32, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xfffffff7}, @action_gd=@TCA_ACT_TAB={0x38, 0x1, [{0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x311}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x810}, 0x0) 1.619062553s ago: executing program 0 (id=8597): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = socket(0x2a, 0x2, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f0000000340)="4700000001003f", 0x7) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, 0x0, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x35, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, r2, 0xb0260000) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r1, 0xc6e9f000) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r3, 0xffffe000) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@ipv4_newroute={0x20, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20, 0x20}, [@RTA_METRICS={0x4}]}, 0x20}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9722ce62fcb86b15086d6e9ecdfb2c22b45a8fd62d54ce101195ddf0cb2ece707e1a5f98362aa6481e83958401569507ee06d449b1d515d96d7990a7245d3fdd1082b4acdf6d5a396f9f956cc5fc624e119d17fe4b9c49f37591c34477a95f192219a94d3eae8bf45d8cb1b8bd03394b803bb3f0e213ee6e", @ANYRESDEC=r6], 0x140}, 0x1, 0x0, 0x0, 0x8001}, 0x8804) 1.514792767s ago: executing program 3 (id=8598): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f00000001c0)={0x1, 0x1, 0x1000, 0xb, &(0x7f0000000100)="959ede5b91e3eddd7c652f", 0x4, 0x0, &(0x7f0000000140)="b1edb584"}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x19, 0x4, 0x4, 0x7ff, 0x0, 0xffffffffffffffff, 0x7f}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000004340)={0x6, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000540)={r5, 0x8, 0x25, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff27, 0x0, 0x0}, 0x19) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000080)={r2, r5}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, r3, 0x300, 0x0, 0xfffffffd, {}, [@ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x5}, @ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5, 0x7, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) 1.453877527s ago: executing program 0 (id=8599): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000100)={@val={0x0, 0x88b5}, @void, @eth={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @multicast, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0xfe6d, 0x65, 0x0, 0x1, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0x21}, @empty}}}}}}, 0x26) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x28, r4, 0x1, 0x0, 0xffffffff, {{0x11}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0xec0}, 0x0) 1.347970626s ago: executing program 1 (id=8601): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0xfffffffffffffffd, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x1500, &(0x7f0000000140)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000600014002020a600e41b0000900ac00060211000000120012000a00ff110048035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x0) 1.304125923s ago: executing program 3 (id=8602): r0 = socket(0x2a, 0x2, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r1, &(0x7f0000006380)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x7, @private0, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000001840)=[@pktinfo={{0x24, 0x29, 0x32, {@empty}}}], 0x28}}], 0x1, 0x8044) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x40000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xf8}], 0x1}, 0xbf82) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xfff1, 0xfff3}, {0x6, 0xffe0}, {0x10, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.226353438s ago: executing program 2 (id=8603): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_BACKLOG_LIMIT={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200040f0}, 0x4890) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000ffa100010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 1.172702307s ago: executing program 0 (id=8604): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400000000000000000500fffe0900010073797a30000000002c000000030a01020000000000000000050000000900010073797a30000000000900030073797a3200000000e4040000060a010400000000000000000500000008000b40000000000900010073797a3000000000080009"], 0x558}}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000002e00), &(0x7f0000000200), 0x8, 0x0, 0x8, 0x0, 0x0}}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x7, 0x2}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r2, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) 1.056745009s ago: executing program 0 (id=8605): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x332, 0xffffffa9, 0xfffffffc, 0x9a, 0x6, 0x101, 0x834e, 0x6, 0x6}}}}, @TCA_INGRESS_BLOCK={0x8}]}, 0x60}}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb88a820008100400086dd67c172f500304bccbb649f1503510c0021fb763aff00000000000000000000ffffac141481fe8000000000000000000000000000aa040090782000ffbf6554d03a04008801fe880000000000000000000000000001200100"/123], 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0xe80, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) connect$inet6(r0, &(0x7f0000000600)={0x2, 0x4e23, 0x0, @private0, 0x4}, 0x1c) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x2, 0x20, 0x8, 0x6}, &(0x7f0000000140)=0x18) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000001c0)={r5, 0xa, "c6eb27205a2186e9f251"}, &(0x7f0000000240)=0x12) r7 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r7, &(0x7f0000000480)="1feca5a54deea716c4bde8daa4ec1a74d00e190bd4d677414807dfc1e5aed3892607644dd57c0dba50d8257adae00c2769ce28fe91736c3163a00c84b3cec1b5fd88ccd9bda93d7e71890c3cf9a69021899b35ae44806f467b2995899cce1eab0c52285204b5fff99364f10265bf9b51db9adf4693c75f6f57188250476cd3efecf8287b9c8e2f2ee7487d00433823c672bb6e5c72fb5d", 0x97, 0x48000, &(0x7f0000000540)={0x2, 0x4e23, @loopback}, 0x10) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180)={r6, 0x5026}, &(0x7f0000000280)=0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x1, @ipv4={'\x00', '\xff\xff', @local}, 0x7daa}, 0x1c) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e22ac1414aa925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 997.116446ms ago: executing program 1 (id=8606): r0 = accept4$rose(0xffffffffffffffff, &(0x7f0000001340)=@full={0xb, @remote, @bcast, 0x0, [@null, @default, @rose, @null, @bcast, @rose]}, &(0x7f0000001380)=0x40, 0x800) sendmmsg(0xffffffffffffffff, &(0x7f0000002380)=[{{&(0x7f0000000000)=@xdp={0x2c, 0x5, 0x0, 0x34}, 0x80, &(0x7f0000001080)=[{&(0x7f0000000080)="d8f2a831432e307a083aef5d215bcd83d79e4f979187484c4f0c54c208c66594fc1e13cf4b9ea2b2348e1492cedc0dd2a5a9f7d725e12763ccea0e011a5556718369b5c0074aaff40ee770199de42aab17e90315bcd348e1113f83ef2bccc12134015fb50da85ab57bf629b126d2b44cf24a417f0e96fe026905e11f90cd9ccfe9ef9a29673d3568866e1e904492147fb3161727768e76024659d3be4d08b69a98e593c91a4b5726b780ea06f62bc98f7ef7dda67803d71e62c490f8045d5a5c27b545914fa6a647686f3673081ca85f81c014cfd7bbf863093ef7ee86a3ab7ef870dd30c7c55d62721dec16638d71183aec85aef0129a877669ffbdf9bd639ee2ed37007338705fa0def2cad9d0047d96a9ac703e35ea1300a3d21460ddc0d19208fe03878f64765f8c27d3f2a315710664d01f4d54dd5ecf57952f0e761b7cccb6caf6d8ef81920d451fba63e89a41bbfcd9dc67f49fae11bbc6d9c381541cd3d8538ee1179459e6d24a00596820d2532fb5e1f9ad23399a731d018555fc7980910e5af9a91fbc0223896b7f806303dd02d51e9cd9402e3f632a0c8832ed6eed14d2e4fa0a8eac7ac5232daeaaa6103be132332022488e5526b7df100f4dab996708339eb08a361f6f1474dbd9e076486e4d507115db85cc7e7bd45f59087c6951562b6db17433389e7f06f3c26cdc2a21b8d950a7eb990cdf0e89a704e423f37f382102b47339d8a198a8f7faee33351659156bd440e0c4e87545d59855c27ba11b17d82166d99fb9ed0fb19f1f3d1b18135d221f4d00961789dd4c447bf462351bb17107bbc0a64103cb9eb04d5e6c9b7458d83cc3fd820c86242241917233632e1c0a986fa8e90118e83591052cba236fe4162964e4653b9453c6bffd1df067ff01809c6058c8ae06ebde9327a1227769343b210ceca61024a4c1d6f2e66d92c2dc684ccd4e15af7dc7f0b3dd0558f02a8fb842eba0ebfdb44efa70cbdb119b9640dc7ad7c3857fd7deb1c45b3ff6dae717ca9db3f33b008fa54278a8ca65e297b58ea77e62f4ea0ebf6773d8bb928179ccbae3b4bb8c0b5dcc0faa5c05c2beebd224a8cea219f7e604b57193631ad125b124d9d3d5fd689a9d05525616e97aa8a9bc111ca950fa5b7e617ef7d6828f70f2d2d085701797a773b35d1d18aef949db227f81c01d822eed6abe5db5e1e7e30bc40b8f312aa5fefd88024e304ba49ce890499b64db75d660f527bf271ce0d36d52f5ab704bbb1579c5f5629735b926f7747aa0c3708c0e87f6db300381c1864c565efa30b05dde1462fa10f357ed6e4123bcb31a31c5ca888c5b18ade3466e2ad108fbdf09dc88414945cfb0ddab7f0ba74d9bd27235fd0db71b421e0bc77c90ed00b47137a2815c33ad3ddcd10535e1c0ea59b516c56c0e25a67c85cd3a00348eced5bdc51ef697f154e2c6d0656673d649902e80b0380b77b6bb98e6f4f10bf46c3623c9d0d6f613021c2cca2305c461af0ff24512dd7576e6c89e8436ca19bf9797e828cbcfbbd76afa6028d8bbdda44703bd0e979e9b361f3a483966d29a820e188e9f2b0bd5f14fe250351908e6c0374567d3c34df6f777358346a5b907bdd12a604c51baacf84ae93bc837f8ac8eb9ce4b2939cbc718e5327eb049174816c17b36dbf96a5acb72d092389d72f853111ea171b4297cc4af587c8fcc46477ee7ba3626b8eaedca1dcd4c10116379c340b0e4e022c4bdd24e718ad34c9095350b31010d0789c4ccb43833860ac9fd2c4d587c1f3d8e5ff05b4f60543a397003cdd700c53b692de5188ce9188f1769815c1deb6d43e6e74bcf593ab7faf41fb6c2e97c2c35ff337c4292cd347d34cd86cc30bba3a0af88bb6f421207b23acf6114a24bf3d4b720ee1fb12e801cec59c13ef98bd3378b372eb0268de1a1a576c1580290c86b63ad459325fc062439f74251b132868630c14785b2fc225bca2dc0930d43d06d6053494e8d1efdee4e7519d97a7a5ba8d01c2bef216ccb392aca7c1329e6e2d1ac7e2536fde178f9243ac8988198b809e7d4192828b1791ca93703e342494670b2b17e12e0a4202cb4d6901a4b96acfd19e0148945ea2de47eb66e6eb0fca0f69b89b235e5a644f9430410d5cfa18e1c8e7fa0fdb7b9f50c561f5b277d09dafe51f059004fa64ec27c5c2db7e808c68fc4f688fdc5702f87bae8727c3b27c7f5842f2c1b7f36e536059b6c52955cb22a43b64ebf619d94b10e22ce3b3d685e24fde235f94c14173c93fbbabbc9b9115fe3ddc66aa57e6881517a2897fbbfaacace7c8b1076f6f347157cbf528783410177da64002c0cf1f8302e6479757a035d7d44c363b27c20271f2bdcd0865255aee3d73a12ec1155c8080d0db0c1a2462a63a787265049458717ce1180d0387d806de39e5f7f37474b93a748e12621c4c4dfd923fb795eca82026a6e494a160d9467aa28b4952649da3371a8bb7a98e767aa112afec50e2125900d6f3dbada356bbdb46fe5b495ef5b425ac58b0baa9bf87659f27090f0576804aa317ac8efbd037a15a0b27dde73940afa43e8ee0fc1b17c8e145649d68193007d2923611c498cb3577e9ea5538375cb3aa79e53a2633bef106b87f3e7a75eae3b6f27b75da5ec83ed3e8559a04e50ad96c991bc8ff57b8cc8f55353be0e7febd2d74583690391b11a4be54b2df0e767cb3ea8ceb4b84034f41df7cd608926c6b6fa9535181bb2e538b30676b92f5af781407f1b79260dced1f6eb406d2e4221c94b073c95d9d1619258adb332ebeafdd927141199a3e12eb277c35c855b8143d6f9fa13aca8f585265ed6f89cb995afc3fd7b8c1b836de7b0f8b5d3931597504c4b2336d540b784d5014b6a91474cef0c2098239cace2eae3ea6dc62c8f14950af24724c4b483cd90821b210a0d009f088d74c30f5f6fb5f92880569d0b276b9a148e7e9a0cda919118594076ba00496fecda1f0213e415668c6445ea4dc779dc0f7640e2bef1bb8f0d2341e8f4fe7d0962ed30915bf6dcddee8d2ba863caacdb4db19a821eba7115c6bbc38345c9685d4f136d4b5e87c0de35cb1c3164f683d31ed40480dffbf783b37e956211974894f138fd933d18951b32001a8df6c256b13d0a392dd90aeb943b9c6aa8ef7fbc4a6147c6e75fa84eeda3cea4a67a0067bd2baf97529a1bbc93b3a3cf4e7d8bafa74f6e74160a2539498a105318c3d9c18b9384cde1c9674421c2e5c7295c1da55dfd0cc57c00a35f0bfb5295af185f1b018df1d0a11d19c6884369a40e7823bcdeeb1869e989935cf18bfc7aeb8c106a0d51d88ad0a3c619deadbea69f783e9913558f266601b7ecbc8fde68629b4a0db8aca6b5556dd198854b41fa35458f213f681b20dbda354badff9e149850f8a9af842bdced95d60c7c906b6c9e3c6dc5f0c33bc05b339b48856b0f91451646469281b12fb6d712df3f7ddb1e9fa630302a71727668bbce0b620aa6663cc0bfd2b7bba996a27fc006d3a08ca169dea3591f43f9992fa866d2e0e88f5a7928da529390e4b0c97810c299d3eefc948ee1cca665f9634f92cf0fd98a800459744442aa3c84868fc8ef5eed5000ca8273bb5b010baffef4ef97393b0d0253f56b7ee7f16439a29f4e6135b7b9af84809a163842169e8a74834ccc3d4b9fef008fbbf9b5d8ffc511de0fbabac7839833813cd36888ddf30e3e8a7712938151bc37c88be4368c64671e868ced07fa6fb0ae8b572e51d043613757b483f2126e894adb9913878ddfd45fa7c6cdc921a92199ef013623483a3c5d4acf34fce60977c6a808d97f41d6cd35c52c60dfac864b455fb5336ca0b3439bed786ba3c2c56b66200c40a1b1543559765e19864b8f5a3b3ec935a4eb3af2995b9ef461cc3405348b7ea6d0dd7cb8e91a7c989cab12a0429138a1a6fd2f0f5138eff865ef1f618b12b4ea7a6a79434b8952c25820e315f1bcd833e23a17c3a85e0a90ed6b8ec044c96d980c44dcd7feda2c74d877ab427428c848382b2001489c4fd8865d56fe8101d363f2adf0258f3fe07fe11bed6d8c3e6249234d15d037175844cb1a9c5c0d42c766ec56bfbc7583ac3af75baaaedadc2588f1fc08640b7d9187409da9870fc98de5202272617bfde0f7ed9720e6ad06ba852cf0766968bb9851ca430c363203fd520fae19dd0276287df3a38681b660bc5e68a6a7d8842181bc3e470e2296531762d921f621143472c3ad9df80bfa8860755bc18d2f6ba4245db89ae4df53e4ed4d6081d9d0c8a6d72e60cd6a7173f97c42e29138af5431a0e7a82df028e68923b952d6b4062230776cd3838fc691bb3d265df0d2341257ec5d69be5ca4d5c47493dd78dc9684ae31aa1c8ed56d649de9b092a573853ed1bb140432f0d41cc7bc582de9f499110b3522c783f2e4df4da7395d56fd83f49f196b00e57562b1cee89fcdaadddebf9604a945969c0f176843d215eb4bae54aebfb93d4a51152cc1cd89c2939c56c640354a36c41d439e470ca384ab96f5ad473b2c97dd97b0a1a6bc9384f2025578237660d562778e72056c853003bc57687a89bcfe445fbd494144f3eacd0dc55e110f89b6aef7bcaeee8268331d832d79c8b865d61b2742e7949be7023b96ecd63172ed7e61bc7dcf541b11969abd361a98dbd415694531197bd3fb83b95f6e7580927f932f7936879cbc905a061950f39a9c1b2f99eef6e69dfcded8b1262cab707072a9f81898e29ff9197f186b76f223a29376509409f9e344ba8d0e5e5c9fba6a57c016d33365546862565df946d101039b12e6e47df7943821a3d699480d4762718be3fb661e8a02cbd9e56e853cca26f215d457e1d985015017f2c2498880239731e88dc63df50a06b4e394e5f21619bca78dc29e4571abfe5175d026358ec61c47854a24ee04efdfe19ac23a6cd168427a71be84d03a6c58dcefc032da14b48017a9f339996fca35eff3311843f0985026603606853bd4a28aa67efe2a59c0a5fcf601d448a11ac7d878a4ffa86f833c308b97ee81cca72abfaf78c0ad4216ce789beafb91d5da3ba12b91e390f63dd1c7a251108a9fff96b250272e84665e49b827a4e97e4712589f65e092d0cfce280d8dd86c7cd0ed599a58e8331cca520360e1c207027525274bc6bdb28e3fa21284b03fbabc890dbb390a631b76496dd71ea1ad753934ba9512760bab9ff9a5cb30e887d12a931edf44b67cf3346e754381ea41bb7fc23593f68a77011a439527ca22bda98df94e38f0a97ca6f02838e13f9a71a2ececaa08544ef8c5c64ef9c602bce7fcf3d7a4bd8abe7881d0717aadd81780d6ed140d8244279e14e19acdf1cb68bf1ffb67f88cc98c4af859783acf1444a4d44e92df584d219b2c456685578294a6a37a04359fbadbcd1d221ecf589fa8190af4ed52d72e7c06e03a36fe1412d858343dd6c8c409aef1f0f5a07ff47fbe5e00ff0c0833b4367da0f63ccb3464df698c7e192f15943652b7c443bc4c8ac90ba7c098e183f4588e02ccf79e676ca613db82d570a9e0ab34333321bf3642fee7c756791a67c1535b57b613649c700d9794133512934739a2b61b106c4ec448806a7123ac9df7af2c6e16d701ec9415f33a9fc47cc3a154e717bb849b553e9d5522fef55ca495e9f04ea7f4c44ac824176937250d4edfee97050c28bf84aafe230686f5a37ea3f844b54cf66490812ff95a5bee642474067126950531feda582ffc15066dad6f5d723d0e7335e25cd7e2e945fa9031cd1e48d0ba0c82cddccdb895a86ae416397c153aee8a604aca5e2dea", 0x1000}], 0x1, &(0x7f00000010c0)=[{0x28, 0x11, 0x1ff, "f1a3070bb8b83bc735e08df0a655b5c5e4"}, {0xc8, 0x10f, 0x0, "e2c72b66b3b12d98e1078d3936fa274780edd821b88c7368c2a1326d183c44e2c5160257a1a5b05c1111d5728ec52971f286d8940f72665610cdb7e881dfbe145c1dc315f715db268db2f827cb7385e93979dc9cb5fd3a5e7d47f5e0e3493868da62ce561cf6afc5ebc78a5f0776575d971f067e5712ac0bb096aff905669714cbe2ec759a509df2bb20c5eb9a37feb1f3ef6c31cf4d99a4d5e7341feb7823c13ae57ac3eb781c91815aafec078b6a2b2dfb209702bc"}, {0x88, 0x108, 0x1ff, "7cce79cfd6f003e580c5e30f1fb4d2858ac3caab6d4c286ed4b2fee5ac693839624a351afe51e28a5665038f7bc2e0837f7d250d599c93d545023320ae1a5d04eaf98914761b2cfdb4745f7a0e800e655cd2092eb663379ce35b565819f79f2095f22bac79c53ff01d394d537242f7d8ee5b8cde"}, {0xc0, 0x108, 0x7, "65724536940e7f6e89c4033589781c8949c1fc2da1752f0a3b22e94adf8fb74236c343e74476951ce2729f84e2af40d7d04608e1319fcb206fcc73be923a971793da1eee45ae8bc77372ea0a50bc7afcb13bf08309ad85b085025967a1b6476a00b838ed9b41714542cd97618e024f25adcefb6efe8a3c985523af9704c31005816b9976ba00b25307d447473aab562a921c989338b0f5e33ee3d417cbf037de387d83adc951a110cb"}, {0x20, 0x114, 0xc165, "62765791c78c9995ad"}], 0x258}}, {{&(0x7f00000013c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @empty}, 0x1, 0x3, 0x2, 0x1}}, 0x80, &(0x7f00000016c0)=[{&(0x7f0000001440)="11554fbb280a1ad0e22e0162f638dd842fff517427b0decf0e1112c95b1f4506d6372f0fe5fb73b7de58bd15dfb7c0269206eed39eaa86e2fcdc31443e0184bbac8a", 0x42}, {&(0x7f00000014c0)="2d60ab049b952b5a6cea0fd0d61a7551e799e4d413627d2a24db27a080e4dc55eeead69fef8c38ad7aaac76a2a877b251864ae502860df82b60d5c21a82587e9f088660c63eab7cd4daed2c0220c7e9133e4d5a2b00403ce6e4fcaa12bcea5ae53fa63f576f8ffeb52918b0c16f6", 0x6e}, {&(0x7f0000001540)="d4c1228abc25449953f7c4c2a9e251de6a719e5324a0f0371aa589e8577989559cb9bf12edcdbffe0c64ce5916d7aefdbfd5fec2094d2317de42ad1bb3a4b4b4dddac2ef494a6ce25c970422add832040ea6cb79", 0x54}, {&(0x7f00000015c0)="89a7aa5d6f5a39b5b21e91ec0e2cb6d756b3ec043d64ad4731de953246adf525b1775efd7657c50111a7ec7d1d49db4f2d0a336989dfdd2e2a88025c1df7f10ba085e96411fde2a2033ce01a8d5f9960e4e407981a9816a2f25cc8ef10354cc809b49269d64427c399647ff282612cbd8f2aeb9f3b718f5c56b730cebff4d39e14f1a573b58244762e9f142e7fd5d4c11e0928cf725efc019ae06a8627b35d6b70259635a2e307924a946ca9384490617a54e1b0b9e5f2e27cdf115978ae6cbd495c63fc452d42580cdf1cc4a6276be72ae271cf1c04f00dc10691", 0xdb}], 0x4, &(0x7f0000001700)=[{0x98, 0x0, 0x86, "784e61e6ca8e70668b62ba53a7d51c005945e63d3847db11f97bf145c5dd8986ad3f236c157d8f2e1bcc3b8d5a2a360698822d98390847b41c703a7d512897c2afe37830abb7c5eebbf65bd83fe0d689de81b4ac722528a76a6f4c5dc23fbdde7c596e898ef74d7907e3973fb3cd25edbdd31e0f1cf056d13e681406ea8fbfc781c26bd901"}, {0x48, 0x113, 0x4a, "5042d7b09741e37eb6bcf28d0e0f39e339b30d000432d522d09d2f1021f171d7daa3afc3ab3041ac2ddaffe9e7afe39b7fb57ee9a5de82"}, {0x38, 0x107, 0x2, "345b3570f10a0c41bf0c38350a0a472a2f39ba573022caa57d0c22cd1733e173eb"}, {0xa8, 0x114, 0x25f0, "a942a102c4303355906f12ac85ec80db44d7dfca79c3f8166ed1491b5370d51b6871fa5e8b7465f040b3eea82f67f01ede7691b66dc649c05624e5d4b38ca25241408506c746c1813e939329d6948284e23a39f9dbddccfea4768be3958a66b943a3f6bc910b0302746f0a9a72c2ed2225e8e506d3d720b1400799ed82d80c4ec02d3bd3c7ad852b6c516a98d6f1a616f5b186f7ff42e3"}, {0x38, 0x1597df0d939e31d7, 0x2, "ce60208ce66eeeb12045d16b3d39c2e596d105f20fd25b0c35af2df3c3f4aeb7f5310f5c"}, {0x78, 0x103, 0xf, "6ec5b4356ee836da019c5c4142d159fc14b6bd622d8135f7e0fb7dc89161c177f8ee2d8df645137018328e664346d2f5a16b54841f12c2becc15f1d89c31045c1dd1f5fe6e3455ca8a3253193fd080ec847c1c6f2bf318dac728b63cfecf4fe674e01f"}, {0x10, 0x1, 0x3}, {0xc0, 0x108, 0x5, "ba8f7228d5e1759234ef403646eb523505c4456a2cae4fe2e36bacc8aa60663f87514b4ca7e4efd04df67cead1ce8a86f447394d93211f02108f3b657435eea45c3e9a31cff31a5a3ae6f9358387e31dbfa8be7a015b85d51e46a0694ce5ba383e454ce2f9e8c6bc7ed04085493351de3b0fe2858f4aba93316e24c9526b17b6f34be97c53e080c7cdc61122662e4b7d39b9b18457c70b65ab3d709f45a07cf8c0a49b82856379229c"}, {0x80, 0x6, 0x2, "0a8c01759b7584f9f360631815b09f29537fd81a2176a4651685c5cb3f9dbdb5fda1bc37b1b9da0777d380b5cc1ae2a4b18c0fbcf2b447baec0e7a3835d8e6ff5dc14645f97e202f375088e67a4ed40f53f864e1ae328d92e192b634954c4d6b0dbff9d30d3c769043fb771fa7c6"}, {0x80, 0x10c, 0x2, "587dae589b679f18b90a38bef0da7645337bc7a736e17cfb123de08620f2d33b7eaefa80246fe55b966c9c7a6b00fcca49655c533ce75095dd0ab759809a442ab1b9ddb5d13077844f800022c7fd1754375452ab197df75137dcb919542b9c2a8cc9f6fae4d6fe2beccf87fa01"}], 0x440}}, {{0x0, 0x0, &(0x7f0000002140)=[{&(0x7f0000001b40)="8b24495a486d215a5cc4679e8784e905c2c7fb6ac02e9df1fcf551346d345d5837bbda48c5c45b31478aeb0233be244b60cd1c177387d116a8b4c22399eb7e069255b58744fc9b1f7e8e3ce5bbb68fceb73ee5f35d68b9066b041c1a90af2f15d363c7ef2308bdf26d4dbc2e959c5692816376963e37d6509de21700a579f261613f44aaf1fe302b0e6c8fb12fcdea32f9c8f031c09a1aafa2d7b9a236863344d60fd7656f679f7f18de56f54b16fc684d8867e2b8421f2064241e906be4383e6da9f9505beecb5cddb1b2ec4fff4e29a2bd69969f77c07564212afaab69380a2801791466549c767c0c", 0xea}, {&(0x7f0000001c40)="db2b9c8cf8ad9f1653486cf57ec9608bcee808912cb4ca198626b5812f856ccd30731ea80525a5e01d8b68fbc6104c59c0c22e52a4c0e4317dac6e31813e84864b6f6c3bbc4a240259f5ca5610dc571ae9b16f34dc20fd983b549828ca1af06e172538b716ac7c92a9a8d8901dd3dd62b477346939c4496d80048dcbb90362c6c8a01984ddf0c964be7e42ec60ae2046ab4df6bbd5e24fb160ae7bb5b467dccce416", 0xa2}, {&(0x7f0000001d00)="e100e1a2b70a3285401066fce7cdd6aa54ffeeb24f62698fe534da6b5e194433d11eab69e5bfae502ededbc565d178a081cbc46775adb346b6d4c5003086aa7a69f324682b42ec20ac2a0cf6c6c30094ae82c4ca9e7bbfda649853281791", 