last executing test programs: 2m54.011909307s ago: executing program 1 (id=3669): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180)=0xb15, 0x4) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto(r0, &(0x7f0000000740)="50fbdf12a30d", 0x6, 0x4008044, 0x0, 0x0) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x178, 0x0, 0x0) 2m53.026987657s ago: executing program 1 (id=3683): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e000000000000000600000007"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000400)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0200", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0xfffc}}}}}}}, 0x0) 2m52.867146897s ago: executing program 1 (id=3686): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000340)=@NCI_OP_NFCEE_DISCOVER_RSP={0x2, 0x0, 0x2, 0x0, 0x2, {0x0, 0xbb}}, 0x5) 2m49.726225235s ago: executing program 1 (id=3699): r0 = socket(0xa, 0x5, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, 0x0, 0x0) 2m49.571010215s ago: executing program 1 (id=3702): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0a000000020000006d05000002", @ANYBLOB, @ANYBLOB], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r0}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000004c0), 0x1000, r0}, 0x38) 2m49.05475496s ago: executing program 1 (id=3711): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x26, 0x9, 0x70bd25, 0x25dfdbfa, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r3, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) 2m43.507466143s ago: executing program 4 (id=3798): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@getlink={0x20, 0x12, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x18020, 0x20}}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x20000084) getgid() 2m43.404341655s ago: executing program 4 (id=3800): syz_emit_ethernet(0x42, &(0x7f0000000280)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x66, 0x0, 0x0, 0x21, 0x0, @private, @broadcast}, @redirect={0x5, 0x3, 0x0, @dev={0xac, 0x14, 0x14, 0x3a}, {0x6, 0x4, 0x3, 0x3, 0x4, 0x65, 0xb5, 0xe, 0x5c, 0x7, @broadcast, @multicast2, {[@noop]}}}}}}}, 0x0) 2m43.31760114s ago: executing program 4 (id=3801): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000003feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000006f440000000000006b0a00fe000000007303000000000000b500feff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050cdcfc92f5daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf9bf04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff4e2c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62cd15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc8230000065937f36f6490eb033b1ce0d4922701cb42aa86ee11cd5950b58ebffffae2aba1a21410e6cb3835bc2c19c9dacbb5f836d1c0de069c20c55fa567859aca8be3afdc3a14779e9181a382831580eac154d314974d209c00896548b04f80d68da1c7ecdfea1e05d0f442b81c4f2a38ae1f43688aff1d3eb14112da5d5289bedeeff7093a12faf47f55bd7ffc82893600042e761ec18de4cd287e176befc4af4063e5f091f8a50cbf02ad70682c0131d616ff6d999fc6fba6e9d4a3fc4e6430aca493d38db18ef4b2d46a22c1dc14910a49126684e453d30ea51dc537a0c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r3, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) (async) sendto$packet(r4, &(0x7f0000000480)="c1858aec1d0a21756f66b4805f3a", 0xe, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r3, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000540)=[{&(0x7f0000000580)='-', 0x1}], 0x1, 0x1) close(r6) (async) sendmsg$NL80211_CMD_SET_BEACON(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000c80)=ANY=[], 0x220}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) (async) splice(r5, 0x0, r6, 0x0, 0xfffd, 0xa) (async) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000002c0)=@bpf_ext={0x1c, 0xd, &(0x7f0000000140)=@raw=[@ldst={0x3, 0x3, 0x6, 0xb, 0xb, 0x0, 0x1}, @map_fd={0x18, 0x7}, @initr0={0x18, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0x7, 0x4, 0xb, 0xffffffffffffffe0, 0xfffffffffffffff0}, @map_val={0x18, 0xb, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffff9}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}], &(0x7f0000000200)='GPL\x00', 0x80000001, 0x5, &(0x7f0000000240)=""/5, 0x40f00, 0x46, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x2, 0xf, 0x0, 0x1}, 0x10, 0x21e40, r0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r8, 0xfffff000) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7f14, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x5}, 0x50) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f00000005c0)={{r0, &(0x7f0000000400)='\x00', 0x41, &(0x7f0000000440)={@align=0xf, {0x6, 0xd9be, 0x7, 0x8}}, 0xfffffffe, &(0x7f0000000480)={@_ha_fsid}, &(0x7f00000004c0)=0x862a}, 0x1, &(0x7f0000000580)=[{0x3, 0x8000, &(0x7f0000000500)='\x00', &(0x7f0000000540)="ef6be2be0e6de4afcb9328", 0xb, 0x8}]}) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b000000070000000f0000000900000005"], 0x50) bpf$MAP_LOOKUP_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000001840), 0xfffffff7, r11}, 0x38) (async) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x2, r11}, 0x38) r12 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000680)=@generic={&(0x7f0000000640)='./file0\x00', 0x0, 0x8}, 0x18) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000006c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xe, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000007c0)=@bpf_tracing={0x1a, 0x8, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @call={0x85, 0x0, 0x0, 0x4b}]}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x60, '\x00', r3, 0x17, r6, 0x8, &(0x7f00000000c0)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x0, 0x8, 0xd, 0x200}, 0x10, 0x13498, r7, 0x1, &(0x7f0000000740)=[r8, r9, r10, r11, r12, r13, 0xffffffffffffffff, 0x1], &(0x7f0000000780)=[{0x4, 0x2, 0xc, 0x6}], 0x10, 0x4}, 0x94) 2m43.125563397s ago: executing program 4 (id=3803): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0xe6) syz_extract_tcp_res(&(0x7f0000000240)={0x41424344, 0x41424344}, 0x8, 0x2) syz_emit_ethernet(0x4a, &(0x7f0000000280)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0200", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, r1, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000e00)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a3ff2", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x95}}}}}}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f0000000000)=0x0) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$nfc_llcp(r7, &(0x7f00000000c0)={0x27, r6, 0x1, 0x4, 0x0, 0xff, "bac5115c7dad488702b535116fad55baf63cdd52fc30106310abb622a1c3c01c13c04df6b906288e64e96754059e65c39c5759b069d6e6d9589e5f2348878c", 0x24}, 0x60) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2c, r3, 0x200, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x2c}}, 0x40) 2m42.886271247s ago: executing program 4 (id=3808): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ipvlan1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x401, 0x70bd2b, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503, 0x8400}, [@IFLA_LINK={0x8, 0x5, r0}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x20}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) 2m42.774851167s ago: executing program 4 (id=3812): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000200)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x3c, 0x4, 0x8, 0x301, 0x0, 0x0, {0x2, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r2 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback, 0xfffffffc}, 0x1c) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bond_slave_1\x00', 0x10) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000080)='v', 0x1}], 0x1) sendto(r2, &(0x7f00000004c0)="328a2ab698c2f41b46809eefc800b064e089fe8bec34798df38620cc4a8dfd94b492e8cab05231b52c242fdf1923101d17c202baa694ea6ac45823ea09c0a8db0715bc0185b15023ccbaae92c01e683f8bd33454dc3115c0069252d7a2f1835eb23ed741527733545ac90f91b15999b5c4e85e0268f168a72aaf7687cf34813235d33c0c02eff4780bad8c2750ec75bb8bd16e23c53aebf5dff745259576ba33103d792e1fb24a3faef4437d510fd2616be2f78fd4eab786f9b06a3e7f936924630e99fdc4862c3ac8b0b88f3fe2d313785e690b0efd7fe320c27f1da7f9e5947e1196bffb99ea8ba84d46e5f60652dee5d7a083f22a785b1c6857cd96f4e8ea264769d6560ffd9147c48874a7dd07928f16b3e361d53c9023e2ee5c896d01aeea077806e0d71ff44eb1611242b625592f9c6a94a684ab5baf31f6e2612935d714531c7c5beb56230ca5eb15c317dca1637c0162f4e3938cdfc21e7261a8e7dda4c2eca0e67af065f022b0ff5c8ece21dbdd13d1ef667b1b30916bf4a3ce7184e9657713ce7ce85486e189276e8f1a5c7ac530ff0991844a9160faec069359e3993255d4f44f87e9c06c42a43f539a8bc6d55e381dcb7a94911f17ee8be8d09c429228b778c32ae67616c0e55dc4bc0388de22efb67bef538c617907afbe892f260394bfbe7578973d4fbbb97a808773c18fcaf9bd043b052c5e9c4544329fe7f9e42b8c7f4626f0b937fbe94197e9d3e8f9439ed12b30ee83588d3e9eab5b807f48dbba458dcabdbdfa6c89baeddc4440c1a3eff27cafe6bd309a9fdd9ea16e889782cacc94714c5f3572794b1b36bdb84f927d52a3ec117ad3ba454ab99dcd273a2034ec1e992b4fd3de64f20098afde5526cc29e506dc9969afa4857c5b19aed872c763d7312c6e62479819d3ad8aa8f95f8ed6d1378ee8704b4d7f927a241c23a03714c5920afbe184c7a6b5251a020271e0a729a3641bd62d4837912b3c7d49331177f50dcc0bc57471b79a7982f6dc48ed9fd6c692d7debdea95d43f8b38091058c2f288f14381da85b53be6d91c9bbe1f912d983ed229459ab0c0a61ce97bc2da3736335ab7769e4a3987b0f1f6cb46966e76d5fbda70bef49aacd56866521ea7ad6a28f575af9256ef573a9a635254e9b8c570eb7f3c1713839f825b56d7819e89dd075733041690a52f7d8645291b74f545f08db5b603096d34065c042126e88c543433d503486222524c2de4da1d810a29afbc0e3d3068d2f4ae83b7565b07a349d9548efa7cf15aaad58ab6196d184c0f33e15e6544a9c14eabc2ddc476de792cf54334d3850f645c33dea01e85941ba75272cc1a53e5708d92cadceea2585a988e9486cbd589d706b30619901b2378f3103e5e76b9173f281e63e76df01669882a4c7460062b7ab030c65168081ae9473d19513d6de1180f1e7f0b7170b26e191659ab14cd84ee4b4c6cf248b4dfa6b1cac57ace6529320a24f2841e83be5a985d4b119b561cb856b05e468941d5229cbeb457efb741147887619df712125f315cad3b3bf692930a1243ea20d03ea3c5e233b6cf495ac34517766b70b59aba1b35a9c5b0a044a05607ee5647c0f713bd42b88b6241e70d7dd3cb76c094630ed5e76cb67bc6ea55af38ee445b464e83522f968428995a90fc195e2238e439adbe5c9217d0de90c4f70b63126f41cd81663d6f17ee18d0c8022a5b18c05372b3b4d3a246ab7e46e5083c701f03bacc3d617427fd356f5a06322061df8c587efaa91f7fa0a50fd2ebedb3c75d6afcc6e8a11713bdc0ae86bdf4d44deaf19f1de07c5138fbd60513963e2921827d5117dc127d312fd95d05161987c9b525592cd5b47ed68aef3f1cc4ab8c1bcfcc0c2394202b352ace85ebf004e2e86857e104c7ab8e013531756c7dfa51a3fd5c17a33ff7702ed680d5a7533a27fcbfadfb0875d7209aaa541a82e273360d42b107241190170f1a83a53bf176bf6e4074ef6e623bb3b8681eb8303e4818361ecaa94d287ec067a9ce8e4a8ad80a8ec6c6f9d02b8aaa629a9ab83f890d835e873dacd97e9e4b11491ada4cc4ca541085", 0xff24, 0x4004004, 0x0, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@newtaction={0x18, 0x30, 0x53b, 0x0, 0x400000, {0x9}, [{0x4}]}, 0x18}}, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="6400000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000001400078008000640200000000800134000"], 0x64}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={0x14, 0x26, 0x301, 0x70bd2b, 0xffbffffc, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x800) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r10, @ANYBLOB="0c00990000000000000000000800a000d615000008009f0005000000080026000816"], 0x40}}, 0x0) sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, r9, 0x8, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xfffffffffffffda6, 0x99, {0x1000001, 0xf}}}}, [@NL80211_ATTR_KEY_DEFAULT, @NL80211_ATTR_MAC]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="24000000200001000000000015056a5d0a0a86620000000a0000000000000000000000080018004e22ffff"], 0x24}}, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000b9656da034b5d1666e3ad1a4", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x18, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000001811000029036879339935d6087ffc7e337deca7ff8795dd1a6874b99cdf4ef5aa456931122a651b88", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r13, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) setsockopt$bt_BT_SNDMTU(r6, 0x112, 0xc, 0x0, 0x0) 2m34.021290709s ago: executing program 32 (id=3711): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x26, 0x9, 0x70bd25, 0x25dfdbfa, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r3, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) 1m22.490848732s ago: executing program 33 (id=3812): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000200)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x3c, 0x4, 0x8, 0x301, 0x0, 0x0, {0x2, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r2 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x2409c8c1, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback, 0xfffffffc}, 0x1c) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='bond_slave_1\x00', 0x10) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000080)='v', 0x1}], 0x1) sendto(r2, &(0x7f00000004c0)="328a2ab698c2f41b46809eefc800b064e089fe8bec34798df38620cc4a8dfd94b492e8cab05231b52c242fdf1923101d17c202baa694ea6ac45823ea09c0a8db0715bc0185b15023ccbaae92c01e683f8bd33454dc3115c0069252d7a2f1835eb23ed741527733545ac90f91b15999b5c4e85e0268f168a72aaf7687cf34813235d33c0c02eff4780bad8c2750ec75bb8bd16e23c53aebf5dff745259576ba33103d792e1fb24a3faef4437d510fd2616be2f78fd4eab786f9b06a3e7f936924630e99fdc4862c3ac8b0b88f3fe2d313785e690b0efd7fe320c27f1da7f9e5947e1196bffb99ea8ba84d46e5f60652dee5d7a083f22a785b1c6857cd96f4e8ea264769d6560ffd9147c48874a7dd07928f16b3e361d53c9023e2ee5c896d01aeea077806e0d71ff44eb1611242b625592f9c6a94a684ab5baf31f6e2612935d714531c7c5beb56230ca5eb15c317dca1637c0162f4e3938cdfc21e7261a8e7dda4c2eca0e67af065f022b0ff5c8ece21dbdd13d1ef667b1b30916bf4a3ce7184e9657713ce7ce85486e189276e8f1a5c7ac530ff0991844a9160faec069359e3993255d4f44f87e9c06c42a43f539a8bc6d55e381dcb7a94911f17ee8be8d09c429228b778c32ae67616c0e55dc4bc0388de22efb67bef538c617907afbe892f260394bfbe7578973d4fbbb97a808773c18fcaf9bd043b052c5e9c4544329fe7f9e42b8c7f4626f0b937fbe94197e9d3e8f9439ed12b30ee83588d3e9eab5b807f48dbba458dcabdbdfa6c89baeddc4440c1a3eff27cafe6bd309a9fdd9ea16e889782cacc94714c5f3572794b1b36bdb84f927d52a3ec117ad3ba454ab99dcd273a2034ec1e992b4fd3de64f20098afde5526cc29e506dc9969afa4857c5b19aed872c763d7312c6e62479819d3ad8aa8f95f8ed6d1378ee8704b4d7f927a241c23a03714c5920afbe184c7a6b5251a020271e0a729a3641bd62d4837912b3c7d49331177f50dcc0bc57471b79a7982f6dc48ed9fd6c692d7debdea95d43f8b38091058c2f288f14381da85b53be6d91c9bbe1f912d983ed229459ab0c0a61ce97bc2da3736335ab7769e4a3987b0f1f6cb46966e76d5fbda70bef49aacd56866521ea7ad6a28f575af9256ef573a9a635254e9b8c570eb7f3c1713839f825b56d7819e89dd075733041690a52f7d8645291b74f545f08db5b603096d34065c042126e88c543433d503486222524c2de4da1d810a29afbc0e3d3068d2f4ae83b7565b07a349d9548efa7cf15aaad58ab6196d184c0f33e15e6544a9c14eabc2ddc476de792cf54334d3850f645c33dea01e85941ba75272cc1a53e5708d92cadceea2585a988e9486cbd589d706b30619901b2378f3103e5e76b9173f281e63e76df01669882a4c7460062b7ab030c65168081ae9473d19513d6de1180f1e7f0b7170b26e191659ab14cd84ee4b4c6cf248b4dfa6b1cac57ace6529320a24f2841e83be5a985d4b119b561cb856b05e468941d5229cbeb457efb741147887619df712125f315cad3b3bf692930a1243ea20d03ea3c5e233b6cf495ac34517766b70b59aba1b35a9c5b0a044a05607ee5647c0f713bd42b88b6241e70d7dd3cb76c094630ed5e76cb67bc6ea55af38ee445b464e83522f968428995a90fc195e2238e439adbe5c9217d0de90c4f70b63126f41cd81663d6f17ee18d0c8022a5b18c05372b3b4d3a246ab7e46e5083c701f03bacc3d617427fd356f5a06322061df8c587efaa91f7fa0a50fd2ebedb3c75d6afcc6e8a11713bdc0ae86bdf4d44deaf19f1de07c5138fbd60513963e2921827d5117dc127d312fd95d05161987c9b525592cd5b47ed68aef3f1cc4ab8c1bcfcc0c2394202b352ace85ebf004e2e86857e104c7ab8e013531756c7dfa51a3fd5c17a33ff7702ed680d5a7533a27fcbfadfb0875d7209aaa541a82e273360d42b107241190170f1a83a53bf176bf6e4074ef6e623bb3b8681eb8303e4818361ecaa94d287ec067a9ce8e4a8ad80a8ec6c6f9d02b8aaa629a9ab83f890d835e873dacd97e9e4b11491ada4cc4ca541085", 0xff24, 0x4004004, 0x0, 0x0) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@newtaction={0x18, 0x30, 0x53b, 0x0, 0x400000, {0x9}, [{0x4}]}, 0x18}}, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="6400000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000001400078008000640200000000800134000"], 0x64}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={0x14, 0x26, 0x301, 0x70bd2b, 0xffbffffc, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x800) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r10, @ANYBLOB="0c00990000000000000000000800a000d615000008009f0005000000080026000816"], 0x40}}, 0x0) sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, r9, 0x8, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xfffffffffffffda6, 0x99, {0x1000001, 0xf}}}}, [@NL80211_ATTR_KEY_DEFAULT, @NL80211_ATTR_MAC]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="24000000200001000000000015056a5d0a0a86620000000a0000000000000000000000080018004e22ffff"], 0x24}}, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000b9656da034b5d1666e3ad1a4", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x18, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000001811000029036879339935d6087ffc7e337deca7ff8795dd1a6874b99cdf4ef5aa456931122a651b88", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r13, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) setsockopt$bt_BT_SNDMTU(r6, 0x112, 0xc, 0x0, 0x0) 7.446421608s ago: executing program 0 (id=4698): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x300}, [@IFLA_MASTER={0x8, 0xa, r5}]}, 0x28}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x50, 0x10, 0x403, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x40020}}}}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x50}, 0x1, 0x0, 0x0, 0x24000804}, 0x20008020) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="280000005f00013caf23b8000000000008"], 0x28}], 0x1}, 0x0) 6.834631493s ago: executing program 0 (id=4703): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000011008188040f46ecdb4cb9cca7480ef410000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x40840) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000001ac0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000400)="5f1ef9653da1", 0x6}], 0x1}}], 0x1, 0x94) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 5.116680094s ago: executing program 3 (id=4719): r0 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10) setsockopt$PNPIPE_INITSTATE(r0, 0x113, 0x4, &(0x7f0000000080), 0x4) ioctl$XFS_IOC_SCRUBV_METADATA(r0, 0xc0285840, &(0x7f0000000100)={0xfffffffffffffffe, 0x38, 0x10000, 0x0, 0x3, 0x4, 0x0, &(0x7f00000000c0)=[{0x1, 0xfe, 0xc71a}, {0x7, 0x101, 0x3}, {0x0, 0x1ff, 0x5}, {0xe, 0x101, 0xf23}]}) socketpair(0x8, 0x0, 0x5, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f0000000180)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}, @in6={0xa, 0x4e21, 0x6, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfffffff7}, @in6={0xa, 0x4e24, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}, @in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x68) r3 = socket$pptp(0x18, 0x1, 0x2) poll(&(0x7f0000000200)=[{r3}, {r0}, {r2, 0x1}, {r0, 0x627}], 0x4, 0x9) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000240)=[@in={0x2, 0x4e24, @empty}], 0x10) setsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000280)=0x7, 0x1) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000002c0)=0x5, 0x4) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$802154_raw(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x24, @long={0x3, 0x0, {0x7ee50a7e4e440c77}}}, 0x14, &(0x7f00000003c0)={&(0x7f0000000340)="229f5497bf43f5d39da14e781456ec85906627ef231341a9450f920eaf9360d86a44c1476defc7c6d8cfec0cd5c5e9ca86354dde2932bd41c3aa684dc3ece921c1997b603321dc125b5774febcff2e7e718571056dfbc7d77933deef8187cabde9269d8a33f3add0a3745cdaaa81a39a1f948ffbf0f09a33", 0x78}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000) sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x64, 0x0, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x3e, 0x3, "2bb7bfb158989e4bf816b7f726e0fde706410198949de9f7a7031611fdc8c94780dd11a3bb2fac43241af4d021a891501ec4563f83bec25c5465"}]}]}, 0x64}}, 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000005c0)={0x0, 0x10, &(0x7f0000000580)=[@in={0x2, 0x4e21, @loopback}]}, &(0x7f0000000600)=0x10) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000640)={r5, 0x4}, &(0x7f0000000680)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000006c0)={r5, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000700)={r5, @in6={{0xa, 0x4e24, 0xb, @rand_addr=' \x01\x00'}}, 0x8, 0xae5, 0x5, 0x3, 0x2, 0x9, 0x9}, &(0x7f00000007c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000800)={r5, 0x2, 0xed42}, 0x8) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000a80)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1102}, 0xc, &(0x7f0000000a40)={&(0x7f0000000880)={0x188, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xa4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8a7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5af}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x60, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xb, 0x1, @l2={'ib', 0x3a, 'wg0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x73da}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x401}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5c2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3e}]}]}, 0x188}, 0x1, 0x0, 0x0, 0x80}, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000ac0)={r6, 0xb1, "ef74f35ef6484ee8127545d1b19982934b46a1f9be49ef50a0e73001d57aa1557ca8ef17d644bb93b889e1fc4ec513716e8f7da481a26eefd1f943522d8989e2c1bc15dc8e78b526d2b50d917aba0d578d3767e76419360d677659655c22e7a4b50993dc6ae6aa65accd2dd2201f4e80c7cb50a57da41c6d82323e4f4ebadac67b435d2a95d6a4c1479aa3ff6b7564dbcdc56a2d0cc7504e11dbd8342badaeb07828a185956d4482276ea397e72d5ffcbd"}, &(0x7f0000000b80)=0xb9) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000bc0)={r7, 0x3a, 0x8000, 0x2, 0xffffffff, 0x6}, &(0x7f0000000c00)=0x14) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r8, 0x100, &(0x7f0000000c80)="8a78ce20a7e607037b8caa8d89b0934f79b2e6d3299575931e5b572e1ba72a64210f0b126926b00c54682ce37234a0ab858a13ae9c17d1869d9604545298aadae178ba1397a1f85f601790cc43b4f842d4aec58020648ec61885aea9c46d5ee9c51a9127f682472e8b6d6b8eba35b78e9b5ef94d5af8ef0f643b760acca5a757078914300ee5011f649c01bd6dc5af897abd3670816c69cf90e0997bd8912c05dcecde3d4b43c780a8ff7a209da1b3fbac70fd278f87b24fdbc0722d38fa9ef9") r10 = socket$kcm(0x29, 0x7, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x89e2, &(0x7f0000000d40)={r3}) r12 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000f80)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000d80)=@raw=[@call={0x85, 0x0, 0x0, 0xaa}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x5}, @jmp={0x5, 0x1, 0x3, 0x8, 0xe, 0x8, 0xd6d0ddcdd148c0b}], &(0x7f0000000dc0)='syzkaller\x00', 0x1, 0xa6, &(0x7f0000000e00)=""/166, 0x41100, 0x20, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000000ec0)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000f00)={0x5, 0x9, 0x81, 0xffff}, 0x10, 0x217f5, 0xffffffffffffffff, 0x0, &(0x7f0000000f40)=[0xffffffffffffffff, 0x1, r1, 0xffffffffffffffff], 0x0, 0x10, 0x1}, 0x94) ioctl$FICLONERANGE(r12, 0x4020940d, &(0x7f0000001040)={{r3}, 0xbfb, 0x101, 0x5}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000001080), &(0x7f00000010c0)=0x4) ioctl$INCFS_IOC_PERMIT_FILL(r11, 0x40046721, &(0x7f0000001100)={r9}) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000001240)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x1c, 0x0, 0x4, 0x3, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) 4.531991304s ago: executing program 0 (id=4724): syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x68, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}, "040022eb00000000"}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0xfffffffffffffe01, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000600)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000900)={0x40, r2, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_KEY={0x24, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x20, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x4, 0x3, 0xfffe}]}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x40}, 0x1, 0x0, 0x0, 0x100}, 0x24000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) r4 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0xff76, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x27, 0x2c, 0x3fc, 0x0, 0x0, 0x2, 0x0, @rand_addr, @multicast1}, @address_request}}}}, 0x0) sendmsg(r4, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x2c, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x3e}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0x10, 0x1, 'CONNSECMARK\x00'}, @NFTA_TARGET_INFO={0x5, 0x3, "ef"}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x7, 0x1, 0x1, 0x0, 0x6006}]}]}], {0x14}}, 0xa0}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000440), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x40, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_LABELS_MASK={0x4}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_LABELS={0x4}]}, 