last executing test programs: 6.852895105s ago: executing program 0 (id=2928): socket$key(0xf, 0x3, 0x2) (async) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000007c0)={0x2, 0xf, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@multicast2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast2}}]}, 0xa0}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000000c0)}}], 0x2, 0x4040040) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) r3 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_TIOCOUTQ(r3, 0x5411, &(0x7f000000a080)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}, [], [], 'wg1\x00', 'caif0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) 2.504111592s ago: executing program 4 (id=2998): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r0}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(r1, 0x80049367, &(0x7f00000001c0)=0x8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x1, 0xf0}, 0xfe}, 0x11) r4 = socket$can_j1939(0x1d, 0x2, 0x7) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001e00010000000000e0ffffff0100000003000007000000000800080000000000080001"], 0x2c}, 0x1, 0x0, 0x0, 0x2}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) writev(r2, &(0x7f0000000200)=[{&(0x7f00000003c0)="b4fd1de35ccef880f6c46e430d001997319a71db587127abfdf1f0237efc37639575d9780b544ad95d8fb1e01e2d94fbe498dd99fd9733e5b8ad519f20e5ff1de4793bc19b10ddc1f2093e9ecb1e7fe2e7ca7ad0c97e8e4c3f44bbcd69d6e163ffa60705f1ab528a129cd666a7a1e1715d81974f238d70e8f4053c823a230d8738ef111d7dcdf9ac9f0ee94e505f0e1023bfcd2166b779228d635a7326b10d2c79f0ed0ff0385514cb266fce822e038549343ddde51b140b893fe473d47f45ae39bf92574c07b0e492986b4149948daf7e00", 0xd2}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x20, 0x16, &(0x7f0000000240)=ANY=[@ANYRESDEC=r0], &(0x7f0000001580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x20}, 0x94) sendmsg$can_j1939(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)="db343e3bef6ac5b42f", 0x9}, 0x1, 0x0, 0x0, 0x4048000}, 0x810) bind$can_j1939(r4, &(0x7f00000000c0)={0x1d, r6, 0x0, {0x0, 0xff}}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="b70000000000000007000000000000009500e200000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c700000000d97899514e64e36cad5eba82010b2d149ac02e5f07000000000000000000000000000000000000000000009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad48c830e8003c45f5b2dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d509effc252599b26555355d7955f551df82ea475a711ec56d00000000a89c7533c9955fd63cd00cb83d1228"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r9, 0x114, 0xa, &(0x7f0000000040)=ANY=[@ANYRES64=r9], 0x4) setsockopt$sock_int(r8, 0x1, 0x1000000000000f, &(0x7f0000000180)=0x57bb, 0x3c) setsockopt$sock_attach_bpf(r8, 0x1, 0x34, &(0x7f00000000c0)=r7, 0x4) r10 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r10, &(0x7f0000000000)={0x3, 0x0, @remote}, 0x10) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x33, &(0x7f00000a2000)={0x1, &(0x7f0000000200)=[{0x6}]}, 0x10) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000001540)={0x0, 0x0, 0x7, 0x256}) connect$can_j1939(r4, &(0x7f0000000140)={0x1d, r6}, 0x18) sendmmsg(r4, &(0x7f000000a200)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)="220733d69b211bb4a3", 0x9}], 0x1}}], 0x1, 0x60000800) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080)={0x41, 0x1, 0x3}, 0x10) r11 = epoll_create(0x7) epoll_pwait(r11, &(0x7f0000000380)=[{}], 0x1, 0x3f38, &(0x7f00000002c0), 0x8) 2.151009406s ago: executing program 1 (id=3003): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001840)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a216798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271fefc583eec8912c37562d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de7368ca69f6f8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a18159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b2059ba4b923a1188dd61dc7de058a4dfa7e85a8bdf1d41a2d8bd044d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4ae52066bb5d4045c958549b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9530243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a000000002a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd103c1962f4759286db3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e1dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd040000000000000034137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a175979d54000004408996ec5db6a4d15b71ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87492332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b24000000000000000070000000072716bc8e139c49b91c76bea3858f7ca208d31330d89069f96f66e2e7748a2ff93060ff073b3a113e47edf0672fda649e8ca5095f2a161bf60b876f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee62714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff42961f8f3b555d9e8aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e8173d3d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e00400000022f3e34b7524642c248aa813edaa626f000000000000000000000000000000005519fe545110a9c01d6f0da7b04d6eb1a47675aea60371f629ed3446beb20bf2bab80e451b4139dc6c87e6b395edc142e24b596f636f8c248beeb268dbbf120b26693f73a6362e7c6bff6b08514763f6fbe6c914baf7e25ac7e8d36babeb6c58d012cf7b1ffbe996204af87412b9b21da1dfb01aa5a4ff142deb3bd70d11cf71752bdb33f1dfb6ef107ef3cb0016b2b6dcffb0be5a95d56172098ebf6075cc048f94350e2adb108eabccfae942bbca66ea83139ab4062963be6d549907b17d95b248201322cd8cc6540b6e369c7ebd9b98ec3dab43e84ecf9e66be246847b40feadfebcbb566d4e243bd8f279db0c7f5320ca6bf5cea49671ca89eedbb79028af6d459d6fe81071e700136fdb9234ce00d6ce181421dc659fc73ad25cdf97e5a6f4e5e05394e70fdf1ef4b41c376ba0222a87d8d5609f535a6a6fbbd60fc633064a94c252ac127b7467ec036ed883e252cb8727208712e4296f106c6527ff939552e23c2140c0000000000000000000000000000000000000000000000707d178c32bafb18352f2840a48309d5fd326a0f3a352321543173b4bb9e92b431aa4b9bb916945ce250b8b1120930fd1784810b696a77fd0500257c3952a2f399557c8323b1b0ad995a9c02bf21f00d5b56c2a62e31e7ebfade7c5f091b373db013878526bb7f9179c2ff52dae8557ec08905963527edb6cdf98493a48a191182f29f358801a33d5e4b7e05912f0323c6c9536a0495d014e5d42832ac32a216c437baa696287b84356ab4bbc4c35e2b786ee0856426d1a67ca168850f858d20e8bb7d8fbf1ca251646c35373aefdf180d8dd9511beb88084ba4287faa0f45f3bcba27c79a"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0xf5, 0xfffff010}, {0x6}]}, 0x10) sendmmsg$inet(r1, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0x14, r4, 0x1}, 0x14}}, 0x4080) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x0, &(0x7f00000004c0)="ad5ce39667bde4014c9745573838", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.833569099s ago: executing program 2 (id=3006): r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x8, 0x0, &(0x7f0000000240)) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) r2 = epoll_create1(0x0) epoll_pwait(r2, 0xfffffffffffffffc, 0x0, 0x8000002, 0x0, 0x0) (async) sendmmsg$sock(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000340)}}], 0x1, 0x83d086745984798f) 1.787533225s ago: executing program 3 (id=3007): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000012c0)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="52e10be29ad16e2b63707520"], 0x5) r3 = openat$cgroup_int(r0, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x8, 0x12) write$cgroup_subtree(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB='-b0u '], 0x5) readv(r3, &(0x7f0000001680)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x1) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000000)={0xfffffffb}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001040)=ANY=[@ANYBLOB="280596000000fb0097023dbd7000000000000700", @ANYRES32=0x0, @ANYBLOB="000000000000000008001f0055000000"], 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(0x0, r6) sendmsg$TIPC_CMD_GET_NETID(r5, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r7, 0x300, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000094) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000080)=0xfffffd12) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r8, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r9, 0x3}, 0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000540)={r9, 0xbf}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000100)={r9, @in6={{0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x10000}}, [0x0, 0xfffffffffffffffb, 0x8, 0xebd, 0x0, 0x2, 0x40d, 0x1ff, 0x8, 0xfffffffffffffc00, 0x66, 0xffffffffa9fe8e4a, 0x8, 0x8, 0x2]}, &(0x7f0000000200)=0x100) socket$nl_netfilter(0x10, 0x3, 0xc) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="ff010000100001000000000000000000e00000020000000000000000000000000a01010100"/59, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000fe8000000000000000000000000000bb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000020000a000000920000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008001d000000000008001e0003000000"], 0x148}}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="68000000100001002fbd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0201000000000000140003006e657464657673696d3000000000000034001680300001802c000c8014000100a463ede3"], 0x68}, 0x1, 0x0, 0x0, 0x20008080}, 0x24040800) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$net_dm(&(0x7f0000004b40), r12) sendmsg$NET_DM_CMD_START(r12, &(0x7f0000004c00)={0x0, 0x0, &(0x7f0000004bc0)={&(0x7f0000004b80)={0x14, r13, 0x1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x8000) 1.752454905s ago: executing program 2 (id=3008): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@ipv4_newrule={0x24, 0x1e, 0x1, 0x0, 0x200000, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7}, [@FRA_GENERIC_POLICY=@FRA_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@ipv4_newrule={0x24, 0x1e, 0x1, 0x0, 0x200000, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7}, [@FRA_GENERIC_POLICY=@FRA_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x840000000002, 0x3, 0x100) setsockopt$sock_int(r3, 0x1, 0x1a, &(0x7f0000000240), 0x4) socket$can_raw(0x1d, 0x3, 0x1) (async) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'pim6reg1\x00'}) accept(r4, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001c00010027bd7000ffdbdf2507000000", @ANYRES32=r5, @ANYBLOB="80030200aa3decaaaa0c000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x200440c5}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007050000080013002d15010000000000950017b8000000006916000000000000bf67000000000000350607000fff07206706000002000000160300000ee6fe5fbf500000000000000f650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f19de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03cc86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f674629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40446d7074be86a912a5ac00f7ffffffffffffff000000000000c1eb2d91fb79ea00000000000000bb0d0000000000000000001fe4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b00631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809f905f12f6106f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3f00004d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad0fceee5f339550130a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3116dbc7e2bf2402275fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453b65586f65c7943d54b52f06c870edf0c5d644b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a57ff52f657a67463d7db0825e9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f3b563ab9000000ff000000000077a99fb5b0a43749ca477c9c7ca20bd428d8f77bb920ad0db4c1da671bfad7f109b776476a54939e621232cd115ba9f37057ad891fea2353f3ad9c042c64a5ecf80f4e4cf927ae39347c22822375c26edf2754695c16780429e03759691adb63553e9c4561528ded5f35bb20e98b2e6d01dbfcde82608359c50881324524db0dbe21efba4f0fc338f4b0b11cb028d1063b3bacaab92fb7f9d2971440f873ec261d54c1570adef8004c91896fcd74c9e03dfd9a781210c0346ed1b02a44c64adad8a3f238a8ddf7207c45057c02e922b942f15ddcfbfb00"/1752], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) 1.633744102s ago: executing program 1 (id=3009): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0xa}, 0x28) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000180), &(0x7f00000001c0)=0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bond_slave_1\x00', 0x0}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x6, 0x80, 0x200}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r6 = socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route_sched(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0xc48, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r5, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xc1c, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x62}, @TCA_U32_POLICE={0x18, 0x6, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x3f44}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}]}, @TCA_U32_HASH={0x8, 0x2, 0x8}, @TCA_U32_HASH={0x8, 0x2, 0x1522}, @TCA_U32_ACT={0x368, 0x7, [@m_bpf={0xb4, 0x1c, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x5, 0x5, 0x9, 0x5}}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{0x7, 0x8, 0x8, 0x10000}, {0x51e, 0x3, 0x2, 0x2}]}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}, @TCA_ACT_BPF_FD={0x8, 0x5, r6}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}]}, {0x3c, 0x6, "e9b5400d147f4ce8f8364f3d66b44c4105c1f0a90600517e8ba8430995d84641b6444cc45d3d5e48bae740cb5b415b20ac5cce6274d22b8b"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x8c, 0x1b, 0x0, 0x0, {{0x8}, {0x4}, {0x62, 0x6, "113922f2f809c4d5778a4b1447db9e0510c67651ffb50bd48a89e9ff22ff462c62248dfbc1b4312173975e347d812c375caa559e7d0562a4bc5e23485a0b50590b68da364aa91839c17d7ecafe8ba6e5cbff329d117ce3e59cc0d791a0be"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}, @m_simple={0x134, 0x13, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x4, 0x0, 0x4, 0x1, 0xa}}, @TCA_DEF_PARMS={0x18, 0x2, {0x5, 0x80, 0x0, 0x9ce, 0x10001}}, @TCA_DEF_DATA={0x9, 0x3, '*\xaa:\x04\x00'}, @TCA_DEF_DATA={0x9, 0x3, 'hfsc\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x2, 0x7, 0x0, 0x8}}]}, {0xa7, 0x6, "fe2388553a1722eb5eefe03ded1663731cfa729b6403148de69e656f2f97fe4fc6d6a0e133980bff51343d3dc8bc073f37a1629ab8f17ae6e012cf8c70f02a5c06c856adcd20de5460f2de556e8e5209137548bd02c9233bf92e03b74a505a28494bb0a84eebee82d24db14a62062e5f045de6f3054c38b5ce56ceb5a145be6e8e602e04ac859d385f6be4f9727d1f1d2f68170b96355e6b87b823b71b4ad647c25d19"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_tunnel_key={0xf0, 0xd, 0x0, 0x0, {{0xf}, {0x1c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e23}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0xfffffffb}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x4}]}, {0xa7, 0x6, "0d6639ad05a75b93391a70bc8be9f92e9733d47c45653e9987db7f29bc379b242de2bfb4781a1ef73265885f112a9cc7e9d157a59c76903e28b291911b1ae81d751f5963f54eb8c924dad11c75c6b7cc39ff4f6d82fe28bc52c769bcfa4a3d67a7b044021c3a1d358d143782d4cc09c711c6ac28ff578532d8d5eda4d193ddad86942921b88e07669dab6d32508205124b9b5cec93c2d3c10aa9e6936bbc3d04da5756"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}, @TCA_U32_POLICE={0x880, 0x6, [@TCA_POLICE_RATE64={0xc, 0x8, 0x6}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}, @TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x2, 0x2, 0x9, 0x3ff, 0x10001, 0x7ff, 0x1, 0x8000004, 0x4, 0x10, 0x5, 0x2, 0x3d5, 0x1, 0xa, 0xf, 0x5, 0x8001, 0x0, 0xa4de, 0x8, 0x7, 0x400, 0x3, 0x1000, 0xfffffff7, 0x0, 0x28000000, 0xfffff0c1, 0x8, 0x1cf8, 0x7ff, 0xffffffff, 0x2, 0x3, 0x5, 0x7, 0x5, 0x2, 0x9, 0x6, 0x5, 0x7, 0x9, 0x1ff, 0xa9c, 0x75, 0x1b0, 0x290d, 0x6, 0x8, 0x8, 0x58, 0x9, 0x7db, 0xa, 0x7, 0xb, 0x6, 0x9, 0x2, 0x7, 0x5, 0x1c, 0x10000, 0x5, 0xa, 0x3, 0x2, 0x1, 0x1000, 0x401, 0x7, 0x80000001, 0x8, 0xffff6751, 0x401, 0xfffffffc, 0x9, 0x7f, 0x10000, 0x525, 0x1, 0xfffffff9, 0x7, 0x4, 0xd, 0xffffffff, 0x24b2, 0x4, 0x9, 0x8, 0x7, 0x200, 0xf, 0x9, 0x5, 0x4, 0x8, 0x1, 0x4, 0x5, 0xf8, 0x0, 0x0, 0x7, 0x1, 0x6, 0x40, 0x219e, 0x0, 0x10001, 0x7, 0x4, 0x96, 0x2, 0xfffffff9, 0xfffffe01, 0x80000001, 0x1, 0x223, 0x3ff, 0x9, 0x9, 0x1, 0x80000000, 0x2292, 0x7f, 0x8, 0x0, 0x2, 0x2, 0x3, 0xcb1c, 0x4, 0x7, 0x800, 0x35, 0x1000, 0x8d, 0xffff6647, 0xfffffff9, 0x4, 0x3, 0x1, 0x401, 0x0, 0x67006c47, 0x9, 0x8, 0x20, 0xffff, 0x2, 0x5, 0x3, 0x9, 0x7, 0x7fffffff, 0x100, 0xdc5a, 0x883, 0x4, 0x1000, 0x1, 0xced2, 0x4, 0x4, 0xad, 0xffffffff, 0x3, 0x5, 0x7fffffff, 0x9, 0x3, 0x6, 0x0, 0x9000000, 0x7fff, 0xa, 0x1, 0xc0, 0x8, 0x5, 0x7, 0x8, 0xcd, 0x5, 0xdd1, 0x4, 0x9, 0xfff, 0xfffff801, 0x1ff, 0xfffffff8, 0x9, 0xff, 0x8, 0x9e2, 0x3, 0x3ff, 0x5f6b, 0x1, 0xfffff6da, 0xffffffff, 0x2, 0x7, 0x1, 0x5, 0x0, 0x0, 0x3, 0x79, 0x0, 0x5, 0x7, 0x401, 0xfffffffd, 0x2, 0x5, 0x5, 0x101, 0x1, 0x7, 0xff, 0x0, 0xec, 0x810000, 0x7f, 0x5490, 0x6, 0x5d3, 0x7fffffff, 0x0, 0x9, 0x8000, 0xea9, 0x7a, 0x7fff, 0xf, 0x5, 0x9, 0x4, 0xd4cb, 0x0, 0x9f, 0x9, 0xa90a, 0xfffffffe, 0x2, 0x7, 0x4, 0x80000001, 0x74edb46d, 0xde, 0x9]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x10001, 0x7, 0x6, 0x2, 0x4, 0x1, 0x1, 0x692, 0xce3, 0x5, 0x8, 0x5, 0x30, 0xc31, 0x2, 0x6, 0x0, 0x7, 0x2, 0x8ea7, 0x9, 0x6, 0x375, 0xa01d, 0x1, 0xffffffff, 0x2, 0x10000, 0x5, 0x5, 0x7ff, 0x0, 0x7f, 0x5, 0xea63, 0x80000000, 0x5, 0xd6, 0xfc73, 0xf814, 0x81ff, 0x3, 0x8, 0x6, 0xffffffff, 0xa9, 0x8, 0x366, 0xffffff28, 0x1000, 0x8, 0x80, 0x0, 0x7, 0x73b4cf, 0x0, 0x1, 0x27f7, 0x6, 0x1, 0x0, 0x10001, 0x5, 0x7, 0x5, 0xff89, 0x3ff, 0x6, 0x1, 0x8, 0x3, 0x8, 0x7, 0xc, 0x636, 0xa858, 0x6, 0x4, 0x81, 0x3, 0x2, 0x7, 0x8, 0xe, 0x5, 0x8, 0x5, 0x8, 0x418d, 0x2, 0x2, 0x5, 0xffffffff, 0x6c3c, 0xa7a, 0xf94, 0x100, 0x5, 0xffff, 0x2, 0x0, 0x6, 0x6, 0x1, 0x6, 0x8, 0x9, 0x5, 0xeb, 0xb176, 0x2, 0x4, 0x2, 0x6, 0x6, 0x8, 0x0, 0x3, 0x1, 0x6, 0x7, 0xffff, 0x0, 0x200, 0x20000, 0x61f72f94, 0x7, 0x101, 0x0, 0x6, 0x7, 0x80, 0xce4, 0x6000000, 0x1, 0xff, 0x7, 0xef, 0x1, 0x1, 0x4, 0x8000, 0xd, 0x1, 0x1, 0x5d, 0x2, 0x73e5, 0x0, 0x4, 0xf6884a5, 0x7, 0x19, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1ff, 0x6, 0x3, 0x1, 0x1ff, 0x0, 0x7, 0x1000, 0x3, 0xfff, 0x7, 0x7ff, 0x9, 0x5, 0xfffff000, 0x7, 0xd, 0x80, 0x53a, 0x8, 0x8, 0xb9, 0x2, 0xc909, 0x4d, 0x7, 0x7, 0x5, 0x5, 0x9, 0xff, 0x2, 0xffff7fff, 0x81, 0x968d, 0x5, 0xf, 0x9, 0x8, 0x0, 0x2, 0x7ff, 0x8a3, 0x0, 0x7, 0x9, 0x65e312d9, 0xfffffffd, 0x3ff, 0x800, 0x1, 0xe, 0x7f, 0xfffffffe, 0x9f10, 0x995, 0xdf, 0xfff, 0x9, 0x80000000, 0xfffffff8, 0xffffff81, 0x10000, 0x10001, 0x4, 0x5c, 0x3, 0x6, 0x6a6, 0x7, 0x3, 0x10, 0xffffffff, 0x80000001, 0x80000000, 0x6, 0x2, 0x3, 0x9, 0x3ff, 0xffff, 0x4, 0xb, 0x8, 0x5, 0x4, 0x77, 0xffff, 0x0, 0x4, 0xef0, 0x7f, 0x100, 0xf5, 0xcfc, 0x2, 0x100]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x7, 0x8a, 0x6, 0xe38, {0xc2, 0x2, 0x69e, 0xa32, 0x7, 0xd3}, {0x4b, 0x0, 0x3, 0x9, 0x3, 0x8}, 0x401, 0x8}}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}]}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x8, &(0x7f0000001e40)=0xffff, 0x4) getsockopt$IPT_SO_GET_INFO(r3, 0x0, 0x40, &(0x7f0000000040)={'raw\x00', 0x0, [0x100, 0x8, 0x8, 0xa0000, 0xd2]}, &(0x7f00000000c0)=0x54) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="8a450200000000002400128009000100626f6e640000000014000280050001000600000008000200", @ANYRES32=r2], 0x44}, 0x1, 0x0, 0x0, 0x20000044}, 0x4000040) 1.613341186s ago: executing program 3 (id=3010): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x104, 0x4, 0x3c0, 0x0, 0xe8, 0x1f0, 0x2d8, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'macvlan0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28}}, {{@arp={@loopback, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00'}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe8}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r1) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000eeff130000000a0013007778616e3300000008001500", @ANYRES32=0x0, @ANYBLOB="080001"], 0x30}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r3) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r4, 0x1, 0x70bd2c, 0x0, {0x3}}, 0x14}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="98000000", @ANYRES16=r6, @ANYBLOB="2da52abd7000fbdbdf2503000000080001000000000008000100000000003400", @ANYRES32=r7, @ANYRES32=r8], 0x98}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000) sendmsg$NLBL_CALIPSO_C_ADD(r5, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x4c, r4, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10000880}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x104, 0x4, 0x3c0, 0x0, 0xe8, 0x1f0, 0x2d8, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'macvlan0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28}}, {{@arp={@loopback, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00'}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe8}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r1) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) (async) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000eeff130000000a0013007778616e3300000008001500", @ANYRES32=0x0, @ANYBLOB="080001"], 0x30}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r3) (async) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r4, 0x1, 0x70bd2c, 0x0, {0x3}}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) sendmsg$NBD_CMD_RECONFIGURE(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="98000000", @ANYRES16=r6, @ANYBLOB="2da52abd7000fbdbdf2503000000080001000000000008000100000000003400", @ANYRES32=r7, @ANYRES32=r8], 0x98}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000) (async) sendmsg$NLBL_CALIPSO_C_ADD(r5, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x4c, r4, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10000880}, 0x1) (async) 1.590126795s ago: executing program 2 (id=3011): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}}, 0x0) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000040)={0x4, 0x1ae, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @can={{0x0, 0x1, 0x1, 0x1}, 0x85, 0x3, 0x0, 0x0, "3868efaafd720c4b"}}, 0x48}, 0x1, 0x0, 0x0, 0x40814}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.io_serviced_recursive\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f000c000000080026000816"], 0x40}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x16}]}, 0x1c}, 0x1, 0x0, 0x0, 0x854}, 0x810) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), r6) sendmsg$IEEE802154_ASSOCIATE_REQ(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x1c, r7, 0xc11, 0x0, 0x0, {}, [@IEEE802154_ATTR_CHANNEL={0x5}]}, 0x1c}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r6) 1.46882487s ago: executing program 3 (id=3012): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r3}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xa, 0x101, 0x7ffc, 0xcc}, 0x50) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x2, 0x13, 0x5, 0x0, 0x2, 0x0, 0x70bd25, 0x25dfdbfe}, 0x10}}, 0x20000080) 1.386385912s ago: executing program 2 (id=3013): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x4, @none, 0x0, 0x1}, 0xe) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xf, &(0x7f0000000000), &(0x7f0000000080)=0x2) syz_emit_ethernet(0x4e, &(0x7f00000003c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd308", 0x18, 0x6, 0x0, @local, @local, {[], {{0x3, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x2, 0x0, 0x0, {[@mss={0x2, 0x4}]}}}}}}}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x4, @none, 0x0, 0x1}, 0xe) (async) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xf, &(0x7f0000000000), &(0x7f0000000080)=0x2) (async) syz_emit_ethernet(0x4e, &(0x7f00000003c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd308", 0x18, 0x6, 0x0, @local, @local, {[], {{0x3, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x2, 0x0, 0x0, {[@mss={0x2, 0x4}]}}}}}}}}, 0x0) (async) 1.357204186s ago: executing program 1 (id=3014): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r1, 0x1, 0x0, 0x0, {{}, {}, {0x3, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000040)=@bpf_lsm={0xd, 0x5, &(0x7f00000001c0)=ANY=[@ANYRES64=r0, @ANYRES32=r1, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x1}, 0x94) socket$nl_route(0x10, 0x3, 0x0) 1.300842935s ago: executing program 2 (id=3015): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000063019b248583000095000000008ca2f3"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x100, 0x70bd28, 0xffffffff, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}, @IFLA_BOND_MIIMON={0x8, 0x3, 0x1}, @IFLA_BOND_UPDELAY={0x8, 0x4, 0x4}]}}}]}, 0x4c}}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000140)=""/172, 0xac}, {&(0x7f0000000600)=""/210, 0xd2}, {&(0x7f0000004000)=""/4064, 0xfe0}, {&(0x7f0000000940)=""/4111, 0x100f}, {&(0x7f0000001c80)=""/131, 0x83}], 0x5}, 0x40012100) r3 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000040)=0x1ba9, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="10031400e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f0000000180)={'ip_vti0\x00', 0x0, 0x8, 0x20, 0x1, 0x8, {{0x18, 0x4, 0x0, 0x7, 0x60, 0x68, 0x0, 0x40, 0x29, 0x0, @local, @multicast2, {[@rr={0x7, 0x17, 0xa, [@rand_addr=0x64010100, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @dev={0xac, 0x14, 0x14, 0x43}]}, @timestamp_addr={0x44, 0x1c, 0x24, 0x1, 0x1, [{@empty, 0x8}, {@loopback, 0xffffffff}, {@private=0xa010102, 0x9}]}, @end, @timestamp={0x44, 0x18, 0x4d, 0x0, 0x3, [0x70b0, 0x2, 0x9f7f, 0xffffffff, 0x34]}]}}}}}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r10, @ANYBLOB='\b\x00%'], 0x3c}, 0x1, 0x0, 0x0, 0x7000000}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(r3, &(0x7f0000001a40)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001a00)={&(0x7f0000001a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="2000937c062d29a394136c80ea465357fd000008000300", @ANYRES32=r10, @ANYBLOB='\b\x00\'\x00\x00\x00\x00\x00'], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x40000) r11 = socket(0x200000100000011, 0x3, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', r7}, 0x50) r13 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0x3, &(0x7f0000001b80)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000000ed1d5e2e41804a8895905f74e7249bd9d6d80464d64821f5c1f269d519604143e7aae97987eab0e1499f13069ca1d6779797d9a91487b2c38be3f811fbe382c1944a7398fe2fdbf974ed82ea870f4de9a0d2a332ee7ed48bc129c9d75bb"], &(0x7f0000000200)='syzkaller\x00', 0x7, 0x1000, &(0x7f0000000240)=""/4096}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000001d40)=ANY=[@ANYRES32=r12, @ANYRES32=r13, @ANYBLOB="0500"/12, @ANYRES32, @ANYBLOB="57578f715b7bfa04dd31ccfc7e2e99f69d0b374af94b588b4affecdedcb51013b2cb7455d449f0a55b1709563d183cd4e11abda0e0e9ab474d410fb1fd334e24eb1e38b36528c18ca0b8e2cd561183097869150861444dd3db7efeabed8f3185ec2f35a7efcec8df2e12559a60a1", @ANYRES64=0x0], 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r12, r13, 0x5}, 0x10) r14 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r14, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) bind$packet(r11, &(0x7f0000000040)={0x11, 0x0, r15, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route(r3, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="340000006a00000228bd7000fedbdf25000000000000000008000500", @ANYRES32=r6, @ANYBLOB="08000500", @ANYRES32=r7, @ANYBLOB="04000b0008000500", @ANYRES32=r15, @ANYBLOB="892cd0ffc2a52fa064de309dcc2b0498f039e0ef34f46af82c3bb099c1faec430f9127a8608d15f4e19b8713251edd9f3a967899624090521b6be9d926b1336643aef16f421016fc4271ef8ca56ccdd13055"], 0x34}, 0x1, 0x0, 0x0, 0x24000800}, 0x4004080) 1.111874179s ago: executing program 1 (id=3016): sendmsg$key(0xffffffffffffffff, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRESHEX, @ANYRESOCT], 0xb0}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) (async) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @none, 0x7, 0x2}, 0xe) setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000001300)={0x2, 0x9}, 0x2) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) openat$cgroup(r0, &(0x7f0000000300)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000340)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) (async) r3 = openat$cgroup_ro(r0, &(0x7f0000000340)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) close(r3) (async) close(r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x26e1, 0x0) close(r4) (async) close(r4) getsockopt$inet_pktinfo(r4, 0x11a, 0x8, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9f03000000009d2c00000000100000001000000002000000000000000000000100000000640000040000"], 0x0, 0x2a, 0x0, 0x1}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9f03000000009d2c00000000100000001000000002000000000000000000000100000000640000040000"], 0x0, 0x2a, 0x0, 0x1}, 0x28) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0xff05, 0x0) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x3, &(0x7f0000000240)=0x629, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$l2tp6(0xa, 0x2, 0x73) connect$pppl2tp(r7, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, r9, 0x0, 0x800, 0x4, 0x0, {0xa, 0x4e22, 0xab6a, @loopback}}}, 0x32) ioctl$EXT4_IOC_CHECKPOINT(r8, 0x4004662b, &(0x7f0000000000)=0x3) ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) 1.048887818s ago: executing program 4 (id=3017): socket$nl_xfrm(0x10, 0x3, 0x6) 1.010953547s ago: executing program 3 (id=3018): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)={0x28, r1, 0x5, 0x0, 0x1000000, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xd3}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x40, 0x10, 0x49920d862a921d1b, 0x0, 0x25dfdbff, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}, @IFLA_MTU={0x8, 0x4, 0xfff}]}, 0x40}}, 0x0) 966.164036ms ago: executing program 2 (id=3019): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 64) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001c00110c0000001400000f0007000000", @ANYRES32=r6, @ANYBLOB="800202000a0002"], 0x48}}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) r11 = syz_open_procfs$namespace(r8, &(0x7f0000001780)='ns/ipc\x00') (async, rerun: 64) r12 = getpid() (rerun: 64) sendmmsg$unix(r7, &(0x7f0000001b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r8, 0x0, 0xee00}}}], 0x20, 0x4044014}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c, 0x1, 0x2, {r8, 0x0, r10}}}, @cred={{0x1c, 0x1, 0x2, {r12, r9}}}, @rights={{0x18, 0x1, 0x1, [r11, 0xffffffffffffffff]}}], 0x58, 0x800}}], 0x2, 0x0) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000300)={{{@in=@multicast2, @in=@multicast1, 0x4e23, 0x80, 0x4e22, 0x0, 0xa, 0x80, 0x80, 0x8b, r6, r9}, {0x200, 0x401, 0xbc2, 0x9, 0x0, 0x5, 0x3, 0x5}, {0x0, 0x800, 0x9, 0x81}, 0x2, 0x0, 0x1, 0x0, 0x2, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d4, 0x5f}, 0x2, @in=@private=0xa010101, 0x3504, 0x3, 0x1, 0x7, 0x4, 0xfff, 0x10001}}, 0xe8) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01007de74a00"/18, @ANYRES32=r3, @ANYBLOB="080026007f17000008009f0007000000"], 0x2c}, 0x1, 0x0, 0x0, 0xd37697ff280d3c0e}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x8c, r1, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @random="394b83f5aeb2"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="a8eeb6cf4364"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="98c76e2139da"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @random="f7c2cbcea2ab"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="f8800b4a26cc"}]}, 0x8c}, 0x1, 0x0, 0x0, 0xd}, 0x4000811) (async, rerun: 32) r13 = socket$alg(0x26, 0x5, 0x0) (rerun: 32) bind$alg(r13, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r14 = accept4(r13, 0x0, 0x0, 0x0) sendmsg$kcm(r14, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) r15 = socket(0x1, 0x2, 0x0) (async, rerun: 64) r16 = socket$kcm(0x2, 0x5, 0x84) (rerun: 64) setsockopt$sock_attach_bpf(r16, 0x84, 0x17, &(0x7f0000000000), 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r15, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, @dev, @dev}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r15, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r17, 0x0, 0xff, 0x0, 0x7, 0x0, @dev, @private0, 0x0, 0x1, 0xfffffffe}}) 923.714017ms ago: executing program 1 (id=3020): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r1) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000580)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000eeff120000000a0004007778616e3300000008001500", @ANYRES32, @ANYBLOB="080001"], 0x30}}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x11, @broadcast, 0x4e20, 0x3, 'none\x00', 0x11, 0x3}, 0x2c) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000180)=0x68) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c00000004001b7500"/20, @ANYRES32=r3, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg(r0, &(0x7f0000000c80)={&(0x7f0000000280)=@ieee802154={0x24, @short={0x2, 0x3, 0xaaa2}}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000200)="c3d2b91af777776dfbecd54c873c962fb90daae7a5aae08361a6f065", 0x1c}, {&(0x7f0000000340)="c9458c71dfb9eaf4b4d2f7018617ec59669292dc06b0e4b29cc66beb38f420e5e437e419ecd27fcad91ffbc048e715b38a0f33ffd947d51ec47f76b1ef2efcaf5286473329f8135817c7174413bc81b85bb1d7ab72951863de715881e4ea94a0c3c453fdf012d84ef15e20ecc61ce2664a2d5cee856d2b7b60999820c2b1e8467384f7657c055fbdc8e3afa8dcc307218fa0d00090c031940ac42d14765a37520d2ae5fa4770baf28d3a5b710ffd502f3482", 0xb2}], 0x2, &(0x7f00000005c0)=[{0xf8, 0x102, 0x1, "20531c4053c4204e585f9c38a883c267ee14518d9d5b225f364b4240939d0245a8f1426327825b12c1046ae47353702e8060db4c6ce372364f87050333ad90d60ae23645df0acb67cbffafd1e228450cf1e39c248ed49f2f538e2b17c234d10f449aa9b25c66226175bb9b3fab957f4780c4cc8c5ac6626a8e4c23a0075bb02025dce059cc7cbab0d144f98197624d456bb6d8da0a6d8d02dd345af9ea6c03754a9437c6c5225b1d2ae482cdb6af55414f3c9ab5676eb6aaf77d55de5bec1e176d7d5fc43785bd6a7d53c98fd2fda328114873f3956717168ee758168e9ee4d93b41f2b1ba"}, {0xc8, 0x103, 0x4, "3c584c29f6fcd5f2fa3934074d27727c95c095195ebfca381d876bc4c27943cb0d9ad94c1cc3970cf21b99851879a30eaeda885e61427ed74a198bfa7b1dde257d075c852df7be97eefaece5c8bb25b25d1f55fa301275a42f82d2aea84030c147f6c55cebcdd033bfe5144cf477550c9da0a80b7f75cbdb2ffb8f93032fadabbde47af21284a3d23cbc37f14cc1fcefba64449786a7513ed9d78a38f8ec8e984650deea8b4172279b3433ebeae61bbeff0eb0434ab9c357"}, {0xe0, 0x0, 0xbdb8, "76060db9f1506d06abd03b258620b4a23aee8083167816264301d2a27db05f9e7e5bdc2efcc97a7e00fa537b9890a71c8e7b702d56ff9c294b209d35ed199e244f34ca7bb89bda022eb559ff1d9f27e70fae41eb9854f4144454e3e0eef207e32df5b47d2103e4852a2b12811ed1b199c8f7cabaff482ef43dab2f3d7b595ff103b06c54deb90ff27816778b31417f746878897b354756d7b976e191a170617093c4f9cf7b8501b5bb15e29b1305afafed1e8c1f814df57839bcfbb2f235a9da972b127a3ed026a132f354af27"}, {0x78, 0x115, 0x4, "a0312a6f1b3f91036a1a888d61dc8e6ba57d64a2288623ca950cd9f29ae304ce122c28b0e3abd5d11e58f2ab10e2c6ee8f51109df78590827aefd87cc95530fb0285f35100f2137b7b04a47ccda6b77f72d66327ae82d77ddc582e2d21277e61dccb46650a"}, {0x20, 0x88, 0x86, "2dc06a326cb4dfc07f"}, {0x18, 0x108, 0x9, "969ad307"}, {0x48, 0x107, 0x5, "5cc2603fb22a8da097720846b0d5e229533d5bf5126619b0de85b21315d7cdd917e670302d147b58a0f7afadfcfc30abb56fc4"}, {0xe0, 0x118, 0x6, "534f3677abff302ba9b14c64943eff4480c9afbce72fc847bcdf3a25a59ac79886e7968311547728b2e1459d75b9ee05c6affab03454d5d82ccdb08125efd78a528e49c5166fa3780f490a5f0f85ce9b67c55b688472f19ac8ccbf07e7d87c231ecac858ef2b4a9dfa88ee3aa4e5f69c3b0ef518ea9814254d2c94b3bba1f1f8f14057959778bbcdb9de7b07069ea30e0a1db405990d18ef03f463600c11657d9bcb55164d9d2b5d6c2b4608d1e3d0ea628a9c4858808255c78d2750fe6b8bfe5a93958bb64f754184"}, {0x110, 0x107, 0x1, "40119f51a8e87dc66fd2c02fd6dd7cced5eb9c2ef495210cdbb1b03f22ed774cd489cf5164b0231baf4b88fe2be505b48c64dc0f4c03a94e4a117797b31d372f256ab2e35d205e2e6d6779c32a70924ace8d99c8903e879a396dd38f0544b52511dd70457ad81f36235684ac661b3e3a2cf2b4c93d51b548e5c87cc691003320eb3577e0363c081986e5103a8ab149606e6d3422deb954eb4155dc50b5df197cba8d9906e2c90c022c0aca87288f8fbd1cf6042ef3dbe26dbccf20412322615b97269be3d555473f589571442172ad453b2963a225c9f68e4764da2392a54cae00eb1fbc8450173c29cebf7321fb008122d8dafb712d43577c81fa6d11f1"}, {0x100, 0x0, 0x1, "e373b7ca745609b481178e7ba9d7159eeeed339dfb1c4286224785b1d885eec6942b9ab96ce358a9b9886890d1d110d218359e12579bea9b4f606b72ad06a96890c1c158ca0fe0976fd8943f84f59366751e3d5cec7dadee3fe0f3b3796fc439ad4e45a1681c2a25563ef1eb9e1acfcee41f53b5571b8a02ef552f09319f0372cb6838451ae037abcbeb65a289e8896cadc5e455bb546005489e367bdebef47a91db1d75d79d759d8d0e04c1b9c40ea977e6f8d04ed88a40f171cbdd5bc08b6392aba6ab93b26c267206c914f21e60a74ede630dabe7ce15caad1afe6bf188fd761fe1fd425d6ea49e2b36bd"}], 0x688}, 0x4000010) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$IP_VS_SO_SET_EDIT(r5, 0x0, 0x483, &(0x7f00000001c0)={0x5e, @dev={0xac, 0x14, 0x14, 0xa}, 0x4e21, 0x2, 'sed\x00', 0x3d, 0x0, 0x73}, 0x2c) 850.099574ms ago: executing program 3 (id=3021): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000200)={0x0, 0x1, 0x6, @link_local}, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r1) sendmsg$nl_route_sched(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000002500)=@newtaction={0x1058, 0x30, 0xe1f, 0x70bd2d, 0x25dfdbfc, {}, [{0x1044, 0x1, [@m_police={0x1040, 0x9, 0x0, 0x0, {{0xb}, {0x1014, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0xad7, 0x5, 0xd3, 0x5, 0x8001, 0xb, 0x1, 0x2, 0x3ff, 0xa, 0x8, 0x100, 0x4, 0x6f89f017, 0x2, 0xf, 0x4, 0x8, 0x3, 0x7f, 0x0, 0x7f, 0xab6, 0x396, 0xb, 0x0, 0x800, 0x9, 0x0, 0xe, 0x5, 0x2, 0x1, 0xa, 0x6, 0x6, 0x0, 0x9, 0x9, 0x5, 0x3, 0x2, 0x9, 0x8, 0x7, 0x401, 0x5, 0xfffffffe, 0x952, 0x7, 0x100, 0xbb9, 0x2, 0x9, 0xfffffffc, 0x8db1, 0x5, 0x401, 0xf6, 0x7fff, 0x4, 0x8795, 0x7, 0x5, 0x5e9, 0xe44, 0x0, 0x1000800, 0xc11, 0x55, 0xc15, 0xfffffffc, 0x8000, 0x6, 0xb, 0xfffffff7, 0x0, 0x100, 0x0, 0xab86, 0x9, 0x100, 0x3, 0x99, 0xb3, 0x74, 0x5, 0x8, 0x7ff, 0x2, 0x2, 0x4, 0x200, 0x3, 0x4, 0xffffffff, 0x8, 0x37, 0x46d2e732, 0x3, 0x8, 0x3, 0x8, 0x8001, 0x2, 0xffffffff, 0x10001, 0x1, 0x6, 0x6, 0xa, 0x9, 0xd43b, 0x7f, 0x4, 0x800, 0x80000000, 0x8, 0x2, 0x8, 0xffffffff, 0x8, 0xfffffffb, 0x5, 0x55ec, 0x4, 0x3, 0xffffffff, 0xffff, 0xb3d, 0x40, 0x7, 0x80000001, 0x2, 0x400, 0x7, 0xfffffffc, 0xff, 0x200, 0xf90, 0x10000, 0xfff, 0x32, 0x8, 0x3, 0x1, 0x1, 0x2, 0xd8, 0x3, 0x1, 0x3, 0x1, 0x5, 0x9, 0x3, 0x2, 0x9, 0x7, 0x4, 0x8, 0xf, 0x5, 0x1, 0x4, 0x6, 0x23f8, 0x9, 0x1, 0x80000000, 0xe0e8, 0x7ff, 0x0, 0x3, 0x8000, 0x21, 0x5, 0xc7fb, 0x3, 0xfffffffb, 0x7, 0xfffffc00, 0x8, 0x9, 0x2, 0x0, 0x79b33bbe, 0x4, 0xd20, 0xb, 0x6, 0x8, 0x0, 0x5, 0x1, 0x49b, 0x0, 0x1, 0x100000, 0x3, 0xffff, 0x8001, 0x10000, 0x3, 0xab, 0xc, 0x9, 0x4, 0x3, 0xc, 0x7f, 0x2, 0x6, 0x2, 0xfffffffe, 0x8, 0x9, 0x7ed00b2a, 0x8000, 0x2, 0x1, 0xb, 0x2be8, 0x6, 0x8, 0x4, 0x5, 0x1, 0x7f, 0x3, 0x9, 0xffffffff, 0x10, 0x1, 0xfffffff9, 0xe6, 0x5, 0x0, 0x100, 0x7, 0x3, 0x1, 0x8, 0x2, 0x292c, 0x5, 0x8, 0x81, 0xf, 0x7, 0x5, 0x8, 0xb, 0x4, 0x7fffffff, 0x8]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x80000001, 0x1000, 0x9, 0x7, 0x101, 0x7, 0x3, 0x1, 0xfffffbff, 0x1, 0x4, 0x6, 0x80000001, 0x2, 0xe, 0x7, 0x2, 0x7fffffff, 0x5, 0x7c9, 0x3c1c, 0xfffffffd, 0x3, 0x10001, 0x5, 0x4, 0x62, 0x4, 0x0, 0x2, 0x9, 0x8, 0x5ca9, 0x6, 0x7, 0x4, 0xbc, 0x10, 0xa9, 0x9, 0x2, 0xffff, 0x7, 0x9, 0x200, 0x0, 0xb, 0x2, 0xe30a, 0x5, 0x3, 0x3, 0x20000, 0x7f, 0x8, 0xe, 0x2, 0xe8c, 0x1, 0xef8, 0x6, 0x1, 0x0, 0x3, 0x2, 0x3, 0x1, 0xc2, 0x0, 0xffff, 0x1, 0xc8, 0x400, 0x34, 0x5, 0x800, 0x8, 0x9, 0x3ff, 0xfff, 0x6, 0xfffffff7, 0x8, 0x7f, 0x6, 0x4, 0xf, 0x5, 0xe3, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x6, 0x81, 0x3, 0x401, 0x9, 0xff, 0xa5fe, 0x8, 0x1, 0x31e, 0x53a, 0x7, 0x0, 0x81, 0x0, 0xfffffffe, 0x8, 0x1, 0x2a55, 0x4f7e, 0x3, 0x2, 0x4, 0x3, 0x7, 0xfffffff7, 0x3, 0x7, 0x6, 0xfffffffb, 0xce, 0x6, 0x3, 0xdfe, 0x2, 0xf99d, 0x9c, 0x8000, 0x0, 0x8, 0x4ea, 0x9, 0x7f, 0x8, 0x0, 0x101, 0x4, 0x1, 0x7, 0xb9b0, 0x0, 0x1, 0xc2, 0x3, 0x4, 0xfffff001, 0x40, 0x2, 0x1, 0x8, 0xefa6, 0xffffffff, 0x8, 0x23c, 0x395f, 0x2, 0xd1, 0x2, 0x0, 0x2, 0x6, 0x2, 0x2, 0x699e, 0x3, 0xc, 0x5, 0x400, 0x400, 0x1f32, 0x2dd, 0xf8, 0x2, 0xe, 0x200, 0xa77, 0x8, 0x0, 0x7, 0x6, 0xf, 0x7fff, 0x1, 0x101, 0x2, 0x7, 0x1, 0x7, 0x6, 0x768b7023, 0x2, 0x950, 0x8, 0x9, 0xd, 0x748, 0x269, 0x1ff, 0x9, 0xf22, 0x101, 0x8, 0x808, 0x31d, 0x8000, 0xbc4, 0x1, 0x8, 0x8, 0x1, 0x2, 0x1, 0x5, 0x5, 0x6, 0x2, 0x100, 0x3548feeb, 0x3, 0x4, 0x5, 0xd32, 0x3, 0xc, 0x9, 0x1, 0x0, 0xfffffffe, 0x4, 0x7fff, 0x7, 0x7, 0x929a, 0x317, 0x9, 0xbe18, 0x2, 0x4, 0x9, 0x1c2d00, 0x4, 0xfffffffe, 0x2, 0x2, 0x0, 0x400, 0x6b, 0x70, 0x8, 0x7fff]}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x8001, 0xfffffffe, 0x1, 0x401, 0x5, 0x3, 0x40, 0x8, 0x6, 0x500, 0x3, 0x7, 0x5, 0x9, 0x6, 0x6, 0xc92, 0x9, 0x0, 0xff, 0xfffffff0, 0xe, 0xa, 0x9, 0x7, 0x9, 0x1, 0x1, 0x1, 0xffff339f, 0xffffffff, 0x3a, 0x6, 0x7, 0x1, 0xe, 0x1ff, 0x80000000, 0x6, 0x5, 0x7, 0x1, 0x4, 0xffffffff, 0x8, 0x200, 0x3, 0x6, 0x7, 0x800, 0x4, 0xf158, 0x80000001, 0x7, 0x7d, 0x4, 0xb8a6, 0x0, 0x8, 0xfe3a, 0x4, 0x5, 0x101, 0x3ff, 0x4, 0xc, 0x3, 0x1, 0x7, 0x792, 0x80000000, 0x3ff, 0x5, 0x5, 0x6, 0x4, 0x2, 0xa, 0x8, 0x7, 0x0, 0x9, 0x5, 0x0, 0x100, 0x5, 0x1000, 0x0, 0xfffffffa, 0x80000000, 0x3, 0x7, 0xf, 0xff, 0x0, 0x80000001, 0xa, 0x2, 0x8, 0x6, 0x1c02, 0x9, 0x1000, 0x6, 0x0, 0x8, 0x5, 0x3, 0xffff739f, 0x0, 0x8001, 0x5, 0xf, 0xfffffffb, 0x5, 0xc, 0x1, 0x7f, 0x9, 0x0, 0xfff, 0x1000, 0x1, 0xffff0000, 0x4, 0x0, 0x2, 0x5, 0xa60, 0x800, 0x10000, 0x5, 0x3, 0x6, 0xaf3, 0x7, 0x3, 0x7ff, 0x4, 0x6c, 0x4, 0x8, 0xfff, 0x0, 0x5, 0x7fffffff, 0x200, 0xfffffff2, 0x1, 0x101, 0x4, 0x0, 0x4, 0x8, 0x9, 0x7, 0x3, 0x5, 0x4, 0x5, 0x9, 0x800, 0x401, 0x90, 0xed1, 0xa, 0x6, 0x1000007, 0x8, 0x3, 0x3, 0x4, 0x1, 0x3, 0x6, 0x4, 0x240, 0x99, 0x0, 0xbdd, 0x8, 0x7ff, 0x9, 0x3be, 0x1, 0x5, 0x5, 0x28000, 0xffffffff, 0x9, 0x7f, 0x4, 0x5, 0x7a, 0x7, 0x401, 0x0, 0x400, 0x8ce, 0x2, 0x0, 0xfff, 0x8, 0x4, 0x6, 0x0, 0x3, 0x6, 0x2, 0xfffffff8, 0x2, 0x1, 0x3, 0x10, 0x8000, 0x0, 0x100, 0x3, 0x8000, 0x5, 0x4, 0x8, 0x7, 0x9, 0x400000, 0x7ff, 0x200, 0x6, 0xeaf5, 0x2, 0x5, 0x410, 0x3ff, 0xf7, 0x7, 0x928b, 0x9, 0xa45, 0x3, 0x2, 0x7, 0x100, 0x10001, 0x8, 0x200, 0x0, 0x7, 0x0, 0x7e9, 0x87bf, 0xc00, 0xffffffff, 0x3, 0x5, 0xfffffffb]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x8000, 0x0, 0x5, 0x60000, 0xa, 0x6, 0x1, 0x8000, 0xfff, 0x2, 0x1, 0x7ff, 0x6, 0x1, 0x1, 0x7, 0x3, 0xee, 0x0, 0x2fe1, 0x12, 0x7, 0x6db9f0d9, 0x0, 0x0, 0x80, 0xffffff01, 0x6, 0x10000, 0x2, 0x7, 0x0, 0x400, 0x3, 0x101, 0x200, 0x6, 0x7fff, 0x2, 0x5, 0x3, 0x3, 0x200, 0x6, 0x2, 0x1, 0x4, 0x81, 0x2, 0x802, 0x1, 0x7, 0x6, 0x7, 0x2, 0xfffffffd, 0x3, 0x9, 0xfffffff8, 0x1, 0x0, 0x2, 0x8001, 0xd1000000, 0x6, 0x5, 0x7, 0x3, 0xffffffff, 0xa, 0x8, 0x10001, 0x10000, 0x4, 0x1, 0x6, 0xffff, 0x3c, 0x3, 0xfe23b666, 0x401, 0x6, 0x8, 0x401, 0x5, 0xe5dc, 0xb, 0x80000000, 0x1, 0xdb, 0x5, 0x9, 0x6, 0x1ff, 0x200, 0x5, 0x0, 0x8, 0x10001, 0x0, 0x8, 0x41cef381, 0xb2ee, 0x4, 0xfa4, 0xd, 0x7, 0x12000000, 0x1, 0x3, 0xe, 0x9, 0x8000, 0x401, 0x40, 0x4, 0x4, 0x993, 0xe8000000, 0xf8, 0x8, 0x625dd73, 0x9, 0x5, 0x8000000, 0xff, 0x4e, 0x3, 0x0, 0x0, 0x4, 0x1, 0x8, 0x3ff, 0x8, 0x5, 0x5, 0x3, 0xf261, 0x6, 0x0, 0x7a6, 0x2, 0x414, 0x10000, 0x5, 0x81, 0x7, 0xfffff800, 0x8d, 0x20000, 0x4, 0x6, 0x6, 0x50043af7, 0x5, 0x7fff, 0x10001, 0x9, 0x80, 0x0, 0x8, 0xba0, 0xfffffffd, 0x5, 0xe, 0x1, 0xffffffff, 0x6, 0x5, 0x4, 0x9, 0x80, 0x0, 0xf70, 0x1, 0x8, 0x9, 0x6, 0x10000, 0xf, 0x8, 0x5dd, 0x3, 0xcf6, 0x2, 0x4, 0x9, 0x44, 0x6, 0x1, 0x8000, 0x7f, 0x6, 0x7, 0x9a3d, 0x7, 0x8, 0x3, 0x8, 0x8, 0x3, 0x80, 0x10000, 0x3, 0x7fff, 0x81, 0x81, 0x1ff, 0x5, 0x7fff, 0x0, 0x9, 0x6, 0x101, 0x6e87, 0x9, 0xfffffa7f, 0x4, 0xfffffffa, 0x3, 0x3, 0x7, 0x6, 0x1ee8, 0x8b, 0x8, 0xec85, 0x0, 0x9, 0x3, 0xe22, 0x8, 0x7, 0x1, 0x800, 0x6, 0x6, 0x6, 0xfffffffd, 0xb, 0x8, 0xfffff56e, 0x3c, 0x5, 0x9, 0x7, 0x1, 0x7f, 0x9, 0x80000001, 0x4, 0x10001, 0x7, 0x2, 0x2267]}]]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x1058}, 0x1, 0x0, 0x0, 0x40040}, 0x6048800) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x18, 0x2, [@TCA_RED_PARMS={0x14}]}}]}, 0x44}}, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSCOMPRESS(r3, 0x4010744d) 798.527992ms ago: executing program 4 (id=3022): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x1c, 0x3, 0x1, 0x201, 0x0, 0x0, {}, [@CTA_STATUS={0x8}]}, 0x1c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0xfffffffd, @empty, 0xffffffff}, 0x1c) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e22, @multicast2}, 0x10) (async) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="300000001a0001f40000ef000000000081040000000000000000000014000100"], 0x30}}, 0x0) 771.299438ms ago: executing program 0 (id=2931): r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000040), &(0x7f00000000c0)=0xc) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={0x50, r1, 0xe17, 0x0, 0x0, {0x1, 0x0, 0x6000}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @dev}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}]}, 0x50}}, 0x0) 711.257142ms ago: executing program 1 (id=3024): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000200), 0x12) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)={0x6, 0x4, 0x1a00}, 0x980) splice(r5, 0x0, r4, 