last executing test programs: 2.758518828s ago: executing program 4 (id=4857): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_timeval(r1, 0x1, 0x2, &(0x7f0000000040), 0x10) read(r0, &(0x7f00000003c0)=""/71, 0x47) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r3, 0x65, 0x5, &(0x7f0000000240)=0x1, 0x4) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0xea}]}}}]}, 0x3c}}, 0x20000020) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0xb4, r4, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_HE_OBSS_PD={0x10, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET={0x5, 0x2, 0x2}]}, @NL80211_ATTR_HE_BSS_COLOR={0x24, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}, @NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_COLOR={0x5, 0x1, 0x6}, @NL80211_HE_BSS_COLOR_ATTR_COLOR={0x5, 0x1, 0x34}]}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x9}, @NL80211_ATTR_TWT_RESPONDER={0x4}, @NL80211_ATTR_HE_OBSS_PD={0x34, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP={0xc, 0x5, "dcd948c9a43b5cf9"}, @NL80211_HE_OBSS_PD_ATTR_SR_CTRL={0x5, 0x6, 0x9}, @NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "fb85df2ae71900"}, @NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET={0x5, 0x3, 0x14}]}, @NL80211_ATTR_HE_BSS_COLOR={0x24, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}, @NL80211_HE_BSS_COLOR_ATTR_COLOR={0x5, 0x1, 0x1}, @NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_COLOR={0x5, 0x1, 0x4}, @NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}]}, @NL80211_ATTR_HIDDEN_SSID={0x8, 0x7e, 0x1}]}, 0xb4}, 0x1, 0x0, 0x0, 0x44080}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000e00)=ANY=[@ANYBLOB="980200001000010400000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="000004000000000024001280090001007866726d000000001400028008000200020000000800020001000000140003007866726d30"], 0x298}}, 0x0) r5 = socket(0x1e, 0x1, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x8a, &(0x7f0000000440), 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r7, 0x10, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0x7}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x18014) 2.36776771s ago: executing program 2 (id=4866): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710443000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r0 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r0, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, 0x24) connect$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private}}, 0x24) getsockname(r0, &(0x7f0000000080)=@can, &(0x7f0000000000)=0x80) 2.147643412s ago: executing program 2 (id=4869): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x18, 0x0, 0x201, 0x70bd29, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000010}, 0x4000801) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x1, 'veth0_to_hsr\x00', {}, 0x9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x20e, 0x11f, 0x0, &(0x7f00000004c0)="b9180bb76003070c009e40f086dd1fff31000000330020010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d74733e0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19", 0x0, 0x31, 0x6000000000000000, 0x0, 0x0, 0x0}, 0x50) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c00100006000d0085a168d0bf46d32345", 0x33, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x100, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800, 0x55407}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000810}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) getsockopt$nfc_llcp(r1, 0x10f, 0x0, 0x0, 0x3b514ca05b9f5cc7) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r1) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xc2200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x1c, r3, 0x10, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000092}, 0x804) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), r2) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000ecffffffffff2000000005002000000000000c001f0070687930"], 0x28}}, 0x0) 2.11914422s ago: executing program 1 (id=4870): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000010c0)={'wpan0\x00', 0x0}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r7, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000081c0)=@deltfilter={0x34, 0x2d, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xa, 0x4}, {0x2, 0xffff}, {0xfff3, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x40890) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e20, 0x3, 'none\x00', 0x30, 0x4, 0x68}, 0x2c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_int(r9, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[@ANYBLOB="504ae68e"], 0x8) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x15, 0x3240, 0x3a}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0xc03, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x10) r13 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict]}}, 0x0, 0x26, 0x0, 0x1}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x2, &(0x7f0000000300)=@raw=[@map_idx_val={0x18, 0xb, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x100, 0x49, '\x00', 0x0, 0x25, r13, 0x8, &(0x7f00000005c0)={0x9, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8e}, 0x90) getsockopt$inet6_tcp_int(r11, 0x6, 0x1e, 0xffffffffffffffff, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x4, 0xc24, 0x9, 0xfffffffb}}, 0x44) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB, @ANYRES32=r2, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x4040001}, 0x810) 1.811076446s ago: executing program 4 (id=4873): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = accept$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f00000001c0)=0x6e) bind$unix(r1, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000080)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) 1.787072832s ago: executing program 1 (id=4874): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x32, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x70bd2d, 0x25dfdbff, {}, [@IFLA_MTU={0x8, 0x4, 0x42}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x24, 0x8, 0x4, 0x1ff, 0x0, 0x1, 0x0, 0x6, 0x7, 0x0, 0xa, 0x0, 0x0, 0x8, 0x0, 0x0, [0x0, 0x2]}}) sendmsg$NFNL_MSG_ACCT_GET(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x40, 0x1, 0x7, 0x201, 0x0, 0x0, {0x0, 0x0, 0x331d}, [@NFACCT_FLAGS={0x8}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x8}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x7}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r6) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="2da882de01903c858b68ffa67156998cca011ed5c3d4b648d65f7d5c91cf612a93300139a13969c8fba75b16c8485a6f50a700433603037f44777ef9b5cdda4f715c420a7f284fdcb9749be5e3cf7d987bc3cfadcd848dc91d34475b756f39e8832a25b8dc9bcda927a6cca8bdc6fe3ad208ce0e3997ab4d359dcd2c8c2e8439487c581ba9fc91fada817e2582ec6d311df3b8d340607aa030658f2f1e21e8c575", @ANYRES16=r8, @ANYBLOB="0100000000000000000030000000"], 0x14}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000425bd7000fcdbdf040200010008003f0036000000080061"], 0x24}, 0x1, 0x0, 0x0, 0x4008001}, 0x20000000) sendmsg$NL80211_CMD_SET_COALESCE(r4, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="e2b58f743d5306e378f68606b8ea4e80b3e86369c4e0b1ac6e93cc8c15b708f493880ef88de4368dddbc273f2834cc0b576975d348185ff74b2a7ada03aa983c41c41bddbeaca67b33bd5aad16379b0d8f0bd2a217e53d0323719b11c2921ae98a0a41c548386ba525dc2fe5732f749eaf94eecf2c8e02fc496c42b87e74336b665b221983cf1a9f1da9c94caa775bea69abfd07f1e0245b041d45085ae7feacc8f8e84babc22ebfe242539585570ecb3e", @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r9, @ANYBLOB], 0x28}}, 0x0) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0xfffffffffffffffe, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="f9a1e227973fc3ed653407bfcee8a85beb62f3fea639a42b88590faea2bbb9fc1b02682b6ea16e74faae4b284c34096a8c089a82edf51dbbf452cf4f26d7287cb864bd7e45cdbd86cedf8adc6186b2f0d8a54461189c3c4a7df8b4e79512aaa5cc621373bdaf39ff15d2", @ANYRES16=r5, @ANYBLOB="01002dbd7000fddbdf253b0000000c009900080000006b00000004006c009201330040200100080211000001080211000000f584afaaed063300001f694cc2a4dce8fc9ab4a5bdf591980b6f221e8edc3d7c49ddbbd470d916bdf4030100dd07038de8d35ab32eddaa3b706b19b6ca1d7f15b64e0287df44ee489a580be89fba74b63c8deb66021956bca785187cf19fa249120bafb8b09b1fddee7ed51ccb7b1c1b6205569da65f29772de5b996addcf8382ad023e429ea9e04e8e044fd3287fc88786e1d17e95a228849dfad3ad58f69385ee255ebf72f19e8c96947f8f2eee8addd92a826d112749cd1c2cc6b9195845f2f7801fe32a9e5c51bb6a5e0f12324470ddd3142fc1442ac144f306f6efdb2b6b4dd32bb9c9c906ffef22b6d9dd68e262ed8688da52055e9c152cd0e52903aba8bfcbe2f7cbedd96b32464c36b9affb477a089ef3cdd2cc3a21f7875a298d3bbc0bbb93117a8000735d835c67a409a6fe8163a2886af0eafbf0faa4f3b6c74922ed0c5dd396031c5ffee3e008e708c1f8a42d90d1a6d0dc7e453372265b733fbbcb5ec3e54b3e07b54f9e232eb4b5da208b86bb675f41f80a6ea73160ff800000600cd000c00000004008e0004008e00040087000400870008005700020e0000080026006c090000080026006c090000050018013c000000"], 0x1f0}, 0x1, 0x0, 0x0, 0x4801}, 0x8801) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) close(r1) 1.694571083s ago: executing program 4 (id=4876): unshare(0x20000400) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000001000000000000000741000300000018"], 0x68}}, 0x0) pread64(r0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x2b, &(0x7f0000000040)={@local, @local, @void, {@ipv4={0x800, @generic={{0x7, 0x4, 0x0, 0x0, 0x1d, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @local, {[@cipso={0x86, 0x6}]}}, "e9"}}}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x0, 0x1000, 0x3}, 0x20) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000004c0), r5) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="070600000000000000002d0000000c000500000000000000000008002f000000f1e67500000a0001007770616e3100000005002b0000"], 0x3c}}, 0x0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)={0x2c, r7, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004810}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r8, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendto$inet(r8, &(0x7f0000000440)="cb4ca11a", 0x4, 0x1, 0x0, 0x0) sendmmsg$inet(r8, &(0x7f0000000d00)=[{{0x0, 0x1e, &(0x7f0000002c00)=[{&(0x7f0000001500)="b25b365c0254a7c6fc7ea6155a71b613b02d1645aab67271075189c3540c4dd19ebfb3c4acf87f2eeb258e62cc6ae96db360d874500cb86b4185ee533bf708", 0x3f}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0ac8fb1d99df61d7b518d0a62071e7ec69f658d5a52d7eb7ea31db43f8cf570f335a80860ac4cc240dc149d8468493db8aad089f590d62e0bcb9d1dcee636ee311ee51839b7201745baef82209b2ab741dc5ea481ae9dcebe39b1101a42a8c82de46107541c240ad0d9ee4a9340cffd72aaea692a60993637c81d23a0d0ebbae66f1eb2771df2482c043d8715ae788b56cc91eaa4d6bbdec82d8f91eb822d0b5f3ebd86", 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000002b40)='-', 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce90bfdbcfb8a86a74f6799f98c36e23e210f053830ac8e978a0785884001a7099c4b9016f1a65a57390caf78c272cbf9711f94505dd525af1ff7d013438df5b844226f41b81e58eb73366", 0x4b}, {&(0x7f0000000540)="f2e659a0b00d26c2ee15", 0xa}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2964dd16e01d56b414499264923beda58d7da0313c1ccafe53965750f25bdaa6b56a87307ec23d48b6f35ce49a813a2bc3cb23fdf42826bdc16788ff466919594de5bf8a1fa5d825947271ade4a95efeb170c", 0xfffffd57}, {&(0x7f0000001340)="b8", 0x1}, {&(0x7f0000000500)="01", 0x1}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000140), 0x1}, {&(0x7f0000000340)="e4", 0xfffffec2}], 0x2, 0x0, 0xffffff84}}], 0x5f, 0x4000000) setsockopt$sock_int(r8, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) getsockopt$inet_pktinfo(r8, 0x0, 0x8, &(0x7f0000000500)={0x0, @empty, @dev}, &(0x7f0000000540)=0xc) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)={0x14, r10, 0x1}, 0x14}}, 0x0) r11 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000340), r3) sendmsg$NLBL_UNLABEL_C_STATICADD(r3, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="88000000", @ANYRES16=r11, @ANYBLOB="0002299d7000fbdbdf250300000014000200fc0000000000000000000000000000002e00070073797374656d5f753a6f626a6563745f723a73656d616e6167655f726561645f6c6f636b5f743a733000000014000200fe80000000000000000000000000001514000600687372300000000000000000000000000500010000000000"], 0x88}, 0x1, 0x0, 0x0, 0x4008000}, 0x4008010) 1.609208521s ago: executing program 1 (id=4877): r0 = socket$inet6(0xa, 0x3, 0x7) r1 = accept$netrom(0xffffffffffffffff, &(0x7f0000000140)={{0x3, @default}, [@bcast, @default, @remote, @bcast, @remote, @default, @default, @netrom]}, &(0x7f00000000c0)=0x48) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f00000001c0)=0x9, 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@private2, 0x800, 0x0, 0x0, 0x1, 0xf801}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@private0, 0x800, 0x0, 0xff}, 0x20) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x23}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={{0x14, 0x1, 0x1, [r3]}}], 0x18}, 0x0) r5 = socket(0x840000000002, 0x3, 0xff) getsockopt$sock_cred(r5, 0x1, 0x3e, &(0x7f00000003c0), &(0x7f0000000140)=0x32) r6 = socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b24, &(0x7f0000000000)={'wlan0\x00'}) setsockopt$inet_sctp_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000200)={0xb, 0x0, 0x6, 0x3, 0xc, 0x81, 0x5, 0x7, 0x4, 0x75, 0x8, 0x5, 0x0, 0x3}, 0xe) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001000010c25bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000050010000400000008002300030000000500110004000000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) 1.578500784s ago: executing program 3 (id=4878): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d010000000000004704000001ed000062030000000000001d440000000000007a0a00fe00ffffffc303000010010000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda8cc658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ad539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c97888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5a444a41bac326ddea7d7b9c90d44f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2a4d39b43878b6ef26ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee92ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93b71db0a2366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00000000000000000000009a8329eb97567787ff28dd96c8e0f9e3c84394afc8f83dc6c6c813fafed61cdd6117092562837a3fa3fc388ab57429a9ecc4fddb0f0a7e4a1415d82d8bac999696d9130e36fc86df796a72559c523fae90d0b742d09cd2edf652c67aa62742e9ce0ff5283f627b622a83576f57d0899e0da8483f9dc296"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$tun(r1, &(0x7f0000000080)={@val={0x0, 0x88f7}, @void, @ipv6=@icmpv6={0x4, 0x6, "29a18a", 0xcf, 0x3a, 0xff, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {[@dstopts={0x0, 0xe, '\x00', [@hao={0xc9, 0x10, @empty}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x48, {0x2, 0x10, 0x2, 0xc2c, [0xffffffffffffffff, 0x6, 0x8, 0x4, 0x4, 0x2, 0x400, 0x1]}}, @hao={0xc9, 0x10, @private1}]}, @srh={0x32, 0x4, 0x4, 0x2, 0x5, 0x20, 0x8, [@private1, @mcast2]}], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x7, 0xcb, 0x5, 0x40, [{0x19, 0x2, "5a1025e96226125090ec418070e9af554596c9ea49"}]}}}}, 0xfb) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d010000000000004704000001ed000062030000000000001d440000000000007a0a00fe00ffffffc303000010010000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda8cc658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ad539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c97888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5a444a41bac326ddea7d7b9c90d44f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2a4d39b43878b6ef26ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee92ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93b71db0a2366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00000000000000000000009a8329eb97567787ff28dd96c8e0f9e3c84394afc8f83dc6c6c813fafed61cdd6117092562837a3fa3fc388ab57429a9ecc4fddb0f0a7e4a1415d82d8bac999696d9130e36fc86df796a72559c523fae90d0b742d09cd2edf652c67aa62742e9ce0ff5283f627b622a83576f57d0899e0da8483f9dc296"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) (async) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) write$tun(r1, &(0x7f0000000080)={@val={0x0, 0x88f7}, @void, @ipv6=@icmpv6={0x4, 0x6, "29a18a", 0xcf, 0x3a, 0xff, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {[@dstopts={0x0, 0xe, '\x00', [@hao={0xc9, 0x10, @empty}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x48, {0x2, 0x10, 0x2, 0xc2c, [0xffffffffffffffff, 0x6, 0x8, 0x4, 0x4, 0x2, 0x400, 0x1]}}, @hao={0xc9, 0x10, @private1}]}, @srh={0x32, 0x4, 0x4, 0x2, 0x5, 0x20, 0x8, [@private1, @mcast2]}], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x7, 0xcb, 0x5, 0x40, [{0x19, 0x2, "5a1025e96226125090ec418070e9af554596c9ea49"}]}}}}, 0xfb) (async) 1.410277303s ago: executing program 1 (id=4880): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x56) connect$inet(r1, &(0x7f0000000380)={0x2, 0x4e25, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10) close(r1) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @typed={0xb, 0x12c, 0x0, 0x0, @str=')!.\'&&\x00'}, @nested={0x11, 0x2, 0x0, 0x1, [@nested={0xc, 0x14, 0x0, 0x1, [@typed={0x8, 0x19, 0x0, 0x0, @u32=0x9}]}, @generic='V']}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x56) (async) connect$inet(r1, &(0x7f0000000380)={0x2, 0x4e25, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10) (async) close(r1) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @typed={0xb, 0x12c, 0x0, 0x0, @str=')!.\'&&\x00'}, @nested={0x11, 0x2, 0x0, 0x1, [@nested={0xc, 0x14, 0x0, 0x1, [@typed={0x8, 0x19, 0x0, 0x0, @u32=0x9}]}, @generic='V']}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) 1.406086196s ago: executing program 3 (id=4881): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="1c00000000070103000000000000000000000000080001"], 0x1c}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}}, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f0000000100)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) r5 = accept(r2, 0x0, &(0x7f00000002c0)) ioctl$sock_bt_hci(r5, 0xc0000038, &(0x7f0000000440)="34c87cf3c501ffb933a40e855b5ce78673e0c1967ccae6f60c02173922e74c51f1bfe4829ccc62f0f3b37f324e8b52d224bccc4987ef7f520baeaf310708e67cc8d1ca5a666fe30f8bf9156e4ed9fdbb385d2204c4a9f6d6782365785f9ed093d4c92cc9c765f8b12ea7d5d16dc5bda22a529dad37e25f7b16506d06e55c2d9b41e9475ae9d223566bffecf8a1cfee8313c19cd9c3d4e62e0cf20bb307673e397ba3dd88b256f347e2c449f8416657b8db16d307779eeac5aa3bca28792d39b03b6dc2335614eea160cd06e53b8252b06731e2684b0cb519ea63eeaa47b285e2ccbd9256a2493bc353be248d211b0a9ac9d6ca21be25c2") r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000300)="390000001300090468fe0700000000005f50e475ebdde021e5c00000ff3f04000000480100100000000004002b00707b010014a4ee1ee438d2fd000000000000007208b54e3a249f45bb4e1263d5533c51dd117b1be8f834da69ea4632fbac88ba2baa2a2897841562a343ea25fb1bb2b837c96058bbdfe26ac791f403fdbdb2c246a4e8e715afb4ace16dbd3189c4946cf50486679e06ccf5f9e06dd80e74", 0x9f}], 0x1) close(0x3) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000a000000000008000b002417"], 0x44}, 0x1, 0x2000000000000000}, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000240)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) socket$packet(0x11, 0x3, 0x300) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000016c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000013f82e"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071101800000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x28e, &(0x7f00000000c0)=ANY=[@ANYBLOB="e727dc07001f00000000000086dd609907a602582c03cb697a653e336f000000500000000000ff0200000000000000000000000000010102002e0000000000"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)=ANY=[@ANYBLOB="69e1629b6174391e7dd7a2d786dd60b6000000302c03cb697a653e336f000000500000000000ff02000000000000000000000000000102000003"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 1.237607623s ago: executing program 0 (id=4882): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000980)={0x802}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x52, 0x1, 0x0, 0x0, {0x2}, [@typed={0x8, 0x3, 0x0, 0x0, @binary="feffffff"}]}, 0x1c}}, 0x0) connect$can_bcm(r0, &(0x7f0000000140), 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0x80049370, &(0x7f0000000040)) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[], 0x0) sendmsg$can_bcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) recvmsg$can_bcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000340)=""/154, 0x9a}, {&(0x7f0000000180)=""/95, 0x5f}, {&(0x7f0000000680)=""/244, 0xf4}, {&(0x7f0000000780)=""/180, 0xb4}, {&(0x7f0000000100)=""/51, 0x33}, {&(0x7f0000000840)=""/250, 0xfa}], 0x6}, 0x18040) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='\a\x00'/16, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000200000000000000000000004acede967c288ef4e03d074f42b78b9f7c73b3edddb7312d7f7fcf028c850d5e1b22299841e18e59f6351808acdeedcee9bcc0c7244fd8ec7917a60f49d08530850d968e8174f18b1af584c45ba45426901e6c5da8496c15b9a330dd7d629282c5d43779f24d97f2118919843d045406299efcacef747dc7ab0620fe4b7dbe76d2d33e0300f93b1f4015d3cd56375810c90ce86510cf81e84a2090768fb9b6049a9f7558b252a0e64ec8433c888970d7dc1e494aaf689866dbf9b87bcc0c361407e2e827ff0d1a569eef3fb3aedf20b5e41a7b083eeadd7ec4e7b4ca541b6960a83aa3978fadfd28076c486a25bb8a665f62505573f6542d72eb20c11287c7513449"], 0x20000408}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000100013070000000000000000ac1414bb00000000000000000000000000000000000000000000ffffac14140000000000000000000a00000000000000", @ANYRES64=r3, @ANYRES32=r2, @ANYRES64=r3], 0x13c}}, 0x8051) socket$can_bcm(0x1d, 0x2, 0x2) (async) socket(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000980)={0x802}, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x1c, 0x52, 0x1, 0x0, 0x0, {0x2}, [@typed={0x8, 0x3, 0x0, 0x0, @binary="feffffff"}]}, 0x1c}}, 0x0) (async) connect$can_bcm(r0, &(0x7f0000000140), 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0x80049370, &(0x7f0000000040)) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) (async) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[], 0x0) (async) sendmsg$can_bcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) (async) recvmsg$can_bcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000340)=""/154, 0x9a}, {&(0x7f0000000180)=""/95, 0x5f}, {&(0x7f0000000680)=""/244, 