0x5e}, {&(0x7f0000001d80)="91ce718c5b665683de001da2d3d26e75a9b15434cf8de75104df39c9692c001110608623a121822c4fb5328cc65b9056bb82ead5e5e8950a3bfe129e77ff831c4433b17dcf352f9892bbda9d1a86b9b49b5cde120e1e81ad07e3e3dfac540adb4cea67c34e9a0db32da4e401b05c0171f5e9b404059df7bc5b614bb93afb65a485770b7101821ced70972420d8d55e26b58ec0f0c5ccd763e1de6bf6adc3d8ec56", 0xa1}, {&(0x7f0000001e40)="562f77d701c74aeba805cce526fd7dc236996e6bfcc7f6ca9f0bbb9eb268a7b9ba6786aa75e30a81327d0b22f426685c530d6b7ec47b3157e634ef36bf029ab7128fca475b4db86192c5ee245af1549339af7cd1dcf7f729bf8cf0c66e1ddf794153797d9b1f866deea07df511f86ef0a539bd4ccef5", 0x76}, {&(0x7f0000001ec0)="5c39502debd07498f3ab78bde91778361226506cfe2be20052d46f7b4e045c2f84c426f633436039071390b5a4361cc77978988298d028f9dbcefb3a6de77729133358caefa54b078de8e238d6cbeb70d808d4f4d2111d457e1f79815d1703aab681a65213751c00cbad44151c237a0cdebc49d6022479a382c0a174bb07905c951f83280f838a46d6a92e7dca90db2b89e4d684922b1b9f2149684518ec82a2beb24978d0a55652546d4bcdb03e2a34d8d0050b326d3584736ae9713e842406106dd587b3a4ab48b4bc8bc570c82713bb173ee720b0166cc7f6a71340636878f1a7ee06fca95fc5beef8c38d8dfc4", 0xef}, {&(0x7f0000001fc0)="f0b5216c42e3d139ae57077da0b121729ca17ade2e9ff5689c27935aceff8fdd051494617d28dfaa7f3dbd1a9d22b17b1975d4296ecf20fffe7c7215c75cc33246ebc1d1bf20146bace3debcc8c3571b0966f4252b8f505facfc5810ba499788dc091f2374d8efdfecc1729f351771ea18357bf5b23ec8aa6e2fb3eade5e3a0d3c283ce85a0595d5e94227ba9b798ffa007c8880f3aed21b535d4f5921161549bae0072292a9c884b01260aa3c30356530c0ec5579b5acd5760c2a1a9ddea330a7332cd4aaf34a10c8ac196a7926997d557d16a46eb8a161da80955f5df96536", 0xe0}, {&(0x7f00000020c0)="a36a7720179d6a316775ebeca86e156a960745e49ef76e5d2b0c6e45d7cdec83bee0f83429ec532ea27ed0bb0893585cda26a96a7baf916188af1dbd4366c20ad6313c0a742c17", 0x47}], 0x8, &(0x7f00000021c0)=[{0x108, 0x1, 0x3, "2606ccf51fac6310d5d50bc968631d4bf1dbf6739bd4544d8aa164cb3b1212999106cb694baa68414d2c02d4e4ca644c9c2da2f8deff1683e8b5c8da94bc6883679cd5d9ead6473dc15617615df605133726bd33101a622261046f6c9d226119268b8d79438115f2287d994cb07acf7dce55c044c683354a6e14aa8552292091abbc87dd4c1b15390a5903d1099af8d42656d4242dc454604982baa849d476a18e25e4d0937757e2e25358a19048f07843d5968725bbf218e95e32e6d1ea41214e9568fa0d92ffcfc22d00408536288e4ce4105be0cecb208e4f9d91d910356580f79d9259d757a0c114c5c5925f9a1453ec"}, {0x78, 0x117, 0x0, "b51fe5f896399ddf81fffc1a2dadbdb9c5b83b03993947305e989e0affdcd2b5292e210cd829b3d5379b3e343d3fc2d00e1fe34c48e90d490afcccdbddeea7e00284c0cde8c4c1fcc7dd8ff388fd4a2a58bc9b1302a45aef760d87c357372b41cf2c160511b399"}, {0x40, 0x118, 0x9, "bd36cdc609694a4107d831fc8e71bf7840ca2f2acaadd0ff0f1bbd277833cefa2a19ff7e6d2e2713638cff"}], 0x1c0}}], 0x3, 0x24040000) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000002440), 0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000002480)={0x0, 0x1, 0x0, 0x4, 0x4, 0x400}, &(0x7f00000024c0)=0x14) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000002500)=[@in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x22}, 0x2}, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e23, @private=0xa010101}, @in={0x2, 0x4e23, @rand_addr=0x64010101}, @in6={0xa, 0x4e22, 0x6, @local, 0x40e4c88c}, @in6={0xa, 0x4e24, 0x31a70908, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, @in={0x2, 0x4e20, @multicast1}], 0x94) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000025c0)={r2, @in={{0x2, 0x4e22, @private=0xa010102}}, 0x5, 0x8}, 0x90) r3 = accept$unix(r1, &(0x7f0000002680), &(0x7f0000002700)=0x6e) recvfrom$unix(r3, &(0x7f0000002740)=""/114, 0x72, 0x41, &(0x7f00000027c0)=@abs={0x1, 0x0, 0x1}, 0x6e) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000002840)={0x20000000}) syz_emit_ethernet(0x32, &(0x7f0000002880)={@random="4fb77e990c5e", @local, @val={@val={0x88a8, 0x1, 0x1, 0x4}, {0x8100, 0x4, 0x1}}, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x4, @empty, @local, @broadcast, @multicast1}}}}, 0x0) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r4, &(0x7f00000028c0)={0xa, 0x4e24, 0x800, @mcast1, 0x2}, 0x1c) r5 = accept4(r1, &(0x7f0000002900)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000002980)=0x80, 0x80800) close(r6) getpeername$packet(r6, &(0x7f00000029c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000002a00)=0x14) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000002a40)=@bloom_filter={0x1e, 0x7f000, 0xd, 0x9779, 0x4, r1, 0xb36, '\x00', r7, r1, 0x1, 0x1, 0x3}, 0x50) shutdown(r8, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000002ac0)={r2, 0x0, 0x3, 0x1ff}, &(0x7f0000002b00)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x73, &(0x7f0000002b40)={r9, 0xc193, 0x0, 0x2, 0x8000000000000001}, &(0x7f0000002b80)=0x18) setsockopt$RDS_GET_MR_FOR_DEST(r6, 0x114, 0x7, &(0x7f0000002c40)={@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e22, 0x7f, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, {&(0x7f0000002bc0)=""/54, 0x36}, &(0x7f0000002c00), 0xc}, 0xa0) syz_emit_ethernet(0x1c, &(0x7f0000002d00)={@remote, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @val={@void, {0x8100, 0x6}}, {@generic={0x8917, "7cecb4655091d33dc7ef"}}}, &(0x7f0000002d40)={0x0, 0x4, [0xcc0, 0x9b6, 0xc8, 0x550]}) bpf$MAP_CREATE(0x0, &(0x7f0000002d80)=@bloom_filter={0x1e, 0x3, 0x6, 0x17, 0x2000, r1, 0x7fffffff, '\x00', r7, r1, 0x2, 0x2, 0x5, 0x2}, 0x50) read(r1, &(0x7f0000002e00)=""/210, 0xd2) ioctl$F2FS_IOC_MOVE_RANGE(r6, 0xc020f509, &(0x7f0000002f00)={r5, 0xffffffffffffffff, 0x6, 0x9}) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002f80), r6) sendmsg$TIPC_NL_BEARER_ADD(r10, &(0x7f0000003100)={&(0x7f0000002f40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000030c0)={&(0x7f0000002fc0)={0xf8, r11, 0x800, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x200}]}, @TIPC_NLA_BEARER={0x60, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xd31}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x40, @empty, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x80000001, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x5}}}}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}]}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000040}, 0x4005) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000003140)={r2, 0x800}, 0x8) setsockopt$inet_sctp6_SCTP_NODELAY(r10, 0x84, 0x3, &(0x7f0000003180)=0x3, 0x4) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000003200)=@raw={'raw\x00', 0x9, 0x3, 0x408, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x338, 0xffffffff, 0xffffffff, 0x338, 0xffffffff, 0x3, &(0x7f00000031c0), {[{{@uncond, 0x0, 0xf8, 0x220, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x7f, 'system_u:object_r:syslogd_var_run_t:s0\x00'}}}, {{@ipv6={@loopback, @dev={0xfe, 0x80, '\x00', 0xc}, [0xffffff00, 0xffffff00, 0xffffffff, 0xff000000], [0xff, 0xffffff00, 0x0, 0xff0000ff], 'sit0\x00', 'nr0\x00', {}, {}, 0x2f, 0x80, 0x6, 0x2}, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x468) setsockopt$CAIFSO_REQ_PARAM(r1, 0x116, 0x80, &(0x7f0000003680)="7ea17d4d605a586b9e03408f87f33076e6f6369df9c6315d3b953231619cd61cc487de19d333c1b8c6feafa0f07b10172edb4ad0bc9534c9a521c349ac4e7c075024a1443303a8049bcd517e2c27d613a64827e09905b04401166bfc8fc2696a75d517080e425ad4982e8db7f6b264b9527f7dd60236cd466ef486bc9bcf067fd5e10707614acf1781b38053427a8152c6f43f00018bcc99a496fdbcb80c6d788a95e755c58e6bfa8a", 0xa9) 886.769744ms ago: executing program 1 (id=8607): socket$kcm(0x11, 0x200000000000002, 0x300) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000300)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x2f}, {0x7, 0x0, 0xb, 0x9}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x41}, @call={0x85, 0x0, 0x0, 0x2a}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000680)={0x0, 0xfffffe2f, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r1], 0x38}}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="00000004006e5c784cdb81272c00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r5 = socket(0x6, 0x5, 0x42) sendmmsg$nfc_llcp(0xffffffffffffffff, &(0x7f0000000c40)=[{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000400)="5afb194ddebc95dcd8839fc0a5ecb47d498a28c6f1629ecdec359aee4b872cc2753b44553912fd97ad3b86df16dd3ba0465a6a68cb4fec9712bb5fe10da4f0e483728ae89dcf7127be9d57662b0c5c94756ee06aa974e31712ef08efca6679a7b4415d06f00ec4d9b6b01ad324764bd4fb736c3d60bc4e528111746972772f", 0x7f}], 0x1, 0x0, 0x0, 0xc000}], 0x1, 0x41) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000ac0)={@val={0x70, 0x600}, @val={0x2, 0x3, 0x100, 0x8, 0x3, 0x2}, @mpls={[{0x4d}, {0x6}, {0xffffe, 0x0, 0x1}], @generic="567553923d9faec0f01da9f4897c2e26d239099d78465093143f7575f46249dca27cfb14da6f2e23a6c57fff1db225a873d5ff19947d94cf74fd9f0d31bf897489f346656a2cb7a3ff0f0000000000003d1e17de8f86e777b665944842550aab8d8371ce0c72fd9276d2e6e55946eea66198c6233e23c1e29c187d058cfa790549dc7f23d8a2c242a2c226929dd33bd33c5e7d0fb17480206ea27a4ae65fd40b73d9303db9ee4926cf3079547626891dc08043d5c16a23cb75bfd9aa16a8d3b73ac6db83bcff3ac2a2cdeee5ffae86fde6505bcadb0438592db12aadb04d9d78f1"}}, 0xfb) getsockopt$inet_mreq(r5, 0x0, 0x20, &(0x7f0000000100)={@multicast2, @multicast2}, &(0x7f0000000140)=0x8) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1d, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b70300001b0000008500000083000000bf0900000000000055090100000000009500000000000000b7080000100000007b9af8ff00000000b5090500000000007baaf0ff00000000bda804000000000007080000f8ffffffbf07000000000000070000000800ffffb70200000800000018220000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000046000000760000006d00ffff00000000bf91000000000000b6080000000000008500000085000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0xf4, 0x40, 0x107, 0x70bd2b, 0x0, {0x4, 0x7c}, [@generic="e84cca12a90dcee052c1ad1b4a9b4b2d2285e89d328e1e4d255eb2bb7863f6021590ed6ef7adc626dbcd388e796092101776c0cb3393ab9486a235c065fe52583ff7bf8e93c0baeaeed6d696df1a2ca905599afbf2675c863939f2c74512fdeb8dbc0c263c29782798eb104d97c75366ddf270ea6843079620d3ead31eb7139ce6d8b1db641fff94ec38ece016c62568b6eb29843a73317a0862cf5e6f19fb1ca05eca416fc02517341efcf2dc8fda43b09fd2b0bd1596f40620c94e550fc89db2bbf127254cc071dfdbdc2edd35", @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x84;'}]}, @nested={0x4, 0x2}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 882.703301ms ago: executing program 2 (id=8608): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0xe22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r3, 0x8983, &(0x7f0000000040)={0x6, 'ip6erspan0\x00', {}, 0x105}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f00000006c0)={0x0, 'macvtap0\x00', {0xffe}, 0x2b1}) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e20, 0x3, @local, 0x1}, 0x1c) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) r5 = socket(0x21, 0x803, 0xa) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000080)={0x18, 0x0, {0x1, @empty, 'ip_vti0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r6, 0x80047453, 0x0) r7 = socket(0x2000000015, 0x6, 0x0) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback, 0xffffff81}, 0x1c) sendto$inet6(r7, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) close(r7) 726.092802ms ago: executing program 2 (id=8609): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000000900010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014002b8008000100", @ANYRES32, @ANYBLOB="080003001900000008001b0000000000"], 0x3c}}, 0x0) 579.890448ms ago: executing program 2 (id=8610): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r0, 0x89e5, &(0x7f0000000b40)={0x13, "dd6e4eaaff9e7199f5b246fb0144c42ce5a861c065a1424a20e8705c8a6d70b593a9c20eddcb4bf2a10b606ce6b400e06c17dc5c2ad6c632a3aa2d50f01ef1293ad45749226b7af96e58d1a92ac1d2ecd704a63548983cf9b60da2d6ce07bb02a3b3e9b1bb016997bff8ff78f44f6371b5c0f58260bf2d27ebbdba58224b0129"}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[], 0x188}}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000140)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @dev={0xac, 0x14, 0x14, 0xff}}}}}}, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 514.279949ms ago: executing program 1 (id=8611): r0 = socket$tipc(0x1e, 0x5, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001080)=ANY=[@ANYBLOB="3000000040000701feffffff00000000047c0000040042801400018006000600800a000008001c00", @ANYRES16=r1, @ANYRES8=r0], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, 0x0, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r3, &(0x7f0000004380), 0x0, 0xc0000000, &(0x7f0000004580)={0x77359400}) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x2}, 0x50) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r4) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r4}, 0x20) (async) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r5, &(0x7f0000000180)}, 0x20) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x19, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x7f}, @generic={0x2, 0x1, 0x8, 0x2, 0x7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x1}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, 0x0}, 0x94) (async) r6 = socket$inet6(0xa, 0x1, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) (async) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r8, &(0x7f0000000140)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) (async) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) (async) r11 = socket$unix(0x1, 0x1, 0x0) bind$unix(r11, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) listen(r11, 0x0) (async) connect$unix(r11, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={0x44, r10, 0xb97534d5fe9704cf, 0x70bd3c, 0x25dfdbfb, {{0x12}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x1c, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x7}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xba}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x38}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40880}, 0xc808) (async) socket$key(0xf, 0x3, 0x2) 335.703451ms ago: executing program 3 (id=8612): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x3, 0x3}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) bind$tipc(r0, 0x0, 0x0) close(r0) 308.585132ms ago: executing program 2 (id=8613): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000100)=@upd={0xf0, 0x12, 0x100, 0x70bd22, 0x25dfdbff, {{'blake2s-256-x86\x00'}, '\x00', '\x00', 0x0, 0x400}, [{0x8, 0x1, 0x100}, {0x8}]}, 0xf0}}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000480), 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) getsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f00000001c0), &(0x7f0000000200)=0x4) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, 0x0, 0x50) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'pimreg1\x00', 0x1}, 0x18) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x2b, 0x0, @void}, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0xffffffffffffffff) r7 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r6, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)={0x24, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r8}, @nested={0xb, 0x0, 0x0, 0x1, [@generic="976b64087c6030"]}]}, 0x24}], 0x1}, 0x84) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in6=@mcast1, 0x4e22, 0x8, 0x4e23, 0x6, 0xa, 0x80, 0xa0, 0x29, 0x0, r8}, {0x3, 0x6, 0x0, 0x10000, 0xd937, 0x9, 0xc9, 0x5}, {0xffffffffffffffff, 0xf, 0x3, 0x8}, 0x9, 0x6e6bb3, 0x1, 0x1, 0x3}, {{@in6=@loopback, 0x4d3, 0x32}, 0x2, @in=@remote, 0x3502, 0x4, 0x3, 0xc0, 0x5, 0xff, 0x2}}, 0xe8) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000002c0), r5) sendmsg$NLBL_UNLABEL_C_STATICADD(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r9, 0x201, 0x0, 0x0, {0x3, 0x0, 0x26}}, 0x14}, 0x8, 0x3000000000002}, 0x0) splice(r1, &(0x7f0000000040)=0x7, r4, &(0x7f00000000c0)=0xa, 0x205cee0f, 0xa) 133.784512ms ago: executing program 3 (id=8614): syz_emit_ethernet(0x4e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @icmpv6={0x3, 0x6, "269fe0", 0x14, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @mcast2}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000440)=0x1, 0x4) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002e00000000000000009dfb78c7699c74e891a0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x44, r6, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x8, 0x4, '\x00\x00\x00\x00'}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x44}}, 0x0) (async) r8 = socket$inet(0x10, 0x2, 0x3) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60044}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x3c}}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r4, &(0x7f0000000400)={&(0x7f0000000080), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, r6, 0x204, 0x70bd29, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x0) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r1}, &(0x7f0000000280), &(0x7f0000000340)=r2}, 0x20) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) (async) openat$cgroup_ro(r4, &(0x7f00000004c0)='blkio.bfq.sectors\x00', 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r2, r11, 0x25, 0x2, @val=@netkit={@void, @value=r2}}, 0x1c) syz_emit_ethernet(0x16, &(0x7f0000000380)={@local, @remote, @void, {@llc={0x4, {@snap={0x0, 0x1, "c8", "118190", 0x60}}}}}, 0x0) (async) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r12, 0x400454cd, 0x30a) 113.338909ms ago: executing program 0 (id=8615): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x64, 0x31, 0x107, 0x70bd2b, 0x0, {0x5, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x84;'}]}, @nested={0x3e, 0x2, 0x0, 0x1, [@generic="6d6343bc6179b13d3ac7633d5a34283482f21706878e2f7267db2aff6ef85ae878f14811f0208e12a45627636a2312b6611e8176ecaf6a13a95e"]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="0e2f11f5", @ANYRES16=0x0, @ANYBLOB="000225bd7000fddbdf251000000005002f00010000000800340000000200"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000280)={0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x80002, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000440)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x8, 'syz1\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7, 0x4, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r1, 0x4, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x24, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x4}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x10}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x5}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x4}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000010) 0s ago: executing program 2 (id=8616): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000630109000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10010}, 0x94) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet(r1, &(0x7f0000000a80)=[{{&(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10, 0x0}}], 0x1, 0x48040) (async) sendto$unix(r1, 0x0, 0x2, 0x0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @initr0, @generic={0x66}, @initr0, @exit, @alu={0x4, 0x0, 0xa, 0x3}]}, &(0x7f0000000000)='GPL\x00'}, 0x90) (async) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r2, &(0x7f0000000100)={0x10}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async, rerun: 64) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000140)={'tunl0\x00', r4, 0x8, 0x7800, 0xb2, 0x0, {{0x3d, 0x4, 0x0, 0x8, 0xf4, 0x67, 0x0, 0x1, 0x2f, 0x0, @multicast1, @multicast2, {[@timestamp_addr={0x44, 0x2c, 0xcd, 0x1, 0x8, [{@multicast2, 0xf5}, {@dev={0xac, 0x14, 0x14, 0x18}, 0x4}, {@empty, 0xd3fc}, {@local, 0xfffffff7}, {@remote, 0x1}]}, @timestamp_prespec={0x44, 0x14, 0x92, 0x3, 0x5, [{@local, 0x5e7f}, {@private=0xa010101}]}, @rr={0x7, 0xb, 0x19, [@broadcast, @private=0xa010102]}, @timestamp={0x44, 0x1c, 0x84, 0x0, 0x6, [0x80, 0x6, 0x35ea, 0x7c98, 0x90c, 0xb221]}, @timestamp_addr={0x44, 0x24, 0x88, 0x1, 0x4, [{@dev={0xac, 0x14, 0x14, 0x19}, 0xa}, {@multicast2, 0x2}, {@local, 0x6}, {@loopback, 0x401}]}, @lsrr={0x83, 0x7, 0xe5, [@multicast1]}, @cipso={0x86, 0xc, 0x2, [{0x1, 0x6, "82ca0899"}]}, @lsrr={0x83, 0x13, 0x67, [@broadcast, @remote, @dev={0xac, 0x14, 0x14, 0x3d}, @dev={0xac, 0x14, 0x14, 0xf}]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x29, 0x0, [{0x7, 0x11, "dc76676401925d4bdb95637cf933d3"}, {0x6, 0xb, "6f546e8e15aaab8e1c"}, {0x5, 0x7, "737fba85ec"}]}]}}}}}) (rerun: 64) kernel console output (not intermixed with test programs): rcv_msg+0x10/0x10 [ 783.454576][T29411] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 783.454609][T29411] ? __pfx_ref_tracker_free+0x10/0x10 [ 783.454647][T29411] netlink_rcv_skb+0x232/0x4b0 [ 783.454670][T29411] ? __pfx_genl_rcv_msg+0x10/0x10 [ 783.454700][T29411] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 