0x0, 0x10000008ebc, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000000)={r4, &(0x7f0000000340)="bd977a4fd83b701c87f5171c56d6a9faa22e06685a1e7d56f0ca7f85e7ae3d2f87132e635d6308beda14c43612b4aefbde87fe71cf81dfefc8d68dcbaa8b22d4257505b642bcb7e97abb72cbec57292fef2a3fc8b256dab8c029df06ded31718d77038584cef21c4edf978bbfa9e4bae405745e49910dc8ce9c07484453c129624367032aed0e4488eafca7acae3422d358c156cd38051a79357b3e8d47e001794ddddc5da7622fdc9d8e55d301f1193397a7931c869cda88e430439738eb1804b1568e4c7f9", &(0x7f0000000440)=""/122}, 0x20) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x84, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x9}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x58, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa, [{0x200, 0x500, 0x3, 0xe}, {0x6783, 0x2, 0x8001, 0x10}, {0x40000, 0x53, 0xa9, 0x80000001}]}}, @TCA_U32_MARK={0x10, 0xa, {0x800, 0x8001}}]}}]}, 0x84}}, 0x20000000) 634.262104ms ago: executing program 4 (id=3025): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000380)={'wpan3\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)={0x48, r4, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_DEVKEY={0x2c, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x6}, @NL802154_DEVKEY_ATTR_ID={0x14, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xdb}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x80, r0, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x80}, 0x1, 0x0, 0x0, 0x10}, 0x801) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002cbd700000dcdf251800000008000300", @ANYRES32=r7, @ANYBLOB="2c00308009000400"], 0x48}}, 0x24004084) sendmsg$NL802154_CMD_SET_SHORT_ADDR(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r6, 0x105, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xaaa0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24008015}, 0x400c899) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r0, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x2, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4aef6a06}, [@call={0x85, 0x0, 0x0, 0x43}, @ldst={0x6, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f00000005c0)=""/147, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x61e5cc96, 0x0, 0xfffffffffffffc8d}, 0x4c) 601.746008ms ago: executing program 0 (id=3026): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@gettfilter={0x24, 0x2e, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0x2}, {0x0, 0x3}}}, 0x24}}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xffffffffffffff18, &(0x7f0000000100)=[{&(0x7f0000000000)="2f0000001c0005c5ffffff000d000000020000000b000000ec0091c913000180f0ffffeb", 0x1dd}], 0x1}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120c000200040001400400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) r3 = socket(0x10, 0x80002, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c00071bab0925000900070007ab08000c000000f0007e93210001c000000000000000000000000000039915fa2c1ec28670e9889bb94b46fe0000000a0002", 0xff82) sendmmsg$alg(r3, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100)}], 0x492492492492856, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x12, r2, 0xae083000) 424.272369ms ago: executing program 0 (id=3027): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x4081, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000000)=0x87f4, 0x4) recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40010042) 234.397396ms ago: executing program 0 (id=3028): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001a80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000002120000000090a030b0000000000000000050000070900010073797a3100000000540400000b0a05000000000000000000070000093400098008000140000000080800014000000009200002801c0001800800014000000600080001400000407708000140fffffff8080007400000001608030980e40002804400018008000140000000000800014000000007080001400000000108000140000006c40800014000007dfb08000140000001010800014000000001080001400000cb6e340001800800014000000002080001400000000208000140fffffc000800014000000800080001400000000408000140000000052c000180080001400000000808000140ffffffff08001840000000ff080001400000001008000140000000093c000180080001400c0000000800014000000002080001400000000408000140000004130800014000000009080001400000000c08000140000000013c0102801c000180080001400000057c080001400000000208000140800000000c00018008000140000000030c000180080001400000000344000180080001400000010d080001400000000008000140000000090800014000000fff080001400000000008100140000000060800014000007fff0800014000000006240001800800014000004ca708000140000061a908000140000000050800014000000a781400018008000140ffffffff0800014000000006440001800800014000010001080001400000000408000140800000010800014000000ac5080001400000000008000140fffff0000800014000000c3108000140000000804400018008000140000000030800014000003b4b08000140000000040800014000000005080001400000040008000140000000080800014000000005080001400000000908000140000000c5b400028014000180080001400021c20008000140000000054400018008000140ffffffff0800014003a66d57080001400000000508000140000008000800014000000006080001400000000308000140ffffff0b080001400100000034000180080001400000000408000140ffffffff0800014000000006080001400000000608000140000000010800014000000ea12400018008000140000001000800014000000009080001400c000000080001400000000808000140000005f00800014000000002100002800c0001800800014000000008080001400000ffff08000f4000000005080006400000000008000440000000030900010073797a3000000000090002"], 0x944}, 0x1, 0x0, 0x0, 0x50}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x405, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_INDEX={0x8}]}}}]}, 0x40}}, 0x0) 204.273349ms ago: executing program 4 (id=3029): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000010000895000000354f0000d578e9f076fe1083e55b8ad3a5c34e45db541359293d6874b8c20f89f0f7df7f2297b286d9954204d4403dd1664a00bf6666d0756f82e4f5ca28cd58714a47974ecd2e4bf01754920b6e7133400f6c47c7dc8d38e2dde689fe4146bcf469e20b3cbe031c1cdbaf9004dc7f8d31f06ae10075a58b3b5874b29f321d57b3ca363e"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newqdisc={0x68, 0x24, 0xe0b, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x38, 0x2, {{0x1ff, 0x6, 0xfffffffd, 0x0, 0xfffffffd, 0x32d}, [@TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0xfffff800, 0x8, 0x99f5, 0x2, 0x2}}]}]}}}]}, 0x68}}, 0x0) sendto$packet(r1, &(0x7f0000000580)="44c394f305916c4516999da20800", 0x36, 0x0, &(0x7f0000000440)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, 0x14) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000180000000000000", @ANYRES32, @ANYBLOB="00b9c0ba1f1000"/20, @ANYRES32=r4, @ANYRES32, @ANYBLOB="04000000050000000500"/28], 0x50) 133.498207ms ago: executing program 3 (id=3030): getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000100)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000000)=0x100) (async, rerun: 64) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) (async, rerun: 64) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) (async) mkdirat$cgroup(r0, &(0x7f00000000c0)='syz1\x00', 0x1ff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@local, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast1, 0x4d4, 0x6c}, @in6=@empty, {0x0, 0x192, 0x6, 0xffff, 0x28251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffd}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newnexthop={0x20, 0x68, 0x1, 0x0, 0x0, {0x2}, [@NHA_OIF={0x8, 0x5, r4}]}, 0x20}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7c40280f}, @NFTA_HOOK_HOOKNUM={0x8}]}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0xb8}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x70bd27, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}}, 0x4000) r7 = socket(0x40000000015, 0x5, 0x0) bind$inet(r7, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={0xffffffffffffffff, r4, 0x25, 0x5, @void}, 0x10) (async, rerun: 64) r8 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000068ffff0000000000000000000a00000000000000040004000800010001000000"], 0x24}}, 0x0) (async) socket$inet(0x2, 0x3, 0x9) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="58000000020601040000000000000000000000000c00078008001140000000000500010006000000000000000900090073797a30ee5052d51610160000000013000300686173683a6e65742c696661636500000000000000000000000000004c63d39010825562419a3bccdd2fadf00f6d2fc6a652d9618c1454df6a7603efbe7accbbde712a364a30cc92f5"], 0x58}}, 0x0) sendfile(r1, r1, 0x0, 0x9) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_mreqsrc(r10, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0xc) 6.259997ms ago: executing program 0 (id=3031): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x4, &(0x7f00000002c0)=@framed={{}, [@generic={0x40}]}, &(0x7f0000000300)='syzkaller\x00', 0x9, 0xd0, &(0x7f0000000340)=""/208}, 0x90) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000700000aa0000000060a0b0400000000000200000200000074000480700001800a0001006d617463680000006000028008000240000000000c0001007068797364657600460003007e6b92c43235dc7e977221f83c3f179e65022fc067b787cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470580800000900010073797a30000000000900020073797a32"], 0xc8}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) (async) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r5, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r4], 0x38}}, 0x10) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'ip6_vti0\x00', 0x0}) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e22, @private=0xa010101}], 0x10) (async) r8 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000bc0)=0xc) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, 0x4f, 0x1, 0x0, 0x25dfdbff, {}, [@typed={0x8, 0x51, 0x0, 0x0, @uid=r9}]}, 0x1c}}, 0x0) (async) setsockopt$inet6_IPV6_IPSEC_POLICY(r8, 0x29, 0x22, &(0x7f0000000000)={{{@in=@private=0xa010100, @in=@dev={0xac, 0x14, 0x14, 0x28}, 0x4e24, 0x8, 0x4e20, 0x1, 0x2, 0xa0, 0x80, 0x67, r6, r9}, {0x1dc7, 0x0, 0x9711, 0x8, 0x2, 0x80, 0xd, 0x40}, {0x0, 0x8, 0x4, 0x7}, 0x7, 0x6e6bbe, 0x2, 0x0, 0x3, 0x2}, {{@in=@multicast2, 0x4d6, 0x50}, 0x8, @in6=@empty, 0x3504, 0x0, 0x3, 0x5, 0x4, 0x11, 0x1}}, 0xe8) (async) r10 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'geneve1\x00', 0x0}) sendto$packet(r10, &(0x7f00000002c0)="05031600d3fc140000004788031c", 0xe, 0x4081, &(0x7f0000000140)={0x11, 0x17, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r1, @ANYBLOB="01060000000000000000090000002c0004801300010062726f6164636173742d6c696e6b00001400078008000600"], 0xac}}, 0x0) (async) syz_emit_ethernet(0x66, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaa159447a89809c81add60cb653e00303a000000ffffffff00000000ffffac1414bbff0200000000000000000000000000eb900090780000000060256b5400000000ff0100"/102], 0x0) 0s ago: executing program 4 (id=3032): syz_init_net_socket$ax25(0x27, 0x3, 0xc3) kernel console output (not intermixed with test programs): etlink: 16 bytes leftover after parsing attributes in process `syz.0.986'. [ 159.514452][ T9362] 0 pages cma reserved [ 159.520237][ T9409] netlink: 16 bytes leftover after parsing attributes in process `syz.0.986'. [ 159.530562][ T9431] netlink: 24 bytes leftover after parsing attributes in process `syz.4.991'. [ 159.550242][ T9409] netlink: 16 bytes leftover after parsing attributes in process `syz.0.986'. [ 159.608662][ T9409] netlink: 16 bytes leftover after parsing attributes in process `syz.0.986'. [ 159.648025][ T9409] netlink: 16 bytes leftover after parsing attributes in process `syz.0.986'. [ 162.466657][ T9494] ieee802154 phy0 wpan0: encryption failed: -22 [ 162.734694][ T9511] veth0_virt_wifi: Caught tx_queue_len zero misconfig [ 163.151452][ T9526] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 163.185210][ T9526] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 163.398176][ T9547] openvswitch: netlink: EtherType 53b is less than min 600 [ 163.646675][ T9561] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 164.011075][ T9572] macvtap1: entered promiscuous mode [ 164.021226][ T9572] vlan0: entered promiscuous mode [ 164.028120][ T9572] macvtap1: entered allmulticast mode [ 164.034172][ T9572] vlan0: entered allmulticast mode [ 164.039322][ T9572] veth0_vlan: entered allmulticast mode [ 164.375558][ T9602] bond0: (slave bridge0): Releasing backup interface [ 164.396287][ T9602] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.458751][ T9602] bridge_slave_0: left allmulticast mode [ 164.465017][ T9602] bridge_slave_0: left promiscuous mode [ 164.473043][ T9602] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.488826][ T9602] bridge_slave_1: left promiscuous mode [ 164.500558][ T9602] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.541783][ T9602] bond0: (slave bond_slave_0): Releasing backup interface [ 164.559592][ T9602] bond0: (slave bond_slave_1): Releasing backup interface [ 164.572574][ T9616] __nla_validate_parse: 17 callbacks suppressed [ 164.572592][ T9616] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1043'. [ 164.591471][ T9602] team0: Failed to send options change via netlink (err -105) [ 164.602541][ T9602] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 164.624109][ T9602] team0: Port device team_slave_0 removed [ 164.645678][ T9619] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1044'. [ 164.742757][ T9602] team0: Failed to send options change via netlink (err -105) [ 164.750824][ T9602] team0: Failed to send port change of device team_slave_1 via netlink (err -105) [ 164.771018][ T9602] team0: Port device team_slave_1 removed [ 164.784967][ T9602] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 164.805942][ T9602] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 164.841854][ T9602] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 164.850691][ T9602] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 164.862801][ T9602] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 164.946131][ T9607] 8021q: adding VLAN 0 to HW filter on device bond4 [ 165.148236][ T9635] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 165.347550][ T9645] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1055'. [ 165.417476][ T9648] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 165.631290][ T9661] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1060'. [ 165.648102][ T9665] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 165.677720][ T9661] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1060'. [ 165.943068][ T9685] netlink: 'syz.3.1069': attribute type 1 has an invalid length. [ 165.986198][ T9685] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1069'. [ 166.087776][ T9694] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1071'. [ 166.124273][ T9694] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1071'. [ 166.269743][ T9700] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1073'. [ 166.649559][ T9725] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1081'. [ 166.725738][ T9729] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20001 [ 167.093149][ T9763] syzkaller1: entered promiscuous mode [ 167.098905][ T9763] syzkaller1: entered allmulticast mode [ 167.567081][ T9733] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 167.893724][ T9797] IPVS: set_ctl: invalid protocol: 43 224.0.0.2:0 [ 167.912254][ T9805] IPVS: set_ctl: invalid protocol: 43 224.0.0.2:0 [ 167.942986][ T9797] netlink: 'syz.0.1105': attribute type 6 has an invalid length. [ 168.003024][ T9805] netlink: 'syz.0.1105': attribute type 5 has an invalid length. [ 168.088167][ T9812] netlink: 'syz.1.1106': attribute type 7 has an invalid length. [ 168.096045][ T9812] netlink: 'syz.1.1106': attribute type 8 has an invalid length. [ 168.675075][ T9848] bond5 (unregistering): Released all slaves [ 168.780987][ T9846] syzkaller0: entered promiscuous mode [ 168.786832][ T9846] syzkaller0: entered allmulticast mode [ 168.795819][ T5842] Bluetooth: hci0: command 0x0c1a tx timeout [ 169.168781][ T30] audit: type=1107 audit(1761816665.798:6): pid=9855 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='I YP.9|qg[qE."FJ%j=' [ 170.173530][ T9854] tipc: Started in network mode [ 170.178528][ T9854] tipc: Node identity dec1d703faa, cluster identity 4711 [ 170.187336][ T9854] tipc: Enabled bearer , priority 0 [ 170.208714][ T12] tipc: Resetting bearer [ 170.275710][ T9845] tipc: Resetting bearer [ 170.301233][ T9845] tipc: Disabling bearer [ 170.318489][ T9895] __nla_validate_parse: 5 callbacks suppressed [ 170.318504][ T9895] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1128'. [ 170.405798][ T9896] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 170.680547][ T9912] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1135'. [ 170.694436][ T9913] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1134'. [ 170.733185][ T9917] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 170.926878][ T9927] 8021q: adding VLAN 0 to HW filter on device bond5 [ 171.018759][ T9941] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1143'. [ 171.166488][ T9935] syzkaller0: entered promiscuous mode [ 171.172092][ T9935] syzkaller0: entered allmulticast mode [ 193.605322][ T9962] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1149'. [ 193.686668][ T9974] openvswitch: netlink: Message has 592 unknown bytes. [ 193.712650][ T9974] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 193.715791][ T9982] netlink: 84 bytes leftover after parsing attributes in process `syz.4.1155'. [ 193.781871][ T9974] syzkaller0: entered promiscuous mode [ 193.796946][ T9974] syzkaller0: entered allmulticast mode [ 193.861428][ T9985] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1156'. [ 193.882600][ T9988] xt_connbytes: Forcing CT accounting to be enabled [ 193.919920][ T9985] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1156'. [ 193.967705][ T1326] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 193.987056][ T1326] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.045836][T10005] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1161'. [ 194.046515][ T1326] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.101110][ T1326] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.155007][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 194.163486][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 194.466230][ T5941] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 194.475329][T10032] syzkaller1: entered promiscuous mode [ 194.480812][T10032] syzkaller1: entered allmulticast mode [ 194.691322][T10047] openvswitch: netlink: Flow actions attr not present in new flow. [ 194.801984][T10054] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1174'. [ 194.812609][T10054] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1174'. [ 195.357539][T10075] dvmrp0: entered allmulticast mode [ 195.366642][T10074] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1180'. [ 195.424487][T10079] netlink: 'syz.2.1181': attribute type 1 has an invalid length. [ 195.453558][T10079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1181'. [ 195.484280][T10088] openvswitch: netlink: Flow actions attr not present in new flow. [ 195.504070][ T5941] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 195.520887][T10083] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1180'. [ 195.536847][T10075] dvmrp0: left allmulticast mode [ 195.860182][T10103] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 195.862471][T10109] sctp: [Deprecated]: syz.0.1191 (pid 10109) Use of struct sctp_assoc_value in delayed_ack socket option. [ 195.862471][T10109] Use struct sctp_sack_info instead [ 196.056901][T10116] netlink: 'syz.4.1194': attribute type 11 has an invalid length. [ 196.107153][T10122] openvswitch: netlink: Flow actions attr not present in new flow. [ 196.224801][ T5837] Bluetooth: hci3: command 0x0406 tx timeout [ 196.226936][ T5843] Bluetooth: hci2: command 0x0406 tx timeout [ 196.230954][ T5837] Bluetooth: hci0: command 0x0c1a tx timeout [ 196.243968][ T5836] Bluetooth: hci1: command 0x0406 tx timeout [ 196.448022][T10140] netlink: 'syz.4.1200': attribute type 1 has an invalid length. [ 196.516701][T10140] bond3: entered promiscuous mode [ 196.522776][T10140] 8021q: adding VLAN 0 to HW filter on device bond3 [ 196.774322][T10162] syzkaller0: entered allmulticast mode [ 196.786774][T10167] syzkaller0: entered promiscuous mode [ 196.792383][T10167] syzkaller0: entered allmulticast mode [ 197.348861][T10177] ipt_REJECT: TCP_RESET invalid for non-tcp [ 198.131531][T10195] netlink: 'syz.2.1215': attribute type 2 has an invalid length. [ 198.168280][T10195] : entered promiscuous mode [ 198.191110][T10202] netlink: 'syz.0.1216': attribute type 21 has an invalid length. [ 198.474807][T10217] netlink: 'syz.0.1218': attribute type 2 has an invalid length. [ 198.770778][T10237] __nla_validate_parse: 14 callbacks suppressed [ 198.770796][T10237] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1227'. [ 198.806879][T10237] netem: invalid attributes len -24 [ 198.821881][T10237] netem: change failed [ 199.200828][T10265] xt_limit: Overflow, try lower: 604147548/4200216962 [ 199.374722][T10281] netlink: 'syz.2.1240': attribute type 11 has an invalid length. [ 199.416493][T10281] netlink: 'syz.2.1240': attribute type 11 has an invalid length. [ 199.522189][T10289] 8021q: VLANs not supported on ip6_vti0 [ 199.664247][ T5940] net_ratelimit: 6 callbacks suppressed [ 199.664265][ T5940] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 200.155422][T10317] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1248'. [ 200.212099][ T5833] IPVS: starting estimator thread 0... [ 200.235191][ T5833] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 200.311899][T10331] IPVS: using max 30 ests per chain, 72000 per kthread [ 200.348706][T10336] tipc: Enabled bearer , priority 0 [ 200.375287][T10336] syzkaller0: entered promiscuous mode [ 200.380790][T10336] syzkaller0: entered allmulticast mode [ 200.406719][T10336] tipc: Resetting bearer [ 200.423964][T10335] tipc: Resetting bearer [ 200.477917][T10335] tipc: Disabling bearer [ 200.689024][T10368] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1261'. [ 200.700922][T10360] bond3: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 200.714326][ T5940] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 200.714850][T10369] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1261'. [ 200.736826][T10360] bond3 (unregistering): Released all slaves [ 200.781311][T10364] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 