0xf4}, {&(0x7f0000000780)=""/180, 0xb4}, {&(0x7f0000000100)=""/51, 0x33}, {&(0x7f0000000840)=""/250, 0xfa}], 0x6}, 0x18040) (async) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='\a\x00'/16, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000200000000000000000000004acede967c288ef4e03d074f42b78b9f7c73b3edddb7312d7f7fcf028c850d5e1b22299841e18e59f6351808acdeedcee9bcc0c7244fd8ec7917a60f49d08530850d968e8174f18b1af584c45ba45426901e6c5da8496c15b9a330dd7d629282c5d43779f24d97f2118919843d045406299efcacef747dc7ab0620fe4b7dbe76d2d33e0300f93b1f4015d3cd56375810c90ce86510cf81e84a2090768fb9b6049a9f7558b252a0e64ec8433c888970d7dc1e494aaf689866dbf9b87bcc0c361407e2e827ff0d1a569eef3fb3aedf20b5e41a7b083eeadd7ec4e7b4ca541b6960a83aa3978fadfd28076c486a25bb8a665f62505573f6542d72eb20c11287c7513449"], 0x20000408}}, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000100013070000000000000000ac1414bb00000000000000000000000000000000000000000000ffffac14140000000000000000000a00000000000000", @ANYRES64=r3, @ANYRES32=r2, @ANYRES64=r3], 0x13c}}, 0x8051) (async) 1.20852735s ago: executing program 1 (id=4883): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r0, &(0x7f0000000000)="c6bbf6b3d649d08663d2f8cf7330eadefd080ff872c41cca8293158ececcea54e1d5243684775b9a355ca28d8b04f780c8c520643ccba8e85317447059f7b010f4df0272f3425a253385c96d92c77710f2944609777e5b4bd0e2144989a777c1bfd4432484c81a95a7f823cc647e37d2d827ef74fce6", 0x76, 0x84, &(0x7f0000000080)={0xa, 0x4e22, 0x4, @private1, 0x2}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r1) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x46, 0x7, 0x1, 0x4, 0x1}, &(0x7f0000000140)=0x14) (rerun: 64) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000180)={r2, 0x800, 0xfffffff7, 0xb64d}, 0x10) (async) r3 = socket$kcm(0x29, 0x0, 0x0) recvmsg$kcm(r3, &(0x7f0000001340)={&(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001240)=[{&(0x7f0000000240)=""/4096, 0x1000}], 0x1, &(0x7f0000001280)=""/155, 0x9b}, 0x0) (async) r5 = openat$cgroup(0xffffffffffffffff, &(0x7f0000001380)='syz1\x00', 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f00000013c0)='memory.current\x00', 0x0, 0x0) (async) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000001440)={0x0, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x14}}, {0x2, 0x4e20, @empty}, {0x2, 0x4e23, @rand_addr=0x64010101}, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001400)='tunl0\x00', 0x8, 0x7fffffffffffffff, 0x5}) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001500), r4) (rerun: 32) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000001640)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001600)={&(0x7f0000001540)={0xa8, r8, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x20, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_SOCK={0x5c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xd}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}]}]}, 0xa8}}, 0x24000001) (async, rerun: 32) sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f00000017c0)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001780)={&(0x7f00000016c0)={0xac, r8, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x30, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e22, @remote}}}}]}, @TIPC_NLA_SOCK={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xdb}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x101}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x916}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x8800}, 0x800) (rerun: 32) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x3c, 0x2, 0x1, 0x201, 0x0, 0x0, {0x3}, [@CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x1) ioctl$FS_IOC_FSGETXATTR(r5, 0x801c581f, &(0x7f0000001900)={0x0, 0x7, 0x3, 0x10001, 0x2}) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000001940)) (async) r9 = syz_genetlink_get_family_id$devlink(&(0x7f00000019c0), r4) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r1, &(0x7f0000001c80)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x53ec487a4a82a206}, 0xc, &(0x7f0000001c40)={&(0x7f0000001a00)={0x234, r9, 0x6796d530a3c6a61c, 0x70bd2a, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x16, 0x4}, {0x5}, {0x6}, {0x8, 0xb, 0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x16, 0x8}, {0x5}, {0x6, 0x11, 0x3}, {0x8, 0xb, 0xad}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xa}, {0x6, 0x16, 0x4}, {0x5}, {0x6, 0x11, 0x8}, {0x8, 0xb, 0x4}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x4}, {0x8, 0xb, 0x210}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xff}, {0x6, 0x16, 0x1}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0xe}, {0x8, 0xb, 0x9}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xfffffff8}, {0x6, 0x16, 0x5}, {0x5}, {0x6, 0x11, 0xbd9}, {0x8, 0xb, 0x4}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8}, {0x6, 0x16, 0x9a5b}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x6}, {0x8, 0xb, 0x100}}]}, 0x234}, 0x1, 0x0, 0x0, 0x814}, 0x400c0) r10 = accept$packet(r6, &(0x7f0000001cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001d00)=0x14) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000001d40)={0x4, 0x8000}, 0x4) (async) ioctl$sock_inet_SIOCDELRT(r6, 0x890c, &(0x7f0000001dc0)={0x0, {0x2, 0x4e21, @multicast2}, {0x2, 0x4e20, @loopback}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x0, 0x0, 0x0, 0x0, 0x400, &(0x7f0000001d80)='vlan0\x00', 0x5, 0x4, 0x7}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000001e40)=0x2, 0x4) (async) bind$packet(0xffffffffffffffff, &(0x7f0000001e80)={0x11, 0x1a, r11, 0x1, 0x9, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async, rerun: 64) syz_genetlink_get_family_id$tipc(&(0x7f0000001ec0), r7) (rerun: 64) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000001f00)=0x2, 0x4) (async) r12 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_IPV6_XFRM_POLICY(r12, 0x29, 0x23, &(0x7f0000001f40)={{{@in=@empty, @in6=@empty}}, {{@in=@loopback}, 0x0, @in=@remote}}, &(0x7f0000002040)=0xe8) 1.159397453s ago: executing program 0 (id=4884): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000010c0)={'wpan0\x00', 0x0}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r7, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000081c0)=@deltfilter={0x34, 0x2d, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xa, 0x4}, {0x2, 0xffff}, {0xfff3, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x40890) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e20, 0x3, 'none\x00', 0x30, 0x4, 0x68}, 0x2c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_int(r9, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[@ANYBLOB="504ae68e"], 0x8) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x15, 0x3240, 0x3a}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0xc03, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x10) r13 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict]}}, 0x0, 0x26, 0x0, 0x1}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x2, &(0x7f0000000300)=@raw=[@map_idx_val={0x18, 0xb, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x100, 0x49, '\x00', 0x0, 0x25, r13, 0x8, &(0x7f00000005c0)={0x9, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8e}, 0x90) getsockopt$inet6_tcp_int(r11, 0x6, 0x1e, 0xffffffffffffffff, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x4, 0xc24, 0x9, 0xfffffffb}}, 0x44) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010002007000fedbdf251500000010002b", @ANYRES32=r2, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x4040001}, 0x810) 1.152275965s ago: executing program 2 (id=4885): mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newae={0x70, 0x1e, 0x399, 0x0, 0x0, {{@in6=@mcast1}, @in6=@local}, [@lifetime_val={0x24}, @mark={0xc}]}, 0x70}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x5, 0x1, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000005, 0x3032, 0xffffffffffffffff, 0x0) 937.509972ms ago: executing program 3 (id=4886): r0 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r0, 0x84, 0x76, &(0x7f0000000000)=""/4071, &(0x7f0000001080)=0xfe7) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0x12) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000440)={0x1100, 0x0, 0x0, 0x10000}) preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000040)=""/92, 0x5c}], 0x1, 0x2, 0x9) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001040)={0x59d2, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x15, 0x4, &(0x7f0000001100)=ANY=[@ANYBLOB="18000000000000000000000000000000711294000000000095", @ANYBLOB="b1f84ed4d373ec37381db94d67d68b05fc29064eec1ca5e6a6cbb45128d1865de8c760e7b3f9ae23786822a8cbaf554420f8c763ccaf5b477af65a7ba10f78f6e23513eb6ac2bf9a3eddc986b01693c554f895215306bdaaa926e8ce42efa664f7f60e4031d2f8055cf7471bec83774e8ed6e7d20c"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, r1}, 0x94) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.throttle.io_service_bytes\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x1}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000100)={r5, 0xf2, "917ef2b0bf25ca026d4b58195d05b1eae6b9e104d06a939d5c1f984d987f789b9a15726e40fc061561fc6a3651fd51c8089d743ad4a75bdaa570929b717662a0f303789dd8fabb7b2f4b6e9b08f7ceff8c6ea3b3147622c0be55443559055da921f8a3e4ee51dde6151f3db4dbc432e84258e081c285cc99b489690f735a77d2d43932a5008ff7fa0bfebc319ca677ca51a7d9a2424eb2496a6266cd15420abc0e5b1d7afc7bcd255c3826c8e276a4b72ba422428165c634e3e04afa07b98837f33dac5165793b336f5a453731ebfd9b7bc20503507b27187ccb7ba3d29433f757ea814b57e53470b1c797c9998e2abaf384"}, &(0x7f0000000200)=0xfa) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000080)='ip_vti0\x00', 0x10) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000cc0)=@newtaction={0x50, 0x30, 0x12f, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_police={0x38, 0x1, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [[@TCA_POLICE_AVRATE={0x8, 0x4, 0xfffffffe}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x2}}}}]}]}, 0x50}}, 0x0) pwrite64(r3, &(0x7f0000001280)="dbcfe07caa65db76e00958b560d63ffd3276c704462ca55332c3d8b34fe61a20618bfbed0f0f2484e727036b6bf5c233825231d8603c9b2528a300814cb91fd388413c139e749f5dbdcd098e0a792c676b73fa89919f1793b38491ea21f4e11448f5db4777612afe1067e5fb3b92582813389356fcca135c135124137f9fc144d644d2ec10473939ed29e80fe1c7a20bc11e909e33fe3cb62a7b7174dd73f7af48989312a39540a3a52cbb13eca8813261442b348e78fd3aa747bb54ae839528baaa29a0f17d10bf5dad023966ef8e158a6d51e39933106c3e3b607bd56f8b29ce5ad301fdbb9b07a37bdac2f63a8e14b1049ea8ef725bc9ac408519d168da8b1de128de4b256d0a05ea12443be57eb0cd37d87fd5b35a553f363519a25cadfdbb8abb6df5e78b302f910c4616a097d10a5405960c8ff0117f3ed1891a8e82647ce16eb16ec788fa8a36eaca8007a76bd1ad1709e869630a1e93f3dbda09d476ab6b3814a426b6d22c4d1bdd3340e070e641eaaea7a1c684af3c5cabf4c7bb1a8889af7ffee23b575fe1f7f37f1d89eb3e543a17e613e3114d39701da2501b6aa997ebd7d8b95d51673a6ec51e29a56f354b35c64f03eb0818562509e8bf1b6e699a62e482f54f893fa470c2a39ba03b0f6176ddf11a4e971c4575622019e83c3902d6738c64e266b05e3327dfa11fe77049502e7d9ecb13fe86b1eead60fd4eaff0e1682e9f88ef8e00391b3a256e9835c70710ac8d14146ffce021856cb876b6292f209bc137d1a3ce0c1decaffc0ce932f1c29e1242cbe664b448fce7a02b766a0ee72845a89f3e9c513ad7dba2975d097a82b7316c8c6fa88fe53fcb5d823ab22ac26ec4e04314764953b21a0607ec736f7f41497ae89504006bc44e6142fce22ffabecc26adacb2a7c8a1b7fa3e6dba6110bc990764fb5f6243ad9ef0122c7b68d88b8570a1df57c77b96ceb787dda4207c77ef4c10d5f9248fba003ded651092ad287a01fb70fe52609b40e82ea6fdf05eaf965262da64b7f06164e0767fe14e86242b533cc104545629c325a95bc9a10971c81b0de121d2109bd6516780035bf4c3be427040b9999e962f935e93da256fe12cda2f364955e79ed04e29435f67f98dbd4d71c171364710138242e4070dc853ac2d750d0349e28c78d8ca67bc33ee7d391ae547c126aa828bfb52301413fd59840e54dfc3b523a2b266bf7885e7c5a7253c727782edcbcabd7c2bba1331ff75c9191f794a90ebb05f17c291a7e16566cd79aa7aa14b160c5b1f6b9601783c8aaedda5ec7e3bc157241b771fdc6cd0d74494929ae529e34a540ac1c044845042ef908f34d232a2846b4463f216b8c4a32ec1785ef0d757d09a70242f50bf394feeffb038ccaa4728575b70b8557dee40ebedb144d258370deb4f1fcbb9f83499083ca0753221f6a7452dcf4146a079c2ce19824750e7f139404686b3b5caabf7afc65bc765c3815eb29dfcf9f5bfa76530b51ad3a70bf8833e0b5d8ab93c5913dc5469b737d45660f950bb44ba7a992c3612ded3402a2883ab5f4813b7ebb18d484c186bf9afd40b7fdaaa42117c419de2749d5518dff049104b9c8780969353bc39ab6e58a3723883343254e933cdc1ac9abcee86677d9aac6c01f483697f77a998600e2fe948feac8795d6a4e8a181324e1b423db9139df9bc7880995e230244d1033b29cb69afa8d74573ea07f3152232a4057d26e5bd8b7231d66195fa0e1d16567d5e5b9ba531dc6c065e4a7d05759cac62df954cfe2395c92b1a663988484fe910a61505d6fefd7c9b339284ba0aa91bf73dadb8c55fcd0b7361c318680fdfef7b6ce0a2f2772eab974563f325f9ab375919c65fc246e043fae9546e3db792907e8b986c5d63b58a3ed83f61846618156e0c8dfe1986a3ab85e6c3ec624743f400a651c6ffd413df4c6eacaf6fcfb98cd2059746039ede6d8567815d6d7712abe6aa007dc0973a8efbee7a2450a02efb1da4a0b486bac5183a62b2867aee21a7bf3768f3f57376d3be2872e7b8928edf2135d96cd3f9ffb7aae9a2422690872ddff8615bc604b935fe675f06483eb6498628f596272bd39158a5ea7cbd2e42acee9669d644d44d04d9b7c7fcc788c891f8c87568f6c59d726e7f9ad52ce31b892a9ea1ec70199ab5a597ea3e7e1cdae9cf3a8a6059e0c0bdc11f84d5734a99deed2adf31230ac2bf222c2666462a873de053c4b03d629c5dfb567fb2e124aae3040360eeb61eb7989977d8955a2b69d762d7c3a557ac828044370dd969c0078e47900335444755e4f2255f86bb7cca8b44e8988b07455bc6951719a45e362b80f19687f5f8a09bd762440fe68e2391e652f2a384bbccf5c44738478d00a509e632f1fb01add67609d2b4fcdfbc8ccdf5e8ea60eb9f54bc898ba9daff3005abfad8d109e5ebaea442c9272b40249b2ddd46bee8aa6c11a040b594fbb2c282ea25a22a9b2d195b5e287b8b73ab2957ea303255130483b1d6428843373fa55fe8d6c0e21173147e5b741757211c077afe5dc6e3b13ee52d921b4f03baed82502016139aa33909312534a8c81399f8a6ee9f5b130f9cbc963b9921b72634845c80059c3cee69e21acfa2bc46d485277ed00dc2994f5f124ce7e2b2ffb160dda915797d77dc99a455291db4d7bcc7e313dcffcbf548c9941153c845b53dc8969a6b46f7248a8a0235f0f20cf80a3f9d096e849ab8f54a3cd8e496c0b7b34d9e21b31072ea5f00e77157339d8799ccf419bb78f2c0ef15875082fbf096a15e270081cd9c3ab15fc0b33408f8375849cfea917d0070170d83ca1b29aa4a8499b737461488473ba941a6a09c2f30b84b52f07d08ca42de21e8de73988b2d12ed9a4bffaa689b490877f984946bfa2befd1343f090c9a4ee56d1436055eba9948ac8fa8de55273f78439e629183ae09032c3999a73e0830cb64dcc27ed99245d0c73a53dd35c4ea54710a9b1551e9b4edbc4dee79cd12a4e52f808d3e22561b00684207fbab6485c079ad028d7a9d3e2f7db892e4b408d8367a6413eb3d39ad30117df2ca29ab266cd357d175f46c1c83f21dd84b99bcd5c7ed9e93ec488babeb6347ec7288fba6ac69f3717d0d994c0d7908f816e73590b7ad6af29c6baa60038dfca70308f6f5335cdc3575214f1d5cdaf18cc5b534c5b8a41b79c92012dbb780fa6a831488650fae1fa17e6db93113bc491d99062bcbf776366be8d477beb9f15cd7b0f9c5438cf85fe8464d870cce7a6740e895c987e85d3483103e45fa5bf57c2f17da157f3a931156ff2c89fabee3da6cee9c3dd2ab89e3df18257e60cc85175f3cd1da364926c3053d0a4d3d6e28b26b863249c96d05484d23588828594da423ae5cdf85b9638af5a4954373237b67a0cedf5da36bed0bc85191358ac1809ecea67e5841e167a098bbb451d2a5d7001c4dde3948e3030ff0f32d1ba0a1e0732375878726b8e1bc414f321d11d36a3455af0bd85ab9f950d6247dbffa2ab68e82768ec4cf340cd788a6732871441769fb72f851bf8a45afa47a2b5f17b3f6463884ea40bec8ee950e86c22a5179c0ee7f053c09d3a1e892b562352107d034705a8f83662cb369cd6a086f6e43b2d2acd4ca71e9dacadd7a5bd8dceee633cffb35dc224628479b913c7c47968fc94587fa2f87f1230304ae3b0049b122b2f529eef436d8e713512a800e48decab3bd021f297fb0fb1e279a5c916a1c3ad7ba285cd4217c5141678adcb81e8378f98d8cae3049aac4f3cd998f535f2f8c20b32345f5f61ed5e60a4f9d4cff9b38b7fa19450dafae23a6be2a1e724df9229adf2add5212c88dbaed9e2441dce1085deecfecf1872c6d55386efb64a64e1d7a16722f00139199d366fbde50c2bbee77e34973367e66fb49991fc2c6df205883c10934251e1ebe93e1172599e648e30ad1cf91d140c007ab67818257126d16b5c1ac600800e2b63c95590fc3fb822e80d82c8642c5131dd91e5b69d6b3d071d0af7aafddc0661d37a712ef7c28fa4ac1245bc1eb11e8fecd63155b5c8e234d0fc4b00b0eb8ed01d122a62da8ba7ac4defb13c3f52001d05d4abd1255850698bc0f94b318efc23cf47e10e0aa1977eab53ffb11f29da864af75ea9a1afd18df6d75bda48945c8e557042398bcdd59ee6ffa2012e233c8c95fcae968c3ca6067bdce5a5616e7e5f74a69c46828bf8a684b4c4bb0109bdc3592023bc27dc9043a5602127e48d00de5d0e02e1390a7197299e1b6400e5eb6fc86df2f4c6f854d7c6e15b2eff18ebf4763e931db7618b2c63083dd57125e6602c1a2d10a52b487e9c37df44419596678e968a8d0b574234080e9165b6ce05b9baf8d6b7e8c82f5ade50f5aa2150694482ab1a702ddff2514893aaaeda72f80f162e74b8d1bdb3fad41075ddfac2bcfb0ec63719b1d87e09d0efe44b547188b8fe963d70863cac14bf84f55a2465b4cb5392bb5c582c3c9b96b68e45e2402ca8d1a6ed9e8bd98ffaab9b074d83338c6f00040b267e2b18ce224f470ed2b7b68cbe9054024e26dff0ce399e91448ba1bdc1b894af8b0a1951324c0ed83d5c6e3041fe4c655d344fa622273a91fd18ced1d9d1cdef3e00042fdc8e2b042c7f39400b26a6f8173c0343a26bc27ac372d349c06d67c7b4c0abd0477885bbf9f9fb266068e08a428703a4ca55a613069daec20f060c712e734bde4d8936ae5cc45c6bbb158630c7703929d56f219176efd792e02ab6bbc4048716d902e8290207b02dde14a736de2fe57a8d6926ed00bc6ed14d27a0de57463be497f11982e1f6c337a176ee5c8ad8b9d955fba5f4cb529cec72443739a04e5f8422324d697675a7926d394948c7952359968e518c11f8b1f01342c5e5510b7e3c0cf15725fe91b379453159c0ff506ff9ca6d5ff7ea5197c3aee8f33e9de5d31de07f65cdf354a8a7827d99c9f7db63a5122b97306739803d7822fc5706e4a2fafa11e859bbd7af19c9288b7f9f0f9dfaf7385863a888fd8eb05d6032c5eccaea33546ce09e0fff79366f03e3f46ac717bd2d1df71a78497fcd0caf63164b3d98699f10b72cb46107e222b2344dceb6f13e7eb11b3b5da2a979bdf6cf3b490762b7f0d33287625f9000e31f7da418ec4e083421e741fe0c366c71325ea8694c4882cb4ea812f72c8afb6a484609afb4c82c77356b28885e41ce3c03e9a3dd1cb1d7f7616cb2d10c57e548fc2001cfa92dd527dc7eb9efca3a4d77a96718b9e67bed413d3bff1a07c82e980ba7931506525c72cf41e8ab8cb23f7c5b1b996d6a30d9aeb8a469630a8669dc59896b3a0a82a2d5d99a33a82ffc3a3dd9e1e634770a5ba071898083d261d465b1782096df5e96015f6b8d4836af1dd44ef99aa7ddb04a3e472b2b5f15bc2f145fae5995ed8923d1e5b17c3fbdc131db1e8efe1dcbf963bc055b5388a88b6e0961fc9755f15fcfa4310ddfeb863ad9b011e04451ee937f6972ed8a649dbdd020b60dfb4e8cb9ce7a6b96a55aac100d78bac43e4ff923b69de01bd14d146c9f4d0b74e5ac1e16ae38ee4545b1b93b9107db66b9457e02515315823f84f41957446cdb69ecf6f2210988e85c8a73fc829bf4c02488e67230cd50ee767a1d984ee4be87870e3473d5143e3de86deb44ffcf6662edcf09ae437605b138bbd33e392dd8e5f44336b03c8f938407065f8cca910609d7babe3cb4f03f501fdb4a9d3583869187098e0d88bd2c83723283e5b4aa5b1283aec2ec4fed375dfd40b17be077953e59fa91982d9a36218cb312b4952242ed942", 0x1000, 0xffffffffffff09d0) 937.145328ms ago: executing program 2 (id=4887): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r1, 0xe4}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1804"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="6c00000002060500000000000000000000000000120003006269746d61703a6970006d616300000005000400000000000900020073797a3100000000200007800c00018008000140000000000800080000000000080006400000000005000500020000000500010006"], 0x6c}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r3, 0x4010744d, &(0x7f0000000180)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'batadv0\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000100)={@val, @void, @eth={@random="ad65d0fc00", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x1, 0x2, 0x20, 0x64, 0x0, 0x1, 0x11, 0x0, @rand_addr=0x64010102, @empty=0xe0000001}, {0x4e22, 0x4e21, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0xff, 0x0, @void}}}}}}}}, 0x32) r7 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10) 897.411918ms ago: executing program 1 (id=4888): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000100)={0x1d, r2, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000380)="00c7662fcf1f6e36b7", 0x9}], 0x1}, 0x48005) readv(r1, &(0x7f0000000400)=[{&(0x7f00000000c0)=""/20, 0x14}], 0x1) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x37, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0, @ANYRESHEX=r0, @ANYRES16=r1, @ANYRESDEC=r0, @ANYRES64=r0, @ANYRESDEC=0x0, @ANYRES16=r0, @ANYRES32=r1], 0x128}, 0x800) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={0x0, @tipc=@name={0x1e, 0x2, 0x3, {{0x41}, 0x1}}, @ax25={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1}, @llc={0x1a, 0x102, 0xf7, 0x0, 0x1, 0x6}, 0x7f, 0x0, 0x0, 0x0, 0x400, &(0x7f0000000000)='vlan1\x00', 0x7, 0x5, 0x200}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001580)={0x34, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x28b}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xd5}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_ABORT_SCAN(r3, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r4, 0x20, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x5, 0x38}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x40000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r6) 829.277474ms ago: executing program 0 (id=4889): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112c7000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0xff88, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001e000180180010"], 0x34}}, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xc, &(0x7f0000000680)=@assoc_value={0x0}, &(0x7f0000000500)=0x8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000240), r4) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000200)={0x0, 0x9000000, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000100000008000100040000002c0004800500030080ff00000500030080ffffff05000380ff0000000400030080ffffff0500030080ffffff0800020003"], 0x50}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)={0x170, r5, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0xf4, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x99}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x12}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6078a66b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x16fb8c8f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26ff3a8d}]}, {0x54, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xbd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x37a602aa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x67962f3d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x97}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x30}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x40456649}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6e87dc31}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x43697b0f}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2e99b6ee}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4bc28841}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x84}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xfd22d0e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xee}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x769982e7}]}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x60, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8ab9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe562}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x96d7}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x751e54e0}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9f66}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb887}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x47126f9d}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8ec8}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x72fa}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x170}, 