last executing test programs: 4.446280448s ago: executing program 3 (id=3960): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x20}]}, &(0x7f0000000680)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffff97) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket(0x10, 0x803, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, 0x49801, 0x49a41}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}]}}}]}, 0x38}}, 0x0) sendto$packet(r1, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r4, 0x1, 0x4, 0x6, @local}, 0x14) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x14, &(0x7f0000000440)=ANY=[@ANYRESOCT=r3, @ANYRES16=r4, @ANYRESHEX, @ANYRES8=r0], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x40, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) r6 = accept4(r1, 0x0, &(0x7f0000000000), 0x80800) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x44, r8, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x40040) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r6, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x48, r8, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x80000001}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0xa000}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x8010) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x2f, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa5bc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 4.44490151s ago: executing program 4 (id=3962): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x20, r1, 0x5eae78d9c54e9d3f, 0x0, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_KEY={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) (fail_nth: 1) 4.294282138s ago: executing program 2 (id=3964): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd2b, 0xfffffffe, {0x0, 0x0, 0x0, r7, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x10001, 0x9f0, 0x7, 0x6, 0x3}, 0x52}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}}, 0x2) close(r5) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000001040)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001000)={&(0x7f00000008c0)=ANY=[@ANYBLOB='\b\a\x00\x00', @ANYRES16=0x0, @ANYBLOB="000326bd7000fedbdf250100000008000100", @ANYRES32=r7, @ANYBLOB="3001028038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004008a0000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r7, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000100008008000600", @ANYRES32=r7, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000100000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e63650008000100", @ANYRES32=0x0, @ANYBLOB="7400028038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000400000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004001907000008000100", @ANYRES32=0x0, @ANYBLOB="bc0002803c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r9, @ANYBLOB="080007000000000008000100", @ANYRES32=r9, @ANYBLOB="f40002807c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000004c0004000600748f06000000040008faff7f000040000b100e00000045450508a00d0000030008000300000001000704060000000200372001000000050000c0070000000900040c060000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r7, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="3c0002803800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="c4000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000040020008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004001d81000008000600", @ANYRES32=r7, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r9, @ANYBLOB="080007000000000008000100", @ANYRES32=r7, @ANYBLOB="f00002803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r7, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400ff0700003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="7001028038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400000100003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r7, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040001000000080007000000000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400070000000800070000000000400001002400010071756575655f696400000000000000000000000000000000000000000000000089cc030003000000080004001000000008000600", @ANYRES32=r9, @ANYBLOB], 0x708}}, 0x40041) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000640)={&(0x7f0000000380)=@xdp={0x2c, 0x8, r9, 0x41}, 0x80, &(0x7f0000003300)=[{&(0x7f0000000200)="27030200000314000e00203c0003000000000084", 0x14}, {&(0x7f00000022c0)="6037524d630f68287629547bd5c098e381953c405689f3afe4ec", 0x1a}, {&(0x7f0000002300)="3a9bd65e267e793c04ef2f57c99e4b5a4fc32622582fec4c83adc689975966d0608e099cc2d73c11c27ee7ec7cb98dedef95b6db3b9e36283b4b9f8a360a418da633a96149633d143f70788609b34f3d7a133569edc8e23cd6dabf9efa01928eb2bf385c8bf7fd8147380b5c6a90920396fa6b3ddacfc975be41ec5bc6c98e17447a1b95fb8d3bf91e577eb402bdf15ffaefbeb578c5f8bd8837525f537cfd0ec470fdf423e0d72a79f567fc20944492b40d96e64cc83ea242e59d208419cf97fce01cb47ee301da8993cfb16acb850644fbba86278f57751be770bd6f2b05d1143d04bf0ae9b5ad8e440a267bac023adbb23813ac0ba8e7acc790fb9611dfb9adde308024ab49d2617ca5bc55b069e3a5e73aaf87fa6da4e16660fbd4bd894ade6f190ed0fb39686ec70ae00cf01b9fab0ede475559972146bcb8684a59814b85712d22bd755967a022549bf88430512107481617324b5860f344f80c0daee5d32d57b72d02450cd97f21ba0931f94ad8dac43e5e7aa90ddf87da93f53ca8093e8b9d18a10f09d8bdb946bb0cb1cff30503fcc8e6580d83eac90892a51d896b89f5c934f2c86327292b3a76c6ddcf595782d6319bbd49aebcc5ea856649acd94439f6d78860b98cb01f0338eef99adc28af48c2ca68aa36786cf3b6f09d57c48f619ae8f5912fd06eaff92cb3199217c415c024d9f5a21770e24a096e725e4ebe09165253280e8d83e847bb011d7b975cbb864b430955d6feadfad6c4135268968258c8e0505cde214585cd9b4a549619ecaa20ec0b5b35a99cad2ea0638f4e3ec5eb887a0e3ff25e7399c7746946092bbc18b2f2b852621d6d1dcca95d776bedf7666f94906e4f47904b0d975767fea8fa4fb0e7194ec8b9a009b91470015ad9e17786159a8c6c8cc674574d8229989ff466d8b7d83745235c437dc54d3f7526af65462b236c4df362501145f55b037fbe5fb7fcd5043902e8ca3478596b82198fdf6129983f91e7c8225516f94d42d3af77d0a651d577ce9d7bc9027c11de564445444f0562c98df721f573e1fc52b4", 0x2f1}], 0x3}, 0x4041) r10 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r10, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x10, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r10, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="0b000000000000000a00000000000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000020000000a00000000000000fe8000000000000000000000000000bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000fe8000000000000000000000000000bb"], 0x190) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd6012000800183a01fe8000000000000000000000000000bbff020000000000000000000000000001"], 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000880)={@fallback, 0xffffffffffffffff, 0x1}, 0x20) r12 = socket$nl_route(0x10, 0x3, 0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001400038010"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r13, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x3, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1a, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x3, 0x3, 0x1, 0x3ff, 0x4}, 