last executing test programs: 2m25.231612772s ago: executing program 4 (id=205): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x2, 0x6, 0x5}, 0x14}}, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x103, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c"]}]}, 0x114}], 0x1}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) listen(r0, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0x3000000}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_ORIG={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}]}]}, 0x80}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x215}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0xfffffffffffffe9c}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8}]}, 0x44}, 0x1, 0xba01}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0x0, 0x1, 0x51, @empty, @private1, 0x8, 0x7800, 0x8ff7, 0xa}}) sendmsg$nl_route(r2, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)=@ipv6_newaddrlabel={0x34, 0x48, 0x20, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x78, 0x0, r4, 0x3}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_LABEL={0x8, 0x2, 0x4}, @IFAL_LABEL={0x8, 0x2, 0x3}]}, 0x34}}, 0x1) 2m24.346946665s ago: executing program 4 (id=215): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}}], {0x14}}, 0x5c}, 0x1, 0xfff4}, 0x0) 2m24.147032318s ago: executing program 4 (id=218): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$igmp6(0xa, 0x3, 0x2) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x2, @loopback}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d8, 0x118, 0xc8, 0x8, 0x0, 0x5803, 0x208, 0x2e8, 0x2e8, 0x208, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0xf8, 0x118, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@addrtype1={{0x28}}, @common=@ipv6header={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x2000000, 0x0, 0x54}, 0x9c) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64-generic\x00'}, 0x58) r4 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000004e00)=[{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)="607be25f2ef1280ed2c663ad71511dde7f74dd31fb0e5a9dbe2ee7745c3636ae33443fa73a387c92566fc67599610cabb9a3fcc284c5d0e7824e32b0d8fd3acef8af71e5f4784bd40778d418042d76c4e25c840db0b8022dddb286e48c9d34d0bcfe943d2cb2b3e77998406bdc487c63740e9d450f16ca09323f1ffa6c83e41bd8da053dfd564f5ebf6bf529217bec9611005a3955f9082f30027a5a7fb021a5eaf79760c0ab0f42ca4b091855c9c192f234f9e3f5ada9", 0xb7}], 0x1}], 0x1, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @private=0xa010101}, 0x10) listen(r6, 0xffffffff) r7 = accept4(r6, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000140)=@assoc_value, &(0x7f0000000040)=0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000300000000000a01020000000000000000010000000900010073797a300000000080000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000540003800f000140000000000800024000000000400003801400010076657468305f746f5f6272696467650014000100767863616e310000000000000000000014000100767863616e3100000000000000000000140000001000010000000000000000000000000a"], 0xc8}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r9, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}]}]}, 0x30}}, 0x0) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000ab0020000080a010400000000000000000a0000034c0005800800024000000002080001400000892708000140000000890800024000000002080001400000005c080001400000001608000140000065580800014000000021080001400000005c700004800c000180080001006c6f6700440001800b00010074756e6e656c000034000280080002400000000008000140409929a208000140000000000800034000000002080002400000000108000340000000001c0001800a00010071756f74610000000c00028008000240000000010c00034000000000000000032c010480100001800c000100626974776973650010000180090001006d657461000000003400018009000100686173680000000024000280080003400000009d0800014000000016080007400000000008000740000000004c000180090001007866726d000000003c0002800800044000000006080004400000000608000440000000060800044000000005080001400000000e080001400000000105000300000000004800018008000100647570003c0002800800024000000017080002400000001108000240000000040800014000000008080001400000000c0800024000000013080002400000000a100001800b0001006e756d67656e0000100001800b0001007461726765740000200001800800010064757000140002800800024000000019080001400000000f9400048018000180080001006f7366000c000280050002000200000048000180080001006f7366003c0002800501020005000000050002000700000008000140000000030500020097000000050002006000000008000140000000100800034000000001100001800b0001007470726f78790000100001800b000100736f636b65740000100001800a00010072656469720000000c0005800800014000008848080009400000000024000000080a0300000000000000000005000003080009400000000108000a400000000160010000080a01020000000000000000020000080900010073797a31000000000c000640000000000000000423000740cc3d477d662c0c443877b981025920de8c99c04c8334e1ed0357ce18f516320008010480600001800e000100636f6e6e6c696d69740000004c000280080002400000000008000940ffffffff0800014000000fff0800014000000009080002400000000008000240000000010800014000000222080001400000008108000140000000043800018008000100647570002c000280080002400000000e080002400000000a080002400000001108000240000000000800024000000013440001800c000100636f756e74657200340002800c000140000000000000dee80c00024000000000000000030c00024000000000000048c90c00024000000000000001002800018008000100667764001c000280080003400000000a0800024000000014080003400000000208000a40000000016c000000080a01020000000000000000050000004a000740e5c28c2076a25be217f8b7197f4efc774e07e833e018a800b760416123c7dc0b8b00963aceeea8eb1c960bf50af96f5b56f3cce4b3550792ed2ea19e946501db7f967fe7b32e00000c000340000000000000000520000000120a010200000000000000000a0000070c000640000000000000000414000000030a0108000000000000000000000005ec000000030a010200000000000000000100000808000540fffffffb0c0002400000000000000005c4000c00dd3784e971d4693e163564fe71e4dc69400a702dcb3715f9ab0e4c052ad3181a6d8b2d090aef3307801b5f6029df6d297c99bdf14a7f1fb58465d1c7afa4d7e2d4b22215c8e30c840310ec807e02fb3a10958b0fb714f7b7b556ac8cfa7afbddad902697538fa6dc335953d8b7c8101f98ba21c8e4e64835c76d6e68ff54c40c03f05aac7b42ac68193fd6f7fdc7296ee8e21636304445bd02d6b82bda1e7ee001f0f799f92ab5ba1220e7fd285fe1e8992d7a30fc6e1972c3424aa583ccfffd200000000c0a01010000000000000000050000030900010073797a3000000000140000001100010000000000000000000a00000a"], 0x608}, 0x1, 0x0, 0x0, 0x40c4}, 0x240000c4) connect$inet6(r10, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) 2m23.117711054s ago: executing program 4 (id=235): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x1f0, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x9}, {0x0, 0xb}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_flower={{0xb}, {0x48, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0x0, 0xff, 0xff, 0xffffff00]}, @TCA_FLOWER_KEY_ICMPV6_CODE={0x5}, @TCA_FLOWER_KEY_PORT_SRC_MAX={0x6, 0x58, 0x4e21}, @TCA_FLOWER_KEY_UDP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_ICMPV6_TYPE={0x5}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_SCTP_DST_MASK={0x6}]}}, @filter_kind_options=@f_route={{0xa}, {0x154, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x138, 0x6, [@m_nat={0x5c, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x31, 0x6, "3eaed48f5023f5c36bc9d8619f3e2af20800000000000000a40bc384135c74eb813bf1cf69dbeaddd76b564e92"}, {0xc}, {0xc}}}, @m_connmark={0x40, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0xd, 0x6, "66396e732cf67237ec"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x98, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x6d, 0x6, "ca8fd735f4c425bd44291fa86781920ab90ff95c64e3d33704248d0546950f6c3113358c2551981c52f5a6dd8a3891697d8ab8d8f56d15025dc3c339c95c2c879249dbbfa3c3f7576ea41a624c8db9b4a2896e26ced3361e33c793332fc709bb25bcdfc387325cb1fa"}, {0xc}, {0xc}}}]}]}}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0xa1}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 2m22.702106727s ago: executing program 4 (id=241): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200010a0000000000000000800040"], 0x26}}, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000000), &(0x7f0000000040)=@tcp, 0x3}, 0x20) (async) r2 = socket(0x2, 0x3, 0x7) getsockopt(r2, 0xff, 0x100000000000001, 0x0, 0x0) (async) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000140)={'filter\x00', 0xfb, "d0f00624a63ff017648a99490ed02f6e9e22af8dd7ec19fd0a8a3a888e87e3237af02413a3a90e2d07040a579f2fd5600543bcd821d2f278dfc759902aec5210c55383367987c4798b95c1ff5e8c33e8e16d296247cb082c40d9706465740998bcdf9550f614c6d03369f7e49a36fb69863ce89d5270cff40620dadee88519f8d362722816a0a513a954ca41b78534d11d5abcd052a8a1f9b88243938ebac12489bbe7193775457290fb66d0ed4fb9a0d62cd38c02b359cfc4095a848f1bb84d3dc4577176ee999cc014c2474d3dffe8f89bb2af3e70590df2bfb8e83f1510851610b9867137484ef0922c722a7a135599712ad92f7691fe5f7585"}, &(0x7f00000000c0)=0x11f) 2m22.394703614s ago: executing program 4 (id=244): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@bridge_dellink={0x34, 0x13, 0x1, 0x0, 0xfffffffd, {}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x5, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1}]}}]}]}, 0x34}}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="6c000000100003042cbd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c00128009000100766c616e000000002c00028006000100000000001c0003800c00010000010000800000000c00010000000000ffffff7f0400048008000a00", @ANYRES32=r4, @ANYBLOB="08000500", @ANYRES32=r4], 0x6c}, 0x1, 0xba01}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = accept(r0, &(0x7f0000000300)=@sco, &(0x7f0000000240)=0x80) getsockopt$inet6_buf(r6, 0x29, 0xd3, 0x0, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000a5fbaed61094f8b706f100004b4293a0e71eeb3300000000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r7, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x8, 0x1016, &(0x7f0000003080)=""/4118, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socket$packet(0x11, 0xa, 0x300) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f0000001900)=ANY=[@ANYBLOB="180100002d0001000000000000000000070100800c0000000200000000000000140001"], 0x118}], 0x1}, 0x0) r10 = socket(0x22, 0x2, 0x3) sendmmsg$inet6(r10, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4005) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001400000003008000240000000030800014000000012080003"], 0x122}}, 0x0) r12 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r12, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x67) write$bt_hci(r12, &(0x7f0000000040)=ANY=[], 0x6) socket$l2tp6(0xa, 0x2, 0x73) syz_emit_ethernet(0x32, &(0x7f0000000440)={@random="e90c610faca2", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x1, 0x1, 0x2, 0xc, 0x100, @void}, "09cf88f0"}}}}}}, 0x0) r13 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r13, 0x10f, 0x87, &(0x7f0000000000)={0x40}, 0x10) syz_emit_ethernet(0xbe, &(0x7f00000004c0)=ANY=[@ANYBLOB="0180c2000002bbbbbbbbbbbb0800450000b00000000200119078ffffffff0000000000000000009c907801000000040000009e188a80c32aa9b86ed6ce56992732d9f7fc6cda762c07530a038941764a92bb074336477e9205df5f47f7da965c25c746ba7f8ca07841d3da17308a6df3f54855ecedd6d8664fa125e3972a48e81039a562ff321beb3f036b9fd27aeff89c8e79a57a3873e0b4e6553e2c444cf02a016458a5f67aa497153eddc6a19a3f9661ac468177dc130be49bdd8eb554dbfb261d23695ee77e509f5ab7d93c788236013526aea5fcd6b7dedeeb8242a156241e5252dd0d1d6ce201edc22b986d8f248f4b23734138c9adbe2df8788799825bba9d6e77b7df95ed929f1496ce1d2ba90043002f6b7e3f30f1a9061ef4d485d9d56654b1cf516f7e611f86b7adbc1edce57d445df11252430f51c6629e6bb642419b3ff1f030d3f833478322245bc083c2e0c225bbb6d55d707a1f3816e5f06233f95071d4f5fcf4be13cca14c74d6a08079baec077d18513f9c72cd167d42a9de29a4603ee1b2458dc0e07af89742a554fd2b79e0c07cdbb675b5e4c8f5177af76faab0cb5d486caeb978940fbb06aa3d4afe0afc729a01f8db3212f2d0e0100cc4abadf90f85b907aa7460bac3fe216e88085d5a846e0b8979b8ffd82895c32ad678ba5748a01c3ec22da94acc9d3a0920ac75cf14d0935e9df7995e85d6e919d8593497de413b2af3da8ed37030095340e65b401a323522f896090000001fbcde18d4f50a172f3cda598d0dac72d885c1cbbc7c53cd638176fc26b0a5ef749c4fc26226d1"], 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32=r1], 0x34}}, 0x0) 2m7.236327181s ago: executing program 32 (id=244): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@bridge_dellink={0x34, 0x13, 0x1, 0x0, 0xfffffffd, {}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x5, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1}]}}]}]}, 0x34}}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="6c000000100003042cbd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c00128009000100766c616e000000002c00028006000100000000001c0003800c00010000010000800000000c00010000000000ffffff7f0400048008000a00", @ANYRES32=r4, @ANYBLOB="08000500", @ANYRES32=r4], 0x6c}, 0x1, 0xba01}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = accept(r0, &(0x7f0000000300)=@sco, &(0x7f0000000240)=0x80) getsockopt$inet6_buf(r6, 0x29, 0xd3, 0x0, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000a5fbaed61094f8b706f100004b4293a0e71eeb3300000000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r7, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x8, 0x1016, &(0x7f0000003080)=""/4118, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socket$packet(0x11, 0xa, 0x300) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f0000001900)=ANY=[@ANYBLOB="180100002d0001000000000000000000070100800c0000000200000000000000140001"], 0x118}], 0x1}, 0x0) r10 = socket(0x22, 0x2, 0x3) sendmmsg$inet6(r10, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4005) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001400000003008000240000000030800014000000012080003"], 0x122}}, 0x0) r12 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r12, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x67) write$bt_hci(r12, &(0x7f0000000040)=ANY=[], 0x6) socket$l2tp6(0xa, 0x2, 0x73) syz_emit_ethernet(0x32, &(0x7f0000000440)={@random="e90c610faca2", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x1, 0x1, 0x2, 0xc, 0x100, @void}, "09cf88f0"}}}}}}, 0x0) r13 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r13, 0x10f, 0x87, &(0x7f0000000000)={0x40}, 0x10) syz_emit_ethernet(0xbe, &(0x7f00000004c0)=ANY=[@ANYBLOB="0180c2000002bbbbbbbbbbbb0800450000b00000000200119078ffffffff0000000000000000009c907801000000040000009e188a80c32aa9b86ed6ce56992732d9f7fc6cda762c07530a038941764a92bb074336477e9205df5f47f7da965c25c746ba7f8ca07841d3da17308a6df3f54855ecedd6d8664fa125e3972a48e81039a562ff321beb3f036b9fd27aeff89c8e79a57a3873e0b4e6553e2c444cf02a016458a5f67aa497153eddc6a19a3f9661ac468177dc130be49bdd8eb554dbfb261d23695ee77e509f5ab7d93c788236013526aea5fcd6b7dedeeb8242a156241e5252dd0d1d6ce201edc22b986d8f248f4b23734138c9adbe2df8788799825bba9d6e77b7df95ed929f1496ce1d2ba90043002f6b7e3f30f1a9061ef4d485d9d56654b1cf516f7e611f86b7adbc1edce57d445df11252430f51c6629e6bb642419b3ff1f030d3f833478322245bc083c2e0c225bbb6d55d707a1f3816e5f06233f95071d4f5fcf4be13cca14c74d6a08079baec077d18513f9c72cd167d42a9de29a4603ee1b2458dc0e07af89742a554fd2b79e0c07cdbb675b5e4c8f5177af76faab0cb5d486caeb978940fbb06aa3d4afe0afc729a01f8db3212f2d0e0100cc4abadf90f85b907aa7460bac3fe216e88085d5a846e0b8979b8ffd82895c32ad678ba5748a01c3ec22da94acc9d3a0920ac75cf14d0935e9df7995e85d6e919d8593497de413b2af3da8ed37030095340e65b401a323522f896090000001fbcde18d4f50a172f3cda598d0dac72d885c1cbbc7c53cd638176fc26b0a5ef749c4fc26226d1"], 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32=r1], 0x34}}, 0x0) 2.434602919s ago: executing program 2 (id=2218): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) preadv(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x9) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000025c0)=@delchain={0x550, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}}, [@filter_kind_options=@f_route={{0xa}, {0x520, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0xa, 0xe}}, @TCA_ROUTE4_ACT={0x514, 0x6, [@m_simple={0x1e4, 0x1f, 0x0, 0x0, {{0xb}, {0x8c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x401, 0x2, 0x1, 0x2, 0x8}}, @TCA_DEF_DATA={0x2d, 0x3, '@-^[\xa5&,.\x00pe\xe9\xb9\xf1Q+=\xdf\xacqd\xb4\xd3\rj6\xb4\xa6fz\x91\xa6\xe9\xdfy\xef\xbcY\xbb[a'}, @TCA_DEF_DATA={0x7, 0x3, 'lo\x00'}, @TCA_DEF_DATA={0xb, 0x3, 'simple\x00'}, @TCA_DEF_DATA={0x7, 0x3, '\xfc}\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x6, 0x1, 0x10000000, 0x4, 0x8}}, @TCA_DEF_DATA={0xb, 0x3, 'j\xbf!*{$\x00'}]}, {0x12d, 0x6, "bb56072c27c5e2984fb9b39740c7dea2e6372a168bf1fdb8ecb6019c9f5db834fcaca18620641b7aab2922f69d2f9b062f5ec4be8a5a603fe7236ffd67f60e9e007b34e0f9cb58fc8855dae5289e4e856559f64bc5a1c5683263937fdd088e5f34874e0d2d2273a7a09810d9042b32fb69223c74e88c41fda5268c22a3107d32ee49d3a99665178abfde24d27a872b23ece9d09c9560070a6e3cca383ccb4d1a6d7c302ab3ee820e67d26e78f72566a2f9765698d783e6c14d8da6156473bc39143eaba66c1921f94f19f65bc88b127c0eb8ac765b9220105c7c1060a0dd863f80d90bc3848a4fa52f73aaa4e21a1f0d6078cc5386cdfb2eef199f5261cf64455c3d8b7584e7e01a4e794f882f04307913cd5e00e1ebd8bbb0e6ed906dfc64b4608f285ecdef3d31a8"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_vlan={0x16c, 0x3, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xb7e}]}, {0x12d, 0x6, "b4f5f8a000aed611d1e3ee1aaa84601c97299db7511af811242f5e599e70462ff947d7fce8171ca76d6272e5926e4bcc41c5f2a45eda585981ca0de6f00b6a83a630a32eb3d933702dde61376ab26952f74f090fb6858f97715363bfca363004ef43db3a48e84090d7517b700dc6a2a2f94e7329147f25670ca37779fb3bb34630b673bfa93845abd7c43a11e2c7d51cd033af07fdedab1b0a4fd3289168734a438364c97d0791494427d5c5c48b1f99b2933a263cfb4ca5c4ae41bb0d4ad806597b90b1569a91f0af9997eb0a37a98b616eeb9b0e0d88e3faa90e480ed36ed0731503f2a4bda6e9158fad7756a073b2cec8125c7d5602435a45a08326af0e776af578e665ce74bc12a9711427e5e489a7fc95ee4920fca6d97a55e300de194ccb7e828af89c3c15e1"}, {0xc}, {0xc, 0x8, {0x3}}}}, @m_vlan={0xe8, 0xc, 0x0, 0x0, {{0x9}, {0x50, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x30a}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x8, 0x6, 0x7, 0xf64, 0x2}, 0x2}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x4e9}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xee1}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x715}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x8a7}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x6}]}, {0x6d, 0x6, "eda7d7a535361ed0c9b32a364b522addd6669254402ee3ff325c8cea5004909bdc00830603507c7cc3cb8a9b0bfd1aa374f3d137bd1e7f8b57e264a568809005b37e0f9e7b458fe6d976cd4a52b8661fb1fc93f220613f0a0b672f610c1e30c05bb4f3d26355d6814b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_mpls={0x8c, 0x15, 0x0, 0x0, {{0x9}, {0x4}, {0x5d, 0x6, "b785195954bf29eb39a865c5695a7ac46cec065f7db06dbdba2e8cf062693312261bf71915b2d84a074fd931b04b8440933794ba3bc0c3d3302773efdb92a216873b53281af4671231b5fff52cece35cfe0cd79a10ddc8fbcb"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_bpf={0x4c, 0x1b, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x4, 0x3, 0x6, 0x4, 0x7}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x550}}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x7e}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41, 0xb00}, 0x300}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) bpf$ITER_CREATE(0x21, 0x0, 0x0) 2.382023751s ago: executing program 0 (id=2219): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r1, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=r2, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f0000000240)={0x0, r1}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0xe, &(0x7f0000000880)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0x8, 0x10, &(0x7f0000000040), 0x10, r2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0xe72, 0x10, 0x0, &(0x7f0000000200)="63eced8e46dc3fad77b7b3f7b986edf7", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.19819584s ago: executing program 0 (id=2223): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0), 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000280)) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000080)) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="54000000120001032cbd700000000000000000004e234e240be50000feffffff00000000000000009e3ff2c1a91200"/56, @ANYRES32=0x0, @ANYBLOB="000000000000000000100000040000000800030011"], 0x54}}, 0x0) 2.197491049s ago: executing program 2 (id=2224): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x168, 0x10, 0x0, 0xb, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth1_to_batadv\x00', 'veth1_to_hsr\x00', {}, {}, 0x3a}, 0x6000000, 0x138, 0x180, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0x5}}, @common=@inet=@iprange={{0x68}, {@ipv4=@dev={0xac, 0x14, 0x14, 0xa}, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv4=@multicast2, @ipv6=@local, 0x20}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x1, 0x1, 0x8, 'pptp\x00', {0x9}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x180}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="07000000010000", 0x7) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000a80)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r6, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, r5, 0x403, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x26}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x6c}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x48081}, 0x8000) sendmsg$NL80211_CMD_DEL_TX_TS(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000e40)={0x30, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TSID={0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x30}}, 0x0) 2.064904037s ago: executing program 0 (id=2226): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$can_raw(0x1d, 0x3, 0x1) socket$packet(0x11, 0x2, 0x300) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_emit_ethernet(0x80, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "dd690b", 0x4a, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100, 0x0, 0xe803, [0x3e8, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [0x0]}}}}}}}, 0x0) sendmsg$netlink(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000180)={0x20, 0x2e, 0x1, 0x70bd26, 0x0, "", [@typed={0xc, 0x107, 0x0, 0x0, @u64=0x5}, @typed={0x0, 0x15, 0x0, 0x0, @u32=0xffff8000}]}, 0x20}], 0x1, 0x0, 0xffffffffffffffca, 