0x1, 0x0, 0x0, 0x44}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000002c0)={r3, 0x7}, 0x8) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x30, 0x19, 0x200, 0x0, 0x25dfdbfe, {0x1c, 0x0, 0x14, 0x0, 0xff, 0x2, 0xff, 0x3, 0x1200}, [@RTA_VIA={0x14, 0x12, {0x15, "c85a7388024596712b5399de4ed6"}}]}, 0x30}}, 0x4040804) 694.252524ms ago: executing program 4 (id=4890): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xf, 0x4, 0x4, 0x7}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001fc0)={r0, &(0x7f0000001e80), 0x0}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000a00)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x118}, 0x1, 0x0, 0x0, 0x8000}, 0x48000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, [@call={0x85, 0x0, 0x0, 0x3b}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) recvmmsg$unix(r3, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f00000008c0)=""/89, 0x59}, {&(0x7f0000000200)=""/252, 0xfc}], 0x2}}], 0x2, 0x40010102, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$alg(r3, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000605a0adc0000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080007000000000008000140000000000900010073797a300000000078000000060a010400000000000000000100000008000b400000000009007bc27db67a30000000005000048020000180070001007274000014000280080001400000001508000240000000042c0001800900010068617368000000001c00028008000440fffff3e008000240000000170800074000000000140000001100010000000000000000000000000af1ffafc4a34c0ab7afa49e99df3d415f37b29e01533766f8d34661ab93f9e9cee4fd5958331af82a154c3c48c49327b05ae174fab10cdcebce4dafa4d04617fc641a69c02388b868b2cb21777102ba37f3497811010e9014028c59c43fe3c06b2e2ae0c6567154b7745600c0ee23e99f943483b11c70f737eae81de225f8498d59cd662b31261dedf4dfbc654a606dc319859a203b7aac129bc9da65d4531d70434c6be3022665edfa80c3412ef840a61281"], 0x100}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="030300000000000000008dc42cd5e6496b00000000f4cd440a000000"], 0x14}}, 0x0) 692.996203ms ago: executing program 3 (id=4891): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000000)={'sit0\x00', 0x0}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b707000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000240)=r3}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xd50, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xd50, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 520.446997ms ago: executing program 0 (id=4892): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a8c000000060a090400000000000000000200000060000480300001800e000100696d6d6564696174650000001c000280100002800c000280080001800000000108000140000000002c0001800b0001006e756d67656e00001c0002800800034000000001080001400000000408000240000000940900010073797a30000000000900020073797a32"], 0xb4}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00ff0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded5275c00"/420], &(0x7f0000000100)='GPL\x00'}, 0x48) 512.090576ms ago: executing program 4 (id=4893): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x891f, &(0x7f0000000000)={'dummy0\x00'}) getsockopt$netrom_NETROM_N2(0xffffffffffffffff, 0x103, 0x3, &(0x7f0000000000)=0xece9, &(0x7f0000000040)=0x4) select(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000000c0)="17000000020001000003be8c5ee17688a2002b08030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba000840024f0298e9e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0x11a) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@typedef={0x0, 0x0, 0x0, 0x8, 0x2}]}}, 0x0, 0x26, 0x0, 0x1, 0x5}, 0x28) 429.869186ms ago: executing program 3 (id=4894): r0 = socket(0x10, 0x803, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELCHAIN={0x34, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x34, 0x8, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELOBJ={0xe4, 0x14, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_USERDATA={0x8b, 0x8, "930da6cf9126524d928e889bc27f0169f8b211326c5fb0550e643d3f5e6e3007c05f5f2e75def3e10ee6cd95e3223120c3f1d83c2b34db9f5465e14ce356d1c50928f51ccb83abd9f2bebe28173362b4b7d2b5293b5c6edf19c97d11e09c1a525bbc9e09a075cf58ddfa6e1e3330ed7e0d9aabc7d0fbd64f24b1b1d0a90e1bfa8689d72a4e4300"}]}], {0x14}}, 0x174}, 0x1, 0x0, 0x0, 0x4080}, 0x20000000) 386.483158ms ago: executing program 4 (id=4895): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x18, 0x0, 0x201, 0x70bd29, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000010}, 0x4000801) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x1, 'veth0_to_hsr\x00', {}, 0x9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x20e, 0x11f, 0x0, &(0x7f00000004c0)="b9180bb76003070c009e40f086dd1fff31000000330020010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d74733e0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19", 0x0, 0x31, 0x6000000000000000, 0x0, 0x0, 0x0}, 0x50) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c00100006000d0085a168d0bf46d32345", 0x33, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x100, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800, 0x55407}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000810}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) getsockopt$nfc_llcp(r1, 0x10f, 0x0, 0x0, 0x3b514ca05b9f5cc7) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r1) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xc2200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x1c, r3, 0x10, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000092}, 0x804) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), r2) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000ecffffffffff2000000005002000000000000c001f0070687930"], 0x28}}, 0x0) 323.326767ms ago: executing program 0 (id=4896): socket$packet(0x11, 0x3, 0x300) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000000040)=@getpolicy={0x58, 0x15, 0x1, 0x0, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x1b}, @in=@local}, 0x6e6bba, 0x2}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0x58}}, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x8000000000000001, 0x0) socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x28e, &(0x7f00000000c0)=ANY=[@ANYBLOB="e727dc07001f00000000000086dd609907a602582c03cb697a653e336f000000500000000000ff0200000000000000000000000000010102002e0000000000"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)=ANY=[@ANYBLOB="69e1629b6174391e7dd7a2d786dd60b6000000302c03cb697a653e336f000000500000000000ff02000000000000000000000000000102000003"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 229.662531ms ago: executing program 0 (id=4897): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000900020073797a31000000000500010007000000050005000a0000000c00078008001240fffffffa11000300686173683a69702c70647274000000000500040000000000"], 0x58}}, 0x0) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@deltclass={0x24, 0x29, 0x300, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0x4, 0xffe0}, {0x10, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40440c4}, 0x2000000) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r6) r7 = socket$alg(0x26, 0x5, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000002d00091327bd70000000000006"], 0x20}}, 0x84) sendmsg$netlink(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf2504"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r8) bind$alg(r7, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r9 = accept$alg(r7, 0x0, 0x0) recvmsg(r9, &(0x7f0000007140)={0x0, 0x0, &(0x7f0000007100)=[{&(0x7f00000002c0)=""/50, 0x32}], 0x1}, 0x40010002) sendmmsg$alg(r9, &(0x7f00000007c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4001044}], 0x1, 0x24008844) sendmmsg$inet(r9, &(0x7f0000005d00)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000140)="ec0767137af7e7d890debdedb6aba1a8b4ede604461087e87bc1e54d08a4c58d94481c59aaedb0d8e7dcf67b286f2eb81279", 0x32}], 0x1}}], 0x1, 0x8058) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r10, 0x8914, &(0x7f0000000000)) r11 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}}, @NFT_MSG_DELSETELEM={0x18, 0xe, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}, @NFT_MSG_NEWTABLE={0x24, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_USERDATA={0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x30, 0x16, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_FLOWTABLE_HOOK={0x4}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x0, @bcast, @bpq0, 0x9, 'syz0\x00', @default, 0x1, 0x1, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a84000000090a014400000000000000000100000208000a400000000008000640ffffff000900010073797a0000000000080005400000001c0900020073797a3200000000080003400000008838000980340002800c00018008000140000000090c0001800800014000000008ee00018008000040000000040c0001800800014000000002140000001060512f3dbb7c4f9ca15200ed81a43f"], 0xac}, 0x1, 0x0, 0x0, 0x4404c810}, 0x0) 229.219981ms ago: executing program 3 (id=4898): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x8000000, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000015006b05c84e21000ab16d6e230675f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async, rerun: 64) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e00)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404000000c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e46968eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000000000000005335000000143ea70c2ab40c7cb70c943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a33e680846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fa807de38a3a61e44a9ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf652e28e700000000000000b24478a78a0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8ff7e7d1c94c450503009688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0000f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4cbaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13e434aae9df81ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a384002421d898913c45a9ac091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c045a17e9a61c3b064e679508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d522946727024de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df00000000000000000000dfa4c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5d00f26126d4cf2c73e5f94030000000000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62fc9dfffeb13b4858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1ef90ed4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d78429d358aa54b4b49926c4be9ee4659153d9f9f5d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000d0267ac40d1130a9000000000045f50812a1a0530b02baed19f4c977ac0d397ed6371ec589bf5943690250bdfa5b676d5d53d2ab3aeee1a6910c1a33b6c06c93386768f8b1bb27ec31cffbd4f5c7b0c2e14e4fc6c2f089ab08567254e93780afdddefb3f0d2143ad73c0bf2467859049d46dc5aa91f918a307e7dcaaccd6cbe66e8a04d201392a487f681f82528a800e27d65200ae10e1b5d39a29d8a2c8ed2dfa77e21249b45806733e674a9e8e72ad1cb0d3bfadb00a18a5008ea1e4c8fb93d311f52a476c576a3f65c9bdd4e4b870aed4cb9906a8aa25986e6e30be249d9911114b42b2fb51168e56000a62b794c193f7797ebeb7f8b91c70b6e720af06ecfcfb89a2d5a25f"], &(0x7f0000000140)='GPL\x00'}, 0x48) (rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x18000000000002a0, 0x160, 0x0, &(0x7f0000000380)="b9e403c6630d698cb8a00b04339c", 0x0, 0x7ec, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x26}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x90) (async, rerun: 64) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) (rerun: 64) setsockopt$netrom_NETROM_T1(r3, 0x103, 0x1, &(0x7f0000000080)=0x1, 0x4) (async) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000200)={r3, r2}) 170.450569ms ago: executing program 2 (id=4899): socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000500)='blkio.throttle.io_serviced\x00', 0x7a05, 0x1700) (async) r0 = socket$packet(0x11, 0x2, 0x300) socket$nl_netfilter(0x10, 0x3, 0xc) (async) close(r0) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r3, &(0x7f0000000bc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000ec0)=""/156, 0x9c}, {&(0x7f0000001340)=""/4096, 0x1000}, {&(0x7f0000000040)=""/114, 0x72}, {&(0x7f00000001c0)=""/60, 0x3c}, {&(0x7f0000000200)=""/152, 0x98}, {&(0x7f00000002c0)=""/210, 0xd2}], 0x6}, 0x1}], 0x2, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000004c0)={0x2008}) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f00000002c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00'}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000200)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={r5, r1, 0x0, 0x7, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00\x00'}, 0x30) (async, rerun: 32) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async, rerun: 32) r7 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r7, 0x110, 0x4, &(0x7f0000000380)=0x1, 0x4) r8 = openat$cgroup_ro(r6, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) (async) r9 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r9, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) (async) r10 = socket$kcm(0x10, 0x2, 0x0) mmap$xdp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x30, 0xffffffffffffffff, 0x80000000) (async) recvmsg$kcm(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000a40)=""/4072, 0xfe8}], 0x1}, 0x0) (async, rerun: 64) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0xfe33) (rerun: 64) getsockopt$inet6_buf(r9, 0x29, 0x3d, &(0x7f0000000000)=""/85, &(0x7f0000000080)=0x55) (async) close(r8) 0s ago: executing program 2 (id=4900): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_opts(r1, 0x0, 0x19, 0xffffffffffffffff, &(0x7f0000000340)=0x10) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0xfffffffffffffdc1, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x17}]}}}, {0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x0, 0x4, 0x1, 0x0, 0x1}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xc}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) kernel console output (not intermixed with test programs): h:syzkaller0> rejected, failed to enable media [ 313.989690][T16265] __nla_validate_parse: 7 callbacks suppressed [ 313.989706][T16265] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3041'. [ 314.067781][T16254] syzkaller0: entered promiscuous mode [ 314.074083][T16254] syzkaller0: entered allmulticast mode [ 314.125217][ T5918] hsr0 speed is unknown, defaulting to 1000 [ 314.227287][T16273] netlink: 'syz.3.3043': attribute type 10 has an invalid length. [ 314.244883][T16272] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3043'. [ 314.265334][T16272] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3043'. [ 314.281640][T16272] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3043'. [ 314.302308][T16272] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3043'. [ 314.327585][T16272] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3043'. [ 314.412748][T16273] bond0: (slave wlan1): Opening slave failed [ 314.956182][ T51] Bluetooth: hci1: command tx timeout [ 315.247640][T16282] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3044'. [ 316.713838][T16019] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 316.770553][T16019] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 316.812296][T16019] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 316.853126][T16019] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 316.906645][T16298] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3046'. [ 317.024457][ T51] Bluetooth: hci1: command tx timeout [ 317.113179][T16314] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3052'. [ 317.157000][T16314] netlink: 'syz.1.3052': attribute type 9 has an invalid length. [ 317.183210][T16314] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3052'. [ 317.275496][T16019] 8021q: adding VLAN 0 to HW filter on device bond0 [ 317.294938][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.301030][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.388483][T16019] 8021q: adding VLAN 0 to HW filter on device team0 [ 317.406114][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.433811][T16314] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 317.461536][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 317.469238][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 317.551506][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.559838][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 317.567075][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 317.622214][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.645872][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.729586][T16337] bond0: entered promiscuous mode [ 317.736612][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.745873][T16314] wg1 speed is unknown, defaulting to 1000 [ 317.772090][T16314] wg1 speed is unknown, defaulting to 1000 [ 318.070263][T16352] sctp: [Deprecated]: syz.1.3061 (pid 16352) Use of int in maxseg socket option. [ 318.070263][T16352] Use struct sctp_assoc_value instead [ 318.330526][T16361] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 318.338018][T16019] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 318.423679][T16366] veth0_to_bridge: entered promiscuous mode [ 318.440598][T16366] netlink: 'syz.0.3065': attribute type 12 has an invalid length. [ 318.455178][T16365] veth0_to_bridge: left promiscuous mode [ 319.027547][T16392] vlan2: entered promiscuous mode [ 319.033594][T16392] vlan2: entered allmulticast mode [ 319.074871][T16392] hsr_slave_1: entered allmulticast mode [ 319.096792][T16404] __nla_validate_parse: 3 callbacks suppressed [ 319.096814][T16404] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3073'. [ 319.531718][T16421] unknown channel width for channel at 909000KHz? [ 319.581695][T16019] veth0_vlan: entered promiscuous mode [ 319.626991][T16019] veth1_vlan: entered promiscuous mode [ 319.760520][T16019] veth0_macvtap: entered promiscuous mode [ 319.795761][T16019] veth1_macvtap: entered promiscuous mode [ 319.802770][T16431] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3081'. [ 319.852915][T16019] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 319.865437][T16437] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3085'. [ 319.878369][T16019] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 319.974826][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.985105][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.002155][ T49] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.011572][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.238883][T16453] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3089'. [ 320.283555][T16453] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 320.298305][T16457] netlink: 116 bytes leftover after parsing attributes in process `syz.1.3092'. [ 320.328471][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 320.348529][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 320.422329][T16453] (unnamed net_device) (uninitialized): option mode: invalid value (133) [ 320.449883][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 320.484602][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 320.713862][T16477] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2972'. [ 320.758995][T16475] netlink: 'syz.0.3097': attribute type 83 has an invalid length. [ 320.803714][T16472] hsr0 speed is unknown, defaulting to 1000 [ 320.826465][T16472] wg1 speed is unknown, defaulting to 1000 [ 321.162885][T16488] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3100'. [ 321.643993][T16497] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3103'. [ 321.655174][ T5864] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 321.669277][ T5864] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 321.695074][ T5864] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 321.708855][ T5864] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 321.715383][T16506] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3103'. [ 321.764858][ T5864] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 321.798271][ T5859] syz_tun (unregistering): left allmulticast mode [ 322.030683][T16502] hsr0 speed is unknown, defaulting to 1000 [ 322.036659][T16517] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 322.057723][T16502] wg1 speed is unknown, defaulting to 1000 [ 322.357263][T16530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3110'. [ 322.553057][T16537] netlink: 'syz.3.3112': attribute type 1 has an invalid length. [ 322.804563][T16541] tipc: Started in network mode [ 322.814913][T16541] tipc: Node identity ba15bc9b9edc, cluster identity 4711 [ 322.825848][T16541] tipc: Enabled bearer , priority 0 [ 322.902274][T16559] netlink: 'syz.3.3118': attribute type 1 has an invalid length. [ 322.910732][T16559] netlink: 'syz.3.3118': attribute type 1 has an invalid length. [ 322.957212][T16546] syzkaller0: entered promiscuous mode [ 322.963078][T16546] syzkaller0: entered allmulticast mode [ 322.970172][T16546] tipc: Resetting bearer [ 323.049134][T16566] (unnamed net_device) (uninitialized): option use_carrier: invalid value (4) [ 323.099607][T16539] tipc: Resetting bearer [ 323.828028][ T51] Bluetooth: hci3: command tx timeout [ 323.970313][ T10] tipc: Node number set to 617200795 [ 325.172808][T16539] tipc: Disabling bearer [ 325.210259][T16502] chnl_net:caif_netlink_parms(): no params data found [ 325.619252][T16602] __nla_validate_parse: 7 callbacks suppressed [ 325.619273][T16602] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3128'. [ 325.699863][T16502] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.710234][T16605] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3129'. [ 