201.174447][T10395] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 201.215322][T10400] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1273'. [ 201.229414][T10399] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1272'. [ 201.230144][T10400] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1273'. [ 201.453850][T10415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 201.495346][T10418] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1276'. [ 201.528602][T10415] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1275'. [ 201.547698][T10415] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1275'. [ 201.745495][ T5940] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 201.931899][T10444] RDS: rds_bind could not find a transport for ::ffff:172.30.1.5, load rds_tcp or rds_rdma? [ 202.122552][T10455] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 202.237026][T10463] IPVS: set_ctl: invalid protocol: 115 100.1.1.2:20001 [ 202.251004][ T5940] IPVS: starting estimator thread 0... [ 202.296261][T10467] bond0: (slave rose0): Error: Device can not be enslaved while up [ 202.353416][T10465] IPVS: using max 30 ests per chain, 72000 per kthread [ 202.611974][T10488] veth0: entered promiscuous mode [ 202.663414][T10489] : entered promiscuous mode [ 202.788687][ T856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 203.263777][ T5883] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 203.817774][T10548] bond4: entered promiscuous mode [ 203.831943][T10548] __nla_validate_parse: 8 callbacks suppressed [ 203.831959][T10548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1327'. [ 203.855477][T10548] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1327'. [ 203.866840][T10548] netlink: 'syz.4.1327': attribute type 15 has an invalid length. [ 203.895461][T10557] netlink: 'syz.2.1329': attribute type 2 has an invalid length. [ 204.045472][T10566] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1333'. [ 204.055183][T10566] netlink: 'syz.1.1333': attribute type 7 has an invalid length. [ 204.073649][T10566] netlink: 'syz.1.1333': attribute type 8 has an invalid length. [ 204.083169][T10566] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1333'. [ 204.451719][T10590] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1338'. [ 204.754460][T10604] team0: Device vti0 is of different type [ 204.842956][T10606] team0: Caught tx_queue_len zero misconfig [ 204.877351][T10608] team0: Device vti0 is of different type [ 204.918951][T10616] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1334'. [ 204.935182][T10616] netlink: 43 bytes leftover after parsing attributes in process `syz.4.1334'. [ 204.953687][T10616] netlink: 'syz.4.1334': attribute type 5 has an invalid length. [ 204.972818][T10616] netlink: 43 bytes leftover after parsing attributes in process `syz.4.1334'. [ 205.018393][T10616] tipc: Enabled bearer , priority 0 [ 205.054736][T10620] macvlan1: Caught tx_queue_len zero misconfig [ 205.122739][T10610] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 205.214142][T10629] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 205.235114][T10632] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 205.285036][T10629] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.310670][T10632] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.461293][T10640] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.514877][T10570] tipc: Disabling bearer [ 205.527953][T10640] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1351'. [ 205.737407][T10656] Bluetooth: MGMT ver 1.23 [ 205.935802][T10693] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1362'. [ 206.301923][T10699] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 206.312524][T10710] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 206.616505][T10745] sctp: [Deprecated]: syz.3.1375 (pid 10745) Use of struct sctp_assoc_value in delayed_ack socket option. [ 206.616505][T10745] Use struct sctp_sack_info instead [ 206.924133][T10773] netlink: 'syz.0.1382': attribute type 18 has an invalid length. [ 207.463008][T10811] tipc: Enabled bearer , priority 0 [ 207.521703][T10810] tipc: Disabling bearer [ 207.752564][T10828] tipc: Enabled bearer , priority 0 [ 207.760318][T10828] syzkaller0: entered promiscuous mode [ 207.766152][T10828] syzkaller0: entered allmulticast mode [ 207.801339][T10828] tipc: Resetting bearer [ 207.822699][T10827] tipc: Resetting bearer [ 207.855578][T10827] tipc: Disabling bearer [ 207.899296][T10841] netlink: 'syz.1.1403': attribute type 11 has an invalid length. [ 208.326152][T10868] netlink: 'syz.4.1408': attribute type 7 has an invalid length. [ 208.807868][T10895] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 208.908968][T10883] bond3: (slave veth0_to_bond): Releasing active interface [ 208.925309][T10883] bond0: (slave bond_slave_0): Releasing backup interface [ 208.937161][T10883] bond_slave_0: left promiscuous mode [ 208.945925][T10904] netlink: 'syz.0.1416': attribute type 5 has an invalid length. [ 208.958891][T10883] bond0: (slave bond_slave_1): Releasing backup interface [ 208.972106][T10883] bond_slave_1: left promiscuous mode [ 208.984394][T10883] team0: Port device team_slave_0 removed [ 208.995718][T10883] team0: Port device team_slave_1 removed [ 209.005817][T10883] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.013665][T10883] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.021898][T10883] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 209.030395][T10883] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 209.039593][T10883] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 209.072764][T10903] tipc: New replicast peer: 255.255.255.255 [ 209.081443][T10903] tipc: Enabled bearer , priority 10 [ 209.221477][T10905] __nla_validate_parse: 9 callbacks suppressed [ 209.221499][T10905] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1417'. [ 209.246415][T10918] netlink: 'syz.4.1420': attribute type 24 has an invalid length. [ 209.255053][T10918] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1420'. [ 209.272918][T10918] openvswitch: netlink: Key type 1040 is out of range max 32 [ 209.652209][T10941] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1426'. [ 209.861035][T10958] tunl0: Caught tx_queue_len zero misconfig [ 209.925256][T10964] IPVS: set_ctl: invalid protocol: 4 100.1.1.0:20000 [ 209.935224][T10959] netlink: 'syz.3.1434': attribute type 16 has an invalid length. [ 209.954311][T10959] netlink: 'syz.3.1434': attribute type 17 has an invalid length. [ 209.976343][T10963] tipc: Enabled bearer , priority 0 [ 209.985960][T10963] syzkaller0: entered promiscuous mode [ 209.991440][T10963] syzkaller0: entered allmulticast mode [ 210.052221][T10959] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 210.135916][T10963] tipc: Resetting bearer [ 210.168698][T10984] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 210.182104][T10962] tipc: Resetting bearer [ 210.196132][ T5940] tipc: Node number set to 3067119004 [ 210.218369][T10992] x_tables: duplicate underflow at hook 2 [ 210.244385][T10962] tipc: Disabling bearer [ 210.282081][T10990] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 210.302384][T10999] sit3: entered promiscuous mode [ 210.307487][T10999] sit3: entered allmulticast mode [ 210.318063][T10996] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 210.337062][T11002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1444'. [ 210.534365][T11017] netlink: 'syz.4.1450': attribute type 2 has an invalid length. [ 210.551844][T11017] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1450'. [ 210.660033][T11025] netlink: 'syz.1.1452': attribute type 13 has an invalid length. [ 210.739483][T11028] openvswitch: netlink: Message has 592 unknown bytes. [ 210.760292][T11028] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.939160][T11044] netlink: 64985 bytes leftover after parsing attributes in process `syz.3.1459'. [ 210.943745][T11037] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1457'. [ 211.042989][T11047] bond4: entered promiscuous mode [ 211.057853][T11047] bond4: entered allmulticast mode [ 211.064158][T11047] 8021q: adding VLAN 0 to HW filter on device bond4 [ 211.172798][T11061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1463'. [ 211.347298][T11072] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1468'. [ 211.373129][T11072] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1468'. [ 211.388879][T11075] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 211.404903][T11075] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.796707][T11104] tipc: Enabling of bearer rejected, failed to enable media [ 211.832210][T11107] netlink: 'syz.4.1479': attribute type 1 has an invalid length. [ 212.275023][T11138] netlink: 'syz.3.1485': attribute type 1 has an invalid length. [ 212.665922][T11165] lo: entered allmulticast mode [ 212.681368][T11165] dvmrp1: entered allmulticast mode [ 212.692216][T11164] lo: left allmulticast mode [ 212.847895][T11177] 8021q: adding VLAN 0 to HW filter on device bond5 [ 212.857007][T11177] bond0: (slave bond5): Enslaving as an active interface with an up link [ 212.897075][T11182] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 212.932425][T11184] macvlan0: entered promiscuous mode [ 212.944107][T11184] batadv0: entered promiscuous mode [ 212.957075][T11184] batadv0: left promiscuous mode [ 212.964064][T11184] macvlan0: left promiscuous mode [ 213.767588][T11241] IPv6: sit1: Disabled Multicast RS [ 213.781072][T11241] sit1: entered allmulticast mode [ 214.073058][T11264] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 214.145401][T11270] veth9: entered allmulticast mode [ 214.162807][T11275] netlink: 'syz.0.1526': attribute type 1 has an invalid length. [ 214.172604][T11272] bridge: RTM_NEWNEIGH with invalid ether address [ 214.187283][T11276] ip6tnl1: entered promiscuous mode [ 214.192500][T11276] ip6tnl1: entered allmulticast mode [ 214.258837][T11280] netlink: 'syz.3.1527': attribute type 12 has an invalid length. [ 214.477246][T11292] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 214.492715][T11290] syzkaller0: entered promiscuous mode [ 214.512959][T11290] syzkaller0: entered allmulticast mode [ 214.541115][T11292] __nla_validate_parse: 8 callbacks suppressed [ 214.541130][T11292] netlink: 332 bytes leftover after parsing attributes in process `syz.3.1531'. [ 214.781318][T11308] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1536'. [ 214.795837][T11308] netlink: 4096 bytes leftover after parsing attributes in process `syz.2.1536'. [ 214.874147][T11308] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1536'. [ 214.886616][T11317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1536'. [ 214.921880][T11318] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1540'. [ 214.988380][T11314] netlink: 'syz.3.1538': attribute type 4 has an invalid length. [ 214.997301][T11314] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1538'. [ 215.032042][T11326] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1542'. [ 215.233771][T11333] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1544'. [ 215.410084][T11342] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1551'. [ 215.530146][T11342] bond6: entered allmulticast mode [ 215.536369][T11342] 8021q: adding VLAN 0 to HW filter on device bond6 [ 215.544693][T11342] bridge0: port 4(bond6) entered blocking state [ 215.551201][T11342] bridge0: port 4(bond6) entered disabled state [ 215.568807][T11342] bond6: entered promiscuous mode [ 215.585073][T11361] netlink: 'syz.4.1554': attribute type 1 has an invalid length. [ 216.088244][T11392] lo: Caught tx_queue_len zero misconfig [ 216.195044][T11401] sctp: [Deprecated]: syz.2.1566 (pid 11401) Use of int in maxseg socket option. [ 216.195044][T11401] Use struct sctp_assoc_value instead [ 216.213088][T11404] !: renamed from dummy0 (while UP) [ 216.292425][T11409] netlink: 'syz.0.1570': attribute type 83 has an invalid length. [ 216.357925][ T30] audit: type=1107 audit(1761816712.988:7): pid=11413 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='?H#Fc}!cNE,%0AY8ZH=dI ߌ/F:Z`[g' [ 216.431149][T11422] ip6t_srh: unknown srh invflags 4000 [ 216.552212][T11435] bond0: entered allmulticast mode [ 216.705343][T11445] sctp: [Deprecated]: syz.0.1575 (pid 11445) Use of int in max_burst socket option. [ 216.705343][T11445] Use struct sctp_assoc_value instead [ 217.028515][T10684] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.509305][T11503] vxcan0: entered allmulticast mode [ 217.719247][T11518] team0: Device wireguard1 is of different type [ 217.816095][T11525] tipc: Enabled bearer , priority 0 [ 217.847530][T11525] syzkaller0: entered promiscuous mode [ 217.872653][T11525] syzkaller0: entered allmulticast mode [ 217.883453][T10662] syzkaller0: tun_net_xmit 70 [ 217.931704][T11525] tipc: Resetting bearer [ 217.941704][T11525] syzkaller0: tun_net_xmit 90 [ 217.946601][T11525] syzkaller0: tun_net_xmit 90 [ 217.962151][T11523] tipc: Resetting bearer [ 218.008059][T11523] tipc: Disabling bearer [ 218.330393][T11509] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 218.615952][T11580] af_packet: tpacket_rcv: packet too big, clamped from 92 to 4294967272. macoff=96 [ 218.741757][T11592] netlink: 'syz.2.1619': attribute type 6 has an invalid length. [ 219.052054][T11615] xt_NFQUEUE: number of queues (16) out of range (got 65549) [ 219.069258][T11615] geneve2: entered promiscuous mode [ 219.074967][T11615] geneve2: entered allmulticast mode [ 219.081991][T10684] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 19999 - 0 [ 219.090994][T10684] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 19999 - 0 [ 219.110008][T11615] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.141851][T10684] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 19999 - 0 [ 219.583322][ T5149] Bluetooth: hci0: command 0x0c1a tx timeout [ 220.865194][T11615] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 221.123278][T11615] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 221.615228][T11615] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 221.744312][T11615] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 222.205226][T11615] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.443604][T11615] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 223.626308][T10662] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 223.670779][T10662] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 224.043737][ T9367] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 224.052039][ T9367] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 224.433512][T10662] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 224.441798][T10662] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 224.675656][T10684] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 224.713681][T10684] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 225.384514][T11632] set match dimension is over the limit! [ 225.462168][T11637] vlan0: entered promiscuous mode [ 225.484015][T11637] vlan0: entered allmulticast mode [ 225.490509][T11637] hsr_slave_1: entered allmulticast mode [ 225.832279][T11667] __nla_validate_parse: 14 callbacks suppressed [ 225.832295][T11667] netlink: 348 bytes leftover after parsing attributes in process `syz.0.1647'. [ 225.901588][T11666] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1648'. [ 225.947765][T11660] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1646'. [ 225.955464][T11670] netlink: 'syz.3.1649': attribute type 4 has an invalid length. [ 225.971006][T11666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1648'. [ 225.988157][T11673] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1650'. [ 225.999277][T11673] netlink: 'syz.0.1650': attribute type 3 has an invalid length. [ 226.015765][T11660] veth0_macvtap: left promiscuous mode [ 226.597088][T11724] netlink: 'syz.2.1667': attribute type 27 has an invalid length. [ 226.637272][T11726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1668'. [ 226.692231][T11729] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1667'. [ 227.222712][T11726] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1668'. [ 227.260810][T11732] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1669'. [ 227.307308][T11732] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1669'. [ 227.446440][T11744] netlink: 'syz.4.1674': attribute type 11 has an invalid length. [ 227.781037][T11767] nbd: must specify a size in bytes for the device [ 227.855557][ T5149] Bluetooth: hci4: link tx timeout [ 227.860934][ T5149] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 227.872099][ T52] Bluetooth: hci4: link tx timeout [ 227.877959][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 227.886591][ T52] Bluetooth: hci4: link tx timeout [ 227.891711][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 227.901139][ T52] Bluetooth: hci4: link tx timeout [ 227.906313][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 227.914561][ T52] Bluetooth: hci4: link tx timeout [ 227.919676][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 227.932568][T11777] netlink: 'syz.4.1686': attribute type 1 has an invalid length. [ 228.105131][T11788] bond5: (slave gretap2): making interface the new active one [ 228.113577][T11788] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 228.289250][T11811] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 228.987086][T11866] sctp: [Deprecated]: syz.0.1709 (pid 11866) Use of struct sctp_assoc_value in delayed_ack socket option. [ 228.987086][T11866] Use struct sctp_sack_info instead [ 229.004510][T11866] sctp: [Deprecated]: syz.0.1709 (pid 11866) Use of struct sctp_assoc_value in delayed_ack socket option. [ 229.004510][T11866] Use struct sctp_sack_info instead [ 229.028163][T11860] bond6: option min_links: invalid value (18446744073709551614) [ 229.063146][T11860] bond6: option min_links: allowed values 0 - 2147483647 [ 229.098916][T11860] bond6 (unregistering): Released all slaves [ 229.209672][T11866] bond7 (unregistering): Released all slaves [ 229.317158][T10683] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 229.528302][T11902] dvmrp1: left allmulticast mode [ 229.565672][T11911] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 229.655673][T11922] netlink: 'syz.0.1721': attribute type 6 has an invalid length. [ 229.678333][T11922] netlink: 'syz.0.1721': attribute type 5 has an invalid length. [ 229.837365][T11937] veth0_to_bond: entered allmulticast mode [ 229.869075][T11943] netlink: 'syz.0.1726': attribute type 3 has an invalid length. [ 229.887493][T11941] netlink: 'syz.0.1726': attribute type 3 has an invalid length. [ 229.907288][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 229.922719][T11942] bridge6: entered allmulticast mode [ 230.101033][T11952] netlink: 'syz.3.1727': attribute type 2 has an invalid length. [ 230.120330][T11952] : entered promiscuous mode [ 230.238443][T11959] erspan0: entered allmulticast mode [ 230.388711][T11963] netlink: 'syz.3.1732': attribute type 1 has an invalid length. [ 230.475450][T11963] 8021q: adding VLAN 0 to HW filter on device bond3 [ 231.167215][T12028] __nla_validate_parse: 15 callbacks suppressed [ 231.167233][T12028] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1750'. [ 231.182870][T12029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1752'. [ 231.190490][T12033] netlink: 'syz.0.1751': attribute type 1 has an invalid length. [ 231.205022][T12033] netlink: 'syz.0.1751': attribute type 2 has an invalid length. [ 231.205065][T12028] gretap0: entered promiscuous mode [ 231.303713][T12028] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1750'. [ 231.312753][T12028] 0{X: renamed from gretap0 [ 231.358115][T12028] 0{X: left promiscuous mode [ 231.363192][T12028] 0{X: entered allmulticast mode [ 231.390123][T12028] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 231.450182][T12054] syzkaller0: entered promiscuous mode [ 231.479261][T12057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1758'. [ 231.481039][T12054] syzkaller0: entered allmulticast mode [ 231.675475][T12068] geneve3: entered promiscuous mode [ 231.686741][T12070] netlink: 'syz.0.1762': attribute type 6 has an invalid length. [ 231.694741][T12070] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1762'. [ 231.725330][T12070] block nbd0: not configured, cannot reconfigure [ 231.968144][T12083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1766'. [ 232.938816][T12150] netlink: 'syz.2.1782': attribute type 19 has an invalid length. [ 233.008537][T12150] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1782'. [ 233.026503][T10662] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 233.039270][T10662] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 233.083919][T10662] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 233.102367][T10662] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 233.164834][T12167] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1788'. [ 233.176359][T12167] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1788'. [ 233.254889][T12172] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1788'. [ 233.268175][T12167] netlink: 'syz.1.1788': attribute type 83 has an invalid length. [ 233.482238][T12183] bond7: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 233.500993][T12183] bond7 (unregistering): Released all slaves [ 233.707414][T12190] syzkaller0: entered promiscuous mode [ 233.711625][T12198] sctp: [Deprecated]: syz.1.1798 (pid 12198) Use of struct sctp_assoc_value in delayed_ack socket option. [ 233.711625][T12198] Use struct sctp_sack_info instead [ 233.718417][T12190] syzkaller0: entered allmulticast mode [ 233.734850][T12197] sctp: [Deprecated]: syz.1.1798 (pid 12197) Use of struct sctp_assoc_value in delayed_ack socket option. [ 233.734850][T12197] Use struct sctp_sack_info instead [ 235.057390][T12230] netlink: 'syz.0.1807': attribute type 58 has an invalid length. [ 235.129661][T12225] kthread_run failed with err -4 [ 235.429421][T12258] netlink: 'syz.1.1814': attribute type 29 has an invalid length. [ 235.462806][ T30] audit: type=1107 audit(1761816732.088:8): pid=12265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='R [ 235.462806][ T30] WܭeL+>' [ 235.818282][T12291] tc_dump_action: action bad kind [ 235.929535][T12293] netlink: 