0xe9654dd4ab7a1c5b}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000080)=r0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r1, 0x8008f511, &(0x7f0000000280)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x4, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5a}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x7}}, [], {{0x6, 0x1, 0x3, 0x8}, {0x6, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @SEG6_LOCAL_IIF={0x8, 0x6, 0x1}}]}, 0x30}}, 0x0) r7 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000001880)=@raw={'raw\x00', 0x3c1, 0x3, 0x380, 0x158, 0x111, 0x4b4, 0x158, 0xd4feffff, 0x2b0, 0x20a, 0x278, 0x2b0, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'vlan1\x00'}, 0x7a, 0x118, 0x158, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x80000001, 0x80}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@mcast1, @private1, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@dst={{0x48}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e0) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x406, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x403, 0xfffffffc, 0x3f, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 1.886778785s ago: executing program 2 (id=2229): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000004980)=ANY=[@ANYBLOB="380100001000010000000000000000000000fe8000000000000000000000000000aa000000002000"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb000000146c00000000000014000000000000000000000000000000000000000000000000000000000000000000000000fffffffff7ffffff000000000000000000000000000000000000000000000010000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000020001060000000000000000480003006465666c61746500"/240], 0x138}, 0x1, 0x0, 0x0, 0x4004050}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) r2 = socket$kcm(0x2, 0x922000000001, 0x106) sendmsg$inet(r2, &(0x7f0000003080)={0x0, 0x0, 0x0}, 0x200488d5) setsockopt$sock_attach_bpf(r2, 0x1, 0x31, &(0x7f00000008c0), 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) write$cgroup_int(r1, &(0x7f0000003000), 0x12) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newlink={0x38, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x42}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6=r3}]}}}]}, 0x38}, 0x1, 0xba01}, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x4000004}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg$unix(r4, &(0x7f0000002e80)=[{{&(0x7f0000000180), 0x6e, &(0x7f00000005c0)=[{&(0x7f0000000380)=""/98, 0x62}, {&(0x7f0000000240)=""/17, 0x11}, {&(0x7f0000000400)=""/147, 0x93}, {&(0x7f00000004c0)=""/194, 0xc2}], 0x4, &(0x7f0000000600)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000640), 0x6e, &(0x7f0000000dc0)=[{&(0x7f00000006c0)=""/85, 0x55}, {&(0x7f0000000740)=""/232, 0xe8}, {&(0x7f0000000840)=""/105, 0x69}, {&(0x7f0000000900)=""/120, 0x78}, {&(0x7f0000000980)=""/140, 0x8c}, {&(0x7f0000000a40)=""/131, 0x83}, {&(0x7f0000000b00)=""/238, 0xee}, {&(0x7f0000000c00)=""/255, 0xff}, {&(0x7f0000000d00)=""/170, 0xaa}], 0x9, &(0x7f0000000e80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x140}}, {{&(0x7f0000000fc0)=@abs, 0x6e, &(0x7f00000024c0)=[{&(0x7f0000001040)=""/36, 0x24}, {&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000002080)=""/177, 0xb1}, {&(0x7f0000002140)=""/202, 0xca}, {&(0x7f0000002240)=""/7, 0x7}, {&(0x7f0000002280)=""/64, 0x40}, {&(0x7f00000022c0)=""/201, 0xc9}, {&(0x7f00000023c0)=""/51, 0x33}, {&(0x7f0000002400)=""/132, 0x84}], 0x9, &(0x7f0000002580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f00000025c0), 0x6e, &(0x7f0000002980)=[{&(0x7f0000002640)=""/128, 0x80}, {&(0x7f00000026c0)=""/36, 0x24}, {&(0x7f0000002700)=""/249, 0xf9}, {&(0x7f0000002800)=""/165, 0xa5}, {&(0x7f00000028c0)=""/92, 0x5c}, {&(0x7f0000002940)=""/58, 0x3a}], 0x6, &(0x7f00000030c0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x168}}, {{&(0x7f0000002b80), 0x6e, &(0x7f0000002dc0)=[{&(0x7f0000002c00)=""/98, 0x62}, {&(0x7f0000002c80)=""/97, 0x61}, {&(0x7f0000002d00)=""/173, 0xad}], 0x3, &(0x7f0000002e00)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x70}}], 0x5, 0x40000020, &(0x7f0000002fc0)={0x0, 0x3938700}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="3800000055002f03000000000000000007000000", @ANYRES32, @ANYBLOB="20000100", @ANYRES32=0x0, @ANYBLOB="000000ce0f"], 0x38}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) write(r4, &(0x7f0000000080)="240000001a007f0214f9f4070009040802000000000000050002000008000f40fe00000e", 0x24) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r7 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r7, 0x28, 0x1, &(0x7f0000000300)=0x2000000000000000, 0x8) connect$vsock_stream(r7, &(0x7f0000000340)={0x28, 0x0, 0x0, @host}, 0x10) sendmsg$NL80211_CMD_LEAVE_IBSS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x8, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x0, 0x5d}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x8010}, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e21, 0x9, @private1, 0x3ff}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff)='X', 0x1, 0x0, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv4_newrule={0x2c, 0x20, 0x1, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_FWMARK={0x8, 0xa, 0x20}, @FRA_GENERIC_POLICY=@FRA_FWMASK={0x8}]}, 0x2c}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) 1.823849536s ago: executing program 5 (id=2230): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r3, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xff19}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendto$packet(r5, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x11, 0x86dd, r6, 0x1, 0x0, 0x6, @random="97db959f8319"}, 0x14) writev(r4, &(0x7f0000000200)=[{&(0x7f0000000080)='/', 0x1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) r7 = socket$xdp(0x2c, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) (async) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000490000000000000000000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x32) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@cgroup=r9, 0xa, 0x1, 0x6, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000400)=[0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0]}, 0x40) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@cgroup=r9, 0xa, 0x1, 0x6, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000400)=[0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0]}, 0x40) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, 0x0, &(0x7f0000000180)) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r11, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r11, &(0x7f0000000180)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x10001}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="5800000000000000000000000000000085000000ad0000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) recvmmsg(r11, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xfff}], 0x1, 0x26, 0x0) (async) recvmmsg(r11, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xfff}], 0x1, 0x26, 0x0) bind$xdp(r7, &(0x7f00000001c0), 0x2a) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYRES8=r1, @ANYRES16=r1, @ANYBLOB="010000000000000000001400000018000180140002006e657464657673696d38001a0000000008000d00000000000500180000000000080010000002000008000e0000000000"], 0x4c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x200000000000007f, &(0x7f0000000240)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000073013e000000000095000000000000007279d8"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x200000000000007f, &(0x7f0000000240)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000073013e000000000095000000000000007279d8"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.718042322s ago: executing program 0 (id=2231): socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) recvmmsg(r0, 0x0, 0x0, 0x140, &(0x7f0000002e80)) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback}], 0x2c) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r3 = socket$inet(0x2b, 0x801, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x1, &(0x7f0000000100)=0x5, 0x4) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000005200010000000008000100"/24, @ANYRES32=r4, @ANYBLOB], 0x1c}}, 0x804) 1.71663549s ago: executing program 1 (id=2232): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000009000000000000000200000d00000000060000000000080000000000000000000000000000002e10"], &(0x7f0000000180)=""/129, 0x3d, 0x81, 0x1, 0x0, 0x0, @void, @value}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r1, &(0x7f00000001c0), &(0x7f0000000080)=""/52}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xce, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x17, 0x1b, &(0x7f0000000500)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @ringbuf_query, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}], &(0x7f0000000600)='GPL\x00', 0x65d02bcc, 0xc, &(0x7f0000000640)=""/12, 0xd33aa0fc88159da3, 0x18, '\x00', 0x0, @fallback=0x10, r0, 0x8, &(0x7f0000000680)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000006c0)={0x0, 0x6, 0x7, 0x3f60}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=[0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x74, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x8, 0x1e, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9c3}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000140)='GPL\x00', 0x10001, 0x80, &(0x7f0000000400)=""/128, 0x41100, 0x9, '\x00', r4, @fallback=0x14, r0, 0x8, &(0x7f0000000480)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x10, 0x0, 0xfffff3f6}, 0x10, 0xffffffffffffffff, r5, 0x3, &(0x7f0000000800)=[0x1, 0x1], &(0x7f0000000840)=[{0x1, 0xfff, 0x7, 0x3}, {0x5, 0x1, 0x6, 0xc}, {0x3, 0x4, 0xb, 0x4}], 0x10, 0x4, @void, @value}, 0x94) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r8 = accept$inet(r6, &(0x7f0000000940)={0x2, 0x0, @broadcast}, &(0x7f0000000980)=0x10) ioctl$sock_inet_sctp_SIOCINQ(r8, 0x541b, &(0x7f0000000a40)) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r10, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r9, @ANYBLOB="01e5c300000000fb04003b1c210008000300", @ANYRES32=r7, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) 1.54570621s ago: executing program 1 (id=2234): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_emit_ethernet(0x3e, &(0x7f0000000540)={@local, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x8, 0x3a, 0x0, @remote, @mcast2, {[], @mlv2_report}}}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x484cb}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x5}]}}}]}, 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e20}]}}}]}, 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0x8, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xc4}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) pipe(&(0x7f0000000680)) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x100, 0x10, 0x9, 0x1, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) accept4(r3, &(0x7f00000000c0)=@ax25={{0x3, @null}, [@rose, @default, @rose, @remote, @bcast, @null, @bcast, @rose]}, &(0x7f0000000140)=0x80, 0x800) 1.544583821s ago: executing program 0 (id=2235): r0 = socket$xdp(0x2c, 0x3, 0x0) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) (async, rerun: 32) r3 = socket$pppl2tp(0x18, 0x1, 0x1) (rerun: 32) connect$pppl2tp(r3, &(0x7f0000000400)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @local}, 0x2, 0x3, 0x0, 0x4}}, 0x2e) ioctl$PPPIOCSFLAGS(r3, 0x40047459, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) (async) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f000000cdc0)=0x10, 0x4) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) (async) bind$xdp(r4, &(0x7f00000001c0)={0x2c, 0x0, r6}, 0x10) (async) bind$xdp(r0, &(0x7f0000000200)={0x2c, 0x1, r6, 0x0, r4}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="850000008b000000840000000000000095000000000000008560fc2b2062f611fc2f864ef177d634e46e8dcfe61b4fb9f600344d592fee49e176fe6ad28fbcb1f9259bfc63e9030971917e30b6f42e8f9dd6ab0ce07312a135cd363aa7e5bcef8fd0e8c7d2082584156c52ebfd69e8e13b7a8b477abc86468e11b6242133ce882f05e16b91c37b3437347f6058b4489c759783b9d4dfb55d0085a26e41201a6d8c8ced33e10048e756a40538b32bf653fa3c831a4e60599ed7a0f999d18de9984522a7cdb6fc30015633a0132c9578b7da5bd7280a5f7e28fd858ba712020b23ef8a2785b6c146c48b48ca7e232d0489661396e9303b38aa5d26d06e2e676795fd2733f95da570bab301000000ffffffff2a2792a630d8fcdc"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 1.50124693s ago: executing program 5 (id=2236): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000030000005800018044000400200001e6f8b1830149b12e00000001d900000000000000000000000100000000200002000a00000000000000fe800000000000000004000000000000000000000d0001007564703a73"], 0x6c}}, 0x0) pselect6(0x0, 0x0, &(0x7f0000000080)={0x100000001, 0x1, 0x6, 0x7, 0x40, 0x5, 0x9e86, 0x2}, 0x0, &(0x7f0000000300)={0x77359400}, &(0x7f0000000540)={&(0x7f0000000340), 0x8}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f0000000a80)=ANY=[@ANYBLOB="180000000000002000000000ff000000850000000f000000850000000500000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000580)={0xffffffffffffffff, 0x81, 0x10}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r5}, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r2}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f000000cbc0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x97}, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x4eb}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x1}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) socket(0x18, 0x80000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b80)=@delchain={0x190, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x9}, {0x0, 0xb}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_flower={{0xb}, {0x48, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0x0, 0xff, 0xff, 0xffffff00]}, @TCA_FLOWER_KEY_ICMPV6_CODE={0x5}, @TCA_FLOWER_KEY_PORT_SRC_MAX={0x6, 0x58, 0x4e21}, @TCA_FLOWER_KEY_UDP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_ICMPV6_TYPE={0x5}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_SCTP_DST_MASK={0x6}]}}, @filter_kind_options=@f_route={{0xa}, {0xf4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0xd8, 0x6, [@m_nat={0x98, 0x0, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @dev={0xac, 0x14, 0x14, 0x31}}}]}, {0x45, 0x6, "3ea6d48212417e7c0e7c09619f3e2af20800021ab7b00000a40bc384135c74eb813bf10700ddd76b564e929f83ce5a3fc2a9db1aae055080bed1631b653f6bff61"}, {0xc}, {0xc}}}, @m_connmark={0x3c, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0x9, 0x6, 'f9ns,'}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x190}, 0x1, 0x0, 0x0, 0x81}, 0x0) socket(0x10, 0x803, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$bt_hci(r7, &(0x7f0000000140)=ANY=[], 0xc) 1.205971931s ago: executing program 1 (id=2239): socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000880)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x2, 0x0, 0x0) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0xfd8a, 0x0, 0x4, 0x0, 0xc}, 0x14}, 0x1, 0x0, 0x0, 0xc044}, 0x40) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000800000000000001e0000000a0004007770616e3100000008000100000000ee"], 0x28}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) syz_emit_ethernet(0x4f, &(0x7f00000001c0)={@random="e904a200", @link_local, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x3d, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x29, 0x0, @opaque="94e72bfca9178a675cb87605c83f336e9d367516620aad7f215ad5846e20b20cfd"}}}}}, 0x0) 1.077548771s ago: executing program 0 (id=2240): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0xff) write(r0, &(0x7f0000000000)="0a000000010001", 0x7) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0xa6, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$sock_int(r2, 0x1, 0x12, 0x0, &(0x7f0000000140)=0x5104) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000340)={'syztnl2\x00', 0x0, 0x4, 0x44, 0x0, 0x7, 0x28, @ipv4={'\x00', '\xff\xff', @broadcast}, @loopback, 0x8, 0x1, 0x7, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'syztnl1\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r3, 0x29, 0x40, 0x7, 0x7f, 0x48, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x7, 0x80, 0x7ff, 0x1}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$unix(0x1, 0x2, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x44, r8, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r10 = accept4$netrom(0xffffffffffffffff, &(0x7f00000003c0)={{0x3, @null}, [@netrom, @remote, @default, @rose, @bcast, @default, @netrom, @null]}, &(0x7f0000000440)=0x48, 0x80800) setsockopt$netrom_NETROM_T1(r10, 0x103, 0x1, &(0x7f0000000480)=0x9, 0x4) sendmsg$NL80211_CMD_GET_POWER_SAVE(r4, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r5, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x1, 0x5c}}}}, ["", "", ""]}, 0x28}}, 0x24000000) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r11, 0x400448ca, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000005000)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=@newtaction={0x48, 0x30, 0xeaa3ef926154e70d, 0x0, 0x0, {}, [{0x34, 0x1, [@m_vlan={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) r13 = socket(0x10, 0x3, 0x0) r14 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000080)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r15, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0xffffff70}}]}, 0x38}}, 0x0) bind$bt_hci(r13, 0x0, 0x0) 1.041033726s ago: executing program 1 (id=2241): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000780)={{0x14}, [@NFT_MSG_DELRULE={0x2c, 0x6, 0xa, 0x301, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x54}}, 0x4800) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000400)={0x104, r2, 0x4, 0x70bd2d, 0x1, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x1}}]}, 0x104}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004800) (async) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x3c, r2, 0x1, 0x0, 0x0, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x3c}}, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) (async, rerun: 64) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (rerun: 64) ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x6, 0xc, &(0x7f0000000000)=ANY=[@ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000007fb0000f8ffffffb703000008000000b70400000000000085000000450000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.freeze\x00', 0x26e1, 0x0) close(r5) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r5, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @broadcast}) (rerun: 32) ioctl$TUNSETNOCSUM(r5, 0x8914, 0x20000000) (async, rerun: 64) r6 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="d8000000180081064e81f782db4cb904021d0800fe067c05e8fe55a10a0005000140020003600e41b0000900ac0006fc1100000016000500014002000000035c3b61c1d67f6f94007174cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001b14d6d930dfe1d9d322fe7c4650b5b9bd6ee6f63f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b4ff010000000000000dd6e4edef3d93452a09004b43370e9703920723f97e46bb5c07540d3b", 0xd8}], 0x1}, 0x0) 898.109749ms ago: executing program 3 (id=2242): r0 = socket$inet_udplite(0x2, 0x2, 0x88) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) (async) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='wg0\x00', 0x10) (async) getsockname$packet(r2, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b00)=@newlink={0x40, 0x10, 0x437, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r3, 0x54583}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @dev}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmmsg$inet(r0, &(0x7f0000000d40)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty}}}], 0x20}}, {{0x0, 0x0, 0x0}}], 0x2, 0x80) 810.872227ms ago: executing program 3 (id=2243): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000001c00)="b7028d7a89a1a9e34b7acba3d9bff1ab77e1013b52513a5cb7517654ea56087a12fc122db35560019cab83110b00e4b990cc5c7df69da2e4f2361ae22704000000000030", 0x44}], 0x1) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5000009, 0x10012, r1, 0x0) (async, rerun: 32) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000040)=0x7ff, 0x4) (async, rerun: 32) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f00000001c0)=""/36, &(0x7f0000000280)=0x24) 757.816153ms ago: executing program 1 (id=2244): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000009000000000000000200000d00000000060000000000080000000000000000000000000000002e10"], &(0x7f0000000180)=""/129, 0x3d, 0x81, 0x1, 0x0, 0x0, @void, @value}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r1, &(0x7f00000001c0), &(0x7f0000000080)=""/52}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xce, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x17, 0x1b, &(0x7f0000000500)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @ringbuf_query, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}], &(0x7f0000000600)='GPL\x00', 0x65d02bcc, 0xc, &(0x7f0000000640)=""/12, 0xd33aa0fc88159da3, 0x18, '\x00', 0x0, @fallback=0x10, r0, 0x8, &(0x7f0000000680)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000006c0)={0x0, 0x6, 0x7, 0x3f60}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=[0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x74, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x8, 0x1e, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9c3}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000140)='GPL\x00', 0x10001, 0x80, &(0x7f0000000400)=""/128, 0x41100, 0x9, '\x00', r4, @fallback=0x14, r0, 0x8, &(0x7f0000000480)={0x0, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x10, 0x0, 0xfffff3f6}, 0x10, 0xffffffffffffffff, r5, 0x3, &(0x7f0000000800)=[0x1, 0x1], &(0x7f0000000840)=[{0x1, 0xfff, 0x7, 0x3}, {0x5, 0x1, 0x6, 0xc}, {0x3, 0x4, 0xb, 0x4}], 0x10, 0x4, @void, @value}, 0x94) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r8 = accept$inet(r6, &(0x7f0000000940)={0x2, 0x0, @broadcast}, &(0x7f0000000980)=0x10) ioctl$sock_inet_sctp_SIOCINQ(r8, 