325.742435][T16502] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.753936][T16502] bridge_slave_0: entered allmulticast mode [ 325.775845][T16502] bridge_slave_0: entered promiscuous mode [ 325.872252][T16502] bridge0: port 2(bridge_slave_1) entered blocking state [ 325.880682][T16502] bridge0: port 2(bridge_slave_1) entered disabled state [ 325.900385][T16502] bridge_slave_1: entered allmulticast mode [ 325.907173][ T51] Bluetooth: hci3: command tx timeout [ 325.919958][T16502] bridge_slave_1: entered promiscuous mode [ 325.929830][T16610] netlink: 4948 bytes leftover after parsing attributes in process `syz.4.3130'. [ 326.021665][T16612] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3131'. [ 326.148544][T16614] netlink: 'syz.2.3132': attribute type 2 has an invalid length. [ 326.160765][T16502] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 326.174673][T16614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3132'. [ 326.208945][T16614] tipc: Resetting bearer [ 326.249544][T16502] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 326.458690][T16502] team0: Port device team_slave_0 added [ 326.506405][T16502] team0: Port device team_slave_1 added [ 326.743493][T16502] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 326.775069][T16502] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 326.823086][T16502] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 326.841462][T16640] netlink: 'syz.3.3138': attribute type 2 has an invalid length. [ 326.852911][T16502] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 326.862667][T16502] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 326.868858][T16640] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3138'. [ 326.890594][T16502] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 326.926609][T16640] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3138'. [ 326.988497][T16634] netlink: 'syz.4.3136': attribute type 10 has an invalid length. [ 327.171638][T16653] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3140'. [ 327.192505][T16653] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3140'. [ 327.237748][T16502] hsr_slave_0: entered promiscuous mode [ 327.263826][T16660] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3141'. [ 327.275246][T16502] hsr_slave_1: entered promiscuous mode [ 327.282274][T16502] debugfs: 'hsr0' already exists in 'hsr' [ 327.322102][T16502] Cannot create hsr debugfs directory [ 327.401567][ T5918] IPVS: starting estimator thread 0... [ 327.440375][T16669] IPVS: set_ctl: invalid protocol: 94 100.1.1.0:20003 [ 327.494396][T16668] IPVS: using max 25 ests per chain, 60000 per kthread [ 327.868780][T16502] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 327.896431][T16502] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.985036][ T51] Bluetooth: hci3: command tx timeout [ 328.046290][T16502] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 328.056585][T16502] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.145504][T16690] netlink: 'syz.4.3150': attribute type 142 has an invalid length. [ 328.171086][T16502] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 328.183350][T16502] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.251983][T16692] nbd: must specify a device to reconfigure [ 328.282976][T16502] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 328.306031][T16502] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.507511][T16705] netlink: 'syz.2.3156': attribute type 1 has an invalid length. [ 328.606949][T16705] 8021q: adding VLAN 0 to HW filter on device bond6 [ 328.662421][T16713] 8021q: adding VLAN 0 to HW filter on device bond6 [ 328.680034][T16713] bond6: (slave vti0): The slave device specified does not support setting the MAC address [ 328.709077][T16713] bond6: (slave vti0): Error -95 calling set_mac_address [ 328.765686][T16705] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 328.998843][T16719] gtp0: entered promiscuous mode [ 329.003943][T16719] gtp0: entered allmulticast mode [ 329.073238][T16502] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 329.129585][T16502] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 329.166898][T16502] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 329.208740][T16502] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 329.269298][ T1099] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.291610][ T1099] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.318182][ T1099] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.338209][ T1099] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.480199][T16502] 8021q: adding VLAN 0 to HW filter on device bond0 [ 329.546484][T16502] 8021q: adding VLAN 0 to HW filter on device team0 [ 329.576674][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.584180][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 329.602804][ T1144] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.610157][ T1144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 330.065659][ T51] Bluetooth: hci3: command tx timeout [ 330.130364][T16766] tipc: Resetting bearer [ 330.282280][T16502] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 330.564583][T16502] veth0_vlan: entered promiscuous mode [ 330.617754][T16502] veth1_vlan: entered promiscuous mode [ 330.755718][T16502] veth0_macvtap: entered promiscuous mode [ 330.847584][T16804] __nla_validate_parse: 11 callbacks suppressed [ 330.847608][T16804] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3177'. [ 330.869348][T16502] veth1_macvtap: entered promiscuous mode [ 331.100289][T16502] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 331.177460][T16812] pimreg: entered allmulticast mode [ 331.213902][T16502] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 331.307508][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.343461][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.413984][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.433454][T16818] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3184'. [ 331.453446][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.519686][T16828] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3187'. [ 331.536519][T16824] vlan2: entered promiscuous mode [ 331.551229][T16824] vlan2: entered allmulticast mode [ 331.568352][T16824] hsr_slave_1: entered allmulticast mode [ 331.623335][T16828] syzkaller1: entered promiscuous mode [ 331.638329][T16828] syzkaller1: entered allmulticast mode [ 331.868281][T16841] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3191'. [ 331.903881][ T10] IPVS: starting estimator thread 0... [ 331.958226][T16844] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3192'. [ 332.015091][T16843] IPVS: using max 27 ests per chain, 64800 per kthread [ 332.063267][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 332.101807][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 332.144423][ T5864] Bluetooth: hci3: command tx timeout [ 332.337567][ T5973] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 332.361232][ T5973] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 332.441772][T16861] netlink: 'syz.4.3198': attribute type 17 has an invalid length. [ 332.456544][T16861] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3198'. [ 332.474651][T16861] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3198'. [ 332.495580][T16862] bridge_slave_0: entered promiscuous mode [ 332.506582][T16864] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3198'. [ 332.634022][T16871] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3098'. [ 332.838841][T16877] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3202'. [ 332.880452][T16877] sctp: [Deprecated]: syz.0.3202 (pid 16877) Use of struct sctp_assoc_value in delayed_ack socket option. [ 332.880452][T16877] Use struct sctp_sack_info instead [ 333.865510][ T5862] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 333.887579][ T5862] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 333.898448][ T5862] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 333.908898][ T5862] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 333.931366][ T5862] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 334.226837][ T5864] Bluetooth: hci3: command 0x0405 tx timeout [ 334.247472][T16906] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 334.306692][ T36] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.491001][ T36] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.573736][T16902] hsr0 speed is unknown, defaulting to 1000 [ 334.577792][T16929] netlink: 'syz.1.3219': attribute type 1 has an invalid length. [ 334.606368][T16902] wg1 speed is unknown, defaulting to 1000 [ 334.617955][T16930] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 334.698174][ T36] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.837216][ T36] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.293664][T16964] netlink: 'syz.1.3229': attribute type 24 has an invalid length. [ 335.623760][T16975] netlink: 'syz.1.3232': attribute type 1 has an invalid length. [ 335.660581][T16975] netlink: 'syz.1.3232': attribute type 2 has an invalid length. [ 335.672906][T16977] netlink: 'syz.2.3233': attribute type 1 has an invalid length. [ 335.855306][T16983] sctp: [Deprecated]: syz.0.3236 (pid 16983) Use of int in max_burst socket option deprecated. [ 335.855306][T16983] Use struct sctp_assoc_value instead [ 335.887022][T16983] __nla_validate_parse: 8 callbacks suppressed [ 335.887044][T16983] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3236'. [ 335.984561][ T51] Bluetooth: hci0: command tx timeout [ 337.079105][ T36] bond0 (unregistering): Released all slaves [ 337.219398][ T36] bond1 (unregistering): Released all slaves [ 337.363675][ T36] bond2 (unregistering): Released all slaves [ 337.387292][T16902] chnl_net:caif_netlink_parms(): no params data found [ 337.627160][ T36] tipc: Disabling bearer [ 337.683574][ T36] tipc: Disabling bearer [ 337.694713][ T36] tipc: Left network mode [ 337.710490][T16998] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3239'. [ 337.782761][ T36] IPVS: stopping master sync thread 9136 ... [ 337.969605][T17014] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3243'. [ 338.058211][T16902] bridge0: port 1(bridge_slave_0) entered blocking state [ 338.064951][T17018] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3245'. [ 338.094989][T16902] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.102802][T16902] bridge_slave_0: entered allmulticast mode [ 338.104755][ T51] Bluetooth: hci0: command tx timeout [ 338.112732][T16902] bridge_slave_0: entered promiscuous mode [ 338.138464][T17021] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3245'. [ 338.179635][T17025] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3247'. [ 338.212264][T17024] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3246'. [ 338.224429][T16902] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.239933][T16902] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.250220][T16902] bridge_slave_1: entered allmulticast mode [ 338.270075][T16902] bridge_slave_1: entered promiscuous mode [ 338.317310][T17021] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3245'. [ 338.595975][T17030] syzkaller1: entered promiscuous mode [ 338.601618][T17030] syzkaller1: entered allmulticast mode [ 338.841728][T17037] hsr0 speed is unknown, defaulting to 1000 [ 338.858133][T16902] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 338.869215][T17037] wg1 speed is unknown, defaulting to 1000 [ 338.873194][T16902] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 339.014303][ T36] hsr_slave_0: left promiscuous mode [ 339.051017][T17055] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3254'. [ 339.065716][ T36] veth0_macvtap: left promiscuous mode [ 339.072194][ T36] veth1_vlan: left promiscuous mode [ 339.077643][ T36] veth0_vlan: left promiscuous mode [ 339.281984][ T36] pim6reg527 (unregistering): left allmulticast mode [ 340.146670][ T51] Bluetooth: hci0: command tx timeout [ 340.366369][T16902] team0: Port device team_slave_0 added [ 340.408032][ T24] hsr0 speed is unknown, defaulting to 1000 [ 340.424892][ T24] infiniband syz1: ib_query_port failed (-19) [ 340.432683][T16902] team0: Port device team_slave_1 added [ 340.696637][T16902] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 340.703751][T16902] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 340.739712][T16902] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 340.908442][T16902] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 340.924976][T16902] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 340.953624][T16902] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 341.003681][T17081] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3259'. [ 341.017226][T17081] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3259'. [ 341.028987][T17081] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3259'. [ 341.102060][T17084] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 341.126960][T17084] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3260'. [ 341.225530][T16902] hsr_slave_0: entered promiscuous mode [ 341.234156][T16902] hsr_slave_1: entered promiscuous mode [ 341.253605][T16902] debugfs: 'hsr0' already exists in 'hsr' [ 341.259825][T16902] Cannot create hsr debugfs directory [ 341.261292][T17092] netlink: 'syz.1.3263': attribute type 3 has an invalid length. [ 341.337531][T17084] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3260'. [ 341.422737][ T36] IPVS: stop unused estimator thread 0... [ 341.691988][T17101] netlink: 'syz.0.3266': attribute type 62 has an invalid length. [ 341.743223][T17103] openvswitch: netlink: Key 9 has unexpected len 0 expected 4 [ 342.189201][T17109] netlink: 'syz.1.3270': attribute type 2 has an invalid length. [ 342.224799][ T51] Bluetooth: hci0: command tx timeout [ 342.274026][T17121] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3275'. [ 342.488173][T17129] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 342.502308][T17128] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3278'. [ 342.522634][T16902] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 342.543859][T16902] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 342.586820][T16902] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 342.645432][T16902] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 342.775938][T17145] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3281'. [ 342.816600][T17145] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3281'. [ 342.839213][T17145] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3281'. [ 342.919752][T16902] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.022514][T17149] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 343.060465][T16902] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.099045][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.106720][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.404020][T17164] geneve2: entered promiscuous mode [ 343.416203][T17164] geneve2: entered allmulticast mode [ 343.439015][ T1144] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.446379][ T1144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 343.475661][ T12] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 343.492934][T17164] netlink: zone id is out of range [ 343.498389][T17164] netlink: zone id is out of range [ 343.504146][T17164] netlink: zone id is out of range [ 343.513540][T17164] netlink: zone id is out of range [ 343.526713][T17164] netlink: zone id is out of range [ 343.534025][T17164] netlink: zone id is out of range [ 343.540152][T17164] netlink: zone id is out of range [ 343.554669][ T12] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 343.598633][ T12] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 343.656861][ T1144] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 343.745230][T17172] bond0: entered promiscuous mode [ 343.751524][T17172] bond_slave_0: entered promiscuous mode [ 343.769159][T17172] bond_slave_1: entered promiscuous mode [ 343.778170][T17172] batadv_slave_1: entered promiscuous mode [ 344.808662][T17212] netlink: 'syz.2.3298': attribute type 7 has an invalid length. [ 344.859043][T17199] netlink: 'syz.0.3297': attribute type 3 has an invalid length. [ 344.956005][T17212] : entered promiscuous mode [ 345.378575][T16902] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 345.567746][T16902] veth0_vlan: entered promiscuous mode [ 345.675684][T17256] team1: entered promiscuous mode [ 345.681203][T17256] team1: entered allmulticast mode [ 345.697659][T16902] veth1_vlan: entered promiscuous mode [ 345.766659][T17259] netlink: 'syz.4.3309': attribute type 6 has an invalid length. [ 345.808215][T16902] veth0_macvtap: entered promiscuous mode [ 346.015635][T16902] veth1_macvtap: entered promiscuous mode [ 346.048875][ T5918] IPVS: starting estimator thread 0... [ 346.093447][T17280] __nla_validate_parse: 77 callbacks suppressed [ 346.093470][T17280] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3312'. [ 346.174557][T17279] IPVS: using max 23 ests per chain, 55200 per kthread [ 346.221440][T16902] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 346.250168][T16902] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 346.299533][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.329966][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.392455][T17298] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3319'. [ 346.402504][T17298] net_ratelimit: 83 callbacks suppressed [ 346.402529][T17298] openvswitch: netlink: Flow actions attr not present in new flow. [ 346.423267][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.434921][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.442835][T17300] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3317'. [ 346.640274][T17304] netlink: 332 bytes leftover after parsing attributes in process `syz.2.3321'. [ 346.706349][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.750139][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.840310][T17318] netlink: 'syz.4.3324': attribute type 1 has an invalid length. [ 346.882645][T17318] netlink: 'syz.4.3324': attribute type 1 has an invalid length. [ 347.023826][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.064121][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.127660][T17329] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3325'. [ 347.171312][T17329] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3325'. [ 347.183409][T17329] netlink: 191164 bytes leftover after parsing attributes in process `syz.1.3325'. [ 347.221681][T17331] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3201'. [ 347.305906][T17333] netlink: 116 bytes leftover after parsing attributes in process `syz.2.3326'. [ 347.400902][T17338] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3327'. [ 348.252131][T17358] netlink: 'syz.0.3334': attribute type 1 has an invalid length. [ 348.285646][T17358] netlink: 'syz.0.3334': attribute type 2 has an invalid length. [ 348.291609][T17365] ip6gre1: entered allmulticast mode [ 348.527211][T17378] netlink: 'syz.0.3340': attribute type 13 has an invalid length. [ 348.589653][ T5864] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 348.600207][ T5864] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 348.612878][ T5864] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 348.624098][ T5864] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 348.633356][ T5864] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 348.667552][T17378] veth0_macvtap: left promiscuous mode [ 348.673310][T17378] macvtap0: entered allmulticast mode [ 348.684859][T17378] macvtap0: refused to change device tx_queue_len [ 348.879534][T17381] wg1 speed is unknown, defaulting to 1000 [ 349.522904][T17381] chnl_net:caif_netlink_parms(): no params data found [ 349.957851][T17436] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 350.108952][T17381] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.133095][T17381] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.141963][T17381] bridge_slave_0: entered allmulticast mode [ 350.150764][T17381] bridge_slave_0: entered promiscuous mode [ 350.159966][T17381] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.167461][T17381] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.174897][T17381] bridge_slave_1: entered allmulticast mode [ 350.183543][T17381] bridge_slave_1: entered promiscuous mode [ 350.463139][T17381] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 350.478457][T17381] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 350.698351][T17458] netlink: 'syz.0.3361': attribute type 6 has an invalid length. [ 350.703070][T17459] Bluetooth: MGMT ver 1.23 [ 350.715036][ T51] Bluetooth: hci2: command tx timeout [ 350.739224][T17381] team0: Port device team_slave_0 added [ 350.801964][T17381] team0: Port device team_slave_1 added [ 351.064933][T17381] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 351.072425][T17381] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 351.134994][T17381] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 351.174991][T17381] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 351.207783][T17381] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 351.237679][T17381] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 351.466833][T17381] hsr_slave_0: entered promiscuous mode [ 351.477406][T17381] hsr_slave_1: entered promiscuous mode [ 351.494715][T17381] debugfs: 'hsr0' already exists in 'hsr' [ 351.500510][T17381] Cannot create hsr debugfs directory [ 351.813614][T17512] netlink: 'syz.1.3377': attribute type 1 has an invalid length. [ 352.095231][T17516] __nla_validate_parse: 8 callbacks suppressed [ 352.095255][T17516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3380'. [ 352.231769][T17381] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.273548][T17381] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 352.461009][T17381] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.511042][T17381] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 352.748157][T17381] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.785151][ T51] Bluetooth: hci2: command tx timeout [ 352.790046][T17381] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 