0x40}}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000140)) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r10, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}]}, 0x1c}}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000ca0c250101c33536442e1cc8aa90d415dee30010008155ffff070000000025000000001d24bd55d78ddb74a689774d030000001ac55978c52c2baebc57d26cd8cd16f3524b963a958847443b4dc2", @ANYRES32=0x0, @ANYBLOB="d4d00000500000001400128009000100626f6e6400000000040002800a0001000000000000000000"], 0x40}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000300)) 4.260652851s ago: executing program 3 (id=4727): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x2d}, 0x6, 0x0, 0x3, 0x6, 0x0, 0x1}, 0x20) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@mpls_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x20, 0x0, 0xfe, 0x0, 0xff}}, 0x1c}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000006680)=ANY=[@ANYRES32=r0], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000001c80)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822a0269a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7ae22e16c6c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546bba3d005585bf07d70e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225c380fac12f8205d182f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37bc21cfdc8180c7d09c35d130d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d96ee1b84bb64b14aebc6b5194c55dd6890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56bd86acb7654a195bc3e98df3a5dffd5b07838a3ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0ed9829dec16ab67a4f59a504e09f55ab82bbd405087a17a229a149c53ee9145500db213cb36489a10957739e481a756e65bde579bbbfb404213f661eeaaffacbcfbfd6e19946b18a45333df51d78f735999aadfcda64488160c4ae6ba9dcef0c144e3de7be7fdc1ead6a425ff6128fab1517630c1d9507e0685488a57f85298b4e4382842c0730"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000400)={"a5591d8ac95626a4899fed7fbbdac97f", 0x0, 0x0, {0x8000, 0x4}, {0x100000001, 0x4}, 0x2, [0x3d, 0x4, 0x6, 0xff, 0x88, 0x3d7, 0xf587, 0x6, 0x4, 0x4, 0x1, 0xc4, 0x9f14, 0x1000, 0x7, 0x80]}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@mpls_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}}, 0x1c}}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f0000000580)={{r1}, r3, 0x10, @unused=[0x8000000000000000, 0x7, 0x4, 0xcb], @name="55a0f7826f219fcc6abae7728af98299fb3fe6de42a2161be67010f16ed56ac85d310e3ad9ac36cade430972680785fea79e85abdab9df9d10dd6dc1b48bcdb88a3299b4abd3c2e4bffa4df7bf093cf987d0750d944c103e802b2df44b2407a3df2e5ad81b0264586b1c86deedb6db730cba338e5f6c323e8ca60aff69040560a90794b5fcd00067868657a825b9401c819f88f04f506399c9a17d19be60627a2382f381955cec5fe677e45653f30b7f441349fb0051b66b5c2c04b75a3cdad47106bff4fce452a68347c5451f1ced943ddf360b83b85367909480385c1e444cc76ad19a4c5ce376a67cc395d01ab4a0e58932f9571aa79a2bdbace491b3ecb3a9689e9c4938bdc2b70d9532972d3afbef62487ebff55ea771b5052f5c71c280c98ad21b949eb298e016a40bbf3207c8bcd65e650ccb745785bef698f2f169730d10954ead4c469a19743934d135bad2ea7a807434c3365a667f40637f0962dcce87297b858e79e17b11c7c5bbb5464b84df7e399dfc90f5768d8a635987fd66dad0d462b8aa7120b78c3e6bf5fee1397d12e456f50d71c2ce4a4de250c7f5307da68708319168ce349b7365c9928f07d3400dbcd8bb0175fed3f69f311c7229e21f546b28f22fd3be40b32b4a2aab8a1c7cea7f12b46646cdfcb244d031b98a5e1ffce22ea7be937b94909545bf9b94f04eebeb2389b60c769a412fc8821a905fac465af4ee03b177b4df9baad9144733a42391b98f919f8294eef7c4187da6a75375702e442a7340b17ce6734152a01e97a8a6c70376ed86cb875c76d6ad917998e93d28375693e40c3d199787e5c713835539ec58ff5a11c226676ca1821073e1fcef95d38fa0144df2cb5d01a35e1bb4656b1e9ba95f518c02359a257ea47c931a58e5d3c76f3880fff26bdf85a4045f7baf1b984782fe244df3f7c2b66c6c16c78f29b8f231bc1b410deb8cc07c01f2b41b5442cfe9f9628fbe8ad0366f362e1829bf3c146c9285b1e3550d8f7fe315adb3d75a30bb7ac93f1c30508b5492b131e74f131beccc24a5d8fd104e3b29e70f4b3391418834f9ae4ef6a739bf17e3cf81480fe89c835af19523d3015ea4a8a746abab595fdd7b6c39d784ad864df29820750b3615e748da0e14b2adba85dd5ff82982abbb08c1ead905b78e190bef32f502aa7a1d6a4a6057762b77931aab914058cfd1826f91f1cfcd843b8f2fb11f9f71a91ab668a6f4bd95a69d7272bb60bce5f37a00561a7d4e3c1f816ce8edd0f90ad0348a75f697c168a1ee3b7adbf826235a2a4c2e2f18f2e4d45393b59aae29fc623261f638591e29b195a1e6ec8afb53601258b1fd7ec1174e688f032a6e39aacd244bfac0274a74d11cba4fb468b6254f328af91de80b6b52736a4fb877655d497be747b935351a128a0867760827f4c1d5e9371a06f69ff241cbe2b0f041dd9b5f7523a85f77e085af0dff24a0a83c4985e77079fa23b195fce37df814d039da7e18a091a7b663830fca023871abd4dc5103119a8daa3fce3c0bda82c08da0e816264f98562f99a04c7e67f6db557fb9b7f0b7ac7a28d991bbd63f6005862e5c8148364e2c9ba8e2cb6e335242d92f03499d4a579eb9d6124d44c6e82c8e001067bbb2d301f0908fbfa003919497fd81bebb56fc520e98163267d36319215e7aee0f596b49b07ac99b66160ad39a81fcbd44231c9fc5c0abc20882e3dc1fcfe20027a5a3c9dbc2baac834469968cd5532d76d8fdf6c170f375984d6a0c4e89ecbf6a0af90f54eaf1f778c9ca6893fda5cb7a0c94ac2cf8d17ef61e2f0632dfe7f292057928f282606e42be96cc4484ad8458d8b267e94816f4e53b184d5fe450b6186c215d4f304114dff92bacec2b6a95f9e1dfadd706eed8a17c331fc1bef0c91e28b7728abb8d0a66f3e9cef31ee1704b20fde64dd7d26063623777236568563a4ba8419dfcdbf0607ee7a7b13188bb5fc3a387042056681960cc73b8e4651831e62465b36b83cdd32126e15611abcb6f7c9cac06a81fa8ca8f36869642779e2805b654c9390fa94d1364a472f12ffc5da04a3b1634b659ca1736aa45439bb225ea17da356c5d1e34c3e39fc11349e3574122f206fb432695711462a05c0adea26c70be5e635f2eef7446912fa8b439ed9a23ebf4283e85ad1377f364f53006c2b266b3d6de8d7265e3a92a5992f23fa390833a3f40eaef726c2cd07612a8f97f19fffddcba64d04499a3ce73af16dbb035552cc8a2a4ab639770900935a752dcb21715c8e990f74017855b148394da00392ead117dfd59ec16e32bac8e7e5794f37f75c6d286e0608803e0b46deb4fc6b445cbf233f8bf6d5892b8e18cb0a05bf06a59eb872f216a52d277489536692acb73cfa481a78fa755e1b4823e27d21b08d3cc46a7f59d10c16a8c064ffa6855d580df2d5bf5e5e9ae19ebd3ce727833abcce6e3f800248c1d5a10d9488d39fd7d89d1b147b9a2e51df071a0d27a05962a42138395bae32a2605ac60211bc5349fbf7e577496c702538d67efaa96c39259e3d466bdc4a49bb8e6117460b27429df522b7482a095f549c0c8f93c9319e547595ffcf9ed6e33db02b8a5ca3f1ed17c0fc16ed030fd1eaea6f1585f6e81e6aa45a917b99a1d742eff038eaf01215f715f430d9a6887156f1eb73bfb7626df7a61213072ec3f1782e328af5912d62f475b68bdddc76c1c78d563c4052304bbe71294fc3448d8b899047ee34c21a9823b9e4260da60d09d9e719435385e5591e23efe8b328b0d829124d4d363af72f218ee20a41907580048398ef16ea535b3fe161ddb094b5564d155ca1c5b89d23bd633d1063a601a85589113f53f61bf1f22e23c3c34158cc30bfe46834b9dea8133d748bca23e857360ad9ceed7bf43cbebf489b8661ee3da67f8ff591ea6f364dd94f9091c168fbbd2622b551013d85f41b98797d2a0d559d8e881dc431fea5b07395f5a402082df473ea315afa8e28b413b6d24cdff1f71643fd69a0c985c1c0a9639d2563e4730ec2164f9beb5c3d3c52435229a0cce6bbe99774a2d3b1ab763b4a0621b615eac43525a3a585292f02f44382321ad0b06bf474912dbe1d43a1114da37a0dfac7029290eb48a9efe5b9950672cf1d1a0e823f98617ca135e8ec090507b888b772465bdd06351bb4366718db5f32bf967e00328edfbddbe6ce9f8ca0951d4c9b9aef6893756ccfce5c3a6301e59355bcb6c58d0d9a82ba88b8a93f287bee4c4bce2a5c08084aa1eb8f354ff1df0b13f4f46deedb4ebe83f15194bcb21e4ad4c0891f452cccdcb96d99f31c377f20a41a3ad16e23c74e34a1156e8136bcf517485f2494a88545748b5159e1bbcf415244aa9e5f49ec43075dd824ac092e2bb940173ffcc2e8030d02bb5ffdefcf797fadaff16fe96c5ac32dfa226f199b7c23002172b8793b4dd47206110c2b19a4f8a953aaffcf8247a76240efff1b308531fccb9acb19fa9815dc77e80bb2c94d1bd54da6f2db7bdb5acfe70bbdd5d029578e60f07da34828df1f2d8f0e1c0c267c8a3f9088d6c297628eb8ac2da4b93ba9715e0b666edf31fe17a54fc8dc63d99ac8152b3756d8378757e2061e890f8b906f969deec06120681396dc9917eba49f2464d067a93e4341d10d1e275a436f70a40977f6cdf22911ef3132f69a62b3003b0d9e7be6e27579ed2b0d202c9b15324c7fc3e29d77bd5a26a3438254f9fe4dd3891f090cdd4f142cae8ede7d75e339a97ab5781e276837440c876d478f9009e6f686cfe254d2624340849f9e7180e26b5ad624254a7d98592215cad886b589889da00ad63d7d3c8a2289b6f1df1bad26add785211a7cd5d0166496d168007739031f9824bac41dd79d214b98d82d318ed41fcd42676737980c395f1fff80e63e4a5a97e2562bda7a8558d9044dc23c675e74c62c8c57c08181bcffafd6d41c69dd5280079c9d4f31c8b69d7c4671d451cab7bc229f72277d11771c91582c959ef1c636403d0256410fafd190d0746c117ac0ad6dde5a07883825f9768cf305feb43c06d67bce1fe07ebde39ba7bf4e9b1a6631e153a243c6178e0f05bff0d1e901fcc18d10324602dfd27c0e33364a1c0dd52711578f2aa351ee80bd7899e82e176990b6dcbb6988d8c9398b92645082f63ba38ccf1e300c365cbc0ecf15ab1d3cc909eb638f1ebdb7a34c77ddadfde8ad3248901ba2089de414357643216057c4fd11616421dabe04c26dc4fd11509e690fd27037c7d6d9279b010b1257dae170440929ad3a8531ca6b42ea8c228117b0f2d3c3203aadd08b8183e2b9466b90024e34487433ba116180c8203508c0d804a87c8a9fa269c729c46966b952572208cd83380dfa420e88df4cecbaafbb068f6f798e791c1173d00dcbedb74cfe9bb1f3a7700540e8b03455caa2b2267463fa1a9ae61879e5b520479a5775427763c651cd0a28eb0a25dc36170e8150506876f0cd22ad8855ecef68fa57a2d26abeec658e5554995037c17948d42ce93de1a61e2782effe9a9acbdf53ac4e929f5e217222860248fb6b0966795723f1621ae12f5681a8cda5b1f14a0846761b717707b63f25df2fcea72cc281bb697cdaeb1d3d0b48d9ab65d7457219fd5506f8571528e23752aa0b176db729829bf4b335c7a46943973583a7579543d99015ab1eb7bbc901406cb4d05a3283530e666d0967877f5ec55a13d07608622030bc41d3e79ccd374ebd89f6e8655d4193fad13b31c60fea9f35824e37d7ef4c6da0edf5511751cfaa4386a6dca91209aff3b44d00782033c7d5c27a7d34059176ce9041b67a22377357abae7bbdb3d0c959a4421b82746c8c40581bace8d77f2b26ef522ebd310a34f3d9558cc0f9cacc0ee3d57f99d36cbf6c21985dbaffc5c722d7e22dbce4a340ffdf1958af6b0b6b8d3db9c463637638461f12f9086c3947f5da7417a2ac76c3eec085946d484b8cc0277f5c2ec786a4f9d32095bd8ffa55519af244ade3d80433344e908f0dac51a599fe92b8a5b14592a6417419c5e8a83711fffec18fdcc2b5e33b5aa41d11779dfe4851004bd4b3490aa8e49fb8c6846ece31f688f8e370901828a2e3cd5f41914aaad3ca1d04ff1586b181f9707f996eec517f3affad2524774ca98ac26b6eeeb89ee834ea81fa58241228508bcb500b83b69b44b0a46781f733fb35543aaa479694ea22f4b1d9dd2ed562d5147d33207bad0f9eba7256ce4ee0eaf9d5821ed62d7ec1a83bba165677a95348aeb117ca9a95c92719d8ad982c55fe186da1fc3b96d20cc892fd1d36b4ff60e2f6e04dd2e0f41b816d8c61326beb490016fd89a86e5164d4d54a0f19cbbfee9eb4eb2de77f13e4da742c2005219499de81ace3834341006c20d3c6aecdf01df43b4c4ee103cb60b54eb80a40fdbfa7fd70f9ea1a42032f5553289a7877d48562ea832cf914f60e80262b0481e0276b665b22436f49db6ef1c1c28ee6675d9abcd1126639e85fd3c5f16faefa3ce478bb8c1c745c94a405e88e96e2a8dbcee1fd5452810a0d705aa1362aeebf288e44bbb39a31bd04fb3e0aa3860e8b626d3c5d6584e6ec1b8e21b76a436f63d4174ac026b878045bbd731f8959b7e91c76b8da364332fccb8e961367d5fd9cfd445275525ea4cc17ab1df95ae1be60029989f3b9e4608c8d4d5c2ef01654c8d520bd14b3c039e214fc768ffdf9ccc95e18d41"}) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000017c0)={0x1, 0x3b, "342fc07d4a803cbbba93057317187eff4e39e7f389e4e95997be8d8be6fd9c4aa69a95d822bc5057550eea6c18a7b5410c373692fd59732cb5e0d3"}) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000001900)=ANY=[@ANYRES32=r2, @ANYRES32=r2, @ANYBLOB='/\x00'/12, @ANYRES32, @ANYBLOB="407a786570edac4eb2b2d2ec6805000000000000009fdaa16a497daf671b868a3b0e5a3a8ae2c9339501a200b4365080bed170c4a49b", @ANYRES64=0x0], 0x20) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup=r1, r2, 0x2f, 0x8, 0x4}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r1, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000100)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x95, &(0x7f00000001c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0xef, 0x8, 0x8, &(0x7f0000000280)}}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_BT_FLUSHABLE(r6, 0x112, 0x8, &(0x7f00000000c0), 0x4) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000500)={0x0, 0x7, 0x9}, &(0x7f0000001580)=0x8) ioctl(r7, 0x8b32, &(0x7f0000000040)) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@func={0x4}]}, {0x0, [0x0, 0x0, 0x0, 0x2e, 0x5f]}}, 0x0, 0x2b}, 0x20) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x4a, 0x0, &(0x7f00000002c0)) connect$bt_l2cap(r8, &(0x7f00000015c0)={0x1f, 0x1000, @any, 0x7, 0x1}, 0xe) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r9) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001bc0)={&(0x7f0000002dc0)=ANY=[@ANYBLOB="10010000", @ANYRES16=0x0, @ANYBLOB="000225bd7000fedbdf250300000008000a00237b2d3a0c0006000200000000000000580007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c000200000100000000000008000100000000000c00020005000000000000000c0006000200000000000000580007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0100686d5f276fc63549bf1911265e089f256553bb7720a274ebe562ac9e9cf3d914ad00fa2448d2c1f5ddf78f16b83f259e303e3c9616bfc5701e408eeb6812a8ebd5dc8b20d76caba278a68f0eb256073573487966c26ea412da2050a9aa5e49faceb3217caa4153ebd78a89910a8018bbcbe8a4fa77b49a6f726adbbfbb767917eeafdd988be8ef456109aa03e65a8379e5a6b6cafa92fc094c359857629193c69ab9838044b88326b3a2083852eb98a0358efe036480182246afe14420364039c5ae02d686854a7063b5ca056a18cf7badf17b82b182470b68e1c155592511e9e3bf87d1630e0acecf9eab5a0cdf43e37f1d432baa997381900345d1e5f5c72c", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="0c0005000400000000000000"], 0x110}, 0x1, 0x0, 0x0, 0x48001}, 0x20004014) syz_genetlink_get_family_id$ethtool(&(0x7f0000001640), r9) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000001880)={'erspan0\x00', &(0x7f0000001800)={'syztnl2\x00', r5, 0x8000, 0x700, 0xfffffffc, 0x6e57, {{0x11, 0x4, 0x3, 0x0, 0x44, 0x67, 0x0, 0x6, 0x4, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp_addr={0x44, 0x24, 0x3c, 0x1, 0xe, [{@broadcast, 0x1}, {@loopback, 0xf1}, {@rand_addr=0x64010101, 0x4}, {@dev={0xac, 0x14, 0x14, 0x1d}, 0x81}]}, @timestamp_addr={0x44, 0xc, 0x12, 0x1, 0x5, [{@loopback, 0x5}]}]}}}}}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r9, &(0x7f0000001780)={&(0x7f0000001600), 0xc, &(0x7f0000001740)={&(0x7f0000001680)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r8, @ANYBLOB="000329bd7000ffdbdf251400000008000f000900000005001900010000000500180001000000080015000100008008000500970700006000018008000100", @ANYRES32=r5, @ANYBLOB="14000200766c616e300000000000000000000000140002007663616e30000000000000000000000008000300010000001400020076657468315f766c616e00000000000008000100", @ANYRES32=r10, @ANYRESDEC=r1], 0xac}, 0x1, 0x0, 0x0, 0x20048001}, 0x0) 4.024697277s ago: executing program 5 (id=4729): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x30, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x6, 0x2, [{}, {0x0, 0x5}]}]}]}]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x44, r2, 0x100, 0x70bd28, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40051) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, &(0x7f0000000140)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x18, 0x42, 0x107, 0xfffffffe, 0x0, {0x4, 0x7c}, [@nested={0x4, 0x146}]}, 0x18}, 0x1, 0x0, 0x0, 0x20048808}, 0xc000) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x30, r6, 0x1, 0x0, 0x2, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xf}]}]}, 0x30}}, 0x0) socket(0x1f, 0xa, 0x7) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x0, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x7c}}, 0x0) 1.370276595s ago: executing program 3 (id=4732): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x80}, {0x6}]}, 0x10) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x70, 0xff00, 0x90, [0x0, 0x0, 0x0, 0x0, 0x200000001300, 0x200000001330], 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff0000000000000000000000000000000000004c0b5f14345eca9c70d7e924c478ff0467e31cf053c2bf7d6d93ab2cca7573c972beb8bc0b998013f54259a13f95bcb6ff94f67f8e1176250ea957eaf36109d8633e58e24289e64724e612acf60a11a75fb00ecb0faa1179c0f2e391a5e2187e94d4f663741f660a192da5307fce7e3ac137a6b4a6a28dc4d19b7c4c4bfc135af03a622a1c76"]}, 0x18e) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000038980a00000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000006c0a03801c0000800800034000000002100002800c000280080001"], 0xb40}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r5, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES64=r3], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r2, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62646c95c716727e", 0x2f, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r5, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="38c499349e8d92a3df7b37cc5707b19eb02459bce22899e2ae8e2094b5a21d05274fd9ddd3d2e40b7cdfb94c32deecba443c64627dc272f29cafb50f8b9eab25f133cbd0282a4c0579362b89941abb588a25233b96fb08dd44082f521e512c690bfd3f05e65187d20063d3fca21f1f40b7f98434b5c5e010b9ac25030ac7a4cf233b8f6e4ce42da7622c153f72f6249c55bdd6109f24bbc7ffce38b4315fba29d877ca4abe0180ff39385fb8274e7365d52bd17bd924b77461ca1bb7e3f8e7d0ee16efdcb3adc841d283e2b024f682a05e2041257d328a1969c7b4c69112b280c69a9500c2d91b692c9b8d60a464fb5dacd57b090ef5286409000000000000005df93d008447a5b999f6db6aa60880c0a5dde36755eea82e08bd1caefeffffff40e68935bd24ff995ce10478fd937c2f9eeebf1b06904b716f709bfcc56facddb662037e1c74879e8100007e2578a417976368e38a1f368bad512dbb5ecc2444759cb5a46f58f2ed63aef350719775be9737740bc24923b4fb13dbaf30f766db33cd77e7c38bb93d0a8b343d60eb8fadbf2378ff2114bcef56cbed343e03be75ede4446f80426e9aea400d8634f5428ad0716442b81646025ef1ac4a703e000000000000000000707088bd878ba9c0c746bb61c81a1c5c55326314a085b930a23c51cafd7ceb169d10633ac1a51539c8cbb26014611b43a2d54b30d8c773eff6e898d169f70cdb8b78eefcf5f571bab7a746d9e2ee5354b6ced03773442b18fe2215be166cedc198fc62", @ANYBLOB="76d0f5c801a2ba93aa0cd7d41a3f3ebb17d810ae9a282ee20e074af5a0ce649ddc9f0f14b3504606db53df9962204d52e1bdd4c277441acdbaf190777dc7466a38d7dfbfec6bcc09daae7f47917511078b0cec7a9debcd525e0c2dc6c4abaccfbd54224f8e3e940adc8bab88c344dd28793cedb27d23b1a228c4c2b7d7d0f36ffa8a09aac4fbe065b960074599e109187c900eb3c9a6dfb45795333a7c5e29c44ce9a6c09cfd49083a8b3fa180727aaedd36981575e35e2ed91514389707598ec37d77482f060580"], 0x50) pipe(&(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r8, 0x0, 0x3, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.355774946s ago: executing program 6 (id=4733): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="340000002e0003050000000000000000200000f8ffffffffffffff0008000000", @ANYRES16=r0, @ANYBLOB="0c000f"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000000000007111c300000000008510000002000000850000000000000095000000000000009500b0059d350000f8eb70c3d9330b16491e095815635bf7490c180e3be703966bd8fdc277008531ccb9d9ae8dc9e78d9dc5311486fd1d2bfab99b08b4d46852f103d4ed539d04b034d645e2ea69674b1749efdc6a03ab8d5c3d2a2ed722271db8f4b166d4a579abbfc27974"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x6}, 0x70) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) writev(r1, &(0x7f00000003c0), 0x0) (async) connect$l2tp6(r1, &(0x7f0000000200)={0xa, 0x0, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x200001, 0x2}, 0x20) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), r3) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xe, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x63, 0x11, 0x21}}, &(0x7f0000000000)='GPL\x00'}, 0x94) (async) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000220000000a0001007770616e3000000005002000000004000500200000000000050020000000000009001f"], 0x44}, 0x1, 0x0, 0x0, 0x4044880}, 0x40040) (async) ioctl$NILFS_IOCTL_RESIZE(r1, 0x40086e8b, &(0x7f0000000000)=0x7) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xdc0, 0x0, &(0x7f0000000300)="0400000071a76d2688ca006588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000280)={0x81, 0x2, 0x0, 0xab5f, 0x7fff, 0xb5f, 0x7fffffff, 0x3, 0x0}, &(0x7f00000002c0)=0x20) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000680)={r6, @in6={{0xa, 0x4e21, 0x400, @empty, 0x7fff}}, 0xb97, 0x2, 0x28, 0x48ec, 0x0, 0xacb3, 0xc}, 0x9c) (async) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) (async) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000400), r0) sendmsg$L2TP_CMD_NOOP(r7, &(0x7f0000000780)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000740)={&(0x7f00000005c0)={0x38, r9, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_to_hsr\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x40085}, 0x83199438880dc94e) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001540)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xffffffff, 0xb, 0x4}}}}]}, 0x40}}, 0x0) (async) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfffffffc}, 0x1c) 1.306240228s ago: executing program 5 (id=4734): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000021000100000000000000000002000000000004000200ac1414aa08001000ff030000fc9470445f60f86fbbe55ad5ded83a1fc4e8f9a8f4360de4f8fcdee55d6f626c0996d77073c1a668df9a42f6fc6f6184b40f171b64ba1d3edb010ce144c8277f3207d97618b65a3f8eccaecc18642578666b9cb43e8d7df5724f776f6eae0f712afec5af000000000000541a"], 0x2c}}, 0x40) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x20, &(0x7f0000000180), &(0x7f0000000140)=0x3) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r2, 0x104, 0x5, &(0x7f0000000300)=0xffffff6c, 0x4) r3 = socket$packet(0x11, 0x2, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c00048038000180080001006e6174002c00028008000540000000000800014000000000080006400000000d08000240ffff000a080006"], 0xd8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r5, @ANYBLOB="020000000000800080001200080001007674693674000200"], 0xa0}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x4}}, @TCA_MPLS_LABEL={0x8}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xfffff02c}, {0x80000006, 0xfc, 0x67, 0xffff}]}, 0x10) 1.246696239s ago: executing program 0 (id=4735): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$SIOCAX25GETUID(r1, 0x891a, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000080)={0x2, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0xa, 0x0, 0x0, 0x2}, 0x10}}, 0x0) recvmmsg(r2, &(0x7f0000000740)=[{{&(0x7f00000005c0)=@tipc, 0x80, &(0x7f0000000800)=[{&(0x7f0000001740)=""/4081, 0xff1}, {&(0x7f0000000640)=""/251, 0xfb}, {&(0x7f0000000300)=""/52, 0x34}, {&(0x7f0000000180)=""/51, 0x33}, {&(0x7f0000000240)=""/140, 0x8c}], 0x5}}], 0x4000000000000b7, 0x2, 0x0) read(r2, &(0x7f0000000200)=""/7, 0x7) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, 0xffffffffffffffff, 0x40000) r4 = socket$can_raw(0x1d, 0x3, 0x1) recvmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f0000000340)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}}}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000400)=""/123, 0x7b}, {&(0x7f0000000480)=""/181, 0xb5}, {&(0x7f0000000540)=""/89, 0x59}, {&(0x7f0000000780)=""/66, 0x42}], 0x4, &(0x7f00000008c0)=""/8, 0x8}, 0x40030000) readv(r3, &(0x7f0000000040)=[{&(0x7f0000000180)=""/163, 0xa3}, {&(0x7f00000010c0)=""/4084, 0xff4}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c000000640001090000000000000000021800000000fd010000000008000100ac141400080005000a"], 0x4c}}, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000002a80)={0x114, 0x23, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x102, 0xf2, 0x0, 0x1, [@typed={0xf, 0x18, 0x0, 0x0, @str='}:.