'syz.2.1823': attribute type 13 has an invalid length. [ 236.020992][T12293] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 236.049856][T12310] vlan0: entered promiscuous mode [ 236.056336][T12310] bridge0: entered promiscuous mode [ 236.067265][T12303] netlink: 'syz.1.1828': attribute type 29 has an invalid length. [ 236.088501][T12303] netlink: 'syz.1.1828': attribute type 29 has an invalid length. [ 236.139376][T12314] syzkaller0: entered promiscuous mode [ 236.148770][T12314] syzkaller0: entered allmulticast mode [ 236.158483][T12314] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 236.298605][T12323] __nla_validate_parse: 15 callbacks suppressed [ 236.298621][T12323] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1836'. [ 236.351145][T12329] bridge5: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 236.388709][T12323] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1836'. [ 236.404849][T12329] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1838'. [ 236.414667][T12329] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1838'. [ 236.433011][T12329] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1838'. [ 236.453559][T12333] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1839'. [ 236.483811][T12338] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1836'. [ 236.493990][T12329] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1838'. [ 236.589510][T12333] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1839'. [ 236.675769][T12353] ipt_REJECT: TCP_RESET invalid for non-tcp [ 236.822789][T12358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1845'. [ 236.867978][T12362] FAULT_INJECTION: forcing a failure. [ 236.867978][T12362] name failslab, interval 1, probability 0, space 0, times 0 [ 236.882236][T12360] netlink: 'syz.1.1847': attribute type 2 has an invalid length. [ 236.894678][ T5149] block nbd0: Receive control failed (result -107) [ 236.896146][T12360] netlink: 'syz.1.1847': attribute type 2 has an invalid length. [ 236.914822][T12362] CPU: 1 UID: 0 PID: 12362 Comm: syz.2.1848 Not tainted syzkaller #0 PREEMPT(full) [ 236.914846][T12362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 236.914856][T12362] Call Trace: [ 236.914864][T12362] [ 236.914871][T12362] dump_stack_lvl+0x189/0x250 [ 236.914899][T12362] ? __pfx____ratelimit+0x10/0x10 [ 236.914921][T12362] ? __pfx_dump_stack_lvl+0x10/0x10 [ 236.914944][T12362] ? __pfx__printk+0x10/0x10 [ 236.914968][T12362] ? __pfx___might_resched+0x10/0x10 [ 236.914991][T12362] should_fail_ex+0x414/0x560 [ 236.915021][T12362] should_failslab+0xa8/0x100 [ 236.915041][T12362] kmem_cache_alloc_noprof+0x74/0x6e0 [ 236.915066][T12362] ? ovs_flow_alloc+0x24/0x1f0 [ 236.915088][T12362] ovs_flow_alloc+0x24/0x1f0 [ 236.915109][T12362] ovs_flow_cmd_new+0x1ee/0xd80 [ 236.915128][T12362] ? netlink_deliver_tap+0x19c/0x1b0 [ 236.915153][T12362] ? __sock_sendmsg+0x21c/0x270 [ 236.915181][T12362] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 236.915256][T12362] ? rcu_is_watching+0x15/0xb0 [ 236.915279][T12362] ? __nla_parse+0x40/0x60 [ 236.915300][T12362] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 236.915327][T12362] genl_family_rcv_msg_doit+0x215/0x300 [ 236.915355][T12362] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 236.915388][T12362] ? bpf_lsm_capable+0x9/0x20 [ 236.915407][T12362] ? security_capable+0x7e/0x2e0 [ 236.915437][T12362] genl_rcv_msg+0x60e/0x790 [ 236.915464][T12362] ? __pfx_genl_rcv_msg+0x10/0x10 [ 236.915483][T12362] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 236.915506][T12362] ? __asan_memcpy+0x40/0x70 [ 236.915527][T12362] ? __pfx_ref_tracker_free+0x10/0x10 [ 236.915552][T12362] netlink_rcv_skb+0x208/0x470 [ 236.915574][T12362] ? __lock_acquire+0xab9/0xd20 [ 236.915592][T12362] ? __pfx_genl_rcv_msg+0x10/0x10 [ 236.915613][T12362] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 236.915658][T12362] ? down_read+0x1ad/0x2e0 [ 236.915686][T12362] genl_rcv+0x28/0x40 [ 236.915703][T12362] netlink_unicast+0x82f/0x9e0 [ 236.915736][T12362] ? __pfx_netlink_unicast+0x10/0x10 [ 236.915761][T12362] ? netlink_sendmsg+0x642/0xb30 [ 236.915781][T12362] ? skb_put+0x11b/0x210 [ 236.915802][T12362] netlink_sendmsg+0x805/0xb30 [ 236.915828][T12362] ? __pfx_netlink_sendmsg+0x10/0x10 [ 236.915861][T12362] ? aa_sock_msg_perm+0xf1/0x1d0 [ 236.915887][T12362] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 236.915904][T12362] ? __pfx_netlink_sendmsg+0x10/0x10 [ 236.915929][T12362] __sock_sendmsg+0x21c/0x270 [ 236.915954][T12362] ____sys_sendmsg+0x505/0x830 [ 236.915979][T12362] ? __pfx_____sys_sendmsg+0x10/0x10 [ 236.916007][T12362] ? import_iovec+0x74/0xa0 [ 236.916032][T12362] ___sys_sendmsg+0x21f/0x2a0 [ 236.916053][T12362] ? __pfx____sys_sendmsg+0x10/0x10 [ 236.916110][T12362] ? __fget_files+0x2a/0x420 [ 236.916126][T12362] ? __fget_files+0x3a0/0x420 [ 236.916154][T12362] __x64_sys_sendmsg+0x19b/0x260 [ 236.916176][T12362] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 236.916204][T12362] ? __pfx_ksys_write+0x10/0x10 [ 236.916232][T12362] ? do_syscall_64+0xbe/0xfa0 [ 236.916257][T12362] do_syscall_64+0xfa/0xfa0 [ 236.916276][T12362] ? lockdep_hardirqs_on+0x9c/0x150 [ 236.916297][T12362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.916314][T12362] ? clear_bhb_loop+0x60/0xb0 [ 236.916336][T12362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.916353][T12362] RIP: 0033:0x7f06ecd8efc9 [ 236.916370][T12362] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 236.916384][T12362] RSP: 002b:00007f06edbfa038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 236.916411][T12362] RAX: ffffffffffffffda RBX: 00007f06ecfe5fa0 RCX: 00007f06ecd8efc9 [ 236.916424][T12362] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 236.916435][T12362] RBP: 00007f06edbfa090 R08: 0000000000000000 R09: 0000000000000000 [ 236.916446][T12362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 236.916457][T12362] R13: 00007f06ecfe6038 R14: 00007f06ecfe5fa0 R15: 00007ffc6b690958 [ 236.916490][T12362] [ 237.369230][T12358] netlink: 'syz.4.1845': attribute type 15 has an invalid length. [ 237.590289][T12379] tipc: Enabled bearer , priority 0 [ 237.597741][T12379] syzkaller0: entered promiscuous mode [ 237.603556][T12379] syzkaller0: entered allmulticast mode [ 237.611965][T12379] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 237.650713][T12379] tipc: Resetting bearer [ 237.732641][T12378] tipc: Resetting bearer [ 237.782809][T12378] tipc: Disabling bearer [ 237.821727][T12398] bond4: option mode: invalid value (133) [ 237.829957][T12398] bond4 (unregistering): Released all slaves [ 237.911865][T12407] Cannot find del_set index 4 as target [ 238.014104][T12413] netlink: 'syz.1.1864': attribute type 1 has an invalid length. [ 238.025159][T12413] netlink: 'syz.1.1864': attribute type 1 has an invalid length. [ 238.214158][T12430] workqueue: Failed to create a rescuer kthread for wq "nfc6_nci_cmd_wq": -EINTR [ 238.215072][T12417] workqueue: Failed to create a rescuer kthread for wq "nfc6_nci_cmd_wq": -EINTR [ 238.801482][T12464] bridge7: entered promiscuous mode [ 238.834649][T12464] bridge7: entered allmulticast mode [ 239.058949][T12477] pimreg: entered allmulticast mode [ 239.343566][T12497] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 239.421549][T12491] bond0 (unregistering): Released all slaves [ 239.468661][T12503] bond8 (unregistering): Released all slaves [ 239.719653][T12525] netlink: 'syz.1.1893': attribute type 11 has an invalid length. [ 239.867344][T12536] netlink: 'syz.3.1897': attribute type 23 has an invalid length. [ 239.957966][T12536] tipc: Enabled bearer , priority 0 [ 239.965503][T12536] syzkaller0: entered promiscuous mode [ 239.971066][T12536] syzkaller0: entered allmulticast mode [ 240.009637][T12536] tipc: Resetting bearer [ 240.034925][T12535] tipc: Resetting bearer [ 240.061550][T12535] tipc: Disabling bearer [ 240.590999][T12593] netlink: 'syz.3.1914': attribute type 15 has an invalid length. [ 240.636467][T12595] netlink: 'syz.2.1915': attribute type 16 has an invalid length. [ 240.732062][T12603] netlink: 'syz.0.1917': attribute type 21 has an invalid length. [ 241.115194][T12628] netlink: 'syz.0.1927': attribute type 1 has an invalid length. [ 241.137381][T12636] Bluetooth: MGMT ver 1.23 [ 241.297026][T12644] FAULT_INJECTION: forcing a failure. [ 241.297026][T12644] name failslab, interval 1, probability 0, space 0, times 0 [ 241.360334][T12644] CPU: 0 UID: 0 PID: 12644 Comm: syz.3.1931 Not tainted syzkaller #0 PREEMPT(full) [ 241.360358][T12644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 241.360369][T12644] Call Trace: [ 241.360376][T12644] [ 241.360384][T12644] dump_stack_lvl+0x189/0x250 [ 241.360412][T12644] ? __pfx____ratelimit+0x10/0x10 [ 241.360434][T12644] ? __pfx_dump_stack_lvl+0x10/0x10 [ 241.360459][T12644] ? __pfx__printk+0x10/0x10 [ 241.360478][T12644] ? __pfx___might_resched+0x10/0x10 [ 241.360497][T12644] ? fs_reclaim_acquire+0x7d/0x100 [ 241.360526][T12644] should_fail_ex+0x414/0x560 [ 241.360556][T12644] should_failslab+0xa8/0x100 [ 241.360573][T12644] __kmalloc_cache_noprof+0x6f/0x6f0 [ 241.360595][T12644] ? ovs_flow_cmd_new+0x294/0xd80 [ 241.360622][T12644] ovs_flow_cmd_new+0x294/0xd80 [ 241.360641][T12644] ? netlink_deliver_tap+0x19c/0x1b0 [ 241.360675][T12644] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 241.360748][T12644] ? rcu_is_watching+0x15/0xb0 [ 241.360772][T12644] ? __nla_parse+0x40/0x60 [ 241.360795][T12644] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 241.360823][T12644] genl_family_rcv_msg_doit+0x215/0x300 [ 241.360851][T12644] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 241.360885][T12644] ? bpf_lsm_capable+0x9/0x20 [ 241.360904][T12644] ? security_capable+0x7e/0x2e0 [ 241.360934][T12644] genl_rcv_msg+0x60e/0x790 [ 241.360960][T12644] ? __pfx_genl_rcv_msg+0x10/0x10 [ 241.360979][T12644] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 241.361002][T12644] ? __asan_memcpy+0x40/0x70 [ 241.361023][T12644] ? __pfx_ref_tracker_free+0x10/0x10 [ 241.361049][T12644] netlink_rcv_skb+0x208/0x470 [ 241.361068][T12644] ? __lock_acquire+0xab9/0xd20 [ 241.361085][T12644] ? __pfx_genl_rcv_msg+0x10/0x10 [ 241.361107][T12644] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 241.361151][T12644] ? down_read+0x1ad/0x2e0 [ 241.361179][T12644] genl_rcv+0x28/0x40 [ 241.361196][T12644] netlink_unicast+0x82f/0x9e0 [ 241.361227][T12644] ? __pfx_netlink_unicast+0x10/0x10 [ 241.361251][T12644] ? netlink_sendmsg+0x642/0xb30 [ 241.361263][T12644] ? skb_put+0x11b/0x210 [ 241.361283][T12644] netlink_sendmsg+0x805/0xb30 [ 241.361316][T12644] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.361345][T12644] ? aa_sock_msg_perm+0xf1/0x1d0 [ 241.361370][T12644] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 241.361385][T12644] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.361410][T12644] __sock_sendmsg+0x21c/0x270 [ 241.361435][T12644] ____sys_sendmsg+0x505/0x830 [ 241.361457][T12644] ? __pfx_____sys_sendmsg+0x10/0x10 [ 241.361483][T12644] ? import_iovec+0x74/0xa0 [ 241.361507][T12644] ___sys_sendmsg+0x21f/0x2a0 [ 241.361528][T12644] ? __pfx____sys_sendmsg+0x10/0x10 [ 241.361583][T12644] ? __fget_files+0x2a/0x420 [ 241.361599][T12644] ? __fget_files+0x3a0/0x420 [ 241.361626][T12644] __x64_sys_sendmsg+0x19b/0x260 [ 241.361647][T12644] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 241.361675][T12644] ? __pfx_ksys_write+0x10/0x10 [ 241.361703][T12644] ? do_syscall_64+0xbe/0xfa0 [ 241.361728][T12644] do_syscall_64+0xfa/0xfa0 [ 241.361748][T12644] ? lockdep_hardirqs_on+0x9c/0x150 [ 241.361769][T12644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.361786][T12644] ? clear_bhb_loop+0x60/0xb0 [ 241.361808][T12644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.361825][T12644] RIP: 0033:0x7f17f878efc9 [ 241.361841][T12644] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 241.361856][T12644] RSP: 002b:00007f17f96fc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 241.361876][T12644] RAX: ffffffffffffffda RBX: 00007f17f89e5fa0 RCX: 00007f17f878efc9 [ 241.361889][T12644] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 241.361900][T12644] RBP: 00007f17f96fc090 R08: 0000000000000000 R09: 0000000000000000 [ 241.361911][T12644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 241.361921][T12644] R13: 00007f17f89e6038 R14: 00007f17f89e5fa0 R15: 00007fffe24a8d18 [ 241.361954][T12644] [ 241.795312][T12655] x_tables: duplicate underflow at hook 1 [ 241.801517][T12655] IPVS: set_ctl: invalid protocol: 59 172.20.20.26:20000 [ 241.810231][T12655] IPVS: set_ctl: invalid protocol: 59 172.20.20.26:20000 [ 241.997886][T12674] __nla_validate_parse: 27 callbacks suppressed [ 241.997904][T12674] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1940'. [ 242.060836][T12675] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1940'. [ 242.134296][T12686] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1943'. [ 242.163777][T12687] bond6: Removing last ns target with arp_interval on [ 242.170728][T12686] netlink: 4040 bytes leftover after parsing attributes in process `syz.0.1943'. [ 242.255149][T12686] netlink: 'syz.0.1943': attribute type 21 has an invalid length. [ 242.296308][T12697] FAULT_INJECTION: forcing a failure. [ 242.296308][T12697] name failslab, interval 1, probability 0, space 0, times 0 [ 242.320634][T12686] bond9: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 242.330434][T12697] CPU: 0 UID: 0 PID: 12697 Comm: syz.1.1947 Not tainted syzkaller #0 PREEMPT(full) [ 242.330458][T12697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 242.330469][T12697] Call Trace: [ 242.330475][T12697] [ 242.330483][T12697] dump_stack_lvl+0x189/0x250 [ 242.330511][T12697] ? __pfx____ratelimit+0x10/0x10 [ 242.330532][T12697] ? __pfx_dump_stack_lvl+0x10/0x10 [ 242.330554][T12697] ? __pfx__printk+0x10/0x10 [ 242.330576][T12697] ? __pfx___might_resched+0x10/0x10 [ 242.330600][T12697] should_fail_ex+0x414/0x560 [ 242.330630][T12697] should_failslab+0xa8/0x100 [ 242.330650][T12697] __kmalloc_noprof+0xcb/0x7f0 [ 242.330672][T12697] ? ovs_nla_copy_actions+0x68/0x3d0 [ 242.330696][T12697] ? __kmalloc_cache_noprof+0x3d5/0x6f0 [ 242.330722][T12697] ovs_nla_copy_actions+0x68/0x3d0 [ 242.330745][T12697] ? __asan_memcpy+0x40/0x70 [ 242.330773][T12697] ovs_flow_cmd_new+0x528/0xd80 [ 242.330792][T12697] ? netlink_deliver_tap+0x19c/0x1b0 [ 242.330824][T12697] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 242.330898][T12697] ? rcu_is_watching+0x15/0xb0 [ 242.330920][T12697] ? __nla_parse+0x40/0x60 [ 242.330942][T12697] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 242.330970][T12697] genl_family_rcv_msg_doit+0x215/0x300 [ 242.330997][T12697] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 242.331030][T12697] ? bpf_lsm_capable+0x9/0x20 [ 242.331050][T12697] ? security_capable+0x7e/0x2e0 [ 242.331080][T12697] genl_rcv_msg+0x60e/0x790 [ 242.331105][T12697] ? __pfx_genl_rcv_msg+0x10/0x10 [ 242.331124][T12697] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 242.331147][T12697] ? __asan_memcpy+0x40/0x70 [ 242.331168][T12697] ? __pfx_ref_tracker_free+0x10/0x10 [ 242.331193][T12697] netlink_rcv_skb+0x208/0x470 [ 242.331221][T12697] ? __lock_acquire+0xab9/0xd20 [ 242.331239][T12697] ? __pfx_genl_rcv_msg+0x10/0x10 [ 242.331260][T12697] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 242.331303][T12697] ? down_read+0x1ad/0x2e0 [ 242.331330][T12697] genl_rcv+0x28/0x40 [ 242.331347][T12697] netlink_unicast+0x82f/0x9e0 [ 242.331378][T12697] ? __pfx_netlink_unicast+0x10/0x10 [ 242.331402][T12697] ? netlink_sendmsg+0x642/0xb30 [ 242.331416][T12697] ? skb_put+0x11b/0x210 [ 242.331436][T12697] netlink_sendmsg+0x805/0xb30 [ 242.331461][T12697] ? __pfx_netlink_sendmsg+0x10/0x10 [ 242.331488][T12697] ? aa_sock_msg_perm+0xf1/0x1d0 [ 242.331514][T12697] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 242.331530][T12697] ? __pfx_netlink_sendmsg+0x10/0x10 [ 242.331555][T12697] __sock_sendmsg+0x21c/0x270 [ 242.331580][T12697] ____sys_sendmsg+0x505/0x830 [ 242.331603][T12697] ? __pfx_____sys_sendmsg+0x10/0x10 [ 242.331631][T12697] ? import_iovec+0x74/0xa0 [ 242.331656][T12697] ___sys_sendmsg+0x21f/0x2a0 [ 242.331676][T12697] ? __pfx____sys_sendmsg+0x10/0x10 [ 242.331730][T12697] ? __fget_files+0x2a/0x420 [ 242.331745][T12697] ? __fget_files+0x3a0/0x420 [ 242.331772][T12697] __x64_sys_sendmsg+0x19b/0x260 [ 242.331793][T12697] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 242.331820][T12697] ? __pfx_ksys_write+0x10/0x10 [ 242.331847][T12697] ? do_syscall_64+0xbe/0xfa0 [ 242.331872][T12697] do_syscall_64+0xfa/0xfa0 [ 242.331890][T12697] ? lockdep_hardirqs_on+0x9c/0x150 [ 242.331911][T12697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.331928][T12697] ? clear_bhb_loop+0x60/0xb0 [ 242.331949][T12697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.331965][T12697] RIP: 0033:0x7efd8898efc9 [ 242.331981][T12697] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 242.331996][T12697] RSP: 002b:00007efd898f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 242.332015][T12697] RAX: ffffffffffffffda RBX: 00007efd88be5fa0 RCX: 00007efd8898efc9 [ 242.332028][T12697] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 242.332039][T12697] RBP: 00007efd898f0090 R08: 0000000000000000 R09: 0000000000000000 [ 242.332050][T12697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 242.332059][T12697] R13: 00007efd88be6038 R14: 00007efd88be5fa0 R15: 00007fff217f7f88 [ 242.332090][T12697] [ 242.332099][T12697] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 242.747507][T12686] bond9 (unregistering): Released all slaves [ 242.912328][T12722] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1954'. [ 242.979612][T12718] syzkaller0: entered allmulticast mode [ 242.986624][T12730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1953'. [ 243.062888][T12730] 8021q: adding VLAN 0 to HW filter on device bond7 [ 244.382380][T12762] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1963'. [ 244.463804][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 244.478105][T12766] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1965'. [ 244.521341][T12773] openvswitch: netlink: nsh attr 0 has unexpected len 57 expected 0 [ 244.529626][T12773] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 244.552169][T12772] netlink: 'syz.2.1969': attribute type 1 has an invalid length. [ 244.676576][T12783] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1971'. [ 244.795590][T12792] x_tables: duplicate underflow at hook 3 [ 244.804172][T12792] x_tables: duplicate underflow at hook 1 [ 244.839705][T12797] netlink: 'syz.2.1977': attribute type 10 has an invalid length. [ 244.886080][T12797] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 245.000386][T12804] netlink: 'syz.3.1978': attribute type 2 has an invalid length. [ 245.122293][T12814] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1980'. [ 245.250610][T12813] bridge0: port 1(ipvlan2) entered blocking state [ 245.258295][T12813] bridge0: port 1(ipvlan2) entered disabled state [ 245.266654][T12813] ipvlan2: entered allmulticast mode [ 245.272572][T12813] bridge0: entered allmulticast mode [ 245.281427][T12813] ipvlan2: left allmulticast mode [ 245.287977][T12813] bridge0: left allmulticast mode [ 245.318126][T12814] macsec1: entered promiscuous mode [ 245.323535][T12814] bridge0: entered promiscuous mode [ 245.329011][T12814] macsec1: entered allmulticast mode [ 245.336040][T12814] bridge0: entered allmulticast mode [ 245.341953][T12814] bridge0: port 1(macsec1) entered blocking state [ 245.349343][T12814] bridge0: port 1(macsec1) entered disabled state [ 245.361714][T12814] bridge0: left allmulticast mode [ 245.367101][T12814] bridge0: left promiscuous mode [ 245.596864][T12840] openvswitch: netlink: Flow actions attr not present in new flow. [ 245.918024][T12872] erspan0: entered allmulticast mode [ 245.950021][T12878] FAULT_INJECTION: forcing a failure. [ 245.950021][T12878] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 245.967186][T12878] CPU: 0 UID: 0 PID: 12878 Comm: syz.2.1997 Not tainted syzkaller #0 PREEMPT(full) [ 245.967211][T12878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 245.967222][T12878] Call Trace: [ 245.967230][T12878] [ 245.967237][T12878] dump_stack_lvl+0x189/0x250 [ 245.967265][T12878] ? __pfx____ratelimit+0x10/0x10 [ 245.967288][T12878] ? __pfx_dump_stack_lvl+0x10/0x10 [ 245.967309][T12878] ? __pfx__printk+0x10/0x10 [ 245.967340][T12878] should_fail_ex+0x414/0x560 [ 245.967370][T12878] _copy_to_user+0x31/0xb0 [ 245.967394][T12878] simple_read_from_buffer+0xe1/0x170 [ 245.967424][T12878] proc_fail_nth_read+0x1b3/0x220 [ 245.967450][T12878] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 245.967475][T12878] ? rw_verify_area+0x2a6/0x4d0 [ 245.967496][T12878] ? __lock_acquire+0xab9/0xd20 [ 245.967512][T12878] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 245.967535][T12878] vfs_read+0x200/0xa30 [ 245.967557][T12878] ? fdget_pos+0x247/0x320 [ 245.967577][T12878] ? __pfx___mutex_lock+0x10/0x10 [ 245.967600][T12878] ? __pfx_vfs_read+0x10/0x10 [ 245.967624][T12878] ? __fget_files+0x2a/0x420 [ 245.967643][T12878] ? __fget_files+0x3a0/0x420 [ 245.967658][T12878] ? __fget_files+0x2a/0x420 [ 245.967685][T12878] ksys_read+0x145/0x250 [ 245.967709][T12878] ? __pfx_ksys_read+0x10/0x10 [ 245.967736][T12878] ? do_syscall_64+0xbe/0xfa0 [ 245.967761][T12878] do_syscall_64+0xfa/0xfa0 [ 245.967780][T12878] ? lockdep_hardirqs_on+0x9c/0x150 [ 245.967801][T12878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 245.967817][T12878] ? clear_bhb_loop+0x60/0xb0 [ 245.967839][T12878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 245.967856][T12878] RIP: 0033:0x7f06ecd8d9dc [ 245.967871][T12878] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 245.967894][T12878] RSP: 002b:00007f06edbfa030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 245.967913][T12878] RAX: ffffffffffffffda RBX: 00007f06ecfe5fa0 RCX: 00007f06ecd8d9dc [ 245.967926][T12878] RDX: 000000000000000f RSI: 00007f06edbfa0a0 RDI: 0000000000000004 [ 245.967937][T12878] RBP: 00007f06edbfa090 R08: 0000000000000000 R09: 0000000000000000 [ 245.967948][T12878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 245.967959][T12878] R13: 00007f06ecfe6038 R14: 00007f06ecfe5fa0 R15: 00007ffc6b690958 [ 245.967992][T12878] [ 246.376446][T12898] openvswitch: netlink: Flow actions attr not present in new flow. [ 246.465510][T12842] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 246.860661][ T5940] IPVS: starting estimator thread 0... [ 246.867707][T12926] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 246.878045][T12926] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 246.899736][T12926] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 246.926969][T12926] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 246.954719][T12927] IPVS: using max 27 ests per chain, 64800 per kthread [ 247.073712][T12945] __nla_validate_parse: 12 callbacks suppressed [ 247.073730][T12945] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2014'. [ 247.117264][T12924] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 247.160544][T12924] veth0_vlan: left promiscuous mode [ 247.360625][ T36] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 247.370308][ T36] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.387360][ T36] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 247.393149][T12952] xt_bpf: check failed: parse error [ 247.397579][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.413954][ T36] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 247.424592][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.451045][ T36] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 247.462386][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.480346][T12959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2019'. [ 247.581990][T12959] 8021q: adding VLAN 0 to HW filter on device bond7 [ 247.664043][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 247.707958][T12959] 8021q: adding VLAN 0 to HW filter on device bond7 [ 247.745491][T12959] bond7: (slave vxcan5): The slave device specified does not support setting the MAC address [ 247.760210][T12959] bond7: (slave vxcan5): Error -95 calling set_mac_address [ 247.961339][T12992] macvtap3: entered allmulticast mode [ 247.969723][T12992] veth0_macvtap: entered allmulticast mode [ 248.031390][T12993] netlink: 'syz.0.2027': attribute type 1 has an invalid length. [ 248.042819][T12997] syzkaller0: entered promiscuous mode [ 248.052570][T12990] can: request_module (can-proto-0) failed. [ 248.053700][T12997] syzkaller0: entered allmulticast mode [ 248.100823][T13002] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2031'. [ 248.122157][T13002] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2031'. [ 248.257895][T13015] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2035'. [ 248.290968][T13017] dummy0: Caught tx_queue_len zero misconfig [ 248.377726][T13024] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 248.463081][T13024] syzkaller0: entered promiscuous mode [ 248.471018][T12977] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 248.477571][T13024] syzkaller0: entered allmulticast mode [ 248.490325][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2041'. [ 248.501094][T13032] netlink: 'syz.0.2041': attribute type 30 has an invalid length. [ 248.549987][T10676] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.567597][T10676] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.597320][T10676] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.626735][T10676] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.761908][T13054] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2046'. [ 248.774251][T13054] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2046'. [ 248.936921][T13067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2050'. [ 248.980806][T13070] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2051'. [ 249.434458][T13101] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 249.628919][T13114] netlink: 'syz.0.2063': attribute type 1 has an invalid length. [ 249.660946][T13119] FAULT_INJECTION: forcing a failure. [ 249.660946][T13119] name failslab, interval 1, probability 0, space 0, times 0 [ 249.697708][T13119] CPU: 0 UID: 0 PID: 13119 Comm: syz.3.2066 Not tainted syzkaller #0 PREEMPT(full) [ 249.697731][T13119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 249.697740][T13119] Call Trace: [ 249.697746][T13119] [ 249.697752][T13119] dump_stack_lvl+0x189/0x250 [ 249.697776][T13119] ? __pfx____ratelimit+0x10/0x10 [ 249.697793][T13119] ? __pfx_dump_stack_lvl+0x10/0x10 [ 249.697813][T13119] ? __pfx__printk+0x10/0x10 [ 249.697835][T13119] ? __pfx___might_resched+0x10/0x10 [ 249.697858][T13119] should_fail_ex+0x414/0x560 [ 249.697881][T13119] should_failslab+0xa8/0x100 [ 249.697901][T13119] __kmalloc_cache_noprof+0x6f/0x6f0 [ 249.697920][T13119] ? alloc_pipe_info+0xe9/0x4d0 [ 249.697946][T13119] alloc_pipe_info+0xe9/0x4d0 [ 249.697973][T13119] splice_direct_to_actor+0xa5d/0xcc0 [ 249.697996][T13119] ? __lock_acquire+0xab9/0xd20 [ 249.698018][T13119] ? __pfx_aa_file_perm+0x10/0x10 [ 249.698031][T13119] ? __lock_acquire+0xab9/0xd20 [ 249.698043][T13119] ? __pfx_direct_splice_actor+0x10/0x10 [ 249.698062][T13119] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 249.698091][T13119] do_splice_direct+0x181/0x270 [ 249.698116][T13119] ? __pfx_do_splice_direct+0x10/0x10 [ 249.698134][T13119] ? common_file_perm+0x1b5/0x230 [ 249.698154][T13119] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 249.698171][T13119] ? bpf_lsm_file_permission+0x9/0x20 [ 249.698187][T13119] ? security_file_permission+0x75/0x290 [ 249.698204][T13119] ? rw_verify_area+0x255/0x4d0 [ 249.698226][T13119] do_sendfile+0x4da/0x7e0 [ 249.698253][T13119] ? __pfx_vfs_write+0x10/0x10 [ 249.698277][T13119] ? __pfx_do_sendfile+0x10/0x10 [ 249.698292][T13119] ? __fget_files+0x3a0/0x420 [ 249.698318][T13119] __se_sys_sendfile64+0x13e/0x190 [ 249.698339][T13119] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 249.698361][T13119] ? do_syscall_64+0xbe/0xfa0 [ 249.698386][T13119] do_syscall_64+0xfa/0xfa0 [ 249.698406][T13119] ? lockdep_hardirqs_on+0x9c/0x150 [ 249.698426][T13119] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.698443][T13119] ? clear_bhb_loop+0x60/0xb0 [ 249.698464][T13119] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.698477][T13119] RIP: 0033:0x7f17f878efc9 [ 249.698492][T13119] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 249.698504][T13119] RSP: 002b:00007f17f96fc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 249.698520][T13119] RAX: ffffffffffffffda RBX: 00007f17f89e5fa0 RCX: 00007f17f878efc9 [ 249.698532][T13119] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000003 [ 249.698541][T13119] RBP: 00007f17f96fc090 R08: 0000000000000000 R09: 0000000000000000 [ 249.698551][T13119] R10: 0000020000000002 R11: 0000000000000246 R12: 0000000000000001 [ 249.698561][T13119] R13: 00007f17f89e6038 R14: 00007f17f89e5fa0 R15: 00007fffe24a8d18 [ 249.698589][T13119] [ 249.985869][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 250.087531][T13126] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 250.232745][T13144] tipc: Enabled bearer , priority 0 [ 250.241080][T13144] syzkaller0: entered promiscuous mode [ 250.247987][T13144] syzkaller0: entered allmulticast mode [ 250.289606][T13142] tipc: Resetting bearer [ 250.344934][T13142] tipc: Disabling bearer [ 250.493880][T13163] xt_recent: Unsupported userspace flags (000000b1) [ 250.606636][T13173] FAULT_INJECTION: forcing a failure. [ 250.606636][T13173] name failslab, interval 1, probability 0, space 0, times 0 [ 250.671051][T13173] CPU: 0 UID: 0 PID: 13173 Comm: syz.4.2080 Not tainted syzkaller #0 PREEMPT(full) [ 250.671077][T13173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 250.671087][T13173] Call Trace: [ 250.671095][T13173] [ 250.671103][T13173] dump_stack_lvl+0x189/0x250 [ 250.671131][T13173] ? __pfx____ratelimit+0x10/0x10 [ 250.671152][T13173] ? __pfx_dump_stack_lvl+0x10/0x10 [ 250.671175][T13173] ? __pfx__printk+0x10/0x10 [ 250.671200][T13173] ? __pfx___might_resched+0x10/0x10 [ 250.671217][T13173] ? fs_reclaim_acquire+0x7d/0x100 [ 250.671247][T13173] should_fail_ex+0x414/0x560 [ 250.671277][T13173] should_failslab+0xa8/0x100 [ 250.671296][T13173] __kmalloc_noprof+0xcb/0x7f0 [ 250.671319][T13173] ? alloc_pipe_info+0x1fd/0x4d0 [ 250.671355][T13173] alloc_pipe_info+0x1fd/0x4d0 [ 250.671381][T13173] splice_direct_to_actor+0xa5d/0xcc0 [ 250.671409][T13173] ? __lock_acquire+0xab9/0xd20 [ 250.671439][T13173] ? __pfx_aa_file_perm+0x10/0x10 [ 250.671454][T13173] ? __lock_acquire+0xab9/0xd20 [ 250.671471][T13173] ? __pfx_direct_splice_actor+0x10/0x10 [ 250.671496][T13173] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 250.671532][T13173] do_splice_direct+0x181/0x270 [ 250.671560][T13173] ? __pfx_do_splice_direct+0x10/0x10 [ 250.671582][T13173] ? common_file_perm+0x1b5/0x230 [ 250.671606][T13173] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 250.671626][T13173] ? bpf_lsm_file_permission+0x9/0x20 [ 250.671645][T13173] ? security_file_permission+0x75/0x290 [ 250.671667][T13173] ? rw_verify_area+0x255/0x4d0 [ 250.671694][T13173] do_sendfile+0x4da/0x7e0 [ 250.671712][T13173] ? __pfx_vfs_write+0x10/0x10 [ 250.671741][T13173] ? __pfx_do_sendfile+0x10/0x10 [ 250.671761][T13173] ? __fget_files+0x3a0/0x420 [ 250.671788][T13173] __se_sys_sendfile64+0x13e/0x190 [ 250.671810][T13173] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 250.671832][T13173] ? do_syscall_64+0xbe/0xfa0 [ 250.671857][T13173] do_syscall_64+0xfa/0xfa0 [ 250.671877][T13173] ? lockdep_hardirqs_on+0x9c/0x150 [ 250.671899][T13173] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.671916][T13173] ? clear_bhb_loop+0x60/0xb0 [ 250.671938][T13173] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.671955][T13173] RIP: 0033:0x7f42dab8efc9 [ 250.671971][T13173] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 250.671987][T13173] RSP: 002b:00007f42db995038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 250.672006][T13173] RAX: ffffffffffffffda RBX: 00007f42dade5fa0 RCX: 00007f42dab8efc9 [ 250.672019][T13173] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000003 [ 250.672030][T13173] RBP: 00007f42db995090 R08: 0000000000000000 R09: 0000000000000000 [ 250.672041][T13173] R10: 0000020000000002 R11: 0000000000000246 R12: 0000000000000001 [ 250.672053][T13173] R13: 00007f42dade6038 R14: 00007f42dade5fa0 R15: 00007ffcbc278f38 [ 250.672088][T13173] [ 251.946075][T13247] bond10: option mode: invalid value (133) [ 251.955822][T13247] bond10 (unregistering): Released all slaves [ 252.067286][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 252.228262][T13270] netlink: 'syz.0.2118': attribute type 3 has an invalid length. [ 252.256639][T13273] __nla_validate_parse: 11 callbacks suppressed [ 252.256656][T13273] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2119'. [ 252.288307][T13278] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2121'. [ 252.773945][T13323] netlink: 'syz.3.2136': attribute type 4 has an invalid length. [ 252.800270][T13323] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2136'. [ 252.804149][T13326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2137'. [ 252.827479][T13326] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2137'. [ 252.855760][T13326] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 253.074697][T13342] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 253.101674][T13342] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 253.145583][T13350] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2146'. [ 253.247832][T13352] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2147'. [ 253.262860][ T9367] tipc: Subscription rejected, illegal request [ 253.276332][T13357] netlink: 'syz.3.2149': attribute type 26 has an invalid length. [ 253.401324][T13369] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 253.584110][T13380] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2157'. [ 253.593013][T13380] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2157'. [ 253.630926][T13382] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2161'. [ 253.648702][T13389] wg1: entered promiscuous mode [ 253.662826][T13389] wg1: entered allmulticast mode [ 253.730948][T13382] 8021q: adding VLAN 0 to HW filter on device bond8 [ 253.871559][T13382] 8021q: adding VLAN 0 to HW filter on device bond8 [ 253.918747][T13382] bond8: (slave vxcan1): The slave device specified does not support setting the MAC address [ 253.956009][T13382] bond8: (slave vxcan1): Error -95 calling set_mac_address [ 254.006646][T13409] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 254.049813][T13413] netlink: 'syz.3.2168': attribute type 33 has an invalid length. [ 254.300338][T13431] block nbd3: not configured, cannot reconfigure [ 254.455633][T13444] vlan2: entered allmulticast mode [ 254.542619][T13458] netlink: 'syz.0.2179': attribute type 1 has an invalid length. [ 254.805030][T13478] netlink: 'syz.4.2185': attribute type 75 has an invalid length. [ 255.237893][T13508] netlink: 'syz.4.2194': attribute type 3 has an invalid length. [ 255.331891][T13514] bond0 (unregistering): Released all slaves [ 255.408293][T13525] unsupported nla_type 52263 [ 255.453799][T13514] netlink: 'syz.2.2196': attribute type 1 has an invalid length. [ 255.561855][T13539] tipc: Enabled bearer , priority 0 [ 255.580264][T13539] syzkaller0: entered promiscuous mode [ 255.598978][T13539] syzkaller0: entered allmulticast mode [ 255.671955][T13539] tipc: Resetting bearer [ 255.712607][T13538] tipc: Resetting bearer [ 255.772530][T13538] tipc: Disabling bearer [ 255.792626][T13547] tipc: Enabled bearer , priority 0 [ 255.813807][T13560] openvswitch: netlink: Tunnel attr 15060 out of range max 16 [ 255.822910][T13547] tipc: Disabling bearer [ 256.237706][T13590] syzkaller0: entered promiscuous mode [ 256.261638][T13590] syzkaller0: entered allmulticast mode [ 256.327631][T13595] lo: entered allmulticast mode [ 256.336513][T13592] lo: left allmulticast mode [ 256.529259][T13608] tipc: Enabling of bearer rejected, media not registered [ 256.536611][T13613] netlink: 'syz.0.2231': attribute type 1 has an invalid length. [ 256.609596][T13613] 8021q: adding VLAN 0 to HW filter on device bond10 [ 256.659144][T13616] 8021q: adding VLAN 0 to HW filter on device bond10 [ 256.672604][T13616] bond10: (slave vxcan7): The slave device specified does not support setting the MAC address [ 256.699623][T13616] bond10: (slave vxcan7): Error -95 calling set_mac_address [ 256.802632][T13613] veth1: entered promiscuous mode [ 256.816664][T13613] bond10: (slave veth1): Enslaving as an active interface with a down link [ 256.866135][T13624] vlan0: entered allmulticast mode [ 256.871315][T13624] bond10: entered allmulticast mode [ 256.931110][T13635] IPVS: set_ctl: invalid protocol: 217 224.0.0.2:21 [ 257.184434][T13649] bond0: entered allmulticast mode [ 257.242819][T13655] netlink: 'syz.4.2242': attribute type 25 has an invalid length. [ 257.266427][T13655] __nla_validate_parse: 13 callbacks suppressed [ 257.266441][T13655] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2242'. [ 257.284899][T13659] netlink: 'syz.4.2242': attribute type 25 has an invalid length. [ 257.286792][T13657] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2243'. [ 257.292714][T13659] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2242'. [ 257.351669][T13667] netlink: 'syz.2.2245': attribute type 1 has an invalid length. [ 257.494100][T13670] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 257.669180][T13685] netlink: 14560 bytes leftover after parsing attributes in process `syz.2.2250'. [ 258.002088][T13711] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2259'. [ 258.043727][T13716] tipc: Enabled bearer , priority 0 [ 258.084518][T13718] syzkaller0: entered promiscuous mode [ 258.102862][T13718] syzkaller0: entered allmulticast mode [ 258.123800][T13725] openvswitch: netlink: Duplicate key (type 1). [ 258.135737][T13721] C: renamed from lo (while UP) [ 258.167127][T13716] tipc: Resetting bearer [ 258.255577][T13730] tipc: Resetting bearer [ 258.295391][T13730] tipc: Disabling bearer [ 258.309232][T13734] batman_adv: batadv0: Adding interface: netdevsim0 [ 258.316119][T13734] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 258.347053][T13734] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 258.369288][T13739] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2264'. [ 258.561632][T13748] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2266'. [ 258.616179][T13752] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 258.827008][T13769] 8021q: adding VLAN 0 to HW filter on device bond7 [ 258.908618][T13774] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2277'. [ 259.046368][T13777] validate_nla: 3 callbacks suppressed [ 259.046385][T13777] netlink: 'syz.3.2276': attribute type 8 has an invalid length. [ 259.561015][T13807] set match dimension is over the limit! [ 259.834562][T13820] netlink: 'syz.1.2290': attribute type 7 has an invalid length. [ 259.842337][T13820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2290'. [ 259.914429][T13825] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2292'. [ 260.039109][T13830] 8021q: adding VLAN 0 to HW filter on device bond8 [ 260.077402][T13833] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 260.129293][T13833] IPVS: Unknown mcast interface: vcan0 [ 260.247919][T13849] FAULT_INJECTION: forcing a failure. [ 260.247919][T13849] name failslab, interval 1, probability 0, space 0, times 0 [ 260.262877][T13849] CPU: 0 UID: 0 PID: 13849 Comm: syz.0.2299 Not tainted syzkaller #0 PREEMPT(full) [ 260.262902][T13849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 260.262912][T13849] Call Trace: [ 260.262920][T13849] [ 260.262928][T13849] dump_stack_lvl+0x189/0x250 [ 260.262956][T13849] ? __pfx____ratelimit+0x10/0x10 [ 260.262977][T13849] ? __pfx_dump_stack_lvl+0x10/0x10 [ 260.263000][T13849] ? __pfx__printk+0x10/0x10 [ 260.263024][T13849] ? __pfx___might_resched+0x10/0x10 [ 260.263057][T13849] should_fail_ex+0x414/0x560 [ 260.263087][T13849] should_failslab+0xa8/0x100 [ 260.263108][T13849] __kmalloc_cache_noprof+0x6f/0x6f0 [ 260.263133][T13849] ? alloc_pipe_info+0xe9/0x4d0 [ 260.263164][T13849] alloc_pipe_info+0xe9/0x4d0 [ 260.263190][T13849] splice_direct_to_actor+0xa5d/0xcc0 [ 260.263221][T13849] ? __lock_acquire+0xab9/0xd20 [ 260.263246][T13849] ? __pfx_aa_file_perm+0x10/0x10 [ 260.263262][T13849] ? __lock_acquire+0xab9/0xd20 [ 260.263277][T13849] ? __pfx_direct_splice_actor+0x10/0x10 [ 260.263300][T13849] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 260.263332][T13849] do_splice_direct+0x181/0x270 [ 260.263358][T13849] ? __pfx_do_splice_direct+0x10/0x10 [ 260.263381][T13849] ? common_file_perm+0x1b5/0x230 [ 260.263404][T13849] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 260.263423][T13849] ? bpf_lsm_file_permission+0x9/0x20 [ 260.263441][T13849] ? security_file_permission+0x75/0x290 [ 260.263461][T13849] ? rw_verify_area+0x255/0x4d0 [ 260.263487][T13849] do_sendfile+0x4da/0x7e0 [ 260.263506][T13849] ? __pfx_vfs_write+0x10/0x10 [ 260.263534][T13849] ? __pfx_do_sendfile+0x10/0x10 [ 260.263550][T13849] ? __fget_files+0x3a0/0x420 [ 260.263576][T13849] __se_sys_sendfile64+0x13e/0x190 [ 260.263594][T13849] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 260.263615][T13849] ? do_syscall_64+0xbe/0xfa0 [ 260.263636][T13849] do_syscall_64+0xfa/0xfa0 [ 260.263654][T13849] ? lockdep_hardirqs_on+0x9c/0x150 [ 260.263674][T13849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.263689][T13849] ? clear_bhb_loop+0x60/0xb0 [ 260.263709][T13849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.263725][T13849] RIP: 0033:0x7f90c318efc9 [ 260.263740][T13849] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 260.263753][T13849] RSP: 002b:00007f90c4114038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 260.263771][T13849] RAX: ffffffffffffffda RBX: 00007f90c33e5fa0 RCX: 00007f90c318efc9 [ 260.263783][T13849] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000003 [ 260.263792][T13849] RBP: 00007f90c4114090 R08: 0000000000000000 R09: 0000000000000000 [ 260.263802][T13849] R10: 0000020000000002 R11: 0000000000000246 R12: 0000000000000001 [ 260.263814][T13849] R13: 00007f90c33e6038 R14: 00007f90c33e5fa0 R15: 00007ffdaff43ca8 [ 260.263842][T13849] [ 260.810008][T13871] bridge0: port 2(syz_tun) entered blocking state [ 260.849521][T13871] bridge0: port 2(syz_tun) entered disabled state [ 260.856940][T13871] syz_tun: entered allmulticast mode [ 260.864793][T13873] netlink: 'syz.4.2307': attribute type 10 has an invalid length. [ 260.879854][T13872] netlink: 'syz.4.2307': attribute type 10 has an invalid length. [ 260.884396][T13871] syz_tun: entered promiscuous mode [ 260.911295][T13873] bridge0: port 2(syz_tun) entered blocking state [ 260.917933][T13873] bridge0: port 2(syz_tun) entered forwarding state [ 260.931876][T13873] `: (slave bridge0): Enslaving as an active interface with an up link [ 260.940579][T13872] bridge0: port 2(syz_tun) entered disabled state [ 260.956640][T13884] lo: entered allmulticast mode [ 260.961703][T13886] veth0_to_team: entered promiscuous mode [ 261.003034][T13871] __ib_cache_gid_add: unable to add gid fe80:0000:0000:0000:a8aa:aaff:feaa:aa17 error=-28 [ 261.045651][T13888] x_tables: duplicate underflow at hook 2 [ 261.209015][T13908] netlink: 'syz.1.2311': attribute type 10 has an invalid length. [ 261.346620][T13871] infiniband syz1: set active [ 261.352465][T13871] infiniband syz1: added syz_tun [ 261.409422][T13871] RDS/IB: syz1: added [ 261.414024][T13871] smc: adding ib device syz1 with port count 1 [ 261.420329][T13871] smc: ib device syz1 port 1 has no pnetid [ 261.625538][T13921] delete_channel: no stack [ 261.806068][T13934] 8021q: VLANs not supported on lo [ 261.839036][T13939] tipc: Enabled bearer , priority 0 [ 261.861779][T13939] syzkaller0: entered promiscuous mode [ 261.880813][T13939] syzkaller0: entered allmulticast mode [ 261.937248][T13939] tipc: Resetting bearer [ 261.964505][T13937] tipc: Resetting bearer [ 262.015250][T13937] tipc: Disabling bearer [ 262.092391][T13953] netlink: zone id is out of range [ 262.121692][T13953] netlink: zone id is out of range [ 262.142702][T13953] netlink: zone id is out of range [ 262.159316][T13953] netlink: zone id is out of range [ 262.183653][T13953] netlink: zone id is out of range [ 262.200729][T13953] netlink: zone id is out of range [ 262.219772][T13953] netlink: zone id is out of range [ 262.228338][T13953] netlink: zone id is out of range [ 