352.950418][T17555] wg1 speed is unknown, defaulting to 1000 [ 353.057776][T17381] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.081208][T17381] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 353.436654][T17580] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3395'. [ 353.448738][T17584] netlink: 212332 bytes leftover after parsing attributes in process `syz.1.3394'. [ 353.665450][T17589] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3396'. [ 353.815906][T17596] tipc: Started in network mode [ 353.821215][T17596] tipc: Node identity fad00c0c6549, cluster identity 4711 [ 353.842028][T17596] tipc: Enabled bearer , priority 0 [ 353.880545][T17596] tipc: Resetting bearer [ 353.973341][T17595] tipc: Disabling bearer [ 354.011492][T17381] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 354.066086][T17610] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3400'. [ 354.087438][T17381] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 354.151546][T17381] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 354.182632][T17614] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3403'. [ 354.275824][T17381] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 354.391918][T17631] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3405'. [ 354.596853][T17641] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3409'. [ 354.642952][T17639] geneve3: entered promiscuous mode [ 354.660986][T17639] geneve3: entered allmulticast mode [ 354.690397][ T1099] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 354.707228][ T1099] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 354.716553][ T1099] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 354.750006][T17641] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3409'. [ 354.811671][T17644] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.836526][T17644] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.865355][ T51] Bluetooth: hci2: command tx timeout [ 355.000289][T17662] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3413'. [ 355.042667][T17381] 8021q: adding VLAN 0 to HW filter on device bond0 [ 355.081151][T17381] 8021q: adding VLAN 0 to HW filter on device team0 [ 355.206887][ T6199] bridge0: port 1(bridge_slave_0) entered blocking state [ 355.214345][ T6199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 355.302853][ T6199] bridge0: port 2(bridge_slave_1) entered blocking state [ 355.310289][ T6199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 355.891743][T17702] netlink: 'syz.0.3423': attribute type 12 has an invalid length. [ 355.915136][T17702] netlink: 'syz.0.3423': attribute type 11 has an invalid length. [ 356.120218][T17381] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 356.130704][T17710] tipc: Started in network mode [ 356.135994][T17710] tipc: Node identity 8eedd7e19f44, cluster identity 4711 [ 356.143420][T17710] tipc: Enabled bearer , priority 0 [ 356.152117][T17712] syzkaller1: entered promiscuous mode [ 356.158583][T17712] syzkaller1: entered allmulticast mode [ 356.169069][T17710] syzkaller0: entered promiscuous mode [ 356.175204][T17710] syzkaller0: entered allmulticast mode [ 356.220103][T17710] tipc: Resetting bearer [ 356.350579][T17381] veth0_vlan: entered promiscuous mode [ 356.362168][T17710] tipc: Resetting bearer [ 356.392412][T17710] tipc: Disabling bearer [ 356.426457][T17381] veth1_vlan: entered promiscuous mode [ 356.488965][T17381] veth0_macvtap: entered promiscuous mode [ 356.501747][T17381] veth1_macvtap: entered promiscuous mode [ 356.530405][T17381] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 356.565406][T17381] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 356.613967][T17644] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.630276][T17644] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.641242][T17644] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 356.675667][ T6199] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.704033][ T6199] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.759424][ T6199] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.787452][ T6199] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.846452][T17725] netlink: 'syz.1.3431': attribute type 83 has an invalid length. [ 356.864065][T17644] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.877997][T17644] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.888805][T17644] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 356.945666][ T51] Bluetooth: hci2: command tx timeout [ 357.029413][T17644] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 357.041021][T17644] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.051877][T17644] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 357.198707][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.210510][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.285761][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.324401][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.384439][ T49] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.392961][ T49] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 357.439204][ T49] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 357.469789][T17735] __nla_validate_parse: 7 callbacks suppressed [ 357.469810][T17735] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3434'. [ 357.517835][ T1144] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.546723][ T1144] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 357.572036][ T1144] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 357.797823][T17756] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3437'. [ 357.902302][ T1099] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.934040][ T1099] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 357.951405][ T1099] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 358.044150][ T78] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 358.067052][ T78] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 358.084516][ T78] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 358.323117][T17777] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3443'. [ 358.447219][T17781] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3445'. [ 358.497415][T17785] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3447'. [ 358.615258][T17790] x_tables: ip6_tables: TEE.1 target: invalid size 40 (kernel) != (user) 272 [ 358.705605][T17791] x_tables: ip6_tables: TEE.1 target: invalid size 40 (kernel) != (user) 272 [ 358.765671][T17800] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3451'. [ 358.828547][T17799] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3452'. [ 358.884939][T17799] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3452'. [ 358.893969][T17799] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3452'. [ 358.963445][T17799] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3452'. [ 358.968305][T17808] netlink: 'syz.3.3456': attribute type 3 has an invalid length. [ 359.281122][T17825] gretap0: entered promiscuous mode [ 360.360500][T17875] tipc: Enabled bearer , priority 0 [ 360.393461][T17875] syzkaller0: entered promiscuous mode [ 360.421341][T17882] netlink: 'syz.2.3477': attribute type 10 has an invalid length. [ 360.436923][T17875] syzkaller0: entered allmulticast mode [ 360.557453][T17882] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 360.592647][T17874] tipc: Resetting bearer [ 360.752021][T17874] tipc: Disabling bearer [ 360.842524][ T5873] IPVS: starting estimator thread 0... [ 360.966087][T17910] IPVS: using max 23 ests per chain, 55200 per kthread [ 361.057014][T17922] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 361.277183][T17930] netlink: 'syz.3.3489': attribute type 12 has an invalid length. [ 361.304715][T17930] netlink: 'syz.3.3489': attribute type 11 has an invalid length. [ 361.681964][T17945] syzkaller0: entered promiscuous mode [ 361.692390][T17945] syzkaller0: entered allmulticast mode [ 362.365391][T17981] netlink: 'syz.3.3501': attribute type 1 has an invalid length. [ 362.450862][ T5878] IPVS: starting estimator thread 0... [ 362.560963][T17986] IPVS: using max 28 ests per chain, 67200 per kthread [ 362.849040][T17998] netlink: 'syz.0.3503': attribute type 10 has an invalid length. [ 364.516432][T17981] 8021q: adding VLAN 0 to HW filter on device bond1 [ 364.806403][T18012] __nla_validate_parse: 18 callbacks suppressed [ 364.806429][T18012] netlink: 212384 bytes leftover after parsing attributes in process `syz.4.3508'. [ 364.825132][T18012] netlink: zone id is out of range [ 364.846871][T18012] netlink: get zone limit has 8 unknown bytes [ 364.990339][T17989] team0 (unregistering): Port device team_slave_0 removed [ 365.012474][T17989] team0 (unregistering): Port device team_slave_1 removed [ 365.093745][T17998] mac80211_hwsim hwsim31 wlan1: entered promiscuous mode [ 365.104001][T17998] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 365.181607][ T78] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.212314][ T78] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.227440][ T78] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.236550][ T78] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.452175][T18037] netlink: 'syz.4.3517': attribute type 1 has an invalid length. [ 365.474651][T18038] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3514'. [ 365.573763][T18037] 8021q: adding VLAN 0 to HW filter on device bond1 [ 365.696388][T18042] vlan0: entered promiscuous mode [ 365.701749][T18042] bond1: entered promiscuous mode [ 365.709870][T18042] vlan0: entered allmulticast mode [ 365.715242][T18042] bond1: entered allmulticast mode [ 365.752414][T18037] bond1: (slave gretap2): making interface the new active one [ 365.768555][T18037] gretap2: entered promiscuous mode [ 365.781604][T18037] gretap2: entered allmulticast mode [ 365.811856][T18037] bond1: (slave gretap2): Enslaving as an active interface with an up link [ 365.817419][T18060] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3517'. [ 366.026118][T18037] syz.4.3517 (18037) used greatest stack depth: 18384 bytes left [ 366.141682][T18070] syzkaller0: entered allmulticast mode [ 366.284019][T18077] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3525'. [ 366.603089][T18103] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3531'. [ 366.732994][T18111] netlink: 'syz.3.3535': attribute type 7 has an invalid length. [ 366.804972][T18114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3535'. [ 367.105907][T18125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3538'. [ 367.213976][T18137] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 367.559446][T18149] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.680719][T18162] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3549'. [ 367.765313][T18149] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.981979][T18171] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3551'. [ 368.017423][T18170] netlink: 'syz.2.3552': attribute type 7 has an invalid length. [ 368.030330][T18149] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.079529][T18170] : entered promiscuous mode [ 368.113929][T18170] netlink: zone id is out of range [ 368.119835][T18170] netlink: zone id is out of range [ 368.129374][T18170] netlink: zone id is out of range [ 368.135240][T18170] netlink: zone id is out of range [ 368.141450][T18170] netlink: del zone limit has 4 unknown bytes [ 368.306655][T18149] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.605026][ T1099] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.686553][ T5973] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.715356][T18196] veth1_macvtap: left promiscuous mode [ 368.734187][T18196] macsec0: entered promiscuous mode [ 368.742038][T18196] macsec0: entered allmulticast mode [ 368.765301][T18197] macsec0: left promiscuous mode [ 368.777880][T18197] macsec0: left allmulticast mode [ 368.950747][T18210] IPVS: set_ctl: invalid protocol: 31 172.20.20.170:20002 [ 368.950780][ T5973] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.090182][ T5973] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.230228][T18219] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3563'. [ 369.301958][T18226] netlink: 'syz.4.3565': attribute type 8 has an invalid length. [ 369.775921][T18241] macvtap1: entered promiscuous mode [ 369.781776][T18241] vlan0: entered promiscuous mode [ 369.790940][T18241] macvtap1: entered allmulticast mode [ 369.797050][T18241] vlan0: entered allmulticast mode [ 369.805310][T18241] veth0_vlan: entered allmulticast mode [ 369.833947][T18248] __nla_validate_parse: 2 callbacks suppressed [ 369.833970][T18248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3573'. [ 369.852587][T18248] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3573'. [ 369.898352][T18252] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3573'. [ 369.970826][T18255] netlink: 'syz.3.3575': attribute type 7 has an invalid length. [ 370.035965][T18262] netlink: 211384 bytes leftover after parsing attributes in process `syz.4.3577'. [ 370.138371][T18265] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3578'. [ 370.273658][T18275] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3578'. [ 370.276710][T18274] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3580'. [ 370.545570][T18265] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3578'. [ 370.575103][T18272] tipc: Enabled bearer , priority 10 [ 370.634722][T18287] bond0: (slave rose0): Error: Device can not be enslaved while up [ 370.692880][T18289] netlink: 'syz.2.3582': attribute type 1 has an invalid length. [ 370.732932][T18289] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3582'. [ 370.916081][T18296] lo: entered allmulticast mode [ 370.928519][T18296] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3584'. [ 371.395739][T18318] openvswitch: netlink: Unknown key attributes 2 [ 371.697109][ T5932] tipc: Node number set to 2677607436 [ 371.739961][T18340] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 372.353258][T18371] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 373.180131][T18398] Bluetooth: MGMT ver 1.23 [ 373.729790][T18438] netlink: 'syz.4.3627': attribute type 1 has an invalid length. [ 373.803156][T18436] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 373.803276][T18438] 8021q: adding VLAN 0 to HW filter on device bond3 [ 373.896459][T18445] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 373.957719][T18445] bond3: entered promiscuous mode [ 373.963101][T18445] bond3: entered allmulticast mode [ 373.969088][T18445] 8021q: adding VLAN 0 to HW filter on device bond3 [ 374.016271][T18438] syzkaller1: entered promiscuous mode [ 374.022081][T18438] syzkaller1: entered allmulticast mode [ 374.096133][T18450] ip6gre1: entered allmulticast mode [ 374.426480][T18476] tipc: Started in network mode [ 374.431651][T18476] tipc: Node identity ce47168babd6, cluster identity 4711 [ 374.459359][T18476] tipc: Enabled bearer , priority 0 [ 374.547102][T18471] syzkaller0: entered promiscuous mode [ 374.552767][T18471] syzkaller0: entered allmulticast mode [ 374.612661][T18489] netlink: 'syz.0.3638': attribute type 1 has an invalid length. [ 374.624049][T18471] tipc: Resetting bearer [ 374.681066][T18469] tipc: Resetting bearer [ 374.797363][T18469] tipc: Disabling bearer [ 375.025598][T18504] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 375.399276][T18516] __nla_validate_parse: 16 callbacks suppressed [ 375.399299][T18516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3649'. [ 375.429909][T18516] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.3649'. [ 375.595127][T18541] netlink: ct family unspecified [ 375.607182][T18541] openvswitch: netlink: Actions may not be safe on all matching packets [ 375.698727][T18545] netlink: 1036 bytes leftover after parsing attributes in process `syz.4.3657'. [ 375.709557][T18545] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 375.752736][T18545] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3657'. [ 375.794087][T18545] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3657'. [ 376.264131][T18568] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 376.726423][T18598] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3674'. [ 376.807346][T18604] syzkaller0: entered promiscuous mode [ 376.818121][T18604] syzkaller0: entered allmulticast mode [ 376.927105][T18612] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3680'. [ 376.948582][T18612] netlink: 'syz.4.3680': attribute type 1 has an invalid length. [ 376.965296][T18612] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3680'. [ 376.997164][T18614] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3681'. [ 377.294810][T18620] netlink: 'syz.2.3682': attribute type 9 has an invalid length. [ 377.314605][T18624] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3684'. [ 378.279976][T18660] tipc: New replicast peer: 255.255.255.255 [ 378.304701][T18660] tipc: Enabled bearer , priority 10 [ 378.900662][T18698] NCSI netlink: No device for ifindex 0 [ 379.066797][T18702] netlink: 'syz.0.3708': attribute type 15 has an invalid length. [ 379.144489][T18706] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 380.104721][T18743] netlink: 'syz.0.3719': attribute type 7 has an invalid length. [ 380.116633][T18743] netlink: 'syz.0.3719': attribute type 8 has an invalid length. [ 380.511164][T18765] siw: device registration error -23 [ 380.638259][T18774] __nla_validate_parse: 13 callbacks suppressed [ 380.638285][T18774] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3729'. [ 380.645971][T18775] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3728'. [ 380.773163][T18781] netlink: 212404 bytes leftover after parsing attributes in process `syz.4.3730'. [ 381.059424][T18792] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3733'. [ 381.107540][T18794] netdevsim netdevsim0 : renamed from netdevsim0 [ 381.140466][T18794] netdevsim netdevsim0 : left promiscuous mode [ 381.375819][T18811] netlink: 'syz.0.3740': attribute type 4 has an invalid length. [ 381.596599][T18827] netlink: 'syz.2.3744': attribute type 10 has an invalid length. [ 381.690458][T18827] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 381.691726][T18836] netlink: 'syz.3.3745': attribute type 1 has an invalid length. [ 381.777621][T18833] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 381.848077][T18849] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 381.848614][T18845] netlink: 13 bytes leftover after parsing attributes in process `syz.0.3747'. [ 381.855527][T18849] IPv6: NLM_F_CREATE should be set when creating new route [ 381.872119][T18849] IPv6: NLM_F_CREATE should be set when creating new route [ 382.050169][T18858] netlink: 'syz.1.3751': attribute type 2 has an invalid length. [ 382.058797][T18858] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3751'. [ 382.069179][T18858] nbd: must specify a device to reconfigure [ 382.118955][T18853] netlink: 'syz.0.3749': attribute type 11 has an invalid length. [ 382.318261][T18863] netlink: 'syz.2.3753': attribute type 10 has an invalid length. [ 382.433167][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 382.476123][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 382.532527][T18876] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3757'. [ 382.997263][T18893] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3762'. [ 383.020509][T18894] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3763'. [ 383.394021][T18914] netlink: 124 bytes leftover after parsing attributes in process `syz.1.3768'. [ 384.242604][T18933] IPv6: sit2: Disabled Multicast RS [ 384.251600][T18934] netlink: 'syz.4.3774': attribute type 12 has an invalid length. [ 384.300404][T18934] netlink: 'syz.4.3774': attribute type 29 has an invalid length. [ 384.344355][T18934] netlink: 'syz.4.3774': attribute type 2 has an invalid length. [ 384.605399][T18952] netlink: 'syz.4.3782': attribute type 9 has an invalid length. [ 385.032440][T18968] netlink: zone id is out of range [ 385.074571][T18968] netlink: zone id is out of range [ 385.080709][T18968] netlink: zone id is out of range [ 385.171447][T18968] netlink: zone id is out of range [ 385.240058][T18968] netlink: set zone limit has 4 unknown bytes [ 385.779345][T19000] __nla_validate_parse: 6 callbacks suppressed [ 385.779368][T19000] netlink: 192 bytes leftover after parsing attributes in process `syz.2.3795'. [ 387.889805][T18996] netlink: 160 bytes leftover after parsing attributes in process `syz.3.3793'. [ 387.914297][T19000] netlink: 'syz.2.3795': attribute type 12 has an invalid length. [ 387.937522][T19000] netlink: 'syz.2.3795': attribute type 29 has an invalid length. [ 387.955390][T19000] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3795'. [ 387.993734][T19001] netlink: 'syz.2.3795': attribute type 12 has an invalid length. [ 388.044872][T19001] netlink: 'syz.2.3795': attribute type 29 has an invalid length. [ 388.070255][T19001] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3795'. [ 388.107925][T19014] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3796'. [ 388.575010][T19028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3804'. [ 388.780927][T19039] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3802'. [ 388.883242][T19048] netlink: 212364 bytes leftover after parsing attributes in process `syz.1.3812'. [ 388.899665][T19048] openvswitch: netlink: Message has 5 unknown bytes. [ 388.908396][T19042] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3809'. [ 389.161572][T19061] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3816'. [ 389.659443][T19085] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 390.100578][T19115] sctp: [Deprecated]: syz.0.3829 (pid 19115) Use of int in max_burst socket option deprecated. [ 390.100578][T19115] Use struct sctp_assoc_value instead [ 390.363441][T19128] netlink: 'syz.1.3832': attribute type 10 has an invalid length. [ 391.006671][T19160] netlink: 'syz.4.3842': attribute type 1 has an invalid length. [ 391.076049][ T1144] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 391.101437][T19177] __nla_validate_parse: 10 callbacks suppressed [ 391.101461][T19177] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3845'. [ 391.325941][T19186] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3847'. [ 