\x9c[\xc8\\#\'}\x00'}, @typed={0x14, 0x5, 0x0, 0x0, @ipv6=@private2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x48000}, 0x800) 1.086399829s ago: executing program 6 (id=4737): r0 = socket$inet(0x2, 0x3, 0x1) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001880)="5c00000012006b949e3de3d86e6c1dffff137e03000000000000fcce1ef0f8001d000a00a0e6b1e517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='pim6reg0\x00', 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 1.085749071s ago: executing program 5 (id=4738): syz_emit_ethernet(0x9a, &(0x7f0000002340)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "3000bb", 0x64, 0x2b, 0x0, @private2, @local, {[], {0x0, 0x0, 0x64, 0x0, @wg=@response={0x3a, 0x0, 0x0, "82f63de64f6ce2ee11028289aefdb3449391a823213e6336516748a7949bb108", "402fa83b1d661c18462075368a186092", {"9ddeb8f71aa23d391b8fa99e9816af2d", "040876a663a86d97f46b9665cc18492b"}}}}}}}}, 0x0) (async, rerun: 64) r0 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r1 = socket(0x10, 0x803, 0x2) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) (async, rerun: 32) getsockname$packet(r1, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async, rerun: 32) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r4, 0x89f4, &(0x7f0000000000)) (async) r5 = socket$netlink(0x10, 0x3, 0x0) (async) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) (async, rerun: 64) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) (async, rerun: 64) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) (async) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000080), 0x4) (async) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=@newlink={0x30, 0x10, 0x20, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@IFLA_CARRIER={0x5, 0x21, 0x2}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x30}}, 0x0) (async, rerun: 32) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3], 0x3c}}, 0x0) 1.084735803s ago: executing program 2 (id=4739): bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)=@newsa={0xf0, 0x18, 0x713, 0x0, 0x25dfdbfc, {{@in=@multicast2, @in=@dev={0xac, 0x14, 0x14, 0x3d}, 0x0, 0x0, 0x4c21, 0x2, 0x0, 0x0, 0x0, 0x5c, 0x0, 0xee00}, {@in6=@mcast2, 0xfe, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, {0x0, 0x0, 0x0, 0xa, 0x0, 0x80000, 0x0, 0x543}, {0x4, 0x7fffffffffffffff}, {}, 0x70bd28, 0x3500, 0xa, 0x4, 0x0, 0x22}}, 0xf0}, 0x1, 0x0, 0x0, 0x880}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r1, 0xffffffffffffffff, 0x26}, 0x14) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4) r4 = socket$caif_stream(0x25, 0x1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x201, 0x0, 0x0, {0x3, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88be}]}, 0x28}, 0x1, 0x0, 0x0, 0x54}, 0x4044) connect$caif(r4, &(0x7f0000001780)=@dbg={0x2}, 0x18) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x29, 0x0, 0x4, 0xb, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', 0x1f, 0x80, 0x8, 0x1000}}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000840)=0xffffffffffffffff, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r1}, 0x8) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000880)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x5a49, '\x00', r6, 0xffffffffffffffff, 0x0, 0x2}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000018c0)={{r7, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f00000006c0)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={r8, 0xffffffffffffffff}, 0x4) r10 = socket$rxrpc(0x21, 0x2, 0xa) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r11, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @private0}, 0xb5) sendto$rxrpc(r10, &(0x7f0000000700)="86a151d465e25e6dfd497fa119ad17b64dfe394aa814dbc346870f36457a9a5a1a35fc7d67798ba430ecc316a65c73561446c8a3d0beb257777ed2a916e24dce19d1fb7432ff72cf9654397142e014b493cbdae9b88a3b9e28a4dfd5c8c28cd48de02240d03977dd6ba4e6f2e1f795deb888fb65602adf32c751698913996db824b688f8de0f51313736f00bd2ab74be44a8c1958ba8388ce64161fc67a6f1375ade99c54264db7a75b1f70f", 0xac, 0x20000085, &(0x7f00000003c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x24) r12 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9c, 0x9c, 0x7, [@enum={0x8, 0x1, 0x0, 0x6, 0x4, [{0x7, 0x4}]}, @func={0xb, 0x0, 0x0, 0xc, 0x3}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x3, 0xef75}}, @type_tag={0x9, 0x0, 0x0, 0x12, 0x5}, @int={0xa, 0x0, 0x0, 0x1, 0x0, 0x30, 0x0, 0x6d, 0x1}, @ptr={0x8}, @struct={0x10, 0x4, 0x0, 0x4, 0x0, 0xfff, [{0xb, 0x4, 0xd33}, {0x10, 0x2, 0x3}, {0x3, 0x1, 0x7}, {0x4, 0x1, 0x101}]}]}, {0x0, [0x30, 0x2e, 0x5f, 0x30, 0x0]}}, &(0x7f00000002c0)=""/236, 0xbb, 0xec, 0x1, 0x9, 0x10000, @value=r2}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000000000000000000008000000b7080000000000007b8af8ff000000009f080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230800", @ANYRES32=r9, @ANYBLOB="0000000200f159e067a7000000b70500000800000085000000a5000000951977ceac88426e2e50c6c83c0719227fdd6c43f6650ea4e7daaac9e03f40689700591d509e56d1d66c32d987735ae72f8cfd66a45c4e33395217fe8875b2ab4d1a72346cf5f808ed6a5b83fba3a9b0736246ace2f90f772012ffe660a4e48cec10babfb90751ecd6740f3e05b6cccf2599156e7ab999727afac409c4eb490c7d278dc25ed5475365e88e249eb860fdcce55245e004f71e712cd2956f55250ab7fa1bb064fc05a956f80736b9a37abcc787c6ce30cc1a91d0228d2c5171"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x24, r12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) 991.368451ms ago: executing program 6 (id=4740): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x402, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close(r1) (async) close(r1) ioctl$TUNSETLINK(r0, 0x400454cd, 0x118) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b23000d"], 0xffdd) r2 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x79}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) getsockname$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_CT_MARK_MASK={0x8, 0x60, 0x80}, @TCA_FLOWER_KEY_CT_MARK={0x8, 0x5f, 0x31cf}]}}]}, 0x44}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 946.780577ms ago: executing program 2 (id=4741): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES32=r0], 0x7c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYRESDEC, @ANYRES16=r1], 0x38}, 0x1, 0x0, 0x0, 0x42812}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a4c000000060a0b04000000000000000002000000200004801c0001800b00010065787468647200000c00028008000640000000020900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a7becce1285d1d4b64c4186b4522a1a746fa136062c92ae17449401deeb7dd0659117097d19bfbfdcc9fc4b80e8788f585123ea8b1c992ddf942de13e1bd32b59f2f2aa8e5d9a98b982c98ada5086d4584473ede4ea73ed33f15aada011ad09655f2aa56fdf5b88744366a0"], 0x74}, 0x1, 0x0, 0x0, 0x800}, 0x0) 846.359201ms ago: executing program 5 (id=4742): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b405000000000000611068000000000020000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x0, 0xfffffffd}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r0 = socket$inet6_sctp(0xa, 0x4, 0x84) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f00000000c0)={0x0, 0x54, "571457f03b5f4bee0a3188a983c3d17911c46a16edfdae07dae9492760b7108af0b0d4dee0a5004bc3c45580390be48ef02928d47f00a469017f5084a6aecbbdbbaf3e3e6fc7beb1edefe2d52cddd50423fb265d"}, &(0x7f0000000140)=0x5c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={r1, 0x6}, 0x8) 844.977411ms ago: executing program 2 (id=4743): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_queued_recursive\x00', 0x7a44, 0x1700) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000003c0)={'tunl0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x7, 0x20, 0x7fffffff, 0x8, {{0xe, 0x4, 0x1, 0x8, 0x38, 0x67, 0x0, 0xf1, 0x2f, 0x0, @loopback, @broadcast, {[@generic={0x44, 0xb, "973a0afa64d5b0c97b"}, @lsrr={0x83, 0x17, 0x95, [@empty, @multicast2, @loopback, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x8, 0xe, &(0x7f0000000780)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', r1, @fallback=0x2e, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfffffffd}, 0x10, 0xffffffffffffffff, r0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), r2) setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f00000002c0)={{0x4, 0x100}, 0x3}, 0x10) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000200)=ANY=[@ANYBLOB="33fa815c81afb2ad7d05d33ced20c323b0b97546510487fa8a5cbc25aa0c316efcc2e785ed75f3643bab41b3ff8dcf118b95e2705bbbd579a07b42cafa77ac5ee21ae4c8e7f5e41775b267d42bdf4266ab79b61ee921a8605d0d17c5d57028", @ANYRES16=r3, @ANYBLOB="05002dbd7000ffdbdf250a0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000240)={@multicast2, @empty}, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001500010000000000000000000a000000080001"], 0x1c}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r4, 0x400, 0x70bd26, 0x25dfdbff}, 0x71}, 0x1, 0x0, 0x0, 0x10000}, 0x20000001) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r5) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0xb358521fbcb7291}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x40, r7, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xc69, 0x51}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x1250}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xa87}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xfe9}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xc7e}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x10000040) 704.171807ms ago: executing program 2 (id=4744): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="53c46fdfea3fd574b3936b610a025162c9997455191e7a1b4148b44154a38746e5eddf98ca825859c227e971d6a1b47c87090dac5b784a316ce78d9409ff7928384759411ab898e803a37a1734524b26bf1b42928f613130d8ef8bc3197484e00d458a1405dfb12e677a73e11760be07b1d77add8c9282980cfa2b5b773852be050ffffa9652b0ec55c4ff3f30d6315c72f12dba9c607cd1", @ANYRES16=r1, @ANYBLOB="200000200000020000000200000005003d000300000008000a0100000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000084}, 0x2000c000) (async) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r3}, @void}}}, 0x28}, 0x1, 0x6c00}, 0x0) 638.065362ms ago: executing program 6 (id=4745): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000980)=ANY=[@ANYBLOB="4402000000000305020000000000000000000800e5700591f179d117875b6e67d580037aaf59d40deef50b41eb0f495dc1bebd1797d6b0cdb8cfe3ae82071c5cb04a4f292b3107f9bba60bb56aaf5d467407b28282dd5ef09f8f5a7aaf382c97aea239adbc2f2553d0386526bcc760ddc66387621f7aca8a9625e82bf86091e89f34743f07859c6cad47d7cafed7173e37969ba0c0e4e906797d9a9e8bd3b7989190f2e0c028cd141ac65ad78291e4abb57d2cc06b4ebc03a3e3370716f448eae3b3e137", @ANYRES32=0x0, @ANYBLOB="15010000000000002400128009000100626f6e6400000000140002800500010004000000080007009d000000"], 0x44}}, 0x0) r1 = socket(0xa, 0x2400000001, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)={0x3c, r3, 0x607, 0x4, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x5}, 0x10) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000034000)={0x1, {{0xa, 0x4e22, 0x0, @mcast1, 0x1000003}}}, 0x88) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1e000000000000001c0000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000008100000000000000000400"/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000000040), 0x3, r4, 0x4}, 0x38) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000e8ffffff0900000d0000000002000000"], 0x1c}}, 0x8044) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000001240)={0x20, 0x140e, 0x1, 0x70bd2b, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x800) ioctl$SIOCSIFHWADDR(r6, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random='\x00\x00\x00\x00\x00 '}) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f00000002c0)={0x5, {{0xa, 0x0, 0x0, @mcast1, 0x1000000}}}, 0x88) getsockopt$inet6_buf(r1, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000002280)=0x90) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r6, 0x660c) sendmsg$tipc(r6, &(0x7f0000000840)={&(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x2, 0x3}}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000140)="a61651ab4aaed19ef40b97ccbdefae33a2be489c572a1cfcdea59c581a59936ab9ca9ef055", 0x25}, {&(0x7f0000000180)="3fb4b4197225c236c33f96cda19864335db89eea240423e0328b5e00473e", 0x1e}, {&(0x7f00000001c0)="8b6037d68789103f3fa34ca91283fec9da10abd08891c52fb94565825c2b30cc0424cc52e6cb28522244e2f18204008a1e0d1dcfda20de8fae29e7003874761221825545b8790494cd720c3ef64b570cbdc9466d53fafde60e9133f7d98295d7538f9ff2406737dd1ad2463fc908c34ed8bef7ce86db6c14f30d68948e6d3960a33370a9547b79373c8e3faddba424af6325b77d09b88a4b74b86666440606658e68678642b1676532f49013537097bcfbdce8a7064dc4efe31af99e0fc52765573d4644821591e3b93ebc0a30eebd4ef0ff76a3cd2b76ac6e635c525669431119ed2f0def36e152c73f0d2a2b97252da31a505076d34b420a554cce81366e", 0xff}, {&(0x7f0000000380)="ae64c9181e65449f89803044a038a522dc90e657f894a437d5b3de1084a9fa37da1fc8abdc26a4f3b3707e770c0808aca5771781235ba9d7165ef886bfff9ed9a4f03ed319b4082658210e51058667628769b24aa3725b5075aa8cb9c5b60bee015ed8ad45d84d8588c42e7ca033fafad02bf235c56d93f80e8bd3b789195f9d63be6856de9b5ed095", 0x89}, {&(0x7f0000000440)="bcb864cdce6dda3c699395592522391f8bb7ab08310b6ada23bd2e1337e7ab1f33cced830a0705c84edcc6446ecce690c3ab22ecec9c6b552e118a6e6be9585cfea1013fad8346ec6483638b7e0d152c5421ac82a5c81fcee00c1cf7c1550305f790da701ba745e21300da8dd9bd1efc8532d59c0a2891509c2ec135f0ed6af2937428da93be1aefbf34b7f0e93851ce39accf72e0cc3e1afab6dc418e00cfdaee2a45525234b23365a7c5944915239db7c1bc211ecb3a4d4462f27778aec32be3789d89fea9131e06a513096e96a6055191e69e380ef3c289", 0xd9}, {&(0x7f0000000540)="f9882e8a82a0c6b7be89f09dddfe1db308e5f05e49a558c74db6f61a87e8b276ea9190d442a8277c6d3ede47e68dc545d1ce6e25ebdd3ab91386e6dfd13605a1981c6e902c4880f275840667c0314f610b106a40f7865c8c754a6e3ca668ae0d8337d5b7df9b6919ba72f0e6cf664e18ae18c4fc80ae0526f62b8cfe77b0f71bf2e4511b32b9af15e92c0bd035453e1188d4a9739cb48bb758c2ad93a602e4f48678cce424ea8a12", 0xa8}, {&(0x7f0000000700)="a7e17fe800f2fb1d58b0e2ff030000114ac5bda1eebb75fb4d7e184fb92b67ff1cce60a3a3aa867fa7b11ae11697590cc890107aaf1b8b8392809a78fd284e31d2014bedc7c232844b449d899edb473df6b3c22f1f66ec562e1aec5cd798b2347cd7a1d78735ccc382f2d123865dfc665151fe3f65371a7630bfc9d5e2184fd3e081cc6cab12f7fbefb41d67e01f74ab5240c223c5d18a512c877b4b24d63347", 0xa0}], 0x7, &(0x7f00000007c0)="4e314b400eb6d826398d0b74f1812db7677f34aa3960bd9857ef5fd13f39ccd723c9cf812e36e3135df180b5e57cd393d067f5910c0a1d3e2b03ddd2ddc2e12054062e8d645876f833f3dd40893795be5d", 0x51, 0x4041}, 0xb7dcc5ee9954a791) bind$bt_sco(r1, &(0x7f0000000000), 0x8) 594.154512ms ago: executing program 5 (id=4746): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x100, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b7030000fdffffff850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x1000000, 0xdc0, 0x0, &(0x7f0000000400)="e0b9547ed387c6e950a4e1f95bec", 0x0, 0xf, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x18) r2 = socket$unix(0x1, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) r4 = socket$unix(0x1, 0x5, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r4, 0x1, 0x53, 0x0, &(0x7f0000001340)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x10, 0x3, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0xa, &(0x7f0000000140)=0x9d, 0x4) recvmmsg(r8, &(0x7f0000001300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x41, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}, @TCA_RATE={0x6, 0x5, {0x1, 0x82}}]}, 0x90}}, 0x20000000) 533.173403ms ago: executing program 2 (id=4747): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$TUNGETIFF(r3, 0x800454d2, &(0x7f0000000500)={'bridge0\x00'}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 526.78296ms ago: executing program 6 (id=4748): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'veth1_to_bridge\x00', 0x20}) (async, rerun: 64) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00'}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x148, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffe, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x16}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "09000000000000208f29d158039b90627d7b60f0d5ca47f33eed46409b7c8722ce020df6b24c2e6ac7b97dc04d01be2092874115214b1ebb764511f69cd1e9f6263346363d2c639c76000067af25166c2f0f85f36aa8867406119c010400002e31dea98204000000d560eae59ea49ef95d73202a6e3b5e1eb38244e694e7410d33bc92794ad27031f2a19698b5142ddf36e2a876a4fc871207bf12a84f1d4d132f5bb7edcf2d08d677e6a7268e106b6ced3c7f53df24092ddb9e0fac6a1153c3fc88bfd1404fef22cf3e825a6e19c6a48a5444eabb459ac3ec9a278df4011773d2f2e6529ed0ad424b47ec67522477f979360b76d1008000"}, @TCA_RED_PARMS={0x14, 0x1, {0x3f26, 0x7, 0x81, 0x4c, 0xb, 0x14, 0x5}}]}}]}, 0x148}}, 0x24004004) 357.515255ms ago: executing program 3 (id=4749): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)={0x14, 0x8, 0x6, 0x801}, 0x14}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd7000fddbdf25140000001880e67f14000200763b7468310740c8b805000081000000"], 0x2c}, 0x1, 0x0, 0x0, 0xc1}, 0x40) 317.321509ms ago: executing program 6 (id=4750): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xff}}, [@tmpl={0x184, 0x5, [{{@in6=@mcast1, 0x4d2, 0x33}, 0xa, @in6=@empty, 0x3501, 0x1, 0x0, 0x3b, 0x83, 0x5, 0x7}, {{@in6=@local, 0x4d6, 0x3c}, 0xa, @in6=@private1, 0x3502, 0x2, 0x0, 0x7, 0x7f, 0x0, 0x4}, {{@in=@multicast1, 0x4d5, 0x6c}, 0x2, @in6=@empty, 0x3507, 0x4, 0x3, 0x3, 0x4, 0x2, 0x3}, {{@in6=@private0, 0x4d3, 0x3c}, 0x2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0x0, 0x2, 0xfffffffa, 0x401, 0x81}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4d3, 0x6c}, 0x2, @in=@private=0xa010100, 0x3502, 0x5, 0x0, 0xd1, 0xe, 0x47b, 0x3}, {{@in=@broadcast, 0x4d5, 0x33}, 0x2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x34ff, 0x3, 0x0, 0x6, 0x5, 0x4, 0x7f}]}]}, 0x23c}}, 0x4000) sendmmsg$alg(r1, &(0x7f0000004340)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001540)="9555d9cc111d987d25750612e1b624c3abbff3793c9103a60a5d88e9422491145a1002c5297a2fea7de02f1c19acb3b3", 0x30}], 0x1, &(0x7f0000001780)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x81}], 0x1, 0x2000891) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000280)=""/81, 0x51}], 0x1}, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f00000000c0)=@ethtool_regs={0x4, 0x0, 0x4, "f42a97b9"}}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r4, 0x401054d5, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r3, 0x4058587a, &(0x7f0000000240)={{r3, &(0x7f0000000340)='bridge0\x00', 0xd2243a38195b3a6a, &(0x7f0000000040)={@_ha_fsid={[0x3, 0x3]}, {0x0, 0x2, 0x80000001, 0x5}}, 0x8, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000000)=0xfffffffe}, {[0x9, 0x7c, 0xbf2e, 0x3ff]}, 0x3c, 0xb2, &(0x7f0000000180)=""/178}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r5) sendmsg$NLBL_CALIPSO_C_ADD(r5, &(0x7f0000000b80)={0x0, 0x11, &(0x7f0000000b40)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002cbd7000fddbdf250100000008000100030800000800020002000000af8ce3db0fdf1f5b384de4319146aed96fec3f5a538d83a700e3cd51ecc0a1117410251bab043c76"], 0x24}, 0x1, 0x0, 0x0, 0x24004810}, 0x20020000) socket$inet6(0xa, 0x800, 0x1) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r7, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r7, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000200)="875692", 0x3}], 0x1}}], 0x1, 0x4000000) syz_emit_ethernet(0x4e, 0x0, 0x0) sendto(r7, &(0x7f0000000040)="dfcde1", 0x3, 0x4000004, 0x0, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) 308.267509ms ago: executing program 0 (id=4751): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) (async) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x20086}], 0x1}}], 0x1, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) (async) sendmmsg$inet6(r0, &(0x7f00000071c0)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000080)='H'}], 0x1}}], 0x1, 0x0) 250.711253ms ago: executing program 2 (id=4752): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0xed27c9fa5277b9b7}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ALPHA={0x8, 0x5, 0xd}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0xfffffff8}]}}]}, 0x44}}, 0x20008000) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000080)) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000100)=0xffff0080) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000000)=0x8) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x310, 0x168, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3c0, 0xffffffff, 0xffffffff, 0x3c0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x148, 0x168, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x810001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@NOTRACK={0x20}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x370) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r8, 0x0, 0x30, 0x0, @void}, 0x40) socket$netlink(0x10, 0x3, 0x12) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)={0x14, 0x17, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xfffffffffffffe62}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040005}, 0x0) 205.767687ms ago: executing program 3 (id=4753): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newlink={0x38, 0x10, 0x401, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x38}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r0], 0x5c}, 0x1, 0x0, 0x0, 0x24000000}, 0x840) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x0, 0x3, 0x3, 0x4000, r2, 0x1ff, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x0, 0x8}, 0x50) 132.999459ms ago: executing program 5 (id=4754): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30a) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newtaction={0x70, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_ctinfo={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_MASK={0x20}, @TCA_CTINFO_ACT={0x18}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) bind$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x2, 0x0, 0x1, 0xe, 0x6, @local}, 0x14) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000240)=ANY=[], 0xfdef) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0xa, 0x0, 0xfffffffffffffff8}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52}, 0x37) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x39}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 78.264709ms ago: executing program 0 (id=4755): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x8, [@fwd={0x2}, @ptr={0x0, 0x0, 0x0, 0x2, 0x3}, @func={0x6}]}, {0x0, [0x0, 0x61, 0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x44}, 0x20) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f000000e740)=ANY=[], 0x6ae8}, 0x1, 0x0, 0x0, 0x1}, 0x10) recvmsg$can_bcm(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000500)=""/4096, 0x1000}], 0x1}, 0x20) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x8930, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) 0s ago: executing program 3 (id=4756): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40) (async) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x2, 0x0, 0x0) (async) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x400008a, 0x0) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newsa={0x154, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1, @in=@rand_addr=0x64010102, 0x0, 0xecdf, 0x0, 0x0, 0x0, 0x100}, {@in=@remote, 0x0, 0x32}, @in6=@private1, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x70bd2a}}]}, 0x154}}, 0x0) kernel console output (not intermixed with test programs): 1 [ 400.497580][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.539773][T18653] netlink: 'syz.3.3295': attribute type 1 has an invalid length. [ 400.556292][T18653] __nla_validate_parse: 5 callbacks suppressed [ 400.556314][T18653] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3295'. [ 400.594635][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.605080][ T1140] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.663859][ T1140] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.797675][T18670] netlink: 'syz.4.3298': attribute type 1 has an invalid length. [ 400.827384][T18670] netlink: 228 bytes leftover after parsing attributes in process `syz.4.3298'. [ 400.850288][ T1140] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 400.885417][ T1140] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 400.939159][T18674] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 400.948718][T18676] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3300'. [ 401.057710][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.096999][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.288927][T18695] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3305'. [ 401.511758][T18705] team0: Cannot enslave team device to itself [ 401.769494][ T5837] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 401.784107][ T5837] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 401.796073][ T5837] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 401.815206][ T5837] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 401.824231][ T5837] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 402.035805][T18717] lo speed is unknown, defaulting to 1000 [ 402.479089][T18752] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3318'. [ 402.505185][T18752] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3318'. [ 402.538368][T18753] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3318'. [ 402.562987][T18753] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3318'. [ 402.804825][T18717] chnl_net:caif_netlink_parms(): no params data found [ 402.961693][T18767] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3322'. [ 403.008768][T18767] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3322'. [ 403.430046][T18771] syzkaller1: entered allmulticast mode [ 403.454521][T18717] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.461698][T18717] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.499588][T18717] bridge_slave_0: entered allmulticast mode [ 403.538527][T18717] bridge_slave_0: entered promiscuous mode [ 403.601222][T18717] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.615100][T18717] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.646321][T18717] bridge_slave_1: entered allmulticast mode [ 403.664720][T18717] bridge_slave_1: entered promiscuous mode [ 403.839969][T18717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 403.846347][T18807] netlink: 'syz.1.3328': attribute type 1 has an invalid length. [ 403.865992][T18717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 403.873470][ T5846] Bluetooth: hci1: command tx timeout [ 403.964032][T18717] team0: Port device team_slave_0 added [ 404.011000][T18717] team0: Port device team_slave_1 added [ 404.080430][T18821] ip6t_srh: unknown srh invflags 4000 [ 404.168405][T18717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 404.191522][T18717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 404.218638][T18717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 404.266229][T18717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 404.273308][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6120 ms [ 404.273341][ C1] lec:lec_tx_timeout: lec0 [ 404.282879][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 