0x4}}, @TCA_MPLS_BOS={0x5}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="000000001d00200028bd7000ffdbdf250a000000", @ANYRES32=r11, @ANYBLOB="04006d0b000005000400000000000c0007000000000007000600000000000e8000000200000001000400000000000100030000000000010000000000000001008f000000000001000400000000000100470000000000020000000100050000000000020000000c000100000000000100e000000100000800", @ANYRES32=0x0, @ANYBLOB="000001000a010100000009a705378700"], 0xffffffffffffff12}, 0x1, 0x0, 0x0, 0x24004000}, 0x8804) 4.171202729s ago: executing program 4 (id=3965): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1e000000000000000100000007"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0xd, 0x3}, {}, {0xfff3, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc4}, 0x20004000) 3.893748291s ago: executing program 3 (id=3968): socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000580)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x7d, &(0x7f00000004c0)={r3, @in={{0x2, 0x1, @multicast1}}, 0x5, 0x400}, 0x90) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={r3, 0x9}, &(0x7f0000000100)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="0000bb0800451900140065000001329078ac14142dac1e0001"], 0x26) 3.787638736s ago: executing program 4 (id=3970): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1, 0x9, 0x5, 0x7, 0xc1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000100), 0x3f, r0}, 0x38) socket(0x2, 0x3, 0xff) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf2500000000", @ANYRES32=r3, @ANYBLOB="138000002b9201002400128009000100626f6e6400000000140002800800", @ANYRES16=r1], 0x44}}, 0x8000) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r6, r5, 0x25, 0x2, @val=@tcx={@void, @value=r6}}, 0x1c) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000e5ceb1b6e27393023f0a3a46c16511807a73e24479446395a2f7ad799af35058d7154c175a489656ee997a20b60bf169a0825055ac18d1e43818ef621a4ae9aea9ab8a941f783ce4161aed7df2c87a0d04fbef5f3e0670703094ff98e14aa458964cd9d0f84ee2d4164c8aecc84bbd7e1d808bae24b2d467dab1cf7c9c28f97cec69f651460a70fcf9f517b713dbc3167979115428b092b7e40a49ec1c883f18437d1d1267db4187d646253e9467dfd328aaa23897ab8355481d5c0a77aad4bf528a05ed567f5779f5b185166ac97f00"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r9, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r10, r8, 0x25, 0x0, @void}, 0x10) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x8, 0x0}, @default, @bcast]}, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000002100000426bd7000fedbdf2502142000050000081400000008000200ffffffff08000d000400000008000200e00000020c000c400000000020000006"], 0x40}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000380)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x2d, 0x30, 0x800, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x3, 0x11, 0x0, 0x0, 0x4, 0xccce, {0x5, 0x4, 0x2, 0x1, 0xff, 0x67, 0x1, 0xe7, 0x33, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}}}}}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x100, 0x70bc25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) socket$inet6(0xa, 0x80001, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) r11 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r11, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @loopback, 0x9}, 0x1c) sendto$inet6(r11, &(0x7f0000000040)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) 2.86937272s ago: executing program 0 (id=3972): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, 0x3, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_SYNPROXY={0x44, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x59db}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x8ff}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0xdd}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0xfffffff2}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x3}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x40854}, 0x200000c0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000300)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000080)=@gcm_256={{0x304}, "174f1802006a377c", "4607a89cbc4f913db7d883093ad776efb47025e8121a09386e8df52827eed8b9", "85beac8a", "b2b4f5f4ef0b0e66"}, 0x38) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r2) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) 2.747625265s ago: executing program 0 (id=3973): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000010640)={'tunl0\x00', &(0x7f00000001c0)=@ethtool_channels={0x3c, 0x1, 0x4, 0x6dd1, 0x4000212a, 0x40000004, 0x6, 0x2, 0x1}}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x336, '\x00', 0x0, 0x0}, 0x50) r2 = socket(0x28, 0x5, 0x0) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) listen(r3, 0x4) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r2, &(0x7f0000000100)=[{{0x0, 0xffffffc2, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) r4 = accept4$unix(r3, 0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) recvmsg$unix(r2, &(0x7f00000022c0)={&(0x7f00000002c0)=@abs, 0x6e, &(0x7f0000002240)=[{&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f0000001e80)=""/67, 0x43}, {&(0x7f0000001f00)=""/190, 0xbe}, {&(0x7f0000001fc0)=""/154, 0x9a}, {&(0x7f0000000340)=""/121, 0x79}, {&(0x7f0000000400)=""/211, 0xd3}], 0x6}, 0x41) recvfrom$unix(r4, &(0x7f0000000140)=""/248, 0x1ffd4, 0x12, 0x0, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xb, 0x8, 0x9}, {0x4, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r1}, {}, {0x46, 0x0, 0x0, 0x76}}], {{}, {0x6, 0x0, 0x7, 0x8}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.751945327s ago: executing program 4 (id=3975): r0 = accept4$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000240)=0x1c, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000002c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x14) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x5, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="10005e016a"], 0x2c}}, 0x800) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CHANNEL(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x100, 0x63}}}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x293c}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x82}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x10) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) mmap(&(0x7f0000096000/0x2000)=nil, 0x2000, 0x200000c, 0x200000006c832, 0xffffffffffffffff, 0x0) 1.695763298s ago: executing program 0 (id=3976): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000200)=0xd9e, 0x4) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) recvmmsg(r1, &(0x7f0000007740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000061c0)=""/1, 0x1}, 0xc5}], 0x1, 0x45833af92e4b38ff, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYRES32=r0], 0x7c}}, 0x24044081) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)={0x18, 0x2e, 0x9, 0x70bd27, 0x25dfdbff, {0x4}, [@nested={0x4, 0x1a}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x84) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000380)=ANY=[@ANYBLOB="1f000000000000000000004bc0d5af00000008"], 0x50) write$cgroup_int(r3, &(0x7f0000000000), 0x12) ioctl$FS_IOC_RESVSP(r3, 0x40305829, &(0x7f0000000440)={0x1100, 0x0, 0x0, 