392.511433][T19224] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3860'. [ 392.522406][T19224] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3860'. [ 392.602790][T19228] netlink: 'syz.3.3861': attribute type 11 has an invalid length. [ 392.645056][T19229] sctp: [Deprecated]: syz.2.3862 (pid 19229) Use of int in maxseg socket option. [ 392.645056][T19229] Use struct sctp_assoc_value instead [ 392.727414][T19232] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 392.956618][T19242] netlink: 'syz.2.3867': attribute type 1 has an invalid length. [ 393.079973][T19251] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3870'. [ 393.118636][T19252] syzkaller0: entered promiscuous mode [ 393.124896][T19251] openvswitch: netlink: Flow key attr not present in new flow. [ 393.134807][T19252] syzkaller0: entered allmulticast mode [ 393.247445][T19260] 8021q: VLANs not supported on lo [ 393.381817][T19266] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3874'. [ 393.606077][T19274] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3877'. [ 393.723607][T19277] tipc: Enabled bearer , priority 10 [ 394.149612][T19300] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3882'. [ 394.344728][T19314] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3884'. [ 394.346832][T19302] 8021q: adding VLAN 0 to HW filter on device bond4 [ 394.660693][T19320] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 394.670557][T19329] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3890'. [ 394.714746][T19332] netlink: 'syz.4.3889': attribute type 7 has an invalid length. [ 394.722673][T19332] netlink: 'syz.4.3889': attribute type 8 has an invalid length. [ 394.928336][T19331] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 394.979798][T19331] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 395.015302][T19331] gretap2: entered promiscuous mode [ 395.020753][T19331] gretap2: entered allmulticast mode [ 395.228882][T19351] netlink: 'syz.1.3896': attribute type 6 has an invalid length. [ 395.368092][T19356] veth0_virt_wifi: renamed from dummy0 (while UP) [ 395.577914][T19356] nbd2: detected capacity change from 0 to 127 [ 395.714950][T19368] bond1: entered allmulticast mode [ 395.720829][T19368] 8021q: adding VLAN 0 to HW filter on device bond1 [ 395.728881][T19368] bridge0: port 3(bond1) entered blocking state [ 395.735721][T19368] bridge0: port 3(bond1) entered disabled state [ 395.746290][T19368] bond1: entered promiscuous mode [ 395.752061][T19368] bridge0: port 3(bond1) entered blocking state [ 395.759673][T19368] bridge0: port 3(bond1) entered forwarding state [ 395.769267][T19367] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 395.772762][ T51] block nbd2: Receive control failed (result -32) [ 396.198809][T19391] __nla_validate_parse: 3 callbacks suppressed [ 396.198834][T19391] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3906'. [ 396.296325][T19396] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3906'. [ 396.327550][T19398] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3907'. [ 396.345142][T19402] netlink: 'syz.2.3906': attribute type 11 has an invalid length. [ 396.364703][T19402] netlink: 'syz.2.3906': attribute type 4 has an invalid length. [ 396.372814][T19402] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3906'. [ 396.383091][T19399] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3907'. [ 396.419300][T19391] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3906'. [ 396.698382][ T49] bridge0: port 3(bond1) entered disabled state [ 397.119637][T19429] 8021q: VLANs not supported on ip6_vti0 [ 397.164067][T19429] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3917'. [ 397.204751][T19429] netem: invalid attributes len -24 [ 397.210822][T19429] netem: change failed [ 397.229689][T19434] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3917'. [ 397.324143][T19440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3920'. [ 397.370098][T19440] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 397.487157][T19447] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3923'. [ 397.555895][T19452] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 398.124039][T19486] netlink: 'syz.4.3932': attribute type 1 has an invalid length. [ 398.181835][T19486] netlink: 'syz.4.3932': attribute type 3 has an invalid length. [ 398.490806][T19509] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 399.532480][T19542] netlink: 'syz.1.3950': attribute type 32 has an invalid length. [ 399.543801][T19542] (unnamed net_device) (uninitialized): option coupled_control: invalid value (109) [ 399.623040][T19553] netlink: 'syz.4.3954': attribute type 1 has an invalid length. [ 399.666914][T19553] 8021q: adding VLAN 0 to HW filter on device bond4 [ 399.720940][T19555] 8021q: adding VLAN 0 to HW filter on device bond4 [ 399.738953][T19555] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 399.768171][T19555] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 399.801268][T19559] netlink: 'syz.0.3955': attribute type 1 has an invalid length. [ 399.831689][T19553] veth9: entered promiscuous mode [ 399.845178][T19553] bond4: (slave veth9): Enslaving as an active interface with a down link [ 399.865542][T19560] vlan1: entered allmulticast mode [ 399.871044][T19560] bond4: entered allmulticast mode [ 399.903707][T19558] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 399.946432][T19559] macvlan4: entered promiscuous mode [ 399.951952][T19559] macvlan4: entered allmulticast mode [ 399.960316][T19559] bond5: entered promiscuous mode [ 399.966510][T19559] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 399.982654][T19559] bond5: left promiscuous mode [ 400.056193][T19562] gretap3: entered promiscuous mode [ 400.069593][T19562] bond5: (slave gretap3): making interface the new active one [ 400.078561][T19562] bond5: (slave gretap3): Enslaving as an active interface with an up link [ 400.123148][T19572] netlink: 'syz.4.3959': attribute type 10 has an invalid length. [ 400.180881][T19572] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 400.201018][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 400.216395][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 400.285815][T19579] netlink: 'syz.0.3961': attribute type 1 has an invalid length. [ 400.293897][T19579] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 400.499496][T19585] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 400.865432][T19606] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 401.283863][T19633] __nla_validate_parse: 10 callbacks suppressed [ 401.292404][T19633] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3978'. [ 401.309801][T19633] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3978'. [ 401.349299][T19637] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3978'. [ 401.364436][T19637] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3978'. [ 401.607045][T19644] tipc: Resetting bearer [ 402.530982][T19688] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3993'. [ 402.554738][ T51] Bluetooth: hci0: command tx timeout [ 402.776451][T19688] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3993'. [ 402.789861][T19699] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3995'. [ 402.997995][T19708] netlink: 'syz.0.3998': attribute type 1 has an invalid length. [ 403.014973][T19708] netlink: 784 bytes leftover after parsing attributes in process `syz.0.3998'. [ 403.073990][T19709] pim6reg1: entered promiscuous mode [ 403.117657][T19709] pim6reg1: entered allmulticast mode [ 403.209139][T19719] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.4000'. [ 403.281360][T19732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4002'. [ 403.663722][T19750] openvswitch: netlink: Missing valid actions attribute. [ 403.691589][T19750] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 403.716437][T19756] wireguard: wg1: Could not create IPv4 socket [ 404.056224][T19771] netlink: 'syz.1.4013': attribute type 4 has an invalid length. [ 404.170655][T19777] tipc: Enabled bearer , priority 10 [ 404.635216][T19801] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 404.673014][T19801] syzkaller1: entered promiscuous mode [ 404.694174][T19801] syzkaller1: entered allmulticast mode [ 404.742113][T19811] tipc: Enabled bearer , priority 0 [ 404.756292][T19811] tipc: Resetting bearer [ 404.779643][T19810] tipc: Disabling bearer [ 404.881088][T19813] netlink: zone id is out of range [ 404.891324][T19813] netlink: del zone limit has 4 unknown bytes [ 404.902356][T19813] netlink: 'syz.3.4026': attribute type 4 has an invalid length. [ 405.602740][T19848] IPVS: ip_vs_add_dest(): server weight less than zero [ 405.619992][T19848] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20002 [ 405.647400][T19847] IPVS: set_ctl: invalid protocol: 5 172.20.20.187:21 [ 406.154076][T19873] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge_slave_0 [ 406.397735][T19891] netlink: 'syz.0.4049': attribute type 4 has an invalid length. [ 406.412466][T19890] netlink: 'syz.0.4049': attribute type 13 has an invalid length. [ 406.428431][T19886] tipc: Enabled bearer , priority 0 [ 406.473111][T19886] syzkaller0: entered promiscuous mode [ 406.500541][T19886] syzkaller0: entered allmulticast mode [ 406.569816][T19886] tipc: Resetting bearer [ 406.613950][T19897] __nla_validate_parse: 74 callbacks suppressed [ 406.613973][T19897] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4050'. [ 406.632556][T19884] tipc: Resetting bearer [ 406.683462][T19884] tipc: Disabling bearer [ 406.749784][T19902] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4052'. [ 406.750055][T19905] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4052'. [ 406.975855][T19916] netlink: 256 bytes leftover after parsing attributes in process `syz.2.4056'. [ 407.064865][T19903] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4053'. [ 407.232223][T19930] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4059'. [ 407.267219][T19929] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 407.376303][T19930] 8021q: adding VLAN 0 to HW filter on device bond2 [ 407.410473][T19939] vlan3: entered allmulticast mode [ 407.417641][T19939] bond2: entered allmulticast mode [ 407.752462][T19960] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4067'. [ 407.855245][T19966] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 408.014115][T19977] team_slave_0: mtu greater than device maximum [ 408.064837][T19976] team_slave_0: mtu greater than device maximum [ 408.136466][T19979] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 408.359768][T19993] netlink: 'syz.3.4076': attribute type 10 has an invalid length. [ 408.422395][T19993] bond0: (slave wlan1): Opening slave failed [ 408.440488][T19987] wg1 speed is unknown, defaulting to 1000 [ 408.996972][T20030] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 409.396797][T20048] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4094'. [ 409.713108][T20070] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 410.309834][T20093] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4103'. [ 410.317572][T20094] netlink: 'syz.4.4103': attribute type 39 has an invalid length. [ 411.030512][T20121] IPv6: Can't replace route, no match found [ 411.161051][T20127] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4108'. [ 411.226658][T20127] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 411.481480][T20147] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 411.573156][T20152] dummy0: entered promiscuous mode [ 411.614481][T20152] batadv_slave_1: entered promiscuous mode [ 411.622476][T20152] debugfs: 'hsr1' already exists in 'hsr' [ 411.628853][T20152] Cannot create hsr debugfs directory [ 411.636503][T20155] __nla_validate_parse: 5 callbacks suppressed [ 411.636526][T20155] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4118'. [ 411.782576][T20162] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4120'. [ 411.796059][T20163] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4121'. [ 411.802662][T20162] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (64) [ 411.891681][T20168] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 411.908594][T20168] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4123'. [ 412.034993][T20172] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4126'. [ 412.050107][T20172] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4126'. [ 412.110697][T20181] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4126'. [ 412.176425][T20183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4127'. [ 413.264483][ T51] Bluetooth: hci1: command 0x0401 tx timeout [ 413.339567][T20223] tipc: Bearer : already 2 bearers with priority 10 [ 413.347649][T20223] tipc: Bearer : trying with adjusted priority [ 413.357015][T20223] tipc: Enabled bearer , priority 9 [ 413.375849][T20223] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4135'. [ 413.894530][T20248] netdevsim netdevsim2: Firmware load for './file0/../file0' refused, path contains '..' component [ 413.910549][T20248] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4143'. [ 415.155333][T20290] sctp: [Deprecated]: syz.2.4154 (pid 20290) Use of struct sctp_assoc_value in delayed_ack socket option. [ 415.155333][T20290] Use struct sctp_sack_info instead [ 415.230504][T20294] netlink: 'syz.3.4155': attribute type 1 has an invalid length. [ 415.390012][T20296] bond4: (slave bridge4): making interface the new active one [ 415.508256][T20296] bond4: (slave bridge4): Enslaving as an active interface with an up link [ 415.780078][T20301] wg1 speed is unknown, defaulting to 1000 [ 415.941341][T20319] netlink: 'syz.4.4163': attribute type 5 has an invalid length. [ 417.027759][T20349] __nla_validate_parse: 3 callbacks suppressed [ 417.027784][T20349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4171'. [ 417.263670][T20367] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4176'. [ 417.274896][T20367] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4176'. [ 417.750609][T20368] delete_channel: no stack [ 417.783395][T20381] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4179'. [ 418.042130][T20388] netlink: 'syz.1.4181': attribute type 9 has an invalid length. [ 418.270370][T20399] netlink: 'syz.3.4185': attribute type 1 has an invalid length. [ 418.297426][T20396] netlink: 'syz.2.4184': attribute type 1 has an invalid length. [ 418.307345][T20396] netlink: 228 bytes leftover after parsing attributes in process `syz.2.4184'. [ 418.370718][T20401] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4185'. [ 418.891356][T20421] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4191'. [ 419.100700][T20427] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 419.247906][T20427] bond1: entered promiscuous mode [ 419.255953][T20427] 8021q: adding VLAN 0 to HW filter on device bond1 [ 419.603922][T20439] wg1 speed is unknown, defaulting to 1000 [ 419.637052][T20444] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 419.837106][T20435] syzkaller0: entered promiscuous mode [ 419.850715][T20435] syzkaller0: entered allmulticast mode [ 420.469161][T20224] Set syz1 is full, maxelem 65536 reached [ 421.871577][T20472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4205'. [ 422.056636][T20477] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4206'. [ 422.618926][T20455] netlink: 'syz.2.4200': attribute type 29 has an invalid length. [ 422.796561][T20486] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4209'. [ 423.192983][T20504] xfrm1: entered allmulticast mode [ 423.330220][T20508] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4217'. [ 423.376498][T20508] chnl_net:caif_netlink_parms(): no params data found [ 423.423782][T20515] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.4218'. [ 423.440334][T20515] netlink: zone id is out of range [ 423.447885][T20515] netlink: get zone limit has 8 unknown bytes [ 423.540291][T20519] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4220'. [ 424.067921][T20542] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4228'. [ 424.185456][T20551] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 424.437309][T20568] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4235'. [ 424.621555][T20576] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4237'. [ 424.791589][T20580] netlink: 'syz.0.4238': attribute type 1 has an invalid length. [ 424.871600][T20584] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 425.044395][T20597] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4241'. [ 425.511244][T20621] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5 [ 425.553435][T20624] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4249'. [ 426.113878][T20650] netlink: 'syz.3.4257': attribute type 6 has an invalid length. [ 426.474076][T20668] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0 [ 426.487268][T20662] IPVS: stopping backup sync thread 20668 ... [ 427.374870][T20693] __nla_validate_parse: 8 callbacks suppressed [ 427.374893][T20693] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4271'. [ 427.641905][T20706] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 427.783358][T20708] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.786012][T20715] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4278'. [ 428.396689][T20747] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4287'. [ 428.491854][T20747] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 428.661829][T20760] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4292'. [ 428.878455][T20775] 8021q: VLANs not supported on sit0 [ 428.923847][T20779] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4295'. [ 429.023785][T20782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4298'. [ 429.075551][T20782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4298'. [ 429.117313][T20782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4298'. [ 429.158264][T20782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4298'. [ 429.205957][T20782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4298'. [ 429.769944][T20822] netlink: 'syz.3.4310': attribute type 23 has an invalid length. [ 429.856788][T20825] tipc: Started in network mode [ 429.863551][T20825] tipc: Node identity 46f13358432d, cluster identity 4711 [ 429.872667][T20825] tipc: Enabled bearer , priority 0 [ 429.881686][T20825] syzkaller0: entered promiscuous mode [ 429.888073][T20825] syzkaller0: entered allmulticast mode [ 429.952149][T20825] tipc: Resetting bearer [ 429.992852][ T51] Bluetooth: hci2: link tx timeout [ 429.999915][ T51] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 430.010015][T20823] tipc: Resetting bearer [ 430.017676][ T5864] Bluetooth: hci2: link tx timeout [ 430.023191][ T5864] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 430.087293][T20823] tipc: Disabling bearer [ 430.240909][T20842] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 430.521499][T20857] GUP no longer grows the stack in syz.4.4321 (20857): 200000003000-20000000a000 (200000001000) [ 430.570066][T20857] CPU: 0 UID: 0 PID: 20857 Comm: syz.4.4321 Not tainted syzkaller #0 PREEMPT(full) [ 430.570098][T20857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 430.570111][T20857] Call Trace: [ 430.570121][T20857] [ 430.570130][T20857] dump_stack_lvl+0x189/0x250 [ 430.570167][T20857] ? __pfx_dump_stack_lvl+0x10/0x10 [ 430.570194][T20857] ? __pfx__printk+0x10/0x10 [ 430.570221][T20857] ? find_vma+0xe7/0x160 [ 430.570251][T20857] ? __lock_acquire+0xab9/0xd20 [ 430.570305][T20857] __get_user_pages+0x24d0/0x2ce0 [ 430.570335][T20857] ? __bpf_trace_mmap_lock_acquire_returned+0x13b/0x190 [ 430.570397][T20857] ? rcu_is_watching+0x15/0xb0 [ 430.570426][T20857] __gup_longterm_locked+0xde9/0x1660 [ 430.570470][T20857] ? sanity_check_pinned_pages+0x123a/0x1300 [ 430.570509][T20857] gup_fast_fallback+0x1e6a/0x2010 [ 430.570575][T20857] ? __pfx_gup_fast_fallback+0x10/0x10 [ 430.570599][T20857] ? stack_trace_save+0x9c/0xe0 [ 430.570622][T20857] ? __pfx_stack_trace_save+0x10/0x10 [ 430.570673][T20857] ? pin_user_pages_fast+0x4d/0xb0 [ 430.570703][T20857] iov_iter_extract_pages+0x35a/0x5e0 [ 430.570741][T20857] extract_iter_to_sg+0xe46/0x24e0 [ 430.570795][T20857] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 430.570851][T20857] ? __asan_memset+0x22/0x50 [ 430.570879][T20857] af_alg_get_rsgl+0x436/0x810 [ 430.570930][T20857] aead_recvmsg+0x4cc/0x13f0 [ 430.570975][T20857] ? rcu_is_watching+0x15/0xb0 [ 430.571006][T20857] ? __pfx_aead_recvmsg+0x10/0x10 [ 430.571040][T20857] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 430.571065][T20857] ? __pfx_aead_recvmsg+0x10/0x10 [ 430.571095][T20857] sock_recvmsg_nosec+0x186/0x1c0 [ 430.571130][T20857] ____sys_recvmsg+0x3aa/0x460 [ 430.571166][T20857] ? __pfx_____sys_recvmsg+0x10/0x10 [ 430.571210][T20857] ? import_iovec+0x74/0xa0 [ 430.571239][T20857] ___sys_recvmsg+0x1b5/0x510 [ 430.571269][T20857] ? __pfx____sys_recvmsg+0x10/0x10 [ 430.571335][T20857] ? __might_fault+0xb0/0x130 [ 430.571368][T20857] do_recvmmsg+0x307/0x770 [ 430.571403][T20857] ? __pfx_do_recvmmsg+0x10/0x10 [ 430.571443][T20857] ? __pfx_do_futex+0x10/0x10 [ 430.571493][T20857] __x64_sys_recvmmsg+0x190/0x240 [ 430.571520][T20857] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 430.571540][T20857] ? rcu_is_watching+0x15/0xb0 [ 430.571569][T20857] ? do_syscall_64+0xbe/0x3b0 [ 430.571605][T20857] do_syscall_64+0xfa/0x3b0 [ 430.571633][T20857] ? lockdep_hardirqs_on+0x9c/0x150 [ 430.571669][T20857] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.571689][T20857] ? clear_bhb_loop+0x60/0xb0 [ 430.571715][T20857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.571735][T20857] RIP: 0033:0x7f9cf6d8ebe9 [ 430.571756][T20857] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 430.571774][T20857] RSP: 002b:00007f9cf7c39038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 430.571800][T20857] RAX: ffffffffffffffda RBX: 00007f9cf6fb5fa0 RCX: 00007f9cf6d8ebe9 [ 430.571815][T20857] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 000000000000000b [ 430.571828][T20857] RBP: 00007f9cf6e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 430.571842][T20857] R10: 0000000000000101 R11: 0000000000000246 R12: 0000000000000000 [ 430.571855][T20857] R13: 00007f9cf6fb6038 R14: 00007f9cf6fb5fa0 R15: 