404.331467][T18717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 404.360061][T18717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 404.563175][T18717] hsr_slave_0: entered promiscuous mode [ 404.587454][T18717] hsr_slave_1: entered promiscuous mode [ 404.605375][T18717] debugfs: 'hsr0' already exists in 'hsr' [ 404.619105][T18717] Cannot create hsr debugfs directory [ 404.715169][T18861] mac80211_hwsim hwsim30 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 404.956774][T18868] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 404.978050][T18865] syzkaller1: entered promiscuous mode [ 405.029790][T18865] syzkaller1: entered allmulticast mode [ 405.258714][T18879] netlink: 'syz.0.3342': attribute type 1 has an invalid length. [ 405.400136][T18717] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 405.445227][T18717] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.464863][T18717] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 405.511621][T18879] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 405.668853][T18717] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 405.752234][T18717] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.794599][T18909] xt_ipcomp: unknown flags 1D [ 405.799844][T18717] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 405.935294][T18717] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 405.952192][T18717] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.963091][ T5846] Bluetooth: hci1: command tx timeout [ 405.970767][T18717] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 406.123833][T18915] bond2: Unable to set peer notification delay as MII monitoring is disabled [ 406.135650][T18924] __nla_validate_parse: 6 callbacks suppressed [ 406.135670][T18924] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.3350'. [ 406.153588][T18915] bond2 (unregistering): Released all slaves [ 406.308843][T18717] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 406.319740][T18717] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.336899][T18717] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 406.602456][T18937] netlink: 'syz.0.3354': attribute type 1 has an invalid length. [ 406.642753][T18937] netlink: 'syz.0.3354': attribute type 2 has an invalid length. [ 406.692732][T18937] netlink: 584 bytes leftover after parsing attributes in process `syz.0.3354'. [ 406.722856][T18937] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3354'. [ 406.867290][T18951] syzkaller0: entered promiscuous mode [ 406.876152][T18951] syzkaller0: entered allmulticast mode [ 406.903133][T18717] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 406.994165][ T12] wlan1: Trigger new scan to find an IBSS to join [ 407.007921][T18717] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 407.212276][T18946] 8021q: adding VLAN 0 to HW filter on device bond1 [ 407.243661][T18717] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 407.405091][T18717] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 407.413292][T18972] netlink: 'syz.2.3359': attribute type 1 has an invalid length. [ 407.573458][T18972] 8021q: adding VLAN 0 to HW filter on device bond3 [ 407.657858][T18986] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3360'. [ 407.683227][T18986] openvswitch: netlink: Flow key attr not present in new flow. [ 407.944762][T18717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 407.996270][T18995] batadv_slave_1: default FDB implementation only supports local addresses [ 408.039187][ T5846] Bluetooth: hci1: command tx timeout [ 408.047996][T19000] Bluetooth: MGMT ver 1.23 [ 408.077207][T18717] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.094708][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.101918][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 408.144872][T19000] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3363'. [ 408.174920][T19000] netlink: zone id is out of range [ 408.180159][T19000] netlink: zone id is out of range [ 408.190122][ T1157] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.197307][ T1157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 408.211382][T19000] netlink: zone id is out of range [ 408.228206][T19000] netlink: zone id is out of range [ 408.234847][T19000] netlink: zone id is out of range [ 408.240074][T19000] netlink: zone id is out of range [ 408.282244][T19000] netlink: zone id is out of range [ 408.319656][T19000] netlink: zone id is out of range [ 408.323244][T19017] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3366'. [ 408.341136][T19000] netlink: zone id is out of range [ 408.368324][T19017] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3366'. [ 408.974031][T19040] sctp: [Deprecated]: syz.4.3372 (pid 19040) Use of struct sctp_assoc_value in delayed_ack socket option. [ 408.974031][T19040] Use struct sctp_sack_info instead [ 409.011027][T18717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 409.046463][T19036] syzkaller0: entered promiscuous mode [ 409.059189][T19036] syzkaller0: entered allmulticast mode [ 409.218963][T18717] veth0_vlan: entered promiscuous mode [ 409.408604][T18717] veth1_vlan: entered promiscuous mode [ 409.545623][T18717] veth0_macvtap: entered promiscuous mode [ 409.594505][T18717] veth1_macvtap: entered promiscuous mode [ 409.710685][T18717] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.785200][T19074] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 409.867257][T18717] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 409.930146][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.962493][ T1150] wlan1: Trigger new scan to find an IBSS to join [ 409.995254][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.010176][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.042037][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5760 ms [ 410.050114][ C1] lec:lec_tx_timeout: lec0 [ 410.055616][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 410.065821][T19081] netlink: 'syz.2.3381': attribute type 1 has an invalid length. [ 410.092162][T19081] netlink: 'syz.2.3381': attribute type 1 has an invalid length. [ 410.100194][ T1150] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.112863][ T5846] Bluetooth: hci1: command tx timeout [ 410.127167][T19083] netlink: 'syz.4.3382': attribute type 11 has an invalid length. [ 410.171222][T19083] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3382'. [ 410.321165][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.347588][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.411791][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.414130][T19093] netlink: 'syz.4.3384': attribute type 1 has an invalid length. [ 410.434879][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.447521][T19093] netlink: 'syz.4.3384': attribute type 3 has an invalid length. [ 410.459859][T19093] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3384'. [ 410.748452][T19100] syzkaller0: entered promiscuous mode [ 410.776042][T19100] syzkaller0: entered allmulticast mode [ 411.749801][T19129] pim6reg: entered allmulticast mode [ 411.755986][T19134] pim6reg: left allmulticast mode [ 411.841642][T19140] netlink: 'syz.1.3391': attribute type 1 has an invalid length. [ 411.857930][T19150] Cannot find add_set index 3 as target [ 412.235189][T19166] IPVS: length: 239 != 24 [ 412.248801][T19168] sctp: [Deprecated]: syz.1.3399 (pid 19168) Use of int in max_burst socket option. [ 412.248801][T19168] Use struct sctp_assoc_value instead [ 412.271278][T19169] IPVS: length: 239 != 24 [ 412.347417][T19174] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3401'. [ 412.806611][T19197] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3406'. [ 412.818147][T19197] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.826035][T19197] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.916983][ T36] wlan1: Creating new IBSS network, BSSID 5a:77:ef:a6:20:d5 [ 412.973127][T19206] C: renamed from lo (while UP) [ 412.997941][T19206] net_ratelimit: 187 callbacks suppressed [ 412.997963][T19206] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 413.028297][T19213] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 413.069199][T19185] netlink: 'syz.2.3403': attribute type 29 has an invalid length. [ 413.179726][T19221] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3408'. [ 413.433590][T19230] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3410'. [ 413.448105][T19231] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3410'. [ 413.801483][T19251] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3412'. [ 415.062047][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 415.070173][ C1] lec:lec_tx_timeout: lec0 [ 415.081139][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 415.322864][T19176] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 415.532511][T19305] netlink: 'syz.3.3413': attribute type 63 has an invalid length. [ 415.561343][T19305] netlink: 'syz.3.3413': attribute type 63 has an invalid length. [ 415.793291][T19324] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3419'. [ 416.048146][T19338] Cannot find set identified by id 0 to match [ 416.060542][T19338] openvswitch: netlink: Flow actions attr not present in new flow. [ 416.110664][T19338] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3423'. [ 416.117213][T19331] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.209934][T19338] bond0: entered promiscuous mode [ 416.219721][T19338] bond_slave_0: entered promiscuous mode [ 416.227313][T19338] bond_slave_1: entered promiscuous mode [ 416.240118][T19338] gretap0: entered promiscuous mode [ 416.248009][T19338] hsr1: entered promiscuous mode [ 416.259006][T19339] netlink: 'syz.0.3421': attribute type 5 has an invalid length. [ 416.416972][T19331] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.487010][T19353] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3425'. [ 416.625387][T19331] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.820772][T19331] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.106769][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.206803][T19386] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3433'. [ 417.224242][ T1140] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.251170][ T1140] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.318680][ T36] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.487275][T19400] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 417.487984][T19398] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3436'. [ 417.522923][T19398] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3436'. [ 417.801658][ T5846] Bluetooth: hci1: command tx timeout [ 417.805368][T19417] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3442'. [ 417.972621][T19417] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3442'. [ 418.029492][T19428] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 418.123566][T19438] xt_CT: You must specify a L4 protocol and not use inversions on it [ 418.234303][T19442] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 418.241416][T19443] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 418.619362][T19465] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3456'. [ 418.623411][T19466] netlink: 'syz.0.3458': attribute type 1 has an invalid length. [ 418.737126][T19466] bond2: entered promiscuous mode [ 418.742730][T19466] bond2: entered allmulticast mode [ 418.748323][T19466] 8021q: adding VLAN 0 to HW filter on device bond2 [ 418.985153][T19488] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3464'. [ 419.112873][T19497] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3467'. [ 419.183294][T19502] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 419.208079][T19502] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 419.266179][T19502] gretap1: entered promiscuous mode [ 419.271459][T19502] gretap1: entered allmulticast mode [ 419.296137][T19505] netlink: 'syz.1.3468': attribute type 2 has an invalid length. [ 419.608308][T19519] netlink: 'syz.3.3472': attribute type 1 has an invalid length. [ 419.620964][T19519] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 419.681625][T19527] netdevsim netdevsim4: Direct firmware load for .. @ failed with error -2 [ 419.731050][T19527] netdevsim netdevsim4: Falling back to sysfs fallback for: .. @ [ 419.810374][T19534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3476'. [ 419.896165][T19534] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 420.092084][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 420.100154][ C1] lec:lec_tx_timeout: lec0 [ 420.104823][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 420.147482][T19544] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3479'. [ 420.174385][T19545] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3478'. [ 421.576846][T19597] lo speed is unknown, defaulting to 1000 [ 421.604588][ T5891] IPVS: starting estimator thread 0... [ 421.700267][T19603] syzkaller0: entered promiscuous mode [ 421.702110][T19601] IPVS: using max 30 ests per chain, 72000 per kthread [ 421.707320][T19603] syzkaller0: entered allmulticast mode [ 421.725829][T19608] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 421.735126][ T5891] IPVS: starting estimator thread 0... [ 421.833379][T19609] IPVS: using max 49 ests per chain, 117600 per kthread [ 422.287466][T19633] macvtap1: entered promiscuous mode [ 422.307459][T19633] macvtap1: entered allmulticast mode [ 422.332061][T19633] veth1_vlan: entered allmulticast mode [ 422.363670][T19639] vcan0: tx address claim with dest, not broadcast [ 422.365316][T19637] hsr0: entered promiscuous mode [ 422.418921][T19637] macvlan2: entered allmulticast mode [ 422.439060][T19637] hsr0: entered allmulticast mode [ 422.452057][T19637] hsr_slave_0: entered allmulticast mode [ 422.479594][T19637] hsr_slave_1: entered allmulticast mode [ 422.520702][T19638] macvtap2: entered promiscuous mode [ 422.539588][T19638] macvtap2: entered allmulticast mode [ 422.626424][T19656] netlink: 'syz.2.3512': attribute type 1 has an invalid length. [ 422.637244][T19656] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.859563][T19661] xt_l2tp: v2 doesn't support IP mode [ 422.981777][T19670] syzkaller0: entered promiscuous mode [ 423.016226][T19661] __nla_validate_parse: 7 callbacks suppressed [ 423.016247][T19661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3513'. [ 423.022033][T19670] syzkaller0: entered allmulticast mode [ 423.023779][T19661] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3513'. [ 423.130443][T19682] syzkaller0: entered promiscuous mode [ 423.141241][T19682] syzkaller0: entered allmulticast mode [ 425.112061][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 425.120151][ C1] lec:lec_tx_timeout: lec0 [ 425.124793][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 425.472569][T19735] Unsupported ieee802154 address type: 0 [ 425.631150][T19725] lo speed is unknown, defaulting to 1000 [ 426.104578][T19766] nbd: couldn't find a device at index 0 [ 426.117571][T19766] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3547'. [ 426.131584][T19766] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3547'. [ 426.158382][T19768] : entered promiscuous mode [ 426.292308][T19772] netlink: 'syz.4.3549': attribute type 9 has an invalid length. [ 426.300172][T19772] netlink: 'syz.4.3549': attribute type 11 has an invalid length. [ 426.308820][T19772] netlink: 'syz.4.3549': attribute type 12 has an invalid length. [ 426.317159][T19772] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.3549'. [ 426.327112][T19772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3549'. [ 426.338205][T19772] netlink: 'syz.4.3549': attribute type 1 has an invalid length. [ 426.362668][T19772] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3549'. [ 426.381916][T19772] netlink: 1 bytes leftover after parsing attributes in process `syz.4.3549'. [ 426.420061][T19777] netlink: 'syz.1.3551': attribute type 1 has an invalid length. [ 426.439044][T19772] netlink: 'syz.4.3549': attribute type 2 has an invalid length. [ 426.564070][T19784] netlink: 'syz.2.3552': attribute type 1 has an invalid length. [ 426.581659][T19784] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3552'. [ 426.630850][T19782] 8021q: adding VLAN 0 to HW filter on device bond2 [ 426.673546][T19782] bond1: (slave bond2): making interface the new active one [ 426.684660][T19782] bond1: (slave bond2): Enslaving as an active interface with an up link [ 426.740722][T19793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3552'. [ 426.778307][T19777] bond1: (slave gretap2): Enslaving as a backup interface with an up link [ 426.800098][T19795] 8021q: adding VLAN 0 to HW filter on device bond1 [ 426.950571][T19807] x_tables: duplicate underflow at hook 2 [ 427.046196][T19811] batadv1: entered allmulticast mode [ 427.077448][T19816] netlink: 'syz.3.3562': attribute type 24 has an invalid length. [ 427.263481][T19813] lo speed is unknown, defaulting to 1000 [ 427.282049][T19827] IPVS: set_ctl: invalid protocol: 47 255.255.255.255:20002 [ 427.289749][T19827] IPVS: set_ctl: invalid protocol: 46 172.20.20.170:20001 [ 427.444004][T19837] netlink: 'syz.2.3569': attribute type 11 has an invalid length. [ 427.475956][T19837] netlink: 'syz.2.3569': attribute type 11 has an invalid length. [ 427.568887][T19844] netlink: 'syz.0.3571': attribute type 11 has an invalid length. [ 427.631396][T19844] netlink: 'syz.0.3571': attribute type 4 has an invalid length. [ 427.886521][T19857] openvswitch: netlink: IP tunnel dst address not specified [ 427.888616][T19852] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 428.633360][T19906] delete_channel: no stack [ 428.837814][T19920] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 429.101875][T19937] netlink: 'syz.4.3593': attribute type 12 has an invalid length. [ 429.177523][T19943] __nla_validate_parse: 6 callbacks suppressed [ 429.177554][T19943] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3593'. [ 429.309552][T19941] IPVS: sh: FWM 3 0x00000003 - no destination available [ 429.319920][T19952] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3593'. [ 429.329269][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 429.344735][T19941] openvswitch: netlink: Missing key (keys=40, expected=80) [ 429.358922][T19937] bond2: option primary_reselect: invalid value (255) [ 429.386195][T19937] bond2 (unregistering): Released all slaves [ 429.549704][T19949] lo speed is unknown, defaulting to 1000 [ 429.671241][T19959] netlink: 'syz.2.3598': attribute type 29 has an invalid length. [ 429.689791][T19959] netlink: 'syz.2.3598': attribute type 29 has an invalid length. [ 429.710161][T19966] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3599'. [ 429.743533][T19959] netlink: 596 bytes leftover after parsing attributes in process `syz.2.3598'. [ 429.775492][T19965] netlink: 'syz.2.3598': attribute type 29 has an invalid length. [ 429.894247][T19975] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3601'. [ 430.129462][T19986] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 430.142029][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 430.150140][ C1] lec:lec_tx_timeout: lec0 [ 430.154979][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 430.437997][T19999] bond3 (unregistering): Released all slaves [ 430.748810][T20030] netlink: 'syz.1.3612': attribute type 5 has an invalid length. [ 430.758383][T20030] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3612'. [ 430.767882][T20030] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3612'. [ 430.809846][T20032] netlink: 'syz.3.3614': attribute type 1 has an invalid length. [ 430.907119][T20036] lo speed is unknown, defaulting to 1000 [ 431.247433][T20050] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3618'. [ 433.252982][T19997] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 433.537231][T20068] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.3620'. [ 433.590774][T20071] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 433.615654][T20067] syzkaller0: entered promiscuous mode [ 433.633152][T20067] syzkaller0: entered allmulticast mode [ 433.649764][T20083] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20002 [ 433.663328][T20076] bridge_slave_0: left allmulticast mode [ 433.669034][T20076] bridge_slave_0: left promiscuous mode [ 433.712626][T20076] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.738940][T20076] bridge_slave_1: left allmulticast mode [ 433.761296][T20076] bridge_slave_1: left promiscuous mode [ 433.770285][T20076] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.793507][T20076] bond0: (slave bond_slave_0): Releasing backup interface [ 433.841272][T20076] bond0: (slave bond_slave_1): Releasing backup interface [ 433.862940][T20076] team0: Port device team_slave_0 removed [ 433.878702][T20076] team0: Port device team_slave_1 removed [ 433.888596][T20076] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 433.897229][T20076] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 433.907398][T20076] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 433.916688][T20076] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 433.936082][T20076] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 434.146229][T20092] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3626'. [ 434.186908][T20088] syzkaller0: entered promiscuous mode [ 434.200006][T20108] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3631'. [ 434.209495][T20088] syzkaller0: entered allmulticast mode [ 434.211394][T20108] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3631'. [ 434.226286][T20108] chnl_net:caif_netlink_parms(): no params data found [ 434.586001][T20129] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3637'. [ 434.615366][T20129] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3637'. [ 436.238562][T20103] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 436.254301][T20112] syzkaller0: entered promiscuous mode [ 436.259774][T20112] syzkaller0: entered allmulticast mode [ 436.272048][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6120 ms [ 436.280175][ C1] lec:lec_tx_timeout: lec0 [ 436.287204][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 436.482545][T20153] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3641'. [ 436.641266][T20163] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3645'. [ 436.665793][T20163] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3645'. [ 436.765219][T20171] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3648'. [ 437.395820][T20207] xt_hashlimit: size too large, truncated to 1048576 [ 437.823916][T20224] lo speed is unknown, defaulting to 1000 [ 437.855829][T20231] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3670'. [ 438.419950][T20255] xt_hashlimit: size too large, truncated to 1048576 [ 438.938813][T20281] syzkaller0: entered promiscuous mode [ 438.946493][T20281] syzkaller0: entered allmulticast mode [ 439.169703][T20298] netlink: 'syz.0.3692': attribute type 4 has an invalid length. [ 439.231463][ T5889] lo speed is unknown, defaulting to 1000 [ 439.235296][T20298] netlink: 'syz.0.3692': attribute type 4 has an invalid length. [ 439.237754][ T5889] syz0: Port: 1 Link DOWN [ 439.252573][ T5891] lo speed is unknown, defaulting to 1000 [ 439.258625][ T5891] syz0: Port: 1 Link ACTIVE [ 439.265913][ T5891] lo speed is unknown, defaulting to 1000 [ 439.273370][ T5891] syz0: Port: 1 Link DOWN [ 441.015462][ T49] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 441.802326][T20274] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 442.031982][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 442.040108][ C1] lec:lec_tx_timeout: lec0 [ 442.045095][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 442.706994][T20350] Unknown metaid 0 dlen 28 [ 442.839308][T20355] Set syz1 is full, maxelem 1023 reached [ 443.103574][T20367] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3716'. [ 443.477167][T20375] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.571911][T20393] IPv6: addrconf: prefix option has invalid lifetime [ 443.578999][T20393] IPv6: addrconf: prefix option has invalid lifetime [ 443.683868][T20396] Set syz1 is full, maxelem 2 reached [ 443.832918][T20412] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 443.850987][T20412] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 443.944402][T20417] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3730'. [ 444.333368][T20432] syzkaller0: entered promiscuous mode [ 444.467571][T20441] netlink: 'syz.3.3739': attribute type 1 has an invalid length. [ 444.485270][T20405] mpoa:mpoad_close: () going down [ 444.535953][T20441] bond2: entered promiscuous mode [ 444.572762][T20441] 8021q: adding VLAN 0 to HW filter on device bond2 [ 444.605943][T20441] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3739'. [ 444.615433][T20441] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3739'. [ 444.650065][T20441] bond2: (slave bridge3): making interface the new active