0x10000}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004810) close(0x3) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000540)=@bpf_lsm={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000079100000000000006100feff0000000095"], &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 1.67677391s ago: executing program 2 (id=3977): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xe0ffffff00000000}}, 0x1c) shutdown(r1, 0x1) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) accept4(r2, 0x0, 0x0, 0x80000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x3fe3aa0262d8c583, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {}, {0x6, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40022}, 0x2000400c) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@newlink={0x40, 0x10, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x1591, 0x4000}, [@IFLA_IFNAME={0x14, 0x3, 'team0\x00'}, @IFLA_MTU={0x8, 0x4, 0xd4}, @IFLA_PORT_SELF={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x24044884}, 0x20000010) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000003480)=@newqdisc={0x860, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x834, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x1, 0xfffffffe, 0x9, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x6, 0x7, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x7fc, 0xffff8000, 0x6, 0x401, 0x9, 0xb89, 0xffffe4f5, 0xd6, 0x4, 0xffff, 0x7, 0x0, 0x2, 0x101, 0x1, 0x7ffffffc, 0x4, 0x1, 0x1, 0x9, 0xd, 0x20001000, 0x4, 0x2, 0x7, 0x4, 0x6bdc, 0x9, 0x2, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x44, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x80000001, 0x400, 0x8, 0xfffffa72, 0xcd, 0xffffff80, 0x80000000, 0xc, 0x3, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0xff, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x4fe, 0x4dc, 0x80, 0x2, 0x7fffffff, 0xfc, 0x9, 0xa7, 0xf, 0x2, 0x0, 0x3, 0x1000, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4, 0xffffffff, 0x80000000, 0x1966f9ab, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0xffffffff, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x3, 0xfffffffb, 0x1, 0x0, 0x0, 0x2, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x80000009, 0x6, 0x5, 0x5, 0x4d15, 0x1ff, 0xfffff060, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x796, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0xfff, 0x1ff, 0x8000, 0x3, 0x8, 0x3, 0x9, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x3e, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x4, 0x1, 0x6, 0x1fd, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x8, 0x200006, 0xd, 0x403, 0x0, 0x3, 0x5, 0x10000, 0x7, 0x4, 0x81, 0x0, 0x8, 0x0, 0x9, 0x5, 0xc0000, 0x8001, 0x1, 0x2000, 0x1, 0x8da5, 0x1, 0x4, 0x2, 0x6, 0x58, 0x7, 0x6f, 0x8, 0x3, 0x4, 0x9, 0x1000, 0x4, 0x9, 0x6, 0x80000001, 0x3, 0x1, 0xd4, 0x100, 0xa, 0xfff, 0x8, 0x9, 0x7, 0x7fffffff, 0xf4b3, 0x1, 0x0, 0x8, 0x8, 0x6, 0xd815, 0xfffffff9, 0x2, 0x401, 0x9, 0x1894, 0xf, 0x74, 0xbbc, 0x9, 0x0, 0x6, 0x8, 0x5, 0x6, 0xb, 0x5, 0x5, 0x4e3, 0x200, 0x0, 0x9, 0x9, 0x2, 0x1000, 0x7fffffff, 0x46a3, 0x6, 0x2, 0x1dd50645, 0x401, 0x5, 0x101, 0xbf, 0x0, 0x9, 0x3, 0x65, 0xffffff13, 0x2, 0x30, 0x1a3f, 0x2, 0x389c, 0x4, 0x3, 0x3ff, 0x4, 0x4, 0x6, 0xf3bb, 0x1ff, 0x8, 0xf, 0xb, 0x401, 0x4, 0x1003, 0x1, 0x8, 0x1, 0x7ff, 0x7fff, 0x8, 0x408, 0x3ff, 0x4, 0x1, 0xffff, 0x7fff, 0x2, 0x9, 0x1, 0xfff, 0x0, 0xfffffffe, 0x4, 0x0, 0x101, 0x78f0, 0xd, 0x7, 0x0, 0x1000, 0xf1c7, 0x100, 0x3, 0x4, 0xfffffffe, 0xffffff7f, 0x3, 0x0, 0x6, 0xd, 0x3, 0xa, 0x8, 0x200, 0x0, 0x400, 0x9, 0x6, 0x132f, 0xaba3, 0x1, 0x3, 0x5, 0x5, 0x6f788000, 0xc, 0x1ff, 0x40, 0x9, 0x3, 0x2, 0x1, 0x0, 0x71, 0xb11, 0x4, 0xbc5, 0xfffffffd, 0x7, 0xffff, 0x100, 0x7b58, 0x1, 0x807, 0x1ff, 0x3, 0x400, 0x80000000, 0x1040, 0x3, 0xfffffffa, 0x9a5, 0x8, 0x5, 0x1, 0x9, 0x3, 0x9, 0xffffffff, 0x3, 0x1, 0x101, 0x4, 0x6, 0x598f, 0x5, 0x8e, 0x0, 0xa, 0x9, 0x1000, 0x8, 0xd00f, 0x2, 0x1, 0x6, 0x2a, 0x7, 0x100, 0x24e, 0xbd, 0x2, 0x2800000, 0x807, 0x0, 0x401, 0x6, 0x2, 0x9, 0x7039, 0x4, 0x1, 0x9, 0x1, 0xb18, 0x2, 0xfffffffe, 0x26e, 0x6, 0x5c, 0x8, 0x100, 0x3ff, 0x1, 0x0, 0xb, 0x10000, 0x8, 0x6, 0x2, 0x6, 0xa, 0x2, 0x7ff, 0x1, 0x4, 0x8001, 0x3]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3f, 0x2, 0x0, 0x0, 0x97ab, 0x40}, {0x2, 0x0, 0x3, 0x57, 0x8, 0x3}, 0x1, 0x2, 0xa2d}}]}}]}, 0x860}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r12, 0x0, 0x0, 0x4000050, &(0x7f00000001c0)={0x11, 0xf7, r11, 0x1, 0xd8, 0x6, @multicast}, 0x14) r13 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 1.581582866s ago: executing program 0 (id=3979): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x1c, 0x0, 0x5eae78d9c54e9d3f, 0x0, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) 1.110662393s ago: executing program 4 (id=3980): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007912b0000000000097"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0xfffffffffffffffb}, {0x3, 0x0, 0x200000000000000, 0xffffffffffffffff}, 0x800}}, 0xb8}, 0x1, 0x0, 0x0, 0x840}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x2, 0x0, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="040100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001200000080001"], 0x104}}, 0x0) 1.105440188s ago: executing program 3 (id=3982): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200000700003b000000000080000085000000750000009500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @rand_addr=0x1}, 0x2, 0x4}}, 0x26) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x4e23, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffff8, 0x0, 0x6}, {0x0, 0x20000000000, 0x400000003, 0xfffffffffffffffc}, 0xfffffffc, 0x0, 0x1, 0x0, 0x3, 0x1}, {{@in=@rand_addr=0x64010102, 0x4, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r4, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) shutdown(r4, 0x1) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) 1.104472893s ago: executing program 0 (id=3983): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a30000000005c000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000c77f140000001100010000000000000000000000000a"], 0xa4}}, 0x0) 1.093229165s ago: executing program 1 (id=3984): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000380)={r0, r2, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xffe, &(0x7f0000000b80)=ANY=[], 0x0) 1.091139647s ago: executing program 2 (id=3985): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x3c, r1, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000000) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000440)={r4, 0xfffffffffffff840, 0x4, 0x5}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000440)={r4, 0xfffffffffffff840, 0x4, 0x5}) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000580)={{{@in=@private, @in6=@empty}}, {{@in6=@empty}, 0x0, @in=@remote}}, &(0x7f0000000680)=0xe8) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000580)={{{@in=@private, @in6=@empty}}, {{@in6=@empty}, 0x0, @in=@remote}}, &(0x7f0000000680)=0xe8) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000200)={r4, &(0x7f0000000000)='-+\x00', 0x4302, &(0x7f0000000100)={@_ha_fsid={[0x7ff, 0x4494]}, {0x5245, 0x200, 0x8, 0x8e22}}, 0xe2b6, &(0x7f0000000180), &(0x7f00000001c0)}) write$cgroup_subtree(r7, &(0x7f0000000480)=ANY=[@ANYRESDEC=r4], 