783.454719][T29411] ? genl_rcv+0x19/0x40 [ 783.454776][T29411] ? down_read+0x272/0x2e0 [ 783.454799][T29411] ? genl_rcv+0xd/0x40 [ 783.454828][T29411] genl_rcv+0x28/0x40 [ 783.454854][T29411] netlink_unicast+0x80f/0x9b0 [ 783.454899][T29411] ? __pfx_netlink_unicast+0x10/0x10 [ 783.454934][T29411] ? netlink_sendmsg+0x650/0xb40 [ 783.454955][T29411] ? skb_put+0x11b/0x210 [ 783.454987][T29411] netlink_sendmsg+0x813/0xb40 [ 783.455021][T29411] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.455048][T29411] ? aa_sock_msg_perm+0xf1/0x1b0 [ 783.455077][T29411] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 783.455103][T29411] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.455125][T29411] ____sys_sendmsg+0xa68/0xad0 [ 783.455154][T29411] ? __might_fault+0xaf/0x130 [ 783.455195][T29411] ? __pfx_____sys_sendmsg+0x10/0x10 [ 783.455236][T29411] ? import_iovec+0x73/0xa0 [ 783.455274][T29411] ___sys_sendmsg+0x2a5/0x360 [ 783.455302][T29411] ? __lock_acquire+0x6b5/0x2cf0 [ 783.455338][T29411] ? __pfx____sys_sendmsg+0x10/0x10 [ 783.455376][T29411] ? futex_wait+0x29a/0x380 [ 783.455434][T29411] ? __fget_files+0x2a/0x420 [ 783.455457][T29411] ? __fget_files+0x3a0/0x420 [ 783.455494][T29411] __x64_sys_sendmsg+0x1bd/0x2a0 [ 783.455534][T29411] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 783.455577][T29411] ? rcu_is_watching+0x15/0xb0 [ 783.455613][T29411] do_syscall_64+0xe2/0xf80 [ 783.455636][T29411] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.455657][T29411] ? clear_bhb_loop+0x60/0xb0 [ 783.455684][T29411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.455705][T29411] RIP: 0033:0x7fa60bb9aeb9 [ 783.455728][T29411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 783.455748][T29411] RSP: 002b:00007fa60cb21028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 783.455782][T29411] RAX: ffffffffffffffda RBX: 00007fa60be15fa0 RCX: 00007fa60bb9aeb9 [ 783.455800][T29411] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 783.455814][T29411] RBP: 00007fa60bc08c1f R08: 0000000000000000 R09: 0000000000000000 [ 783.455829][T29411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 783.455842][T29411] R13: 00007fa60be16038 R14: 00007fa60be15fa0 R15: 00007ffd7ad40ae8 [ 783.455882][T29411] [ 783.928308][T29417] netlink: 'syz.0.6967': attribute type 10 has an invalid length. [ 783.968521][T29417] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 784.037459][T29412] mac80211_hwsim hwsim84 wlan0: entered promiscuous mode [ 784.111664][T29426] netlink: 'syz.4.6972': attribute type 1 has an invalid length. [ 784.193332][T29432] bond6: (slave bridge0): making interface the new active one [ 784.202129][T29432] bond6: (slave bridge0): Enslaving as an active interface with an up link [ 784.211825][T29428] netlink: 'syz.3.6971': attribute type 12 has an invalid length. [ 784.230953][T29428] netlink: 'syz.3.6971': attribute type 29 has an invalid length. [ 784.248007][T29426] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6972'. [ 784.257537][T29426] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6972'. [ 784.269591][T29428] netlink: 148 bytes leftover after parsing attributes in process `syz.3.6971'. [ 784.284647][T29426] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6972'. [ 784.443714][T29443] netlink: 'syz.1.6977': attribute type 1 has an invalid length. [ 784.579487][T29451] sysfs: cannot create duplicate filename '/class/ieee80211/Ku crK:̥B| lS-!' [ 784.592983][ T8758] net_ratelimit: 71 callbacks suppressed [ 784.593003][ T8758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.617345][ T8758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.631570][T29451] CPU: 1 UID: 0 PID: 29451 Comm: syz.4.6980 Not tainted syzkaller #0 PREEMPT(full) [ 784.631602][T29451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 784.631614][T29451] Call Trace: [ 784.631623][T29451] [ 784.631633][T29451] dump_stack_lvl+0xe8/0x150 [ 784.631667][T29451] sysfs_warn_dup+0x8e/0xa0 [ 784.631695][T29451] sysfs_do_create_link_sd+0xc0/0x110 [ 784.631724][T29451] device_add_class_symlinks+0x1cf/0x240 [ 784.631757][T29451] device_add+0x475/0xb70 [ 784.631788][T29451] wiphy_register+0x1d6c/0x2d50 [ 784.631825][T29451] ? __pfx_wiphy_register+0x10/0x10 [ 784.631846][T29451] ? __pfx_netdev_run_todo+0x10/0x10 [ 784.631876][T29451] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 784.631916][T29451] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 784.631951][T29451] ieee80211_register_hw+0x34d2/0x4150 [ 784.632014][T29451] ? __lock_acquire+0x6b5/0x2cf0 [ 784.632062][T29451] ? ieee80211_register_hw+0x13d1/0x4150 [ 784.632104][T29451] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 784.632157][T29451] ? __hrtimer_setup+0x181/0x200 [ 784.632178][T29451] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 784.632220][T29451] mac80211_hwsim_new_radio+0x2f97/0x5330 [ 784.632276][T29451] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 784.632299][T29451] ? kstrndup+0xbf/0x160 [ 784.632336][T29451] hwsim_new_radio_nl+0xf85/0x1c30 [ 784.632369][T29451] ? __pfx___nla_validate_parse+0x10/0x10 [ 784.632414][T29451] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 784.632449][T29451] ? rcu_is_watching+0x15/0xb0 [ 784.632475][T29451] ? __nla_parse+0x40/0x60 [ 784.632509][T29451] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 784.632549][T29451] genl_family_rcv_msg_doit+0x22a/0x330 [ 784.632587][T29451] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 784.632632][T29451] ? bpf_lsm_capable+0x9/0x20 [ 784.632658][T29451] ? security_capable+0x7e/0x2c0 [ 784.632692][T29451] genl_rcv_msg+0x61c/0x7a0 [ 784.632728][T29451] ? __pfx_genl_rcv_msg+0x10/0x10 [ 784.632747][T29451] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 784.632775][T29451] ? __pfx_ref_tracker_free+0x10/0x10 [ 784.632813][T29451] netlink_rcv_skb+0x232/0x4b0 [ 784.632836][T29451] ? __pfx_genl_rcv_msg+0x10/0x10 [ 784.632866][T29451] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 784.632885][T29451] ? genl_rcv+0x19/0x40 [ 784.632934][T29451] ? down_read+0x272/0x2e0 [ 784.632956][T29451] ? genl_rcv+0xd/0x40 [ 784.632995][T29451] genl_rcv+0x28/0x40 [ 784.633020][T29451] netlink_unicast+0x80f/0x9b0 [ 784.633064][T29451] ? __pfx_netlink_unicast+0x10/0x10 [ 784.633100][T29451] ? netlink_sendmsg+0x650/0xb40 [ 784.633121][T29451] ? skb_put+0x11b/0x210 [ 784.633153][T29451] netlink_sendmsg+0x813/0xb40 [ 784.633186][T29451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 784.633214][T29451] ? aa_sock_msg_perm+0xf1/0x1b0 [ 784.633244][T29451] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 784.633271][T29451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 784.633292][T29451] ____sys_sendmsg+0xa68/0xad0 [ 784.633321][T29451] ? __might_fault+0xaf/0x130 [ 784.633361][T29451] ? __pfx_____sys_sendmsg+0x10/0x10 [ 784.633402][T29451] ? import_iovec+0x73/0xa0 [ 784.633440][T29451] ___sys_sendmsg+0x2a5/0x360 [ 784.633467][T29451] ? __lock_acquire+0x6b5/0x2cf0 [ 784.633503][T29451] ? __pfx____sys_sendmsg+0x10/0x10 [ 784.633541][T29451] ? futex_wait+0x29a/0x380 [ 784.633598][T29451] ? __fget_files+0x2a/0x420 [ 784.633621][T29451] ? __fget_files+0x3a0/0x420 [ 784.633658][T29451] __x64_sys_sendmsg+0x1bd/0x2a0 [ 784.633690][T29451] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 784.633731][T29451] ? rcu_is_watching+0x15/0xb0 [ 784.633769][T29451] do_syscall_64+0xe2/0xf80 [ 784.633792][T29451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.633813][T29451] ? trace_irq_disable+0x37/0x100 [ 784.633833][T29451] ? clear_bhb_loop+0x60/0xb0 [ 784.633861][T29451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.633881][T29451] RIP: 0033:0x7efd41f9aeb9 [ 784.633904][T29451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 784.633923][T29451] RSP: 002b:00007efd42f29028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 784.633949][T29451] RAX: ffffffffffffffda RBX: 00007efd42215fa0 RCX: 00007efd41f9aeb9 [ 784.633964][T29451] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 784.633986][T29451] RBP: 00007efd42008c1f R08: 0000000000000000 R09: 0000000000000000 [ 784.634000][T29451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 784.634013][T29451] R13: 00007efd42216038 R14: 00007efd42215fa0 R15: 00007ffceabe3278 [ 784.634051][T29451] [ 784.722059][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.750927][T29452] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6977'. [ 784.751333][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.774421][T29443] bond7: (slave bridge2): making interface the new active one [ 784.778612][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.784042][T29443] bond7: (slave bridge2): Enslaving as an active interface with an up link [ 784.787694][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.139672][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.148006][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.156318][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.164551][T29458] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.207917][T29464] netlink: 'syz.3.6981': attribute type 4 has an invalid length. [ 785.558921][T29482] sit2: entered promiscuous mode [ 785.580239][T29482] sit2: entered allmulticast mode [ 785.742153][T29498] syzkaller0: entered promiscuous mode [ 785.759285][T29498] syzkaller0: entered allmulticast mode [ 785.931958][T29502] tipc: Enabling of bearer rejected, failed to enable media [ 786.181681][T29526] netlink: 'syz.0.7006': attribute type 10 has an invalid length. [ 786.218469][T29526] 8021q: adding VLAN 0 to HW filter on device team0 [ 786.244879][T29527] nbd: must specify a size in bytes for the device [ 786.264914][T29526] bond0: (slave team0): Enslaving as an active interface with an up link [ 786.799418][T29551] syzkaller0: entered promiscuous mode [ 786.809911][T29551] syzkaller0: entered allmulticast mode [ 787.897790][T29625] netlink: 'syz.1.7032': attribute type 10 has an invalid length. [ 788.094255][T29631] netlink: 'syz.1.7037': attribute type 1 has an invalid length. [ 788.119779][T29638] Cannot find del_set index 0 as target [ 788.170907][T29631] 8021q: adding VLAN 0 to HW filter on device bond8 [ 788.178774][T29636] netlink: 'syz.0.7040': attribute type 4 has an invalid length. [ 788.314145][T29631] veth11: entered promiscuous mode [ 788.329743][T29631] bond8: (slave veth11): Enslaving as an active interface with a down link [ 788.394421][T29658] __nla_validate_parse: 17 callbacks suppressed [ 788.394442][T29658] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7044'. [ 788.396359][T29644] bond8: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 788.521735][T29663] syzkaller0: entered promiscuous mode [ 788.534213][T29663] syzkaller0: entered allmulticast mode [ 788.543363][T29658] syzkaller0: entered promiscuous mode [ 788.549815][T29658] syzkaller0: entered allmulticast mode [ 788.668060][T29668] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7046'. [ 788.872042][T29674] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7047'. [ 789.140493][T29651] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 789.366135][T29683] validate_nla: 1 callbacks suppressed [ 789.366159][T29683] netlink: 'syz.1.7050': attribute type 1 has an invalid length. [ 789.538082][T29688] 8021q: adding VLAN 0 to HW filter on device bond10 [ 789.550897][T29688] bond9: (slave bond10): making interface the new active one [ 789.559999][T29688] bond9: (slave bond10): Enslaving as an active interface with an up link [ 789.628033][T29683] bond9: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 789.650572][T29683] bond9: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 789.674965][T29697] net_ratelimit: 42 callbacks suppressed [ 789.674985][T29697] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 789.825045][T29704] netlink: 'syz.2.7057': attribute type 1 has an invalid length. [ 789.888896][T29713] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7059'. [ 789.924737][T29704] 8021q: adding VLAN 0 to HW filter on device bond4 [ 789.990235][T29704] veth11: entered promiscuous mode [ 790.016068][T29704] bond4: (slave veth11): Enslaving as an active interface with a down link [ 790.139326][T29714] bond4: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 790.205741][T29730] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7063'. [ 790.275366][T29733] pim6reg1: entered promiscuous mode [ 790.280739][T29733] pim6reg1: entered allmulticast mode [ 790.438614][ T5924] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.449393][T29748] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7067'. [ 790.455954][T29754] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7068'. [ 790.482605][T29748] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7067'. [ 790.653517][T29759] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 790.673978][ T5885] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 790.698900][T29760] syzkaller1: entered promiscuous mode [ 790.708337][T29760] syzkaller1: entered allmulticast mode [ 790.940203][T29772] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7075'. [ 790.985714][ T5955] IPVS: starting estimator thread 0... [ 791.032615][ T5885] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 791.081231][T29777] IPVS: sh: FWM 3 0x00000003 - no destination available [ 791.083787][T29774] IPVS: using max 27 ests per chain, 64800 per kthread [ 791.142707][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.171337][T29773] bridge0: port 1(bridge_slave_0) entered blocking state [ 791.178869][T29773] bridge0: port 1(bridge_slave_0) entered forwarding state [ 791.268480][T29779] netlink: 'syz.3.7077': attribute type 4 has an invalid length. [ 791.296811][T29779] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7077'. [ 791.317120][T29779] bridge0: port 2(bridge_slave_1) entered disabled state [ 791.325259][T29779] bridge0: port 1(bridge_slave_0) entered disabled state [ 791.472529][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.538325][T29789] netlink: 'syz.3.7079': attribute type 1 has an invalid length. [ 791.603628][T29789] 8021q: adding VLAN 0 to HW filter on device bond3 [ 791.623458][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.710802][T29789] veth7: entered promiscuous mode [ 791.758593][T29789] bond3: (slave veth7): Enslaving as an active interface with a down link [ 791.783259][T29798] C: renamed from lo (while UP) [ 791.816098][T29798] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 791.874038][T29799] bond3: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 792.036323][T29819] netlink: 'syz.4.7089': attribute type 1 has an invalid length. [ 792.117866][T29819] 8021q: adding VLAN 0 to HW filter on device bond7 [ 792.193361][T29819] vlan2: entered allmulticast mode [ 792.203530][T29819] bond7: entered allmulticast mode [ 792.226432][T29826] syzkaller0: entered promiscuous mode [ 792.232071][T29826] syzkaller0: entered allmulticast mode [ 792.305300][T29819] bond7: (slave gretap1): making interface the new active one [ 792.322605][T29819] gretap1: entered allmulticast mode [ 792.350548][T29819] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 794.035623][T29907] syzkaller0: entered promiscuous mode [ 794.040033][T29904] __nla_validate_parse: 6 callbacks suppressed [ 794.040054][T29904] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7113'. [ 794.043137][T29907] syzkaller0: entered allmulticast mode [ 794.200491][T29911] delete_channel: no stack [ 794.249491][T29911] syzkaller0: entered promiscuous mode [ 794.291052][T29911] syzkaller0: entered allmulticast mode [ 794.360349][T29923] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7112'. [ 794.456520][T29926] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7112'. [ 794.591647][T29929] netlink: 'syz.2.7118': attribute type 6 has an invalid length. [ 794.645777][T29929] bond5: option all_slaves_active: invalid value (222) [ 794.657259][T29929] bond5 (unregistering): Released all slaves [ 794.696636][T29937] netlink: 48 bytes leftover after parsing attributes in process `syz.0.7120'. [ 794.891540][T29945] netlink: 100 bytes leftover after parsing attributes in process `syz.4.7123'. [ 794.963331][T29948] netlink: 'syz.3.7125': attribute type 4 has an invalid length. [ 795.049340][T29951] pim6reg: entered allmulticast mode [ 795.161338][T29959] tipc: Enabled bearer , priority 0 [ 795.188613][T29959] syzkaller0: entered promiscuous mode [ 795.201634][T29959] syzkaller0: entered allmulticast mode [ 795.238735][T29959] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 795.323580][T29959] tipc: Resetting bearer [ 795.415237][T29970] wg1 speed is unknown, defaulting to 1000 [ 795.435919][T29957] tipc: Resetting bearer [ 795.467130][ T8758] net_ratelimit: 7 callbacks suppressed [ 795.467154][ T8758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.481433][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.550395][T29957] tipc: Disabling bearer [ 795.634969][ T5924] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.864736][T29988] netlink: 'syz.1.7137': attribute type 4 has an invalid length. [ 796.022102][T29994] netlink: 'syz.2.7139': attribute type 1 has an invalid length. [ 796.202514][T29994] 8021q: adding VLAN 0 to HW filter on device bond5 [ 796.411066][T30014] tipc: Enabled bearer , priority 10 [ 796.672740][ T5924] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.017601][T30033] netlink: 'syz.3.7151': attribute type 4 has an invalid length. [ 797.300730][T30051] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7154'. [ 797.385697][ T8758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.412070][T30057] netlink: 72 bytes leftover after parsing attributes in process `syz.0.7155'. [ 797.678076][T30063] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7158'. [ 797.720004][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.773020][T30070] xt_TCPMSS: Only works on TCP SYN packets [ 797.916590][T30073] syzkaller0: entered promiscuous mode [ 797.936280][T30073] syzkaller0: entered allmulticast mode [ 797.980219][T30078] netlink: 'syz.2.7164': attribute type 4 has an invalid length. [ 797.992012][T30073] tipc: Enabled bearer , priority 0 [ 798.013737][T30072] tipc: Resetting bearer [ 798.065519][T30072] tipc: Disabling bearer [ 798.236089][T30092] ieee802154 phy0 wpan0: encryption failed: -22 [ 798.362835][T30096] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7168'. [ 798.385159][T30096] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7168'. [ 798.508301][ T8758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.565511][T30113] netlink: 'syz.0.7173': attribute type 1 has an invalid length. [ 798.660091][T30113] 8021q: adding VLAN 0 to HW filter on device bond1 [ 798.675231][ T8154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.684667][T30110] syzkaller0: entered promiscuous mode [ 798.690584][T30110] syzkaller0: entered allmulticast mode [ 798.753499][ T5924] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.798941][T30113] veth5: entered promiscuous mode [ 798.858362][T30113] bond1: (slave veth5): Enslaving as an active interface with a down link [ 798.903219][T30131] netlink: 'syz.4.7177': attribute type 4 has an invalid length. [ 798.908813][T30118] bond1: (slave ip6gretap1): making interface the new active one [ 798.922173][T30118] ip6gretap1: entered promiscuous mode [ 798.928228][T30118] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 798.956578][T30126] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 799.187072][T30147] netlink: 'syz.2.7181': attribute type 10 has an invalid length. [ 799.192691][T30149] netlink: 'syz.2.7181': attribute type 10 has an invalid length. [ 799.247255][T30149] bond0: left promiscuous mode [ 799.252099][T30149] bond_slave_0: left promiscuous mode [ 799.325906][T30149] bond_slave_1: left promiscuous mode [ 799.348887][T30147] syz_tun: entered promiscuous mode [ 799.409064][T30147] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 799.449080][T30170] __nla_validate_parse: 3 callbacks suppressed [ 799.449100][T30170] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7186'. [ 799.795667][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.841037][T30192] netlink: 'syz.1.7194': attribute type 1 has an invalid length. [ 799.863761][T30191] netlink: 'syz.0.7193': attribute type 4 has an invalid length. [ 799.896174][T30192] 8021q: adding VLAN 0 to HW filter on device bond11 [ 