00007ffcea5d2068 [ 430.571892][T20857] [ 430.948936][T20865] ipvlan2: entered promiscuous mode [ 431.292496][T20885] netlink: 'syz.1.4329': attribute type 39 has an invalid length. [ 432.064565][T20843] Bluetooth: hci2: command 0x0405 tx timeout [ 432.180735][T20930] netlink: 'syz.1.4343': attribute type 83 has an invalid length. [ 432.308071][ T51] Bluetooth: hci1: command 0x0401 tx timeout [ 432.315703][T20843] Bluetooth: hci5: command 0x0406 tx timeout [ 432.653707][T20949] __nla_validate_parse: 39 callbacks suppressed [ 432.653728][T20949] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4349'. [ 432.900776][T20962] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 432.963983][T20962] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 432.974532][T20962] gretap3: entered promiscuous mode [ 432.985949][T20962] gretap3: entered allmulticast mode [ 433.407343][T20979] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4357'. [ 433.480245][T20990] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4356'. [ 433.699265][T20996] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4361'. [ 433.775752][T21001] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4360'. [ 434.405856][T21029] delete_channel: no stack [ 434.412969][T21029] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4368'. [ 434.439704][T21028] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 434.448435][T21029] netlink: 'syz.3.4368': attribute type 9 has an invalid length. [ 434.701646][T21044] netlink: 'syz.2.4374': attribute type 2 has an invalid length. [ 434.713252][T21044] netlink: 119 bytes leftover after parsing attributes in process `syz.2.4374'. [ 434.864526][T21050] netlink: 9 bytes leftover after parsing attributes in process `syz.2.4375'. [ 434.927195][T21051] netlink: 5 bytes leftover after parsing attributes in process `syz.2.4375'. [ 434.966899][T21050] gretap0: entered promiscuous mode [ 435.006520][T21051] 0{X功: renamed from gretap0 [ 435.201133][T21051] 0{X功: left promiscuous mode [ 435.214239][T21051] 0{X功: entered allmulticast mode [ 435.221592][T21051] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 435.278738][T21055] mac80211_hwsim hwsim35 wlan1: entered allmulticast mode [ 435.614508][T21068] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 435.749194][T21078] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4385'. [ 435.848066][T21084] openvswitch: netlink: Message has 4 unknown bytes. [ 436.599895][T21120] netlink: 'syz.3.4397': attribute type 4 has an invalid length. [ 436.756775][T21132] FAULT_INJECTION: forcing a failure. [ 436.756775][T21132] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 436.775666][T21132] CPU: 0 UID: 0 PID: 21132 Comm: syz.0.4401 Not tainted syzkaller #0 PREEMPT(full) [ 436.775698][T21132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 436.775710][T21132] Call Trace: [ 436.775718][T21132] [ 436.775727][T21132] dump_stack_lvl+0x189/0x250 [ 436.775757][T21132] ? __pfx____ratelimit+0x10/0x10 [ 436.775784][T21132] ? __pfx_dump_stack_lvl+0x10/0x10 [ 436.775808][T21132] ? __pfx__printk+0x10/0x10 [ 436.775837][T21132] ? __might_fault+0xb0/0x130 [ 436.775878][T21132] should_fail_ex+0x414/0x560 [ 436.775910][T21132] _copy_from_iter+0x1db/0x16f0 [ 436.775934][T21132] ? __lock_acquire+0xab9/0xd20 [ 436.775970][T21132] ? __pfx__copy_from_iter+0x10/0x10 [ 436.776010][T21132] tun_get_user+0x219/0x3e20 [ 436.776053][T21132] ? aa_file_perm+0x44d/0x1550 [ 436.776073][T21132] ? __pfx_tun_get_user+0x10/0x10 [ 436.776092][T21132] ? _parse_integer_limit+0x1ae/0x1f0 [ 436.776130][T21132] ? __lock_acquire+0xab9/0xd20 [ 436.776164][T21132] ? ref_tracker_alloc+0x318/0x460 [ 436.776188][T21132] ? __lock_acquire+0xab9/0xd20 [ 436.776218][T21132] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 436.776250][T21132] ? tun_get+0x1c/0x2f0 [ 436.776276][T21132] ? tun_get+0x1c/0x2f0 [ 436.776294][T21132] ? tun_get+0x1c/0x2f0 [ 436.776319][T21132] tun_chr_write_iter+0x113/0x200 [ 436.776362][T21132] vfs_write+0x5c9/0xb30 [ 436.776395][T21132] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 436.776427][T21132] ? __pfx_vfs_write+0x10/0x10 [ 436.776466][T21132] ? __fget_files+0x2a/0x420 [ 436.776506][T21132] ksys_write+0x145/0x250 [ 436.776536][T21132] ? __pfx_ksys_write+0x10/0x10 [ 436.776568][T21132] ? do_syscall_64+0xbe/0x3b0 [ 436.776600][T21132] do_syscall_64+0xfa/0x3b0 [ 436.776625][T21132] ? lockdep_hardirqs_on+0x9c/0x150 [ 436.776651][T21132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.776672][T21132] ? clear_bhb_loop+0x60/0xb0 [ 436.776696][T21132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.776716][T21132] RIP: 0033:0x7f2b7238ebe9 [ 436.776735][T21132] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 436.776752][T21132] RSP: 002b:00007f2b7328e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 436.776776][T21132] RAX: ffffffffffffffda RBX: 00007f2b725b5fa0 RCX: 00007f2b7238ebe9 [ 436.776790][T21132] RDX: 000000000000fd6c RSI: 0000200000000280 RDI: 0000000000000004 [ 436.776803][T21132] RBP: 00007f2b7328e090 R08: 0000000000000000 R09: 0000000000000000 [ 436.776815][T21132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 436.776827][T21132] R13: 00007f2b725b6038 R14: 00007f2b725b5fa0 R15: 00007ffeb52a9af8 [ 436.776862][T21132] [ 437.272597][T21149] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20001 [ 437.378042][T21153] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 437.459575][T21156] tipc: MTU too low for tipc bearer [ 437.818736][T21173] __nla_validate_parse: 13 callbacks suppressed [ 437.818759][T21173] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4415'. [ 437.937771][T21181] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4416'. [ 438.059029][T21176] netlink: 'syz.0.4416': attribute type 5 has an invalid length. [ 438.338155][ T1144] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 438.346821][T21193] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 438.649151][T21214] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4427'. [ 438.712020][T21219] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4428'. [ 438.742777][T21219] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4428'. [ 439.125538][T21240] : entered promiscuous mode [ 439.170110][T21242] vlan0: entered promiscuous mode [ 439.195983][T21242] vlan0: entered allmulticast mode [ 439.219166][T21242] hsr_slave_1: entered allmulticast mode [ 439.586345][T21261] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4441'. [ 439.769563][T21269] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 439.970584][T21283] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4447'. [ 441.069439][T21334] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4467'. [ 441.130655][T21334] dummy0: entered promiscuous mode [ 441.158301][T21334] batadv_slave_1: entered promiscuous mode [ 441.169130][T21334] debugfs: 'hsr1' already exists in 'hsr' [ 441.186797][T21334] Cannot create hsr debugfs directory [ 441.349993][T21354] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 441.653979][T21371] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4476'. [ 441.656047][T21370] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4476'. [ 442.307230][T21404] veth1_to_bridge: entered allmulticast mode [ 442.382855][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.391951][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 442.878491][T21434] FAULT_INJECTION: forcing a failure. [ 442.878491][T21434] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 442.898423][T21434] CPU: 0 UID: 0 PID: 21434 Comm: syz.4.4495 Not tainted syzkaller #0 PREEMPT(full) [ 442.898454][T21434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 442.898474][T21434] Call Trace: [ 442.898482][T21434] [ 442.898490][T21434] dump_stack_lvl+0x189/0x250 [ 442.898521][T21434] ? __pfx____ratelimit+0x10/0x10 [ 442.898549][T21434] ? __pfx_dump_stack_lvl+0x10/0x10 [ 442.898573][T21434] ? __pfx__printk+0x10/0x10 [ 442.898602][T21434] ? __might_fault+0xb0/0x130 [ 442.898644][T21434] should_fail_ex+0x414/0x560 [ 442.898677][T21434] _copy_from_iter+0x1db/0x16f0 [ 442.898703][T21434] ? sock_alloc_send_pskb+0x875/0x990 [ 442.898735][T21434] ? __pfx__copy_from_iter+0x10/0x10 [ 442.898766][T21434] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 442.898794][T21434] skb_copy_datagram_from_iter+0xf5/0x720 [ 442.898824][T21434] ? skb_put+0x11b/0x210 [ 442.898848][T21434] tun_get_user+0x1691/0x3e20 [ 442.898893][T21434] ? aa_file_perm+0x44d/0x1550 [ 442.898915][T21434] ? __pfx_tun_get_user+0x10/0x10 [ 442.898933][T21434] ? irqentry_exit+0x74/0x90 [ 442.898983][T21434] ? ref_tracker_alloc+0x318/0x460 [ 442.899009][T21434] ? __lock_acquire+0xab9/0xd20 [ 442.899040][T21434] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 442.899075][T21434] ? tun_get+0x1c/0x2f0 [ 442.899102][T21434] ? tun_get+0x1c/0x2f0 [ 442.899121][T21434] ? tun_get+0x1c/0x2f0 [ 442.899147][T21434] tun_chr_write_iter+0x113/0x200 [ 442.899181][T21434] vfs_write+0x5c9/0xb30 [ 442.899213][T21434] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 442.899245][T21434] ? __pfx_vfs_write+0x10/0x10 [ 442.899284][T21434] ? __fget_files+0x2a/0x420 [ 442.899325][T21434] ksys_write+0x145/0x250 [ 442.899355][T21434] ? __pfx_ksys_write+0x10/0x10 [ 442.899381][T21434] ? rcu_is_watching+0x15/0xb0 [ 442.899403][T21434] ? trace_sys_enter+0x25/0x100 [ 442.899444][T21434] do_syscall_64+0xfa/0x3b0 [ 442.899480][T21434] ? lockdep_hardirqs_on+0x9c/0x150 [ 442.899507][T21434] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.899527][T21434] ? clear_bhb_loop+0x60/0xb0 [ 442.899553][T21434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.899572][T21434] RIP: 0033:0x7f9cf6d8ebe9 [ 442.899591][T21434] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 442.899610][T21434] RSP: 002b:00007f9cf7c39038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 442.899633][T21434] RAX: ffffffffffffffda RBX: 00007f9cf6fb5fa0 RCX: 00007f9cf6d8ebe9 [ 442.899648][T21434] RDX: 000000000000fd6c RSI: 0000200000000280 RDI: 0000000000000004 [ 442.899661][T21434] RBP: 00007f9cf7c39090 R08: 0000000000000000 R09: 0000000000000000 [ 442.899673][T21434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.899686][T21434] R13: 00007f9cf6fb6038 R14: 00007f9cf6fb5fa0 R15: 00007ffcea5d2068 [ 442.899721][T21434] [ 443.459013][T21450] __nla_validate_parse: 3 callbacks suppressed [ 443.459034][T21450] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.4501'. [ 443.706669][T21456] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4504'. [ 443.774860][T21456] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.899001][T21456] bridge_slave_1 (unregistering): left allmulticast mode [ 443.955173][T21456] bridge_slave_1 (unregistering): left promiscuous mode [ 443.962546][T21456] bridge0: port 2(bridge_slave_1) entered disabled state [ 444.308024][T21486] netlink: 408 bytes leftover after parsing attributes in process `syz.2.4513'. [ 444.344658][T21488] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4514'. [ 444.396275][T21495] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4515'. [ 444.428642][T21495] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4515'. [ 444.512306][T21495] gretap0: entered promiscuous mode [ 444.576891][T21495] gretap0: left promiscuous mode [ 444.586681][T21501] netlink: 'syz.2.4517': attribute type 6 has an invalid length. [ 444.709529][T21507] netlink: 'syz.2.4520': attribute type 10 has an invalid length. [ 444.757876][T21507] 8021q: adding VLAN 0 to HW filter on device team0 [ 444.842875][T21507] bond0: (slave team0): Enslaving as an active interface with an up link [ 445.077184][T21529] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (18446744073709551613) [ 445.500017][T21553] netlink: 'syz.1.4534': attribute type 13 has an invalid length. [ 445.715580][T21565] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4538'. [ 445.726939][T21566] netlink: 'syz.2.4536': attribute type 1 has an invalid length. [ 445.740896][T21566] netlink: 244 bytes leftover after parsing attributes in process `syz.2.4536'. [ 445.751829][T21553] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 445.942142][T21572] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 446.407158][T21604] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4550'. [ 446.590880][T21615] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4555'. [ 446.776776][T21621] IPVS: Error joining to the multicast group [ 447.086722][T21641] FAULT_INJECTION: forcing a failure. [ 447.086722][T21641] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 447.155269][T21641] CPU: 0 UID: 0 PID: 21641 Comm: syz.4.4564 Not tainted syzkaller #0 PREEMPT(full) [ 447.155301][T21641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 447.155313][T21641] Call Trace: [ 447.155321][T21641] [ 447.155330][T21641] dump_stack_lvl+0x189/0x250 [ 447.155360][T21641] ? __pfx____ratelimit+0x10/0x10 [ 447.155389][T21641] ? __pfx_dump_stack_lvl+0x10/0x10 [ 447.155413][T21641] ? __pfx__printk+0x10/0x10 [ 447.155442][T21641] ? __might_fault+0xb0/0x130 [ 447.155484][T21641] should_fail_ex+0x414/0x560 [ 447.155517][T21641] _copy_from_iter+0x1db/0x16f0 [ 447.155553][T21641] ? __pfx__copy_from_iter+0x10/0x10 [ 447.155569][T21641] ? sock_alloc_send_pskb+0x875/0x990 [ 447.155601][T21641] ? __pfx__copy_from_iter+0x10/0x10 [ 447.155625][T21641] ? page_copy_sane+0x16a/0x280 [ 447.155648][T21641] copy_page_from_iter+0xdd/0x170 [ 447.155674][T21641] skb_copy_datagram_from_iter+0x306/0x720 [ 447.155713][T21641] tun_get_user+0x1691/0x3e20 [ 447.155759][T21641] ? aa_file_perm+0x44d/0x1550 [ 447.155779][T21641] ? __pfx_tun_get_user+0x10/0x10 [ 447.155798][T21641] ? _parse_integer_limit+0x1ae/0x1f0 [ 447.155838][T21641] ? __lock_acquire+0xab9/0xd20 [ 447.155875][T21641] ? ref_tracker_alloc+0x318/0x460 [ 447.155900][T21641] ? __lock_acquire+0xab9/0xd20 [ 447.155931][T21641] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 447.155965][T21641] ? tun_get+0x1c/0x2f0 [ 447.155992][T21641] ? tun_get+0x1c/0x2f0 [ 447.156016][T21641] ? tun_get+0x1c/0x2f0 [ 447.156042][T21641] tun_chr_write_iter+0x113/0x200 [ 447.156077][T21641] vfs_write+0x5c9/0xb30 [ 447.156110][T21641] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 447.156142][T21641] ? __pfx_vfs_write+0x10/0x10 [ 447.156182][T21641] ? __fget_files+0x2a/0x420 [ 447.156223][T21641] ksys_write+0x145/0x250 [ 447.156261][T21641] ? __pfx_ksys_write+0x10/0x10 [ 447.156284][T21641] ? rcu_is_watching+0x15/0xb0 [ 447.156311][T21641] ? do_syscall_64+0xbe/0x3b0 [ 447.156345][T21641] do_syscall_64+0xfa/0x3b0 [ 447.156371][T21641] ? lockdep_hardirqs_on+0x9c/0x150 [ 447.156397][T21641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.156417][T21641] ? clear_bhb_loop+0x60/0xb0 [ 447.156442][T21641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.156462][T21641] RIP: 0033:0x7f9cf6d8ebe9 [ 447.156480][T21641] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 447.156498][T21641] RSP: 002b:00007f9cf7c39038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 447.156520][T21641] RAX: ffffffffffffffda RBX: 00007f9cf6fb5fa0 RCX: 00007f9cf6d8ebe9 [ 447.156535][T21641] RDX: 000000000000fd6c RSI: 0000200000000280 RDI: 0000000000000004 [ 447.156549][T21641] RBP: 00007f9cf7c39090 R08: 0000000000000000 R09: 0000000000000000 [ 447.156561][T21641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 447.156574][T21641] R13: 00007f9cf6fb6038 R14: 00007f9cf6fb5fa0 R15: 00007ffcea5d2068 [ 447.156609][T21641] [ 447.600583][T21645] netlink: 'syz.0.4565': attribute type 3 has an invalid length. [ 447.633770][T21657] dvmrp1: entered allmulticast mode [ 447.852354][T21665] syzkaller0: entered promiscuous mode [ 447.858973][T21665] syzkaller0: entered allmulticast mode [ 450.561268][T21701] __nla_validate_parse: 3 callbacks suppressed [ 450.561291][T21701] netlink: 124 bytes leftover after parsing attributes in process `syz.0.4582'. [ 450.685653][T21706] ip6erspan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 450.693887][T21706] ip6erspan0: entered promiscuous mode [ 450.708292][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 451.040690][T21731] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4592'. [ 451.184988][T21733] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4593'. [ 451.216538][T21739] 0{X功: left allmulticast mode [ 451.237143][T21739] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 451.245200][T21741] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4596'. [ 451.673702][T21757] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4601'. [ 452.358046][T21770] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4604'. [ 453.824901][ T5864] Bluetooth: hci2: command 0x0405 tx timeout [ 454.459559][T21782] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4606'. [ 454.816943][T21802] netlink: 100 bytes leftover after parsing attributes in process `syz.2.4611'. [ 454.854570][T21804] netlink: 100 bytes leftover after parsing attributes in process `syz.2.4611'. [ 455.448636][T21840] syz.1.4619 uses old SIOCAX25GETINFO [ 455.457558][T21840] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4619'. [ 455.471027][T21834] netlink: 'syz.4.4617': attribute type 3 has an invalid length. [ 455.479268][T21834] netlink: 'syz.4.4617': attribute type 1 has an invalid length. [ 455.649798][T21843] netlink: 'syz.4.4621': attribute type 10 has an invalid length. [ 455.668499][T21843] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4621'. [ 455.740606][T21843] team0: Port device geneve0 added [ 455.766932][T21855] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4623'. [ 455.769022][T21854] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4624'. [ 455.817179][T21854] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4624'. [ 455.948978][T21863] syzkaller0: entered promiscuous mode [ 455.957830][T21863] syzkaller0: entered allmulticast mode [ 455.968395][T21853] tipc: Enabled bearer , priority 0 [ 456.205205][T21856] tipc: Resetting bearer [ 456.324756][T21856] tipc: Resetting bearer [ 456.469612][T21881] xt_socket: unknown flags 0xe4 [ 456.619953][T21856] tipc: Disabling bearer [ 457.142123][T21909] netlink: 348 bytes leftover after parsing attributes in process `syz.1.4638'. [ 457.161752][T21909] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4638'. [ 457.203169][T21909] netlink: 348 bytes leftover after parsing attributes in process `syz.1.4638'. [ 457.227553][T21913] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4638'. [ 457.483541][T21930] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4646'. [ 457.493614][T21930] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4646'. [ 457.614143][T21935] tipc: Bearer : already 2 bearers with priority 10 [ 457.629848][T21935] tipc: Bearer : trying with adjusted priority [ 457.638756][T21935] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 457.981278][T21949] bridge_slave_0: left allmulticast mode [ 458.025268][T21949] bridge_slave_0: left promiscuous mode [ 458.043732][T21949] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.086864][T21949] bridge_slave_1: left allmulticast mode [ 458.093777][T21949] bridge_slave_1: left promiscuous mode [ 458.100346][T21949] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.147718][T21949] bond0: (slave bond_slave_0): Releasing backup interface [ 458.189418][T21949] bond0: (slave bond_slave_1): Releasing backup interface [ 458.215766][T21949] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 458.227202][T21949] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 458.251608][T21949] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 458.285093][T21949] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 458.386458][T21949] bond4: (slave bridge4): Releasing active interface [ 458.633378][T21977] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 458.771149][T21977] syzkaller0: entered promiscuous mode [ 458.783869][T21977] syzkaller0: entered allmulticast mode [ 459.947535][T22020] IPVS: set_ctl: invalid protocol: 115 0.0.0.0:20004 [ 459.956035][T22020] IPVS: set_ctl: invalid protocol: 58 224.0.0.2:20002 [ 461.683668][T22028] netlink: 'syz.4.4670': attribute type 17 has an invalid length. [ 461.692897][T22028] __nla_validate_parse: 2 callbacks suppressed [ 461.692919][T22028] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4670'. [ 461.719840][T22031] pim6reg: entered allmulticast mode [ 461.728970][T22034] netlink: 'syz.2.4672': attribute type 1 has an invalid length. [ 461.734483][T22028] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4670'. [ 461.793911][T22028] gretap0: entered promiscuous mode [ 461.818683][T22028] gretap0: left promiscuous mode [ 461.842681][T22040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4671'. [ 461.951899][T22040] team_slave_0: entered promiscuous mode [ 461.957896][T22040] team_slave_1: entered promiscuous mode [ 462.103642][T22048] netlink: 'syz.2.4676': attribute type 29 has an invalid length. [ 462.138846][T22052] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4676'. [ 462.145087][T22048] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4676'. [ 462.292135][T22060] netlink: 340 bytes leftover after parsing attributes in process `syz.0.4679'. [ 462.541852][T22075] tipc: Enabled bearer , priority 0 [ 462.553466][T22077] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4684'. [ 462.563099][T22075] syzkaller0: entered promiscuous mode [ 462.563127][T22075] syzkaller0: entered allmulticast mode [ 462.603517][T22079] netlink: 'syz.3.4685': attribute type 62 has an invalid length. [ 462.608216][T22075] tipc: Resetting bearer [ 462.619308][T22077] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4684'. [ 462.632251][T22074] tipc: Resetting bearer [ 462.668252][T22074] tipc: Disabling bearer [ 463.106133][T22101] netlink: 'syz.1.4694': attribute type 3 has an invalid length. [ 463.123569][T22101] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4694'. [ 463.236234][T22108] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4696'. [ 463.483097][T22117] netlink: 'syz.1.4699': attribute type 10 has an invalid length. [ 463.502358][T22117] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.582800][T22117] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.590572][T22117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 463.642061][T22117] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 