0x541b, &(0x7f0000000a40)) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r10, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r9, @ANYBLOB="01e5c300000000fb04003b1c210008000300", @ANYRES32=r7, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) 676.332976ms ago: executing program 3 (id=2245): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x7, 0x4) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d8000000", @ANYRES16=0x0, @ANYBLOB="04002dbd7000f2dbdf254f0000000c00839ced540000680000004c007a8008000400000000181c000200134ecc4d908540c3c8630b918a29360800040004005111335ced5fd94e0800040009000000080004000300000048007a801400010003d869f47d8c428eaa74b31794b4b314b5000400000000000c0003004180081ee4f88f1a080004000c0000000c0003007858754e3c504054080004000800000004007a8020007a8008000400050000001400020029"], 0xd8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009000000000008000b"], 0x54}}, 0x0) sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r4, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x66c00000}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}]}]}, 0x3c}}, 0x800) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x952f, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) socket$inet6(0xa, 0x3, 0x8000000003c) (async) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x7, 0x4) (async) socket$igmp6(0xa, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) (async) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d8000000", @ANYRES16=0x0, @ANYBLOB="04002dbd7000f2dbdf254f0000000c00839ced540000680000004c007a8008000400000000181c000200134ecc4d908540c3c8630b918a29360800040004005111335ced5fd94e0800040009000000080004000300000048007a801400010003d869f47d8c428eaa74b31794b4b314b5000400000000000c0003004180081ee4f88f1a080004000c0000000c0003007858754e3c504054080004000800000004007a8020007a8008000400050000001400020029"], 0xd8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009000000000008000b"], 0x54}}, 0x0) (async) sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r4, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x66c00000}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}]}]}, 0x3c}}, 0x800) (async) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x952f, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) (async) 573.944301ms ago: executing program 1 (id=2246): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MFC(r0, 0x29, 0xcd, 0x0, 0x5c) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000001c0)={0x9}, 0x10) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@mcast2, 0x800, 0x0, 0x3, 0x1, 0x0, 0x3}, 0x20) setsockopt$inet6_int(r2, 0x29, 0x4c, &(0x7f00000005c0)=0x7fff, 0x4) sendmmsg$alg(r2, &(0x7f0000000240)=[{0x200000fc, 0xff00, 0x0, 0x0, &(0x7f0000000600)=ANY=[], 0xd8}], 0x1, 0x0) sendmsg$nl_route(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000001400)=ANY=[@ANYBLOB="20000000120001000000020000000000070001"], 0x20}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000000)={'virt_wifi0\x00', @random="06070000005d"}) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000280)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}], 0x1c) setsockopt(r5, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) recvmsg(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000140)={r6, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x1546}, 0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000080)={r6, 0xffff, 0x8}, &(0x7f00000000c0)=0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="260a08001900000061116c00000000001800"/34], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) 495.040898ms ago: executing program 5 (id=2247): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="3800000010003704000000000003000000000000", @ANYRES32, @ANYBLOB="0b12050059240000180012800900010069706970"], 0x38}}, 0x0) 484.621116ms ago: executing program 2 (id=2248): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a0302000000000000000002000000090002007379"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="88010000170a010100"], 0x188}}, 0x0) 354.074054ms ago: executing program 3 (id=2249): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="310300000000000000000900000008000300", @ANYBLOB='\b'], 0x24}}, 0x0) syz_emit_ethernet(0x67, &(0x7f00000000c0)={@multicast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x31, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @empty, @private1, [{0x5, 0x1, "9a59f4f852451b"}]}}}}}}, 0x0) 330.971336ms ago: executing program 5 (id=2250): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r5) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x20, r6, 0x3e8c4ddb697c9f8f, 0x0, 0x0, {0x4}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'netdevsim0\x00'}) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000001c0)=ANY=[], 0x44}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[], 0x17d4}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r8, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8924, &(0x7f0000000000)={'veth1\x00', @random="a1c0f5b6a566"}) 318.681496ms ago: executing program 2 (id=2251): sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000100)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000a40)="118db76e8efb27d530b26a8302bad647e35540226c4052b6d573165d39ad8ead67632e8fe108cf55473bc22914286359c3bb3decf99ed04d34d1a73ae48dae0e69ee69fe", 0x44}], 0x4}}], 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000010001fff001201000006000043be4354", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e000000"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 154.219645ms ago: executing program 3 (id=2252): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a000302000000000000"], 0x1c}, 0x1, 0x0, 0xa00, 0x1000000}, 0x0) 95.73959ms ago: executing program 2 (id=2253): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x10, 0x11}, @TCA_FQ_QUANTUM={0x8}]}}]}, 0x40}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'syztnl1\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x4, 0x97, 0x8, 0x6, 0x1, @empty, @private0, 0x10, 0x80, 0x2, 0x4}}) (async) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@bridge_dellink={0x34, 0x13, 0x5, 0x0, 0xfffffffc, {0x7, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x4, 0x0, 0x1, {0xc, 0x8, 0x0, 0x1, [{0x8, 0x1001, 0x0, 0x0, 0x7}]}}]}]}, 0x34}}, 0x10) (async) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r9 = socket(0xa, 0x3, 0x4) getsockopt$nfc_llcp(r9, 0x29, 0x7, 0x0, 0x20000000) (async) sendmsg$nl_route(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@bridge_dellink={0x28, 0x13, 0x5, 0x0, 0x0, {0x7, 0x0, 0x0, r8}, [@IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_MPLS={0x4}]}]}, 0x28}}, 0x0) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r10, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000000f00000008000300", @ANYRES32=r11, @ANYBLOB="0508380100000000b0d906c80da26c85e6e89b0b"], 0x24}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'syztnl2\x00', 0x0, 0x80, 0x0, 0x9, 0x3590, {{0xa, 0x4, 0x0, 0xd, 0x28, 0x66, 0x0, 0x3, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@rr={0x7, 0x13, 0x63, [@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @loopback]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000540)={'syztnl0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x4, 0x8c, 0x2, 0x7, 0x6, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7, 0x10, 0x948, 0x3ff}}) (async) r14 = socket$nl_route(0x10, 0x3, 0x0) (async) r15 = socket$netlink(0x10, 0x3, 0x0) (async) r16 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r16, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) (async) getsockname$packet(r16, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r15, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r17, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000f00)=@newqdisc={0x1ec, 0x24, 0x20, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r17, {}, {0xffe0, 0xffff}, {0xffe0}}, [@TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x0, 0x1, 0xa26c, 0x1, 0x7, 0x7, 0x7}}, {0x12, 0x2, [0x6, 0xfffd, 0x4a22, 0x1, 0x4, 0x7, 0x0]}}, {{0x1c, 0x1, {0x2, 0x41, 0x8000, 0x6, 0x0, 0x6, 0x2, 0x4}}, {0xc, 0x2, [0x7, 0x4000, 0x3, 0x4]}}, {{0x1c, 0x1, {0x0, 0x4, 0x4, 0x4, 0x0, 0x5, 0x200, 0x1}}, {0x6, 0x2, [0x1]}}, {{0x1c, 0x1, {0x4, 0x2, 0x100, 0x80, 0x0, 0x8000, 0x9}}, {0x4}}]}, @qdisc_kind_options=@q_mqprio={{0xb}, {0x11c, 0x2, {{0xf, [0xc, 0x3, 0xc, 0x0, 0x0, 0xb, 0x6, 0x3, 0x8, 0xe, 0xfd, 0xd, 0x0, 0x10, 0xd, 0x10], 0x1, [0x1, 0x7, 0x8724, 0xff, 0x9c77, 0x9, 0x7f, 0x7fff, 0x6e37, 0xfffb, 0x8, 0x5, 0x8, 0x406, 0x800, 0x7], [0x2, 0x6, 0x1ff, 0x3, 0x35fb, 0x767, 0x81, 0x7, 0x6, 0x5, 0x978, 0x6, 0x6, 0x312, 0x80, 0x2]}, [@TCA_MQPRIO_MAX_RATE64={0xc4, 0x4, 0x0, 0x1, [{0xc, 0x4, 0x5}, {0xc, 0x4, 0xb352}, {0xc, 0x4, 0x2}, {0xc, 0x4, 0xffff}, {0xc, 0x4, 0x3}, {0xc, 0x4, 0x3}, {0xc, 0x4, 0x3}, {0xc, 0x4, 0x30000000000000}, {0xc, 0x4, 0x1}, {0xc, 0x4, 0x6}, {0xc, 0x4, 0x2135}, {0xc, 0x4, 0x1a8}, {0xc, 0x4, 0x9}, {0xc, 0x4, 0x6}, {0xc, 0x4, 0x1549}, {0xc, 0x4, 0x7}]}]}}}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sendmsg$nl_route_sched(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x2a, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r17, {0x0, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r3, &(0x7f00000006c0)={&(0x7f0000000240), 0xc, &(0x7f0000000680)={&(0x7f0000000dc0)={0x108, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x10}, 0x24000805) socket$alg(0x26, 0x5, 0x0) 84.677755ms ago: executing program 3 (id=2254): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @random="97db959f8319"}, 0x14) sendto(r0, &(0x7f00000002c0)='%', 0x300000, 0x0, 0x0, 0x0) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000001a00)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/133, 0x85}, {&(0x7f0000000200)=""/188, 0xbc}], 0x2}, 0x6}, {{0x0, 0x0, &(0x7f0000000240)}, 0xff}], 0x2, 0x100, 0x0) 18.208675ms ago: executing program 5 (id=2255): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}]}}}]}, 0x40}}, 0x0) (async) tee(r1, r1, 0x2, 0x7) 0s ago: executing program 5 (id=2256): r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x8c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r2, {}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd], 0x0, [0x8, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}}]}}]}, 0x8c}}, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3000003, 0x810, r1, 0xa3c110be39dfa828) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/96, 0x2329000, 0x800}, 0x20) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) (async) sendmsg$key(r0, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) (async) sendmmsg(r0, &(0x7f0000000180), 0x400008a, 0x0) kernel console output (not intermixed with test programs): 8768][ T6138] xsk_init_queue+0xa1/0x100 [ 73.373395][ T6138] xsk_setsockopt+0x4ea/0x950 [ 73.378108][ T6138] ? __pfx_xsk_setsockopt+0x10/0x10 [ 73.383322][ T6138] ? __pfx_aa_sk_perm+0x10/0x10 [ 73.388185][ T6138] ? aa_sock_opt_perm+0x79/0x120 [ 73.393128][ T6138] ? __pfx_xsk_setsockopt+0x10/0x10 [ 73.398346][ T6138] do_sock_setsockopt+0x3af/0x720 [ 73.403405][ T6138] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 73.408977][ T6138] ? __fget_files+0x395/0x410 [ 73.413666][ T6138] ? __fget_files+0x2a/0x410 [ 73.418270][ T6138] __x64_sys_setsockopt+0x1ee/0x280 [ 73.423477][ T6138] do_syscall_64+0xf3/0x230 [ 73.427982][ T6138] ? clear_bhb_loop+0x35/0x90 [ 73.432660][ T6138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.438551][ T6138] RIP: 0033:0x7f0cccf7ff19 [ 73.442966][ T6138] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 73.462572][ T6138] RSP: 002b:00007f0ccdd10058 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 73.470988][ T6138] RAX: ffffffffffffffda RBX: 00007f0ccd145fa0 RCX: 00007f0cccf7ff19 [ 73.478969][ T6138] RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000004 [ 73.486950][ T6138] RBP: 00007f0cccff3986 R08: 0000000000000004 R09: 0000000000000000 [ 73.494927][ T6138] R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000000000 [ 73.502902][ T6138] R13: 0000000000000000 R14: 00007f0ccd145fa0 R15: 00007ffce3202028 [ 73.510888][ T6138] [ 73.535969][ T54] Bluetooth: hci4: command 0x0411 tx timeout [ 73.600755][ T6138] Mem-Info: [ 73.603936][ T6138] active_anon:4275 inactive_anon:0 isolated_anon:0 [ 73.603936][ T6138] active_file:1246 inactive_file:38191 isolated_file:0 [ 73.603936][ T6138] unevictable:768 dirty:485 writeback:0 [ 73.603936][ T6138] slab_reclaimable:9821 slab_unreclaimable:97086 [ 73.603936][ T6138] mapped:28480 shmem:1431 pagetables:718 [ 73.603936][ T6138] sec_pagetables:0 bounce:0 [ 73.603936][ T6138] kernel_misc_reclaimable:0 [ 73.603936][ T6138] free:1347891 free_pcp:629 free_cma:0 [ 73.633861][ T6148] x_tables: ip6_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 24 [ 73.658710][ T6133] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 73.686997][ T6133] vlan2: entered promiscuous mode [ 73.688139][ T6153] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 73.708098][ T6138] Node 0 active_anon:17200kB inactive_anon:0kB active_file:4984kB inactive_file:152688kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:113920kB dirty:1932kB writeback:0kB shmem:4188kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10824kB pagetables:3072kB sec_pagetables:0kB all_unreclaimable? no [ 73.713960][ T6133] ip6gretap0: entered promiscuous mode [ 73.748289][ T6133] vlan2: entered allmulticast mode [ 73.753589][ T6133] ip6gretap0: entered allmulticast mode [ 73.771780][ T6155] netlink: 'syz.1.69': attribute type 1 has an invalid length. [ 73.818181][ T6155] netlink: 224 bytes leftover after parsing attributes in process `syz.1.69'. [ 73.875009][ T6138] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:76kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 73.934775][ T6138] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 73.962928][ T6138] lowmem_reserve[]: 0 2463 2464 0 0 [ 73.968558][ T6138] Node 0 DMA32 free:1472736kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB active_anon:16864kB inactive_anon:0kB active_file:5084kB inactive_file:152108kB unevictable:1536kB writepending:1924kB present:3129332kB managed:2550484kB mlocked:0kB bounce:0kB free_pcp:1244kB local_pcp:500kB free_cma:0kB [ 74.001062][ T6138] lowmem_reserve[]: 0 0 0 0 0 [ 74.005935][ T6138] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:580kB unevictable:0kB writepending:8kB present:1048580kB managed:620kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 74.033675][ T6138] lowmem_reserve[]: 0 0 0 0 0 [ 74.049433][ T6138] Node 1 Normal free:3903568kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:76kB unevictable:1536kB writepending:8kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:804kB local_pcp:504kB free_cma:0kB [ 74.084159][ T6138] lowmem_reserve[]: 0 0 0 0 0 [ 74.089003][ T6138] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 74.100548][ T6165] : renamed from ipvlan1 [ 74.107069][ T6138] Node 0 DMA32: 294*4kB (UME) 513*8kB (UME) 314*16kB (UM) 46*32kB (UME) 6*64kB (UME) 6*128kB (UME) 3*256kB (ME) 4*512kB (M) 8*1024kB (UME) 4*2048kB (ME) 352*4096kB (M) = 1473920kB [ 74.126409][ T6167] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 74.138484][ T6138] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 74.154460][ T6138] Node 1 Normal: 191*4kB (UME) 74*8kB (UME) 57*16kB (UME) 218*32kB (UME) 97*64kB (UME) 32*128kB (UME) 14*256kB (UME) 12*512kB (UM) 2*1024kB (UM) 3*2048kB (U) 944*4096kB (ME) = 3904092kB [ 74.177680][ T6138] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 74.192186][ T6138] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 74.202608][ T6138] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 74.222358][ T6138] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 74.231792][ T6138] 40909 total pagecache pages [ 74.236507][ T6138] 0 pages in swap cache [ 74.247801][ T6138] Free swap = 124996kB [ 74.252020][ T6138] Total swap = 124996kB [ 74.256204][ T6138] 2097051 pages RAM [ 74.267671][ T6138] 0 pages HighMem/MovableOnly [ 74.278544][ T6138] 427644 pages reserved [ 74.282745][ T6138] 0 pages cma reserved [ 74.357441][ T6173] tipc: Invalid UDP bearer configuration [ 74.357484][ T6173] tipc: Enabling of bearer rejected, failed to enable media [ 74.748816][ T6191] netlink: 12 bytes leftover after parsing attributes in process `syz.2.84'. [ 74.993483][ T6199] netlink: 64 bytes leftover after parsing attributes in process `syz.4.90'. [ 75.197366][ T6203] tipc: Invalid UDP bearer configuration [ 75.197414][ T6203] tipc: Enabling of bearer rejected, failed to enable media [ 75.295970][ T6209] sctp: failed to load transform for md5: -2 [ 75.334234][ T6210] sctp: failed to load transform for md5: -2 [ 75.558094][ T5165] Bluetooth: hci4: command 0x0411 tx timeout [ 75.681723][ T6241] netlink: 12 bytes leftover after parsing attributes in process `syz.4.100'. [ 75.799687][ T6248] FAULT_INJECTION: forcing a failure. [ 75.799687][ T6248] name failslab, interval 1, probability 0, space 0, times 0 [ 75.823617][ T6248] CPU: 1 UID: 0 PID: 6248 Comm: syz.2.105 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 75.833917][ T6248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 75.844006][ T6248] Call Trace: [ 75.847306][ T6248] [ 75.850260][ T6248] dump_stack_lvl+0x241/0x360 [ 75.854964][ T6248] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.860187][ T6248] ? __pfx__printk+0x10/0x10 [ 75.864822][ T6248] ? kmem_cache_alloc_node_noprof+0x4f/0x380 [ 75.870839][ T6248] ? __pfx___might_resched+0x10/0x10 [ 75.876166][ T6248] should_fail_ex+0x3b0/0x4e0 [ 75.880882][ T6248] should_failslab+0xac/0x100 [ 75.885593][ T6248] kmem_cache_alloc_node_noprof+0x77/0x380 [ 75.891516][ T6248] ? __alloc_skb+0x1c3/0x440 [ 75.896125][ T6248] ? genl_rcv_msg+0x88c/0xec0 [ 75.900837][ T6248] __alloc_skb+0x1c3/0x440 [ 75.905283][ T6248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.911392][ T6248] ? __pfx___alloc_skb+0x10/0x10 [ 75.916378][ T6248] netlink_dump+0x239/0xe10 [ 75.920922][ T6248] ? __pfx_netlink_dump+0x10/0x10 [ 75.925992][ T6248] ? __asan_memset+0x23/0x50 [ 75.930611][ T6248] ? genl_start+0x4ae/0x6d0 [ 75.935156][ T6248] __netlink_dump_start+0x5a2/0x790 [ 75.940386][ T6248] genl_rcv_msg+0x88c/0xec0 [ 75.944934][ T6248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 75.949994][ T6248] ? __pfx_genl_start+0x10/0x10 [ 75.954953][ T6248] ? __pfx_genl_dumpit+0x10/0x10 [ 75.959908][ T6248] ? __pfx_genl_done+0x10/0x10 [ 75.964711][ T6248] ? __pfx_lock_acquire+0x10/0x10 [ 75.969752][ T6248] ? __pfx_nl802154_dump_interface+0x10/0x10 [ 75.975766][ T6248] ? __pfx___might_resched+0x10/0x10 [ 75.981101][ T6248] netlink_rcv_skb+0x1e3/0x430 [ 75.985887][ T6248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 75.990943][ T6248] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 75.996293][ T6248] genl_rcv+0x28/0x40 [ 76.000307][ T6248] netlink_unicast+0x7f6/0x990 [ 76.005115][ T6248] ? __pfx_netlink_unicast+0x10/0x10 [ 76.010432][ T6248] ? __virt_addr_valid+0x183/0x530 [ 76.015578][ T6248] ? __check_object_size+0x48e/0x900 [ 76.020896][ T6248] netlink_sendmsg+0x8e4/0xcb0 [ 76.025700][ T6248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.031016][ T6248] ? aa_sock_msg_perm+0x91/0x160 [ 76.035996][ T6248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.041308][ T6248] __sock_sendmsg+0x221/0x270 [ 76.046027][ T6248] ____sys_sendmsg+0x52a/0x7e0 [ 76.050840][ T6248] ? __pfx_____sys_sendmsg+0x10/0x10 [ 76.056250][ T6248] ? __fget_files+0x2a/0x410 [ 76.060895][ T6248] ? __fget_files+0x2a/0x410 [ 76.065541][ T6248] __sys_sendmsg+0x269/0x350 [ 76.070171][ T6248] ? __pfx_lock_release+0x10/0x10 [ 76.075238][ T6248] ? __pfx___sys_sendmsg+0x10/0x10 [ 76.080392][ T6248] ? __pfx_vfs_write+0x10/0x10 [ 76.085221][ T6248] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 76.091585][ T6248] ? do_syscall_64+0x100/0x230 [ 76.096383][ T6248] ? do_syscall_64+0xb6/0x230 [ 76.101101][ T6248] do_syscall_64+0xf3/0x230 [ 76.105727][ T6248] ? clear_bhb_loop+0x35/0x90 [ 76.110461][ T6248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.116421][ T6248] RIP: 0033:0x7fc541d7ff19 [ 76.120872][ T6248] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.140521][ T6248] RSP: 002b:00007fc542aea058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 76.148975][ T6248] RAX: ffffffffffffffda RBX: 00007fc541f45fa0 RCX: 00007fc541d7ff19 [ 76.156976][ T6248] RDX: 0000000004000008 RSI: 00000000200003c0 RDI: 0000000000000004 [ 76.164976][ T6248] RBP: 00007fc542aea0a0 R08: 0000000000000000 R09: 0000000000000000 [ 76.172988][ T6248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 76.180998][ T6248] R13: 0000000000000000 R14: 00007fc541f45fa0 R15: 00007ffdbf7154c8 [ 76.189023][ T6248] [ 76.237164][ T6261] tipc: Invalid UDP bearer configuration [ 76.237204][ T6261] tipc: Enabling of bearer rejected, failed to enable media [ 76.512675][ T6271] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 76.784665][ T6287] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.116'. [ 76.845501][ T6281] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.910795][ T6285] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.116'. [ 77.206116][ T6278] syz.2.111 (6278) used greatest stack depth: 18544 bytes left [ 77.663066][ T6313] syz_tun: entered promiscuous mode [ 77.695429][ T6313] batadv_slave_0: entered promiscuous mode [ 77.753067][ T6315] tipc: Invalid UDP bearer configuration [ 77.753233][ T6315] tipc: Enabling of bearer rejected, failed to enable media [ 77.865305][ T6329] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 78.017582][ T6338] xt_l2tp: invalid flags combination: c [ 78.309170][ T5944] IPVS: starting estimator thread 0... [ 78.419449][ T6356] IPVS: using max 22 ests per chain, 52800 per kthread [ 78.704147][ T6371] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 78.996868][ T6384] netlink: 'syz.1.148': attribute type 1 has an invalid length. [ 79.029576][ T6384] netlink: 224 bytes leftover after parsing attributes in process `syz.1.148'. [ 79.063659][ T6385] netlink: 12 bytes leftover after parsing attributes in process `syz.3.149'. [ 79.224556][ T6397] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 79.299478][ T6399] netlink: 40 