0x20) syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) socket(0x28, 0x0, 0xfff) (async) r9 = socket(0x28, 0x0, 0xfff) getsockopt$IP_SET_OP_GET_BYNAME(r9, 0x1, 0x53, &(0x7f0000000280)={0x6, 0x7, 'syz2\x00'}, &(0x7f00000002c0)=0x28) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0xffffffff, [{0x0, 0x3, 0x6}]}, @ptr, @restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x4a, 0x0, 0x8}, 0x28) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000100000004000180100002800c0001800800010016"], 0x28}}, 0x0) sendmsg$nl_route(r9, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=@getroute={0x14, 0x1a, 0x121, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0xc0}, 0x10) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'bridge_slave_0\x00', 0xc201}) r11 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) (async) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socket$can_bcm(0x1d, 0x2, 0x2) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfe, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8a1, 0x2, 0x2, 0x4, 0x7}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$kcm(0x10, 0x2, 0x0) (async) r13 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r13, &(0x7f0000000000)=ANY=[], 0xfe33) (async) write$cgroup_subtree(r13, &(0x7f0000000000)=ANY=[], 0xfe33) socket$packet(0x11, 0x3, 0x300) (async) r14 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r14, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0x1, 0x81, 0xfffff034}, {0x20, 0x0, 0x0, 0xfffef010}, {0x6}]}, 0x10) write$tun(r10, &(0x7f0000001240)=ANY=[@ANYBLOB="3a2f080000030500010000000000450a0fc078acf703"], 0xfce) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2a042, 0x41c23}, [@IFLA_GROUP={0x8}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x4, 0x3}}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) 1.089591822s ago: executing program 3 (id=3986): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000540), 0x0, 0x4000800) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3e8, 0xffffffff, 0xffffffff, 0x3e8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0xffff00, 0xff000000], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x88}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [0x0, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'gre0\x00'}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[]) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') r5 = bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x48) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFDSTADDR(r6, 0x8919, &(0x7f0000000000)={'lo\x00', {0x2, 0x4c23, @loopback}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0xf, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x95}}}, &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000}, 0x94) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=@newtfilter={0x60, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x2, 0xfff3}, {0x0, 0xfff3}, {0xffff, 0x10}}, [@filter_kind_options=@f_flower={{0xb}, {0x30, 0x2, [@TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_FLOWER_ACT={0x4}, @TCA_FLOWER_KEY_IPV6_DST_MASK={0x14, 0x11, [0x0, 0xffffffff, 0xff]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x3c, r8, 0x1, 0x4, 0x1, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x20}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48c1}, 0x20048000) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYRES32=r0, @ANYRES16=r8, @ANYBLOB="00042dbd7000001000000b00000084000380080005006401010108000500ac1e000a080005000a0101001400060000000000000000000000ffffac1414bb060004000600000006000400050000001400020069705f76746930000000000000000000080001000100000014000200776c616e3000000000000000000000001400020076657468305f746f5f7465616d000000"], 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x40094) 1.085921933s ago: executing program 0 (id=3987): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000a80)={'syzkaller0\x00', @broadcast}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0xb, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) recvmmsg(r4, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000000c0)=""/55, 0x37}, {&(0x7f0000000700)=""/197, 0xc5}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000000940)=""/74, 0x4a}, {&(0x7f0000000340)=""/249, 0xf9}], 0x5}, 0x5d}], 0x1, 0x10022, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x3}, 0x28) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x0, 0x37}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r7, 0x2, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xd, 0x6, 0x4, 0xd222, 0x0, r8, 0xfffffffe, '\x00', 0x0, r6, 0x2, 0x1}, 0x50) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0xa300}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCI={0xc, 0x1, 0x8}, @IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x50}, 0x1, 0x0, 0x0, 0x24008000}, 0x800) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r10, 0x6, 0x1, &(0x7f0000000280)={0xf3, 0x1bc, 0x3, 0x3, 0xa, 0x5, 0x40}, 0xc) recvmmsg(r10, &(0x7f00000024c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x1, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYRESOCT, @ANYRES8=0x0, @ANYBLOB="00080000c31006002800124ab613c725e584bf001c00028006000d0041000000080003d9f701010206000e0009000000"], 0x48}}, 0x0) 1.084749393s ago: executing program 1 (id=3988): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000006d00673c2bbd7000ffdadf2500000000", @ANYRES32=0x0, @ANYBLOB="0110040004b9040018"], 0x4c}, 0x1, 0x0, 0x0, 0x4000014}, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000600)=ANY=[], 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bind$netlink(r2, &(0x7f0000000480)={0x10, 0x0, 0x25dfdbfd, 0x40}, 0xc) r4 = accept(r3, &(0x7f00000002c0)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000340)=0x80) ioctl$BTRFS_IOC_SEND(r4, 0x40489426, &(0x7f00000003c0)={{r0}, 0x5, &(0x7f0000000380)=[0x3, 0x3, 0x100, 0x5, 0x1], 0xfffffffffffffff9, 0x2, 0x1}) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @last={{0x9}, @void}}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x40) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x10000005, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, '\x00', 0x34}}, 0x1c) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r4, 0x4002f516, &(0x7f0000000440)={0x2, 0x40}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c01000011002300"/20, @ANYRES32=0x0, @ANYRES32, @ANYRES32, @ANYBLOB='\b\x00.'], 0x14c}, 0x1, 0x0, 0x0, 0x40080c5}, 0x4000000) recvmmsg(r0, &(0x7f0000007a40)=[{{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000040c0)=""/13, 0xd}, 0x8}], 0x2, 0x40000023, 0x0) 927.805674ms ago: executing program 3 (id=3989): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000003feffff720a00fef8ffffff71a4f1ff0000000071302000000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a00ff040400007203000000000000b500f7ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3380d28e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51bf900000000000000d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93020000000000000080e69db384ac7eeedcf2ba3a9508f9d6aba582a896a9f1e096df6ecea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6032399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0xb83297c01978451f}, 