799.933334][T30192] veth13: entered promiscuous mode [ 799.947023][T30192] bond11: (slave veth13): Enslaving as an active interface with a down link [ 799.973874][T30199] dvmrp0: entered allmulticast mode [ 800.024864][T30192] bond11: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 800.466156][T30223] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7205'. [ 800.676944][T30238] netlink: 'syz.2.7210': attribute type 1 has an invalid length. [ 800.771870][T30238] 8021q: adding VLAN 0 to HW filter on device bond6 [ 800.825159][ T5924] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.993378][T30238] veth13: entered promiscuous mode [ 801.014783][T30238] bond6: (slave veth13): Enslaving as an active interface with a down link [ 801.127256][T30247] bond6: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 801.204769][T30269] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7216'. [ 801.227945][T30269] sock: sock_set_timeout: `syz.0.7216' (pid 30269) tries to set negative timeout [ 801.493039][T30282] IPVS: set_ctl: invalid protocol: 238 10.1.1.0:20000 [ 801.611694][T30294] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7220'. [ 801.704090][T24734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.882509][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.918726][T30305] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7226'. [ 802.002146][T30305] bond7: entered promiscuous mode [ 802.009942][T30305] 8021q: adding VLAN 0 to HW filter on device bond7 [ 802.324128][T30329] netlink: 'syz.4.7230': attribute type 2 has an invalid length. [ 802.564188][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.567706][T30332] openvswitch: netlink: Geneve opt len 17 is not a multiple of 4. [ 802.673258][T30340] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7236'. [ 802.846192][T30354] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7239'. [ 802.903019][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.022959][T30359] netlink: 'syz.4.7240': attribute type 1 has an invalid length. [ 803.131088][T30359] 8021q: adding VLAN 0 to HW filter on device bond8 [ 803.236219][T30367] veth1: entered promiscuous mode [ 803.258948][T30367] bond8: (slave veth1): Enslaving as an active interface with a down link [ 803.293455][T30359] bond8: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 803.297381][T30377] ipt_REJECT: TCP_RESET invalid for non-tcp [ 803.545245][T30383] netlink: 'syz.1.7249': attribute type 2 has an invalid length. [ 803.564242][T30383] netlink: 244 bytes leftover after parsing attributes in process `syz.1.7249'. [ 803.573174][T30388] netlink: 'syz.0.7250': attribute type 1 has an invalid length. [ 803.736501][T30388] bond2: entered promiscuous mode [ 803.741979][T30388] 8021q: adding VLAN 0 to HW filter on device bond2 [ 803.810733][T30406] sctp: [Deprecated]: syz.2.7256 (pid 30406) Use of int in max_burst socket option. [ 803.810733][T30406] Use struct sctp_assoc_value instead [ 803.946280][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.009577][T30410] netlink: 256 bytes leftover after parsing attributes in process `syz.3.7257'. [ 804.062683][T30421] netlink: 'syz.1.7261': attribute type 21 has an invalid length. [ 804.101156][T30421] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7261'. [ 804.176051][T30418] bond9: entered promiscuous mode [ 804.181884][T30418] bond9: entered allmulticast mode [ 804.188363][T30418] 8021q: adding VLAN 0 to HW filter on device bond9 [ 804.290941][T30428] syzkaller0: entered promiscuous mode [ 804.297107][T30428] syzkaller0: entered allmulticast mode [ 804.424619][ T9997] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.491436][ T5955] IPVS: starting estimator thread 0... [ 804.592599][T30443] IPVS: using max 50 ests per chain, 120000 per kthread [ 804.608388][T30449] __nla_validate_parse: 4 callbacks suppressed [ 804.608409][T30449] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7270'. [ 804.630126][T30449] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7270'. [ 804.738059][T30456] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7273'. [ 804.796678][T30456] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7273'. [ 804.834206][T30458] veth1_macvtap: left promiscuous mode [ 804.876209][T30462] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7275'. [ 804.983662][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.005374][T30465] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7277'. [ 805.098079][T30473] ip6t_REJECT: ECHOREPLY is not supported [ 805.118982][T30477] netlink: 'syz.3.7277': attribute type 1 has an invalid length. [ 805.161773][T30479] netlink: 'syz.4.7281': attribute type 3 has an invalid length. [ 805.181737][T30479] netlink: 'syz.4.7281': attribute type 1 has an invalid length. [ 805.206885][T30479] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7281'. [ 805.236400][T30485] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7277'. [ 805.305863][T30486] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.7282'. [ 805.344606][T30477] bond4: entered promiscuous mode [ 805.363696][T30477] 8021q: adding VLAN 0 to HW filter on device bond4 [ 805.374755][T30484] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7282'. [ 805.651198][T30497] syzkaller0: entered promiscuous mode [ 805.672873][T30497] syzkaller0: entered allmulticast mode [ 806.027439][ T5955] net_ratelimit: 1 callbacks suppressed [ 806.027463][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.993952][ T8758] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.064204][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.478988][T24734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.629352][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.105818][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.231496][T30531] netlink: 'syz.2.7295': attribute type 26 has an invalid length. [ 808.271365][T30531] netlink: 'syz.2.7295': attribute type 10 has an invalid length. [ 808.384945][T30541] netlink: 'syz.0.7298': attribute type 9 has an invalid length. [ 808.509020][T30548] netlink: 'syz.1.7300': attribute type 1 has an invalid length. [ 808.638122][T30548] 8021q: adding VLAN 0 to HW filter on device bond12 [ 808.695185][T30566] tipc: New replicast peer: 255.255.255.255 [ 808.713020][T30566] tipc: Enabled bearer , priority 10 [ 808.808759][T30561] syzkaller0: entered promiscuous mode [ 808.818734][T30561] syzkaller0: entered allmulticast mode [ 808.927269][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 808.936832][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.131251][T30584] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 809.149133][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.434479][T30599] syzkaller0: entered promiscuous mode [ 809.460428][T30599] syzkaller0: entered allmulticast mode [ 809.544902][T27164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.621315][T30614] __nla_validate_parse: 11 callbacks suppressed [ 809.621339][T30614] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7320'. [ 809.844095][T30628] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7323'. [ 810.019380][T30634] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7323'. [ 811.224644][ T5955] net_ratelimit: 2 callbacks suppressed [ 811.224668][ T5955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.058505][T30622] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7320'. [ 812.068780][T24734] tipc: Node number set to 2094176796 [ 812.263453][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.332677][ T8140] ip6gretap1: left promiscuous mode [ 812.354923][T30649] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7329'. [ 812.412660][T30649] netlink: 'syz.1.7329': attribute type 1 has an invalid length. [ 812.475449][T30649] 8021q: adding VLAN 0 to HW filter on device bond13 [ 812.558685][T30653] bond13: (slave veth17): Enslaving as an active interface with a down link [ 812.582928][T24734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.646560][T30649] bond13: (slave veth0_to_bond): making interface the new active one [ 812.657182][T30649] veth0_to_bond: entered promiscuous mode [ 812.668236][T30649] bond13: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 812.851205][T30679] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7337'. [ 813.302908][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.322009][ T9] IPVS: starting estimator thread 0... [ 813.435381][T30707] IPVS: using max 50 ests per chain, 120000 per kthread [ 813.683270][T30724] erspan0: left allmulticast mode [ 813.692583][T30724] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7355'. [ 813.790785][T27159] nci: nci_rsp_packet: unknown rsp opcode 0x220 [ 813.816830][T30734] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.7356'. [ 813.885773][T30745] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7360'. [ 814.257374][T30767] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.7366'. [ 814.343416][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.475592][T30760] netlink: 'syz.1.7363': attribute type 1 has an invalid length. [ 814.523402][T30767] netlink: 'syz.4.7366': attribute type 11 has an invalid length. [ 814.663922][T30776] __nla_validate_parse: 3 callbacks suppressed [ 814.663944][T30776] netlink: 13 bytes leftover after parsing attributes in process `syz.0.7367'. [ 814.722726][T30772] syzkaller0: entered promiscuous mode [ 814.742907][T30772] syzkaller0: entered allmulticast mode [ 814.744921][T30775] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7368'. [ 814.776230][T30775] openvswitch: netlink: Flow actions attr not present in new flow. [ 814.900551][T30785] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7373'. [ 815.469381][T30794] netlink: 'syz.3.7377': attribute type 1 has an invalid length. [ 815.598912][T30800] netlink: 96 bytes leftover after parsing attributes in process `syz.1.7379'. [ 815.726728][T30808] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7380'. [ 815.861856][T30808] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 816.086553][T30826] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 816.103741][ T5836] Bluetooth: hci2: command 0x0406 tx timeout [ 816.120378][T30808] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 816.306972][T30808] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 816.355122][T30834] netlink: 'syz.1.7389': attribute type 1 has an invalid length. [ 816.408651][T30839] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7389'. [ 816.443813][T30834] 8021q: adding VLAN 0 to HW filter on device bond14 [ 816.478659][T30808] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 816.548926][T30842] syzkaller0: entered promiscuous mode [ 816.555101][T30842] syzkaller0: entered allmulticast mode [ 816.603313][T30842] netlink: 232 bytes leftover after parsing attributes in process `syz.2.7391'. [ 816.641555][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 816.687241][T30823] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 816.776290][T30845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7392'. [ 818.114241][ T5147] Bluetooth: hci0: command 0x0c1a tx timeout [ 819.024855][T27164] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.087862][T27164] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.143934][T27159] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.369115][T30873] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.7402'. [ 819.370000][T30879] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7403'. [ 819.416117][T30873] bridge0: port 1(batadv0) entered blocking state [ 819.463583][T30873] bridge0: port 1(batadv0) entered disabled state [ 819.511061][T30873] batadv0: entered allmulticast mode [ 819.551502][T30873] batadv0: entered promiscuous mode [ 819.914000][T27159] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 819.924519][T27159] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 820.017099][T30909] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 820.248916][T30923] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7415'. [ 821.135242][T30967] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7427'. [ 821.150869][T30968] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.7427'. [ 821.225683][ T5147] Bluetooth: hci5: command 0x0406 tx timeout [ 821.274096][T30976] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7430'. [ 821.275164][T30972] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7429'. [ 821.283447][T30976] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7430'. [ 821.397542][T30980] netlink: 'syz.3.7431': attribute type 1 has an invalid length. [ 821.423069][T30980] netlink: 'syz.3.7431': attribute type 3 has an invalid length. [ 821.431315][T30980] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7431'. [ 821.547118][T30987] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 821.573222][T30987] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 821.649839][T30998] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7437'. [ 821.667105][T30999] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7435'. [ 821.676921][T30999] netlink: 10 bytes leftover after parsing attributes in process `syz.2.7435'. [ 822.102870][T31030] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 822.487061][T31053] netlink: 'syz.4.7455': attribute type 12 has an invalid length. [ 822.913416][T31074] syz.3.7462 uses old SIOCAX25GETINFO [ 823.057982][T31093] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 823.061740][T31089] pim6reg1: entered promiscuous mode [ 823.099413][T31089] pim6reg1: entered allmulticast mode [ 823.374497][ T6301] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x6 [ 823.550633][T31114] netlink: 'syz.0.7474': attribute type 1 has an invalid length. [ 823.558860][T31114] netlink: 'syz.0.7474': attribute type 1 has an invalid length. [ 823.674488][T27828] veth0_to_bond: left promiscuous mode [ 824.474854][T31155] openvswitch: netlink: IPv4 tun info is not correct [ 824.528468][T31155] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 824.696630][T31169] veth0: entered promiscuous mode [ 824.708187][T31166] veth0: left promiscuous mode [ 824.818875][T31177] netlink: 'syz.4.7498': attribute type 1 has an invalid length. [ 824.832156][ T5836] Bluetooth: hci4: command 0x0405 tx timeout [ 824.842741][T31178] netlink: 'syz.1.7500': attribute type 1 has an invalid length. [ 824.872639][T31181] netlink: 'syz.1.7500': attribute type 1 has an invalid length. [ 824.898772][T31177] 8021q: adding VLAN 0 to HW filter on device bond10 [ 825.036856][T31178] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 825.039722][T31181] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 825.138875][T31177] veth13: entered promiscuous mode [ 825.180269][T31177] bond10: (slave veth13): Enslaving as an active interface with a down link [ 825.228056][T31205] siw: device registration error -23 [ 825.239950][T31192] bond10: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 825.514988][T31214] IPVS: set_ctl: invalid protocol: 135 255.255.255.255:20000 [ 825.914023][T31236] __nla_validate_parse: 15 callbacks suppressed [ 825.914047][T31236] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7515'. [ 825.967696][T31236] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 825.984952][T31236] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 826.011226][T31242] netlink: 'syz.0.7518': attribute type 4 has an invalid length. [ 826.035151][T31236] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 826.044330][T31236] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 826.640600][T31280] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7527'. [ 826.819036][T31280] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 826.858604][T31280] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 826.897380][T31287] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7530'. [ 826.918051][T31280] bond0 (unregistering): (slave team0): Releasing backup interface [ 826.936344][T31280] bond0 (unregistering): Released all slaves [ 826.968559][ T5885] syz0: Port: 1 Link DOWN [ 827.293178][T31308] netlink: 'syz.4.7534': attribute type 4 has an invalid length. [ 827.324218][T31306] syzkaller0: entered promiscuous mode [ 827.350250][T31306] syzkaller0: entered allmulticast mode [ 827.488681][T31306] tipc: Enabled bearer , priority 0 [ 827.506704][T31305] tipc: Resetting bearer [ 827.536672][T31316] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7539'. [ 827.575515][T31305] tipc: Disabling bearer [ 827.613997][T31323] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7540'. [ 827.686568][T31325] netlink: 'syz.1.7543': attribute type 1 has an invalid length. [ 827.791591][T31325] 8021q: adding VLAN 0 to HW filter on device bond15 [ 827.846285][T31325] veth19: entered promiscuous mode [ 827.856714][T31325] bond15: (slave veth19): Enslaving as an active interface with a down link [ 827.933169][T31333] bond15: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 828.070379][T31350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7548'. [ 828.130532][T31350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7548'. [ 828.687791][T31384] syzkaller0: entered promiscuous mode [ 828.708416][T31384] syzkaller0: entered allmulticast mode [ 828.759216][T31384] tipc: Enabled bearer , priority 0 [ 828.769033][T31382] tipc: Resetting bearer [ 828.798762][T31382] tipc: Disabling bearer [ 828.806481][T31389] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7558'. [ 828.818620][T31389] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7558'. [ 829.012067][T31403] netlink: 'syz.0.7562': attribute type 10 has an invalid length. [ 829.038417][T31407] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7561'. [ 829.113954][T31407] sctp: [Deprecated]: syz.4.7561 (pid 31407) Use of struct sctp_assoc_value in delayed_ack socket option. [ 829.113954][T31407] Use struct sctp_sack_info instead [ 829.199352][T31412] sctp: [Deprecated]: syz.2.7564 (pid 31412) Use of int in max_burst socket option. [ 829.199352][T31412] Use struct sctp_assoc_value instead [ 829.259719][T31415] netlink: 'syz.1.7567': attribute type 4 has an invalid length. [ 829.382764][ C0] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 829.583648][T31438] sctp: [Deprecated]: syz.1.7573 (pid 31438) Use of struct sctp_assoc_value in delayed_ack socket option. [ 829.583648][T31438] Use struct sctp_sack_info instead [ 829.933386][T31453] netlink: 'syz.3.7579': attribute type 4 has an invalid length. [ 830.093356][T31469] Cannot find add_set index 0 as target [ 830.807066][T31495] netlink: 'syz.2.7593': attribute type 1 has an invalid length. [ 830.955108][T31498] netlink: 'syz.2.7594': attribute type 4 has an invalid length. [ 831.470018][T31508] __nla_validate_parse: 5 callbacks suppressed [ 831.470041][T31508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7597'. [ 831.494138][T31508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7597'. [ 831.580608][T31512] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.7600'. [ 831.686390][T31519] veth0: entered promiscuous mode [ 831.759324][T31519] veth0: left promiscuous mode [ 831.903841][T31539] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7606'. [ 831.937537][T31546] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7606'. [ 832.037390][T31538] bond8: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 832.045096][T31553] netlink: 'syz.1.7610': attribute type 63 has an invalid length. [ 832.076074][T31538] bond8 (unregistering): Released all slaves [ 832.117489][T31558] netlink: 'syz.1.7610': attribute type 63 has an invalid length. [ 832.356689][T31571] syzkaller0: entered promiscuous mode [ 832.362746][T31571] syzkaller0: entered allmulticast mode [ 832.385178][T31571] tipc: Enabled bearer , priority 0 [ 832.394234][T31570] tipc: Resetting bearer [ 832.400668][T31572] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7615'. [ 832.411060][T31572] netlink: 120 bytes leftover after parsing attributes in process `syz.2.7615'. [ 832.431488][T31572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7615'. [ 832.441712][T31570] tipc: Disabling bearer [ 832.649144][T31580] team0 (unregistering): Port device team_slave_0 removed [ 832.661957][T31580] team0 (unregistering): Port device team_slave_1 removed [ 832.897361][T31590] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7621'. [ 832.901014][T31592] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7621'. [ 