bytes leftover after parsing attributes in process `syz.3.154'. [ 79.309857][ T6402] FAULT_INJECTION: forcing a failure. [ 79.309857][ T6402] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.349225][ T6402] CPU: 0 UID: 0 PID: 6402 Comm: syz.2.155 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 79.359539][ T6402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 79.369627][ T6402] Call Trace: [ 79.372936][ T6402] [ 79.375902][ T6402] dump_stack_lvl+0x241/0x360 [ 79.380617][ T6402] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.385851][ T6402] ? __pfx__printk+0x10/0x10 [ 79.390480][ T6402] ? __pfx_lock_release+0x10/0x10 [ 79.395549][ T6402] should_fail_ex+0x3b0/0x4e0 [ 79.400266][ T6402] _copy_from_user+0x2f/0xc0 [ 79.404892][ T6402] copy_msghdr_from_user+0xae/0x680 [ 79.410136][ T6402] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 79.415972][ T6402] ? __fget_files+0x2a/0x410 [ 79.420601][ T6402] ? __fget_files+0x2a/0x410 [ 79.425233][ T6402] __sys_sendmsg+0x209/0x350 [ 79.429851][ T6402] ? __pfx_lock_release+0x10/0x10 [ 79.434894][ T6402] ? __pfx___sys_sendmsg+0x10/0x10 [ 79.440030][ T6402] ? __pfx_vfs_write+0x10/0x10 [ 79.444842][ T6402] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 79.451198][ T6402] ? do_syscall_64+0x100/0x230 [ 79.455979][ T6402] ? do_syscall_64+0xb6/0x230 [ 79.460657][ T6402] do_syscall_64+0xf3/0x230 [ 79.465188][ T6402] ? clear_bhb_loop+0x35/0x90 [ 79.469883][ T6402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.475776][ T6402] RIP: 0033:0x7fc541d7ff19 [ 79.480195][ T6402] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.499802][ T6402] RSP: 002b:00007fc542aea058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.508255][ T6402] RAX: ffffffffffffffda RBX: 00007fc541f45fa0 RCX: 00007fc541d7ff19 [ 79.516235][ T6402] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 79.524211][ T6402] RBP: 00007fc542aea0a0 R08: 0000000000000000 R09: 0000000000000000 [ 79.532183][ T6402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.540159][ T6402] R13: 0000000000000000 R14: 00007fc541f45fa0 R15: 00007ffdbf7154c8 [ 79.548225][ T6402] [ 79.849345][ T6424] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 79.868891][ T6426] tipc: Invalid UDP bearer configuration [ 79.868933][ T6426] tipc: Enabling of bearer rejected, failed to enable media [ 79.970312][ T6424] netlink: 'syz.2.164': attribute type 1 has an invalid length. [ 80.001933][ T6424] netlink: 224 bytes leftover after parsing attributes in process `syz.2.164'. [ 80.204569][ T6444] netlink: 'syz.1.170': attribute type 5 has an invalid length. [ 80.414828][ T6454] netlink: 48 bytes leftover after parsing attributes in process `syz.4.174'. [ 80.464015][ T6456] netlink: 'syz.1.175': attribute type 1 has an invalid length. [ 80.483458][ T6457] netlink: 'syz.1.175': attribute type 1 has an invalid length. [ 80.688091][ T6466] tipc: Invalid UDP bearer configuration [ 80.688133][ T6466] tipc: Enabling of bearer rejected, failed to enable media [ 80.760794][ T6471] netlink: 187320 bytes leftover after parsing attributes in process `syz.1.181'. [ 80.788391][ T6471] netlink: zone id is out of range [ 80.797807][ T6471] netlink: zone id is out of range [ 80.801469][ T6472] openvswitch: netlink: nsh attribute has 65524 unknown bytes. [ 80.835038][ T6472] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 80.854730][ T6474] xt_hashlimit: invalid rate [ 80.871263][ T6477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.182'. [ 80.888037][ T6477] netlink: 12 bytes leftover after parsing attributes in process `syz.0.182'. [ 81.118890][ T6489] netlink: 12 bytes leftover after parsing attributes in process `syz.0.188'. [ 81.159914][ T6493] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 81.198704][ T6495] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 81.527599][ T6506] IPVS: set_ctl: invalid protocol: 43 172.20.20.170:20003 [ 81.596418][ T6510] FAULT_INJECTION: forcing a failure. [ 81.596418][ T6510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 81.609996][ T6510] CPU: 1 UID: 0 PID: 6510 Comm: syz.4.197 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 81.620272][ T6510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 81.630447][ T6510] Call Trace: [ 81.633739][ T6510] [ 81.636678][ T6510] dump_stack_lvl+0x241/0x360 [ 81.641394][ T6510] ? __pfx_dump_stack_lvl+0x10/0x10 [ 81.646625][ T6510] ? __pfx__printk+0x10/0x10 [ 81.651249][ T6510] ? __pfx_lock_release+0x10/0x10 [ 81.656304][ T6510] should_fail_ex+0x3b0/0x4e0 [ 81.661013][ T6510] _copy_from_iter+0x21f/0x1e70 [ 81.665898][ T6510] ? __virt_addr_valid+0x183/0x530 [ 81.671046][ T6510] ? __pfx_lock_release+0x10/0x10 [ 81.676132][ T6510] ? __pfx__copy_from_iter+0x10/0x10 [ 81.681458][ T6510] ? __virt_addr_valid+0x183/0x530 [ 81.686582][ T6510] ? __virt_addr_valid+0x183/0x530 [ 81.691694][ T6510] ? __virt_addr_valid+0x45f/0x530 [ 81.696803][ T6510] ? __check_object_size+0x48e/0x900 [ 81.702098][ T6510] netlink_sendmsg+0x73d/0xcb0 [ 81.706868][ T6510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.712153][ T6510] ? aa_sock_msg_perm+0x91/0x160 [ 81.717107][ T6510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.722391][ T6510] __sock_sendmsg+0x221/0x270 [ 81.727076][ T6510] ____sys_sendmsg+0x52a/0x7e0 [ 81.731860][ T6510] ? __pfx_____sys_sendmsg+0x10/0x10 [ 81.737143][ T6510] ? __fget_files+0x2a/0x410 [ 81.741740][ T6510] ? __fget_files+0x2a/0x410 [ 81.746337][ T6510] __sys_sendmsg+0x269/0x350 [ 81.750926][ T6510] ? __pfx_lock_release+0x10/0x10 [ 81.755954][ T6510] ? __pfx___sys_sendmsg+0x10/0x10 [ 81.761078][ T6510] ? __pfx_vfs_write+0x10/0x10 [ 81.765863][ T6510] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 81.772194][ T6510] ? do_syscall_64+0x100/0x230 [ 81.776961][ T6510] ? do_syscall_64+0xb6/0x230 [ 81.781642][ T6510] do_syscall_64+0xf3/0x230 [ 81.786142][ T6510] ? clear_bhb_loop+0x35/0x90 [ 81.790824][ T6510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.796712][ T6510] RIP: 0033:0x7fdd7e97ff19 [ 81.801131][ T6510] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 81.820737][ T6510] RSP: 002b:00007fdd7f757058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.829156][ T6510] RAX: ffffffffffffffda RBX: 00007fdd7eb45fa0 RCX: 00007fdd7e97ff19 [ 81.837126][ T6510] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 81.845180][ T6510] RBP: 00007fdd7f7570a0 R08: 0000000000000000 R09: 0000000000000000 [ 81.853147][ T6510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 81.861114][ T6510] R13: 0000000000000000 R14: 00007fdd7eb45fa0 R15: 00007ffc41616558 [ 81.869098][ T6510] [ 81.913064][ T976] cfg80211: failed to load regulatory.db [ 81.981443][ T6517] : renamed from ipvlan1 [ 82.255181][ T6525] IPVS: persistence engine module ip_vs_pe_À not found [ 82.296868][ T6531] netlink: 'syz.4.205': attribute type 1 has an invalid length. [ 82.337705][ T6531] netlink: 224 bytes leftover after parsing attributes in process `syz.4.205'. [ 82.354039][ T6535] netlink: 4 bytes leftover after parsing attributes in process `syz.1.206'. [ 82.411397][ T6534] netlink: 24 bytes leftover after parsing attributes in process `syz.4.205'. [ 82.528522][ T6542] bond1: entered promiscuous mode [ 82.533761][ T6542] bond1: entered allmulticast mode [ 82.539924][ T6542] 8021q: adding VLAN 0 to HW filter on device bond1 [ 82.561350][ T6552] FAULT_INJECTION: forcing a failure. [ 82.561350][ T6552] name failslab, interval 1, probability 0, space 0, times 0 [ 82.575706][ T6552] CPU: 1 UID: 0 PID: 6552 Comm: syz.1.210 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 82.586005][ T6552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 82.596157][ T6552] Call Trace: [ 82.599477][ T6552] [ 82.602407][ T6552] dump_stack_lvl+0x241/0x360 [ 82.607176][ T6552] ? __pfx_dump_stack_lvl+0x10/0x10 [ 82.612649][ T6552] ? __pfx__printk+0x10/0x10 [ 82.617267][ T6552] should_fail_ex+0x3b0/0x4e0 [ 82.621982][ T6552] should_failslab+0xac/0x100 [ 82.626696][ T6552] ? skb_clone+0x20c/0x390 [ 82.631139][ T6552] kmem_cache_alloc_noprof+0x70/0x380 [ 82.636544][ T6552] skb_clone+0x20c/0x390 [ 82.640799][ T6552] __netlink_deliver_tap+0x3cc/0x7f0 [ 82.646101][ T6552] ? netlink_deliver_tap+0x2e/0x1b0 [ 82.651319][ T6552] netlink_deliver_tap+0x19d/0x1b0 [ 82.656433][ T6552] netlink_unicast+0x7c4/0x990 [ 82.661207][ T6552] ? __pfx_netlink_unicast+0x10/0x10 [ 82.666495][ T6552] ? __virt_addr_valid+0x183/0x530 [ 82.671626][ T6552] ? __check_object_size+0x48e/0x900 [ 82.676935][ T6552] netlink_sendmsg+0x8e4/0xcb0 [ 82.681704][ T6552] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.686989][ T6552] ? aa_sock_msg_perm+0x91/0x160 [ 82.691947][ T6552] ? __pfx_netlink_sendmsg+0x10/0x10 [ 82.697244][ T6552] __sock_sendmsg+0x221/0x270 [ 82.701962][ T6552] ____sys_sendmsg+0x52a/0x7e0 [ 82.706728][ T6552] ? __pfx_____sys_sendmsg+0x10/0x10 [ 82.712022][ T6552] ? __fget_files+0x2a/0x410 [ 82.716627][ T6552] ? __fget_files+0x2a/0x410 [ 82.721238][ T6552] __sys_sendmsg+0x269/0x350 [ 82.725852][ T6552] ? __pfx_lock_release+0x10/0x10 [ 82.730884][ T6552] ? __pfx___sys_sendmsg+0x10/0x10 [ 82.736000][ T6552] ? __pfx_vfs_write+0x10/0x10 [ 82.740804][ T6552] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 82.747225][ T6552] ? do_syscall_64+0x100/0x230 [ 82.752030][ T6552] ? do_syscall_64+0xb6/0x230 [ 82.756735][ T6552] do_syscall_64+0xf3/0x230 [ 82.761250][ T6552] ? clear_bhb_loop+0x35/0x90 [ 82.765929][ T6552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.771837][ T6552] RIP: 0033:0x7fa20837ff19 [ 82.776273][ T6552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 82.796074][ T6552] RSP: 002b:00007fa2091e3058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 82.804559][ T6552] RAX: ffffffffffffffda RBX: 00007fa208545fa0 RCX: 00007fa20837ff19 [ 82.812553][ T6552] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 82.820541][ T6552] RBP: 00007fa2091e30a0 R08: 0000000000000000 R09: 0000000000000000 [ 82.828541][ T6552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 82.836537][ T6552] R13: 0000000000000000 R14: 00007fa208545fa0 R15: 00007fffa41a13c8 [ 82.844633][ T6552] [ 82.850791][ T6552] netlink: 187320 bytes leftover after parsing attributes in process `syz.1.210'. [ 82.875304][ T6552] netlink: zone id is out of range [ 82.886393][ T6552] netlink: zone id is out of range [ 83.004180][ T6542] bond1 (unregistering): Released all slaves [ 83.444818][ T6576] dvmrp1: entered allmulticast mode [ 83.498906][ T6576] dvmrp1: left allmulticast mode [ 83.593578][ T6580] IPv6: sit1: Disabled Multicast RS [ 83.938266][ T6601] netlink: zone id is out of range [ 83.946108][ T6601] netlink: zone id is out of range [ 84.925629][ T6641] netlink: 'syz.2.240': attribute type 9 has an invalid length. [ 84.986726][ T6647] FAULT_INJECTION: forcing a failure. [ 84.986726][ T6647] name failslab, interval 1, probability 0, space 0, times 0 [ 85.018421][ T6641] __nla_validate_parse: 4 callbacks suppressed [ 85.018439][ T6641] netlink: 244 bytes leftover after parsing attributes in process `syz.2.240'. [ 87.918024][ T6647] CPU: 1 UID: 0 PID: 6647 Comm: syz.0.242 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 87.928335][ T6647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 87.938424][ T6647] Call Trace: [ 87.941726][ T6647] [ 87.944681][ T6647] dump_stack_lvl+0x241/0x360 [ 87.949384][ T6647] ? __pfx_dump_stack_lvl+0x10/0x10 [ 87.954617][ T6647] ? __pfx__printk+0x10/0x10 [ 87.959248][ T6647] ? __kmalloc_noprof+0xb5/0x4c0 [ 87.964232][ T6647] ? __pfx___might_resched+0x10/0x10 [ 87.969559][ T6647] should_fail_ex+0x3b0/0x4e0 [ 87.974281][ T6647] should_failslab+0xac/0x100 [ 87.978988][ T6647] __kmalloc_noprof+0xdd/0x4c0 [ 87.983773][ T6647] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 87.990044][ T6647] genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 87.996149][ T6647] genl_rcv_msg+0x802/0xec0 [ 88.000684][ T6647] ? __pfx_genl_rcv_msg+0x10/0x10 [ 88.005754][ T6647] ? __pfx_lock_acquire+0x10/0x10 [ 88.010808][ T6647] ? __pfx_ovs_ct_limit_cmd_get+0x10/0x10 [ 88.016658][ T6647] ? __pfx___might_resched+0x10/0x10 [ 88.021988][ T6647] netlink_rcv_skb+0x1e3/0x430 [ 88.026774][ T6647] ? __pfx_genl_rcv_msg+0x10/0x10 [ 88.031821][ T6647] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 88.037149][ T6647] ? __netlink_deliver_tap+0x7aa/0x7f0 [ 88.042669][ T6647] genl_rcv+0x28/0x40 [ 88.046679][ T6647] netlink_unicast+0x7f6/0x990 [ 88.051474][ T6647] ? __pfx_netlink_unicast+0x10/0x10 [ 88.056785][ T6647] ? __virt_addr_valid+0x183/0x530 [ 88.061933][ T6647] ? __check_object_size+0x48e/0x900 [ 88.067251][ T6647] netlink_sendmsg+0x8e4/0xcb0 [ 88.072070][ T6647] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.077390][ T6647] ? aa_sock_msg_perm+0x91/0x160 [ 88.082361][ T6647] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.087679][ T6647] __sock_sendmsg+0x221/0x270 [ 88.092394][ T6647] ____sys_sendmsg+0x52a/0x7e0 [ 88.097183][ T6647] ? __pfx_____sys_sendmsg+0x10/0x10 [ 88.102489][ T6647] ? __fget_files+0x2a/0x410 [ 88.107289][ T6647] ? __fget_files+0x2a/0x410 [ 88.111914][ T6647] __sys_sendmsg+0x269/0x350 [ 88.116545][ T6647] ? __pfx___sys_sendmsg+0x10/0x10 [ 88.121720][ T6647] ? trace_sys_enter+0xae/0x160 [ 88.126671][ T6647] ? __pfx_lock_release+0x10/0x10 [ 88.131739][ T6647] ? trace_sys_enter+0xae/0x160 [ 88.136615][ T6647] ? rcu_is_watching+0x15/0xb0 [ 88.141406][ T6647] ? trace_sys_enter+0x3d/0x160 [ 88.146285][ T6647] do_syscall_64+0xf3/0x230 [ 88.150814][ T6647] ? clear_bhb_loop+0x35/0x90 [ 88.155547][ T6647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.161461][ T6647] RIP: 0033:0x7fb691b7ff19 [ 88.165921][ T6647] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 88.185564][ T6647] RSP: 002b:00007fb692943058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 88.194034][ T6647] RAX: ffffffffffffffda RBX: 00007fb691d45fa0 RCX: 00007fb691b7ff19 [ 88.202025][ T6647] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 88.210013][ T6647] RBP: 00007fb6929430a0 R08: 0000000000000000 R09: 0000000000000000 [ 88.218000][ T6647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.225995][ T6647] R13: 0000000000000000 R14: 00007fb691d45fa0 R15: 00007ffff859c028 [ 88.234011][ T6647] [ 88.411165][ T6650] bridge0: port 3(vlan2) entered blocking state [ 91.037796][ T6650] bridge0: port 3(vlan2) entered disabled state [ 91.044314][ T6650] vlan2: entered allmulticast mode [ 91.957537][ T6650] vlan2: left allmulticast mode [ 100.217753][ T6671] netlink: 256 bytes leftover after parsing attributes in process `syz.0.249'. [ 100.321462][ T6669] netlink: 12 bytes leftover after parsing attributes in process `syz.2.248'. [ 100.355178][ T6680] tipc: Invalid UDP bearer configuration [ 100.355220][ T6680] tipc: Enabling of bearer rejected, failed to enable media [ 100.479330][ T6682] netlink: 184 bytes leftover after parsing attributes in process `syz.3.252'. [ 100.764165][ T54] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 100.774569][ T54] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 100.800185][ T54] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 100.849521][ T6690] netlink: 24 bytes leftover after parsing attributes in process `syz.1.254'. [ 100.859560][ T54] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 100.868304][ T54] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 100.876774][ T54] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 100.920042][ T6694] netlink: 187320 bytes leftover after parsing attributes in process `syz.0.253'. [ 100.941175][ T6694] net_ratelimit: 2 callbacks suppressed [ 100.941195][ T6694] netlink: zone id is out of range [ 100.954287][ T6694] netlink: zone id is out of range [ 101.346313][ T6703] netlink: 8 bytes leftover after parsing attributes in process `syz.3.257'. [ 101.633696][ T1312] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.696882][ T6736] tipc: Invalid UDP bearer configuration [ 101.696924][ T6736] tipc: Enabling of bearer rejected, failed to enable media [ 101.761997][ T6734] dvmrp1: entered allmulticast mode [ 101.903715][ T1312] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.933549][ T6748] netlink: 4552 bytes leftover after parsing attributes in process `syz.3.265'. [ 102.008014][ T6748] netlink: 4552 bytes leftover after parsing attributes in process `syz.3.265'. [ 102.099876][ T6753] netlink: 'syz.0.267': attribute type 7 has an invalid length. [ 102.150232][ T1312] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.180451][ T6759] netlink: 187320 bytes leftover after parsing attributes in process `syz.3.268'. [ 102.200896][ T6753] tipc: Failed to obtain node identity [ 102.209674][ T6753] tipc: Enabling of bearer rejected, failed to enable media [ 102.219093][ T6759] netlink: zone id is out of range [ 102.224247][ T6759] netlink: zone id is out of range [ 102.266625][ T1312] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.604025][ T6779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 102.616500][ T6688] chnl_net:caif_netlink_parms(): no params data found [ 102.663932][ T6774] netlink: 24 bytes leftover after parsing attributes in process `syz.0.272'. [ 102.804210][ T1312] bridge_slave_1: left allmulticast mode [ 102.810822][ T1312] bridge_slave_1: left promiscuous mode [ 102.822149][ T1312] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.878539][ T1312] bridge_slave_0: left allmulticast mode [ 102.884366][ T1312] bridge_slave_0: left promiscuous mode [ 102.898067][ T1312] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.077988][ T5165] Bluetooth: hci5: command tx timeout [ 103.522243][ T1312] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 103.534351][ T1312] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 103.545299][ T1312] bond0 (unregistering): Released all slaves [ 103.595232][ T6795] tipc: Invalid UDP bearer configuration [ 103.595279][ T6795] tipc: Enabling of bearer rejected, failed to enable media [ 103.802728][ T6820] netlink: zone id is out of range [ 103.826267][ T6820] netlink: zone id is out of range [ 104.336628][ T6688] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.359344][ T6688] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.375731][ T6688] bridge_slave_0: entered allmulticast mode [ 104.391483][ T6688] bridge_slave_0: entered promiscuous mode [ 104.568688][ T6688] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.597435][ T6688] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.618377][ T6688] bridge_slave_1: entered allmulticast mode [ 104.638269][ T6688] bridge_slave_1: entered promiscuous mode [ 104.783237][ T6880] netlink: 'syz.3.289': attribute type 1 has an invalid length. [ 104.854594][ T1312] hsr_slave_0: left promiscuous mode [ 104.874990][ T1312] hsr_slave_1: left promiscuous mode [ 104.883480][ T1312] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 104.906064][ T1312] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 104.925877][ T1312] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.936279][ T1312] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 104.956313][ T1312] veth1_macvtap: left promiscuous mode [ 104.967864][ T1312] veth0_macvtap: left promiscuous mode [ 104.975634][ T1312] veth1_vlan: left promiscuous mode [ 104.982184][ T1312] veth0_vlan: left promiscuous mode [ 105.161924][ T5165] Bluetooth: hci5: command tx timeout [ 105.426393][ T1312] team0 (unregistering): Port device team_slave_1 removed [ 105.466478][ T1312] team0 (unregistering): Port device team_slave_0 removed [ 105.810002][ T6688] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.835096][ T6688] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 106.046215][ T6900] __nla_validate_parse: 3 callbacks suppressed [ 106.046234][ T6900] netlink: 4 bytes leftover after parsing attributes in process `syz.1.295'. [ 106.056560][ T6899] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 106.142882][ T6688] team0: Port device team_slave_0 added [ 106.178147][ T6688] team0: Port device team_slave_1 added [ 106.190522][ T6904] tap0: tun_chr_ioctl cmd 2148553947 [ 106.250635][ T6907] tap0: tun_chr_ioctl cmd 2148553947 [ 106.394589][ T6688] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 106.411178][ T6688] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 106.480057][ T6688] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.494439][ T6688] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.515789][ T6688] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 106.543203][ T6688] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.630215][ T6921] vlan2: entered allmulticast mode [ 106.635964][ T6921] bond0: entered allmulticast mode [ 106.677732][ T6921] bond_slave_0: entered allmulticast mode [ 106.683537][ T6921] bond_slave_1: entered allmulticast mode [ 106.725274][ T6921] bond0: left allmulticast mode [ 106.748793][ T6923] netlink: 20 bytes leftover after parsing attributes in process `syz.3.303'. [ 106.753958][ T6921] bond_slave_0: left allmulticast mode [ 106.765305][ T6921] bond_slave_1: left allmulticast mode [ 106.804982][ T6928] netlink: 'syz.0.302': attribute type 1 has an invalid length. [ 106.857912][ T6928] netlink: 224 bytes leftover after parsing attributes in process `syz.0.302'. [ 106.908483][ T6932] netlink: 24 bytes leftover after parsing attributes in process `syz.0.302'. [ 107.104374][ T6688] hsr_slave_0: entered promiscuous mode [ 107.183896][ T6688] hsr_slave_1: entered promiscuous mode [ 107.201028][ T6688] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 107.213879][ T6688] Cannot create hsr debugfs directory [ 107.244252][ T5165] Bluetooth: hci5: command tx timeout [ 107.267506][ T6955] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 107.290860][ T6953] netlink: 'syz.0.308': attribute type 16 has an invalid length. [ 107.346233][ T6953] netlink: 'syz.0.308': attribute type 17 has an invalid length. [ 107.530659][ T5944] IPVS: starting estimator thread 0... [ 107.559215][ T6971] netlink: 44 bytes leftover after parsing attributes in process `syz.3.312'. [ 107.642892][ T6974] IPVS: using max 27 ests per chain, 64800 per kthread [ 107.688820][ T6977] netlink: 64 bytes leftover after parsing attributes