0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x2, &(0x7f0000000040)=@raw=[@cb_func={0x18, 0x7}], &(0x7f00000000c0)='GPL\x00', 0x3, 0x26, &(0x7f0000000100)=""/38, 0x40f00, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000140)={0x3, 0xb, 0x2, 0x5}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0xffffffffffffffff, 0x1, 0x1, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000001c0)=[{0x5, 0x4, 0x1, 0x5}, {0x4, 0x5, 0x6, 0x1}, {0x3, 0x4, 0x7, 0x6}], 0x10, 0x3}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@cgroup, 0xf, 0x1, 0x200, &(0x7f00000002c0)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0], 0x0}, 0x40) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x14, r4, 0x2, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0x80) r5 = openat$cgroup(r1, &(0x7f0000000480)='syz0\x00', 0x200002, 0x0) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000500)=@generic={&(0x7f00000004c0)='./file0\x00', 0x0, 0x4}, 0x18) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000400)={@cgroup=r5, r2, 0x32, 0x14, 0x0, @void, @value=r6, @void, @void, r3}, 0x20) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r10 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r0, 0x0, 0x25, 0x2, @void}, 0x10) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={@ifindex=r9, r0, 0x26, 0x2002, r0, @value=r10, @void, @void, @void, r3}, 0x20) 919.594997ms ago: executing program 2 (id=3990): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x4e20, @remote}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000004540)={r1}, &(0x7f0000004580)=0x8) 830.816651ms ago: executing program 4 (id=3991): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r2, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) r4 = socket(0x10, 0x3, 0x0) r5 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000380)=ANY=[@ANYBLOB="1400000004000000080000000600000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000066e7fc9573b6e9409d46926b2ac2a3d702d36a2ef43db9abc85cc1703cfc3eba18a996da5eeadfd6fde3c54cece279494396ad73d68e"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r5, &(0x7f0000000b80)="f4ceb2ea27c15211cf0bb0fdba18fdf76b3b570a68cec371a2a274915294706b3019a0229d92fe2272d021eca7ad2fbf8986c85a3eed50278d71830acfeb557df089bf3bb2a71c76af6d27fc4c9bcf531887357cdc6b1286f5aac6705681fbaabd3717b85453a41ecd3ff70dfbd6989abeaa1b332e9fb7ac46f5be58f02e3d721a9991a8cd02dd34033158beff102890062818acf8008b344f652db9d318ab050cf58647f4e2bd5b6d5df89241bd37939a4855e09af352767e28573a757b8875e8a56b9f0c9137e03def77122cce3063c4dfe07d369c39c8c478c22a7641675e71ce205f10dc18877f1891402c9e04a27b3f15870c265f1cc3bac09fa50da1208739007b4cb429197b3c77998726985e2709376338ebea411c09c1bccb55bd7b520942aad7bb7fa019ebd0f05efd48eb48afda3171cdea02a94d3e7118cc824917f7a18466b6c85cbcbb405a4107b1b660895b54a0328c605cb4c2a5501c4180a292a557827788fbddb462d2ca50c053b2b31691531e86a46600002df422339917c6ea0a9082ecc13e792def10ce80056bbf4a7e168ad67079b4bb60ead8a23d939ee47bf622b1a3ea18a4f3970f793ad50c16cdd37613bbd8d8ce21035f7620355be4e21018aa0239054270dad4b2a28d559889dee4c08dd06fa7bdd0755b354b8b1ad30c19cf62f313c4eb1b9f26ce95fd05f00e9696330a163129efcfe174b2425789225a844b7875e337bfc59cc961af15f189fa74bfaf37a70b27dcf59e6eebb84fe2b69254a349cc5051b3b5ce9a69db754db894eaa00409789e0a4bd333bb1410e19a593f966ae9a2eeed1e6ce5202dfde44bd68a52f6fcd9097e5322621caf59a4f849ccb41ef777", 0x0}, 0x20) r6 = socket$isdn(0x22, 0x3, 0x23) r7 = socket$kcm(0x2b, 0x1, 0x0) listen(r7, 0x6) setsockopt$sock_attach_bpf(r7, 0x1, 0xd, &(0x7f0000000080), 0x24) close(r7) getsockopt$IP_VS_SO_GET_INFO(r6, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000080)=0xc) ioctl$XFS_IOC_GETBMAPA(r0, 0xc020582c, &(0x7f0000000340)={0xffff, 0x3, 0xfffffffffffffff8, 0x7f, 0x9}) r8 = socket(0x2, 0x80805, 0x0) r9 = socket$inet(0x2, 0x80001, 0x84) r10 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000180), r4) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$MRT6_ADD_MFC_PROXY(r11, 0x29, 0xd2, 0x0, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(r8, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010028bd7000fddbdf08000000c2dd00040002000000094d00006c690004080002009b000002"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x40) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r8, 0x84, 0x74, &(0x7f0000000200)={r12, 0x5, 0x20}, &(0x7f00000001c0)=0x18) setsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=r12, 0x4) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000300), 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="020000000400"}) 735.769864ms ago: executing program 2 (id=3992): socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) socket$inet6_sctp(0xa, 0x5, 0x84) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000000000300040000000000000000000005000000000000000000000b010000000000da279a0af6e7a1e93633b6035360e201de8e66b65b54a69e771b40a5096d3bc8d47c67f8346aa7d771935bfc95754e7b0136bd7288c8672d9d2b1a1dbe263e590ddbf01de5b3c8fea7360b834a9769b3c6ab8e7843"], 0x0, 0x3e, 0x0, 0x8, 0x3}, 0x28) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 32) socket$unix(0x1, 0x5, 0x0) (async) r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xca) bind$ax25(r0, &(0x7f0000000280)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @null]}, 0x48) (async) pipe(&(0x7f00000001c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf2500000000", @ANYRES32=r3, @ANYBLOB="138000002b9201002400128009000100626f6e6400000000140002800800", @ANYRES16=r1], 0x44}}, 0x8000) 650.192547ms ago: executing program 3 (id=3993): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000002540)="955232d6c924037daed352087a08237337131faef13945bfaaa58d01e5f858e96271cde18577054eb145e62abd8150646072c75137606c9eca87c894182ee54fa975990ac5f7b8f2ced1bc37588f08efcfba84054e1bf5de3ae4fe95d64222f92b12be73478c249144accca8d10df2f204b2905167cb97972c40265e6b4af404adc8f6cf85253346cfeb6eb585e3f0692ab9d35d7850e3d62a948b5c9b", 0x9d}, {&(0x7f00000001c0)="96607e121729ff5ba084661b14fc7202e7b54c2be7983a4e4e11a8906105f36f652d7135bda20b939abb9b959973ca1f755aa9e545c8fb8876d07fa49e24824ff9719993882242846b", 0x49}, {&(0x7f0000000500)="648a6282c6e91b973836904a4a88affa0c371dd1b9c133c5e594714579d6bb3addfd43e78272aef64427ce5467d6994320cf139092452c7944ddab49e459f7e0c73f890e9e2463bd3390e20b1e472bd2aedb47094547a767a098a94a402e6aba65c0ef07eaa87f8663c763d9bb491243eb129eec434e5603956c8333a6ecdf4d3a601b9c8d3d63e3a4a57b38033e2b004f6c3e45f1645c3b7ca0d5ba5eea059b5aa4f0f80ac66904076cc60e47e1afc7d81ad937dee5efc0580e38d96cf0f53808f37d5a8811b07165e8b9aabceac06e4fa7f7668b8832877783a727a1fa8b972bfaeb232cf3e9b500965820f4adf64f1e5eddd65f5734fb43644347e98af7eb6abe95dcb6ed1acc22c8abdd5ea116242d5b7b2ecff3d9c635bce6a377112b4adbd75b71fcc8a6e3693c82ed7fd11ad63683cc89f0a35b", 