832.920823][T31590] xfrm2: entered promiscuous mode [ 832.949163][T31590] xfrm2: entered allmulticast mode [ 833.228403][T31607] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 833.228639][T31605] syzkaller0: entered promiscuous mode [ 833.242444][T31605] syzkaller0: entered allmulticast mode [ 833.498278][T31615] netlink: 'syz.3.7634': attribute type 3 has an invalid length. [ 833.545192][T31627] netlink: 'syz.3.7634': attribute type 3 has an invalid length. [ 833.573088][T31619] syzkaller0: entered promiscuous mode [ 833.592467][T31619] syzkaller0: entered allmulticast mode [ 834.241169][T31666] netlink: 'syz.1.7647': attribute type 4 has an invalid length. [ 834.386833][T31673] netlink: 'syz.1.7649': attribute type 29 has an invalid length. [ 834.403257][T31673] netlink: 'syz.1.7649': attribute type 29 has an invalid length. [ 834.509840][T31679] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 834.732757][T31692] bond0: entered promiscuous mode [ 834.741971][T31692] bond0: left promiscuous mode [ 834.808291][T31699] netlink: 'syz.2.7659': attribute type 4 has an invalid length. [ 835.029672][T31709] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 835.365500][T31729] netlink: 'syz.4.7670': attribute type 4 has an invalid length. [ 835.407027][T31734] netlink: 'syz.2.7672': attribute type 1 has an invalid length. [ 835.481018][T31734] 8021q: adding VLAN 0 to HW filter on device bond8 [ 835.520579][T31740] netlink: 'syz.4.7673': attribute type 10 has an invalid length. [ 835.559686][T31734] veth15: entered promiscuous mode [ 835.569690][T31734] bond8: (slave veth15): Enslaving as an active interface with a down link [ 835.588334][T31743] netlink: 'syz.4.7673': attribute type 10 has an invalid length. [ 835.642141][T31738] bond8: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 835.744824][T31745] tipc: Enabled bearer , priority 0 [ 835.877847][T31745] syzkaller0: entered promiscuous mode [ 835.904919][T31745] syzkaller0: entered allmulticast mode [ 835.919920][T31745] tipc: Resetting bearer [ 836.048774][T31770] bridge_slave_0: entered promiscuous mode [ 836.498297][T31741] tipc: Resetting bearer [ 836.642150][T31804] sctp: [Deprecated]: syz.1.7691 (pid 31804) Use of struct sctp_assoc_value in delayed_ack socket option. [ 836.642150][T31804] Use struct sctp_sack_info instead [ 838.941873][T31741] tipc: Disabling bearer [ 838.964357][ T8758] tipc: Node number set to 3945560907 [ 839.087723][T31824] xt_policy: too many policy elements [ 839.234632][T31827] vlan2: entered promiscuous mode [ 839.239999][T31827] vlan2: entered allmulticast mode [ 839.261448][T31838] __nla_validate_parse: 18 callbacks suppressed [ 839.261471][T31838] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.7698'. [ 839.279991][T31827] hsr_slave_1: entered allmulticast mode [ 839.293090][T31830] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7697'. [ 839.481534][T31845] validate_nla: 1 callbacks suppressed [ 839.481556][T31845] netlink: 'syz.4.7700': attribute type 1 has an invalid length. [ 839.514480][T31845] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7700'. [ 839.518113][T31851] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7703'. [ 839.691144][T31859] netlink: 312 bytes leftover after parsing attributes in process `syz.1.7704'. [ 839.725073][T31858] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7705'. [ 839.896592][T31870] netlink: 'syz.0.7708': attribute type 1 has an invalid length. [ 839.948670][T31870] 8021q: adding VLAN 0 to HW filter on device bond0 [ 839.974913][T31870] bond0: (slave ip6gretap2): making interface the new active one [ 839.985964][T31870] bond0: (slave ip6gretap2): Enslaving as an active interface with an up link [ 840.064004][T31873] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7710'. [ 840.071833][T31876] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7711'. [ 840.127139][T31870] veth9: entered promiscuous mode [ 840.159726][T31870] bond0: (slave veth9): Enslaving as an active interface with a down link [ 840.268639][T31874] bond0: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 840.415255][T31886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7713'. [ 840.495023][T31890] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7713'. [ 841.654533][T31952] netlink: 'syz.2.7736': attribute type 10 has an invalid length. [ 841.923799][T31972] syzkaller1: entered promiscuous mode [ 841.932144][T31972] syzkaller1: entered allmulticast mode [ 842.144769][T31986] sctp: [Deprecated]: syz.3.7749 (pid 31986) Use of struct sctp_assoc_value in delayed_ack socket option. [ 842.144769][T31986] Use struct sctp_sack_info instead [ 842.191728][T31984] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 842.418628][T31997] wg1 speed is unknown, defaulting to 1000 [ 842.613386][T32005] netlink: 'syz.1.7755': attribute type 1 has an invalid length. [ 843.010976][T32020] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 843.076999][T32020] netlink: 'syz.1.7759': attribute type 83 has an invalid length. [ 843.362882][T32031] x_tables: duplicate underflow at hook 1 [ 844.025162][T32065] geneve2: entered promiscuous mode [ 844.085517][T32069] netlink: 'syz.2.7778': attribute type 1 has an invalid length. [ 844.195325][T32078] rdma_rxe: rxe_newlink: failed to add bond_slave_0 [ 844.371917][T32080] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.410217][T32085] __nla_validate_parse: 16 callbacks suppressed [ 844.410237][T32085] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7781'. [ 844.484735][T32080] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.578567][T32080] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.674626][T32080] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.852532][ T6033] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.896381][T27160] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 844.957167][T27160] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 845.019865][ T65] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 845.071110][T32108] netlink: 'syz.1.7788': attribute type 1 has an invalid length. [ 845.084129][T32110] netlink: 'syz.0.7789': attribute type 1 has an invalid length. [ 845.136088][T32114] netlink: 'syz.2.7791': attribute type 1 has an invalid length. [ 845.199079][T32121] netlink: 165 bytes leftover after parsing attributes in process `syz.4.7793'. [ 845.415023][T32114] bond9: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 845.617157][T32138] tipc: Enabled bearer , priority 0 [ 845.641446][T32138] syzkaller0: entered promiscuous mode [ 845.653114][T32138] syzkaller0: entered allmulticast mode [ 845.671245][T32138] tipc: Resetting bearer [ 845.682727][T32137] tipc: Resetting bearer [ 845.748127][T32137] tipc: Disabling bearer [ 845.799309][T32150] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7800'. [ 846.070446][T32157] netlink: 'syz.2.7804': attribute type 39 has an invalid length. [ 846.219854][T32163] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7806'. [ 846.319434][T32163] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 846.355996][T32163] team1: entered promiscuous mode [ 846.361426][T32163] team1: entered allmulticast mode [ 846.625585][T32177] netlink: 312 bytes leftover after parsing attributes in process `syz.3.7811'. [ 846.898191][T32187] IPv6: NLM_F_CREATE should be specified when creating new route [ 846.973015][T32193] tipc: Enabled bearer , priority 0 [ 847.004988][T32193] syzkaller0: entered promiscuous mode [ 847.010522][T32193] syzkaller0: entered allmulticast mode [ 847.054868][T32193] tipc: Resetting bearer [ 847.075259][T32199] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7818'. [ 847.161193][T32204] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 847.397290][T32192] tipc: Resetting bearer [ 847.449689][T32192] tipc: Disabling bearer [ 847.501036][T32215] vlan2: entered allmulticast mode [ 847.517652][T32215] geneve1: entered allmulticast mode [ 847.661111][T32224] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7827'. [ 847.907889][T32244] ieee802154 phy0 wpan0: encryption failed: -126 [ 848.338654][T32276] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7839'. [ 849.200402][T32327] netlink: 248 bytes leftover after parsing attributes in process `syz.2.7857'. [ 849.263069][T32329] netlink: 248 bytes leftover after parsing attributes in process `syz.2.7857'. [ 849.559858][T32348] netlink: 'syz.1.7860': attribute type 2 has an invalid length. [ 849.591117][T32347] netlink: 'syz.2.7861': attribute type 5 has an invalid length. [ 849.618252][T32353] x_tables: duplicate underflow at hook 2 [ 849.625722][T32347] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7861'. [ 849.734430][T32361] netlink: 'syz.3.7866': attribute type 4 has an invalid length. [ 849.954559][T32374] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 849.962955][T32374] bond0: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 850.013012][T32380] ipt_REJECT: TCP_RESET invalid for non-tcp [ 850.485800][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.496041][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.510476][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.553312][T32408] syzkaller0: entered promiscuous mode [ 850.559518][T32408] syzkaller0: entered allmulticast mode [ 850.574188][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.584727][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.595423][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.614602][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.623403][T32409] netlink: 'syz.2.7879': attribute type 1 has an invalid length. [ 850.639434][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.655926][T32408] syzkaller0: left promiscuous mode [ 850.661243][T32408] syzkaller0: left allmulticast mode [ 850.662427][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.696223][T32406] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 850.714900][T32413] netlink: 'syz.1.7881': attribute type 4 has an invalid length. [ 850.777433][T32416] netlink: 576 bytes leftover after parsing attributes in process `syz.3.7882'. [ 851.224296][T32444] netlink: 'syz.0.7893': attribute type 58 has an invalid length. [ 851.265162][T32444] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7893'. [ 851.274453][T32443] team0: Device ip6gre1 is of different type [ 851.731906][T32461] xt_CT: No such helper "syz1" [ 851.778958][T32473] netlink: 'syz.1.7900': attribute type 21 has an invalid length. [ 851.802853][T32473] IPv6: NLM_F_CREATE should be specified when creating new route [ 851.823637][T32473] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 851.831032][T32473] IPv6: NLM_F_CREATE should be set when creating new route [ 851.838651][T32473] IPv6: NLM_F_CREATE should be set when creating new route [ 851.846041][T32473] IPv6: NLM_F_CREATE should be set when creating new route [ 851.943619][ T5836] Bluetooth: hci3: command 0x0406 tx timeout [ 852.087513][T32488] netlink: 'syz.3.7908': attribute type 1 has an invalid length. [ 852.288103][T32497] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7912'. [ 852.495375][T32511] netlink: 'syz.3.7915': attribute type 1 has an invalid length. [ 852.531811][T32515] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7917'. [ 852.621230][T32511] 8021q: adding VLAN 0 to HW filter on device bond7 [ 852.763370][T32518] netlink: 'syz.4.7918': attribute type 1 has an invalid length. [ 852.787947][T32534] netlink: 'syz.3.7921': attribute type 1 has an invalid length. [ 852.825994][T32538] SET target dimension over the limit! [ 852.870271][T32518] 8021q: adding VLAN 0 to HW filter on device bond11 [ 852.933561][T32534] 8021q: adding VLAN 0 to HW filter on device bond8 [ 852.951001][T32527] vlan3: entered allmulticast mode [ 852.960182][T32527] bond11: entered allmulticast mode [ 853.072768][T32543] veth15: entered promiscuous mode [ 853.088852][T32543] bond8: (slave veth15): Enslaving as an active interface with a down link [ 853.099206][T32529] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7918'. [ 853.112684][T32529] netlink: 50 bytes leftover after parsing attributes in process `syz.4.7918'. [ 853.143653][T32529] netlink: 50 bytes leftover after parsing attributes in process `syz.4.7918'. [ 853.178690][T32534] bond8: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 853.264617][T32553] tipc: Enabled bearer , priority 0 [ 853.291147][T32553] syzkaller0: entered promiscuous mode [ 853.300040][T32553] syzkaller0: entered allmulticast mode [ 853.316200][T32553] tipc: Resetting bearer [ 853.325715][T32549] tipc: Resetting bearer [ 853.393959][T32549] tipc: Disabling bearer [ 853.445543][T32562] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7927'. [ 853.525062][T32562] 8021q: adding VLAN 0 to HW filter on device bond12 [ 853.580862][T32565] bond5: option arp_all_targets: invalid value (18446744073709551613) [ 853.604878][T32565] bond5 (unregistering): Released all slaves [ 853.671374][T32568] bond12: (slave dummy0): Enslaving as an active interface with an up link [ 853.697673][T32571] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7929'. [ 854.340359][T32611] netlink: 'syz.4.7940': attribute type 83 has an invalid length. [ 854.366094][T32614] netlink: 'syz.4.7940': attribute type 83 has an invalid length. [ 854.639556][T32621] __nla_validate_parse: 7 callbacks suppressed [ 854.639580][T32621] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7939'. [ 854.648913][T32639] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7947'. [ 854.968170][T32649] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7949'. [ 855.018497][T32654] bond5: (slave veth11): Enslaving as an active interface with a down link [ 855.025823][T32658] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7951'. [ 855.094424][T32658] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7951'. [ 855.113451][T32649] 8021q: adding VLAN 0 to HW filter on device bond5 [ 855.159505][T32658] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 855.167978][T32658] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 855.191192][T32658] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 855.216296][T32658] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 855.623299][T32683] tipc: Disabling bearer [ 855.635903][T32683] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7957'. [ 855.719737][T32687] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7958'. [ 855.767687][T32687] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7958'. [ 855.798675][T32692] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.7962'. [ 856.040074][T32708] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7965'. [ 856.754466][T32739] 8021q: adding VLAN 0 to HW filter on device bond11 [ 857.151907][T32765] FAULT_INJECTION: forcing a failure. [ 857.151907][T32765] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 857.192507][T32765] CPU: 1 UID: 0 PID: 32765 Comm: syz.2.7982 Not tainted syzkaller #0 PREEMPT(full) [ 857.192540][T32765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 857.192553][T32765] Call Trace: [ 857.192562][T32765] [ 857.192572][T32765] dump_stack_lvl+0xe8/0x150 [ 857.192603][T32765] should_fail_ex+0x412/0x560 [ 857.192633][T32765] _copy_from_user+0x2d/0xb0 [ 857.192673][T32765] ___sys_sendmsg+0x1c6/0x360 [ 857.192699][T32765] ? __lock_acquire+0x6b5/0x2cf0 [ 857.192733][T32765] ? __pfx____sys_sendmsg+0x10/0x10 [ 857.192798][T32765] ? __fget_files+0x2a/0x420 [ 857.192820][T32765] ? __fget_files+0x3a0/0x420 [ 857.192853][T32765] __x64_sys_sendmsg+0x1bd/0x2a0 [ 857.192883][T32765] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 857.192922][T32765] ? __pfx_ksys_write+0x10/0x10 [ 857.192966][T32765] do_syscall_64+0xe2/0xf80 [ 857.192987][T32765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 857.193007][T32765] ? trace_irq_disable+0x37/0x100 [ 857.193027][T32765] ? clear_bhb_loop+0x60/0xb0 [ 857.193053][T32765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 857.193073][T32765] RIP: 0033:0x7f8dae39aeb9 [ 857.193093][T32765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 857.193111][T32765] RSP: 002b:00007f8daf32f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 857.193135][T32765] RAX: ffffffffffffffda RBX: 00007f8dae615fa0 RCX: 00007f8dae39aeb9 [ 857.193150][T32765] RDX: 0000000000040010 RSI: 0000200000000240 RDI: 0000000000000005 [ 857.193165][T32765] RBP: 00007f8daf32f090 R08: 0000000000000000 R09: 0000000000000000 [ 857.193179][T32765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 857.193191][T32765] R13: 00007f8dae616038 R14: 00007f8dae615fa0 R15: 00007ffd675e6b98 [ 857.193227][T32765] [ 857.531394][ T304] validate_nla: 4 callbacks suppressed [ 857.531414][ T304] netlink: 'syz.0.7985': attribute type 4 has an invalid length. [ 858.321627][ T338] sctp: [Deprecated]: syz.0.7997 (pid 338) Use of struct sctp_assoc_value in delayed_ack socket option. [ 858.321627][ T338] Use struct sctp_sack_info instead [ 858.656419][ T358] netlink: 'syz.1.8005': attribute type 1 has an invalid length. [ 858.665783][ T358] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 858.740654][ T364] wg1 speed is unknown, defaulting to 1000 [ 859.567920][ T395] syzkaller0: entered promiscuous mode [ 859.595723][ T395] syzkaller0: entered allmulticast mode [ 859.670631][ T409] IPVS: set_ctl: invalid protocol: 2 172.30.1.4:20004 [ 859.752171][ T416] FAULT_INJECTION: forcing a failure. [ 859.752171][ T416] name failslab, interval 1, probability 0, space 0, times 0 [ 859.811832][ T416] CPU: 1 UID: 0 PID: 416 Comm: syz.0.8021 Not tainted syzkaller #0 PREEMPT(full) [ 859.811864][ T416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 859.811876][ T416] Call Trace: [ 859.811885][ T416] [ 859.811895][ T416] dump_stack_lvl+0xe8/0x150 [ 859.811927][ T416] should_fail_ex+0x412/0x560 [ 859.811958][ T416] should_failslab+0xa8/0x100 [ 859.811982][ T416] kmem_cache_alloc_noprof+0x87/0x6e0 [ 859.812010][ T416] ? __netlink_lookup+0xc6/0x8b0 [ 859.812033][ T416] ? skb_clone+0x212/0x3a0 [ 859.812066][ T416] skb_clone+0x212/0x3a0 [ 859.812098][ T416] __netlink_deliver_tap+0x404/0x850 [ 859.812132][ T416] ? netlink_deliver_tap+0x2e/0x1b0 [ 859.812156][ T416] netlink_deliver_tap+0x19c/0x1b0 [ 859.812179][ T416] netlink_unicast+0x7e3/0x9b0 [ 859.812221][ T416] ? __pfx_netlink_unicast+0x10/0x10 [ 859.812249][ T416] ? __alloc_skb+0x193/0x390 [ 859.812281][ T416] ? netlink_sendmsg+0x650/0xb40 [ 859.812310][ T416] ? skb_put+0x11b/0x210 [ 859.812338][ T416] netlink_sendmsg+0x813/0xb40 [ 859.812370][ T416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 859.812395][ T416] ? aa_sock_msg_perm+0xf1/0x1b0 [ 859.812421][ T416] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 859.812446][ T416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 859.812466][ T416] ____sys_sendmsg+0xa68/0xad0 [ 859.812492][ T416] ? __might_fault+0xaf/0x130 [ 859.812526][ T416] ? __pfx_____sys_sendmsg+0x10/0x10 [ 859.812562][ T416] ? import_iovec+0x73/0xa0 [ 859.812595][ T416] ___sys_sendmsg+0x2a5/0x360 [ 859.812621][ T416] ? __lock_acquire+0x6b5/0x2cf0 [ 859.812654][ T416] ? __pfx____sys_sendmsg+0x10/0x10 [ 859.812723][ T416] ? __fget_files+0x2a/0x420 [ 859.812744][ T416] ? __fget_files+0x3a0/0x420 [ 859.812780][ T416] __x64_sys_sendmsg+0x1bd/0x2a0 [ 859.812810][ T416] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 859.812849][ T416] ? __pfx_ksys_write+0x10/0x10 [ 859.812893][ T416] do_syscall_64+0xe2/0xf80 [ 859.812915][ T416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.812936][ T416] ? trace_irq_disable+0x37/0x100 [ 859.812955][ T416] ? clear_bhb_loop+0x60/0xb0 [ 859.812980][ T416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.813001][ T416] RIP: 0033:0x7f8c8b99aeb9 [ 859.813021][ T416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 859.813039][ T416] RSP: 002b:00007f8c8c8b2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 859.813063][ T416] RAX: ffffffffffffffda RBX: 00007f8c8bc15fa0 RCX: 00007f8c8b99aeb9 [ 859.813078][ T416] RDX: 0000000000040010 RSI: 0000200000000240 RDI: 0000000000000005 [ 859.813092][ T416] RBP: 00007f8c8c8b2090 R08: 0000000000000000 R09: 0000000000000000 [ 859.813105][ T416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 859.813118][ T416] R13: 00007f8c8bc16038 R14: 00007f8c8bc15fa0 R15: 00007ffec1f2b888 [ 859.813154][ T416] [ 860.107154][ C1] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 