262.243684][T13953] netlink: zone id is out of range [ 262.249122][T13958] nbd: illegal input index -8454144 [ 262.266502][T13953] netlink: zone id is out of range [ 262.416525][T13970] Cannot find del_set index 4 as target [ 262.811398][T13991] syz.0.2343 (13991) used obsolete PPPIOCDETACH ioctl [ 262.822847][T13997] tipc: Enabled bearer , priority 0 [ 262.878626][T13997] syzkaller0: entered promiscuous mode [ 262.884470][T13997] syzkaller0: entered allmulticast mode [ 262.891564][T13999] __nla_validate_parse: 8 callbacks suppressed [ 262.891578][T13999] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2344'. [ 262.897122][T13992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2341'. [ 262.924710][T13999] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2344'. [ 263.052455][T14000] tipc: Resetting bearer [ 263.065270][T13995] tipc: Resetting bearer [ 263.104692][T13995] tipc: Disabling bearer [ 263.126464][T14007] bridge7: entered promiscuous mode [ 263.140310][T14007] bridge7: entered allmulticast mode [ 263.171217][T14006] 8021q: adding VLAN 0 to HW filter on device bond4 [ 263.182265][T14006] bond0: (slave bond4): Enslaving as an active interface with a down link [ 263.606109][T14022] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2352'. [ 263.835861][T14039] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2357'. [ 264.482635][T14093] veth1_macvtap: left promiscuous mode [ 264.490978][T14093] macsec0: entered promiscuous mode [ 264.497396][T14093] macsec0: entered allmulticast mode [ 264.528000][T14089] ip6gre1: entered allmulticast mode [ 264.566036][T14093] veth1_macvtap: entered promiscuous mode [ 264.571794][T14093] veth1_macvtap: entered allmulticast mode [ 264.602833][T14093] macsec0: left promiscuous mode [ 264.624251][T14093] macsec0: left allmulticast mode [ 264.636323][T14093] veth1_macvtap: left allmulticast mode [ 265.046043][T14134] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2387'. [ 265.091794][T14134] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2387'. [ 265.181444][T14139] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2389'. [ 265.200995][T14139] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2389'. [ 265.275527][T14143] syzkaller0: entered promiscuous mode [ 265.281204][T14143] syzkaller0: entered allmulticast mode [ 265.290039][T14143] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 265.311242][T14146] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2393'. [ 265.357919][T14146] netlink: 'syz.1.2393': attribute type 2 has an invalid length. [ 265.365959][T14146] netlink: 'syz.1.2393': attribute type 4 has an invalid length. [ 265.707054][ T30] audit: type=1107 audit(1761816762.338:9): pid=14176 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 265.927331][T14191] netlink: 'syz.0.2409': attribute type 1 has an invalid length. [ 266.078806][T14209] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 266.157746][T14212] sock: sock_timestamping_bind_phc: sock not bind to device [ 266.381742][T14226] netlink: 'syz.2.2416': attribute type 3 has an invalid length. [ 266.424256][T14226] netlink: 'syz.2.2416': attribute type 10 has an invalid length. [ 266.643740][T14242] netlink: 'syz.2.2423': attribute type 1 has an invalid length. [ 266.663893][T14242] netlink: 'syz.2.2423': attribute type 3 has an invalid length. [ 266.683045][T14242] netlink: 'syz.2.2423': attribute type 10 has an invalid length. [ 266.828152][T14250] veth1_vlan: left promiscuous mode [ 266.838524][T14250] netlink: 'syz.4.2426': attribute type 1 has an invalid length. [ 266.868508][T14250] netlink: 'syz.4.2426': attribute type 2 has an invalid length. [ 267.061381][T14217] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 267.062922][T14267] IPVS: set_ctl: invalid protocol: 1 172.20.20.47:20004 [ 267.345796][T14280] bond5 (unregistering): Released all slaves [ 267.924965][T14323] bond5: Setting coupled_control to off (0) [ 267.986003][T14321] macvtap4: entered promiscuous mode [ 267.991525][T14321] macvtap4: entered allmulticast mode [ 268.079928][T14336] __nla_validate_parse: 13 callbacks suppressed [ 268.079946][T14336] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2450'. [ 268.180708][T14343] smc: net device vcan0 applied user defined pnetid SYZ1 [ 268.263093][T14350] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2456'. [ 268.638885][T14372] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2465'. [ 268.684698][T14372] vcan0 (unregistering): left allmulticast mode [ 269.333605][T14407] 8021q: adding VLAN 0 to HW filter on device bond10 [ 269.360527][T14407] bond10: (slave ip6gretap1): making interface the new active one [ 269.369989][T14407] bond10: (slave ip6gretap1): Enslaving as an active interface with an up link [ 269.407566][T14407] net_ratelimit: 54 callbacks suppressed [ 269.407583][T14407] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 269.431393][T14412] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2482'. [ 269.709840][T14425] syzkaller0: entered promiscuous mode [ 269.716053][T14425] syzkaller0: entered allmulticast mode [ 269.764073][T14433] gtp0: entered promiscuous mode [ 269.769056][T14433] gtp0: entered allmulticast mode [ 269.892472][T14441] xt_HMARK: spi-set and port-set can't be combined [ 269.916434][T14443] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 270.009194][T14449] bond12: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 270.064386][T14449] bond12 (unregistering): Released all slaves [ 270.145176][T14460] syz.2.2495 uses old SIOCAX25GETINFO [ 270.265001][T14464] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2496'. [ 270.380336][T14475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2500'. [ 270.390007][T14478] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2501'. [ 270.430303][T14479] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2501'. [ 270.491750][T14485] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2502'. [ 270.807180][T14504] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2508'. [ 271.022471][T14519] validate_nla: 8 callbacks suppressed [ 271.022488][T14519] netlink: 'syz.1.2511': attribute type 1 has an invalid length. [ 271.226168][T14529] xt_l2tp: wrong L2TP version: 0 [ 271.321054][T14540] ip6t_srh: unknown srh invflags 4000 [ 271.398076][T14546] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 271.893322][T14582] netlink: 'syz.2.2531': attribute type 13 has an invalid length. [ 271.906952][T14581] syzkaller0: entered promiscuous mode [ 271.912464][T14581] syzkaller0: entered allmulticast mode [ 272.079557][T14592] tipc: Enabling of bearer rejected, already enabled [ 272.377104][T14617] netlink: 'syz.1.2540': attribute type 11 has an invalid length. [ 272.415695][T14617] netlink: 'syz.1.2540': attribute type 11 has an invalid length. [ 273.396606][T14683] __nla_validate_parse: 7 callbacks suppressed [ 273.396624][T14683] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2552'. [ 273.640284][T14695] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2555'. [ 274.081661][T14714] tipc: Enabled bearer , priority 0 [ 274.124547][T14714] syzkaller0: entered promiscuous mode [ 274.187998][T14714] syzkaller0: entered allmulticast mode [ 274.267964][T14730] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2562'. [ 274.318707][T14714] tipc: Resetting bearer [ 274.388916][T14714] tipc: Disabling bearer [ 274.825051][T14762] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2570'. [ 274.857058][T14762] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2570'. [ 274.910126][T14765] bond9: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 274.934105][T14765] bond9 (unregistering): Released all slaves [ 274.973952][T14767] syzkaller1: entered promiscuous mode [ 274.979527][T14767] syzkaller1: entered allmulticast mode [ 274.990654][T14767] xt_ecn: cannot match TCP bits for non-tcp packets [ 275.121292][T14778] netlink: 'syz.0.2578': attribute type 10 has an invalid length. [ 275.148289][T14776] xt_policy: too many policy elements [ 275.154260][T14780] syzkaller0: entered promiscuous mode [ 275.164667][T14780] syzkaller0: entered allmulticast mode [ 275.237566][T14776] 8021q: adding VLAN 0 to HW filter on device bond6 [ 275.295595][T14780] netlink: 71 bytes leftover after parsing attributes in process `syz.4.2577'. [ 275.601023][T14817] IPVS: length: 4096 != 24 [ 275.691952][T14827] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2590'. [ 275.706875][T14825] tipc: Enabled bearer , priority 0 [ 275.718898][T14825] tipc: Resetting bearer [ 275.737056][T14821] tipc: Disabling bearer [ 275.767520][T14829] pim6reg1: entered promiscuous mode [ 275.772844][T14829] pim6reg1: entered allmulticast mode [ 275.944373][T14844] netlink: 'syz.1.2595': attribute type 3 has an invalid length. [ 275.994867][T14848] netlink: 'syz.1.2595': attribute type 3 has an invalid length. [ 276.116097][T14858] netlink: 'syz.2.2598': attribute type 6 has an invalid length. [ 276.173976][ T5899] IPVS: starting estimator thread 0... [ 276.201663][T14862] netlink: 'syz.1.2599': attribute type 1 has an invalid length. [ 276.273322][T14863] IPVS: using max 27 ests per chain, 64800 per kthread [ 276.291915][T14872] openvswitch: netlink: Flow key attribute not present in set flow. [ 276.307978][T14869] netlink: 'syz.4.2604': attribute type 21 has an invalid length. [ 276.326652][T14875] netlink: 'syz.3.2605': attribute type 7 has an invalid length. [ 276.368946][T14876] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2603'. [ 276.419688][T14876] netlink: 'syz.2.2603': attribute type 2 has an invalid length. [ 276.441631][T14876] bridge0: mtu less than device minimum [ 276.468750][T14876] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2603'. [ 276.515097][T14876] !: renamed from dummy0 (while UP) [ 276.696491][T14896] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 276.738988][T14898] vcan0: tx address claim with different name [ 276.815579][T14905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2613'. [ 276.859248][T14908] vlan3: entered promiscuous mode [ 276.864580][T14908] vlan3: entered allmulticast mode [ 276.869696][T14908] hsr_slave_1: entered allmulticast mode [ 276.893910][T14905] netlink: 'syz.2.2613': attribute type 14 has an invalid length. [ 276.901752][T14905] netlink: 'syz.2.2613': attribute type 13 has an invalid length. [ 276.977330][T14916] unsupported nlmsg_type 40 [ 277.086387][T14928] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 277.102599][T14922] bond11: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 277.208792][T14922] bond11 (unregistering): Released all slaves [ 277.460896][T14937] netlink: 'syz.3.2623': attribute type 11 has an invalid length. [ 277.657065][T14951] syzkaller0: entered promiscuous mode [ 277.662837][T14951] syzkaller0: entered allmulticast mode [ 277.737310][T14957] mac80211_hwsim hwsim18 : renamed from wlan0 [ 277.781814][T14954] netlink: 'syz.4.2628': attribute type 1 has an invalid length. [ 277.896002][T14959] ip6tnl3: entered promiscuous mode [ 277.901247][T14959] ip6tnl3: entered allmulticast mode [ 278.196259][T14980] netlink: 'syz.0.2635': attribute type 7 has an invalid length. [ 278.409434][T14988] bond9: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 278.455243][T10678] bond9: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 278.456272][T14988] 8021q: adding VLAN 0 to HW filter on device bond9 [ 278.475660][T14990] __nla_validate_parse: 8 callbacks suppressed [ 278.475674][T14990] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2639'. [ 278.595123][T10678] bond9: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 279.071566][T15028] bond11: (slave vxcan5): The slave device specified does not support setting the MAC address [ 279.107706][T15021] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2648'. [ 279.125018][T15028] bond11: (slave vxcan5): Error -95 calling set_mac_address [ 279.193087][T15035] gretap1: entered promiscuous mode [ 279.220221][T15035] bond11: (slave gretap1): making interface the new active one [ 279.229089][T15035] bond11: (slave gretap1): Enslaving as an active interface with an up link [ 279.257510][T15042] macvlan0: entered promiscuous mode [ 279.275527][T15042] macvlan0: entered allmulticast mode [ 279.391256][T15053] syzkaller0: entered promiscuous mode [ 279.423306][T15058] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2657'. [ 279.424586][T15053] syzkaller0: entered allmulticast mode [ 279.443009][T10678] syzkaller0: tun_net_xmit 70 [ 279.709039][T15079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2665'. [ 279.841640][T15091] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2666'. [ 280.038755][T15102] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2670'. [ 280.186129][T15107] 8021q: adding VLAN 0 to HW filter on device bond12 [ 280.233763][T15107] veth19: entered promiscuous mode [ 280.247344][T15107] bond12: (slave veth19): Enslaving as an active interface with a down link [ 280.277062][T15107] veth21: entered promiscuous mode [ 280.286848][T15107] bond12: (slave veth21): Enslaving as an active interface with a down link [ 280.310549][T15107] bond12: entered allmulticast mode [ 280.350960][T15107] macvtap5: entered allmulticast mode [ 280.400221][T15121] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2674'. [ 280.480094][T15127] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2676'. [ 280.730827][T15136] bond12: invalid ARP target 0.0.0.0 specified for addition [ 280.745245][T15136] bond12: option arp_ip_target: invalid value (0) [ 280.755633][T15136] bond12 (unregistering): Released all slaves [ 280.787104][T15146] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2682'. [ 280.796815][T15146] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2682'. [ 281.245654][T15164] bridge_slave_1: entered promiscuous mode [ 281.668225][T15184] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 281.922966][T15205] validate_nla: 5 callbacks suppressed [ 281.922984][T15205] netlink: 'syz.3.2698': attribute type 62 has an invalid length. [ 282.331598][T15234] netlink: 'syz.1.2703': attribute type 1 has an invalid length. [ 282.689810][T15261] netlink: 'syz.2.2710': attribute type 5 has an invalid length. [ 282.764262][T15262] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 282.799878][T15267] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 282.859247][T15273] netlink: 'syz.3.2713': attribute type 10 has an invalid length. [ 282.901199][T15276] netlink: 'syz.4.2712': attribute type 10 has an invalid length. [ 282.955961][T15282] sit0: Caught tx_queue_len zero misconfig [ 282.987803][T15283] bond9: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 283.005293][T15283] bond9 (unregistering): Released all slaves [ 283.127318][T15290] veth1_macvtap: left promiscuous mode [ 283.444303][T15311] netlink: 'syz.1.2724': attribute type 4 has an invalid length. [ 283.537263][T15320] __nla_validate_parse: 9 callbacks suppressed [ 283.537276][T15320] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2726'. [ 284.439921][T15359] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2737'. [ 284.470514][T15351] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2736'. [ 284.909485][T15392] netlink: 232 bytes leftover after parsing attributes in process `syz.4.2746'. [ 285.053160][T15402] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2750'. [ 285.166084][T15408] netlink: 'syz.3.2754': attribute type 22 has an invalid length. [ 285.179096][T15408] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2754'. [ 285.256762][T15408] netlink: 'syz.3.2754': attribute type 22 has an invalid length. [ 285.271977][T15408] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2754'. [ 285.490271][T15431] netlink: 'syz.4.2761': attribute type 1 has an invalid length. [ 285.499631][T15421] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2759'. [ 285.547201][T15431] 8021q: adding VLAN 0 to HW filter on device bond10 [ 285.655366][T15440] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 285.674092][T15436] veth3: entered promiscuous mode [ 285.685727][T15436] bond10: (slave veth3): Enslaving as an active interface with an up link [ 285.705896][T15440] batadv_slave_1: entered promiscuous mode [ 285.791447][T15438] batadv_slave_1: left promiscuous mode [ 285.931621][T15468] netlink: 'syz.2.2771': attribute type 1 has an invalid length. [ 286.020218][T15468] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 286.197975][T15485] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2776'. [ 286.219011][T15491] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2777'. [ 286.548902][T15521] FAULT_INJECTION: forcing a failure. [ 286.548902][T15521] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.563423][T15521] CPU: 0 UID: 0 PID: 15521 Comm: syz.1.2786 Not tainted syzkaller #0 PREEMPT(full) [ 286.563448][T15521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 286.563459][T15521] Call Trace: [ 286.563466][T15521] [ 286.563475][T15521] dump_stack_lvl+0x189/0x250 [ 286.563501][T15521] ? __pfx____ratelimit+0x10/0x10 [ 286.563529][T15521] ? __pfx_dump_stack_lvl+0x10/0x10 [ 286.563552][T15521] ? __pfx__printk+0x10/0x10 [ 286.563570][T15521] ? __might_fault+0xb0/0x130 [ 286.563605][T15521] should_fail_ex+0x414/0x560 [ 286.563635][T15521] _copy_from_user+0x2d/0xb0 [ 286.563657][T15521] ___sys_recvmsg+0x12e/0x510 [ 286.563683][T15521] ? __pfx____sys_recvmsg+0x10/0x10 [ 286.563726][T15521] ? __fget_files+0x3a0/0x420 [ 286.563754][T15521] __x64_sys_recvmsg+0x198/0x260 [ 286.563776][T15521] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 286.563803][T15521] ? __pfx_ksys_write+0x10/0x10 [ 286.563830][T15521] ? do_syscall_64+0xbe/0xfa0 [ 286.563855][T15521] do_syscall_64+0xfa/0xfa0 [ 286.563875][T15521] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.563897][T15521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.563915][T15521] ? clear_bhb_loop+0x60/0xb0 [ 286.563936][T15521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.563953][T15521] RIP: 0033:0x7efd8898efc9 [ 286.563969][T15521] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 286.563985][T15521] RSP: 002b:00007efd898f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 286.564005][T15521] RAX: ffffffffffffffda RBX: 00007efd88be5fa0 RCX: 00007efd8898efc9 [ 286.564018][T15521] RDX: 0000000040010042 RSI: 00002000000002c0 RDI: 0000000000000003 [ 286.564030][T15521] RBP: 00007efd898f0090 R08: 0000000000000000 R09: 0000000000000000 [ 286.564042][T15521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.564052][T15521] R13: 00007efd88be6038 R14: 00007efd88be5fa0 R15: 00007fff217f7f88 [ 286.564084][T15521] [ 286.931150][T15534] gretap0: entered promiscuous mode [ 286.980729][T15534] 0{X: renamed from gretap0 [ 287.006871][T15534] 0{X: left promiscuous mode [ 287.018985][T15534] 0{X: entered allmulticast mode [ 287.050710][T15534] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 287.170809][T15549] syz_tun (unregistering): left allmulticast mode [ 287.180677][T15549] syz_tun (unregistering): left promiscuous mode [ 287.187222][T15549] bridge0: port 2(syz_tun) entered disabled state [ 287.202567][T10678] smc: removing ib device syz1 [ 287.215302][ T5940] syz1: Port: 1 Link DOWN [ 287.215901][T15558] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 287.227891][T15558] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 287.283068][T15554] tipc: Enabled bearer , priority 0 [ 287.344855][T15554] syzkaller0: entered promiscuous mode [ 287.358779][T15554] syzkaller0: entered allmulticast mode [ 287.499896][T15553] tipc: Resetting bearer [ 287.576550][T15553] tipc: Disabling bearer [ 288.107528][T15600] validate_nla: 2 callbacks suppressed [ 288.107544][T15600] netlink: 'syz.0.2809': attribute type 83 has an invalid length. [ 288.171337][T15605] syzkaller1: entered promiscuous mode [ 288.187561][T15605] syzkaller1: entered allmulticast mode [ 288.523685][T15617] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 288.690678][T15629] __nla_validate_parse: 7 callbacks suppressed [ 288.690694][T15629] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2817'. [ 288.742994][T15629] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2817'. [ 289.251005][T15659] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2825'. [ 289.428762][T15659] hsr_slave_0 (unregistering): left promiscuous mode [ 289.452563][T15675] netlink: 'syz.3.2830': attribute type 21 has an invalid length. [ 289.463107][T15675] netlink: 'syz.3.2830': attribute type 6 has an invalid length. [ 289.471603][T15675] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2830'. [ 289.651639][T15689] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2833'. [ 289.685288][T15687] tipc: Enabled bearer , priority 0 [ 289.693517][T15687] syzkaller0: entered promiscuous mode [ 289.705738][T15687] syzkaller0: entered allmulticast mode [ 289.737583][T15687] bond11: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 289.770775][T15687] bond11 (unregistering): Released all slaves [ 289.798772][T15691] pim6reg1: entered promiscuous mode [ 289.804379][T15691] pim6reg1: entered allmulticast mode [ 289.892492][T15686] tipc: Resetting bearer [ 289.919325][T15704] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2839'. [ 289.954563][T15686] tipc: Disabling bearer [ 290.010093][T15714] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2843'. [ 290.041858][T15717] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2844'. [ 290.351205][T15732] IPVS: set_ctl: invalid protocol: 46 172.20.20.27:20003 [ 290.898755][T15756] syzkaller1: entered promiscuous mode [ 290.918701][T15756] syzkaller1: entered allmulticast mode [ 290.920847][T15758] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2858'. [ 290.929310][T15756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2857'. [ 290.958024][ T5149] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 290.967422][T15756] netlink: 'syz.2.2857': attribute type 30 has an invalid length. [ 290.976322][ T5149] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 290.984904][ T5149] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 290.992859][ T5149] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 291.001880][ T5149] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 291.038801][T15762] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 