463.921859][T22140] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 463.977534][T22144] (unnamed net_device) (uninitialized): Unable to set peer notification delay as MII monitoring is disabled [ 464.080842][T22148] netlink: 'syz.2.4710': attribute type 10 has an invalid length. [ 465.725027][T22223] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.752180][T22223] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.767939][T22225] FAULT_INJECTION: forcing a failure. [ 465.767939][T22225] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 465.781862][T22225] CPU: 1 UID: 0 PID: 22225 Comm: syz.0.4736 Not tainted syzkaller #0 PREEMPT(full) [ 465.781892][T22225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 465.781904][T22225] Call Trace: [ 465.781912][T22225] [ 465.781921][T22225] dump_stack_lvl+0x189/0x250 [ 465.781952][T22225] ? __pfx____ratelimit+0x10/0x10 [ 465.781981][T22225] ? __pfx_dump_stack_lvl+0x10/0x10 [ 465.782005][T22225] ? __pfx__printk+0x10/0x10 [ 465.782034][T22225] ? __might_fault+0xb0/0x130 [ 465.782075][T22225] should_fail_ex+0x414/0x560 [ 465.782108][T22225] _copy_from_iter+0x1db/0x16f0 [ 465.782137][T22225] ? __lock_acquire+0xab9/0xd20 [ 465.782166][T22225] ? __pfx__copy_from_iter+0x10/0x10 [ 465.782197][T22225] ? page_copy_sane+0x4e/0x280 [ 465.782218][T22225] copy_page_from_iter+0xdd/0x170 [ 465.782243][T22225] tun_get_user+0x1d7b/0x3e20 [ 465.782271][T22225] ? tun_get_user+0x6f6/0x3e20 [ 465.782308][T22225] ? aa_file_perm+0x44d/0x1550 [ 465.782328][T22225] ? __pfx_tun_get_user+0x10/0x10 [ 465.782346][T22225] ? _parse_integer_limit+0x1ae/0x1f0 [ 465.782384][T22225] ? __lock_acquire+0xab9/0xd20 [ 465.782417][T22225] ? ref_tracker_alloc+0x318/0x460 [ 465.782441][T22225] ? __lock_acquire+0xab9/0xd20 [ 465.782471][T22225] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 465.782505][T22225] ? tun_get+0x1c/0x2f0 [ 465.782531][T22225] ? tun_get+0x1c/0x2f0 [ 465.782550][T22225] ? tun_get+0x1c/0x2f0 [ 465.782575][T22225] tun_chr_write_iter+0x113/0x200 [ 465.782609][T22225] vfs_write+0x5c9/0xb30 [ 465.782643][T22225] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 465.782674][T22225] ? __pfx_vfs_write+0x10/0x10 [ 465.782714][T22225] ? __fget_files+0x2a/0x420 [ 465.782755][T22225] ksys_write+0x145/0x250 [ 465.782785][T22225] ? __pfx_ksys_write+0x10/0x10 [ 465.782807][T22225] ? rcu_is_watching+0x15/0xb0 [ 465.782840][T22225] ? do_syscall_64+0xbe/0x3b0 [ 465.782873][T22225] do_syscall_64+0xfa/0x3b0 [ 465.782898][T22225] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.782924][T22225] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.782944][T22225] ? clear_bhb_loop+0x60/0xb0 [ 465.782968][T22225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.782988][T22225] RIP: 0033:0x7f2b7238d69f [ 465.783007][T22225] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 465.783025][T22225] RSP: 002b:00007f2b7328e000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 465.783048][T22225] RAX: ffffffffffffffda RBX: 00007f2b725b5fa0 RCX: 00007f2b7238d69f [ 465.783061][T22225] RDX: 0000000000000066 RSI: 0000200000000080 RDI: 00000000000000c8 [ 465.783074][T22225] RBP: 00007f2b7328e090 R08: 0000000000000000 R09: 0000000000000000 [ 465.783087][T22225] R10: 0000000000000066 R11: 0000000000000293 R12: 0000000000000001 [ 465.783099][T22225] R13: 00007f2b725b6038 R14: 00007f2b725b5fa0 R15: 00007ffeb52a9af8 [ 465.783134][T22225] [ 465.785670][T22223] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.800502][T22227] openvswitch: netlink: Message has -1 unknown bytes. [ 465.814671][T22223] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 466.293412][T22237] netlink: 'syz.3.4737': attribute type 83 has an invalid length. [ 466.662344][T22269] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 466.733720][T22276] __nla_validate_parse: 9 callbacks suppressed [ 466.733742][T22276] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4747'. [ 466.763051][T22263] wg1 speed is unknown, defaulting to 1000 [ 466.889789][T22283] nft_compat: unsupported protocol 5 [ 466.907591][T22283] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4750'. [ 466.921479][T22283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4750'. [ 466.949697][T22285] netlink: 'syz.2.4751': attribute type 3 has an invalid length. [ 466.958859][T22285] netlink: 'syz.2.4751': attribute type 1 has an invalid length. [ 467.151061][T22285] bridge0: port 1(bridge_slave_0) entered listening state [ 467.160253][ T30] audit: type=1804 audit(1755804325.744:5): pid=22291 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4753" name="/newroot/388/cgroup.controllers" dev="tmpfs" ino=1997 res=1 errno=0 [ 467.162061][T22291] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4753'. [ 467.218308][ T30] audit: type=1800 audit(1755804325.744:6): pid=22291 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4753" name="cgroup.controllers" dev="tmpfs" ino=1997 res=0 errno=0 [ 467.344551][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 467.361864][T22292] syzkaller1: entered promiscuous mode [ 467.379279][T22292] syzkaller1: entered allmulticast mode [ 467.421769][T22300] unknown channel width for channel at 909000KHz? [ 467.454597][T22300] unknown channel width for channel at 909000KHz? [ 467.461173][T22300] unknown channel width for channel at 909000KHz? [ 467.602218][T22300] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.614982][T22300] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 467.699571][T22306] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 467.779028][T22311] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4757'. [ 467.812576][T22300] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.845128][T22300] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 467.961531][T22320] FAULT_INJECTION: forcing a failure. [ 467.961531][T22320] name failslab, interval 1, probability 0, space 0, times 0 [ 467.974351][T22320] CPU: 1 UID: 0 PID: 22320 Comm: syz.0.4761 Not tainted syzkaller #0 PREEMPT(full) [ 467.974382][T22320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 467.974394][T22320] Call Trace: [ 467.974402][T22320] [ 467.974410][T22320] dump_stack_lvl+0x189/0x250 [ 467.974439][T22320] ? __pfx____ratelimit+0x10/0x10 [ 467.974466][T22320] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.974491][T22320] ? __pfx__printk+0x10/0x10 [ 467.974524][T22320] ? __lock_acquire+0xab9/0xd20 [ 467.974559][T22320] should_fail_ex+0x414/0x560 [ 467.974593][T22320] should_failslab+0xa8/0x100 [ 467.974624][T22320] kmem_cache_alloc_noprof+0x73/0x3c0 [ 467.974650][T22320] ? skb_clone+0x212/0x3a0 [ 467.974669][T22320] ? run_filter+0x23/0x270 [ 467.974695][T22320] skb_clone+0x212/0x3a0 [ 467.974715][T22320] ? packet_rcv+0x567/0x1590 [ 467.974740][T22320] packet_rcv+0x6d6/0x1590 [ 467.974769][T22320] ? __pfx_packet_rcv+0x10/0x10 [ 467.974793][T22320] __netif_receive_skb_core+0x3104/0x4020 [ 467.974839][T22320] ? __lock_acquire+0xab9/0xd20 [ 467.974876][T22320] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 467.974901][T22320] ? ktime_get_with_offset+0x8c/0x2a0 [ 467.974947][T22320] ? netif_receive_skb+0x115/0x790 [ 467.974973][T22320] ? netif_receive_skb+0x115/0x790 [ 467.974999][T22320] __netif_receive_skb+0x72/0x380 [ 467.975035][T22320] ? read_tsc+0x9/0x20 [ 467.975066][T22320] ? netif_receive_skb+0x115/0x790 [ 467.975088][T22320] netif_receive_skb+0x1cb/0x790 [ 467.975116][T22320] ? __pfx_netif_receive_skb+0x10/0x10 [ 467.975147][T22320] ? tun_rx_batched+0x160/0x730 [ 467.975170][T22320] tun_rx_batched+0x1b9/0x730 [ 467.975189][T22320] ? __lock_acquire+0xab9/0xd20 [ 467.975220][T22320] ? __pfx_tun_rx_batched+0x10/0x10 [ 467.975245][T22320] ? tun_get_user+0x266c/0x3e20 [ 467.975263][T22320] ? tun_vnet_hdr_tnl_to_skb+0xed/0x830 [ 467.975294][T22320] tun_get_user+0x2aa2/0x3e20 [ 467.975322][T22320] ? tun_get_user+0x6f6/0x3e20 [ 467.975342][T22320] ? tun_get_user+0x266c/0x3e20 [ 467.975366][T22320] ? aa_file_perm+0x44d/0x1550 [ 467.975383][T22320] ? __pfx_tun_get_user+0x10/0x10 [ 467.975435][T22320] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 467.975469][T22320] ? tun_get+0x1c/0x2f0 [ 467.975494][T22320] ? tun_get+0x1c/0x2f0 [ 467.975512][T22320] ? tun_get+0x1c/0x2f0 [ 467.975538][T22320] tun_chr_write_iter+0x113/0x200 [ 467.975572][T22320] vfs_write+0x5c9/0xb30 [ 467.975624][T22320] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 467.975654][T22320] ? __pfx_vfs_write+0x10/0x10 [ 467.975692][T22320] ? __fget_files+0x2a/0x420 [ 467.975733][T22320] ksys_write+0x145/0x250 [ 467.975763][T22320] ? __pfx_ksys_write+0x10/0x10 [ 467.975786][T22320] ? rcu_is_watching+0x15/0xb0 [ 467.975813][T22320] ? do_syscall_64+0xbe/0x3b0 [ 467.975847][T22320] do_syscall_64+0xfa/0x3b0 [ 467.975873][T22320] ? lockdep_hardirqs_on+0x9c/0x150 [ 467.975899][T22320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.975919][T22320] ? clear_bhb_loop+0x60/0xb0 [ 467.975945][T22320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.975964][T22320] RIP: 0033:0x7f2b7238d69f [ 467.975984][T22320] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 467.976002][T22320] RSP: 002b:00007f2b7328e000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 467.976037][T22320] RAX: ffffffffffffffda RBX: 00007f2b725b5fa0 RCX: 00007f2b7238d69f [ 467.976051][T22320] RDX: 0000000000000066 RSI: 0000200000000080 RDI: 00000000000000c8 [ 467.976065][T22320] RBP: 00007f2b7328e090 R08: 0000000000000000 R09: 0000000000000000 [ 467.976077][T22320] R10: 0000000000000066 R11: 0000000000000293 R12: 0000000000000001 [ 467.976090][T22320] R13: 00007f2b725b6038 R14: 00007f2b725b5fa0 R15: 00007ffeb52a9af8 [ 467.976126][T22320] [ 468.057863][T22327] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4762'. [ 468.391200][T22300] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.416713][T22300] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 468.449228][T22328] tipc: Enabled bearer , priority 0 [ 468.473904][T22332] mac80211_hwsim hwsim42 syzkaller0: entered promiscuous mode [ 468.513915][T22332] mac80211_hwsim hwsim42 syzkaller0: entered allmulticast mode [ 468.612851][T22300] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.635597][T22300] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 468.913630][ T1144] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 468.924761][ T1144] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 468.965412][ T1144] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 468.974656][ T1144] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 469.003673][ T1144] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 469.014029][ T1144] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 469.053137][ T6199] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 469.063183][ T6199] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 469.201052][T22362] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4772'. [ 469.428062][T22372] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4775'. [ 469.516549][T22376] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4776'. [ 469.564621][ T5873] tipc: Node number set to 1704007307 [ 469.849719][T22385] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4779'. [ 471.569123][T22463] pim6reg: entered allmulticast mode [ 471.587061][T22463] netlink: 'syz.1.4800': attribute type 1 has an invalid length. [ 471.756103][T22480] __nla_validate_parse: 6 callbacks suppressed [ 471.756126][T22480] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4803'. [ 472.281745][T22510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4809'. [ 472.343308][T22514] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4810'. [ 472.461417][T22510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4809'. [ 472.573428][T22520] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 472.823910][T22539] netlink: 'syz.1.4818': attribute type 1 has an invalid length. [ 472.837686][T22540] sctp: [Deprecated]: syz.2.4819 (pid 22540) Use of int in maxseg socket option. [ 472.837686][T22540] Use struct sctp_assoc_value instead [ 472.856839][T22538] sctp: [Deprecated]: syz.2.4819 (pid 22538) Use of int in maxseg socket option. [ 472.856839][T22538] Use struct sctp_assoc_value instead [ 472.886272][T22540] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4819'. [ 472.886323][T22550] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4819'. [ 472.915415][T22539] 8021q: adding VLAN 0 to HW filter on device bond2 [ 472.943104][T22539] bond2: (slave geneve3): making interface the new active one [ 472.956824][T22551] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4820'. [ 472.966411][T22539] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 473.293168][T22569] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4825'. [ 473.571851][T22584] IPv6: sit3: Disabled Multicast RS [ 473.617733][T22589] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4830'. [ 473.630740][T22584] sit3: entered allmulticast mode [ 473.638732][T22594] netlink: 'syz.1.4831': attribute type 2 has an invalid length. [ 473.652751][T22594] netlink: 'syz.1.4831': attribute type 1 has an invalid length. [ 473.689097][T22586] netlink: 'syz.1.4831': attribute type 2 has an invalid length. [ 473.702486][T22586] netlink: 'syz.1.4831': attribute type 1 has an invalid length. [ 474.026359][T22589] tipc: Disabling bearer [ 474.052301][T22589] vlan0 (unregistering): left allmulticast mode [ 474.059455][T22589] veth0_vlan (unregistering): left allmulticast mode [ 474.069068][T22589] vlan0 (unregistering): left promiscuous mode [ 474.840622][T22618] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4837'. [ 475.532931][T22651] tipc: Resetting bearer [ 475.590303][T22655] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 476.280116][T22689] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 476.308885][T22685] tipc: Enabling of bearer rejected, failed to enable media [ 476.901559][T22728] __nla_validate_parse: 14 callbacks suppressed [ 476.901584][T22728] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4870'. [ 477.050247][T22735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4872'. [ 477.060670][T22735] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4872'. [ 477.215728][T22744] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4875'. [ 477.222008][T22746] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4876'. [ 477.622183][T22765] netlink: 25 bytes leftover after parsing attributes in process `syz.3.4881'. [ 477.661521][T22765] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 477.702402][T22765] netlink: 5 bytes leftover after parsing attributes in process `syz.3.4881'. [ 477.726318][T22765] 0{X功: renamed from gretap0 (while UP) [ 477.747842][T22765] 0{X功: entered allmulticast mode [ 477.774059][T22765] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 477.846870][T22784] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4884'. [ 477.988470][T22778] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4884'. [ 478.199822][T22800] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4889'. [ 478.257496][T22800] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 478.277856][T22805] netlink: 'syz.0.4889': attribute type 3 has an invalid length. [ 478.478583][T22812] 0{X功: entered promiscuous mode [ 478.489984][T22812] vlan0: entered promiscuous mode [ 478.910253][T22824] [ 478.912664][T22824] ====================================================== [ 478.919806][T22824] WARNING: possible circular locking dependency detected [ 478.926954][T22824] syzkaller #0 Not tainted [ 478.931401][T22824] ------------------------------------------------------ [ 478.938450][T22824] syz.0.4897/22824 is trying to acquire lock: [ 478.944786][T22824] ffffffff8f68d2b8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xa9/0x720 [ 478.954291][T22824] [ 478.954291][T22824] but task is already holding lock: [ 478.961768][T22824] ffffffff8f68d258 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720 [ 478.971408][T22824] [ 478.971408][T22824] which lock already depends on the new lock. [ 478.971408][T22824] [ 478.982133][T22824] [ 478.982133][T22824] the existing dependency chain (in reverse order) is: [ 478.991449][T22824] [ 478.991449][T22824] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 478.999666][T22824] lock_acquire+0x120/0x360 [ 479.004816][T22824] _raw_spin_lock_bh+0x36/0x50 [ 479.010155][T22824] nr_rt_ioctl+0x390/0xd50 [ 479.015131][T22824] sock_do_ioctl+0xdc/0x300 [ 479.020171][T22824] sock_ioctl+0x576/0x790 [ 479.025223][T22824] __se_sys_ioctl+0xfc/0x170 [ 479.030366][T22824] do_syscall_64+0xfa/0x3b0 [ 479.035463][T22824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.041988][T22824] [ 479.041988][T22824] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 479.050088][T22824] lock_acquire+0x120/0x360 [ 479.055218][T22824] _raw_spin_lock_bh+0x36/0x50 [ 479.060599][T22824] nr_rt_ioctl+0x193/0xd50 [ 479.065652][T22824] sock_do_ioctl+0xdc/0x300 [ 479.070813][T22824] sock_ioctl+0x576/0x790 [ 479.075883][T22824] __se_sys_ioctl+0xfc/0x170 [ 479.081021][T22824] do_syscall_64+0xfa/0x3b0 [ 479.086118][T22824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.092565][T22824] [ 479.092565][T22824] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 479.100418][T22824] validate_chain+0xb9b/0x2140 [ 479.105879][T22824] __lock_acquire+0xab9/0xd20 [ 479.111112][T22824] lock_acquire+0x120/0x360 [ 479.116270][T22824] _raw_spin_lock_bh+0x36/0x50 [ 479.121590][T22824] nr_rt_device_down+0xa9/0x720 [ 479.127319][T22824] nr_device_event+0x137/0x150 [ 479.132625][T22824] notifier_call_chain+0x1b3/0x3e0 [ 479.138551][T22824] __dev_notify_flags+0x18d/0x2e0 [ 479.144370][T22824] netif_change_flags+0xe8/0x1a0 [ 479.149886][T22824] dev_change_flags+0x130/0x260 [ 479.155606][T22824] dev_ioctl+0x7b4/0x1150 [ 479.160595][T22824] sock_do_ioctl+0x22c/0x300 [ 479.166086][T22824] sock_ioctl+0x576/0x790 [ 479.171035][T22824] __se_sys_ioctl+0xfc/0x170 [ 479.176233][T22824] do_syscall_64+0xfa/0x3b0 [ 479.181361][T22824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.188206][T22824] [ 479.188206][T22824] other info that might help us debug this: [ 479.188206][T22824] [ 479.198917][T22824] Chain exists of: [ 479.198917][T22824] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 479.198917][T22824] [ 479.213036][T22824] Possible unsafe locking scenario: [ 479.213036][T22824] [ 479.220612][T22824] CPU0 CPU1 [ 479.226091][T22824] ---- ---- [ 479.231565][T22824] lock(nr_neigh_list_lock); [ 479.236611][T22824] lock(&nr_node->node_lock); [ 479.243931][T22824] lock(nr_neigh_list_lock); [ 479.251225][T22824] lock(nr_node_list_lock); [ 479.255820][T22824] [ 479.255820][T22824] *** DEADLOCK *** [ 479.255820][T22824] [ 479.264228][T22824] 2 locks held by syz.0.4897/22824: [ 479.269520][T22824] #0: ffffffff8f537c08 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 479.278434][T22824] #1: ffffffff8f68d258 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720 [ 479.288489][T22824] [ 479.288489][T22824] stack backtrace: [ 479.294498][T22824] CPU: 1 UID: 0 PID: 22824 Comm: syz.0.4897 Not tainted syzkaller #0 PREEMPT(full) [ 479.294519][T22824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 479.294529][T22824] Call Trace: [ 479.294539][T22824] [ 479.294548][T22824] dump_stack_lvl+0x189/0x250 [ 479.294573][T22824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 479.294592][T22824] ? __pfx__printk+0x10/0x10 [ 479.294614][T22824] ? print_lock_name+0xde/0x100 [ 479.294637][T22824] print_circular_bug+0x2ee/0x310 [ 479.294657][T22824] check_noncircular+0x134/0x160 [ 479.294678][T22824] validate_chain+0xb9b/0x2140 [ 479.294697][T22824] ? rt6_disable_ip+0x6b3/0x720 [ 479.294717][T22824] ? __queue_work+0xc56/0xfb0 [ 479.294736][T22824] ? __lock_acquire+0xab9/0xd20 [ 479.294760][T22824] __lock_acquire+0xab9/0xd20 [ 479.294784][T22824] ? nr_rt_device_down+0xa9/0x720 [ 479.294801][T22824] lock_acquire+0x120/0x360 [ 479.294822][T22824] ? nr_rt_device_down+0xa9/0x720 [ 479.294844][T22824] ? nr_rt_device_down+0xa9/0x720 [ 479.294860][T22824] _raw_spin_lock_bh+0x36/0x50 [ 479.294879][T22824] ? nr_rt_device_down+0xa9/0x720 [ 479.294895][T22824] nr_rt_device_down+0xa9/0x720 [ 479.294913][T22824] ? do_raw_spin_unlock+0x122/0x240 [ 479.294942][T22824] nr_device_event+0x137/0x150 [ 479.294958][T22824] notifier_call_chain+0x1b3/0x3e0 [ 479.294977][T22824] __dev_notify_flags+0x18d/0x2e0 [ 479.294993][T22824] ? __pfx___dev_notify_flags+0x10/0x10 [ 479.295006][T22824] ? __dev_change_flags+0x4cc/0x6d0 [ 479.295023][T22824] ? __pfx___dev_change_flags+0x10/0x10 [ 479.295038][T22824] ? full_name_hash+0x92/0xe0 [ 479.295057][T22824] netif_change_flags+0xe8/0x1a0 [ 479.295074][T22824] dev_change_flags+0x130/0x260 [ 479.295099][T22824] dev_ioctl+0x7b4/0x1150 [ 479.295122][T22824] sock_do_ioctl+0x22c/0x300 [ 479.295142][T22824] ? __pfx_sock_do_ioctl+0x10/0x10 [ 479.295159][T22824] ? __lock_acquire+0xab9/0xd20 [ 479.295188][T22824] sock_ioctl+0x576/0x790 [ 479.295207][T22824] ? __pfx_sock_ioctl+0x10/0x10 [ 479.295224][T22824] ? __fget_files+0x2a/0x420 [ 479.295246][T22824] ? __fget_files+0x3a0/0x420 [ 479.295268][T22824] ? __fget_files+0x2a/0x420 [ 479.295291][T22824] ? bpf_lsm_file_ioctl+0x9/0x20 [ 479.295310][T22824] ? __pfx_sock_ioctl+0x10/0x10 [ 479.295327][T22824] __se_sys_ioctl+0xfc/0x170 [ 479.295347][T22824] do_syscall_64+0xfa/0x3b0 [ 479.295368][T22824] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.295389][T22824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.295404][T22824] ? clear_bhb_loop+0x60/0xb0 [ 479.295421][T22824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.295436][T22824] RIP: 0033:0x7f2b7238ebe9 [ 479.295451][T22824] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 479.295465][T22824] RSP: 002b:00007f2b7326d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 479.295483][T22824] RAX: ffffffffffffffda RBX: 00007f2b725b6090 RCX: 00007f2b7238ebe9 [ 479.295495][T22824] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 000000000000000f [ 479.295505][T22824] RBP: 00007f2b72411e19 R08: 0000000000000000 R09: 0000000000000000 [ 479.295515][T22824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 479.295525][T22824] R13: 00007f2b725b6128 R14: 00007f2b725b6090 R15: 00007ffeb52a9af8 [ 479.295544][T22824] [ 488.624435][ T5864] Bluetooth: hci3: command 0x0405 tx timeout