in process `syz.3.312'. [ 107.813050][ T6688] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 107.858457][ T6688] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 107.940028][ T6688] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 107.973341][ T6688] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 108.010673][ T6991] netlink: 216 bytes leftover after parsing attributes in process `syz.2.315'. [ 108.040621][ T6991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.315'. [ 108.077440][ T6992] netlink: 216 bytes leftover after parsing attributes in process `syz.2.315'. [ 108.112358][ T6992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.315'. [ 108.184591][ T6688] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.243927][ T6688] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.322611][ T3027] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.329842][ T3027] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.330195][ T7005] netlink: zone id is out of range [ 108.371731][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.379007][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.379514][ T7005] netlink: zone id is out of range [ 108.415752][ T7008] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 108.519461][ T6688] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 108.611578][ T7014] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.640097][ T7014] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.986696][ T7037] openvswitch: netlink: Unknown key attributes 20 [ 109.231882][ T6688] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.318731][ T5165] Bluetooth: hci5: command tx timeout [ 109.330746][ T7060] netlink: 'syz.3.331': attribute type 1 has an invalid length. [ 110.010020][ T6688] veth0_vlan: entered promiscuous mode [ 110.077869][ T6688] veth1_vlan: entered promiscuous mode [ 110.125692][ T7100] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 110.222577][ T6688] veth0_macvtap: entered promiscuous mode [ 110.257561][ T6688] veth1_macvtap: entered promiscuous mode [ 110.359777][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.419305][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.466423][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.499575][ T7120] netlink: 'syz.2.343': attribute type 12 has an invalid length. [ 110.512519][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.533354][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.536578][ T7121] netlink: 'syz.1.346': attribute type 1 has an invalid length. [ 110.568217][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.592055][ T7122] netlink: 'syz.2.343': attribute type 12 has an invalid length. [ 110.599324][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.610501][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.626367][ T6688] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.657968][ T7122] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 110.770987][ T7120] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 110.873351][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 110.912441][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.944970][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 110.960505][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.996449][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.024430][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.036394][ T6688] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.047483][ T6688] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.059582][ T6688] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.078538][ T6688] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.087288][ T6688] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.096325][ T6688] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.111267][ T6688] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.370278][ T7149] __nla_validate_parse: 14 callbacks suppressed [ 111.370298][ T7149] netlink: 187320 bytes leftover after parsing attributes in process `syz.3.353'. [ 111.431133][ T7149] netlink: zone id is out of range [ 111.436426][ T7149] netlink: zone id is out of range [ 111.488509][ T7158] netlink: 'syz.2.355': attribute type 1 has an invalid length. [ 111.673095][ T7176] netlink: 'syz.1.359': attribute type 1 has an invalid length. [ 111.684048][ T7176] Cannot find set identified by id 0 to match [ 111.691373][ T7158] bond1: (slave ipip0): The slave device specified does not support setting the MAC address [ 111.722278][ T7158] bond1: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 111.765541][ T7158] bond1: (slave ipip0): making interface the new active one [ 111.794296][ T7158] bond1: (slave ipip0): Enslaving as an active interface with an up link [ 111.875171][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.883477][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.232509][ T6814] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.288269][ T6814] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.351322][ T7206] netlink: 'syz.1.365': attribute type 10 has an invalid length. [ 112.370658][ T7207] netlink: 24 bytes leftover after parsing attributes in process `syz.3.364'. [ 112.473586][ T7206] team0: Device hsr_slave_0 failed to register rx_handler [ 113.194321][ T7244] netlink: 'syz.2.375': attribute type 29 has an invalid length. [ 113.466713][ T7266] netlink: 'syz.1.379': attribute type 1 has an invalid length. [ 113.474674][ T7266] netlink: 224 bytes leftover after parsing attributes in process `syz.1.379'. [ 113.595553][ T7272] netlink: 72 bytes leftover after parsing attributes in process `syz.1.382'. [ 113.612905][ T7272] netlink: 20 bytes leftover after parsing attributes in process `syz.1.382'. [ 113.628786][ T7272] netlink: 8 bytes leftover after parsing attributes in process `syz.1.382'. [ 113.752227][ T7279] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.756648][ T7272] netlink: 4 bytes leftover after parsing attributes in process `syz.1.382'. [ 113.761638][ T7279] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.779253][ T7279] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.788078][ T7279] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 113.837906][ T7279] vxlan0: entered promiscuous mode [ 113.849783][ T7279] vxlan0: entered allmulticast mode [ 114.000711][ T7290] netlink: 'syz.2.385': attribute type 1 has an invalid length. [ 114.012376][ T7290] netlink: 224 bytes leftover after parsing attributes in process `syz.2.385'. [ 114.064718][ T7296] netlink: 24 bytes leftover after parsing attributes in process `syz.2.385'. [ 114.430258][ T7309] tipc: Invalid UDP bearer configuration [ 114.430300][ T7309] tipc: Enabling of bearer rejected, failed to enable media [ 114.521621][ T7316] vlan2: entered allmulticast mode [ 114.557267][ T7316] bond0: entered allmulticast mode [ 114.580302][ T7316] bond_slave_0: entered allmulticast mode [ 114.586091][ T7316] bond_slave_1: entered allmulticast mode [ 114.647986][ T7319] netlink: 'syz.2.393': attribute type 1 has an invalid length. [ 114.673763][ T7319] netlink: 224 bytes leftover after parsing attributes in process `syz.2.393'. [ 114.708247][ T7328] xt_hashlimit: Unknown mode mask 115, kernel too old? [ 114.821423][ T7316] bond0: left allmulticast mode [ 114.830620][ T7316] bond_slave_0: left allmulticast mode [ 114.883659][ T7316] bond_slave_1: left allmulticast mode [ 115.002523][ T7341] x_tables: (null)_tables: DNAT target: only valid in nat table, not syz0 [ 115.107809][ T7343] netlink: 'syz.0.398': attribute type 1 has an invalid length. [ 115.176123][ T7349] netlink: 'syz.2.399': attribute type 1 has an invalid length. [ 115.527863][ T7372] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 115.548983][ T7370] tap0: tun_chr_ioctl cmd 1074025676 [ 115.566374][ T7370] tap0: owner set to 0 [ 115.581363][ T7378] tipc: Invalid UDP bearer configuration [ 115.581403][ T7378] tipc: Enabling of bearer rejected, failed to enable media [ 116.991472][ T7446] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.118395][ T7439] __nla_validate_parse: 4 callbacks suppressed [ 117.118429][ T7439] netlink: 8 bytes leftover after parsing attributes in process `syz.1.414'. [ 117.240780][ T7461] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 117.426169][ T7465] tipc: Invalid UDP bearer configuration [ 117.426211][ T7465] tipc: Enabling of bearer rejected, failed to enable media [ 117.602375][ T7476] netlink: 'syz.3.426': attribute type 1 has an invalid length. [ 117.617833][ T7476] netlink: 224 bytes leftover after parsing attributes in process `syz.3.426'. [ 117.657280][ T7479] netlink: 40 bytes leftover after parsing attributes in process `syz.1.425'. [ 117.679009][ T7481] netlink: 24 bytes leftover after parsing attributes in process `syz.3.426'. [ 117.759205][ T7485] netlink: 12 bytes leftover after parsing attributes in process `syz.5.427'. [ 117.997322][ T7497] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.006678][ T7497] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.213254][ T7509] netlink: 187320 bytes leftover after parsing attributes in process `syz.2.436'. [ 118.222921][ T7509] netlink: zone id is out of range [ 118.229963][ T7509] netlink: zone id is out of range [ 118.273524][ T7514] netlink: 187320 bytes leftover after parsing attributes in process `syz.5.433'. [ 118.315548][ T7514] netlink: zone id is out of range [ 118.342137][ T7514] netlink: zone id is out of range [ 118.368431][ T7510] netlink: 668 bytes leftover after parsing attributes in process `syz.1.434'. [ 118.387983][ T7514] netlink: zone id is out of range [ 118.393239][ T7510] netlink: 668 bytes leftover after parsing attributes in process `syz.1.434'. [ 118.404803][ T7514] netlink: zone id is out of range [ 118.421450][ T7514] netlink: zone id is out of range [ 118.439336][ T7514] netlink: zone id is out of range [ 118.454037][ T7514] netlink: zone id is out of range [ 118.595473][ T7528] netlink: 40 bytes leftover after parsing attributes in process `syz.3.439'. [ 118.854649][ T7540] netlink: 'syz.1.441': attribute type 1 has an invalid length. [ 119.279662][ T7556] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.296323][ T7556] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.650416][ T7575] netlink: 'syz.2.449': attribute type 4 has an invalid length. [ 119.772194][ T7588] netlink: 'syz.5.455': attribute type 1 has an invalid length. [ 120.198240][ T7613] netlink: 'syz.3.462': attribute type 1 has an invalid length. [ 120.360061][ T7623] vcan0: tx drop: invalid da for name 0x0000000400000000 [ 120.656145][ T7639] tipc: Invalid UDP bearer configuration [ 120.656184][ T7639] tipc: Enabling of bearer rejected, failed to enable media [ 121.217929][ T7654] netlink: 'syz.1.477': attribute type 1 has an invalid length. [ 121.305328][ T7650] netlink: 'syz.2.475': attribute type 5 has an invalid length. [ 121.623478][ T7669] tipc: Invalid UDP bearer configuration [ 121.623512][ T7669] tipc: Enabling of bearer rejected, failed to enable media [ 121.638412][ T7670] netlink: 'syz.0.480': attribute type 29 has an invalid length. [ 121.673477][ T7662] netlink: 'syz.0.480': attribute type 29 has an invalid length. [ 121.751088][ T7675] vlan2: entered allmulticast mode [ 121.756941][ T7675] bond0: entered allmulticast mode [ 121.762214][ T7675] bond_slave_0: entered allmulticast mode [ 121.768118][ T7675] bond_slave_1: entered allmulticast mode [ 121.858112][ T7675] bond0: left allmulticast mode [ 121.863162][ T7675] bond_slave_0: left allmulticast mode [ 121.869548][ T7675] bond_slave_1: left allmulticast mode [ 122.139070][ T7692] __nla_validate_parse: 10 callbacks suppressed [ 122.139089][ T7692] netlink: 20 bytes leftover after parsing attributes in process `syz.5.493'. [ 122.179053][ T7695] netlink: 12 bytes leftover after parsing attributes in process `syz.1.494'. [ 122.383890][ T7707] netlink: 187320 bytes leftover after parsing attributes in process `syz.5.498'. [ 122.409363][ T7707] netlink: zone id is out of range [ 122.683784][ T7719] netlink: 'syz.5.505': attribute type 1 has an invalid length. [ 122.693990][ T7719] netlink: 224 bytes leftover after parsing attributes in process `syz.5.505'. [ 122.726146][ T7722] netlink: 'syz.1.504': attribute type 1 has an invalid length. [ 122.753166][ T7722] netlink: 224 bytes leftover after parsing attributes in process `syz.1.504'. [ 122.765443][ T7725] netlink: 20 bytes leftover after parsing attributes in process `syz.3.507'. [ 122.858317][ T7728] netlink: 24 bytes leftover after parsing attributes in process `syz.1.504'. [ 122.872098][ T7733] netlink: 12 bytes leftover after parsing attributes in process `syz.5.508'. [ 122.948591][ T7733] netlink: 32 bytes leftover after parsing attributes in process `syz.5.508'. [ 122.959191][ T7732] netlink: 32 bytes leftover after parsing attributes in process `syz.5.508'. [ 123.034644][ T7739] tipc: Invalid UDP bearer configuration [ 123.034688][ T7739] tipc: Enabling of bearer rejected, failed to enable media [ 123.512255][ T7760] netlink: 'syz.2.519': attribute type 1 has an invalid length. [ 123.720721][ T7777] netlink: 'syz.0.525': attribute type 1 has an invalid length. [ 123.824690][ T7775] tipc: Invalid UDP bearer configuration [ 123.824745][ T7775] tipc: Enabling of bearer rejected, failed to enable media [ 124.535789][ T7824] tipc: Invalid UDP bearer configuration [ 124.535832][ T7824] tipc: Enabling of bearer rejected, failed to enable media [ 125.192550][ T7859] netlink: 'syz.5.556': attribute type 1 has an invalid length. [ 125.270992][ T7864] tipc: Invalid UDP bearer configuration [ 125.271035][ T7864] tipc: Enabling of bearer rejected, failed to enable media [ 126.505532][ T7923] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input5 [ 126.846683][ T7914] pimreg: entered allmulticast mode [ 127.433739][ T7946] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.442612][ T7946] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.451960][ T7946] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.461033][ T7946] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.498786][ T7946] vxlan0: entered promiscuous mode [ 127.505564][ T7946] vxlan0: entered allmulticast mode [ 127.600257][ T7946] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 127.609620][ T7946] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 127.618868][ T7946] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 127.628041][ T7946] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 127.917948][ T7946] syz.1.591 (7946) used greatest stack depth: 18096 bytes left [ 128.231440][ T7982] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 128.315691][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.348367][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.110877][ T8023] net_ratelimit: 6 callbacks suppressed [ 129.110898][ T8023] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 129.180614][ T8023] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 129.661733][ T8053] netlink: 'syz.5.623': attribute type 21 has an invalid length. [ 129.703931][ T8053] __nla_validate_parse: 18 callbacks suppressed [ 129.703950][ T8053] netlink: 156 bytes leftover after parsing attributes in process `syz.5.623'. [ 129.760977][ T8054] netlink: 12 bytes leftover after parsing attributes in process `syz.0.621'. [ 130.020405][ T8073] netlink: 4 bytes leftover after parsing attributes in process `syz.5.627'. [ 130.397288][ T8093] netlink: 168 bytes leftover after parsing attributes in process `syz.3.637'. [ 131.238374][ T8136] netlink: 4 bytes leftover after parsing attributes in process `syz.3.648'. [ 131.462150][ T8146] netlink: 16 bytes leftover after parsing attributes in process `syz.2.655'. [ 131.508204][ T8148] netlink: 'syz.0.651': attribute type 1 has an invalid length. [ 131.535313][ T8148] netlink: 'syz.0.651': attribute type 3 has an invalid length. [ 131.560805][ T8148] netlink: 224 bytes leftover after parsing attributes in process `syz.0.651'. [ 131.614941][ T8155] netlink: 12 bytes leftover after parsing attributes in process `syz.2.656'. [ 131.883154][ T8169] dccp_invalid_packet: P.Data Offset(4) too small [ 131.947756][ T8161] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.057515][ T8174] tipc: Started in network mode [ 132.065506][ T8174] tipc: Node identity aaaaaaaaaa41, cluster identity 4711 [ 132.094097][ T8174] tipc: Enabled bearer , priority 10 [ 132.119310][ T3027] wlan1: Trigger new scan to find an IBSS to join [ 132.253395][ T8161] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.434300][ T8161] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.512252][ T8199] tipc: Can't bind to reserved service type 1 [ 132.752863][ T8161] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.955104][ T8216] netlink: 372 bytes leftover after parsing attributes in process `syz.5.676'. [ 132.981119][ T8161] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.042225][ T8161] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.081215][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.087660][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.095729][ T5897] tipc: Node number set to 15444650 [ 133.169115][ T8161] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.183612][ T8161] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.220701][ T8229] netlink: 'syz.5.682': attribute type 1 has an invalid length. [ 133.413791][ T8234] bond1 (unregistering): Released all slaves [ 133.544194][ T8229] 8021q: adding VLAN 0 to HW filter on device bond1 [ 133.732216][ T8253] x_tables: ip_tables: SNAT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING [ 134.088912][ T8279] netlink: 732 bytes leftover after parsing attributes in process `syz.3.697'. [ 134.771821][ T8302] pim6reg1: entered promiscuous mode [ 134.796538][ T8302] pim6reg1: entered allmulticast mode [ 134.844643][ T8305] vlan2: entered allmulticast mode [ 135.122183][ T8321] __nla_validate_parse: 4 callbacks suppressed [ 135.122204][ T8321] netlink: 40 bytes leftover after parsing attributes in process `syz.1.707'. [ 135.446182][ T8335] netlink: 'syz.2.712': attribute type 2 has an invalid length. [ 135.473086][ T8335] netlink: 188 bytes leftover after parsing attributes in process `syz.2.712'. [ 135.529560][ T8338] netlink: 12 bytes leftover after parsing attributes in process `syz.3.716'. [ 135.545442][ T8339] netlink: 'syz.1.714': attribute type 1 has an invalid length. [ 135.559230][ T8344] netlink: 20 bytes leftover after parsing attributes in process `syz.5.713'. [ 135.575664][ T8339] netlink: 224 bytes leftover after parsing attributes in process `syz.1.714'. [ 135.778532][ T8348] netlink: 187320 bytes leftover after parsing attributes in process `syz.0.715'. [ 135.788754][ T8348] netlink: zone id is out of range [ 135.794181][ T8348] netlink: zone id is out of range [ 135.855219][ T8348] netlink: zone id is out of range [ 135.894900][ T8348] netlink: zone id is out of range [ 135.907557][ T8348] netlink: zone id is out of range [ 136.150173][ T8361] bridge0: port 1(bridge_slave_0) entered disabled state [ 136.174689][ T8361] bridge0: port 2(bridge_slave_1) entered disabled state [ 136.445850][ T8384] netlink: 'syz.2.724': attribute type 10 has an invalid length. [ 136.704847][ T8401] FAULT_INJECTION: forcing a failure. [ 136.704847][ T8401] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 136.733154][ T8401] CPU: 1 UID: 0 PID: 8401 Comm: syz.5.729 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 136.743461][ T8401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 136.753550][ T8401] Call Trace: [ 136.756859][ T8401] [ 136.759854][ T8401] dump_stack_lvl+0x241/0x360 [ 136.764578][ T8401] ? __pfx_dump_stack_lvl+0x10/0x10 [ 136.769923][ T8401] ? __pfx__printk+0x10/0x10 [ 136.774558][ T8401] should_fail_ex+0x3b0/0x4e0 [ 136.779287][ T8401] _copy_from_user+0x2f/0xc0 [ 136.783930][ T8401] sctp_setsockopt+0xcc/0x11c0 [ 136.788735][ T8401] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 136.794679][ T8401] do_sock_setsockopt+0x3af/0x720 [ 136.799748][ T8401] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 136.805338][ T8401] ? __fget_files+0x395/0x410 [ 136.810059][ T8401] ? __fget_files+0x2a/0x410 [ 136.814722][ T8401] __x64_sys_setsockopt+0x1ee/0x280 [ 136.819972][ T8401] do_syscall_64+0xf3/0x230 [ 136.824516][ T8401] ? clear_bhb_loop+0x35/0x90 [ 136.829236][ T8401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.835172][ T8401] RIP: 0033:0x7fa3b977ff19 [ 136.839618][ T8401] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.859251][ T8401] RSP: 002b:00007fa3b75f6058 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 136.867694][ T8401] RAX: ffffffffffffffda RBX: 00007fa3b9945fa0 RCX: 00007fa3b977ff19 [ 136.875677][ T8401] RDX: 0000000000000079 RSI: 0000000000000084 RDI: 0000000000000003 [ 136.883646][ T8401] RBP: 00007fa3b75f60a0 R08: 0000000000000008 R09: 0000000000000000 [ 136.891618][ T8401] R10: 0000000020000140 R11: 0000000000000246 R12: 0000000000000001 [ 136.899584][ T8401] R13: 0000000000000000 R14: 00007fa3b9945fa0 R15: 00007ffcbccd57b8 [ 136.907567][ T8401] [ 137.083608][ T3027] wlan1: Trigger new scan to find an IBSS to join [ 137.133695][ T8420] netlink: 40 bytes leftover after parsing attributes in process `syz.5.730'. [ 137.635605][ T8445] sctp: [Deprecated]: syz.1.736 (pid 8445) Use of int in max_burst socket option. [ 137.635605][ T8445] Use struct sctp_assoc_value instead [ 137.864877][ T8454] netlink: 20 bytes leftover after parsing attributes in process `syz.2.741'. [ 137.899406][ T8457] netlink: 40 bytes leftover after parsing attributes in process `syz.1.744'. [ 138.039674][ T12] wlan1: Creating new IBSS network, BSSID ea:be:3d:43:ca:0a [ 138.113764][ T8471] netlink: 'syz.0.746': attribute type 1 has an invalid length. [ 138.131242][ T8471] netlink: 224 bytes leftover after parsing attributes in process `syz.0.746'. [ 139.068604][ T8507] netlink: 'syz.3.762': attribute type 12 has an invalid length. [ 139.648114][ T8535] tipc: Invalid UDP bearer configuration [ 139.648156][ T8535] tipc: Enabling of bearer rejected, failed to