291.049910][T15762] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 291.409782][T15759] chnl_net:caif_netlink_parms(): no params data found [ 291.595608][T15759] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.624772][T15759] bridge0: port 1(bridge_slave_0) entered disabled state [ 291.631999][T15759] bridge_slave_0: entered allmulticast mode [ 291.652705][T15759] bridge_slave_0: entered promiscuous mode [ 291.665054][T15759] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.672358][T15759] bridge0: port 2(bridge_slave_1) entered disabled state [ 291.679689][T15759] bridge_slave_1: entered allmulticast mode [ 291.687867][T15759] bridge_slave_1: entered promiscuous mode [ 291.769998][T15759] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 291.800637][T15759] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 291.839389][T15815] netlink: 'syz.2.2873': attribute type 1 has an invalid length. [ 291.859936][T15815] netlink: 'syz.2.2873': attribute type 2 has an invalid length. [ 291.907591][T15759] team0: Port device team_slave_0 added [ 291.931077][T15759] team0: Port device team_slave_1 added [ 292.032890][T15759] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 292.050103][T15759] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 292.090296][T15759] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 292.120295][T15759] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 292.151574][T15759] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 292.202620][T15759] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 292.310747][T15840] bond12: option arp_all_targets: invalid value (18446744073709551613) [ 292.326480][T15840] bond12 (unregistering): Released all slaves [ 292.381771][T15759] hsr_slave_0: entered promiscuous mode [ 292.390547][T15759] hsr_slave_1: entered promiscuous mode [ 292.402890][T15844] netlink: 'syz.1.2880': attribute type 10 has an invalid length. [ 292.410504][T15759] debugfs: 'hsr0' already exists in 'hsr' [ 292.423301][T15759] Cannot create hsr debugfs directory [ 292.439240][T15844] team0: Device veth1_macvtap failed to register rx_handler [ 292.820135][T15759] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 292.831488][T15759] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.936826][T15759] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 292.953853][T15759] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.999200][T15887] macvlan0: left promiscuous mode [ 293.004488][T15887] macvlan0: left allmulticast mode [ 293.008335][T15889] netlink: 'syz.0.2893': attribute type 3 has an invalid length. [ 293.024121][ T5149] Bluetooth: hci2: command tx timeout [ 293.078540][T15759] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 293.103138][T15759] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.159357][T15895] netlink: 'syz.0.2895': attribute type 10 has an invalid length. [ 293.167672][T15895] bridge0: port 5(team0) entered blocking state [ 293.174424][T15895] bridge0: port 5(team0) entered disabled state [ 293.180931][T15895] team0: entered allmulticast mode [ 293.186973][T15895] team_slave_0: entered allmulticast mode [ 293.192799][T15895] team_slave_1: entered allmulticast mode [ 293.200958][T15895] team0: entered promiscuous mode [ 293.206438][T15895] team_slave_0: entered promiscuous mode [ 293.212307][T15895] team_slave_1: entered promiscuous mode [ 293.230704][T15759] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 293.241278][T15759] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.411783][T15759] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 293.427797][T15759] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 293.453051][T15759] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 293.475807][T15759] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 293.679738][T15759] 8021q: adding VLAN 0 to HW filter on device bond0 [ 293.724801][T15759] 8021q: adding VLAN 0 to HW filter on device team0 [ 293.735705][T15934] __nla_validate_parse: 11 callbacks suppressed [ 293.735728][T15934] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2904'. [ 293.767713][T10662] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.774897][T10662] bridge0: port 1(bridge_slave_0) entered forwarding state [ 293.802957][T15934] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2904'. [ 293.819320][ T3556] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.826476][ T3556] bridge0: port 2(bridge_slave_1) entered forwarding state [ 294.449473][T15759] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 294.531539][T15994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2915'. [ 294.537071][T15759] veth0_vlan: entered promiscuous mode [ 294.558437][T15759] veth1_vlan: entered promiscuous mode [ 294.572549][T15994] macsec1: entered promiscuous mode [ 294.580122][T15994] bridge0: entered promiscuous mode [ 294.586006][T15994] macsec1: entered allmulticast mode [ 294.591293][T15994] bridge0: entered allmulticast mode [ 294.597575][T15994] bridge0: port 1(macsec1) entered blocking state [ 294.604299][T15994] bridge0: port 1(macsec1) entered disabled state [ 294.613552][T15994] bridge0: left allmulticast mode [ 294.618592][T15994] bridge0: left promiscuous mode [ 294.695479][T15759] veth0_macvtap: entered promiscuous mode [ 294.718749][T15759] veth1_macvtap: entered promiscuous mode [ 294.764557][T15759] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 294.792464][T15759] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 294.798124][T16006] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2919'. [ 294.843108][T16006] 8021q: adding VLAN 0 to HW filter on device bond14 [ 294.857110][T16011] bond14: entered allmulticast mode [ 294.872247][T16002] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2917'. [ 294.889773][T16006] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 294.900610][T10667] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.942447][T10667] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.961959][T10667] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.986792][T10662] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.103694][ T5149] Bluetooth: hci2: command tx timeout [ 295.181197][T10667] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 295.208193][T10667] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 295.287424][T10662] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 295.304920][T10662] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 295.557102][T16051] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2930'. [ 295.671952][T16055] netlink: 'syz.4.2932': attribute type 7 has an invalid length. [ 295.684657][T16053] : entered promiscuous mode [ 295.936429][T16064] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 295.966057][T16064] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 296.102546][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 296.113090][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 296.129631][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 296.137992][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 296.147004][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 296.208518][T16071] tipc: Enabled bearer , priority 10 [ 296.271420][T16076] netlink: 'syz.1.2938': attribute type 10 has an invalid length. [ 296.296419][T16080] tipc: Enabling of bearer rejected, already enabled [ 296.338675][T16076] geneve1: entered promiscuous mode [ 296.359194][T16076] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 296.583766][T16094] tipc: Started in network mode [ 296.588667][T16094] tipc: Node identity 8afb741b23bf, cluster identity 4711 [ 296.611062][T16094] tipc: Enabled bearer , priority 0 [ 296.715386][T16094] syzkaller0: entered promiscuous mode [ 296.720897][T16094] syzkaller0: entered allmulticast mode [ 296.730562][T16068] chnl_net:caif_netlink_parms(): no params data found [ 296.747189][T16092] tipc: Resetting bearer [ 296.825483][T16092] tipc: Disabling bearer [ 297.188646][ T5149] Bluetooth: hci2: command tx timeout [ 297.207077][T16135] tipc: New replicast peer: 255.255.255.255 [ 297.217695][T16135] tipc: Enabled bearer , priority 10 [ 297.226153][T16135] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2953'. [ 297.238253][T16135] tipc: Disabling bearer [ 297.245691][T16068] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.252876][T16068] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.274075][T16068] bridge_slave_0: entered allmulticast mode [ 297.282021][T16068] bridge_slave_0: entered promiscuous mode [ 297.325926][T16068] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.333075][T16068] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.351016][T16068] bridge_slave_1: entered allmulticast mode [ 297.362442][T16068] bridge_slave_1: entered promiscuous mode [ 297.489034][T16068] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 297.509393][T16068] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 297.628421][T16152] xt_hashlimit: size too large, truncated to 1048576 [ 297.648386][T16068] team0: Port device team_slave_0 added [ 297.668062][T16068] team0: Port device team_slave_1 added [ 297.776960][T16068] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 297.791907][T16068] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 297.845382][T16068] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 297.892639][T16068] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 297.908823][T16068] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 297.935774][T16068] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 297.975961][T16173] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2966'. [ 298.148438][T16068] hsr_slave_0: entered promiscuous mode [ 298.165981][T16068] hsr_slave_1: entered promiscuous mode [ 298.172291][T16068] debugfs: 'hsr0' already exists in 'hsr' [ 298.205094][T16189] xt_cgroup: path and classid specified [ 298.205322][T16068] Cannot create hsr debugfs directory [ 298.227659][ T5149] Bluetooth: hci3: command tx timeout [ 298.485313][T16195] netlink: 'syz.3.2972': attribute type 1 has an invalid length. [ 298.586214][T16211] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2979'. [ 298.622090][T16215] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2978'. [ 298.689156][T16217] netlink: 'syz.4.2981': attribute type 1 has an invalid length. [ 298.753989][T16068] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 298.902383][T16238] __nla_validate_parse: 2 callbacks suppressed [ 298.902400][T16238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2984'. [ 298.926030][T16068] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 298.940632][T16237] ip6_vti0: entered allmulticast mode [ 298.947815][T16238] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2984'. [ 299.001529][T16227] delete_channel: no stack [ 299.010764][T16068] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 299.030511][T16238] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2984'. [ 299.070084][T16068] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 299.236143][T16068] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 299.251703][T16068] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 299.263560][ T5149] Bluetooth: hci2: command tx timeout [ 299.275080][T16068] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 299.290624][T16068] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 299.482632][T16068] 8021q: adding VLAN 0 to HW filter on device bond0 [ 299.529595][T16068] 8021q: adding VLAN 0 to HW filter on device team0 [ 299.560319][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.567476][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 299.586822][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.594026][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.775753][T16280] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2997'. [ 299.864362][T16286] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2999'. [ 300.156614][T16068] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 300.176021][T16305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3001'. [ 300.303500][ T5149] Bluetooth: hci3: command tx timeout [ 300.320550][T16068] veth0_vlan: entered promiscuous mode [ 300.377645][T16068] veth1_vlan: entered promiscuous mode [ 300.464439][T16068] veth0_macvtap: entered promiscuous mode [ 300.482741][T16068] veth1_macvtap: entered promiscuous mode [ 300.531363][T16320] sctp: [Deprecated]: syz.3.3007 (pid 16320) Use of struct sctp_assoc_value in delayed_ack socket option. [ 300.531363][T16320] Use struct sctp_sack_info instead [ 300.555144][T16322] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3008'. [ 300.567982][T16320] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 300.600721][T16068] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 300.688363][T16329] netlink: 'syz.3.3010': attribute type 3 has an invalid length. [ 300.701892][T16329] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3010'. [ 300.711257][T16326] bond9: (slave bond_slave_1): Device is not bonding slave [ 300.711278][T16326] bond9: option active_slave: invalid value (bond_slave_1) [ 300.728817][T16326] bond9 (unregistering): Released all slaves [ 300.820189][T16068] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 300.858270][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.875278][ T50] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.958819][ T50] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.002754][T16348] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3015'. [ 301.016673][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.050850][T16348] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3015'. [ 301.104760][ C0] vcan0: j1939_tp_rxtimer: 0xffff888069d1c000: rx timeout, send abort [ 301.114719][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888069d1c000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 301.157300][T10664] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.185516][T10664] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 301.350911][T10664] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.373838][T10664] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 301.411952][T16361] netlink: 'syz.1.3020': attribute type 4 has an invalid length. [ 301.447171][T16361] IPVS: set_ctl: invalid protocol: 94 172.20.20.10:20001 [ 301.745089][T16385] ip6gretap0: entered promiscuous mode [ 302.250065][T10490] ------------[ cut here ]------------ [ 302.256128][T10490] refcount_t: underflow; use-after-free. [ 302.261979][T10490] WARNING: CPU: 1 PID: 10490 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 [ 302.271557][T10490] Modules linked in: [ 302.275656][T10490] CPU: 1 UID: 0 PID: 10490 Comm: kbnepd bnep0 Not tainted syzkaller #0 PREEMPT(full) [ 302.285415][T10490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 302.295930][T10490] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 302.302071][T10490] Code: 20 55 be 8b e8 77 b9 f9 fc 90 0f 0b 90 90 eb d7 e8 db 9c 36 fd c6 05 4e 87 dd 0a 01 90 48 c7 c7 80 55 be 8b e8 57 b9 f9 fc 90 <0f> 0b 90 90 eb b7 e8 bb 9c 36 fd c6 05 2b 87 dd 0a 01 90 48 c7 c7 [ 302.322248][T10490] RSP: 0018:ffffc9001bdbf6e0 EFLAGS: 00010246 [ 302.328329][T10490] RAX: da603683fe06f600 RBX: 0000000000000003 RCX: ffff888032168000 [ 302.336308][T10490] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 302.344412][T10490] RBP: 0000000000000000 R08: ffff8880b8924293 R09: 1ffff11017124852 [ 302.352362][T10490] R10: dffffc0000000000 R11: ffffed1017124853 R12: dffffc0000000000 [ 302.360358][T10490] R13: ffff88805aadec60 R14: ffff88805aadec78 R15: ffffffff85c63270 [ 302.368364][T10490] FS: 0000000000000000(0000) GS:ffff88812623e000(0000) knlGS:0000000000000000 [ 302.377440][T10490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 302.384267][T10490] CR2: 00007f884ad156c0 CR3: 000000002738a000 CR4: 00000000003526f0 [ 302.392609][T10490] Call Trace: [ 302.396247][T10490] [ 302.399165][T10490] klist_dec_and_del+0x3c7/0x3d0 [ 302.404258][T10490] ? __pfx_klist_children_put+0x10/0x10 [ 302.409786][T10490] klist_del+0xa6/0x110 [ 302.413969][T10490] device_del+0x280/0x8e0 [ 302.418280][T10490] ? _raw_spin_unlock_irq+0x2e/0x50 [ 302.423488][T10490] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 302.429532][T10490] ? __pfx_device_del+0x10/0x10 [ 302.434534][T10490] ? netdev_unregister_kobject+0x344/0x450 [ 302.440324][T10490] unregister_netdevice_many_notify+0x1df2/0x2390 [ 302.446749][T10490] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 302.453523][T10490] ? rtnl_net_dev_lock+0x257/0x2f0 [ 302.458621][T10490] unregister_netdevice_queue+0x33c/0x380 [ 302.464814][T10490] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 302.471035][T10490] ? rtnl_net_dev_lock+0x36/0x2f0 [ 302.476118][T10490] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 302.481212][T10490] unregister_netdev+0x1f/0x60 [ 302.486022][T10490] bnep_session+0x294d/0x2b40 [ 302.490676][T10490] ? rcu_is_watching+0x15/0xb0 [ 302.495951][T10490] ? trace_sched_exit_tp+0x36/0x110 [ 302.501134][T10490] ? __lock_acquire+0xab9/0xd20 [ 302.506271][T10490] ? __pfx_bnep_session+0x10/0x10 [ 302.511274][T10490] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 302.517178][T10490] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 302.523658][T10490] ? __pfx_woken_wake_function+0x10/0x10 [ 302.529272][T10490] ? __kthread_parkme+0x7b/0x200 [ 302.534227][T10490] ? __kthread_parkme+0x1a1/0x200 [ 302.539227][T10490] kthread+0x711/0x8a0 [ 302.543377][T10490] ? __pfx_bnep_session+0x10/0x10 [ 302.548378][T10490] ? __pfx_kthread+0x10/0x10 [ 302.552941][T10490] ? _raw_spin_unlock_irq+0x23/0x50 [ 302.558273][T10490] ? lockdep_hardirqs_on+0x9c/0x150 [ 302.563475][T10490] ? __pfx_kthread+0x10/0x10 [ 302.568044][T10490] ret_from_fork+0x4bc/0x870 [ 302.572610][T10490] ? __pfx_ret_from_fork+0x10/0x10 [ 302.577743][T10490] ? __switch_to_asm+0x39/0x70 [ 302.582478][T10490] ? __switch_to_asm+0x33/0x70 [ 302.587351][T10490] ? __pfx_kthread+0x10/0x10 [ 302.591921][T10490] ret_from_fork_asm+0x1a/0x30 [ 302.597073][T10490] [ 302.600072][T10490] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 302.607324][T10490] CPU: 1 UID: 0 PID: 10490 Comm: kbnepd bnep0 Not tainted syzkaller #0 PREEMPT(full) [ 302.616838][T10490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 302.626867][T10490] Call Trace: [ 302.630120][T10490] [ 302.633026][T10490] dump_stack_lvl+0x99/0x250 [ 302.637596][T10490] ? __asan_memcpy+0x40/0x70 [ 302.642159][T10490] ? __pfx_dump_stack_lvl+0x10/0x10 [ 302.647333][T10490] ? __pfx__printk+0x10/0x10 [ 302.651902][T10490] vpanic+0x237/0x6d0 [ 302.655857][T10490] ? __pfx_vpanic+0x10/0x10 [ 302.660338][T10490] panic+0xb9/0xc0 [ 302.664033][T10490] ? __pfx_panic+0x10/0x10 [ 302.668429][T10490] __warn+0x31b/0x4b0 [ 302.672384][T10490] ? refcount_warn_saturate+0x11a/0x1d0 [ 302.677907][T10490] ? refcount_warn_saturate+0x11a/0x1d0 [ 302.683425][T10490] report_bug+0x2be/0x4f0 [ 302.687725][T10490] ? refcount_warn_saturate+0x11a/0x1d0 [ 302.693243][T10490] ? refcount_warn_saturate+0x11a/0x1d0 [ 302.698761][T10490] ? refcount_warn_saturate+0x11c/0x1d0 [ 302.704276][T10490] handle_bug+0x84/0x160 [ 302.708492][T10490] exc_invalid_op+0x1a/0x50 [ 302.712972][T10490] asm_exc_invalid_op+0x1a/0x20 [ 302.717799][T10490] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 302.723926][T10490] Code: 20 55 be 8b e8 77 b9 f9 fc 90 0f 0b 90 90 eb d7 e8 db 9c 36 fd c6 05 4e 87 dd 0a 01 90 48 c7 c7 80 55 be 8b e8 57 b9 f9 fc 90 <0f> 0b 90 90 eb b7 e8 bb 9c 36 fd c6 05 2b 87 dd 0a 01 90 48 c7 c7 [ 302.743512][T10490] RSP: 0018:ffffc9001bdbf6e0 EFLAGS: 00010246 [ 302.749551][T10490] RAX: da603683fe06f600 RBX: 0000000000000003 RCX: ffff888032168000 [ 302.757505][T10490] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 302.765450][T10490] RBP: 0000000000000000 R08: ffff8880b8924293 R09: 1ffff11017124852 [ 302.773392][T10490] R10: dffffc0000000000 R11: ffffed1017124853 R12: dffffc0000000000 [ 302.781335][T10490] R13: ffff88805aadec60 R14: ffff88805aadec78 R15: ffffffff85c63270 [ 302.789279][T10490] ? __pfx_klist_children_put+0x10/0x10 [ 302.794814][T10490] klist_dec_and_del+0x3c7/0x3d0 [ 302.799726][T10490] ? __pfx_klist_children_put+0x10/0x10 [ 302.805242][T10490] klist_del+0xa6/0x110 [ 302.809373][T10490] device_del+0x280/0x8e0 [ 302.813676][T10490] ? _raw_spin_unlock_irq+0x2e/0x50 [ 302.818845][T10490] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 302.824883][T10490] ? __pfx_device_del+0x10/0x10 [ 302.829705][T10490] ? netdev_unregister_kobject+0x344/0x450 [ 302.835491][T10490] unregister_netdevice_many_notify+0x1df2/0x2390 [ 302.841890][T10490] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 302.848628][T10490] ? rtnl_net_dev_lock+0x257/0x2f0 [ 302.853721][T10490] unregister_netdevice_queue+0x33c/0x380 [ 302.859413][T10490] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 302.865629][T10490] ? rtnl_net_dev_lock+0x36/0x2f0 [ 302.870628][T10490] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 302.875713][T10490] unregister_netdev+0x1f/0x60 [ 302.880451][T10490] bnep_session+0x294d/0x2b40 [ 302.885109][T10490] ? rcu_is_watching+0x15/0xb0 [ 302.889845][T10490] ? trace_sched_exit_tp+0x36/0x110 [ 302.895020][T10490] ? __lock_acquire+0xab9/0xd20 [ 302.899854][T10490] ? __pfx_bnep_session+0x10/0x10 [ 302.904848][T10490] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 302.910717][T10490] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 302.917019][T10490] ? __pfx_woken_wake_function+0x10/0x10 [ 302.922631][T10490] ? __kthread_parkme+0x7b/0x200 [ 302.927540][T10490] ? __kthread_parkme+0x1a1/0x200 [ 302.932545][T10490] kthread+0x711/0x8a0 [ 302.936593][T10490] ? __pfx_bnep_session+0x10/0x10 [ 302.941588][T10490] ? __pfx_kthread+0x10/0x10 [ 302.946153][T10490] ? _raw_spin_unlock_irq+0x23/0x50 [ 302.951323][T10490] ? lockdep_hardirqs_on+0x9c/0x150 [ 302.956495][T10490] ? __pfx_kthread+0x10/0x10 [ 302.961060][T10490] ret_from_fork+0x4bc/0x870 [ 302.965626][T10490] ? __pfx_ret_from_fork+0x10/0x10 [ 302.970714][T10490] ? __switch_to_asm+0x39/0x70 [ 302.975451][T10490] ? __switch_to_asm+0x33/0x70 [ 302.980184][T10490] ? __pfx_kthread+0x10/0x10 [ 302.984747][T10490] ret_from_fork_asm+0x1a/0x30 [ 302.989494][T10490] [ 304.097220][T10490] Shutting down cpus with NMI [ 304.102211][T10490] Kernel Offset: disabled [ 304.106516][T10490] Rebooting in 86400 seconds..