860.228162][ T420] __nla_validate_parse: 8 callbacks suppressed [ 860.228186][ T420] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8022'. [ 860.373813][ T424] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8024'. [ 860.428457][ T429] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8024'. [ 863.034477][ T449] netlink: 'syz.1.8031': attribute type 8 has an invalid length. [ 863.075522][ T453] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8033'. [ 863.098410][ T454] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8032'. [ 863.108291][ T454] block nbd3: Unsupported socket: should be TCP or UNIX. [ 863.197855][ T459] FAULT_INJECTION: forcing a failure. [ 863.197855][ T459] name failslab, interval 1, probability 0, space 0, times 0 [ 863.217655][ T459] CPU: 0 UID: 0 PID: 459 Comm: syz.4.8034 Not tainted syzkaller #0 PREEMPT(full) [ 863.217685][ T459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 863.217698][ T459] Call Trace: [ 863.217707][ T459] [ 863.217716][ T459] dump_stack_lvl+0xe8/0x150 [ 863.217750][ T459] should_fail_ex+0x412/0x560 [ 863.217783][ T459] should_failslab+0xa8/0x100 [ 863.217809][ T459] kmem_cache_alloc_noprof+0x87/0x6e0 [ 863.217838][ T459] ? __netlink_lookup+0xc6/0x8b0 [ 863.217862][ T459] ? skb_clone+0x212/0x3a0 [ 863.217895][ T459] skb_clone+0x212/0x3a0 [ 863.217927][ T459] __netlink_deliver_tap+0x404/0x850 [ 863.217962][ T459] ? netlink_deliver_tap+0x2e/0x1b0 [ 863.217987][ T459] netlink_deliver_tap+0x19c/0x1b0 [ 863.218009][ T459] netlink_unicast+0x7e3/0x9b0 [ 863.218051][ T459] ? __pfx_netlink_unicast+0x10/0x10 [ 863.218081][ T459] ? __alloc_skb+0x193/0x390 [ 863.218105][ T459] ? netlink_sendmsg+0x650/0xb40 [ 863.218124][ T459] ? skb_put+0x11b/0x210 [ 863.218152][ T459] netlink_sendmsg+0x813/0xb40 [ 863.218185][ T459] ? __pfx_netlink_sendmsg+0x10/0x10 [ 863.218211][ T459] ? aa_sock_msg_perm+0xf1/0x1b0 [ 863.218240][ T459] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 863.218264][ T459] ? __pfx_netlink_sendmsg+0x10/0x10 [ 863.218285][ T459] ____sys_sendmsg+0xa68/0xad0 [ 863.218321][ T459] ? __might_fault+0xaf/0x130 [ 863.218360][ T459] ? __pfx_____sys_sendmsg+0x10/0x10 [ 863.218397][ T459] ? import_iovec+0x73/0xa0 [ 863.218432][ T459] ___sys_sendmsg+0x2a5/0x360 [ 863.218457][ T459] ? __lock_acquire+0x6b5/0x2cf0 [ 863.218492][ T459] ? __pfx____sys_sendmsg+0x10/0x10 [ 863.218560][ T459] ? __fget_files+0x2a/0x420 [ 863.218581][ T459] ? __fget_files+0x3a0/0x420 [ 863.218616][ T459] __x64_sys_sendmsg+0x1bd/0x2a0 [ 863.218646][ T459] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 863.218684][ T459] ? __pfx_ksys_write+0x10/0x10 [ 863.218728][ T459] do_syscall_64+0xe2/0xf80 [ 863.218749][ T459] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.218769][ T459] ? trace_irq_disable+0x37/0x100 [ 863.218788][ T459] ? clear_bhb_loop+0x60/0xb0 [ 863.218813][ T459] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.218833][ T459] RIP: 0033:0x7efd41f9aeb9 [ 863.218853][ T459] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 863.218871][ T459] RSP: 002b:00007efd42f29028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 863.218894][ T459] RAX: ffffffffffffffda RBX: 00007efd42215fa0 RCX: 00007efd41f9aeb9 [ 863.218909][ T459] RDX: 0000000000040010 RSI: 0000200000000240 RDI: 0000000000000005 [ 863.218922][ T459] RBP: 00007efd42f29090 R08: 0000000000000000 R09: 0000000000000000 [ 863.218935][ T459] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 863.218948][ T459] R13: 00007efd42216038 R14: 00007efd42215fa0 R15: 00007ffceabe3278 [ 863.218982][ T459] [ 863.536066][ T461] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8036'. [ 863.579408][ T463] netlink: 'syz.0.8037': attribute type 1 has an invalid length. [ 863.639155][ T461] vlan2: entered allmulticast mode [ 863.694519][ T461] mac80211_hwsim hwsim84 wlan0: entered allmulticast mode [ 863.777677][ T463] bond6: entered promiscuous mode [ 863.784372][ T463] 8021q: adding VLAN 0 to HW filter on device bond6 [ 863.821079][ T466] bond6: (slave bridge2): making interface the new active one [ 863.828899][ T466] bridge2: entered promiscuous mode [ 863.835653][ T466] bond6: (slave bridge2): Enslaving as an active interface with an up link [ 863.906759][ T477] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8041'. [ 870.347156][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 870.356829][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 895.955606][T31820] bridge_slave_0: left allmulticast mode [ 895.961383][T31820] bridge_slave_0: left promiscuous mode [ 895.968405][T31820] bridge0: port 1(bridge_slave_0) entered disabled state [ 896.035924][T31820] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 896.165350][T31820] erspan0 (unregistering): left promiscuous mode [ 896.177002][T31820] gretap0 (unregistering): left promiscuous mode [ 896.263873][T31820] dvmrp1 (unregistering): left allmulticast mode [ 896.564135][T31820] ` (unregistering): (slave bond_slave_0): Releasing backup interface [ 896.575873][T31820] ` (unregistering): (slave bond_slave_1): Releasing backup interface [ 896.586561][T31820] ` (unregistering): (slave bridge_slave_1): Releasing backup interface [ 896.596708][T31820] ` (unregistering): Released all slaves [ 896.735854][T31820] bond1 (unregistering): Released all slaves [ 896.879730][T31820] bond2 (unregistering): Released all slaves [ 896.893310][T31820] bond3 (unregistering): Released all slaves [ 897.034049][T31820] bond4 (unregistering): Released all slaves [ 897.048312][T31820] bond5 (unregistering): Released all slaves [ 897.187746][T31820] bond0 (unregistering): Released all slaves [ 897.319300][T31820] bond6 (unregistering): Released all slaves [ 897.454616][T31820] bond7 (unregistering): (slave veth7): Releasing active interface [ 897.463915][T31820] bond7 (unregistering): Released all slaves [ 897.611140][T31820] bond8 (unregistering): Released all slaves [ 897.770528][T31820] bond9 (unregistering): Released all slaves [ 897.914460][T31820] bond10 (unregistering): (slave veth9): Releasing active interface [ 897.923560][T31820] bond10 (unregistering): Released all slaves [ 898.066548][T31820] bond11 (unregistering): (slave veth11): Releasing active interface [ 898.076857][T31820] bond11 (unregistering): Released all slaves [ 898.211308][T31820] bond12 (unregistering): (slave veth13): Releasing active interface [ 898.221227][T31820] bond12 (unregistering): Released all slaves [ 898.234495][T31820] bond13 (unregistering): Released all slaves [ 898.433276][T31820] tipc: Disabling bearer [ 898.439357][T31820] tipc: Disabling bearer [ 898.456875][T31820] tipc: Left network mode [ 898.858073][T31820] hsr_slave_0: left promiscuous mode [ 898.865468][T31820] hsr_slave_1: left promiscuous mode [ 899.017848][T31820] pim6reg (unregistering): left allmulticast mode [ 899.470425][T31820] team0 (unregistering): Port device team_slave_1 removed [ 899.517447][T31820] team0 (unregistering): Port device team_slave_0 removed [ 899.957983][T31820] smc: removing net device team0 with user defined pnetid SYZ2 [ 900.196623][T31820] IPVS: stop unused estimator thread 0... [ 924.849072][ T489] netlink: 'syz.0.8043': attribute type 1 has an invalid length. [ 924.904869][ T494] netlink: 'syz.0.8043': attribute type 2 has an invalid length. [ 924.950350][ T494] netlink: 188 bytes leftover after parsing attributes in process `syz.0.8043'. [ 924.987662][ T489] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8043'. [ 925.078820][ T506] FAULT_INJECTION: forcing a failure. [ 925.078820][ T506] name failslab, interval 1, probability 0, space 0, times 0 [ 925.095332][ T506] CPU: 0 UID: 0 PID: 506 Comm: syz.1.8050 Not tainted syzkaller #0 PREEMPT(full) [ 925.095361][ T506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 925.095374][ T506] Call Trace: [ 925.095383][ T506] [ 925.095392][ T506] dump_stack_lvl+0xe8/0x150 [ 925.095426][ T506] should_fail_ex+0x412/0x560 [ 925.095458][ T506] should_failslab+0xa8/0x100 [ 925.095483][ T506] __kmalloc_noprof+0xde/0x7e0 [ 925.095503][ T506] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 925.095539][ T506] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 925.095574][ T506] genl_family_rcv_msg_doit+0xd9/0x330 [ 925.095599][ T506] ? __asan_memcpy+0x40/0x70 [ 925.095632][ T506] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 925.095665][ T506] ? __pfx_genl_get_cmd+0x10/0x10 [ 925.095697][ T506] ? __dev_queue_xmit+0x274/0x3850 [ 925.095735][ T506] genl_rcv_msg+0x61c/0x7a0 [ 925.095769][ T506] ? __pfx_genl_rcv_msg+0x10/0x10 [ 925.095794][ T506] ? __pfx_netdev_nl_page_pool_get_doit+0x10/0x10 [ 925.095819][ T506] ? __pfx_ref_tracker_free+0x10/0x10 [ 925.095865][ T506] netlink_rcv_skb+0x232/0x4b0 [ 925.095887][ T506] ? __pfx_genl_rcv_msg+0x10/0x10 [ 925.095913][ T506] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 925.095929][ T506] ? genl_rcv+0x19/0x40 [ 925.095971][ T506] ? down_read+0x272/0x2e0 [ 925.095993][ T506] ? genl_rcv+0xd/0x40 [ 925.096020][ T506] genl_rcv+0x28/0x40 [ 925.096042][ T506] netlink_unicast+0x80f/0x9b0 [ 925.096080][ T506] ? __pfx_netlink_unicast+0x10/0x10 [ 925.096113][ T506] ? __alloc_skb+0x193/0x390 [ 925.096132][ T506] ? netlink_sendmsg+0x650/0xb40 [ 925.096147][ T506] ? skb_put+0x11b/0x210 [ 925.096169][ T506] netlink_sendmsg+0x813/0xb40 [ 925.096193][ T506] ? __pfx_netlink_sendmsg+0x10/0x10 [ 925.096213][ T506] ? aa_sock_msg_perm+0xf1/0x1b0 [ 925.096234][ T506] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 925.096253][ T506] ? __pfx_netlink_sendmsg+0x10/0x10 [ 925.096268][ T506] ____sys_sendmsg+0xa68/0xad0 [ 925.096289][ T506] ? __might_fault+0xaf/0x130 [ 925.096318][ T506] ? __pfx_____sys_sendmsg+0x10/0x10 [ 925.096347][ T506] ? import_iovec+0x73/0xa0 [ 925.096374][ T506] ___sys_sendmsg+0x2a5/0x360 [ 925.096393][ T506] ? __lock_acquire+0x6b5/0x2cf0 [ 925.096419][ T506] ? __pfx____sys_sendmsg+0x10/0x10 [ 925.096471][ T506] ? __fget_files+0x2a/0x420 [ 925.096488][ T506] ? __fget_files+0x3a0/0x420 [ 925.096517][ T506] __x64_sys_sendmsg+0x1bd/0x2a0 [ 925.096545][ T506] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 925.096575][ T506] ? __pfx_ksys_write+0x10/0x10 [ 925.096609][ T506] do_syscall_64+0xe2/0xf80 [ 925.096625][ T506] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.096639][ T506] ? trace_irq_disable+0x37/0x100 [ 925.096654][ T506] ? clear_bhb_loop+0x60/0xb0 [ 925.096674][ T506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.096689][ T506] RIP: 0033:0x7fa60bb9aeb9 [ 925.096705][ T506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 925.096719][ T506] RSP: 002b:00007fa60cb21028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 925.096738][ T506] RAX: ffffffffffffffda RBX: 00007fa60be15fa0 RCX: 00007fa60bb9aeb9 [ 925.096750][ T506] RDX: 0000000000040010 RSI: 0000200000000240 RDI: 0000000000000005 [ 925.096761][ T506] RBP: 00007fa60cb21090 R08: 0000000000000000 R09: 0000000000000000 [ 925.096770][ T506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 925.096780][ T506] R13: 00007fa60be16038 R14: 00007fa60be15fa0 R15: 00007ffd7ad40ae8 [ 925.096807][ T506] [ 925.807403][ T530] IPv4: Oversized IP packet from 172.20.20.24 [ 925.814452][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 925.821207][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 926.710396][ T572] netlink: 'syz.3.8063': attribute type 10 has an invalid length. [ 926.809386][ T572] 8021q: adding VLAN 0 to HW filter on device team0 [ 926.833465][ T586] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8067'. [ 926.861165][ T586] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8067'. [ 926.875188][ T572] bond0: (slave team0): Enslaving as an active interface with an up link [ 926.970010][ T594] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8069'. [ 927.047352][ T596] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8070'. [ 927.075125][ T598] netlink: 232 bytes leftover after parsing attributes in process `syz.0.8071'. [ 927.151979][ T598] netlink: 'syz.0.8071': attribute type 11 has an invalid length. [ 927.198759][ T605] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8074'. [ 927.222048][ T606] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8074'. [ 927.378955][ T620] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 927.391479][ T621] netem: change failed [ 927.489777][ T624] syzkaller0: entered promiscuous mode [ 927.497097][ T624] syzkaller0: entered allmulticast mode [ 927.593478][ T628] pim6reg1: entered allmulticast mode [ 927.681404][ T635] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8083'. [ 927.900004][ T647] netlink: 'syz.2.8090': attribute type 1 has an invalid length. [ 928.049375][ T647] 8021q: adding VLAN 0 to HW filter on device bond12 [ 928.090361][ T662] netlink: 'syz.4.8093': attribute type 3 has an invalid length. [ 928.131982][ T658] veth17: entered promiscuous mode [ 928.169383][ T658] bond12: (slave veth17): Enslaving as an active interface with a down link [ 928.189006][ T647] bond12: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 928.282780][ T668] netlink: 'syz.3.8095': attribute type 1 has an invalid length. [ 928.834659][ T699] netlink: 'syz.1.8105': attribute type 10 has an invalid length. [ 928.860310][ T699] netlink: 'syz.1.8105': attribute type 10 has an invalid length. [ 928.900155][ T698] syzkaller0: entered promiscuous mode [ 928.905944][ T698] syzkaller0: entered allmulticast mode [ 929.147174][ T24] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 929.158286][ T710] bridge_slave_0: left allmulticast mode [ 929.165364][ T710] bridge_slave_0: left promiscuous mode [ 929.171329][ T710] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.195851][ T710] bridge_slave_1: left allmulticast mode [ 929.210885][ T710] bridge_slave_1: left promiscuous mode [ 929.217529][ T710] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.237897][ T710] bond13: (slave veth0_to_bond): Releasing active interface [ 929.255264][ T710] bond0: (slave bond_slave_0): Releasing backup interface [ 929.271489][ T710] bond0: (slave bond_slave_1): Releasing backup interface [ 929.285630][ T710] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 929.489456][ T724] veth1_to_bond: entered promiscuous mode [ 929.505657][ T716] netlink: 'syz.3.8109': attribute type 12 has an invalid length. [ 929.948663][ T749] ieee802154 phy0 wpan0: encryption failed: -126 [ 929.977279][ T748] bond7: option min_links: invalid value (18446744073709551614) [ 929.995789][ T756] __nla_validate_parse: 5 callbacks suppressed [ 929.995822][ T756] netlink: 68 bytes leftover after parsing attributes in process `syz.2.8119'. [ 930.005890][ T748] bond7: option min_links: allowed values 0 - 2147483647 [ 930.034687][ T748] bond7 (unregistering): Released all slaves [ 930.103753][ T8758] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 930.250562][ T763] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8122'. [ 930.270321][ T763] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8122'. [ 930.290243][ T767] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8123'. [ 930.305637][ T760] openvswitch: netlink: IPv4 tunnel dst address is zero [ 930.314177][ T760] netlink: 'syz.1.8121': attribute type 6 has an invalid length. [ 930.350428][ T762] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8122'. [ 930.417539][ T762] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8122'. [ 930.557624][ T786] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8127'. [ 930.629752][ T789] netlink: 'syz.0.8128': attribute type 11 has an invalid length. [ 930.637874][ T785] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8127'. [ 930.655618][ T789] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8128'. [ 930.751790][ T797] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8130'. [ 930.772772][ T797] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 930.772890][ T799] netlink: 'syz.1.8131': attribute type 1 has an invalid length. [ 930.798829][ T799] netlink: 'syz.1.8131': attribute type 4 has an invalid length. [ 930.921687][ T811] xt_TPROXY: Can be used only with -p tcp or -p udp [ 931.161980][ T830] openvswitch: netlink: Missing valid actions attribute. [ 931.170380][ T830] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 931.203337][ T830] bridge5: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 931.226238][ T832] Cannot find set identified by id 65534 to match [ 931.248685][ T834] netlink: 'syz.3.8142': attribute type 1 has an invalid length. [ 931.330026][ T838] netlink: 'syz.4.8143': attribute type 11 has an invalid length. [ 931.487536][ T845] netlink: 'syz.1.8149': attribute type 17 has an invalid length. [ 931.489975][ T846] FAULT_INJECTION: forcing a failure. [ 931.489975][ T846] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 931.508536][ T848] syzkaller1: entered promiscuous mode [ 931.510698][ T846] CPU: 0 UID: 0 PID: 846 Comm: syz.4.8147 Not tainted syzkaller #0 PREEMPT(full) [ 931.510723][ T846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 931.510735][ T846] Call Trace: [ 931.510742][ T846] [ 931.510751][ T846] dump_stack_lvl+0xe8/0x150 [ 931.510780][ T846] should_fail_ex+0x412/0x560 [ 931.510808][ T846] _copy_to_user+0x31/0xb0 [ 931.510837][ T846] simple_read_from_buffer+0xe1/0x170 [ 931.510863][ T846] proc_fail_nth_read+0x1bb/0x230 [ 931.510892][ T846] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 931.510929][ T846] ? rw_verify_area+0x2a6/0x4d0 [ 931.510954][ T846] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 931.510982][ T846] vfs_read+0x20c/0xa70 [ 931.511004][ T846] ? fdget_pos+0x246/0x320 [ 931.511030][ T846] ? __pfx___mutex_lock+0x10/0x10 [ 931.511051][ T846] ? __pfx_vfs_read+0x10/0x10 [ 931.511078][ T846] ? __fget_files+0x2a/0x420 [ 931.511111][ T846] ? __fget_files+0x3a0/0x420 [ 931.511129][ T846] ? __fget_files+0x2a/0x420 [ 931.511157][ T846] ksys_read+0x150/0x270 [ 931.511186][ T846] ? __pfx_ksys_read+0x10/0x10 [ 931.511223][ T846] do_syscall_64+0xe2/0xf80 [ 931.511242][ T846] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 931.511260][ T846] ? trace_irq_disable+0x37/0x100 [ 931.511278][ T846] ? clear_bhb_loop+0x60/0xb0 [ 931.511301][ T846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 931.511319][ T846] RIP: 0033:0x7efd41f5b78e [ 931.511336][ T846] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 931.511352][ T846] RSP: 002b:00007efd42f28fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 931.511373][ T846] RAX: ffffffffffffffda RBX: 00007efd42f296c0 RCX: 00007efd41f5b78e [ 931.511387][ T846] RDX: 000000000000000f RSI: 00007efd42f290a0 RDI: 0000000000000007 [ 931.511398][ T846] RBP: 00007efd42f29090 R08: 0000000000000000 R09: 0000000000000000 [ 931.511409][ T846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 931.511421][ T846] R13: 00007efd42216038 R14: 00007efd42215fa0 R15: 00007ffceabe3278 [ 931.511452][ T846] [ 931.737910][ T848] syzkaller1: entered allmulticast mode [ 931.788304][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 931.795915][ T845] erspan0: entered promiscuous mode [ 931.800962][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.833643][ T845] gretap0: entered promiscuous mode [ 931.895129][ T857] netlink: 'syz.0.8151': attribute type 15 has an invalid length. [ 931.963281][T27164] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 931.972907][ T857] netlink: 'syz.0.8151': attribute type 15 has an invalid length. [ 932.001431][T27164] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 932.034584][T27164] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 932.076547][T27164] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 932.663872][ T907] netlink: 'syz.2.8167': attribute type 30 has an invalid length. [ 932.663872][ T905] siw: device registration error -23 [ 932.717877][ T907] bond13: option arp_missed_max: invalid value (0) [ 932.729358][ T907] bond13: option arp_missed_max: allowed values 1 - 255 [ 933.165640][ T907] bond13 (unregistering): Released all slaves [ 933.476697][ T909] bond13: option arp_missed_max: invalid value (0) [ 933.488308][ T909] bond13: option arp_missed_max: allowed values 1 - 255 [ 933.497094][ T909] bond13 (unregistering): Released all slaves [ 933.557207][ T930] bpq0: entered allmulticast mode [ 933.768248][ T956] 8021q: adding VLAN 0 to HW filter on device bond13 [ 933.825261][ T946] can: request_module (can-proto-5) failed. [ 933.904313][ T956] veth19: entered promiscuous mode [ 933.922299][ T956] bond13: (slave veth19): Enslaving as an active interface with a down link [ 933.970872][ T959] bond13: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 934.272770][ T974] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 934.552395][ T30] audit: type=1804 audit(1769469751.031:7): pid=994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.8185" name="/newroot/526/cgroup.controllers" dev="tmpfs" ino=2678 res=1 errno=0 [ 934.620430][ T30] audit: type=1800 audit(1769469751.041:8): pid=994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8185" name="cgroup.controllers" dev="tmpfs" ino=2678 res=0 errno=0 [ 934.753200][ T1000] 8021q: adding VLAN 0 to HW filter on device bond13 [ 934.853572][ T1000] veth17: entered promiscuous mode [ 934.863727][ T1000] bond13: (slave veth17): Enslaving as an active interface with a down link [ 934.891013][ T1000] bond13: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 935.006351][ T1016] __nla_validate_parse: 19 callbacks suppressed [ 935.006374][ T1016] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8193'. [ 935.135976][ T1027] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8195'. [ 935.187900][ T1029] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.8196'. [ 935.274359][ T1039] netlink: 1 bytes leftover after parsing attributes in process `syz.0.8198'. [ 935.456297][ T30] audit: type=1107 audit(1769469751.941:9): pid=1053 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='nJAG{M-IT\[KŝntB5(f [ 935.456297][ T30] K4EPzs,:ճRLvM&uwueZP+Ћ i;k,' [ 935.600514][ T1071] validate_nla: 6 callbacks suppressed [ 935.600538][ T1071] netlink: 'syz.0.8205': attribute type 1 has an invalid length. [ 935.658738][ T1071] 8021q: adding VLAN 0 to HW filter on device bond8 [ 935.699383][ T1071] veth13: entered promiscuous mode [ 935.715484][ T1071] bond8: (slave veth13): Enslaving as an active interface with a down link [ 935.758950][ T1078] bond8: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 935.980099][ T1094] netlink: 'syz.0.8211': attribute type 1 has an invalid length. [ 935.996734][ T1095] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 936.001212][ T1093] netlink: 'syz.0.8211': attribute type 1 has an invalid length. [ 936.119148][ T1105] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8214'. [ 936.123276][ T1107] sctp: [Deprecated]: syz.3.8215 (pid 1107) Use of struct sctp_assoc_value in delayed_ack socket option. [ 936.123276][ T1107] Use struct sctp_sack_info instead [ 936.147630][ T1094] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 936.149240][ T1093] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 936.459189][ T1127] bond0: (slave team0): Releasing backup interface [ 936.484105][ T1129] netlink: 'syz.2.8222': attribute type 28 has an invalid length. [ 936.492586][ T1129] netlink: 'syz.2.8222': attribute type 3 has an invalid length. [ 936.500406][ T1129] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8222'. [ 936.514553][ T1129] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8222'. [ 936.567526][ T1127] bridge_slave_0: left allmulticast mode [ 936.583453][ T1127] bridge0: port 1(bridge_slave_0) entered disabled state [ 936.624188][ T1127] bridge_slave_1: left allmulticast mode [ 936.640473][ T1127] bridge_slave_1: left promiscuous mode [ 936.666179][ T1127] bridge0: port 2(bridge_slave_1) entered disabled state [ 936.698619][ T1143] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8223'. [ 936.713144][ T1127] bond0: (slave bond_slave_0): Releasing backup interface [ 936.737386][ T1143] netlink: 9 bytes leftover after parsing attributes in process `syz.2.8223'. [ 936.761702][ T1127] bond0: (slave c@0): Releasing backup interface [ 936.803636][ T1127] team0: Port device team_slave_0 removed [ 936.831260][ T1127] team0: Port device team_slave_1 removed [ 936.850969][ T1127] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 936.888749][ T1143] veth0_vlan: left allmulticast mode [ 937.168567][ T1158] x_tables: duplicate underflow at hook 1 [ 937.179757][ T1162] netlink: 'syz.4.8228': attribute type 1 has an invalid length. [ 937.199003][ T1160] netlink: 'syz.4.8228': attribute type 1 has an invalid length. [ 937.238290][ T1166] openvswitch: netlink: IP tunnel dst address not specified [ 937.248440][ T1158] netlink: 'syz.3.8227': attribute type 10 has an invalid length. [ 937.316426][ T1158] team0: Device veth1_macvtap failed to register rx_handler [ 937.488796][ T1179] netlink: 277 bytes leftover after parsing attributes in process `syz.4.8234'. [ 937.691938][ T1189] netlink: 'syz.0.8238': attribute type 1 has an invalid length. [ 937.720691][ T1196] netlink: 'syz.1.8240': attribute type 1 has an invalid length. [ 938.190860][ T1232] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz_tun! [ 938.722687][ T1263] erspan0: entered promiscuous mode [ 938.728472][ T1263] erspan0: entered allmulticast mode [ 939.526691][ T1320] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 939.540604][ T1317] veth15: entered promiscuous mode [ 939.558355][ T1317] bond9: (slave veth15): Enslaving as a backup interface with a down link [ 940.043997][ T1346] 8021q: adding VLAN 0 to HW filter on device bond10 [ 940.091673][ T1346] veth17: entered promiscuous mode [ 940.109692][ T1346] bond10: (slave veth17): Enslaving as an active interface with a down link [ 940.168910][ T1346] bond10: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 940.217051][ T1361] __nla_validate_parse: 14 callbacks suppressed [ 940.217074][ T1361] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8289'. [ 940.300311][ T1357] x_tables: duplicate underflow at hook 1 [ 940.319480][ T1366] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8290'. [ 940.580689][ T1383] xt_CT: You must specify a L4 protocol and not use inversions on it [ 940.774318][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888057f92800: rx timeout, send abort [ 940.783880][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff888057f92800: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 940.869379][ T1390] netlink: 76 bytes leftover after parsing attributes in process `syz.1.8298'. [ 940.915992][ T1396] validate_nla: 6 callbacks suppressed [ 940.916013][ T1396] netlink: 'syz.3.8300': attribute type 10 has an invalid length. [ 941.178091][ T1403] netlink: 'syz.3.8301': attribute type 1 has an invalid length. [ 941.276635][ T1403] 8021q: adding VLAN 0 to HW filter on device bond10 [ 941.326363][ T1403] veth17: entered promiscuous mode [ 941.338386][ T1403] bond10: (slave veth17): Enslaving as an active interface with a down link [ 941.362071][ T1403] bond10: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 941.445326][ T1415] netlink: 'syz.0.8304': attribute type 1 has an invalid length. [ 941.457265][ T1415] netlink: 96 bytes leftover after parsing attributes in process `syz.0.8304'. [ 941.476902][ T1415] netlink: 1 bytes leftover after parsing attributes in process `syz.0.8304'. [ 941.487232][ T1415] netlink: 'syz.0.8304': attribute type 1 has an invalid length. [ 941.497235][ T1415] netlink: 618 bytes leftover after parsing attributes in process `syz.0.8304'. [ 941.531769][ T1418] netlink: 'syz.1.8305': attribute type 1 has an invalid length. [ 941.540872][ T1418] netlink: 'syz.1.8305': attribute type 1 has an invalid length. [ 941.580989][ T1418] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 941.608334][ T1423] netlink: 'syz.4.8308': attribute type 1 has an invalid length. [ 941.639505][ T1423] 8021q: adding VLAN 0 to HW filter on device bond14 [ 941.649031][ T1425] .: renamed from bridge_slave_1 (while UP) [ 941.680099][ T1427] veth0_to_bond: left allmulticast mode [ 941.718889][ T1427] veth0_to_bond: left promiscuous mode [ 941.729014][ T1427] bridge2: port 2(veth0_to_bond) entered disabled state [ 941.773747][ T1427] bond14: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 941.888283][ T1423] 8021q: adding VLAN 0 to HW filter on device bond15 [ 941.919816][ T1423] bond14: (slave bond15): Enslaving as an active interface with a down link [ 941.935874][ T1442] lo: entered promiscuous mode [ 941.945807][ T1442] tunl0: entered promiscuous mode [ 941.976518][ T1442] gre0: entered promiscuous mode [ 942.031948][ T1442] ip_vti0: entered promiscuous mode [ 942.042577][ T1449] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8313'. [ 942.210879][ T1458] netlink: 'syz.4.8317': attribute type 1 has an invalid length. [ 942.224377][ T1459] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8319'. [ 942.249329][ T1458] 8021q: adding VLAN 0 to HW filter on device bond16 [ 942.303171][ T1458] veth19: entered promiscuous mode [ 942.336242][ T1458] bond16: (slave veth19): Enslaving as an active interface with a down link [ 942.387905][ T1468] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 942.406823][ T1462] bond16: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 942.735496][ T1487] syzkaller0: entered promiscuous mode [ 942.741137][ T1487] syzkaller0: entered allmulticast mode [ 943.034773][ T1498] netlink: 'syz.4.8329': attribute type 1 has an invalid length. [ 943.207945][ T1510] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8332'. [ 943.353913][ T1518] vcan0: entered allmulticast mode [ 943.386326][ T1521] netlink: 'syz.3.8335': attribute type 1 has an invalid length. [ 943.437553][ T1521] 8021q: adding VLAN 0 to HW filter on device bond11 [ 943.495122][ T1521] veth19: entered promiscuous mode [ 943.510104][ T1521] bond11: (slave veth19): Enslaving as an active interface with a down link [ 943.535189][ T1525] bond11: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 943.999288][ T1549] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 944.166959][ T1558] netlink: 248 bytes leftover after parsing attributes in process `syz.1.8344'. [ 944.357899][ T1570] 8021q: adding VLAN 0 to HW filter on device bond12 [ 944.420676][ T1570] veth21: entered promiscuous mode [ 944.447141][ T1570] bond12: (slave veth21): Enslaving as an active interface with a down link [ 944.509196][ T1579] bond12: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 945.000401][ T1614] Cannot find add_set index 2 as target [ 945.420505][ T1644] __nla_validate_parse: 3 callbacks suppressed [ 945.420527][ T1644] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8371'. [ 945.636975][ T1652] erspan0: left promiscuous mode [ 945.642911][ T1652] erspan0: left allmulticast mode [ 945.679671][ T1652] 8021q: adding VLAN 0 to HW filter on device team0 [ 945.697393][ T1652] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 945.745282][ T1663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8375'. [ 945.899784][ T1672] xt_ecn: cannot match TCP bits for non-tcp packets [ 946.028594][ T1676] validate_nla: 4 callbacks suppressed [ 946.028616][ T1676] netlink: 'syz.4.8381': attribute type 2 has an invalid length. [ 946.047632][ T1677] netlink: 'syz.4.8381': attribute type 2 has an invalid length. [ 946.207615][ T1693] netlink: 'syz.4.8385': attribute type 21 has an invalid length. [ 946.220453][ T1693] netlink: 128 bytes leftover after parsing attributes in process `syz.4.8385'. [ 946.230881][ T1693] netlink: 3 bytes leftover after parsing attributes in process `syz.4.8385'. [ 946.323464][ T1700] sctp: [Deprecated]: syz.4.8387 (pid 1700) Use of struct sctp_assoc_value in delayed_ack socket option. [ 946.323464][ T1700] Use struct sctp_sack_info instead [ 946.510521][ T1704] bond13: option min_links: invalid value (18446744073709551614) [ 946.521286][ T1710] netlink: 'syz.0.8391': attribute type 3 has an invalid length. [ 946.530152][ T1704] bond13: option min_links: allowed values 0 - 2147483647 [ 946.541825][ T1704] bond13 (unregistering): Released all slaves [ 946.568497][ T1712] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 946.602084][ T1712] bond_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 946.770103][ T1719] tipc: Enabling of bearer rejected, failed to enable media [ 946.828448][ T1722] tipc: Enabled bearer , priority 20 [ 946.840702][ T1723] nbd: device at index 3 is going down [ 946.894839][ T1727] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8397'. [ 946.995795][ T1730] syzkaller0: entered promiscuous mode [ 946.996151][ T1735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8400'. [ 947.001323][ T1730] syzkaller0: entered allmulticast mode [ 947.066665][ T1589] udevd[1589]: inotify_add_watch(7, /dev/nbd3, 10) failed: No such file or directory [ 947.249717][ T1744] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8401'. [ 947.778326][ T1768] wg1 speed is unknown, defaulting to 1000 [ 947.827947][ T1770] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8410'. [ 947.842749][ T57] tipc: Node number set to 1897567724 [ 948.102819][ T1784] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8408'. [ 948.217339][ T1788] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8413'. [ 948.229900][ T1791] netlink: 'syz.0.8415': attribute type 1 has an invalid length. [ 948.266876][ T1783] wg1 speed is unknown, defaulting to 1000 [ 948.556513][ T1791] 8021q: adding VLAN 0 to HW filter on device bond11 [ 948.631379][ T1800] veth21: entered promiscuous mode [ 948.665143][ T1800] bond11: (slave veth21): Enslaving as an active interface with a down link [ 948.773927][ T1807] netlink: set zone limit has 4 unknown bytes [ 948.853442][ T1805] bond11: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 949.233531][ T5147] Bluetooth: hci4: command 0x0405 tx timeout [ 949.283513][ T1821] : renamed from veth1 (while UP) [ 950.050762][ T1847] 8021q: adding VLAN 0 to HW filter on device bond12 [ 950.178761][ T1849] bond12: (slave veth23): Enslaving as an active interface with an up link [ 950.235514][ T1847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 950.287345][ T1847] bond12: (slave batadv0): Enslaving as an active interface with an up link [ 950.847698][ T1874] __nla_validate_parse: 9 callbacks suppressed [ 950.847720][ T1874] netlink: 168 bytes leftover after parsing attributes in process `syz.0.8438'. [ 950.863276][ T1877] netlink: 'syz.1.8440': attribute type 1 has an invalid length. [ 950.971038][ T1877] 8021q: adding VLAN 0 to HW filter on device bond17 [ 950.981019][ T1888] netlink: 332 bytes leftover after parsing attributes in process `syz.3.8443'. [ 951.125377][ T1877] veth21: entered promiscuous mode [ 951.146684][ T1877] bond17: (slave veth21): Enslaving as an active interface with a down link [ 951.190907][ T1886] bond17: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 951.481024][ T1907] tipc: Resetting bearer [ 951.506904][ T1907] tipc: Resetting bearer [ 951.742035][ T1935] netlink: 'syz.4.8451': attribute type 6 has an invalid length. [ 951.764673][ T1937] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 952.115882][ T1952] netlink: 'syz.3.8455': attribute type 4 has an invalid length. [ 952.158703][ T1956] netlink: 'syz.3.8455': attribute type 4 has an invalid length. [ 952.289178][ T1961] netlink: 'syz.2.8456': attribute type 11 has an invalid length. [ 952.392002][ T1967] netlink: 'syz.2.8456': attribute type 2 has an invalid length. [ 952.659038][ T1972] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 952.704206][ T1976] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 952.781218][ T1993] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8462'. [ 953.230970][ T2011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8466'. [ 953.892355][ T2039] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8474'. [ 953.905039][ T2039] block nbd4: Unsupported socket: should be TCP or UNIX. [ 953.953463][ T2039] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8474'. [ 954.113607][ T2048] netlink: 'syz.1.8477': attribute type 3 has an invalid length. [ 954.115181][ T2050] syzkaller1: entered promiscuous mode [ 954.125447][ T2048] netlink: 224 bytes leftover after parsing attributes in process `syz.1.8477'. [ 954.145236][ T2050] syzkaller1: entered allmulticast mode [ 954.243424][ T2056] syzkaller0: entered promiscuous mode [ 954.250154][ T2056] syzkaller0: entered allmulticast mode [ 954.320830][ T2054] xfrm3: entered allmulticast mode [ 954.409349][ T2064] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 954.555444][ T5836] block nbd4: Receive control failed (result -32) [ 954.615340][ T2076] netlink: 92 bytes leftover after parsing attributes in process `syz.0.8485'. [ 954.624662][ T2076] netlink: 'syz.0.8485': attribute type 1 has an invalid length. [ 954.939573][ T2098] syzkaller0: entered promiscuous mode [ 954.957459][ T2098] syzkaller0: entered allmulticast mode [ 955.073045][ T2100] wg1 speed is unknown, defaulting to 1000 [ 955.548381][ T2129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8500'. [ 955.571973][ T2129] netlink: 'syz.0.8500': attribute type 1 has an invalid length. [ 955.579871][ T2129] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8500'. [ 956.071515][ T2144] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 956.081125][ T2143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 956.527462][ T2164] netlink: 'syz.4.8510': attribute type 11 has an invalid length. [ 956.536325][ T2164] __nla_validate_parse: 2 callbacks suppressed [ 956.536346][ T2164] netlink: 224 bytes leftover after parsing attributes in process `syz.4.8510'. [ 956.630189][ T2170] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8511'. [ 956.681698][ T2175] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8511'. [ 956.738917][ T2179] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8514'. [ 956.799698][ T2177] bond13 (unregistering): Released all slaves [ 957.140232][ T2206] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 957.684547][ T2239] netlink: 'syz.1.8525': attribute type 83 has an invalid length. [ 957.869331][ T5147] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 957.890869][ T5147] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 957.900836][ T5147] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 957.913460][ T5147] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 957.921412][ T5147] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 958.121856][ T2245] wg1 speed is unknown, defaulting to 1000 [ 958.218577][ T2253] netlink: 11 bytes leftover after parsing attributes in process `syz.2.8530'. [ 958.234182][ T2253] netlink: 11 bytes leftover after parsing attributes in process `syz.2.8530'. [ 958.364307][ T6992] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 958.634143][ T2267] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 958.810223][ T6992] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 958.918178][ T6992] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.006347][ T6992] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.050889][ T2292] netlink: 300 bytes leftover after parsing attributes in process `syz.2.8541'. [ 959.457957][ T2301] syzkaller0: entered promiscuous mode [ 959.489447][ T2301] syzkaller0: entered allmulticast mode [ 959.601080][ T2322] netlink: 'syz.2.8549': attribute type 10 has an invalid length. [ 959.628844][ T6992] veth7: left allmulticast mode [ 959.633881][ T6992] veth7: left promiscuous mode [ 959.638943][ T6992] bridge2: port 1(veth7) entered disabled state [ 959.660201][ T6992] batadv0: left allmulticast mode [ 959.665433][ T6992] batadv0: left promiscuous mode [ 959.682465][ T6992] bridge0: port 1(batadv0) entered disabled state [ 959.704451][ T2326] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8548'. [ 959.942628][ T5147] Bluetooth: hci1: command tx timeout [ 960.393371][ T6992] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 960.404124][ T6992] bond2 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 2e:63:c3:d8:be:38 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 960.632481][ T6992] bond7 (unregistering): (slave gretap1): Releasing active interface [ 960.640637][ T6992] gretap1 (unregistering): left allmulticast mode [ 960.937143][ T6992] bond6 (unregistering): (slave bridge0): Releasing active interface [ 961.166457][ T6992] bond1 (unregistering): Released all slaves [ 961.190831][ T6992] bond0 (unregistering): Released all slaves [ 961.348303][ T6992] bond2 (unregistering): (slave veth3): Releasing active interface [ 961.358199][ T6992] bond2 (unregistering): Released all slaves [ 961.512967][ T6992] bond3 (unregistering): (slave veth5): Releasing active interface [ 961.524098][ T6992] bond3 (unregistering): Released all slaves [ 961.538986][ T6992] bond4 (unregistering): (slave veth9): Releasing backup interface [ 961.554979][ T6992] bond4 (unregistering): Released all slaves [ 961.570897][ T6992] bond5 (unregistering): Released all slaves [ 961.584948][ T6992] bond6 (unregistering): Released all slaves [ 961.746998][ T6992] bond7 (unregistering): Released all slaves [ 961.897371][ T6992] bond8 (unregistering): (slave veth1): Releasing active interface [ 961.908152][ T6992] bond8 (unregistering): Released all slaves [ 962.033394][ T5147] Bluetooth: hci1: command tx timeout [ 962.063865][ T6992] bond9 (unregistering): Released all slaves [ 962.208107][ T6992] bond10 (unregistering): (slave veth13): Releasing active interface [ 962.218218][ T6992] bond10 (unregistering): Released all slaves [ 962.368840][ T6992] bond11 (unregistering): Released all slaves [ 962.515409][ T6992] bond12 (unregistering): (slave dummy0): Releasing backup interface [ 962.527416][ T6992] bond12 (unregistering): Released all slaves [ 962.707363][ T6992] bond13 (unregistering): (slave veth17): Releasing active interface [ 962.719640][ T6992] bond13 (unregistering): Released all slaves [ 962.862598][ T6992] bond14 (unregistering): (slave veth0_to_bond): Releasing active interface [ 962.874715][ T6992] bond14 (unregistering): (slave bond15): Releasing active interface [ 962.883821][ T6992] bond14 (unregistering): Released all slaves [ 963.023688][ T6992] bond15 (unregistering): Released all slaves [ 963.166810][ T6992] bond16 (unregistering): (slave veth19): Releasing active interface [ 963.177785][ T6992] bond16 (unregistering): Released all slaves [ 963.190679][ T2322] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 963.198606][ T2245] chnl_net:caif_netlink_parms(): no params data found [ 963.380399][ T6992] : left promiscuous mode [ 963.567143][ T6992] tipc: Left network mode [ 963.930115][ T2347] ip6tnl0: entered promiscuous mode [ 963.952557][ T2347] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8555'. [ 963.970364][ T2363] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8556'. [ 963.982816][ T2354] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8555'. [ 963.989187][ T2363] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8556'. [ 964.050352][ T2369] netlink: 64 bytes leftover after parsing attributes in process `syz.0.8557'. [ 964.102565][ T5147] Bluetooth: hci1: command tx timeout [ 964.176013][ T2245] bridge0: port 1(bridge_slave_0) entered blocking state [ 964.189245][ T2373] netlink: 'syz.3.8558': attribute type 1 has an invalid length. [ 964.208972][ T2245] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.222976][ T2245] bridge_slave_0: entered allmulticast mode [ 964.250634][ T2245] bridge_slave_0: entered promiscuous mode [ 964.417022][ T2373] bond13: entered promiscuous mode [ 964.463544][ T2373] 8021q: adding VLAN 0 to HW filter on device bond13 [ 964.536045][ T2378] bond13: (slave bridge8): making interface the new active one [ 964.543865][ T2378] bridge8: entered promiscuous mode [ 964.551279][ T2378] bond13: (slave bridge8): Enslaving as an active interface with an up link [ 964.563612][ T2245] bridge0: port 2(bridge_slave_1) entered blocking state [ 964.579492][ T2245] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.613570][ T2245] bridge_slave_1: entered allmulticast mode [ 964.646560][ T2245] bridge_slave_1: entered promiscuous mode [ 964.994265][ T2405] 8021q: adding VLAN 0 to HW filter on device bond14 [ 965.087151][ T2245] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 965.148015][ T2408] bridge0: port 1(bridge_slave_0) entered disabled state [ 965.170587][ T2245] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 965.412125][ T2245] team0: Port device team_slave_0 added [ 965.437736][ T2245] team0: Port device team_slave_1 added [ 965.604645][ T2438] : entered promiscuous mode [ 965.748894][ T2450] netlink: 'syz.2.8575': attribute type 1 has an invalid length. [ 965.772011][ T2450] netlink: 96 bytes leftover after parsing attributes in process `syz.2.8575'. [ 965.805678][ T2450] netlink: 1 bytes leftover after parsing attributes in process `syz.2.8575'. [ 965.807902][ T2245] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 965.865659][ T2245] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 965.893755][ T2245] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 965.930688][ T6992] hsr_slave_0: left promiscuous mode [ 965.943150][ T2456] netlink: 'syz.3.8577': attribute type 1 has an invalid length. [ 966.014104][ T6992] veth1_macvtap: left promiscuous mode [ 966.020110][ T6992] veth0_macvtap: left promiscuous mode [ 966.027341][ T6992] veth1_vlan: left promiscuous mode [ 966.033500][ T6992] veth0_vlan: left promiscuous mode [ 966.183853][ T5147] Bluetooth: hci1: command tx timeout [ 966.210877][ T2476] netlink: 'syz.1.8582': attribute type 4 has an invalid length. [ 966.436184][ T6992] pim6reg (unregistering): left allmulticast mode [ 966.472084][ T2485] netlink: 'syz.0.8583': attribute type 1 has an invalid length. [ 966.494033][ T2485] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8583'. [ 966.516595][ T2485] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8583'. [ 967.192465][ T6992] team0 (unregistering): Port device team_slave_1 removed [ 967.248950][ T6992] team0 (unregistering): Port device team_slave_0 removed [ 967.644555][ T2245] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 967.651541][ T2245] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 967.680446][ T2245] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 967.695088][ T2456] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 967.816449][ T2473] netlink: 'syz.3.8577': attribute type 1 has an invalid length. [ 967.880568][ T2473] netlink: 'syz.3.8577': attribute type 2 has an invalid length. [ 967.959479][ T2245] hsr_slave_0: entered promiscuous mode [ 967.995697][ T2245] hsr_slave_1: entered promiscuous mode [ 968.020289][ T2245] debugfs: 'hsr0' already exists in 'hsr' [ 968.033613][ T2512] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8587'. [ 968.053645][ T2245] Cannot create hsr debugfs directory [ 968.064104][ T2506] : renamed from veth1_vlan (while UP) [ 968.115245][ T2508] netlink: 'syz.2.8588': attribute type 6 has an invalid length. [ 968.269655][ T2530] sysfs: cannot create duplicate filename '/class/ieee80211/Ku crK:̥B| lS-!' [ 968.298898][ T2530] CPU: 0 UID: 0 PID: 2530 Comm: syz.1.8591 Not tainted syzkaller #0 PREEMPT(full) [ 968.298940][ T2530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 968.298954][ T2530] Call Trace: [ 968.298964][ T2530] [ 968.298974][ T2530] dump_stack_lvl+0xe8/0x150 [ 968.299008][ T2530] sysfs_warn_dup+0x8e/0xa0 [ 968.299042][ T2530] sysfs_do_create_link_sd+0xc0/0x110 [ 968.299078][ T2530] device_add_class_symlinks+0x1cf/0x240 [ 968.299118][ T2530] device_add+0x475/0xb70 [ 968.299157][ T2530] wiphy_register+0x1d6c/0x2d50 [ 968.299202][ T2530] ? __pfx_wiphy_register+0x10/0x10 [ 968.299224][ T2530] ? __pfx_netdev_run_todo+0x10/0x10 [ 968.299256][ T2530] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 968.299294][ T2530] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 968.299328][ T2530] ieee80211_register_hw+0x34d2/0x4150 [ 968.299358][ T2530] ? __lock_acquire+0x6b5/0x2cf0 [ 968.299406][ T2530] ? ieee80211_register_hw+0x13d1/0x4150 [ 968.299445][ T2530] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 968.299497][ T2530] ? __hrtimer_setup+0x181/0x200 [ 968.299518][ T2530] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 968.299553][ T2530] mac80211_hwsim_new_radio+0x2f97/0x5330 [ 968.299617][ T2530] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 968.299642][ T2530] ? kstrndup+0xbf/0x160 [ 968.299690][ T2530] hwsim_new_radio_nl+0xf85/0x1c30 [ 968.299727][ T2530] ? __pfx___nla_validate_parse+0x10/0x10 [ 968.299778][ T2530] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 968.299821][ T2530] ? rcu_is_watching+0x15/0xb0 [ 968.299848][ T2530] ? __nla_parse+0x40/0x60 [ 968.299890][ T2530] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 968.299938][ T2530] genl_family_rcv_msg_doit+0x22a/0x330 [ 968.299976][ T2530] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 968.300022][ T2530] ? bpf_lsm_capable+0x9/0x20 [ 968.300049][ T2530] ? security_capable+0x7e/0x2c0 [ 968.300084][ T2530] genl_rcv_msg+0x61c/0x7a0 [ 968.300122][ T2530] ? __pfx_genl_rcv_msg+0x10/0x10 [ 968.300149][ T2530] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 968.300182][ T2530] ? __pfx_ref_tracker_free+0x10/0x10 [ 968.300220][ T2530] netlink_rcv_skb+0x232/0x4b0 [ 968.300244][ T2530] ? __pfx_genl_rcv_msg+0x10/0x10 [ 968.300275][ T2530] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 968.300294][ T2530] ? genl_rcv+0x19/0x40 [ 968.300342][ T2530] ? down_read+0x272/0x2e0 [ 968.300366][ T2530] ? genl_rcv+0xd/0x40 [ 968.300395][ T2530] genl_rcv+0x28/0x40 [ 968.300421][ T2530] netlink_unicast+0x80f/0x9b0 [ 968.300465][ T2530] ? __pfx_netlink_unicast+0x10/0x10 [ 968.300500][ T2530] ? netlink_sendmsg+0x650/0xb40 [ 968.300520][ T2530] ? skb_put+0x11b/0x210 [ 968.300552][ T2530] netlink_sendmsg+0x813/0xb40 [ 968.300587][ T2530] ? __pfx_netlink_sendmsg+0x10/0x10 [ 968.300614][ T2530] ? aa_sock_msg_perm+0xf1/0x1b0 [ 968.300644][ T2530] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 968.300667][ T2530] ? __pfx_netlink_sendmsg+0x10/0x10 [ 968.300689][ T2530] ____sys_sendmsg+0xa68/0xad0 [ 968.300718][ T2530] ? __might_fault+0xaf/0x130 [ 968.300758][ T2530] ? __pfx_____sys_sendmsg+0x10/0x10 [ 968.300800][ T2530] ? import_iovec+0x73/0xa0 [ 968.300838][ T2530] ___sys_sendmsg+0x2a5/0x360 [ 968.300865][ T2530] ? __lock_acquire+0x6b5/0x2cf0 [ 968.300908][ T2530] ? __pfx____sys_sendmsg+0x10/0x10 [ 968.300946][ T2530] ? futex_wait+0x29a/0x380 [ 968.301002][ T2530] ? __fget_files+0x2a/0x420 [ 968.301026][ T2530] ? __fget_files+0x3a0/0x420 [ 968.301063][ T2530] __x64_sys_sendmsg+0x1bd/0x2a0 [ 968.301097][ T2530] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 968.301139][ T2530] ? rcu_is_watching+0x15/0xb0 [ 968.301175][ T2530] do_syscall_64+0xe2/0xf80 [ 968.301198][ T2530] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 968.301218][ T2530] ? trace_irq_disable+0x37/0x100 [ 968.301240][ T2530] ? clear_bhb_loop+0x60/0xb0 [ 968.301267][ T2530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 968.301289][ T2530] RIP: 0033:0x7fa60bb9aeb9 [ 968.301310][ T2530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 968.301329][ T2530] RSP: 002b:00007fa60cb21028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 968.301354][ T2530] RAX: ffffffffffffffda RBX: 00007fa60be15fa0 RCX: 00007fa60bb9aeb9 [ 968.301369][ T2530] RDX: 0000000000000300 RSI: 0000200000000100 RDI: 0000000000000003 [ 968.301383][ T2530] RBP: 00007fa60bc08c1f R08: 0000000000000000 R09: 0000000000000000 [ 968.301397][ T2530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 968.301410][ T2530] R13: 00007fa60be16038 R14: 00007fa60be15fa0 R15: 00007ffd7ad40ae8 [ 968.301472][ T2530] [ 968.981371][ T2539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8593'. [ 969.096740][ T2539] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8593'. [ 969.126288][ T6992] IPVS: stop unused estimator thread 0... [ 969.129705][ T2539] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8593'. [ 969.309889][ T2551] netlink: 13 bytes leftover after parsing attributes in process `syz.3.8595'. [ 969.353249][ T2555] netlink: 'syz.2.8596': attribute type 4 has an invalid length. [ 969.750638][ T2577] netlink: 'syz.1.8601': attribute type 6 has an invalid length. [ 969.759832][ T2581] syzkaller0: entered promiscuous mode [ 969.780597][ T2581] syzkaller0: entered allmulticast mode [ 969.825197][ T2584] netlink: 1204 bytes leftover after parsing attributes in process `syz.0.8604'. [ 969.859748][ T2581] tipc: Enabled bearer , priority 0 [ 969.879065][ T2580] tipc: Resetting bearer [ 969.946562][ T2580] tipc: Disabling bearer [ 970.173664][ T2595] netlink: 220 bytes leftover after parsing attributes in process `syz.1.8607'. [ 970.198403][ T2245] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 970.205032][ T2595] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 970.226030][ T2245] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 970.284999][ T2245] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 970.298800][ T2245] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 970.506793][ T2618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8611'. [ 970.600101][ T2245] 8021q: adding VLAN 0 to HW filter on device bond0 [ 970.686271][ T2245] 8021q: adding VLAN 0 to HW filter on device team0 [ 970.723658][T25124] bridge0: port 1(bridge_slave_0) entered blocking state [ 970.730473][ T2631] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8613'. [ 970.731497][T25124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 970.804335][T25124] bridge0: port 2(bridge_slave_1) entered blocking state [ 970.811821][T25124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 971.016310][ T2644] [ 971.018710][ T2644] ====================================================== [ 971.025754][ T2644] WARNING: possible circular locking dependency detected [ 971.032886][ T2644] syzkaller #0 Not tainted [ 971.037333][ T2644] ------------------------------------------------------ [ 971.044380][ T2644] syz.0.8615/2644 is trying to acquire lock: [ 971.050398][ T2644] ffffffff8fb26e98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 971.059959][ T2644] [ 971.059959][ T2644] but task is already holding lock: [ 971.067440][ T2644] ffff8880525e4770 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 971.077107][ T2644] [ 971.077107][ T2644] which lock already depends on the new lock. [ 971.077107][ T2644] [ 971.087636][ T2644] [ 971.087636][ T2644] the existing dependency chain (in reverse order) is: [ 971.096685][ T2644] [ 971.096685][ T2644] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 971.104731][ T2644] _raw_spin_lock_bh+0x36/0x50 [ 971.110152][ T2644] nr_rt_ioctl+0x215/0xf90 [ 971.115139][ T2644] sock_do_ioctl+0x101/0x320 [ 971.120564][ T2644] sock_ioctl+0x5c6/0x7f0 [ 971.125570][ T2644] __se_sys_ioctl+0xfc/0x170 [ 971.130922][ T2644] do_syscall_64+0xe2/0xf80 [ 971.131388][ T2245] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 971.136061][ T2644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.136087][ T2644] [ 971.136087][ T2644] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 971.157320][ T2644] _raw_spin_lock_bh+0x36/0x50 [ 971.162761][ T2644] nr_rt_device_down+0xbe/0x860 [ 971.168183][ T2644] nr_device_event+0x137/0x150 [ 971.173507][ T2644] notifier_call_chain+0x19d/0x3a0 [ 971.179418][ T2644] __dev_notify_flags+0x16d/0x310 [ 971.184983][ T2644] netif_change_flags+0xe8/0x1a0 [ 971.190456][ T2644] dev_change_flags+0x130/0x260 [ 971.195834][ T2644] dev_ioctl+0x7b4/0x1150 [ 971.200773][ T2644] sock_do_ioctl+0x23e/0x320 [ 971.206067][ T2644] sock_ioctl+0x5c6/0x7f0 [ 971.211028][ T2644] __se_sys_ioctl+0xfc/0x170 [ 971.216147][ T2644] do_syscall_64+0xe2/0xf80 [ 971.221178][ T2644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.227597][ T2644] [ 971.227597][ T2644] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 971.235537][ T2644] __lock_acquire+0x15a5/0x2cf0 [ 971.240918][ T2644] lock_acquire+0x106/0x330 [ 971.246038][ T2644] _raw_spin_lock_bh+0x36/0x50 [ 971.251593][ T2644] nr_remove_neigh+0x25/0xe0 [ 971.256907][ T2644] nr_add_node+0x1e41/0x2630 [ 971.262062][ T2644] nr_rt_ioctl+0xe59/0xf90 [ 971.267016][ T2644] sock_do_ioctl+0x101/0x320 [ 971.272154][ T2644] sock_ioctl+0x5c6/0x7f0 [ 971.277114][ T2644] __se_sys_ioctl+0xfc/0x170 [ 971.282596][ T2644] do_syscall_64+0xe2/0xf80 [ 971.287832][ T2644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.294517][ T2644] [ 971.294517][ T2644] other info that might help us debug this: [ 971.294517][ T2644] [ 971.305024][ T2644] Chain exists of: [ 971.305024][ T2644] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 971.305024][ T2644] [ 971.318854][ T2644] Possible unsafe locking scenario: [ 971.318854][ T2644] [ 971.326599][ T2644] CPU0 CPU1 [ 971.331985][ T2644] ---- ---- [ 971.337548][ T2644] lock(&nr_node->node_lock); [ 971.342520][ T2644] lock(nr_node_list_lock); [ 971.349729][ T2644] lock(&nr_node->node_lock); [ 971.357033][ T2644] lock(nr_neigh_list_lock); [ 971.361823][ T2644] [ 971.361823][ T2644] *** DEADLOCK *** [ 971.361823][ T2644] [ 971.370177][ T2644] 1 lock held by syz.0.8615/2644: [ 971.375382][ T2644] #0: ffff8880525e4770 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 971.385336][ T2644] [ 971.385336][ T2644] stack backtrace: [ 971.391246][ T2644] CPU: 0 UID: 0 PID: 2644 Comm: syz.0.8615 Not tainted syzkaller #0 PREEMPT(full) [ 971.391269][ T2644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 971.391280][ T2644] Call Trace: [ 971.391288][ T2644] [ 971.391295][ T2644] dump_stack_lvl+0xe8/0x150 [ 971.391320][ T2644] print_circular_bug+0x2e1/0x300 [ 971.391340][ T2644] check_noncircular+0x12e/0x150 [ 971.391358][ T2644] __lock_acquire+0x15a5/0x2cf0 [ 971.391389][ T2644] ? nr_remove_neigh+0x25/0xe0 [ 971.391411][ T2644] lock_acquire+0x106/0x330 [ 971.391432][ T2644] ? nr_remove_neigh+0x25/0xe0 [ 971.391455][ T2644] ? do_raw_spin_lock+0x12b/0x2f0 [ 971.391473][ T2644] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 971.391493][ T2644] ? nr_remove_neigh+0x25/0xe0 [ 971.391516][ T2644] _raw_spin_lock_bh+0x36/0x50 [ 971.391541][ T2644] ? nr_remove_neigh+0x25/0xe0 [ 971.391565][ T2644] nr_remove_neigh+0x25/0xe0 [ 971.391595][ T2644] nr_add_node+0x1e41/0x2630 [ 971.391619][ T2644] ? nr_call_to_digi+0x126/0x1b0 [ 971.391641][ T2644] nr_rt_ioctl+0xe59/0xf90 [ 971.391666][ T2644] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 971.391697][ T2644] ? apparmor_capable+0x137/0x1a0 [ 971.391723][ T2644] ? capable+0x88/0xe0 [ 971.391737][ T2644] ? nr_ioctl+0x1b1/0x3b0 [ 971.391755][ T2644] sock_do_ioctl+0x101/0x320 [ 971.391781][ T2644] ? __pfx_sock_do_ioctl+0x10/0x10 [ 971.391803][ T2644] ? do_futex+0x333/0x420 [ 971.391832][ T2644] sock_ioctl+0x5c6/0x7f0 [ 971.391856][ T2644] ? __pfx_sock_ioctl+0x10/0x10 [ 971.391879][ T2644] ? __fget_files+0x2a/0x420 [ 971.391896][ T2644] ? __fget_files+0x3a0/0x420 [ 971.391912][ T2644] ? __fget_files+0x2a/0x420 [ 971.391929][ T2644] ? bpf_lsm_file_ioctl+0x9/0x20 [ 971.391949][ T2644] ? __pfx_sock_ioctl+0x10/0x10 [ 971.391971][ T2644] __se_sys_ioctl+0xfc/0x170 [ 971.391994][ T2644] do_syscall_64+0xe2/0xf80 [ 971.392010][ T2644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.392026][ T2644] ? trace_irq_disable+0x37/0x100 [ 971.392041][ T2644] ? clear_bhb_loop+0x60/0xb0 [ 971.392059][ T2644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.392075][ T2644] RIP: 0033:0x7f8c8b99aeb9 [ 971.392092][ T2644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 971.392106][ T2644] RSP: 002b:00007f8c8c8b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 971.392124][ T2644] RAX: ffffffffffffffda RBX: 00007f8c8bc15fa0 RCX: 00007f8c8b99aeb9 [ 971.392138][ T2644] RDX: 0000200000000440 RSI: 000000000000890b RDI: 0000000000000005 [ 971.392150][ T2644] RBP: 00007f8c8ba08c1f R08: 0000000000000000 R09: 0000000000000000 [ 971.392161][ T2644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 971.392173][ T2644] R13: 00007f8c8bc16038 R14: 00007f8c8bc15fa0 R15: 00007ffec1f2b888 [ 971.392193][ T2644] [ 971.999459][ T2245] veth0_vlan: entered promiscuous mode [ 972.019661][ T2245] veth1_vlan: entered promiscuous mode [ 972.048354][ T2245] veth0_macvtap: entered promiscuous mode [ 972.059741][ T2245] veth1_macvtap: entered promiscuous mode [ 972.079220][ T2245] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 972.093061][ T2245] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 972.108958][ T6352] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.124975][ T6352] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.134515][ T6352] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.145449][ T6352] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.196665][ T2245] ieee80211 phy117: Selected rate control algorithm 'minstrel_ht' [ 972.234973][T27828] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 972.246696][ T2245] ieee80211 phy118: Selected rate control algorithm 'minstrel_ht' [ 972.259495][T27828] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 972.299092][ T1009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 972.307820][ T1009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50