one [ 444.657852][T20441] bridge3: entered promiscuous mode [ 444.664996][T20441] bond2: (slave bridge3): Enslaving as an active interface with an up link [ 444.723657][T20448] xt_hashlimit: size too large, truncated to 1048576 [ 444.831498][T20457] netlink: 'syz.2.3744': attribute type 11 has an invalid length. [ 444.855654][T20457] netlink: 199828 bytes leftover after parsing attributes in process `syz.2.3744'. [ 444.869762][T20459] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3742'. [ 445.261670][T20470] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3747'. [ 445.616223][T20484] tipc: Can't bind to reserved service type 1 [ 445.750723][T20493] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3754'. [ 445.762349][T20493] netlink: 43 bytes leftover after parsing attributes in process `syz.4.3754'. [ 445.780493][T20493] netlink: 'syz.4.3754': attribute type 6 has an invalid length. [ 445.793474][T20495] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3755'. [ 445.803236][T20493] netlink: 'syz.4.3754': attribute type 5 has an invalid length. [ 446.641923][T20541] policy can only be matched on NF_INET_PRE_ROUTING [ 446.642486][T20541] unable to load match [ 447.052005][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 447.060226][ C1] lec:lec_tx_timeout: lec0 [ 447.065250][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 447.199830][T20569] netlink: 'syz.0.3783': attribute type 1 has an invalid length. [ 447.290382][ T5846] Bluetooth: hci4: link tx timeout [ 447.298856][ T5846] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 447.335501][T20574] syzkaller0: entered promiscuous mode [ 447.341157][T20574] syzkaller0: entered allmulticast mode [ 447.371698][T20574] syzkaller0: left promiscuous mode [ 447.377134][T20574] syzkaller0: left allmulticast mode [ 447.530423][T20580] vlan2: entered allmulticast mode [ 447.540742][T20580] bond0: entered allmulticast mode [ 447.546165][T20580] bond_slave_0: entered allmulticast mode [ 447.552511][T20580] bond_slave_1: entered allmulticast mode [ 447.554310][T20582] netlink: 'syz.2.3787': attribute type 2 has an invalid length. [ 447.606352][T20580] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.616297][T20580] bond_slave_0: left allmulticast mode [ 447.649860][T20580] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.663169][T20580] bond_slave_1: left allmulticast mode [ 447.670785][T20580] bond0 (unregistering): Released all slaves [ 447.688686][T20586] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 447.849600][T20594] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.882702][T20606] xt_CT: You must specify a L4 protocol and not use inversions on it [ 447.987683][T20594] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.099820][T20594] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.106563][T20616] netlink: 'syz.0.3796': attribute type 1 has an invalid length. [ 448.149249][T20616] bond0: entered promiscuous mode [ 448.155178][T20616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 448.195234][T20594] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.325819][ T7651] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.400022][ T7651] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.408685][ T7651] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.457132][ T7653] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.677997][T20649] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 448.852210][T20658] __nla_validate_parse: 10 callbacks suppressed [ 448.852232][T20658] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3810'. [ 448.895001][T20660] veth0_to_team: entered allmulticast mode [ 449.151902][T20675] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3812'. [ 449.312372][ T5837] Bluetooth: hci4: command 0x0406 tx timeout [ 450.427711][T20703] vlan3: entered allmulticast mode [ 450.437189][T20703] veth0_to_bond: entered allmulticast mode [ 450.480745][T20705] netlink: 'syz.3.3825': attribute type 1 has an invalid length. [ 450.826923][T20724] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3831'. [ 451.038774][T20733] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3835'. [ 451.572891][T20754] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3841'. [ 451.730831][T20757] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3842'. [ 451.786866][T20760] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3844'. [ 451.879316][T20764] netlink: 'syz.3.3845': attribute type 1 has an invalid length. [ 452.071975][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 452.080084][ C1] lec:lec_tx_timeout: lec0 [ 452.084890][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 452.107545][T20774] xt_hashlimit: size too large, truncated to 1048576 [ 452.460240][T20783] netlink: 'syz.2.3851': attribute type 10 has an invalid length. [ 452.465806][T20785] netlink: 'syz.3.3852': attribute type 4 has an invalid length. [ 452.468297][T20783] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3851'. [ 452.690060][T20793] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3855'. [ 452.733611][T20795] netlink: 'syz.2.3856': attribute type 11 has an invalid length. [ 452.838383][T20800] sctp: [Deprecated]: syz.2.3858 (pid 20800) Use of struct sctp_assoc_value in delayed_ack socket option. [ 452.838383][T20800] Use struct sctp_sack_info instead [ 452.880999][T20801] netem: unknown loss type 0 [ 452.888240][T20801] netem: change failed [ 452.929404][T20797] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3857'. [ 453.335886][T20821] syzkaller0: entered promiscuous mode [ 453.448696][T20829] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 453.666778][T20842] netlink: 'syz.3.3875': attribute type 8 has an invalid length. [ 453.975063][T20862] FAULT_INJECTION: forcing a failure. [ 453.975063][T20862] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 454.012289][T20862] CPU: 0 UID: 0 PID: 20862 Comm: syz.3.3881 Not tainted syzkaller #0 PREEMPT(full) [ 454.012318][T20862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 454.012330][T20862] Call Trace: [ 454.012339][T20862] [ 454.012347][T20862] dump_stack_lvl+0xe8/0x150 [ 454.012383][T20862] should_fail_ex+0x412/0x560 [ 454.012419][T20862] _copy_to_user+0x31/0xb0 [ 454.012445][T20862] simple_read_from_buffer+0xe1/0x170 [ 454.012480][T20862] proc_fail_nth_read+0x1bb/0x230 [ 454.012523][T20862] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 454.012554][T20862] ? rw_verify_area+0x2a6/0x4d0 [ 454.012575][T20862] ? tun_chr_write_iter+0x18a/0x200 [ 454.012595][T20862] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 454.012623][T20862] vfs_read+0x20c/0xa70 [ 454.012641][T20862] ? fdget_pos+0x246/0x320 [ 454.012665][T20862] ? __pfx___mutex_lock+0x10/0x10 [ 454.012689][T20862] ? __pfx_vfs_read+0x10/0x10 [ 454.012718][T20862] ? __fget_files+0x2a/0x420 [ 454.012752][T20862] ? __fget_files+0x3a0/0x420 [ 454.012780][T20862] ? __fget_files+0x2a/0x420 [ 454.012819][T20862] ksys_read+0x150/0x270 [ 454.012844][T20862] ? __pfx_ksys_read+0x10/0x10 [ 454.012879][T20862] do_syscall_64+0x14d/0xf80 [ 454.012902][T20862] ? trace_irq_disable+0x3b/0x150 [ 454.012919][T20862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.012940][T20862] ? clear_bhb_loop+0x40/0x90 [ 454.012964][T20862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.012984][T20862] RIP: 0033:0x7f29cbb5cfce [ 454.013004][T20862] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 454.013020][T20862] RSP: 002b:00007f29cc981fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 454.013042][T20862] RAX: ffffffffffffffda RBX: 00007f29cc9826c0 RCX: 00007f29cbb5cfce [ 454.013057][T20862] RDX: 000000000000000f RSI: 00007f29cc9820a0 RDI: 0000000000000003 [ 454.013070][T20862] RBP: 00007f29cc982090 R08: 0000000000000000 R09: 0000000000000000 [ 454.013083][T20862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.013095][T20862] R13: 00007f29cbe16038 R14: 00007f29cbe15fa0 R15: 00007ffce89232d8 [ 454.013130][T20862] [ 454.343771][T20864] syzkaller0: entered promiscuous mode [ 454.571868][T20884] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 454.805636][T20893] __nla_validate_parse: 6 callbacks suppressed [ 454.805658][T20893] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3892'. [ 454.821993][T20893] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3892'. [ 454.945539][T20899] netlink: 'syz.0.3894': attribute type 24 has an invalid length. [ 454.963293][T20899] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3894'. [ 454.972602][T20899] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3894'. [ 454.981608][T20899] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3894'. [ 455.049965][T20900] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3895'. [ 455.250336][T20908] syzkaller0: entered promiscuous mode [ 455.549733][T20916] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 455.643740][T20915] bond3 (unregistering): Released all slaves [ 456.026661][T20934] netlink: 'syz.2.3907': attribute type 29 has an invalid length. [ 456.261429][T20949] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3912'. [ 456.785695][T20982] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3924'. [ 457.091969][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 457.100101][ C1] lec:lec_tx_timeout: lec0 [ 457.105614][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 457.274451][T21008] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 457.390906][T21016] netlink: 'syz.0.3937': attribute type 39 has an invalid length. [ 457.411807][T21017] netlink: 'syz.0.3937': attribute type 39 has an invalid length. [ 457.504911][T21022] netlink: 'syz.2.3939': attribute type 10 has an invalid length. [ 457.526111][T21022] veth0_macvtap: left promiscuous mode [ 457.564842][T21022] rdma_op ffff888026d389f0 conn xmit_rdma 0000000000000000 [ 457.727579][T21030] netlink: 'syz.3.3943': attribute type 62 has an invalid length. [ 457.947788][T21037] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3945'. [ 457.995272][ T5837] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 458.011282][T21041] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3946'. [ 458.024929][ T5837] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 458.035609][ T5837] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 458.045471][ T5837] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 458.058222][ T5837] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 458.139777][T21047] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 458.156289][T21038] lo speed is unknown, defaulting to 1000 [ 458.264470][T21052] netlink: 'syz.0.3948': attribute type 32 has an invalid length. [ 458.286474][T21053] netlink: 'syz.0.3948': attribute type 32 has an invalid length. [ 458.386500][T21052] vlan2: entered allmulticast mode [ 458.468664][T21038] chnl_net:caif_netlink_parms(): no params data found [ 458.605651][T21038] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.613010][T21038] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.620303][T21038] bridge_slave_0: entered allmulticast mode [ 458.628983][T21038] bridge_slave_0: entered promiscuous mode [ 458.636908][T21038] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.644391][T21038] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.651729][T21038] bridge_slave_1: entered allmulticast mode [ 458.659238][T21038] bridge_slave_1: entered promiscuous mode [ 458.691205][T21038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 458.704040][T21038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 458.738040][T21038] team0: Port device team_slave_0 added [ 458.746293][T21038] team0: Port device team_slave_1 added [ 458.782101][T21038] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 458.789114][T21038] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 458.818473][T21038] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 458.837568][T21038] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 458.844857][T21038] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 458.871315][T21038] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 458.944340][T21038] hsr_slave_0: entered promiscuous mode [ 458.951241][T21038] hsr_slave_1: entered promiscuous mode [ 458.961378][T21038] debugfs: 'hsr0' already exists in 'hsr' [ 458.968662][T21038] Cannot create hsr debugfs directory [ 460.112155][ T5837] Bluetooth: hci2: command tx timeout [ 461.361737][T21057] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 461.384113][T21038] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 461.477938][T21038] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 461.517770][T21038] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 461.560628][T21038] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 461.718294][T21038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 461.756035][T21038] 8021q: adding VLAN 0 to HW filter on device team0 [ 461.775609][ T1157] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.783034][ T1157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 461.817037][ T7651] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.824282][ T7651] bridge0: port 2(bridge_slave_1) entered forwarding state [ 462.112008][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 462.120111][ C1] lec:lec_tx_timeout: lec0 [ 462.125082][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 462.160313][T21038] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 462.203286][ T5846] Bluetooth: hci2: command tx timeout [ 462.672483][ T5846] Bluetooth: hci5: command 0x0406 tx timeout [ 462.743306][T21038] veth0_vlan: entered promiscuous mode [ 462.769668][T21038] veth1_vlan: entered promiscuous mode [ 462.847251][T21038] veth0_macvtap: entered promiscuous mode [ 462.877653][T21038] veth1_macvtap: entered promiscuous mode [ 462.973693][T21038] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 463.007371][T21038] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 463.045635][ T1157] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.068584][ T1157] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.099528][ T1157] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.130576][ T1157] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.265099][T21158] veth1_macvtap: renamed from veth0_vlan [ 463.504828][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 463.515450][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 463.591889][T21175] __nla_validate_parse: 4 callbacks suppressed [ 463.591910][T21175] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3975'. [ 463.629064][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 463.639548][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 464.044824][T21193] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 464.227716][T21205] netlink: 'syz.0.3979': attribute type 11 has an invalid length. [ 464.268452][T21204] delete_channel: no stack [ 464.280426][ T5837] Bluetooth: hci2: command tx timeout [ 464.500622][ T5846] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 464.514350][ T5846] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 464.528477][ T5846] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 464.537266][ T5846] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 464.547415][ T5846] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 464.637553][T21209] lo speed is unknown, defaulting to 1000 [ 464.652772][T21184] mpoa:mpoad_close: () going down [ 464.769552][ T5490] veth1_macvtap: left promiscuous mode [ 464.813417][ T5490] veth1_macvtap: entered promiscuous mode [ 464.940466][T21209] chnl_net:caif_netlink_parms(): no params data found [ 465.134703][T21209] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.142430][T21209] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.149702][T21209] bridge_slave_0: entered allmulticast mode [ 465.159871][T21209] bridge_slave_0: entered promiscuous mode [ 465.170349][T21209] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.178460][T21209] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.188442][T21209] bridge_slave_1: entered allmulticast mode [ 465.201167][T21209] bridge_slave_1: entered promiscuous mode [ 465.256243][T21209] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 465.269769][T21209] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 465.323654][T21209] team0: Port device team_slave_0 added [ 465.332878][T21209] team0: Port device team_slave_1 added [ 465.370787][T21209] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 465.377877][T21209] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 465.406815][T21209] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 465.420114][T21209] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 465.427597][T21209] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 465.453680][T21209] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 465.525736][T21209] hsr_slave_0: entered promiscuous mode [ 465.534023][T21209] hsr_slave_1: entered promiscuous mode [ 465.540248][T21209] debugfs: 'hsr0' already exists in 'hsr' [ 465.546205][T21209] Cannot create hsr debugfs directory [ 465.776932][T21209] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 465.787420][T21209] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 465.799419][T21209] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 465.809446][T21209] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 465.838351][T21209] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.845597][T21209] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.853276][T21209] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.860380][T21209] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.873596][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.884278][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.937728][T21209] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.958805][T21209] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.971450][ T1140] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.979027][ T1140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.995413][ T1140] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.002978][ T1140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.180639][T21209] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.352454][ T5837] Bluetooth: hci2: command tx timeout [ 466.379260][T21209] veth0_vlan: entered promiscuous mode [ 466.394112][T21209] veth1_vlan: entered promiscuous mode [ 466.424859][T21209] veth0_macvtap: entered promiscuous mode [ 466.437855][T21209] veth1_macvtap: entered promiscuous mode [ 466.455489][T21209] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.469697][T21209] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.485293][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.494215][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.506334][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.517930][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.593891][ T5837] Bluetooth: hci6: command tx timeout [ 466.595559][ T7653] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.620024][ T7653] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.650595][ T7653] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.660613][ T7653] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.740236][T21253] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3980'. [ 467.132087][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 467.140155][ C1] lec:lec_tx_timeout: lec0 [ 467.144948][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 468.673037][ T5837] Bluetooth: hci6: command tx timeout [ 470.752171][ T5837] Bluetooth: hci6: command tx timeout [ 472.043182][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 472.832200][ T5837] Bluetooth: hci6: command tx timeout [ 473.392122][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6250 ms [ 473.400349][ C1] lec:lec_tx_timeout: lec0 [ 473.405466][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 479.152019][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 479.160117][ C1] lec:lec_tx_timeout: lec0 [ 479.166710][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 484.912089][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 484.920349][ C1] lec:lec_tx_timeout: lec0 [ 484.925142][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 489.952064][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 489.960117][ C1] lec:lec_tx_timeout: lec0 [ 489.970180][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 494.982006][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 494.990358][ C1] lec:lec_tx_timeout: lec0 [ 501.560930][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 502.967729][ T7653] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 506.912035][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5350 ms [ 506.920117][ C1] lec:lec_tx_timeout: lec0 [ 513.876564][ T5837] Bluetooth: hci3: command 0x0406 tx timeout [ 515.966559][T13790] lec:lec_start_xmit: lec0:No lecd attached [ 520.982036][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 520.990094][ C1] lec:lec_tx_timeout: lec0 [ 528.637531][T21321] x_tables: duplicate underflow at hook 2 [ 529.705716][T21356] tipc: Started in network mode [ 529.710872][T21356] tipc: Node identity 32034100ab13, cluster identity 4711 [ 529.732315][T21356] tipc: Enabled bearer , priority 0 [ 529.772957][T21356] syzkaller0: entered promiscuous mode [ 529.786546][T21356] syzkaller0: entered allmulticast mode [ 529.856104][T21361] netlink: 576 bytes leftover after parsing attributes in process `syz.3.3999'. [ 529.979394][T21364] lo speed is unknown, defaulting to 1000 [ 530.075739][T21356] tipc: Resetting bearer [ 530.129851][T21356] tipc: Disabling bearer [ 530.469218][T21395] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.4009'. [ 530.857857][T21404] netlink: 'syz.6.4010': attribute type 1 has an invalid length. [ 531.146537][T21428] syzkaller0: entered promiscuous mode [ 531.168127][T21428] syzkaller0: entered allmulticast mode [ 531.560836][T13801] IPVS: starting estimator thread 0... [ 531.687191][T21450] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4022'. [ 531.687546][T21446] IPVS: using max 27 ests per chain, 64800 per kthread [ 531.761435][T21455] netlink: 124 bytes leftover after parsing attributes in process `syz.5.4024'. [ 531.841000][T21460] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4025'. [ 532.061336][T21476] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4029'. [ 532.183465][T21479] IPVS: set_ctl: invalid protocol: 94 255.255.255.255:20003 [ 532.649254][T21503] netlink: 'syz.3.4037': attribute type 9 has an invalid length. [ 532.702642][T21506] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4039'. [ 533.010687][T21518] syzkaller0: entered promiscuous mode [ 533.034052][T21520] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 533.082403][T21518] syzkaller0: entered allmulticast mode [ 533.418752][T21532] pimreg: entered allmulticast mode [ 533.566616][T21542] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4045'. [ 533.783579][T21551] ip6tnl1: entered allmulticast mode [ 533.925032][T21555] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4051'. [ 533.986300][T21559] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 534.250484][T21572] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4059'. [ 534.263375][T21573] erspan0: entered promiscuous mode [ 534.272363][T21573] erspan0: left promiscuous mode [ 534.401537][T21575] bond5: Unable to set up delay as MII monitoring is disabled [ 534.477078][T21575] bond5 (unregistering): Released all slaves [ 534.589274][T21584] IPVS: length: 93 != 8 [ 534.935439][T21610] __nla_validate_parse: 2 callbacks suppressed [ 534.935461][T21610] netlink: 76 bytes leftover after parsing attributes in process `syz.6.4069'. [ 534.991128][T21610] syzkaller0: entered promiscuous mode [ 535.000958][T21610] syzkaller0: entered allmulticast mode [ 535.008613][T21613] netlink: 'syz.2.4070': attribute type 4 has an invalid length. [ 535.054951][T21614] tc action pedit offset must be on 32 bit boundaries [ 535.558014][T21638] sctp: [Deprecated]: syz.0.4078 (pid 21638) Use of struct sctp_assoc_value in delayed_ack socket option. [ 535.558014][T21638] Use struct sctp_sack_info instead [ 535.679617][T21635] netlink: 'syz.3.4077': attribute type 3 has an invalid length. [ 535.941767][T21655] FAULT_INJECTION: forcing a failure. [ 535.941767][T21655] name failslab, interval 1, probability 0, space 0, times 0 [ 535.990576][T21655] CPU: 1 UID: 0 PID: 21655 Comm: syz.6.4080 Not tainted syzkaller #0 PREEMPT(full) [ 535.990613][T21655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 535.990625][T21655] Call Trace: [ 535.990633][T21655] [ 535.990650][T21655] dump_stack_lvl+0xe8/0x150 [ 535.990686][T21655] should_fail_ex+0x412/0x560 [ 535.990721][T21655] should_failslab+0xa8/0x100 [ 535.990751][T21655] __kmalloc_cache_noprof+0x88/0x660 [ 535.990773][T21655] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 