enable media [ 139.712606][ T8534] workqueue: name exceeds WQ_NAME_LEN. Truncating to: þÜ»}ÆÓž»räءÑV§ïj×ì·Pbô [ 139.975501][ T8549] FAULT_INJECTION: forcing a failure. [ 139.975501][ T8549] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.024067][ T8549] CPU: 0 UID: 0 PID: 8549 Comm: syz.3.780 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 140.034404][ T8549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 140.044486][ T8549] Call Trace: [ 140.047785][ T8549] [ 140.050747][ T8549] dump_stack_lvl+0x241/0x360 [ 140.055541][ T8549] ? __pfx_dump_stack_lvl+0x10/0x10 [ 140.060774][ T8549] ? __pfx__printk+0x10/0x10 [ 140.065395][ T8549] ? __pfx_lock_release+0x10/0x10 [ 140.070492][ T8549] ? tomoyo_path_number_perm+0x6f9/0x860 [ 140.076162][ T8549] ? __lock_acquire+0x1397/0x2100 [ 140.081218][ T8549] should_fail_ex+0x3b0/0x4e0 [ 140.085930][ T8549] _copy_from_user+0x2f/0xc0 [ 140.090561][ T8549] wext_handle_ioctl+0xf2/0x270 [ 140.095451][ T8549] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 140.100955][ T8549] sock_ioctl+0x17c/0x8e0 [ 140.105314][ T8549] ? __pfx_sock_ioctl+0x10/0x10 [ 140.110195][ T8549] ? __fget_files+0x2a/0x410 [ 140.114829][ T8549] ? __fget_files+0x2a/0x410 [ 140.119461][ T8549] ? __pfx_sock_ioctl+0x10/0x10 [ 140.124357][ T8549] __se_sys_ioctl+0xf5/0x170 [ 140.128976][ T8549] do_syscall_64+0xf3/0x230 [ 140.133506][ T8549] ? clear_bhb_loop+0x35/0x90 [ 140.138215][ T8549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.144148][ T8549] RIP: 0033:0x7f0cccf7ff19 [ 140.148591][ T8549] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 140.168222][ T8549] RSP: 002b:00007f0ccdd10058 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.176676][ T8549] RAX: ffffffffffffffda RBX: 00007f0ccd145fa0 RCX: 00007f0cccf7ff19 [ 140.184684][ T8549] RDX: 0000000020000040 RSI: 0000000000008b04 RDI: 0000000000000008 [ 140.192697][ T8549] RBP: 00007f0ccdd100a0 R08: 0000000000000000 R09: 0000000000000000 [ 140.200701][ T8549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.208789][ T8549] R13: 0000000000000000 R14: 00007f0ccd145fa0 R15: 00007ffce3202028 [ 140.216887][ T8549] [ 140.347445][ T8558] __nla_validate_parse: 2 callbacks suppressed [ 140.347465][ T8558] netlink: 12 bytes leftover after parsing attributes in process `syz.0.782'. [ 140.712668][ T8573] netlink: 20 bytes leftover after parsing attributes in process `syz.5.787'. [ 140.796669][ T8571] netlink: 'syz.3.788': attribute type 1 has an invalid length. [ 140.804699][ T8571] netlink: 224 bytes leftover after parsing attributes in process `syz.3.788'. [ 140.862929][ T8578] tipc: Invalid UDP bearer configuration [ 140.862972][ T8578] tipc: Enabling of bearer rejected, failed to enable media [ 141.337688][ T8603] netem: change failed [ 141.389059][ T8608] netlink: 28 bytes leftover after parsing attributes in process `syz.0.801'. [ 141.420752][ T8608] netlink: 'syz.0.801': attribute type 7 has an invalid length. [ 141.437774][ T8608] netlink: 'syz.0.801': attribute type 8 has an invalid length. [ 141.445466][ T8608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.801'. [ 141.582649][ T8614] FAULT_INJECTION: forcing a failure. [ 141.582649][ T8614] name failslab, interval 1, probability 0, space 0, times 0 [ 141.636729][ T8614] CPU: 0 UID: 0 PID: 8614 Comm: syz.1.802 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 141.642003][ T8617] netlink: 'syz.2.803': attribute type 1 has an invalid length. [ 141.647088][ T8614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 141.647106][ T8614] Call Trace: [ 141.647114][ T8614] [ 141.647123][ T8614] dump_stack_lvl+0x241/0x360 [ 141.675749][ T8614] ? __pfx_dump_stack_lvl+0x10/0x10 [ 141.680978][ T8614] ? __pfx__printk+0x10/0x10 [ 141.685609][ T8614] should_fail_ex+0x3b0/0x4e0 [ 141.690314][ T8614] should_failslab+0xac/0x100 [ 141.695019][ T8614] kmem_cache_alloc_node_noprof+0x77/0x380 [ 141.700853][ T8614] ? __alloc_skb+0x1c3/0x440 [ 141.705473][ T8614] __alloc_skb+0x1c3/0x440 [ 141.709922][ T8614] ? __pfx___alloc_skb+0x10/0x10 [ 141.711251][ T8617] netlink: 224 bytes leftover after parsing attributes in process `syz.2.803'. [ 141.714867][ T8614] ? rcu_is_watching+0x15/0xb0 [ 141.714901][ T8614] wireless_send_event+0x2c7/0xc20 [ 141.733719][ T8614] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 141.739559][ T8614] ? __pfx_wireless_send_event+0x10/0x10 [ 141.745233][ T8614] ? full_name_hash+0x93/0xe0 [ 141.749945][ T8614] ioctl_standard_call+0x146/0x280 [ 141.755104][ T8614] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 141.760941][ T8614] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 141.766775][ T8614] wext_ioctl_dispatch+0x58e/0x680 [ 141.771921][ T8614] ? __pfx_ioctl_standard_call+0x10/0x10 [ 141.777587][ T8614] ? __pfx_ioctl_private_call+0x10/0x10 [ 141.783172][ T8614] ? __pfx_wext_ioctl_dispatch+0x10/0x10 [ 141.788838][ T8614] ? __might_fault+0xc6/0x120 [ 141.793554][ T8614] wext_handle_ioctl+0x15f/0x270 [ 141.798528][ T8614] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 141.804033][ T8614] sock_ioctl+0x17c/0x8e0 [ 141.808400][ T8614] ? __pfx_sock_ioctl+0x10/0x10 [ 141.813277][ T8614] ? __fget_files+0x2a/0x410 [ 141.817902][ T8614] ? __fget_files+0x2a/0x410 [ 141.822531][ T8614] ? __pfx_sock_ioctl+0x10/0x10 [ 141.827421][ T8614] __se_sys_ioctl+0xf5/0x170 [ 141.832043][ T8614] do_syscall_64+0xf3/0x230 [ 141.836584][ T8614] ? clear_bhb_loop+0x35/0x90 [ 141.841301][ T8614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.847223][ T8614] RIP: 0033:0x7fa20837ff19 [ 141.851662][ T8614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 141.871302][ T8614] RSP: 002b:00007fa2091c2058 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 141.879752][ T8614] RAX: ffffffffffffffda RBX: 00007fa208546080 RCX: 00007fa20837ff19 [ 141.887754][ T8614] RDX: 0000000020000040 RSI: 0000000000008b04 RDI: 0000000000000009 [ 141.895755][ T8614] RBP: 00007fa2091c20a0 R08: 0000000000000000 R09: 0000000000000000 [ 141.903757][ T8614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.911754][ T8614] R13: 0000000000000000 R14: 00007fa208546080 R15: 00007fffa41a13c8 [ 141.919767][ T8614] [ 141.977402][ T8621] tipc: Invalid UDP bearer configuration [ 141.977446][ T8621] tipc: Enabling of bearer rejected, failed to enable media [ 142.268613][ T8632] netlink: 4 bytes leftover after parsing attributes in process `syz.2.807'. [ 142.306164][ T8637] netlink: 44 bytes leftover after parsing attributes in process `syz.1.810'. [ 142.491606][ T8647] netlink: 20 bytes leftover after parsing attributes in process `syz.5.813'. [ 142.795987][ T8662] tipc: Invalid UDP bearer configuration [ 142.796030][ T8662] tipc: Enabling of bearer rejected, failed to enable media [ 142.859760][ T8666] netlink: 'syz.5.817': attribute type 1 has an invalid length. [ 142.868188][ T8666] netlink: 224 bytes leftover after parsing attributes in process `syz.5.817'. [ 143.433091][ T8701] skbuff: bad partial csum: csum=65506/2 headroom=144 headlen=65526 [ 143.648722][ T8714] netlink: 'syz.3.830': attribute type 1 has an invalid length. [ 143.680655][ T8706] vlan3: entered allmulticast mode [ 143.695831][ T8706] bond0: entered allmulticast mode [ 143.718230][ T8706] bond_slave_0: entered allmulticast mode [ 143.727338][ T8706] bond_slave_1: entered allmulticast mode [ 143.748588][ T8706] bond0: left allmulticast mode [ 143.753621][ T8706] bond_slave_0: left allmulticast mode [ 143.759500][ T8706] bond_slave_1: left allmulticast mode [ 144.076934][ T8734] FAULT_INJECTION: forcing a failure. [ 144.076934][ T8734] name failslab, interval 1, probability 0, space 0, times 0 [ 144.115531][ T8734] CPU: 1 UID: 0 PID: 8734 Comm: syz.5.835 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 144.125831][ T8734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 144.135921][ T8734] Call Trace: [ 144.139229][ T8734] [ 144.142185][ T8734] dump_stack_lvl+0x241/0x360 [ 144.146902][ T8734] ? __pfx_dump_stack_lvl+0x10/0x10 [ 144.152135][ T8734] ? __pfx__printk+0x10/0x10 [ 144.156771][ T8734] should_fail_ex+0x3b0/0x4e0 [ 144.161486][ T8734] should_failslab+0xac/0x100 [ 144.166201][ T8734] kmem_cache_alloc_node_noprof+0x77/0x380 [ 144.172039][ T8734] ? __alloc_skb+0x1c3/0x440 [ 144.176664][ T8734] __alloc_skb+0x1c3/0x440 [ 144.181108][ T8734] ? skb_put+0x114/0x1f0 [ 144.185380][ T8734] ? nla_put+0x131/0x1e0 [ 144.189691][ T8734] ? __pfx___alloc_skb+0x10/0x10 [ 144.194665][ T8734] ? wireless_send_event+0x391/0xc20 [ 144.199991][ T8734] wireless_send_event+0x4ea/0xc20 [ 144.205180][ T8734] ? __pfx_wireless_send_event+0x10/0x10 [ 144.210947][ T8734] ? full_name_hash+0x93/0xe0 [ 144.215928][ T8734] ioctl_standard_call+0x146/0x280 [ 144.221081][ T8734] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 144.226908][ T8734] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 144.232724][ T8734] wext_ioctl_dispatch+0x58e/0x680 [ 144.237844][ T8734] ? __pfx_ioctl_standard_call+0x10/0x10 [ 144.243481][ T8734] ? __pfx_ioctl_private_call+0x10/0x10 [ 144.249036][ T8734] ? __pfx_wext_ioctl_dispatch+0x10/0x10 [ 144.254687][ T8734] ? __might_fault+0xc6/0x120 [ 144.259383][ T8734] wext_handle_ioctl+0x15f/0x270 [ 144.264331][ T8734] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 144.269820][ T8734] sock_ioctl+0x17c/0x8e0 [ 144.274177][ T8734] ? __pfx_sock_ioctl+0x10/0x10 [ 144.279046][ T8734] ? __fget_files+0x2a/0x410 [ 144.283651][ T8734] ? __fget_files+0x2a/0x410 [ 144.288252][ T8734] ? __pfx_sock_ioctl+0x10/0x10 [ 144.293108][ T8734] __se_sys_ioctl+0xf5/0x170 [ 144.297789][ T8734] do_syscall_64+0xf3/0x230 [ 144.302391][ T8734] ? clear_bhb_loop+0x35/0x90 [ 144.307079][ T8734] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.312971][ T8734] RIP: 0033:0x7fa3b977ff19 [ 144.317383][ T8734] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 144.336988][ T8734] RSP: 002b:00007fa3b75f6058 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 144.345405][ T8734] RAX: ffffffffffffffda RBX: 00007fa3b9945fa0 RCX: 00007fa3b977ff19 [ 144.353381][ T8734] RDX: 0000000020000040 RSI: 0000000000008b04 RDI: 0000000000000008 [ 144.361350][ T8734] RBP: 00007fa3b75f60a0 R08: 0000000000000000 R09: 0000000000000000 [ 144.369320][ T8734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.377287][ T8734] R13: 0000000000000000 R14: 00007fa3b9945fa0 R15: 00007ffcbccd57b8 [ 144.385266][ T8734] [ 144.394140][ T8735] tipc: Invalid UDP bearer configuration [ 144.394179][ T8735] tipc: Enabling of bearer rejected, failed to enable media [ 144.625149][ T8751] syzkaller1: entered promiscuous mode [ 144.636656][ T8753] netlink: 'syz.0.841': attribute type 1 has an invalid length. [ 144.666966][ T8751] syzkaller1: entered allmulticast mode [ 145.080969][ T8782] tipc: Invalid UDP bearer configuration [ 145.081011][ T8782] tipc: Enabling of bearer rejected, failed to enable media [ 145.324559][ T8799] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.357180][ T8799] batadv_slave_1: entered promiscuous mode [ 145.371003][ T8799] batadv_slave_1: entered allmulticast mode [ 145.565843][ T8808] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 145.566265][ T8806] netlink: 'syz.0.855': attribute type 1 has an invalid length. [ 145.575319][ T8808] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 145.583349][ T8806] __nla_validate_parse: 11 callbacks suppressed [ 145.583412][ T8806] netlink: 224 bytes leftover after parsing attributes in process `syz.0.855'. [ 145.607540][ T8808] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 145.616366][ T8808] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 145.664619][ T8808] vxlan0: entered promiscuous mode [ 145.701453][ T8808] vxlan0: entered allmulticast mode [ 145.874797][ T8825] tipc: Invalid UDP bearer configuration [ 145.874841][ T8825] tipc: Enabling of bearer rejected, failed to enable media [ 146.228412][ T8844] netlink: 'syz.5.869': attribute type 1 has an invalid length. [ 146.236111][ T8844] netlink: 224 bytes leftover after parsing attributes in process `syz.5.869'. [ 146.364514][ T8858] netlink: 24 bytes leftover after parsing attributes in process `syz.5.869'. [ 146.413292][ T8861] netlink: 40 bytes leftover after parsing attributes in process `syz.1.874'. [ 146.430520][ T8863] xt_bpf: check failed: parse error [ 146.460951][ T8849] netlink: 'syz.2.873': attribute type 1 has an invalid length. [ 146.481195][ T8849] netlink: 224 bytes leftover after parsing attributes in process `syz.2.873'. [ 146.534865][ T8865] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 146.543794][ T8865] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 146.552646][ T8865] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 146.561500][ T8865] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 146.636601][ T8865] vxlan0: entered promiscuous mode [ 146.655054][ T8865] vxlan0: entered allmulticast mode [ 146.673049][ T8872] netlink: 20 bytes leftover after parsing attributes in process `syz.5.880'. [ 146.957841][ T8884] netlink: 12 bytes leftover after parsing attributes in process `syz.5.884'. [ 147.013648][ T8889] netlink: 40 bytes leftover after parsing attributes in process `syz.0.887'. [ 147.145524][ T8893] netlink: 'syz.2.889': attribute type 1 has an invalid length. [ 147.163001][ T8893] netlink: 224 bytes leftover after parsing attributes in process `syz.2.889'. [ 147.219519][ T8898] erspan0: vlans aren't supported yet for dev_uc|mc_add() [ 147.326565][ T8903] netlink: 'syz.1.891': attribute type 1 has an invalid length. [ 147.352757][ T8903] netlink: 224 bytes leftover after parsing attributes in process `syz.1.891'. [ 147.561022][ T8917] netlink: 'syz.1.898': attribute type 1 has an invalid length. [ 147.870877][ T8927] tipc: Invalid UDP bearer configuration [ 147.870919][ T8927] tipc: Enabling of bearer rejected, failed to enable media [ 147.960002][ T8933] vlan3: entered allmulticast mode [ 147.976030][ T8933] bond0: entered allmulticast mode [ 147.985568][ T8933] bond_slave_0: entered allmulticast mode [ 147.995708][ T8933] bond_slave_1: entered allmulticast mode [ 148.057387][ T8933] bond0: left allmulticast mode [ 148.063002][ T8933] bond_slave_0: left allmulticast mode [ 148.071004][ T8933] bond_slave_1: left allmulticast mode [ 150.217294][ T8961] tipc: Enabling of bearer rejected, failed to enable media [ 150.237794][ T8979] tc_dump_action: action bad kind [ 151.665928][ T9023] __nla_validate_parse: 6 callbacks suppressed [ 151.665947][ T9023] netlink: 40 bytes leftover after parsing attributes in process `syz.0.933'. [ 151.976304][ T9040] netlink: 40 bytes leftover after parsing attributes in process `syz.5.940'. [ 152.132515][ T9044] netlink: 20 bytes leftover after parsing attributes in process `syz.0.941'. [ 152.220154][ T9048] netlink: 20 bytes leftover after parsing attributes in process `syz.5.944'. [ 152.307769][ T9014] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 152.418656][ T9048] netlink: 80 bytes leftover after parsing attributes in process `syz.5.944'. [ 152.462419][ T9048] netlink: 80 bytes leftover after parsing attributes in process `syz.5.944'. [ 153.041791][ T9065] netlink: 'syz.2.951': attribute type 1 has an invalid length. [ 153.050146][ T9065] netlink: 224 bytes leftover after parsing attributes in process `syz.2.951'. [ 153.112722][ T9070] netlink: 12 bytes leftover after parsing attributes in process `syz.2.955'. [ 153.266639][ T9076] veth0: entered promiscuous mode [ 153.276259][ T9076] veth0: left promiscuous mode [ 153.474600][ T9093] netlink: 16 bytes leftover after parsing attributes in process `syz.3.961'. [ 153.917997][ T9119] netlink: 20 bytes leftover after parsing attributes in process `syz.2.968'. [ 154.202161][ T9126] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 154.231686][ T9128] netlink: 'syz.2.975': attribute type 1 has an invalid length. [ 154.819947][ T9151] netlink: 'syz.5.983': attribute type 10 has an invalid length. [ 154.869594][ T9151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.884391][ T9151] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 155.249446][ T9171] netlink: 'syz.2.992': attribute type 1 has an invalid length. [ 155.564019][ T9190] xt_l2tp: unknown flags: 18 [ 156.345725][ T9224] netlink: 'syz.0.1009': attribute type 1 has an invalid length. [ 156.813006][ T9255] netlink: 'syz.0.1017': attribute type 1 has an invalid length. [ 156.843655][ T9255] __nla_validate_parse: 9 callbacks suppressed [ 156.843674][ T9255] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1017'. [ 157.080250][ T9268] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1022'. [ 157.450786][ T9287] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1029'. [ 157.538798][ T9293] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 157.712795][ T9301] netlink: 'syz.2.1035': attribute type 1 has an invalid length. [ 157.731511][ T9301] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1035'. [ 158.175838][ T9318] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1043'. [ 158.202982][ T9320] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1044'. [ 158.233763][ T9320] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1044'. [ 158.507299][ T9331] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1050'. [ 158.520043][ T9332] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.528921][ T9332] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.537767][ T9332] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.546503][ T9332] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.561048][ T9332] vxlan0: entered promiscuous mode [ 158.603750][ T9332] vxlan0: entered allmulticast mode [ 158.812531][ T9345] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1059'. [ 158.855487][ T9352] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1056'. [ 159.512197][ T9376] xt_HMARK: spi-set and port-set can't be combined [ 161.247900][ T9436] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 161.274645][ T9436] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 161.436148][ T9443] netlink: 'syz.3.1100': attribute type 1 has an invalid length. [ 162.287388][ T9456] Cannot find map_set index 0 as target [ 162.536894][ T9462] pimreg: entered allmulticast mode [ 162.693275][ T9475] __nla_validate_parse: 8 callbacks suppressed [ 162.693377][ T9475] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1112'. [ 162.794692][ T9478] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 162.824732][ T9478] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 163.012177][ T9486] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1115'. [ 163.518245][ T9508] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1126'. [ 163.910931][ T9520] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1130'. [ 164.078800][ T9522] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1132'. [ 164.323490][ T9533] netlink: 'syz.0.1140': attribute type 1 has an invalid length. [ 164.331450][ T9533] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1140'. [ 164.398765][ T9539] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1139'. [ 164.440394][ T9541] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1140'. [ 164.629728][ T9550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1143'. [ 164.641060][ T9550] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1143'. [ 164.651778][ T9540] pimreg: entered allmulticast mode [ 166.103394][ T9588] netlink: 'syz.5.1158': attribute type 4 has an invalid length. [ 167.196630][ T9644] netlink: 'syz.3.1176': attribute type 1 has an invalid length. [ 167.712247][ T9675] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 168.097287][ T64] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 168.168433][ T9692] __nla_validate_parse: 10 callbacks suppressed [ 168.168453][ T9692] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1196'. [ 168.567415][ T9713] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1205'. [ 169.125536][ T9743] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1218'. [ 169.307118][ T9749] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1221'. [ 169.487859][ T9761] netlink: 'syz.2.1227': attribute type 1 has an invalid length. [ 169.495626][ T9761] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1227'. [ 169.535461][ T9761] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1227'. [ 169.856295][ T9776] netlink: 372 bytes leftover after parsing attributes in process `syz.3.1232'. [ 170.098028][ T9792] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1239'. [ 170.173021][ T9790] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 170.183898][ T9790] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.297192][ T9790] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 170.342345][ T9790] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.477350][ T9790] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 170.504190][ T9790] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.609465][ T9790] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 170.630895][ T9790] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.663997][ T9815] netlink: 372 bytes leftover after parsing attributes in process `syz.0.1250'. [ 170.825959][ T9790] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.836175][ T9790] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.854757][ T9790] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.893406][ T9790] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.913852][ T9790] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.941724][ T9790] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.959071][ T9790] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 170.970625][ T9790] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 170.986410][ T9824] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1255'. [ 171.431794][ T9846] netlink: 'syz.3.1262': attribute type 1 has an invalid length. [ 172.497597][ T9892] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 172.513068][ T9892] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.692282][ T9892] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 172.719276][ T9892] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.856859][ T9917] netlink: 'syz.0.1292': attribute type 1 has an invalid length. [ 172.872462][ T9892] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 172.899153][ T9892] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.107334][ T9892] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 173.145043][ T9892] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.531257][ T9892] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.588079][ T9892] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.598136][ T9932] pim6reg1: entered promiscuous mode [ 173.603917][ T9932] pim6reg1: entered allmulticast mode [ 173.638912][ T9892] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.653636][ T9892] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.748059][ T9892] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.756339][ T9892] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.805503][ T9892] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.847458][ T9892] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.907696][ T9962] __nla_validate_parse: 6 callbacks suppressed [ 173.907718][ T9962] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1314'. [ 174.525809][ T9992] netlink: 'syz.1.1327': attribute type 1 has an invalid length. [ 174.549831][ T9992] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1327'. [ 174.696319][T10000] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1330'. [ 175.138259][ T214] wlan1: Trigger new scan to find an IBSS to join [ 175.316909][T10031] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1343'. [ 175.536947][T10039] netlink: 'syz.0.1347': attribute type 1 has an invalid length. [ 175.570104][T10039] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1347'. [ 175.714112][T10050] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1352'. [ 175.904685][T10061] netlink: 372 bytes leftover after parsing attributes in process `syz.0.1354'. [ 176.035702][T10066] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1359'. [ 176.277857][T10076] netlink: 'syz.5.1364': attribute type 1 has an invalid length. [ 176.286324][T10076] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1364'. [ 176.372824][T10082] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1366'. [ 176.962869][T10110] netlink: 'syz.1.1380': attribute type 1 has an invalid length. [ 177.603948][T10141] netlink: 'syz.5.1396': attribute type 1 has an invalid length. [ 178.180415][ T12] wlan1: Trigger new scan to find an IBSS to join [ 178.790266][T10199] netlink: 'syz.1.1415': attribute type 1 has an invalid length. [ 179.000318][T10211] pim6reg1: entered promiscuous mode [ 179.007310][T10211] pim6reg1: entered allmulticast mode [ 179.022326][T10216] __nla_validate_parse: 13 callbacks suppressed [ 179.022345][T10216] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1427'. [ 179.322382][T10227] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1433'. [ 179.400131][T10234] netlink: 372 bytes leftover after parsing attributes in process `syz.3.1434'. [ 179.429737][T10237] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1435'. [ 179.532368][T10240] netlink: 'syz.1.1437': attribute type 1 has an invalid length. [ 179.572945][T10240] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1437'. [ 179.776423][T10251] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1441'. [ 180.027049][T10263] pim6reg1: entered promiscuous mode [ 180.035992][T10263] pim6reg1: entered allmulticast mode [ 180.220246][T10271] netlink: 372 bytes leftover after parsing attributes in process `syz.5.1449'. [ 180.338661][T10275] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1452'. [ 180.467875][T10281] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1453'. [ 180.548719][T10286] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1456'. [ 180.734979][T10293] netlink: 'syz.2.1459': attribute type 1 has an invalid length. [ 180.891988][T10303] pim6reg1: entered promiscuous mode [ 180.898261][T10303] pim6reg1: entered allmulticast mode [ 181.078159][ T12] wlan1: Creating new IBSS network, BSSID 9e:df:9f:06:d2:cf [ 181.527342][T10336] netlink: 'syz.0.1477': attribute type 1 has an invalid length. [ 181.758531][T10344] pim6reg1: entered promiscuous mode [ 181.777776][T10344] pim6reg1: entered allmulticast mode [ 182.342470][T10374] netlink: 'syz.1.1492': attribute type 1 has an invalid length. [ 182.598262][T10390] pim6reg1: entered promiscuous mode [ 182.609877][T10390] pim6reg1: entered allmulticast mode [ 183.454396][T10428] netlink: 'syz.3.1519': attribute type 1 has an invalid length. [ 183.595687][T10438] pim6reg1: entered promiscuous mode [ 183.601415][T10438] pim6reg1: entered allmulticast mode [ 184.097483][T10462] __nla_validate_parse: 20 callbacks suppressed [ 184.097512][T10462] netlink: 372 bytes leftover after parsing attributes in process `syz.2.1529'. [ 184.144611][T10464] netlink: 'syz.0.1531': attribute type 1 has an invalid length. [ 184.154742][T10464] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1531'. [ 184.336729][T10472] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1534'. [ 184.423946][T10476] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1536'. [ 184.567536][T10480] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1538'. [ 184.589857][T10479] pim6reg1: entered promiscuous mode [ 184.596780][T10479] pim6reg1: entered allmulticast mode [ 184.894282][T10497] netlink: 372 bytes leftover after parsing attributes in process `syz.5.1544'. [ 184.913592][T10501] netlink: 'syz.1.1546': attribute type 1 has an invalid length. [ 184.921878][T10501] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1546'. [ 185.118382][T10507] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1547'. [ 185.266253][T10513] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1554'. [ 185.304909][T10516] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1552'. [ 185.504010][T10532] pim6reg1: entered promiscuous mode [ 185.515985][T10532] pim6reg1: entered allmulticast mode [ 185.544586][T10534] netlink: 'syz.5.1558': attribute type 1 has an invalid length. [ 185.683262][T10538] 8021q: adding VLAN 0 to HW filter on device bond3 [ 185.725936][T10538] 8021q: adding VLAN 0 to HW filter on device bond3 [ 185.735324][T10541] netlink: 'syz.3.1561': attribute type 1 has an invalid length. [ 185.740344][T10538] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 185.758406][T10538] bond3: (slave vcan1): Error -95 calling set_mac_address [ 186.344021][T10568] netlink: 'syz.3.1571': attribute type 1 has an invalid length. [ 186.375793][ T5857] Bluetooth: hci1: command 0x0406 tx timeout [ 186.383628][ T5857] Bluetooth: hci2: command 0x0406 tx timeout [ 187.146223][T10612] netlink: 'syz.3.1587': attribute type 1 has an invalid length. [ 187.877371][T10647] netlink: 'syz.3.1602': attribute type 1 has an invalid length. [ 188.563843][T10681] netlink: 'syz.2.1616': attribute type 1 has an invalid length. [ 188.597879][ T5165] Bluetooth: hci5: command 0x0405 tx timeout [ 188.599829][T10684] pim6reg1: entered promiscuous mode [ 188.611317][T10684] pim6reg1: entered allmulticast mode [ 189.118485][T10705] __nla_validate_parse: 18 callbacks suppressed [ 189.118505][T10705] netlink: 372 bytes leftover after parsing attributes in process `syz.0.1624'. [ 189.143343][T10707] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1625'. [ 189.290111][T10715] netlink: 'syz.0.1632': attribute type 1 has an invalid length. [ 189.298366][T10715] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1632'. [ 189.362783][T10719] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1629'. [ 189.363373][T10722] pim6reg1: entered promiscuous mode [ 189.377146][T10722] pim6reg1: entered allmulticast mode [ 189.844176][T10743] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1640'. [ 189.867064][T10746] netlink: 372 bytes leftover after parsing attributes in process `syz.2.1642'. [ 189.868463][T10747] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1641'. [ 189.976655][T10749] FAULT_INJECTION: forcing a failure. [ 189.976655][T10749] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 189.996803][T10749] CPU: 0 UID: 0 PID: 10749 Comm: syz.0.1643 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 190.007270][T10749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 190.017354][T10749] Call Trace: [ 190.020660][T10749] [ 190.023627][T10749] dump_stack_lvl+0x241/0x360 [ 190.028334][T10749] ? __pfx_dump_stack_lvl+0x10/0x10 [ 190.033522][T10752] netlink: 'syz.2.1645': attribute type 1 has an invalid length. [ 190.033552][T10749] ? __pfx__printk+0x10/0x10 [ 190.041884][T10752] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1645'. [ 190.045828][T10749] ? __pfx_lock_release+0x10/0x10 [ 190.045863][T10749] should_fail_ex+0x3b0/0x4e0 [ 190.064605][T10749] _copy_from_user+0x2f/0xc0 [ 190.069225][T10749] copy_msghdr_from_user+0xae/0x680 [ 190.074459][T10749] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 190.080292][T10749] ? __fget_files+0x2a/0x410 [ 190.084919][T10749] ? __fget_files+0x2a/0x410 [ 190.089570][T10749] __sys_sendmsg+0x209/0x350 [ 190.094200][T10749] ? __pfx_lock_release+0x10/0x10 [ 190.099265][T10749] ? __pfx___sys_sendmsg+0x10/0x10 [ 190.104427][T10749] ? __pfx_vfs_write+0x10/0x10 [ 190.109253][T10749] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 190.115630][T10749] ? do_syscall_64+0x100/0x230 [ 190.120456][T10749] ? do_syscall_64+0xb6/0x230 [ 190.125165][T10749] do_syscall_64+0xf3/0x230 [ 190.129700][T10749] ? clear_bhb_loop+0x35/0x90 [ 190.134409][T10749] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.140319][T10749] RIP: 0033:0x7fb691b7ff19 [ 190.144746][T10749] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 190.164367][T10749] RSP: 002b:00007fb692943058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 190.172792][T10749] RAX: ffffffffffffffda RBX: 00007fb691d45fa0 RCX: 00007fb691b7ff19 [ 190.180766][T10749] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 190.188732][T10749] RBP: 00007fb6929430a0 R08: 0000000000000000 R09: 0000000000000000 [ 190.196700][T10749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 190.204664][T10749] R13: 0000000000000000 R14: 00007fb691d45fa0 R15: 00007ffff859c028 [ 190.212643][T10749] [ 190.367593][T10758] pim6reg1: entered promiscuous mode [ 190.385966][T10758] pim6reg1: entered allmulticast mode [ 190.673089][T10773] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1654'. [ 190.738440][T10776] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1655'. [ 190.798182][T10780] netlink: 'syz.5.1658': attribute type 1 has an invalid length. [ 190.912739][T10783] netlink: 'syz.3.1657': attribute type 1 has an invalid length. [ 191.306952][T10809] pim6reg1: entered promiscuous mode [ 191.312609][T10809] pim6reg1: entered allmulticast mode [ 191.818298][T10831] netlink: 'syz.5.1676': attribute type 1 has an invalid length. [ 192.120517][T10846] pim6reg1: entered promiscuous mode [ 192.212678][T10846] pim6reg1: entered allmulticast mode [ 192.469589][T10861] Bluetooth: MGMT ver 1.23 [ 192.706367][T10874] netlink: 'syz.5.1691': attribute type 1 has an invalid length. [ 193.054707][T10895] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 193.093807][T10895] xt_hashlimit: max too large, truncated to 1048576 [ 193.114653][T10896] xt_hashlimit: max too large, truncated to 1048576 [ 193.249398][T10903] pim6reg1: entered promiscuous mode [ 193.254845][T10903] pim6reg1: entered allmulticast mode [ 193.332379][T10912] FAULT_INJECTION: forcing a failure. [ 193.332379][T10912] name failslab, interval 1, probability 0, space 0, times 0 [ 193.345202][T10912] CPU: 1 UID: 0 PID: 10912 Comm: syz.5.1704 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 193.355655][T10912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 193.365740][T10912] Call Trace: [ 193.369050][T10912] [ 193.372009][T10912] dump_stack_lvl+0x241/0x360 [ 193.376720][T10912] ? __pfx_dump_stack_lvl+0x10/0x10 [ 193.381948][T10912] ? __pfx__printk+0x10/0x10 [ 193.386578][T10912] ? kmem_cache_alloc_node_noprof+0x4f/0x380 [ 193.392598][T10912] ? __pfx___might_resched+0x10/0x10 [ 193.397916][T10912] should_fail_ex+0x3b0/0x4e0 [ 193.402619][T10912] should_failslab+0xac/0x100 [ 193.407303][T10912] kmem_cache_alloc_node_noprof+0x77/0x380 [ 193.413119][T10912] ? __alloc_skb+0x1c3/0x440 [ 193.417709][T10912] __alloc_skb+0x1c3/0x440 [ 193.422123][T10912] ? __pfx___alloc_skb+0x10/0x10 [ 193.427060][T10912] ? netlink_autobind+0xd6/0x2f0 [ 193.431992][T10912] ? netlink_autobind+0x2b0/0x2f0 [ 193.437018][T10912] netlink_sendmsg+0x638/0xcb0 [ 193.441786][T10912] ? __pfx_netlink_sendmsg+0x10/0x10 [ 193.447071][T10912] ? aa_sock_msg_perm+0x91/0x160 [ 193.452019][T10912] ? __pfx_netlink_sendmsg+0x10/0x10 [ 193.457332][T10912] __sock_sendmsg+0x221/0x270 [ 193.462010][T10912] ____sys_sendmsg+0x52a/0x7e0 [ 193.466778][T10912] ? __pfx_____sys_sendmsg+0x10/0x10 [ 193.472061][T10912] ? __fget_files+0x2a/0x410 [ 193.476672][T10912] ? __fget_files+0x2a/0x410 [ 193.481272][T10912] __sys_sendmsg+0x269/0x350 [ 193.485869][T10912] ? __pfx_lock_release+0x10/0x10 [ 193.490891][T10912] ? __pfx___sys_sendmsg+0x10/0x10 [ 193.496009][T10912] ? __pfx_vfs_write+0x10/0x10 [ 193.500794][T10912] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 193.507120][T10912] ? do_syscall_64+0x100/0x230 [ 193.511884][T10912] ? do_syscall_64+0xb6/0x230 [ 193.516556][T10912] do_syscall_64+0xf3/0x230 [ 193.521062][T10912] ? clear_bhb_loop+0x35/0x90 [ 193.525739][T10912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.531651][T10912] RIP: 0033:0x7fa3b977ff19 [ 193.536060][T10912] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 193.555663][T10912] RSP: 002b:00007fa3b75f6058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.564093][T10912] RAX: ffffffffffffffda RBX: 00007fa3b9945fa0 RCX: 00007fa3b977ff19 [ 193.572060][T10912] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 193.580025][T10912] RBP: 00007fa3b75f60a0 R08: 0000000000000000 R09: 0000000000000000 [ 193.588168][T10912] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.596138][T10912] R13: 0000000000000000 R14: 00007fa3b9945fa0 R15: 00007ffcbccd57b8 [ 193.604122][T10912] [ 193.692530][T10918] netlink: 'syz.5.1707': attribute type 1 has an invalid length. [ 194.175472][T10943] __nla_validate_parse: 18 callbacks suppressed [ 194.175499][T10943] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1715'. [ 194.213033][T10947] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1716'. [ 194.269227][T10949] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1717'. [ 194.521323][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.531572][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.555048][T10965] netlink: 'syz.3.1722': attribute type 22 has an invalid length. [ 194.646093][T10967] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1724'. [ 194.718127][T10973] netlink: 'syz.3.1727': attribute type 1 has an invalid length. [ 194.726188][T10973] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1727'. [ 194.726660][T10970] netlink: 372 bytes leftover after parsing attributes in process `syz.5.1726'. [ 194.796176][T10976] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1727'. [ 194.868607][T10981] netlink: 'syz.2.1725': attribute type 1 has an invalid length. [ 194.884580][T10981] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1725'. [ 195.354855][T11006] netlink: 288 bytes leftover after parsing attributes in process `syz.1.1739'. [ 195.482618][T11008] netlink: 372 bytes leftover after parsing attributes in process `syz.0.1740'. [ 195.636884][T11021] netlink: 'syz.5.1742': attribute type 1 has an invalid length. [ 195.776204][T11029] FAULT_INJECTION: forcing a failure. [ 195.776204][T11029] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 195.804047][T11029] CPU: 1 UID: 0 PID: 11029 Comm: syz.1.1747 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 195.814530][T11029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 195.824699][T11029] Call Trace: [ 195.827999][T11029] [ 195.830953][T11029] dump_stack_lvl+0x241/0x360 [ 195.835664][T11029] ? __pfx_dump_stack_lvl+0x10/0x10 [ 195.840883][T11029] ? __pfx__printk+0x10/0x10 [ 195.845501][T11029] ? __pfx_lock_release+0x10/0x10 [ 195.850556][T11029] should_fail_ex+0x3b0/0x4e0 [ 195.855267][T11029] _copy_from_iter+0x21f/0x1e70 [ 195.860154][T11029] ? __virt_addr_valid+0x183/0x530 [ 195.865296][T11029] ? __pfx_lock_release+0x10/0x10 [ 195.870355][T11029] ? __alloc_skb+0x28f/0x440 [ 195.874968][T11029] ? __pfx__copy_from_iter+0x10/0x10 [ 195.880282][T11029] ? __virt_addr_valid+0x183/0x530 [ 195.885428][T11029] ? __virt_addr_valid+0x183/0x530 [ 195.890562][T11029] ? __virt_addr_valid+0x45f/0x530 [ 195.895701][T11029] ? __check_object_size+0x48e/0x900 [ 195.901024][T11029] netlink_sendmsg+0x73d/0xcb0 [ 195.905806][T11029] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.911092][T11029] ? aa_sock_msg_perm+0x91/0x160 [ 195.916040][T11029] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.921335][T11029] __sock_sendmsg+0x221/0x270 [ 195.926024][T11029] ____sys_sendmsg+0x52a/0x7e0 [ 195.930788][T11029] ? __pfx_____sys_sendmsg+0x10/0x10 [ 195.936067][T11029] ? __fget_files+0x2a/0x410 [ 195.940672][T11029] ? __fget_files+0x2a/0x410 [ 195.945266][T11029] __sys_sendmsg+0x269/0x350 [ 195.949856][T11029] ? __pfx_lock_release+0x10/0x10 [ 195.954883][T11029] ? __pfx___sys_sendmsg+0x10/0x10 [ 195.960010][T11029] ? __pfx_vfs_write+0x10/0x10 [ 195.964788][T11029] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 195.971110][T11029] ? do_syscall_64+0x100/0x230 [ 195.975886][T11029] ? do_syscall_64+0xb6/0x230 [ 195.980744][T11029] do_syscall_64+0xf3/0x230 [ 195.985264][T11029] ? clear_bhb_loop+0x35/0x90 [ 195.989948][T11029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.995848][T11029] RIP: 0033:0x7fa20837ff19 [ 196.000275][T11029] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 196.019898][T11029] RSP: 002b:00007fa2091e3058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 196.028332][T11029] RAX: ffffffffffffffda RBX: 00007fa208545fa0 RCX: 00007fa20837ff19 [ 196.036306][T11029] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 196.044280][T11029] RBP: 00007fa2091e30a0 R08: 0000000000000000 R09: 0000000000000000 [ 196.052250][T11029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.060221][T11029] R13: 0000000000000000 R14: 00007fa208545fa0 R15: 00007fffa41a13c8 [ 196.068205][T11029] [ 196.271005][T11045] netlink: 'syz.2.1753': attribute type 1 has an invalid length. [ 196.626933][T11061] netlink: 'syz.5.1759': attribute type 1 has an invalid length. [ 196.655418][T11063] ip6gre1: entered allmulticast mode [ 196.698766][T11067] sch_tbf: peakrate 7 is lower than or equals to rate 2147483647 ! [ 196.731175][T11071] batadv0: entered promiscuous mode [ 196.752223][T11067] netlink: 'syz.0.1761': attribute type 3 has an invalid length. [ 196.783160][T11071] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.625388][T11124] netlink: 'syz.3.1781': attribute type 1 has an invalid length. [ 198.808672][T11128] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 198.847831][T11128] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 198.867792][T11128] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 198.876130][T11128] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 198.905287][T11128] geneve2: entered promiscuous mode [ 198.917491][T11128] geneve2: entered allmulticast mode [ 198.918716][T11139] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 198.933366][T11128] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 198.948377][T11128] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 198.963581][T11128] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 198.973701][T11128] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 199.227127][T11146] __nla_validate_parse: 14 callbacks suppressed [ 199.227148][T11146] netlink: 372 bytes leftover after parsing attributes in process `syz.2.1789'. [ 199.309731][T11155] netlink: 'syz.3.1793': attribute type 1 has an invalid length. [ 199.336479][T11155] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1793'. [ 199.395484][T11159] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1795'. [ 199.623383][T11165] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1798'. [ 199.738660][T11172] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1801'. [ 199.961275][T11180] netlink: 372 bytes leftover after parsing attributes in process `syz.3.1805'. [ 200.199929][T11188] netlink: 'syz.1.1807': attribute type 3 has an invalid length. [ 200.238346][T11188] netlink: 'syz.1.1807': attribute type 3 has an invalid length. [ 200.474336][T11203] netlink: 'syz.2.1814': attribute type 1 has an invalid length. [ 200.677798][T11203] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1814'. [ 200.774850][T11212] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1814'. [ 200.791581][T11207] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1816'. [ 201.248935][T11233] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1824'. [ 201.338436][T11232] netlink: 'syz.1.1825': attribute type 11 has an invalid length. [ 201.461116][T11241] netlink: 'syz.2.1829': attribute type 1 has an invalid length. [ 201.557141][T11250] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 201.723873][T11257] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 202.076071][T11268] netlink: 'syz.3.1837': attribute type 1 has an invalid length. [ 202.186681][T11287] FAULT_INJECTION: forcing a failure. [ 202.186681][T11287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 202.215650][T11287] CPU: 1 UID: 0 PID: 11287 Comm: syz.0.1844 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 202.226121][T11287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 202.236205][T11287] Call Trace: [ 202.239510][T11287] [ 202.242453][T11287] dump_stack_lvl+0x241/0x360 [ 202.247177][T11287] ? __pfx_dump_stack_lvl+0x10/0x10 [ 202.252399][T11287] ? __pfx__printk+0x10/0x10 [ 202.257023][T11287] ? __pfx_lock_release+0x10/0x10 [ 202.262086][T11287] should_fail_ex+0x3b0/0x4e0 [ 202.266795][T11287] _copy_from_iter+0x21f/0x1e70 [ 202.271677][T11287] ? __virt_addr_valid+0x183/0x530 [ 202.276816][T11287] ? __pfx_lock_release+0x10/0x10 [ 202.281870][T11287] ? __alloc_skb+0x28f/0x440 [ 202.286503][T11287] ? __pfx__copy_from_iter+0x10/0x10 [ 202.291817][T11287] ? __virt_addr_valid+0x183/0x530 [ 202.296955][T11287] ? __virt_addr_valid+0x183/0x530 [ 202.302090][T11287] ? __virt_addr_valid+0x45f/0x530 [ 202.307223][T11287] ? __check_object_size+0x48e/0x900 [ 202.312533][T11287] netlink_sendmsg+0x73d/0xcb0 [ 202.317333][T11287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 202.322654][T11287] ? aa_sock_msg_perm+0x91/0x160 [ 202.327805][T11287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 202.333119][T11287] __sock_sendmsg+0x221/0x270 [ 202.337919][T11287] ____sys_sendmsg+0x52a/0x7e0 [ 202.342720][T11287] ? __pfx_____sys_sendmsg+0x10/0x10 [ 202.348027][T11287] ? __fget_files+0x2a/0x410 [ 202.352690][T11287] ? __fget_files+0x2a/0x410 [ 202.357314][T11287] __sys_sendmsg+0x269/0x350 [ 202.361941][T11287] ? __pfx_lock_release+0x10/0x10 [ 202.367013][T11287] ? __pfx___sys_sendmsg+0x10/0x10 [ 202.372164][T11287] ? __pfx_vfs_write+0x10/0x10 [ 202.374782][T11295] netlink: 'syz.3.1847': attribute type 1 has an invalid length. [ 202.376954][T11287] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 202.391117][T11287] ? do_syscall_64+0x100/0x230 [ 202.395998][T11287] ? do_syscall_64+0xb6/0x230 [ 202.400679][T11287] do_syscall_64+0xf3/0x230 [ 202.400702][T11287] ? clear_bhb_loop+0x35/0x90 [ 202.400725][T11287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.400745][T11287] RIP: 0033:0x7fb691b7ff19 [ 202.400762][T11287] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 202.400776][T11287] RSP: 002b:00007fb692943058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 202.400799][T11287] RAX: ffffffffffffffda RBX: 00007fb691d45fa0 RCX: 00007fb691b7ff19 [ 202.400812][T11287] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 202.400825][T11287] RBP: 00007fb6929430a0 R08: 0000000000000000 R09: 0000000000000000 [ 202.400839][T11287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 202.400851][T11287] R13: 0000000000000000 R14: 00007fb691d45fa0 R15: 00007ffff859c028 [ 202.400877][T11287] [ 203.338961][T11341] netlink: 'syz.0.1866': attribute type 1 has an invalid length. [ 203.567529][T11349] pim6reg1: entered promiscuous mode [ 203.593599][T11349] pim6reg1: entered allmulticast mode [ 204.341051][T11430] __nla_validate_parse: 18 callbacks suppressed [ 204.341071][T11430] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1882'. [ 204.768560][T11451] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 204.826181][T11455] netlink: 'syz.3.1890': attribute type 3 has an invalid length. [ 204.853399][T11455] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1890'. [ 204.864355][T11459] netlink: 372 bytes leftover after parsing attributes in process `syz.2.1892'. [ 204.963179][T11462] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1894'. [ 205.053326][T11470] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1896'. [ 205.211953][T11477] netlink: 'syz.5.1899': attribute type 1 has an invalid length. [ 205.236205][T11477] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1899'. [ 205.430331][T11477] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1899'. [ 205.682411][T11509] netlink: 372 bytes leftover after parsing attributes in process `syz.3.1906'. [ 205.724663][T11504] pim6reg1: entered promiscuous mode [ 205.738249][T11504] pim6reg1: entered allmulticast mode [ 206.044673][T11533] netlink: 'syz.3.1910': attribute type 1 has an invalid length. [ 206.057352][T11533] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1910'. [ 206.344528][T11551] netlink: 'syz.0.1915': attribute type 3 has an invalid length. [ 206.387885][T11551] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1915'. [ 206.931233][T11561] wg2: entered promiscuous mode [ 206.936326][T11561] wg2: entered allmulticast mode [ 206.946014][T11560] wg2: left promiscuous mode [ 206.952699][T11560] wg2: left allmulticast mode [ 207.107099][T11592] pim6reg1: entered promiscuous mode [ 207.148146][T11592] pim6reg1: entered allmulticast mode [ 207.439597][T11617] bridge2: entered promiscuous mode [ 207.665120][T11629] netlink: 'syz.1.1938': attribute type 1 has an invalid length. [ 207.680441][T11629] NCSI netlink: No device for ifindex 536871429 [ 207.733275][T11632] gretap0: entered promiscuous mode [ 207.750995][T11632] macvtap1: entered promiscuous mode [ 207.831893][T11632] gretap0: left promiscuous mode [ 208.067345][T11658] xt_addrtype: ipv6 does not support BROADCAST matching [ 208.108957][T11655] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 208.504994][T11684] ip_vti0: entered promiscuous mode [ 208.512665][T11684] vlan3: entered promiscuous mode [ 208.551538][T11684] ip_vti0: left promiscuous mode [ 208.894366][T11701] batadv_slave_1: default FDB implementation only supports local addresses [ 209.365435][T11399] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 209.561921][T11738] openvswitch: netlink: IP tunnel dst address not specified [ 209.600988][T11741] sctp: [Deprecated]: syz.2.1974 (pid 11741) Use of int in maxseg socket option. [ 209.600988][T11741] Use struct sctp_assoc_value instead [ 209.772072][T11746] netlink: 'syz.5.1977': attribute type 2 has an invalid length. [ 209.950041][T11757] __nla_validate_parse: 14 callbacks suppressed [ 209.950064][T11757] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1984'. [ 209.960287][T11758] netlink: 'syz.0.1983': attribute type 1 has an invalid length. [ 209.974603][T11758] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1983'. [ 210.009431][T11758] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1983'. [ 210.213571][T11767] team0: No ports can be present during mode change [ 210.338209][T11774] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1988'. [ 210.378011][T11777] pim6reg1: entered promiscuous mode [ 210.383363][T11777] pim6reg1: entered allmulticast mode [ 210.384115][T11775] syz.0.1989[11775] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 210.393714][T11776] syz.0.1989[11776] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 210.431648][T11775] syz.0.1989[11775] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 210.452906][T11779] netlink: 'syz.1.1992': attribute type 10 has an invalid length. [ 210.460820][T11776] syz.0.1989[11776] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 210.511594][T11779] macvlan0: entered promiscuous mode [ 210.537915][T11779] macvlan0: entered allmulticast mode [ 210.629855][T11779] veth1_vlan: entered allmulticast mode [ 210.638259][T11779] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 210.670442][T11779] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1992'. [ 211.366053][T11841] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2002'. [ 211.486712][T11849] pim6reg1: entered promiscuous mode [ 211.496897][T11849] pim6reg1: entered allmulticast mode [ 211.604902][T11853] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2009'. [ 211.631961][T11853] geneve2: entered promiscuous mode [ 212.367172][T11887] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2019'. [ 213.045049][T11927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2029'. [ 213.184559][T11935] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2033'. [ 214.556357][T12006] Unsupported ieee802154 address type: 0 [ 214.585113][T12006] Unsupported ieee802154 address type: 0 [ 214.595353][T12006] Unsupported ieee802154 address type: 0 [ 214.601234][T12006] Unsupported ieee802154 address type: 0 [ 214.607040][T12006] Unsupported ieee802154 address type: 0 [ 214.625229][T12005] sctp: [Deprecated]: syz.1.2050 (pid 12005) Use of struct sctp_assoc_value in delayed_ack socket option. [ 214.625229][T12005] Use struct sctp_sack_info instead [ 214.646014][T12006] Unsupported ieee802154 address type: 0 [ 214.653352][T12006] Unsupported ieee802154 address type: 0 [ 214.660588][T12006] Unsupported ieee802154 address type: 0 [ 214.666301][T12006] Unsupported ieee802154 address type: 0 [ 214.672801][T12006] Unsupported ieee802154 address type: 0 [ 214.678939][T12006] Unsupported ieee802154 address type: 0 [ 214.684760][T12006] Unsupported ieee802154 address type: 0 [ 214.691602][T12006] Unsupported ieee802154 address type: 0 [ 214.697470][T12006] Unsupported ieee802154 address type: 0 [ 214.703631][T12006] Unsupported ieee802154 address type: 0 [ 214.710488][T12006] Unsupported ieee802154 address type: 0 [ 214.716197][T12006] Unsupported ieee802154 address type: 0 [ 214.722404][T12006] Unsupported ieee802154 address type: 0 [ 214.729802][T12006] Unsupported ieee802154 address type: 0 [ 214.735583][T12006] Unsupported ieee802154 address type: 0 [ 214.741948][T12006] Unsupported ieee802154 address type: 0 [ 214.748560][T12006] Unsupported ieee802154 address type: 0 [ 214.754450][T12006] Unsupported ieee802154 address type: 0 [ 214.760727][T12006] Unsupported ieee802154 address type: 0 [ 214.766627][T12006] Unsupported ieee802154 address type: 0 [ 214.773345][T12006] Unsupported ieee802154 address type: 0 [ 214.779471][T12006] Unsupported ieee802154 address type: 0 [ 214.785259][T12006] Unsupported ieee802154 address type: 0 [ 214.792164][T12006] Unsupported ieee802154 address type: 0 [ 214.798239][T12006] Unsupported ieee802154 address type: 0 [ 214.804350][T12006] Unsupported ieee802154 address type: 0 [ 214.810572][T12006] Unsupported ieee802154 address type: 0 [ 214.816518][T12006] Unsupported ieee802154 address type: 0 [ 216.414108][T12026] __nla_validate_parse: 4 callbacks suppressed [ 216.414127][T12026] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2054'. [ 216.829963][T12042] vlan2: left promiscuous mode [ 216.838575][T12053] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2063'. [ 216.856075][T12042] ip6gretap0: left promiscuous mode [ 216.904329][T12054] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2060'. [ 216.921892][T12057] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2065'. [ 217.255920][T12074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2069'. [ 217.302872][T12074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2069'. [ 217.550143][T12094] netlink: 'syz.1.2074': attribute type 1 has an invalid length. [ 217.572689][T12096] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2075'. [ 217.715051][T12094] TCP: request_sock_TCPv6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 217.775429][T12107] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2079'. [ 218.106515][T12124] delete_channel: no stack [ 218.142294][T12121] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.171474][T12077] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 218.487041][T12140] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2090'. [ 218.834721][T12162] pim6reg1: entered promiscuous mode [ 218.857804][T12162] pim6reg1: entered allmulticast mode [ 219.050252][T12174] netlink: 'syz.0.2099': attribute type 1 has an invalid length. [ 219.058212][T12174] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2099'. [ 219.204770][T12186] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 219.216640][T12186] IPVS: set_ctl: invalid protocol: 103 172.30.1.3:20002 [ 219.226189][T12186] x_tables: duplicate underflow at hook 1 [ 220.003279][T12228] netlink: 'syz.1.2117': attribute type 11 has an invalid length. [ 220.444426][T12256] netlink: 'syz.1.2128': attribute type 10 has an invalid length. [ 220.486698][T12256] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.504659][T12256] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 220.734539][T12269] pim6reg1: entered promiscuous mode [ 220.758370][T12269] pim6reg1: entered allmulticast mode [ 220.894623][T12277] pim6reg527: entered allmulticast mode [ 220.950292][T12278] netlink: 'syz.0.2136': attribute type 3 has an invalid length. [ 221.439560][T12310] __nla_validate_parse: 8 callbacks suppressed [ 221.439579][T12310] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2147'. [ 221.497757][T12310] netlink: 'syz.5.2147': attribute type 7 has an invalid length. [ 221.505542][T12310] netlink: 'syz.5.2147': attribute type 8 has an invalid length. [ 221.549988][T12310] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2147'. [ 221.581166][T12316] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2149'. [ 221.609197][T12319] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2151'. [ 221.810298][T12327] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2155'. [ 222.035011][T12341] vxcan1: tx address claim with different name [ 222.841406][T12394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2175'. [ 222.858236][T12395] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 222.935704][T12389] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2174'. [ 222.960644][T12397] netlink: 'syz.3.2174': attribute type 29 has an invalid length. [ 222.984960][T12389] netlink: 'syz.3.2174': attribute type 29 has an invalid length. [ 222.996279][T12397] netlink: 'syz.3.2174': attribute type 29 has an invalid length. [ 223.597912][T12432] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2188'. [ 223.622663][T12428] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2186'. [ 223.624547][T12432] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.636150][T12437] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2189'. [ 223.711940][T12428] team1: entered promiscuous mode [ 223.717424][T12428] 8021q: adding VLAN 0 to HW filter on device team1 [ 223.747343][T12432] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.866461][T12432] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.982620][T12432] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.123718][T12432] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.147329][T12432] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.164628][T12432] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.228240][T12432] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.389064][T12474] xt_nat: multiple ranges no longer supported [ 224.578918][T12488] netlink: 'syz.0.2209': attribute type 19 has an invalid length. [ 224.719769][T12492] netlink: 'syz.1.2210': attribute type 1 has an invalid length. [ 224.734969][T12492] netlink: 'syz.1.2210': attribute type 3 has an invalid length. [ 224.744297][T12492] NCSI netlink: No device for ifindex 131080 [ 224.772178][T12497] gre1: entered promiscuous mode [ 224.802438][T12497] team0: Device gre1 is of different type [ 225.406777][T12534] Bluetooth: MGMT ver 1.23 [ 225.518311][T12539] netlink: 'syz.0.2226': attribute type 6 has an invalid length. [ 225.589245][T12544] xt_limit: Overflow, try lower: 2147483649/128 [ 226.087064][T12568] tipc: Invalid UDP bearer configuration [ 226.087108][T12568] tipc: Enabling of bearer rejected, failed to enable media [ 226.138931][T12565] 8021q: adding VLAN 0 to HW filter on device bond2 [ 226.644491][T12597] ipip0: entered promiscuous mode [ 226.702342][T12591] __nla_validate_parse: 10 callbacks suppressed [ 226.702363][T12591] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2240'. [ 227.092374][T12622] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2248'. [ 227.096720][T12621] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2247'. [ 227.111661][T12622] netlink: 372 bytes leftover after parsing attributes in process `syz.2.2248'. [ 227.266482][T12629] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2251'. [ 227.287847][T12629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2251'. [ 227.328090][ T5852] Bluetooth: hci4: command 0x0411 tx timeout [ 227.483166][ T5165] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 227.492867][T12595] [ 227.495242][T12595] ============================================ [ 227.501401][T12595] WARNING: possible recursive locking detected [ 227.507562][T12595] 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 Not tainted [ 227.514336][T12595] -------------------------------------------- [ 227.520499][T12595] syz.0.2240/12595 is trying to acquire lock: [ 227.526576][T12595] ffff888032b24078 (&hdev->lock){+.+.}-{4:4}, at: mgmt_remove_adv_monitor_complete+0xaf/0x550 [ 227.536887][T12595] [ 227.536887][T12595] but task is already holding lock: [ 227.544270][T12595] ffff888032b24078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x5c8/0x11c0 [ 227.553543][T12595] [ 227.553543][T12595] other info that might help us debug this: [ 227.561619][T12595] Possible unsafe locking scenario: [ 227.561619][T12595] [ 227.569130][T12595] CPU0 [ 227.572422][T12595] ---- [ 227.575714][T12595] lock(&hdev->lock); [ 227.579084][T12653] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2258'. [ 227.579783][T12595] lock(&hdev->lock); [ 227.592742][T12595] [ 227.592742][T12595] *** DEADLOCK *** [ 227.592742][T12595] [ 227.600984][T12595] May be due to missing lock nesting notation [ 227.600984][T12595] [ 227.609297][T12595] 3 locks held by syz.0.2240/12595: [ 227.614489][T12595] #0: ffff888032b24d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_close+0x10a/0x210 [ 227.623998][T12595] #1: ffff888032b24078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x5c8/0x11c0 [ 227.633680][T12595] #2: ffff888032b24690 (&hdev->cmd_sync_work_lock){+.+.}-{4:4}, at: hci_cmd_sync_dequeue+0x44/0x3d0 [ 227.644576][T12595] [ 227.644576][T12595] stack backtrace: [ 227.650474][T12595] CPU: 1 UID: 0 PID: 12595 Comm: syz.0.2240 Not tainted 6.12.0-syzkaller-10729-g5eb7de8cd58e #0 [ 227.660882][T12595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 227.671016][T12595] Call Trace: [ 227.674296][T12595] [ 227.677218][T12595] dump_stack_lvl+0x241/0x360 [ 227.681893][T12595] ? __pfx_dump_stack_lvl+0x10/0x10 [ 227.687084][T12595] ? __pfx__printk+0x10/0x10 [ 227.691672][T12595] ? lockdep_unlock+0x16a/0x300 [ 227.696520][T12595] print_deadlock_bug+0x483/0x620 [ 227.701546][T12595] validate_chain+0x15e2/0x5920 [ 227.706397][T12595] ? validate_chain+0x11e/0x5920 [ 227.711328][T12595] ? lock_release+0xbf/0xa30 [ 227.715908][T12595] ? __pfx_validate_chain+0x10/0x10 [ 227.721109][T12595] ? __pfx_lock_acquire+0x10/0x10 [ 227.726126][T12595] ? deref_stack_reg+0x17c/0x210 [ 227.731060][T12595] ? __pfx_lock_release+0x10/0x10 [ 227.736092][T12595] ? unwind_next_frame+0x18e6/0x22d0 [ 227.741390][T12595] ? deref_stack_reg+0x17c/0x210 [ 227.746335][T12595] ? __pfx_validate_chain+0x10/0x10 [ 227.751539][T12595] ? validate_chain+0x11e/0x5920 [ 227.756496][T12595] ? validate_chain+0x11e/0x5920 [ 227.761436][T12595] ? is_bpf_text_address+0x285/0x2a0 [ 227.766726][T12595] ? mark_lock+0x9a/0x360 [ 227.771047][T12595] __lock_acquire+0x1397/0x2100 [ 227.775896][T12595] lock_acquire+0x1ed/0x550 [ 227.780390][T12595] ? mgmt_remove_adv_monitor_complete+0xaf/0x550 [ 227.786718][T12595] ? __pfx_lock_acquire+0x10/0x10 [ 227.791735][T12595] ? __pfx___might_resched+0x10/0x10 [ 227.797024][T12595] __mutex_lock+0x1ac/0xee0 [ 227.801524][T12595] ? mgmt_remove_adv_monitor_complete+0xaf/0x550 [ 227.807852][T12595] ? __pfx___might_resched+0x10/0x10 [ 227.813134][T12595] ? __pfx___mutex_trylock_common+0x10/0x10 [ 227.819174][T12595] ? validate_chain+0x11e/0x5920 [ 227.824133][T12595] ? mgmt_remove_adv_monitor_complete+0xaf/0x550 [ 227.830473][T12595] ? __pfx___mutex_lock+0x10/0x10 [ 227.835494][T12595] ? trace_contention_end+0x3c/0x120 [ 227.840775][T12595] ? __mutex_lock+0x37f/0xee0 [ 227.845445][T12595] ? __lock_acquire+0x1397/0x2100 [ 227.850479][T12595] ? hci_cmd_sync_dequeue+0x44/0x3d0 [ 227.855758][T12595] mgmt_remove_adv_monitor_complete+0xaf/0x550 [ 227.861912][T12595] ? __pfx_mgmt_remove_adv_monitor_complete+0x10/0x10 [ 227.868671][T12595] ? __pfx_mgmt_remove_adv_monitor_complete+0x10/0x10 [ 227.875431][T12595] hci_cmd_sync_dequeue+0x22b/0x3d0 [ 227.880629][T12595] cmd_complete_rsp+0x4c/0x180 [ 227.885388][T12595] mgmt_pending_foreach+0xd1/0x130 [ 227.890490][T12595] ? __pfx_cmd_complete_rsp+0x10/0x10 [ 227.895855][T12595] __mgmt_power_off+0x183/0x430 [ 227.900702][T12595] ? __pfx___mgmt_power_off+0x10/0x10 [ 227.906069][T12595] ? __mutex_trylock_common+0x183/0x2e0 [ 227.911658][T12595] ? __pfx___might_resched+0x10/0x10 [ 227.916964][T12595] ? __pfx___mutex_trylock_common+0x10/0x10 [ 227.922868][T12595] ? rcu_is_watching+0x15/0xb0 [ 227.927636][T12595] ? trace_contention_end+0x3c/0x120 [ 227.932924][T12595] ? __mutex_lock+0x37f/0xee0 [ 227.937602][T12595] ? mark_lock+0x9a/0x360 [ 227.941957][T12595] ? hci_dev_close_sync+0x5c8/0x11c0 [ 227.947257][T12595] ? __pfx___mutex_lock+0x10/0x10 [ 227.952288][T12595] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 227.958288][T12595] ? lockdep_hardirqs_on+0x99/0x150 [ 227.963488][T12595] ? _raw_spin_unlock_irq+0x2e/0x50 [ 227.968684][T12595] ? drain_workqueue+0x2d3/0x3a0 [ 227.973616][T12595] ? hci_discovery_set_state+0x57/0x180 [ 227.979156][T12595] hci_dev_close_sync+0x6c4/0x11c0 [ 227.984277][T12595] hci_dev_close+0x112/0x210 [ 227.988888][T12595] sock_do_ioctl+0x158/0x460 [ 227.993483][T12595] ? __pfx_sock_do_ioctl+0x10/0x10 [ 227.998606][T12595] sock_ioctl+0x626/0x8e0 [ 228.002937][T12595] ? __pfx_sock_ioctl+0x10/0x10 [ 228.007786][T12595] ? __fget_files+0x2a/0x410 [ 228.012384][T12595] ? __fget_files+0x2a/0x410 [ 228.016968][T12595] ? __pfx_sock_ioctl+0x10/0x10 [ 228.021819][T12595] __se_sys_ioctl+0xf5/0x170 [ 228.026403][T12595] do_syscall_64+0xf3/0x230 [ 228.030896][T12595] ? clear_bhb_loop+0x35/0x90 [ 228.035567][T12595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.041455][T12595] RIP: 0033:0x7fb691b7ff19 [ 228.045861][T12595] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 228.065654][T12595] RSP: 002b:00007fb692922058 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 228.074062][T12595] RAX: ffffffffffffffda RBX: 00007fb691d46080 RCX: 00007fb691b7ff19 [ 228.082061][T12595] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 000000000000000a [ 228.090039][T12595] RBP: 00007fb691bf3986 R08: 0000000000000000 R09: 0000000000000000 [ 228.098008][T12595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 228.105990][T12595] R13: 0000000000000000 R14: 00007fb691d46080 R15: 00007ffff859c028 [ 228.113971][T12595]