0x108}, {&(0x7f00000007c0)="a96a428426d96522dbf395b96cda5289bbfe3d97be8f413c48ec17c91194c66443ac9ed513c32242f54abb9a8ad671c6786dd7161962a8cf0dc4c7c0a1f86f7d1b17cc1660980f64e0b66a61b77eed3c8497ff551a20db0aa749c5ed3d49c05b1f787665fc8ed059d872289988b78549f8e5f01c2dab0e462f618669d1ca60666c010a55e46421284abe14fdfa39da550161c5410c37fbd11866c3e2f710e557408f5c4a5d494e87bcacc70ecbc69322da9f6a2388ffece43aeee909aa68d00e2137407fbcf0e749eb6ef98960c1ed54e532722c05c0038e8a9c25a560b3569cc7928a66d41c3dcf80263869467cd8a905d56a7b327d0354d81554f98b1e85ae5d86502a1b3ed1e250f71cb5c5b7aa755326d9d6ab836db15f6107023fe99229e48a9008bd8ed0141577f1f1ea58b10e6ceeacfe98ff142e57f0dd1c88ae37752e200657282cda4177730d24a77a941e21675fa53da47992cce0a954ae826fff35039dc74bd9d0e5973ee99b00200cff625fb828ebc36189f3013291fe121a0810e1008854633b5890b810817609e8311f2e34cf3b78d666a1207a4fdbf77cc2d87410bb8533054f39eeff0602c72476ea86bbd68e3bf4976c16a3a8d60b4fa1c1ff02275718e1f7028119bcb785b0d95369dea71f559a32891ad8b3ef21b0f43f8db1f88fc0984c24ea1a38bc89b3b23c4cf9a67ad08f3fb635736350dfb726f8177efadd377073ba05878ab62d2a18481922e6c48f09f057aba001fb8eb233eb23a67e74d006bdaad1fa9a8a622c17947f34b89d0fc0a6dd3a7b6fa0beabb98875112036ab1ec22090369dc72d3c385b2679f0b99af9bcc6ef785c0b51473d8864ec867ea3c754856199152f000b2afe739b5c568c1619d2af08fb2fc6844fac0035cceb0d0656d3af9bbd686fd99275e7f81aeafd33481c5778b279e5870348ec4495684bdcb71c0c8131cdc8330159d8c92adb613dac99fedb3c50c22243ee61ebb8645f94cd0994b02c5f5b544887b11b2fd3655e115889ebeb8617eb1cdb5dbec30c407ee4f09d17d2ecca77b25604cfbd308a91b0b2e8cd1249a2e1f441989657efc8584ceb7e443f2ae30191c5623b06fac91bab61a40f31f2863b4b508998ded6abd8f55e503401c2e9e298655d50ab3f775f9159d0765b4ee1fef3aa1fe608d5dade41cd16a3c1ec7868b18ff3f1449d3900f7d77489c1bb4cdb99beac51942f8a7c4ab3e3a43e13b6c69b63623a970aec5426b58c63d9ffc229efb58e7b58eb27a12b91c4a0f253e1d5f13e59ffcecb003c5e46b1cc236b9fe508b37c3f2046c53eabbc2a7b1f2c0d04a86ba8918239e1dda997c5612fb43dc86905f79f1503ac47d5ea8399dc5d5cc284a3a789d77cc5e887ce3c25ae3f7a636429873970930ebdeec9690b62f46f480a4a102cfa3ce2a61f056bedf3ca698c4f2666bf55f035daca9fb2efcfd96d18cb7afd6e2592e460c4638f261a4a7a85c290c78a921edbc01e2d7a60c6b6a2608fb52f31b73471dd610f3703242273de21261656df6cd8c3847c730819e402933a40a4c560d9651a95764179f4a1a39e60c80deece7b0eacbafd5efe40eee56424b3e0921524397bd4f554e4a0ccc6e9b2be09e0ae6810a9fef7b027ee3cff9b5e674f793579eac25cee7c4e9351a8d7412e2c6cf9ba4082059a35878771744b8d0c572e10250035630b30db9030bf67c6dca054f6a219c51984f37ec9a2e2ac6e85d97475e5821bbb376af98e1e180cd94c22a2246dc757da46421b85487b7291f68fa595451999c32c869cbabcfe6be628f0909bb62ee174c97bef3f92fbb1072d66b5d28427b1695913bb86759fc20c74acf75df87ded19a81966e7dda1be3cec73f23df8b255ceff270af0ee99253426f5d4866afd89766c498652d5c5f6d4d3d6fbb52931b10613ba80a3d8a23464c30414e89897b90d5e0c90f0c72931b5ad4cbf69c0fc2eda242a56a789af5f4f0f0fb51f26c7a102ce6e0b76cf3a1f84de55f21df446ec9b9409cd1fb919b02a515994166e7ae29ad0783e0adf2c4296ed7fc19c84378a35e83f739a3e370faef047ef39fc7926ebf06f09db535aae1d5558f83f1e434556de25e6d2aa78d4eac784a7407521e1626d038d652d0320c0558c42e9e9ac731404c26248934d23dd3a8812de7622c230888db650f7846770ddc8059447fd03ccf862574d9b548054afb63e32986caf80a57fc2fa01d904ec94ad1c8b6cb56cb782b47b5a5626ab094c196e2e1f9fd25a39ec1ad45a7ae94c9ae64ac4bb45c828295c195fbfed9171d142fb8ece8af614953ad5ca1e5d65c52c4d9633c458b5e788bfd3469328b9e6e4df03f3da9e5d3d11284e791a67d0856666ee21f8ea4b1d76d7a1f07863756029a4b5cb820edb63dc0efe6fc2577a79383f280f241b35dff9cfb92cf04451f5767f95e5d5ff0c808acddf406127e9ceb8d1f55749a5781e9b185e45072d181d069c715febebc1ab63126697d145d63b3a41ba202a387dcfdfbb96de0d05454fecc286fd296bb10d498b49d3bcdeda3035699837dfac86ce61641ee7105f4b441031bea7ae0d1787bf772cfa2f48c3062d232b23b5b328e6ea9e0de0130db2500e37d28a52c490b2fa9d39c3d5c9b8a298f2aeb348b962fee1d6a7d6d2c661113c2b8101f39dba91a3199bab5b70f5bed7871580b54bf34f2851c14b69e16ad97223ab8eb0b2725e00efa7b1e75264a65ad61cfca62f6d5d651c193c123f9bf77b3aed591e8161b767fc2977b56f3849362559dffd3414ef1e5cb2d611f7bb3d7d4c28c0a6de2993eb89c0805622f9fe4136e856e103d931aae07469efc077f9dd6df11c1eeba7468ca78e2e8027b2f672f9b965a6d88756b531321fb181702794ce58299b0cd34e481dc6760b4f9b32cfae5e0a35b4a19a4dbd26870bcb8ccb7724a294b10697763d6b3f7141bf7ca09d0871dceaf364f5aca649d77203328b8ad463a144961595e978043be434cd08dd5120bc36c5d895745ce5cc10f9a7f22baad125d60beaeb8c98279f5b3a363eda42bfc9fef669b2f4fb663700dcc5a47515b9adec65cc99cfea4cc2246dcdff878eae17441c69f4127c49fdd7935bb0c0c8053c9b788aa74a7ff174b7fc8b36ddc5ffa89fe7a98a14805ce96447e00a8b32b3f46af448aa29f326d03477bde78b147fec195cc5b253becf53a80f08ddde4529c2f53f40eb59f8598ed0c045dd60cb8ee90669091d1e2e970791f687db9b28c43c74813b6364b3a0f5762bfaa867bcdd7d44d0eccc1e0149b6ba5c4412b16493330a41352c682dfd88aff599459c6d7beb392925338e9bb1469f59dc833d0e685dc8ac9fc708123d1a1d483e6ccd45f58edac266f5517f5711402a83bacb634e4a28e8d32121be30a2aaeb2adc5cc3e2b0d15cd94b4fab7f37ffa77e477099ea6dd6167e292921f5957fc4e2f3c7a1396e60154bb638dccb5fd0d7bedc36591901dbd5cf63914c401fc79036f4a26f7b4df5fd776b7ef156c33a180ec8615ec6f24659794da3af2cb75a5905b891a0b269405d4471fbeb3e90b19f502f0b36a32f9f8bbac6a1fa6fb7a50cb563b4fa41d0f2639da50773356cce00000000000000016721701a47a54d76c93fbd00f408c270897159bf168ab2ec326978f48f7d845b6e64d856de829fd8b45b86489abb7537e372df0ddc96ed4826ee76b28d8999d7e170b1db1dc9316d51504f7cf7740f354f0255f83a31ef9c8e70d33a256e909bad11ae1217f66260dc5c52682a6e84fec98221de47463b6d37b6a100fe5893b668d316b78f1cc0f67c481c50e275d4613a0b2acf73f86898b2506dc72b427e0476ab342f3c18b0949ee09c2d56154fc7b36a44c0771851186e83619f73945258dfe80304a591b2fe7057e80a2127c5e8b00c6d4809e72d931ffd7bce4b4d9fce0cf6135c47ad63fd7f9ed8beba4de84c087fcd42eaf8474a01bd752bba36dd487c0ae725f8e7ec695aa2958616f6c59413f235f176300a9457d3caf0b4e972b6b9339b4de6e7bf29aa1af48de7a834700a9c999c0198b3f6234aee737c96e02120b79725322aafe19139cc725db0b578cfccd8666b66ae8e034e4240768f03e0ff8ee072245b28f42ceb784133e99071b36709992fa81a9736d89018a2b361877a2fb05bceb0bfa5ee0eb7fc5d78c534f6ea4edcd0f530067c530f7bea92bddc9c61b268d5bc1ad3ff852ab93f3e810002133d0d8e16b1d71e1db2bdb91d416a6bfcb4864d58da1758abff7ca03d379bd48b03f019c33c434bdf25822465ae322b38ae83dd90597db8c781f48efedb66da368f3d9f67f27612c51c07b9aeb419c32ff028a77e3abc5bd531d7bb29bd1c6c1119820abfd881f660e5a7072cdbc0e888d97cbc2105782204f34d093c1e0e6195e51e2e8b639a0f656aa21e29d0fa2a2f868b77995e7ada252a30a31b219be7c1b107ddd737654546340e424f13521ed73f0ed33ad3664f1b9b68eee0f7255119d585c09a2467b22de08104a37202cb737e934b1bdb83102b680d9cfd21c55fd00e33fba7651b2c36a87272945c371303c7e4ca181c1f7d2fe09815c1732d8d777e7b9a430d6b237c7c9fc8758e8456fb4e6ffc2aa421ab5942204e54cb52197e14aae9ae34376ac1d56d009f07babcb3d3492c87faf3e44bdd7d16dbce8148e2c7cb44d30ca29908aaf7c9ef39e791a9a988a5381942e3daf05f85be245f4ef26b08d83b1c1b58892b462783dc27602d8931d3232e5be295d479f9600cc4c3ed2e6a2fbb925c602d251b13f2ec2b7ca99fcd4bc2aa6115ddb0b842ed35c70d867734ee7518fd5299e07818f024a1682aacaa4e28d9f5db71006beb8bcc1e3a43cf27fb3d9475fbd632912d83f4e95b4390068f55f2f832a2e2c9f4ba5ca59d185a655375c6f5779d9fe5a47d1f417cf6f6405eab89f755f9a90623270c2b2a444b6b79662964199f7bedd2a2939e03ec6a334b78a6166ebf70562819a273bb6de9a3d7c2383a569cbeb08859e742ec5f947d1817c2dbfa3b72e5d3afdc4582cad9e25ba954234522bd33e6c6d3fda50a90a33f5c8d7746f3c7c70fd3b7", 0xffffff50}], 0x4}}], 0x1, 0x4044805) splice(r0, 0x0, r2, 0x0, 0x8000000000025a5, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7c, 0x7c, 0x9, [@restrict={0xd, 0x0, 0x0, 0xb, 0x1}, @int={0xf, 0x0, 0x0, 0x1, 0x0, 0x58, 0x0, 0x1f, 0xc54a8d79ceb72ce7}, @type_tag={0x3, 0x0, 0x0, 0x12, 0x3}, @ptr={0xa, 