535.990805][T21655] ? sctp_add_bind_addr+0x8c/0x370 [ 535.990840][T21655] sctp_add_bind_addr+0x8c/0x370 [ 535.990875][T21655] sctp_copy_local_addr_list+0x314/0x4f0 [ 535.990909][T21655] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 535.990939][T21655] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 535.990971][T21655] ? sctp_v6_is_any+0x64/0x80 [ 535.990992][T21655] ? sctp_copy_one_addr+0x93/0x360 [ 535.991025][T21655] sctp_bind_addr_copy+0xb3/0x3c0 [ 535.991054][T21655] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 535.991084][T21655] sctp_connect_new_asoc+0x2ff/0x6b0 [ 535.991112][T21655] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 535.991144][T21655] ? __local_bh_enable_ip+0xd0/0x130 [ 535.991169][T21655] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 535.991193][T21655] ? security_sctp_bind_connect+0x7e/0x2c0 [ 535.991222][T21655] sctp_sendmsg+0x1528/0x2c10 [ 535.991263][T21655] ? __pfx_sctp_sendmsg+0x10/0x10 [ 535.991289][T21655] ? aa_sk_perm+0x6d5/0x900 [ 535.991326][T21655] ? __pfx_aa_sk_perm+0x10/0x10 [ 535.991358][T21655] ? sock_rps_record_flow+0x19/0x400 [ 535.991382][T21655] ? __pfx_inet_sendmsg+0x10/0x10 [ 535.991407][T21655] ? inet_sendmsg+0x2f4/0x370 [ 535.991432][T21655] ? __pfx_inet_sendmsg+0x10/0x10 [ 535.991457][T21655] __sys_sendto+0x5de/0x710 [ 535.991484][T21655] ? __pfx___sys_sendto+0x10/0x10 [ 535.991503][T21655] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 535.991544][T21655] ? __fget_files+0x3a0/0x420 [ 535.991588][T21655] ? ksys_write+0x242/0x270 [ 535.991613][T21655] ? __pfx_ksys_write+0x10/0x10 [ 535.991649][T21655] __x64_sys_sendto+0xde/0x100 [ 535.991676][T21655] do_syscall_64+0x14d/0xf80 [ 535.991699][T21655] ? trace_irq_disable+0x3b/0x150 [ 535.991715][T21655] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.991736][T21655] ? clear_bhb_loop+0x40/0x90 [ 535.991762][T21655] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.991782][T21655] RIP: 0033:0x7f2888d9c799 [ 535.991802][T21655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.991820][T21655] RSP: 002b:00007f2889bea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 535.991843][T21655] RAX: ffffffffffffffda RBX: 00007f2889015fa0 RCX: 00007f2888d9c799 [ 535.991858][T21655] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 535.991871][T21655] RBP: 00007f2889bea090 R08: 0000200000000100 R09: 000000000000001c [ 535.991884][T21655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 535.991895][T21655] R13: 00007f2889016038 R14: 00007f2889015fa0 R15: 00007ffd366b8648 [ 535.991927][T21655] [ 536.425111][T21660] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4084'. [ 536.503729][T21662] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4085'. [ 536.538671][T21662] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4085'. [ 536.720209][T21677] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 536.959797][T21697] netlink: 'syz.6.4093': attribute type 11 has an invalid length. [ 536.978113][T21699] FAULT_INJECTION: forcing a failure. [ 536.978113][T21699] name failslab, interval 1, probability 0, space 0, times 0 [ 537.018389][T21695] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4092'. [ 537.027766][T21699] CPU: 1 UID: 0 PID: 21699 Comm: syz.0.4095 Not tainted syzkaller #0 PREEMPT(full) [ 537.027796][T21699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 537.027808][T21699] Call Trace: [ 537.027817][T21699] [ 537.027825][T21699] dump_stack_lvl+0xe8/0x150 [ 537.027861][T21699] should_fail_ex+0x412/0x560 [ 537.027898][T21699] should_failslab+0xa8/0x100 [ 537.027926][T21699] __kmalloc_cache_noprof+0x88/0x660 [ 537.027949][T21699] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 537.027978][T21699] ? sctp_v6_cmp_addr+0x15/0xd0 [ 537.027996][T21699] ? sctp_add_bind_addr+0x8c/0x370 [ 537.028033][T21699] sctp_add_bind_addr+0x8c/0x370 [ 537.028068][T21699] sctp_copy_local_addr_list+0x314/0x4f0 [ 537.028102][T21699] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 537.028133][T21699] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 537.028166][T21699] ? sctp_v6_is_any+0x64/0x80 [ 537.028187][T21699] ? sctp_copy_one_addr+0x93/0x360 [ 537.028221][T21699] sctp_bind_addr_copy+0xb3/0x3c0 [ 537.028253][T21699] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 537.028286][T21699] sctp_connect_new_asoc+0x2ff/0x6b0 [ 537.028314][T21699] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 537.028347][T21699] ? __local_bh_enable_ip+0xd0/0x130 [ 537.028371][T21699] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 537.028405][T21699] ? security_sctp_bind_connect+0x7e/0x2c0 [ 537.028434][T21699] sctp_sendmsg+0x1528/0x2c10 [ 537.028475][T21699] ? __pfx_sctp_sendmsg+0x10/0x10 [ 537.028502][T21699] ? aa_sk_perm+0x6d5/0x900 [ 537.028541][T21699] ? __pfx_aa_sk_perm+0x10/0x10 [ 537.028572][T21699] ? sock_rps_record_flow+0x19/0x400 [ 537.028597][T21699] ? __pfx_inet_sendmsg+0x10/0x10 [ 537.028623][T21699] ? inet_sendmsg+0x2f4/0x370 [ 537.028647][T21699] ? __pfx_inet_sendmsg+0x10/0x10 [ 537.028672][T21699] __sys_sendto+0x5de/0x710 [ 537.028698][T21699] ? __pfx___sys_sendto+0x10/0x10 [ 537.028717][T21699] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 537.028758][T21699] ? __fget_files+0x3a0/0x420 [ 537.028808][T21699] ? ksys_write+0x242/0x270 [ 537.028834][T21699] ? __pfx_ksys_write+0x10/0x10 [ 537.028864][T21699] __x64_sys_sendto+0xde/0x100 [ 537.028890][T21699] do_syscall_64+0x14d/0xf80 [ 537.028912][T21699] ? trace_irq_disable+0x3b/0x150 [ 537.028930][T21699] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.028949][T21699] ? clear_bhb_loop+0x40/0x90 [ 537.028976][T21699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.028997][T21699] RIP: 0033:0x7fcdecd9c799 [ 537.029016][T21699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.029033][T21699] RSP: 002b:00007fcdedc62028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 537.029056][T21699] RAX: ffffffffffffffda RBX: 00007fcded015fa0 RCX: 00007fcdecd9c799 [ 537.029071][T21699] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 537.029084][T21699] RBP: 00007fcdedc62090 R08: 0000200000000100 R09: 000000000000001c [ 537.029097][T21699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 537.029109][T21699] R13: 00007fcded016038 R14: 00007fcded015fa0 R15: 00007ffdf75fb268 [ 537.029145][T21699] [ 537.410415][T21703] xt_l2tp: missing protocol rule (udp|l2tpip) [ 537.476024][T21695] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4092'. [ 537.666937][T21718] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4101'. [ 537.706717][T21718] netlink: 'syz.0.4101': attribute type 7 has an invalid length. [ 537.718674][T21718] netlink: 'syz.0.4101': attribute type 8 has an invalid length. [ 537.729772][T21718] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4101'. [ 537.775415][T21716] netlink: 40 bytes leftover after parsing attributes in process `syz.6.4100'. [ 538.016572][T21735] netlink: 'syz.5.4105': attribute type 1 has an invalid length. [ 538.129242][T21741] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4108'. [ 538.143173][T21738] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 538.153726][T21738] bond1: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 538.170940][T21738] bond1: (slave vxcan3): making interface the new active one [ 538.179634][T21738] bond1: (slave vxcan3): Enslaving as an active interface with an up link [ 538.230363][T21741] syzkaller0: entered promiscuous mode [ 538.241094][T21741] syzkaller0: entered allmulticast mode [ 538.542463][T21755] netlink: ct family unspecified [ 538.689551][T21764] netlink: 'syz.2.4114': attribute type 10 has an invalid length. [ 538.774304][T21764] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 538.796665][T21771] lo: entered allmulticast mode [ 538.811501][T21769] lo: left allmulticast mode [ 539.049808][T21774] syzkaller0: entered promiscuous mode [ 539.082234][T21774] syzkaller0: entered allmulticast mode [ 540.948325][T21795] __nla_validate_parse: 7 callbacks suppressed [ 540.948345][T21795] netlink: 204 bytes leftover after parsing attributes in process `syz.2.4123'. [ 541.350390][T21822] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4130'. [ 541.416038][T21826] netlink: 'syz.2.4133': attribute type 1 has an invalid length. [ 541.445149][T21826] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4133'. [ 541.454585][T21826] netlink: 658 bytes leftover after parsing attributes in process `syz.2.4133'. [ 541.482160][T21826] netlink: 'syz.2.4133': attribute type 1 has an invalid length. [ 541.725378][T21844] netlink: 'syz.5.4138': attribute type 3 has an invalid length. [ 541.733915][T21839] netlink: 'syz.3.4135': attribute type 1 has an invalid length. [ 541.741694][T21839] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4135'. [ 541.782712][T21839] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4135'. [ 541.811300][T21839] netlink: 'syz.3.4135': attribute type 1 has an invalid length. [ 541.844183][T21839] netlink: 634 bytes leftover after parsing attributes in process `syz.3.4135'. [ 542.101605][T21861] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4142'. [ 542.118404][T21860] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4141'. [ 542.521696][T21882] FAULT_INJECTION: forcing a failure. [ 542.521696][T21882] name failslab, interval 1, probability 0, space 0, times 0 [ 542.543126][ T5846] Bluetooth: hci4: link tx timeout [ 542.548699][ T5846] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 542.565162][T21882] CPU: 1 UID: 0 PID: 21882 Comm: syz.3.4147 Not tainted syzkaller #0 PREEMPT(full) [ 542.565191][T21882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 542.565203][T21882] Call Trace: [ 542.565211][T21882] [ 542.565220][T21882] dump_stack_lvl+0xe8/0x150 [ 542.565256][T21882] should_fail_ex+0x412/0x560 [ 542.565292][T21882] should_failslab+0xa8/0x100 [ 542.565332][T21882] __kmalloc_cache_noprof+0x88/0x660 [ 542.565354][T21882] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 542.565383][T21882] ? sctp_v6_cmp_addr+0x15/0xd0 [ 542.565401][T21882] ? sctp_add_bind_addr+0x8c/0x370 [ 542.565436][T21882] sctp_add_bind_addr+0x8c/0x370 [ 542.565471][T21882] sctp_copy_local_addr_list+0x314/0x4f0 [ 542.565506][T21882] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 542.565536][T21882] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 542.565568][T21882] ? sctp_v6_is_any+0x64/0x80 [ 542.565589][T21882] ? sctp_copy_one_addr+0x93/0x360 [ 542.565623][T21882] sctp_bind_addr_copy+0xb3/0x3c0 [ 542.565654][T21882] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 542.565685][T21882] sctp_connect_new_asoc+0x2ff/0x6b0 [ 542.565713][T21882] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 542.565744][T21882] ? __local_bh_enable_ip+0xd0/0x130 [ 542.565775][T21882] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 542.565799][T21882] ? security_sctp_bind_connect+0x7e/0x2c0 [ 542.565829][T21882] sctp_sendmsg+0x1528/0x2c10 [ 542.565870][T21882] ? __pfx_sctp_sendmsg+0x10/0x10 [ 542.565897][T21882] ? aa_sk_perm+0x6d5/0x900 [ 542.565936][T21882] ? __pfx_aa_sk_perm+0x10/0x10 [ 542.565967][T21882] ? sock_rps_record_flow+0x19/0x400 [ 542.565991][T21882] ? __pfx_inet_sendmsg+0x10/0x10 [ 542.566018][T21882] ? inet_sendmsg+0x2f4/0x370 [ 542.566042][T21882] ? __pfx_inet_sendmsg+0x10/0x10 [ 542.566068][T21882] __sys_sendto+0x5de/0x710 [ 542.566095][T21882] ? __pfx___sys_sendto+0x10/0x10 [ 542.566115][T21882] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 542.566156][T21882] ? __fget_files+0x3a0/0x420 [ 542.566200][T21882] ? ksys_write+0x242/0x270 [ 542.566226][T21882] ? __pfx_ksys_write+0x10/0x10 [ 542.566256][T21882] __x64_sys_sendto+0xde/0x100 [ 542.566282][T21882] do_syscall_64+0x14d/0xf80 [ 542.566313][T21882] ? trace_irq_disable+0x3b/0x150 [ 542.566331][T21882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.566351][T21882] ? clear_bhb_loop+0x40/0x90 [ 542.566377][T21882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.566397][T21882] RIP: 0033:0x7f29cbb9c799 [ 542.566417][T21882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 542.566435][T21882] RSP: 002b:00007f29cc982028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 542.566457][T21882] RAX: ffffffffffffffda RBX: 00007f29cbe15fa0 RCX: 00007f29cbb9c799 [ 542.566472][T21882] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 542.566485][T21882] RBP: 00007f29cc982090 R08: 0000200000000100 R09: 000000000000001c [ 542.566498][T21882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 542.566510][T21882] R13: 00007f29cbe16038 R14: 00007f29cbe15fa0 R15: 00007ffce89232d8 [ 542.566545][T21882] [ 543.058177][T21864] mpoa:mpoad_close: () going down [ 543.061344][T21891] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4153'. [ 543.196303][T21894] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 543.435327][T21916] delete_channel: no stack [ 543.445132][T21913] delete_channel: no stack [ 543.449776][T21913] delete_channel: no stack [ 543.502600][T21913] delete_channel: no stack [ 543.509886][T21913] delete_channel: no stack [ 543.535687][T21913] delete_channel: no stack [ 543.540368][T21913] delete_channel: no stack [ 543.564628][T21913] delete_channel: no stack [ 543.574765][T21913] delete_channel: no stack [ 543.583380][T21913] delete_channel: no stack [ 543.589743][T21913] delete_channel: no stack [ 543.614669][T21913] delete_channel: no stack [ 543.644588][T21913] delete_channel: no stack [ 543.649271][T21913] delete_channel: no stack [ 543.680927][T21913] delete_channel: no stack [ 543.701315][T21913] delete_channel: no stack [ 543.715749][T21913] delete_channel: no stack [ 543.756919][T21913] delete_channel: no stack [ 543.768449][T21913] delete_channel: no stack [ 543.781415][T21913] delete_channel: no stack [ 543.803814][T21913] delete_channel: no stack [ 543.825506][T21913] delete_channel: no stack [ 543.847507][T21913] delete_channel: no stack [ 543.869128][T21913] delete_channel: no stack [ 543.890861][T21913] delete_channel: no stack [ 543.907220][T21913] delete_channel: no stack [ 543.929350][T21913] delete_channel: no stack [ 543.998518][T21947] FAULT_INJECTION: forcing a failure. [ 543.998518][T21947] name failslab, interval 1, probability 0, space 0, times 0 [ 544.007709][T21913] delete_channel: no stack [ 544.023339][T21913] delete_channel: no stack [ 544.036682][T21913] delete_channel: no stack [ 544.047265][T21913] delete_channel: no stack [ 544.054005][T21947] CPU: 1 UID: 0 PID: 21947 Comm: syz.2.4164 Not tainted syzkaller #0 PREEMPT(full) [ 544.054031][T21947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 544.054044][T21947] Call Trace: [ 544.054052][T21947] [ 544.054061][T21947] dump_stack_lvl+0xe8/0x150 [ 544.054097][T21947] should_fail_ex+0x412/0x560 [ 544.054134][T21947] should_failslab+0xa8/0x100 [ 544.054163][T21947] __kmalloc_cache_noprof+0x88/0x660 [ 544.054185][T21947] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 544.054218][T21947] ? sctp_add_bind_addr+0x8c/0x370 [ 544.054253][T21947] sctp_add_bind_addr+0x8c/0x370 [ 544.054288][T21947] sctp_copy_local_addr_list+0x314/0x4f0 [ 544.054323][T21947] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 544.054355][T21947] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 544.054387][T21947] ? sctp_v6_is_any+0x64/0x80 [ 544.054409][T21947] ? sctp_copy_one_addr+0x93/0x360 [ 544.054443][T21947] sctp_bind_addr_copy+0xb3/0x3c0 [ 544.054475][T21947] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 544.054517][T21947] sctp_connect_new_asoc+0x2ff/0x6b0 [ 544.054545][T21947] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 544.054577][T21947] ? __local_bh_enable_ip+0xd0/0x130 [ 544.054602][T21947] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 544.054626][T21947] ? security_sctp_bind_connect+0x7e/0x2c0 [ 544.054656][T21947] sctp_sendmsg+0x1528/0x2c10 [ 544.054698][T21947] ? __pfx_sctp_sendmsg+0x10/0x10 [ 544.054726][T21947] ? aa_sk_perm+0x6d5/0x900 [ 544.054765][T21947] ? __pfx_aa_sk_perm+0x10/0x10 [ 544.054798][T21947] ? sock_rps_record_flow+0x19/0x400 [ 544.054824][T21947] ? __pfx_inet_sendmsg+0x10/0x10 [ 544.054850][T21947] ? inet_sendmsg+0x2f4/0x370 [ 544.054875][T21947] ? __pfx_inet_sendmsg+0x10/0x10 [ 544.054901][T21947] __sys_sendto+0x5de/0x710 [ 544.054928][T21947] ? __pfx___sys_sendto+0x10/0x10 [ 544.054947][T21947] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 544.054989][T21947] ? __fget_files+0x3a0/0x420 [ 544.055032][T21947] ? ksys_write+0x242/0x270 [ 544.055058][T21947] ? __pfx_ksys_write+0x10/0x10 [ 544.055086][T21947] __x64_sys_sendto+0xde/0x100 [ 544.055112][T21947] do_syscall_64+0x14d/0xf80 [ 544.055134][T21947] ? trace_irq_disable+0x3b/0x150 [ 544.055149][T21947] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.055169][T21947] ? clear_bhb_loop+0x40/0x90 [ 544.055195][T21947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.055215][T21947] RIP: 0033:0x7f1965f9c799 [ 544.055235][T21947] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.055251][T21947] RSP: 002b:00007f1966dc0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 544.055274][T21947] RAX: ffffffffffffffda RBX: 00007f1966215fa0 RCX: 00007f1965f9c799 [ 544.055289][T21947] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 544.055302][T21947] RBP: 00007f1966dc0090 R08: 0000200000000100 R09: 000000000000001c [ 544.055315][T21947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 544.055327][T21947] R13: 00007f1966216038 R14: 00007f1966215fa0 R15: 00007fffc21c18b8 [ 544.055363][T21947] [ 544.057557][T21913] delete_channel: no stack [ 544.378380][T21913] delete_channel: no stack [ 544.398012][T21949] syzkaller0: entered promiscuous mode [ 544.609548][ T5837] Bluetooth: hci4: command 0x0406 tx timeout [ 544.859658][T21977] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 544.969420][T21982] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 546.534926][T21981] bridge0: port 2(ipvlan3) entered blocking state [ 546.558141][T21988] xt_l2tp: missing protocol rule (udp|l2tpip) [ 546.569230][T21981] bridge0: port 2(ipvlan3) entered disabled state [ 546.583940][T21981] ipvlan3: entered allmulticast mode [ 546.594040][T21981] bridge0: entered allmulticast mode [ 546.606572][T21981] ipvlan3: left allmulticast mode [ 546.611825][T21981] bridge0: left allmulticast mode [ 546.816107][T21989] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 546.884643][T21989] bond3: (slave lo): Enslaving as an active interface with an up link [ 546.973504][T21989] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 547.189372][T13801] lo speed is unknown, defaulting to 1000 [ 547.195429][ T5891] lo speed is unknown, defaulting to 1000 [ 547.201611][T22005] syzkaller1: entered promiscuous mode [ 547.219154][ T5891] syz0: Port: 1 Link ACTIVE [ 547.248692][T22005] syzkaller1: entered allmulticast mode [ 547.255834][T22024] netlink: 'syz.6.4179': attribute type 16 has an invalid length. [ 547.277801][T22024] netlink: 'syz.6.4179': attribute type 17 has an invalid length. [ 547.307354][T22016] mac80211_hwsim hwsim37 wlan0: entered promiscuous mode [ 547.462202][T22024] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 547.696899][T22044] netlink: 'syz.6.4185': attribute type 1 has an invalid length. [ 547.807691][T22044] 8021q: adding VLAN 0 to HW filter on device bond1 [ 547.915133][T22055] netlink: 'syz.2.4187': attribute type 3 has an invalid length. [ 547.924463][T22050] bond1: (slave gretap1): making interface the new active one [ 547.946428][T22055] __nla_validate_parse: 6 callbacks suppressed [ 547.946449][T22055] netlink: 156 bytes leftover after parsing attributes in process `syz.2.4187'. [ 547.961207][T22050] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 548.187175][T22062] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 548.235498][T22064] debugfs: 'Ku crK:̥B| lS-!' already exists in 'ieee80211' [ 548.292177][T22065] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4188'. [ 548.303148][T22070] netlink: 51 bytes leftover after parsing attributes in process `syz.3.4189'. [ 548.347143][T22071] syzkaller1: entered promiscuous mode [ 548.364876][T22071] syzkaller1: entered allmulticast mode [ 548.380829][T22068] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4190'. [ 548.392186][T22068] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4190'. [ 548.816390][T22087] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 548.874120][T22096] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4197'. [ 549.059336][T22113] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4199'. [ 549.078129][T22113] hsr_slave_0: left promiscuous mode [ 549.135164][T22113] hsr_slave_1: left promiscuous mode [ 549.161414][T22109] netlink: 'syz.6.4200': attribute type 23 has an invalid length. [ 549.319061][T22125] netlink: 276 bytes leftover after parsing attributes in process `syz.2.4202'. [ 549.422892][T22118] lo speed is unknown, defaulting to 1000 [ 549.705088][T22141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4208'. [ 549.793054][T22150] netlink: 'syz.6.4209': attribute type 11 has an invalid length. [ 549.811272][T22150] netlink: 64 bytes leftover after parsing attributes in process `syz.6.4209'. [ 551.010503][T22194] syzkaller0: entered promiscuous mode [ 551.028078][T22194] syzkaller0: entered allmulticast mode [ 551.447293][T22217] lo speed is unknown, defaulting to 1000 [ 551.568617][T22221] tipc: Enabling of bearer rejected, failed to enable media [ 551.996334][T22244] syzkaller0: entered promiscuous mode [ 552.002315][T22244] syzkaller0: entered allmulticast mode [ 552.691364][T22278] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 552.914102][T22294] netlink: 'syz.6.4245': attribute type 7 has an invalid length. [ 552.956028][T22294] __nla_validate_parse: 6 callbacks suppressed [ 552.956048][T22294] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4245'. [ 553.118812][T22307] FAULT_INJECTION: forcing a failure. [ 553.118812][T22307] name failslab, interval 1, probability 0, space 0, times 0 [ 553.133419][T22306] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4247'. [ 553.166148][T22306] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4247'. [ 553.176399][T22307] CPU: 0 UID: 0 PID: 22307 Comm: syz.5.4248 Not tainted syzkaller #0 PREEMPT(full) [ 553.176427][T22307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 553.176440][T22307] Call Trace: [ 553.176448][T22307] [ 553.176457][T22307] dump_stack_lvl+0xe8/0x150 [ 553.176491][T22307] should_fail_ex+0x412/0x560 [ 553.176527][T22307] should_failslab+0xa8/0x100 [ 553.176556][T22307] __kmalloc_cache_noprof+0x88/0x660 [ 553.176577][T22307] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 553.176606][T22307] ? sctp_v6_cmp_addr+0x15/0xd0 [ 553.176624][T22307] ? sctp_add_bind_addr+0x8c/0x370 [ 553.176659][T22307] sctp_add_bind_addr+0x8c/0x370 [ 553.176694][T22307] sctp_copy_local_addr_list+0x314/0x4f0 [ 553.176728][T22307] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 553.176758][T22307] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 553.176789][T22307] ? sctp_v6_is_any+0x64/0x80 [ 553.176810][T22307] ? sctp_copy_one_addr+0x93/0x360 [ 553.176841][T22307] sctp_bind_addr_copy+0xb3/0x3c0 [ 553.176872][T22307] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 553.176901][T22307] sctp_connect_new_asoc+0x2ff/0x6b0 [ 553.176929][T22307] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 553.176960][T22307] ? __local_bh_enable_ip+0xd0/0x130 [ 553.176984][T22307] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 553.177007][T22307] ? security_sctp_bind_connect+0x7e/0x2c0 [ 553.177035][T22307] sctp_sendmsg+0x1528/0x2c10 [ 553.177075][T22307] ? __pfx_sctp_sendmsg+0x10/0x10 [ 553.177102][T22307] ? aa_sk_perm+0x6d5/0x900 [ 553.177139][T22307] ? __pfx_aa_sk_perm+0x10/0x10 [ 553.177182][T22307] ? sock_rps_record_flow+0x19/0x400 [ 553.177207][T22307] ? __pfx_inet_sendmsg+0x10/0x10 [ 553.177233][T22307] ? inet_sendmsg+0x2f4/0x370 [ 553.177257][T22307] ? __pfx_inet_sendmsg+0x10/0x10 [ 553.177289][T22307] __sys_sendto+0x5de/0x710 [ 553.177315][T22307] ? __pfx___sys_sendto+0x10/0x10 [ 553.177334][T22307] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 553.177371][T22307] ? __fget_files+0x3a0/0x420 [ 553.177413][T22307] ? ksys_write+0x242/0x270 [ 553.177444][T22307] ? __pfx_ksys_write+0x10/0x10 [ 553.177473][T22307] __x64_sys_sendto+0xde/0x100 [ 553.177498][T22307] do_syscall_64+0x14d/0xf80 [ 553.177521][T22307] ? trace_irq_disable+0x3b/0x150 [ 553.177538][T22307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.177558][T22307] ? clear_bhb_loop+0x40/0x90 [ 553.177584][T22307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.177603][T22307] RIP: 0033:0x7f8ef099c799 [ 553.177623][T22307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.177640][T22307] RSP: 002b:00007f8ef1840028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 553.177661][T22307] RAX: ffffffffffffffda RBX: 00007f8ef0c15fa0 RCX: 00007f8ef099c799 [ 553.177676][T22307] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 553.177689][T22307] RBP: 