0x0, 0x0, 0x2, 0x2}, @restrict={0xf, 0x0, 0x0, 0xb, 0x4}, @enum={0x2, 0x3, 0x0, 0x6, 0x4, [{0xf, 0x95}, {0xd, 0xcdaf}, {0x6, 0x3}]}, @enum64={0x9, 0x1, 0x0, 0x13, 0x1, 0x3, [{0xe, 0x5, 0xfffffff9}]}]}, {0x0, [0x5f, 0x61, 0x0, 0x61, 0x2e, 0x2e, 0x61]}}, &(0x7f0000000580)=""/189, 0x9d, 0xbd, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="180000007bf40000000000000501000018110000", @ANYRES32=r0, @ANYBLOB="0000000000004000b702000014000000b7030000000000008500000083000000bf09000095000000000000002f50ffff00000d91bf91000000000100b7020000000000008500000084000000a7000000000000009500"/104], &(0x7f0000000200)='syzkaller\x00', 0x431, 0xed, &(0x7f00000003c0)=""/237, 0x41100, 0x3, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000680)={0x5, 0x5}, 0x8, 0x10, &(0x7f00000006c0)={0x0, 0x0, 0x2800000, 0x9}, 0x10, 0x0, 0x0, 0x7, 0x0, &(0x7f0000000700)=[{0x1, 0x5, 0x3, 0x2}, {0x3, 0x3, 0x6, 0xe}, {0x3, 0x5, 0x9, 0x4}, {0x0, 0x5, 0x9, 0x4}, {0x0, 0x3, 0x5, 0x8}, {0x0, 0x3b67, 0xe, 0xc}, {0x2, 0x3, 0xa, 0x7}], 0x10, 0xfffd64fc}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(xeta-generic)\x00'}, 0x58) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000800)={0x2, {{0x2, 0x2, @multicast2}}, 0x1}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x40010, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="560a00000000000061194c00000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) socket$pptp(0x18, 0x1, 0x2) accept4(r4, 0x0, 0x0, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000100)=0x4, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000001280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0x5, [{0x1, 0x4, 0x18}]}]}, {0x0, [0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x3a, 0x0, 0x6}, 0x28) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0x19, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b705000008000000850000006a00000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="763894147583ddd056fea56a8800", 0x0, 0xe00, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x300}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) r10 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r10, 0x107, 0x1, &(0x7f0000000080)={r11, 0x13, 0x6, @local}, 0x10) 616.688788ms ago: executing program 2 (id=3994): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="20000000250009012cbd7000f9ffffff020000000400110008003f00", @ANYRES32, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e22, 0xcc15, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9}, 0x1c) socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0xf3a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000380)=[{0x0}], 0x1, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) listen(r2, 0x5) sendmmsg$inet_sctp(r2, &(0x7f0000002880)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="30000000000000008400000001000000000002000001"], 0x30, 0x24088081}], 0x1, 0x8000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r5, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r5, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x11) shutdown(r5, 0x1) write$cgroup_int(r4, &(0x7f0000000200)=0x10001, 0x12) sendfile(r4, r3, 0x0, 0xf03a0005) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, 0x0, 0x4000084) write$cgroup_type(r7, &(0x7f00000000c0), 0x9) sendfile(r7, r6, 0x0, 0x10000) 191.865296ms ago: executing program 1 (id=3995): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0xa020200) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) 126.0585ms ago: executing program 1 (id=3996): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, r0, 0x300, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x70}, 0x1, 0x0, 0x0, 0x4884}, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000180)='\xff\xff\xff\xff\xff\xff', 0x25c002, &(0x7f00000001c0)={@_ha_fsid={[0x6, 0xd764]}, {0x92f, 0x6, 0x8, 0xfffffffffffffffa}}, 0x3, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)=0x8}) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x6, 0x0, r1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x4}, 0x50) r3 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@o_path={&(0x7f0000000480)='./file0\x00', 0x0, 0x4000, r1}, 0x18) getpeername$packet(r1, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000700)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1d, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5b8, 0x0, 0x0, 0x0, 0x81}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@jmp={0x5, 0x0, 0xd, 0x6, 0x7, 0x40, 0x1}, @jmp={0x5, 0x1, 0x5, 0xb, 0xb, 0xffffffffffffffe2, 0x10}, @alu={0x4, 0x0, 0xa, 0x1, 0x10, 0xfffffffffffffff8}, @map_fd={0x18, 0x3, 0x1, 0x0, r3}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000600)='syzkaller\x00', 0x9, 0x56, &(0x7f0000000640)=""/86, 0x41000, 0x40, '\x00', r4, 0x0, r1, 0x8, &(0x7f0000000740)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000780)={0x3, 0x4, 0x40, 0x1}, 0x10, 0x0, 0x0, 0x2, &(0x7f00000007c0)=[r1, r1, r1], &(0x7f0000000800)=[{0x2, 0x1, 0x10, 0x5}, {0x4, 0x2, 0xe, 0xc}], 0x10, 0x120}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000980)={{r1, 0xffffffffffffffff}, &(0x7f0000000900), &(0x7f0000000940)=r1}, 0x20) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000b80)='memory.events.local\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0xc, &(0x7f00000009c0)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_val={0x18, 0xa, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0xc22}], &(0x7f0000000a40)='GPL\x00', 0x401, 0xe9, &(0x7f0000000a80)=""/233, 0x41100, 0x5b, '\x00', r4, 0x0, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) ioctl$NILFS_IOCTL_GET_CPSTAT(r3, 0x80186e83, &(0x7f0000000c80)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000cc0), &(0x7f0000000d00)=0xc) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000d40)=""/208, &(0x7f0000000e40)=0xd0) socket$isdn_base(0x22, 0x3, 0x0) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000010c0)=@bpf_lsm={0x1d, 0x17, &(0x7f0000000e80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0x3f}, @map_idx={0x18, 0x5}, @map_fd={0x18, 0x3, 0x1, 0x0, 0x1}, @jmp={0x5, 0x1, 0xd, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @generic={0x4, 0x5, 0x5, 0x898, 0x5}, @generic={0x4, 0x8, 0x0, 0x6}, @printk={@x}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, @ldst={0x3, 0x3, 0x2, 0x5, 0x5, 0xc, 0x8}]}, &(0x7f0000000f40)='syzkaller\x00', 0x2, 0x25, &(0x7f0000000f80)=""/37, 0x41100, 0x40, '\x00', 0x0, 0x1b, r1, 0x8, &(0x7f0000000fc0)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000001000)={0x2, 0x0, 0x0, 0x9}, 0x10, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001040)=[r6, r5, r6], &(0x7f0000001080)=[{0x4, 0x5, 0x5, 0xb}], 0x10, 0x7}, 0x94) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000001200)={'syztnl2\x00', &(0x7f0000001180)={'tunl0\x00', r4, 0x40, 0x80, 0x4e, 0x8, {{0xa, 0x4, 0x3, 0x8, 0x28, 0x66, 0x0, 0x7, 0x2f, 0x0, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp={0x44, 0x10, 0x4f, 0x0, 0x0, [0x1, 0xa, 0xffffffff]}, @ra={0x94, 0x4, 0x7}]}}}}}) ioctl$TUNSETSTEERINGEBPF(r6, 0x800454e0, &(0x7f0000001240)=r7) socket$caif_stream(0x25, 0x1, 0x5) sendmsg$nl_route_sched(r1, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)=@deltaction={0x4c, 