00007f8ef1840090 R08: 0000200000000100 R09: 000000000000001c [ 553.177701][T22307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 553.177712][T22307] R13: 00007f8ef0c16038 R14: 00007f8ef0c15fa0 R15: 00007ffe4a524878 [ 553.177757][T22307] [ 553.229920][T22306] netlink: 34 bytes leftover after parsing attributes in process `syz.2.4247'. [ 554.527767][T22365] bond0: entered promiscuous mode [ 554.556931][T22365] bond_slave_0: entered promiscuous mode [ 554.563389][T22365] bond_slave_1: entered promiscuous mode [ 554.570687][T22371] FAULT_INJECTION: forcing a failure. [ 554.570687][T22371] name failslab, interval 1, probability 0, space 0, times 0 [ 554.599382][T22365] mac80211_hwsim hwsim30 wlan1: entered promiscuous mode [ 554.622341][T22365] bond0: left promiscuous mode [ 554.627182][T22365] bond_slave_0: left promiscuous mode [ 554.637512][T22371] CPU: 1 UID: 0 PID: 22371 Comm: syz.6.4260 Not tainted syzkaller #0 PREEMPT(full) [ 554.637539][T22371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 554.637551][T22371] Call Trace: [ 554.637559][T22371] [ 554.637568][T22371] dump_stack_lvl+0xe8/0x150 [ 554.637604][T22371] should_fail_ex+0x412/0x560 [ 554.637640][T22371] should_failslab+0xa8/0x100 [ 554.637668][T22371] __kmalloc_cache_noprof+0x88/0x660 [ 554.637690][T22371] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 554.637720][T22371] ? sctp_v6_cmp_addr+0x15/0xd0 [ 554.637738][T22371] ? sctp_add_bind_addr+0x8c/0x370 [ 554.637772][T22371] sctp_add_bind_addr+0x8c/0x370 [ 554.637804][T22371] sctp_copy_local_addr_list+0x314/0x4f0 [ 554.637836][T22371] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 554.637866][T22371] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 554.637898][T22371] ? sctp_v6_is_any+0x64/0x80 [ 554.637919][T22371] ? sctp_copy_one_addr+0x93/0x360 [ 554.637953][T22371] sctp_bind_addr_copy+0xb3/0x3c0 [ 554.637984][T22371] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 554.638016][T22371] sctp_connect_new_asoc+0x2ff/0x6b0 [ 554.638044][T22371] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 554.638076][T22371] ? __local_bh_enable_ip+0xd0/0x130 [ 554.638101][T22371] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 554.638125][T22371] ? security_sctp_bind_connect+0x7e/0x2c0 [ 554.638153][T22371] sctp_sendmsg+0x1528/0x2c10 [ 554.638193][T22371] ? __pfx_sctp_sendmsg+0x10/0x10 [ 554.638219][T22371] ? aa_sk_perm+0x6d5/0x900 [ 554.638255][T22371] ? __pfx_aa_sk_perm+0x10/0x10 [ 554.638287][T22371] ? sock_rps_record_flow+0x19/0x400 [ 554.638310][T22371] ? __pfx_inet_sendmsg+0x10/0x10 [ 554.638335][T22371] ? inet_sendmsg+0x2f4/0x370 [ 554.638358][T22371] ? __pfx_inet_sendmsg+0x10/0x10 [ 554.638383][T22371] __sys_sendto+0x5de/0x710 [ 554.638408][T22371] ? __pfx___sys_sendto+0x10/0x10 [ 554.638426][T22371] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 554.638475][T22371] ? __fget_files+0x3a0/0x420 [ 554.638518][T22371] ? ksys_write+0x242/0x270 [ 554.638549][T22371] ? __pfx_ksys_write+0x10/0x10 [ 554.638579][T22371] __x64_sys_sendto+0xde/0x100 [ 554.638606][T22371] do_syscall_64+0x14d/0xf80 [ 554.638627][T22371] ? trace_irq_disable+0x3b/0x150 [ 554.638644][T22371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.638664][T22371] ? clear_bhb_loop+0x40/0x90 [ 554.638691][T22371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.638710][T22371] RIP: 0033:0x7f2888d9c799 [ 554.638730][T22371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 554.638746][T22371] RSP: 002b:00007f2889bea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 554.638769][T22371] RAX: ffffffffffffffda RBX: 00007f2889015fa0 RCX: 00007f2888d9c799 [ 554.638783][T22371] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 554.638795][T22371] RBP: 00007f2889bea090 R08: 0000200000000100 R09: 000000000000001c [ 554.638808][T22371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 554.638820][T22371] R13: 00007f2889016038 R14: 00007f2889015fa0 R15: 00007ffd366b8648 [ 554.638856][T22371] [ 554.992640][T22365] bond_slave_1: left promiscuous mode [ 555.031807][T22365] mac80211_hwsim hwsim30 wlan1: left promiscuous mode [ 555.208292][T22383] nbd: must specify at least one socket [ 555.262247][T22385] IPv6: NLM_F_CREATE should be specified when creating new route [ 555.275107][T22390] x_tables: duplicate underflow at hook 4 [ 555.616923][T22409] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4270'. [ 555.672425][T22412] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4270'. [ 555.778637][T22414] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4272'. [ 555.798330][T22417] FAULT_INJECTION: forcing a failure. [ 555.798330][T22417] name failslab, interval 1, probability 0, space 0, times 0 [ 555.863064][T22417] CPU: 0 UID: 0 PID: 22417 Comm: syz.0.4273 Not tainted syzkaller #0 PREEMPT(full) [ 555.863096][T22417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 555.863108][T22417] Call Trace: [ 555.863116][T22417] [ 555.863125][T22417] dump_stack_lvl+0xe8/0x150 [ 555.863160][T22417] should_fail_ex+0x412/0x560 [ 555.863197][T22417] should_failslab+0xa8/0x100 [ 555.863223][T22417] __kmalloc_cache_noprof+0x88/0x660 [ 555.863248][T22417] ? sctp_add_bind_addr+0x8c/0x370 [ 555.863286][T22417] sctp_add_bind_addr+0x8c/0x370 [ 555.863320][T22417] sctp_copy_local_addr_list+0x314/0x4f0 [ 555.863355][T22417] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 555.863384][T22417] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 555.863416][T22417] ? sctp_v6_is_any+0x64/0x80 [ 555.863439][T22417] ? sctp_copy_one_addr+0x93/0x360 [ 555.863482][T22417] sctp_bind_addr_copy+0xb3/0x3c0 [ 555.863513][T22417] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 555.863544][T22417] sctp_connect_new_asoc+0x2ff/0x6b0 [ 555.863572][T22417] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 555.863604][T22417] ? __local_bh_enable_ip+0xd0/0x130 [ 555.863629][T22417] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 555.863653][T22417] ? security_sctp_bind_connect+0x7e/0x2c0 [ 555.863683][T22417] sctp_sendmsg+0x1528/0x2c10 [ 555.863725][T22417] ? __pfx_sctp_sendmsg+0x10/0x10 [ 555.863751][T22417] ? aa_sk_perm+0x6d5/0x900 [ 555.863789][T22417] ? __pfx_aa_sk_perm+0x10/0x10 [ 555.863821][T22417] ? sock_rps_record_flow+0x19/0x400 [ 555.863846][T22417] ? __pfx_inet_sendmsg+0x10/0x10 [ 555.863871][T22417] ? inet_sendmsg+0x2f4/0x370 [ 555.863896][T22417] ? __pfx_inet_sendmsg+0x10/0x10 [ 555.863922][T22417] __sys_sendto+0x5de/0x710 [ 555.863948][T22417] ? __pfx___sys_sendto+0x10/0x10 [ 555.863967][T22417] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 555.864007][T22417] ? __fget_files+0x3a0/0x420 [ 555.864050][T22417] ? ksys_write+0x242/0x270 [ 555.864076][T22417] ? __pfx_ksys_write+0x10/0x10 [ 555.864106][T22417] __x64_sys_sendto+0xde/0x100 [ 555.864132][T22417] do_syscall_64+0x14d/0xf80 [ 555.864155][T22417] ? trace_irq_disable+0x3b/0x150 [ 555.864173][T22417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.864193][T22417] ? clear_bhb_loop+0x40/0x90 [ 555.864218][T22417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.864238][T22417] RIP: 0033:0x7fcdecd9c799 [ 555.864264][T22417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.864281][T22417] RSP: 002b:00007fcdedc62028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 555.864305][T22417] RAX: ffffffffffffffda RBX: 00007fcded015fa0 RCX: 00007fcdecd9c799 [ 555.864319][T22417] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 555.864332][T22417] RBP: 00007fcdedc62090 R08: 0000200000000100 R09: 000000000000001c [ 555.864345][T22417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 555.864357][T22417] R13: 00007fcded016038 R14: 00007fcded015fa0 R15: 00007ffdf75fb268 [ 555.864393][T22417] [ 556.495848][T22434] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4277'. [ 556.544916][T22434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4277'. [ 556.568870][T22425] can: request_module (can-proto-4) failed. [ 556.804999][T22438] syzkaller0: entered promiscuous mode [ 556.896489][T22456] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4282'. [ 559.752773][T22524] __nla_validate_parse: 3 callbacks suppressed [ 559.752793][T22524] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4297'. [ 560.347617][T22556] netlink: 128 bytes leftover after parsing attributes in process `syz.3.4305'. [ 560.365802][T22549] syzkaller0: entered promiscuous mode [ 560.495244][T22560] netlink: 'syz.6.4309': attribute type 1 has an invalid length. [ 562.266711][T22560] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 562.447472][T22580] IPVS: set_ctl: invalid protocol: 183 10.1.1.2:20000 [ 562.473830][ T5833] IPVS: starting estimator thread 0... [ 562.485612][T22578] Bluetooth: MGMT ver 1.23 [ 562.507110][T22578] netlink: 6024 bytes leftover after parsing attributes in process `syz.3.4313'. [ 562.592304][T22581] IPVS: using max 27 ests per chain, 64800 per kthread [ 562.622974][T22578] syzkaller0: entered promiscuous mode [ 562.635503][T22578] syzkaller0: entered allmulticast mode [ 562.896151][T22608] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4319'. [ 563.001245][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 563.294255][T22623] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4324'. [ 563.322212][T22623] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4324'. [ 563.518728][T22627] syzkaller0: entered promiscuous mode [ 563.844905][T22638] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4328'. [ 565.523712][T22638] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4328'. [ 565.541610][T22649] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4330'. [ 565.551440][T22646] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4329'. [ 565.616216][ T36] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 565.616371][T22646] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4329'. [ 565.637867][ T36] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 565.682676][ T36] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 565.691533][ T36] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 565.973502][T22667] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4338'. [ 565.985885][T22668] netlink: 'syz.6.4337': attribute type 3 has an invalid length. [ 565.996490][T22668] netlink: 666 bytes leftover after parsing attributes in process `syz.6.4337'. [ 566.034647][T22676] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4338'. [ 566.225308][T22681] syzkaller0: entered allmulticast mode [ 566.281816][T22677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4336'. [ 566.416971][T22677] team0: Port device team_slave_0 removed [ 566.710841][T22689] syzkaller0: entered promiscuous mode [ 566.724338][T22701] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4344'. [ 568.016703][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 568.025004][ C1] lec:lec_tx_timeout: lec0 [ 568.733307][T22724] netlink: 'syz.3.4351': attribute type 2 has an invalid length. [ 568.741106][T22724] netlink: 'syz.3.4351': attribute type 2 has an invalid length. [ 568.898992][T22728] syzkaller0: entered promiscuous mode [ 568.919774][T22728] syzkaller0: entered allmulticast mode [ 568.984056][T22728] netlink: 'syz.2.4352': attribute type 1 has an invalid length. [ 568.991929][T22728] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4352'. [ 569.181728][T22747] macsec1: entered promiscuous mode [ 569.665278][T22777] RDS: rds_bind could not find a transport for 400:0:1200:0:1030:0:ffff:ffff, load rds_tcp or rds_rdma? [ 569.696740][T22770] syzkaller0: entered promiscuous mode [ 571.979073][T22822] __nla_validate_parse: 4 callbacks suppressed [ 571.979093][T22822] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4377'. [ 572.050615][T22825] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4377'. [ 572.268472][T22844] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4383'. [ 572.314024][T22846] ip6t_rpfilter: unknown options [ 572.323174][T22846] openvswitch: netlink: IPv4 tunnel dst address is zero [ 572.341846][T22840] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4382'. [ 572.540171][T22853] sctp: [Deprecated]: syz.6.4385 (pid 22853) Use of int in maxseg socket option. [ 572.540171][T22853] Use struct sctp_assoc_value instead [ 572.717661][T22861] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4387'. [ 572.801214][T22864] netlink: 'syz.0.4388': attribute type 1 has an invalid length. [ 572.841124][T22864] netlink: 212 bytes leftover after parsing attributes in process `syz.0.4388'. [ 572.994852][T22866] syzkaller0: entered promiscuous mode [ 573.165411][T22874] clip:clip_setentry: non-CLIP VCC [ 573.455623][T22883] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.903727][T22912] openvswitch: netlink: Missing valid actions attribute. [ 575.926183][T22912] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 576.720821][T22942] netlink: 'syz.3.4404': attribute type 4 has an invalid length. [ 576.986981][T22946] netlink: 568 bytes leftover after parsing attributes in process `syz.5.4406'. [ 577.313244][T22958] syzkaller0: entered promiscuous mode [ 579.236929][T13790] lec:lec_start_xmit: lec0:No lecd attached [ 579.677145][T23000] netlink: 568 bytes leftover after parsing attributes in process `syz.6.4421'. [ 579.697070][T23002] FAULT_INJECTION: forcing a failure. [ 579.697070][T23002] name failslab, interval 1, probability 0, space 0, times 0 [ 579.740090][T23002] CPU: 0 UID: 0 PID: 23002 Comm: syz.3.4422 Not tainted syzkaller #0 PREEMPT(full) [ 579.740120][T23002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 579.740132][T23002] Call Trace: [ 579.740140][T23002] [ 579.740148][T23002] dump_stack_lvl+0xe8/0x150 [ 579.740181][T23002] should_fail_ex+0x412/0x560 [ 579.740216][T23002] should_failslab+0xa8/0x100 [ 579.740243][T23002] __kmalloc_cache_noprof+0x88/0x660 [ 579.740266][T23002] ? sctp_add_bind_addr+0x8c/0x370 [ 579.740302][T23002] sctp_add_bind_addr+0x8c/0x370 [ 579.740338][T23002] sctp_copy_local_addr_list+0x314/0x4f0 [ 579.740372][T23002] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 579.740403][T23002] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 579.740436][T23002] ? sctp_v6_is_any+0x64/0x80 [ 579.740458][T23002] ? sctp_copy_one_addr+0x93/0x360 [ 579.740492][T23002] sctp_bind_addr_copy+0xb3/0x3c0 [ 579.740524][T23002] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 579.740556][T23002] sctp_connect_new_asoc+0x2ff/0x6b0 [ 579.740584][T23002] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 579.740616][T23002] ? __local_bh_enable_ip+0xd0/0x130 [ 579.740641][T23002] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 579.740666][T23002] ? security_sctp_bind_connect+0x7e/0x2c0 [ 579.740696][T23002] sctp_sendmsg+0x1528/0x2c10 [ 579.740738][T23002] ? __pfx_sctp_sendmsg+0x10/0x10 [ 579.740766][T23002] ? aa_sk_perm+0x6d5/0x900 [ 579.740805][T23002] ? __pfx_aa_sk_perm+0x10/0x10 [ 579.740838][T23002] ? sock_rps_record_flow+0x19/0x400 [ 579.740872][T23002] ? __pfx_inet_sendmsg+0x10/0x10 [ 579.740899][T23002] ? inet_sendmsg+0x2f4/0x370 [ 579.740923][T23002] ? __pfx_inet_sendmsg+0x10/0x10 [ 579.740949][T23002] __sys_sendto+0x5de/0x710 [ 579.740976][T23002] ? __pfx___sys_sendto+0x10/0x10 [ 579.740995][T23002] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 579.741036][T23002] ? __fget_files+0x3a0/0x420 [ 579.741079][T23002] ? ksys_write+0x242/0x270 [ 579.741104][T23002] ? __pfx_ksys_write+0x10/0x10 [ 579.741133][T23002] __x64_sys_sendto+0xde/0x100 [ 579.741160][T23002] do_syscall_64+0x14d/0xf80 [ 579.741182][T23002] ? trace_irq_disable+0x3b/0x150 [ 579.741200][T23002] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.741221][T23002] ? clear_bhb_loop+0x40/0x90 [ 579.741247][T23002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.741268][T23002] RIP: 0033:0x7f29cbb9c799 [ 579.741288][T23002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.741306][T23002] RSP: 002b:00007f29cc982028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 579.741329][T23002] RAX: ffffffffffffffda RBX: 00007f29cbe15fa0 RCX: 00007f29cbb9c799 [ 579.741344][T23002] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 579.741357][T23002] RBP: 00007f29cc982090 R08: 0000200000000100 R09: 000000000000001c [ 579.741370][T23002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 579.741383][T23002] R13: 00007f29cbe16038 R14: 00007f29cbe15fa0 R15: 00007ffce89232d8 [ 579.741419][T23002] [ 580.442343][T22986] Bluetooth: hci2: command 0x0406 tx timeout [ 580.448592][T22986] Bluetooth: hci1: command 0x0406 tx timeout [ 580.679887][T23045] netlink: 620 bytes leftover after parsing attributes in process `syz.0.4435'. [ 580.682294][T23043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4434'. [ 580.718162][T23043] netlink: 'syz.3.4434': attribute type 3 has an invalid length. [ 580.804889][T23047] netlink: 'syz.6.4436': attribute type 1 has an invalid length. [ 580.822308][T23047] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4436'. [ 581.179552][T23084] tipc: Started in network mode [ 581.222491][T23084] tipc: Node identity ac14140f, cluster identity 4711 [ 581.277823][T23084] tipc: New replicast peer: 255.255.255.255 [ 581.299645][T23084] tipc: Enabled bearer , priority 10 [ 581.338773][T23096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4446'. [ 581.419957][T23106] netlink: 620 bytes leftover after parsing attributes in process `syz.0.4448'. [ 581.513212][T23101] syzkaller0: entered promiscuous mode [ 581.518751][T23101] syzkaller0: entered allmulticast mode [ 581.591434][T23110] : renamed from dummy0 (while UP) [ 581.618079][T23112] netlink: 14 bytes leftover after parsing attributes in process `syz.2.4451'. [ 581.699745][T23113] bond4: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 581.747848][T23113] bond4 (unregistering): Released all slaves [ 581.793490][T23123] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4453'. [ 581.855720][T23130] netlink: 'syz.6.4455': attribute type 1 has an invalid length. [ 581.885327][T23130] netlink: 96 bytes leftover after parsing attributes in process `syz.6.4455'. [ 581.894923][T23130] netlink: 'syz.6.4455': attribute type 1 has an invalid length. [ 581.922271][T23130] netlink: 'syz.6.4455': attribute type 8 has an invalid length. [ 581.948396][T23113] bond4: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 581.975942][T23113] bond4 (unregistering): Released all slaves [ 582.113437][T23136] xt_CT: You must specify a L4 protocol and not use inversions on it [ 582.117191][T23113] bond4: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 582.155897][T23113] bond4 (unregistering): Released all slaves [ 582.417275][T23113] bond4: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 582.437311][T23113] bond4 (unregistering): Released all slaves [ 582.478281][ T5889] tipc: Node number set to 2886997007 [ 582.825654][T23172] netlink: 'syz.6.4469': attribute type 1 has an invalid length. [ 582.857191][T23173] __nla_validate_parse: 2 callbacks suppressed [ 582.857212][T23173] netlink: 52 bytes leftover after parsing attributes in process `syz.6.4469'. [ 583.013698][T23172] 8021q: adding VLAN 0 to HW filter on device bond2 [ 583.145205][T23182] netlink: 'syz.0.4472': attribute type 1 has an invalid length. [ 583.244559][T23182] bond4: entered promiscuous mode [ 583.250809][T23182] bond4: entered allmulticast mode [ 583.259017][T23182] 8021q: adding VLAN 0 to HW filter on device bond4 [ 583.552666][T23159] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4464'. [ 583.913447][T23231] xt_CT: You must specify a L4 protocol and not use inversions on it [ 583.980420][T23222] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.107327][T23234] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4483'. [ 584.206579][T23222] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.508133][T23267] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4486'. [ 584.523183][T23222] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.721696][T23222] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.911942][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5670 ms [ 584.920064][ C1] lec:lec_tx_timeout: lec0 [ 584.997805][ T7651] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.055574][ T1157] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.075064][T23293] netlink: 'syz.0.4491': attribute type 3 has an invalid length. [ 585.126587][ T1157] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.140877][T23293] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4491'. [ 585.176492][ T1157] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 585.290895][T23258] mpoa:mpoad_close: () going down [ 585.450784][T23302] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4492'. [ 585.574736][T23285] mpoa:mpoad_close: () going down [ 585.853591][T23311] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4494'. [ 585.889717][T23313] FAULT_INJECTION: forcing a failure. [ 585.889717][T23313] name failslab, interval 1, probability 0, space 0, times 0 [ 585.929859][T23313] CPU: 1 UID: 0 PID: 23313 Comm: syz.6.4495 Not tainted syzkaller #0 PREEMPT(full) [ 585.929890][T23313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 585.929902][T23313] Call Trace: [ 585.929911][T23313] [ 585.929918][T23313] dump_stack_lvl+0xe8/0x150 [ 585.929952][T23313] should_fail_ex+0x412/0x560 [ 585.929987][T23313] should_failslab+0xa8/0x100 [ 585.930015][T23313] __kmalloc_cache_noprof+0x88/0x660 [ 585.930035][T23313] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 585.930064][T23313] ? sctp_add_bind_addr+0x8c/0x370 [ 585.930098][T23313] sctp_add_bind_addr+0x8c/0x370 [ 585.930131][T23313] sctp_copy_local_addr_list+0x314/0x4f0 [ 585.930163][T23313] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 585.930190][T23313] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 585.930220][T23313] ? sctp_v6_is_any+0x64/0x80 [ 585.930240][T23313] ? sctp_copy_one_addr+0x93/0x360 [ 585.930273][T23313] sctp_bind_addr_copy+0xb3/0x3c0 [ 585.930304][T23313] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 585.930335][T23313] sctp_connect_new_asoc+0x2ff/0x6b0 [ 585.930361][T23313] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 585.930391][T23313] ? __local_bh_enable_ip+0xd0/0x130 [ 585.930413][T23313] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 585.930434][T23313] ? security_sctp_bind_connect+0x7e/0x2c0 [ 585.930462][T23313] sctp_sendmsg+0x1528/0x2c10 [ 585.930502][T23313] ? __pfx_sctp_sendmsg+0x10/0x10 [ 585.930526][T23313] ? aa_sk_perm+0x6d5/0x900 [ 585.930564][T23313] ? __pfx_aa_sk_perm+0x10/0x10 [ 585.930594][T23313] ? sock_rps_record_flow+0x19/0x400 [ 585.930619][T23313] ? __pfx_inet_sendmsg+0x10/0x10 [ 585.930644][T23313] ? inet_sendmsg+0x2f4/0x370 [ 585.930667][T23313] ? __pfx_inet_sendmsg+0x10/0x10 [ 585.930690][T23313] __sys_sendto+0x5de/0x710 [ 585.930715][T23313] ? __pfx___sys_sendto+0x10/0x10 [ 585.930734][T23313] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 585.930773][T23313] ? __fget_files+0x3a0/0x420 [ 585.930826][T23313] ? ksys_write+0x242/0x270 [ 585.930851][T23313] ? __pfx_ksys_write+0x10/0x10 [ 585.930879][T23313] __x64_sys_sendto+0xde/0x100 [ 585.930904][T23313] do_syscall_64+0x14d/0xf80 [ 585.930927][T23313] ? trace_irq_disable+0x3b/0x150 [ 585.930943][T23313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.930964][T23313] ? clear_bhb_loop+0x40/0x90 [ 585.930990][T23313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.931009][T23313] RIP: 0033:0x7f2888d9c799 [ 585.931031][T23313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 585.931047][T23313] RSP: 002b:00007f2889bea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 585.931071][T23313] RAX: ffffffffffffffda RBX: 00007f2889015fa0 RCX: 00007f2888d9c799 [ 585.931086][T23313] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 585.931098][T23313] RBP: 00007f2889bea090 R08: 0000200000000100 R09: 000000000000001c [ 585.931111][T23313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 585.931123][T23313] R13: 00007f2889016038 R14: 00007f2889015fa0 R15: 00007ffd366b8648 [ 585.931156][T23313] [ 585.933693][T23311] netlink: 'syz.3.4494': attribute type 3 has an invalid length. [ 586.128773][T23315] openvswitch: netlink: Message has 1 unknown bytes. [ 586.277237][T23315] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 586.508281][T23334] syzkaller0: entered promiscuous mode [ 586.542714][T23334] syzkaller0: entered allmulticast mode [ 586.568592][T23336] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4502'. [ 586.586077][T23336] syz_tun: left promiscuous mode [ 586.616163][T23334] tc action pedit offset must be on 32 bit boundaries [ 586.867994][T23357] netlink: 'syz.6.4506': attribute type 1 has an invalid length. [ 586.876461][T23357] netlink: 224 bytes leftover after parsing attributes in process `syz.6.4506'. [ 586.902604][T23357] netlink: 'syz.6.4506': attribute type 1 has an invalid length. [ 587.050704][T23364] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4509'. [ 587.241592][T23374] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.260265][T23365] mpoa:atm_mpoa_mpoad_attach: mpoad is already present for itf 0 [ 587.305583][T23374] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.370249][T23374] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.371518][T23342] mpoa:mpoad_close: () going down [ 587.437636][T23374] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.672259][ T7651] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.687814][ T1140] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.699620][ T1140] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.715639][ T1140] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.296993][T23408] openvswitch: netlink: Message has 8 unknown bytes. [ 588.311731][T23408] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 588.474182][T23419] __nla_validate_parse: 1 callbacks suppressed [ 588.474203][T23419] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.4528'. [ 588.501282][T23419] netlink: Conntrack attr has 3 unknown bytes [ 588.509180][T23419] netlink: 92 bytes leftover after parsing attributes in process `syz.0.4528'. [ 588.876726][T23445] netlink: 516 bytes leftover after parsing attributes in process `syz.3.4534'. [ 588.922032][ T5846] Bluetooth: hci6: command 0x0405 tx timeout [ 589.127025][T23460] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4538'. [ 589.159107][T23451] : entered promiscuous mode [ 589.262955][T23465] vlan4: entered allmulticast mode [ 589.270996][T23465] bond0: entered allmulticast mode [ 589.278871][T23465] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4539'. [ 589.369127][T23465] bond0 (unregistering): Released all slaves [ 589.536520][T23478] macvlan0: entered promiscuous mode [ 589.710730][T23482] netlink: 40 bytes leftover after parsing attributes in process `syz.6.4544'. [ 589.836738][T23489] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4546'. [ 590.053518][T23503] netlink: 'syz.6.4549': attribute type 63 has an invalid length. [ 590.061806][T23503] netlink: 'syz.6.4549': attribute type 63 has an invalid length. [ 590.174651][T23503] bond3: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 590.245330][T23503] bond3 (unregistering): Released all slaves [ 590.320459][T23516] bond2: ARP target 1.0.0.0 is already present [ 590.330506][T23516] bond2: option arp_ip_target: invalid value (1) [ 590.341164][T23516] bond2 (unregistering): Released all slaves [ 590.536980][T23516] bond2: ARP target 1.0.0.0 is already present [ 590.560272][T23516] bond2: option arp_ip_target: invalid value (1) [ 590.588675][T23516] bond2 (unregistering): Released all slaves [ 590.837645][T23516] bond2: ARP target 1.0.0.0 is already present [ 590.848947][T23516] bond2: option arp_ip_target: invalid value (1) [ 590.894704][T23516] bond2 (unregistering): Released all slaves [ 590.956509][T23537] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 591.058325][T23516] bond2: ARP target 1.0.0.0 is already present [ 591.065549][T23516] bond2: option arp_ip_target: invalid value (1) [ 591.094128][T23516] bond2 (unregistering): Released all slaves [ 591.122840][T23550] netlink: 'syz.6.4562': attribute type 1 has an invalid length. [ 591.130627][T23550] netlink: 224 bytes leftover after parsing attributes in process `syz.6.4562'. [ 591.139562][T23552] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 591.222503][T23557] ip6t_srh: unknown srh invflags 4000 [ 591.506676][T23570] netlink: 'syz.2.4567': attribute type 5 has an invalid length. [ 591.825580][T23590] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4572'. [ 591.950473][T23603] netlink: 27 bytes leftover after parsing attributes in process `syz.6.4577'. [ 591.988400][T23590] bridge3: port 1(veth3) entered blocking state [ 592.018043][T23590] bridge3: port 1(veth3) entered disabled state [ 592.054457][T23590] veth3: entered allmulticast mode [ 592.071618][T23590] veth3: entered promiscuous mode [ 592.138780][T23596] bridge3: port 2(veth5) entered blocking state [ 592.153627][T23596] bridge3: port 2(veth5) entered disabled state [ 592.168826][T23596] veth5: entered allmulticast mode [ 592.184511][T23596] veth5: entered promiscuous mode [ 592.193503][T23595] netlink: 'syz.2.4575': attribute type 29 has an invalid length. [ 592.216136][T23593] netem: change failed [ 592.762194][T23645] netlink: 'syz.0.4588': attribute type 1 has an invalid length. [ 592.847845][T23646] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 592.858286][T23646] bond5: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 592.873934][T23646] bond5: (slave vxcan3): making interface the new active one [ 592.883433][T23646] bond5: (slave vxcan3): Enslaving as an active interface with an up link [ 593.134171][T23658] bond2: Unable to set down delay as MII monitoring is disabled [ 593.199865][T23658] bond2 (unregistering): Released all slaves [ 593.335041][T23671] xt_TPROXY: Can be used only with -p tcp or -p udp [ 593.853671][T23699] __nla_validate_parse: 2 callbacks suppressed [ 593.853693][T23699] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4605'. [ 593.900201][T23703] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4607'. [ 593.919551][T23703] vlan6: entered promiscuous mode [ 593.936526][T23703] gretap0: entered promiscuous mode [ 594.011499][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 594.023451][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 594.072318][T23699] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 594.892830][T23739] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.4616'. [ 595.096874][T23741] netlink: 'syz.5.4617': attribute type 7 has an invalid length. [ 595.347613][T23756] xt_hashlimit: size too large, truncated to 1048576 [ 595.563934][T23764] netlink: 'syz.3.4624': attribute type 2 has an invalid length. [ 595.845768][T23764] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4624'. [ 595.898408][T23764] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4624'. [ 596.443361][T23757] mpoa:mpoad_close: () going down [ 596.542836][T23788] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4632'. [ 596.587876][T23788] netlink: 192 bytes leftover after parsing attributes in process `syz.3.4632'. [ 596.874956][T23797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4635'. [ 596.884065][T23797] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4635'. [ 596.898499][T23798] bond4: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 596.942869][T23798] bond4 (unregistering): Released all slaves [ 596.944100][T23805] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4636'. [ 597.266386][T23815] tunl0: entered promiscuous mode [ 597.318522][T23815] netlink: 'syz.2.4638': attribute type 3 has an invalid length. [ 597.793683][T23838] sctp: [Deprecated]: syz.3.4646 (pid 23838) Use of int in maxseg socket option. [ 597.793683][T23838] Use struct sctp_assoc_value instead [ 598.190071][T23849] xt_limit: Overflow, try lower: 271964/0 [ 598.574344][T23865] netlink: 'syz.6.4657': attribute type 2 has an invalid length. [ 598.953440][T23886] __nla_validate_parse: 13 callbacks suppressed [ 598.953464][T23886] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4662'. [ 599.096954][T23892] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4662'. [ 599.108920][T23892] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4662'. [ 599.241697][T23903] --map-set only usable from mangle table [ 599.317330][T23900] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4665'. [ 599.347807][T23911] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4666'. [ 599.357082][T23911] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4666'. [ 599.372049][T23900] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4665'. [ 599.424590][T23917] netlink: 412 bytes leftover after parsing attributes in process `syz.6.4668'. [ 599.482607][T23919] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4670'. [ 599.560744][T23911] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4666'. [ 600.164379][T23909] infiniband syz2: set down [ 600.186258][T23909] infiniband syz2: added syzkaller0 [ 600.286279][T23909] RDS/IB: syz2: added [ 600.295158][T23909] smc: adding ib device syz2 with port count 1 [ 600.301624][T23909] smc: ib device syz2 port 1 has no pnetid [ 601.445959][T23979] syzkaller0: entered promiscuous mode [ 601.458303][T23979] syzkaller0: entered allmulticast mode [ 601.833123][T23967] mpoa:mpoad_close: () going down [ 604.237298][T24021] gre1: entered promiscuous mode [ 604.252002][T24021] gre1: entered allmulticast mode [ 604.308785][T24027] __nla_validate_parse: 10 callbacks suppressed [ 604.308809][T24027] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4698'. [ 604.442643][T24027] 8021q: adding VLAN 0 to HW filter on device bond6 [ 604.492051][T24030] bond6: entered promiscuous mode [ 604.526417][T24030] bond6: entered allmulticast mode [ 604.548155][T24030] 8021q: adding VLAN 0 to HW filter on device bond6 [ 604.579552][T24030] team0: Port device bond6 added [ 604.624257][T24027] vxcan5: entered promiscuous mode [ 604.639984][T24027] bond6: (slave vxcan5): refused to change device type [ 604.799490][T24043] Cannot find del_set index 4 as target [ 604.841258][T24045] netlink: 'syz.0.4703': attribute type 10 has an invalid length. [ 604.946537][T24045] team0 (unregistering): Port device team_slave_0 removed [ 604.989556][T24045] team0 (unregistering): Port device team_slave_1 removed [ 605.039223][T24045] team0 (unregistering): Port device bond6 removed [ 605.488552][T24068] IPVS: Unknown mcast interface: lo [ 605.494381][T24069] IPVS: Unknown mcast interface: lo [ 605.635148][T24080] xt_TCPMSS: Only works on TCP SYN packets [ 605.784602][T24082] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4712'. [ 605.858823][T24089] bond0: Device is already in use. [ 606.278890][T24099] mac80211_hwsim hwsim30 syzkaller0: entered promiscuous mode [ 606.292655][T24099] mac80211_hwsim hwsim30 syzkaller0: entered allmulticast mode [ 606.564334][ T7651] smc: removing ib device syz2 [ 606.970316][T24110] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4721'. [ 607.172634][T24118] netlink: 248 bytes leftover after parsing attributes in process `syz.5.4723'. [ 607.224187][T24120] netlink: 'syz.0.4724': attribute type 3 has an invalid length. [ 607.278075][T24120] netlink: 'syz.0.4724': attribute type 1 has an invalid length. [ 607.329465][T24125] netlink: 'syz.5.4725': attribute type 1 has an invalid length. [ 607.452623][T24125] bond2: entered promiscuous mode [ 607.458382][T24125] 8021q: adding VLAN 0 to HW filter on device bond2 [ 607.514437][T24126] bond2: (slave bridge3): making interface the new active one [ 607.528288][T24126] bridge3: entered promiscuous mode [ 607.561320][T24126] bond2: (slave bridge3): Enslaving as an active interface with an up link [ 608.730940][T24146] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 610.189192][T24120] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 610.414156][T24155] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4734'. [ 610.474731][T24155] netlink: 104 bytes leftover after parsing attributes in process `syz.5.4734'. [ 610.594287][T24164] netlink: 220 bytes leftover after parsing attributes in process `syz.0.4735'. [ 610.844598][T24178] syzkaller0: entered promiscuous mode [ 610.850140][T24178] syzkaller0: entered allmulticast mode [ 610.870474][T24177] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 611.054210][T24188] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4744'. [ 611.232821][T24195] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4747'. [ 611.320234][T24201] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4749'. [ 611.513746][T24205] bridge0: port 3(gretap0) entered blocking state [ 611.522566][T24205] bridge0: port 3(gretap0) entered disabled state [ 611.544870][T24205] gretap0: entered allmulticast mode [ 611.581522][T24205] gretap0: entered promiscuous mode [ 611.608090][T24208] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4752'. [ 611.642694][ T31] INFO: task syz.4.3812:20674 blocked for more than 143 seconds. [ 611.669336][ T31] Not tainted syzkaller #0 [ 611.677974][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 611.696460][ T31] task:syz.4.3812 state:D stack:24536 pid:20674 tgid:20665 ppid:17751 task_flags:0x400140 flags:0x00080002 [ 611.711657][ T31] Call Trace: [ 611.725064][ T31] [ 611.730325][ T31] __schedule+0x15dd/0x52d0 [ 611.742730][ T31] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 611.769349][ T31] ? __pfx___schedule+0x10/0x10 [ 611.782127][ T31] ? schedule+0x90/0x360 [ 611.802531][ T31] schedule+0x164/0x360 [ 611.806769][ T31] schedule_preempt_disabled+0x13/0x30 [ 611.827343][ T31] __mutex_lock+0x7fe/0x1300 [ 611.832615][ T31] ? __mutex_lock+0x5ac/0x1300 [ 611.837591][ T31] ? nfsd_nl_rpc_status_get_dumpit+0xdc/0x1410 [ 611.847185][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 611.852385][ T31] ? stack_trace_save+0xa9/0x100 [ 611.857480][ T31] ? __pfx_stack_trace_save+0x10/0x10 [ 611.863581][ T31] nfsd_nl_rpc_status_get_dumpit+0xdc/0x1410 [ 611.869740][ T31] ? kasan_save_track+0x4f/0x80 [ 611.882060][ T31] ? kasan_save_track+0x3e/0x80 [ 611.886979][ T31] ? __kasan_kmalloc+0x93/0xb0 [ 611.902169][ T31] ? __alloc_skb+0x2c1/0x7d0 [ 611.907621][ T31] ? netlink_dump+0x1ef/0xe80 [ 611.917353][ T31] ? __netlink_dump_start+0x5cb/0x7e0 [ 611.937611][ T31] ? genl_family_rcv_msg_dumpit+0x213/0x310 [ 611.947736][ T31] ? genl_rcv_msg+0x5e8/0x7a0 [ 611.962038][ T31] ? netlink_rcv_skb+0x232/0x4b0 [ 611.967055][ T31] ? genl_rcv+0x28/0x40 [ 611.981589][ T31] ? netlink_unicast+0x80f/0x9b0 [ 611.991140][ T31] ? netlink_sendmsg+0x813/0xb40 [ 611.996406][ T31] ? ____sys_sendmsg+0x972/0x9f0 [ 612.001795][ T31] ? ___sys_sendmsg+0x2a5/0x360 [ 612.007745][ T31] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 612.014523][ T31] ? do_syscall_64+0x14d/0xf80 [ 612.019458][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.028350][ T31] ? __pfx_nfsd_nl_rpc_status_get_dumpit+0x10/0x10 [ 612.036133][ T31] ? rcu_is_watching+0x15/0xb0 [ 612.040959][ T31] ? trace_kmalloc+0x2a/0x110 [ 612.046518][ T31] ? __kmalloc_node_track_caller_noprof+0x4f9/0x7b0 [ 612.053478][ T31] genl_dumpit+0x10b/0x1b0 [ 612.058066][ T31] netlink_dump+0x722/0xe80 [ 612.066343][ T31] ? __pfx_netlink_dump+0x10/0x10 [ 612.071569][ T31] ? genl_start+0x499/0x6c0 [ 612.076907][ T31] __netlink_dump_start+0x5cb/0x7e0 [ 612.082628][ T31] genl_family_rcv_msg_dumpit+0x213/0x310 [ 612.088557][ T31] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 612.095521][ T31] ? genl_get_cmd+0x4a8/0x930 [ 612.100267][ T31] ? __pfx_genl_start+0x10/0x10 [ 612.106287][ T31] ? __pfx_genl_dumpit+0x10/0x10 [ 612.111284][ T31] ? __pfx_genl_done+0x10/0x10 [ 612.116532][ T31] genl_rcv_msg+0x5e8/0x7a0 [ 612.121100][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 612.129549][ T31] ? __pfx_nfsd_nl_rpc_status_get_dumpit+0x10/0x10 [ 612.136897][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 612.157221][ T31] netlink_rcv_skb+0x232/0x4b0 [ 612.163324][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 612.168403][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 612.175520][ T31] ? down_read+0x272/0x2e0 [ 612.180004][ T31] ? genl_rcv+0xd/0x40 [ 612.184324][ T31] genl_rcv+0x28/0x40 [ 612.188415][ T31] netlink_unicast+0x80f/0x9b0 [ 612.193795][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 612.199323][ T31] ? netlink_sendmsg+0x650/0xb40 [ 612.204407][ T31] ? skb_put+0x11b/0x210 [ 612.208677][ T31] netlink_sendmsg+0x813/0xb40 [ 612.213636][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 612.218946][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 612.224520][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 612.231212][ T31] ____sys_sendmsg+0x972/0x9f0 [ 612.236261][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 612.241635][ T31] ? import_iovec+0x73/0xa0 [ 612.246352][ T31] ___sys_sendmsg+0x2a5/0x360 [ 612.251138][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 612.258133][ T31] ? futex_wake+0x4ac/0x580 [ 612.263002][ T31] ? __fget_files+0x2a/0x420 [ 612.267700][ T31] ? __fget_files+0x3a0/0x420 [ 612.276457][ T31] __x64_sys_sendmsg+0x1bd/0x2a0 [ 612.289047][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 612.294784][ T31] ? rcu_is_watching+0x15/0xb0 [ 612.302312][ T31] do_syscall_64+0x14d/0xf80 [ 612.307035][ T31] ? trace_irq_disable+0x3b/0x150 [ 612.312678][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.318871][ T31] ? clear_bhb_loop+0x40/0x90 [ 612.323828][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.330562][ T31] RIP: 0033:0x7fcb84b9c799 [ 612.335124][ T31] RSP: 002b:00007fcb85ab1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 612.344098][ T31] RAX: ffffffffffffffda RBX: 00007fcb84e16180 RCX: 00007fcb84b9c799 [ 612.352187][ T31] RDX: 0000000000000800 RSI: 0000200000000180 RDI: 000000000000000c [ 612.360183][ T31] RBP: 00007fcb84c32c99 R08: 0000000000000000 R09: 0000000000000000 [ 612.368341][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 612.376849][ T31] R13: 00007fcb84e16218 R14: 00007fcb84e16180 R15: 00007ffc23d04178 [ 612.385115][ T31] [ 612.388404][ T31] [ 612.388404][ T31] Showing all locks held in the system: [ 612.399116][ T31] 1 lock held by khungtaskd/31: [ 612.406301][T24230] netlink: 'syz.5.4754': attribute type 5 has an invalid length. [ 612.417062][ T31] #0: ffffffff8e75e620 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 612.450372][ T31] 3 locks held by kworker/u8:10/1157: [ 612.455922][ T31] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 612.467931][ T31] #1: ffffc90004c7fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 612.479358][ T31] #2: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 612.488665][ T31] 2 locks held by getty/5585: [ 612.493474][ T31] #0: ffff88803475b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 612.504036][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 612.515275][ T31] 2 locks held by syz.1.3711/20353: [ 612.520508][ T31] #0: ffffffff8fc3cf30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 612.529115][ T31] #1: ffffffff8ea86788 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x2b5/0x9a0 [ 612.540741][ T31] 3 locks held by syz.4.3812/20674: [ 612.546178][ T31] #0: ffffffff8fc3cf30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 612.554605][ T31] #1: ffff8880571b36f0 (nlk_cb_mutex-GENERIC){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 [ 612.565576][ T31] #2: ffffffff8ea86788 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_rpc_status_get_dumpit+0xdc/0x1410 [ 612.576220][ T31] 2 locks held by syz.6.4750/24203: [ 612.581428][ T31] #0: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 612.590584][ T31] #1: ffffffff8e764938 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 612.602286][ T31] 1 lock held by syz.2.4752/24207: [ 612.607406][ T31] #0: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: ppp_release+0x87/0x1f0 [ 612.616500][ T31] 1 lock held by syz.5.4754/24217: [ 612.621646][ T31] #0: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 612.630977][ T31] 1 lock held by syz.5.4754/24227: [ 612.637935][ T31] #0: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3bc/0x1e10 [ 612.647516][ T31] 1 lock held by syz.5.4754/24237: [ 612.652866][ T31] #0: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x32b/0x1b30 [ 612.662743][ T31] 2 locks held by syz.3.4756/24222: [ 612.668115][ T31] #0: ffff88805c9fbb88 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 612.678883][ T31] #1: ffffffff8fbcf1c8 (rtnl_mutex){+.+.}-{4:4}, at: raw_release+0x1bc/0xa10 [ 612.688205][ T31] [ 612.690661][ T31] ============================================= [ 612.690661][ T31] [ 612.699621][ T31] NMI backtrace for cpu 1 [ 612.699640][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 612.699662][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 612.699674][ T31] Call Trace: [ 612.699682][ T31] [ 612.699690][ T31] dump_stack_lvl+0xe8/0x150 [ 612.699723][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 612.699754][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 612.699783][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 612.699824][ T31] sys_info+0x135/0x170 [ 612.699850][ T31] watchdog+0xfd9/0x1030 [ 612.699873][ T31] ? watchdog+0x21a/0x1030 [ 612.699901][ T31] kthread+0x388/0x470 [ 612.699922][ T31] ? __pfx_watchdog+0x10/0x10 [ 612.699938][ T31] ? __pfx_kthread+0x10/0x10 [ 612.699960][ T31] ret_from_fork+0x51e/0xb90 [ 612.699990][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 612.700014][ T31] ? __switch_to+0xc7d/0x1450 [ 612.700041][ T31] ? __pfx_kthread+0x10/0x10 [ 612.700062][ T31] ret_from_fork_asm+0x1a/0x30 [ 612.700107][ T31] [ 612.700116][ T31] Sending NMI from CPU 1 to CPUs 0: [ 612.812904][ C0] NMI backtrace for cpu 0 [ 612.812923][ C0] CPU: 0 UID: 0 PID: 1150 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) [ 612.812942][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 612.812953][ C0] Workqueue: events_unbound nsim_dev_trap_report_work [ 612.812983][ C0] RIP: 0010:unwind_next_frame+0x190e/0x23c0 [ 612.813009][ C0] Code: 85 16 08 00 00 b3 01 8b 84 24 8c 00 00 00 41 39 06 4c 8b 7c 24 50 48 8b 7c 24 78 0f 85 53 01 00 00 48 8b 44 24 58 80 3c 28 00 <74> 05 e8 0b 60 b9 00 4d 8b 66 38 49 8d 7e 08 48 89 f8 48 c1 e8 03 [ 612.813023][ C0] RSP: 0018:ffffc90004a7f4b8 EFLAGS: 00000246 [ 612.813037][ C0] RAX: 1ffff9200094feb8 RBX: ffffffff90b33001 RCX: 0000000000000001 [ 612.813049][ C0] RDX: ffffc90004a7f5c8 RSI: dffffc0000000000 RDI: ffffc90004a7f5c0 [ 612.813060][ C0] RBP: dffffc0000000000 R08: ffffc90004a7f990 R09: 0000000000000000 [ 612.813071][ C0] R10: ffffc90004a7f5d8 R11: fffff5200094febd R12: ffffc90004a7f5d8 [ 612.813083][ C0] R13: 1ffff9200094feb3 R14: ffffc90004a7f588 R15: ffffffff81767e95 [ 612.813095][ C0] FS: 0000000000000000(0000) GS:ffff88812545a000(0000) knlGS:0000000000000000 [ 612.813108][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 612.813119][ C0] CR2: 000000110c3c806a CR3: 0000000078c82000 CR4: 00000000003526f0 [ 612.813136][ C0] Call Trace: [ 612.813142][ C0] [ 612.813153][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 612.813175][ C0] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 612.813195][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 612.813213][ C0] arch_stack_walk+0x11b/0x150 [ 612.813238][ C0] ? __alloc_skb+0x1d0/0x7d0 [ 612.813256][ C0] stack_trace_save+0xa9/0x100 [ 612.813272][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 612.813290][ C0] ? stack_trace_save+0xa9/0x100 [ 612.813305][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 612.813321][ C0] kasan_save_track+0x3e/0x80 [ 612.813337][ C0] ? kasan_save_track+0x3e/0x80 [ 612.813352][ C0] ? __kasan_slab_alloc+0x6c/0x80 [ 612.813369][ C0] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 612.813408][ C0] __kasan_slab_alloc+0x6c/0x80 [ 612.813426][ C0] kmem_cache_alloc_node_noprof+0x384/0x690 [ 612.813443][ C0] ? __alloc_skb+0x1d0/0x7d0 [ 612.813457][ C0] ? kmem_cache_alloc_node_noprof+0x23e/0x690 [ 612.813475][ C0] __alloc_skb+0x1d0/0x7d0 [ 612.813493][ C0] nsim_dev_trap_report_work+0x29a/0xb80 [ 612.813521][ C0] ? process_scheduled_works+0xa8d/0x18c0 [ 612.813542][ C0] process_scheduled_works+0xb6e/0x18c0 [ 612.813575][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 612.813598][ C0] ? assign_work+0x3d5/0x5e0 [ 612.813618][ C0] worker_thread+0xa53/0xfc0 [ 612.813651][ C0] kthread+0x388/0x470 [ 612.813667][ C0] ? __pfx_worker_thread+0x10/0x10 [ 612.813685][ C0] ? __pfx_kthread+0x10/0x10 [ 612.813701][ C0] ret_from_fork+0x51e/0xb90 [ 612.813722][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 612.813740][ C0] ? __switch_to+0xc7d/0x1450 [ 612.813759][ C0] ? __pfx_kthread+0x10/0x10 [ 612.813782][ C0] ret_from_fork_asm+0x1a/0x30 [ 612.813811][ C0] [ 613.123753][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 613.130646][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 613.139779][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 613.149924][ T31] Call Trace: [ 613.153201][ T31] [ 613.156128][ T31] vpanic+0x56c/0xa60 [ 613.160114][ T31] ? __pfx___schedule+0x10/0x10 [ 613.164967][ T31] ? __pfx_vpanic+0x10/0x10 [ 613.169474][ T31] ? __pfx_console_unlock+0x10/0x10 [ 613.174710][ T31] panic+0xc5/0xd0 [ 613.178467][ T31] ? __pfx_panic+0x10/0x10 [ 613.182919][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 613.188310][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 613.194479][ T31] watchdog+0x1023/0x1030 [ 613.198832][ T31] ? watchdog+0x21a/0x1030 [ 613.203258][ T31] kthread+0x388/0x470 [ 613.207332][ T31] ? __pfx_watchdog+0x10/0x10 [ 613.212008][ T31] ? __pfx_kthread+0x10/0x10 [ 613.216606][ T31] ret_from_fork+0x51e/0xb90 [ 613.221205][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 613.226324][ T31] ? __switch_to+0xc7d/0x1450 [ 613.231013][ T31] ? __pfx_kthread+0x10/0x10 [ 613.235613][ T31] ret_from_fork_asm+0x1a/0x30 [ 613.240404][ T31] [ 613.243938][ T31] Kernel Offset: disabled [ 613.248260][ T31] Rebooting in 86400 seconds..