0x31, 0x10, 0x70bd27, 0x25dfdbfd, {}, [@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffe}}]}, @TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4001) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000015c0)={{r1, 0xffffffffffffffff}, &(0x7f0000001540), &(0x7f0000001580)=r6}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001680)=@bpf_tracing={0x1a, 0xd, &(0x7f00000013c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xcea}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xd3c0, 0x0, 0x0, 0x0, 0x20000000}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x3}, @call={0x85, 0x0, 0x0, 0x75}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @cb_func={0x18, 0xb, 0x4, 0x0, 0x7}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x1}]}, &(0x7f0000001440)='syzkaller\x00', 0x8, 0x63, &(0x7f0000001480)=""/99, 0x41000, 0x10, '\x00', 0x0, 0x19, r1, 0x8, &(0x7f0000001500)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xee8a, 0xffffffffffffffff, 0x4, &(0x7f0000001600)=[r9, r2, r5], &(0x7f0000001640)=[{0x0, 0x2, 0xd, 0x5}, {0x5, 0x2, 0xa, 0x2}, {0x2, 0x2, 0x2, 0x4}, {0x1, 0x1, 0x8, 0x18}], 0x10, 0x1}, 0x94) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001b00)={r6, 0x20, &(0x7f0000001ac0)={&(0x7f0000001980)=""/164, 0xa4, 0x0, &(0x7f0000001a40)=""/127, 0x7f}}, 0x10) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001b40)={0x1b, 0x0, 0x0, 0x8, 0x0, r3, 0x7ff, '\x00', r8, 0xffffffffffffffff, 0x1, 0x5, 0x3}, 0x50) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001bc0)={0x1b, 0x0, 0x0, 0xe, 0x0, r6, 0xa91e, '\x00', r4, r6, 0x5, 0x2, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001c80)={0x5, 0x17, &(0x7f0000001740)=@raw=[@map_idx={0x18, 0x4, 0x5, 0x0, 0xc}, @call={0x85, 0x0, 0x0, 0xd0}, @ldst={0x2, 0x1, 0x6, 0x1, 0x9, 0xffffffffffffffff, 0x4}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0xff}, @map_idx={0x18, 0xa, 0x5, 0x0, 0xa}, @generic={0x1, 0x1, 0x2, 0x400, 0x2}, @alu={0x4, 0x0, 0x4, 0xb, 0x5, 0x6, 0x10}], &(0x7f0000001800)='syzkaller\x00', 0x2, 0xac, &(0x7f0000001840)=""/172, 0x41100, 0x24, '\x00', r4, @fallback=0x27, 0xffffffffffffffff, 0x8, &(0x7f0000001900)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000001940)={0x4, 0x6, 0x9, 0x27b68f83}, 0x10, r10, r6, 0x0, &(0x7f0000001c40)=[r5, r11, r12, r9, r5], 0x0, 0x10, 0x5}, 0x94) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000001d40), &(0x7f0000001d80)=0x4) r13 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000001dc0), 0x2, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r13, 0xc0389423, &(0x7f0000001e40)={0x9, 0x38, [0x0, 0x2, 0x7, 0x638], &(0x7f0000001e00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 68.823175ms ago: executing program 1 (id=3997): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200000700003b000000000080000085000000750000009500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @rand_addr=0x1}, 0x2, 0x4}}, 0x26) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x4e23, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffff8, 0x0, 0x6}, {0x0, 0x20000000000, 0x400000003, 0xfffffffffffffffc}, 0xfffffffc, 0x0, 0x1, 0x0, 0x3, 0x1}, {{@in=@rand_addr=0x64010102, 0x4, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r4, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) shutdown(r4, 0x1) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) 0s ago: executing program 1 (id=3998): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r4, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x4004}, 0x20020894) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) close(r8) syz_init_net_socket$rose(0xb, 0x5, 0x0) kernel console output (not intermixed with test programs): st one socket [ 332.039014][T16356] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2756'. [ 332.144966][T16368] netlink: 1100 bytes leftover after parsing attributes in process `syz.4.2758'. [ 332.375026][T16373] virt_wifi0 speed is unknown, defaulting to 1000 [ 332.404549][T16373] lo speed is unknown, defaulting to 1000 [ 332.417119][T16389] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2760'. [ 332.426428][T16389] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2760'. [ 332.573662][T16393] 8021q: adding VLAN 0 to HW filter on device bond7 [ 332.592609][T16397] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2762'. [ 332.604192][T16397] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2762'. [ 332.746842][T16396] virt_wifi0 speed is unknown, defaulting to 1000 [ 332.756482][T16406] tipc: Enabling of bearer rejected, already enabled [ 332.769453][T16396] lo speed is unknown, defaulting to 1000 [ 333.360566][T16439] netlink: 'syz.0.2772': attribute type 2 has an invalid length. [ 334.150732][T16500] netlink: 'syz.2.2790': attribute type 7 has an invalid length. [ 334.167768][T16500] netlink: 'syz.2.2790': attribute type 8 has an invalid length. [ 335.121783][T16538] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 335.148047][T16538] netlink: 'syz.4.2802': attribute type 1 has an invalid length. [ 335.272258][T16559] 8021q: adding VLAN 0 to HW filter on device bond13 [ 335.320969][T16561] bond13: (slave batadv5): Opening slave failed [ 336.063615][T16626] vlan2: left allmulticast mode [ 336.068534][T16626] geneve0: left allmulticast mode [ 336.114437][T16626] vlan2: left promiscuous mode [ 336.129309][T16626] geneve0: left promiscuous mode [ 336.139195][T16626] bridge0: port 3(vlan2) entered disabled state [ 336.217394][T16640] bond3: entered allmulticast mode [ 336.241235][T16640] vcan1: entered allmulticast mode [ 336.297860][T16640] bond3: left allmulticast mode [ 336.315305][T16640] vcan1: left allmulticast mode [ 336.642120][T16668] xt_NFQUEUE: number of queues (16) out of range (got 65549) [ 336.706849][T16670] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 336.719210][T16674] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 336.748581][T16674] syzkaller1: linktype set to 780 [ 336.868061][T16685] __nla_validate_parse: 24 callbacks suppressed [ 336.868084][T16685] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2836'. [ 336.909294][T16685] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2836'. [ 337.580099][T16725] "syz.4.2846" (16725) uses obsolete ecb(arc4) skcipher [ 337.797971][T16739] netlink: 'syz.1.2851': attribute type 1 has an invalid length. [ 337.806174][T16739] netlink: 'syz.1.2851': attribute type 3 has an invalid length. [ 338.086410][T16744] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2853'. [ 338.273991][T16750] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2854'. [ 338.623057][T16759] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2857'. [ 338.655707][T16759] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2857'. [ 338.803797][T16770] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2861'. [ 338.972759][ C1] vcan0: j1939_tp_rxtimer: 0xffff888042343000: rx timeout, send abort [ 339.220120][ T8520] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 339.227689][T16766] virt_wifi0 speed is unknown, defaulting to 1000 [ 339.235321][ T8520] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 339.245878][T16766] lo speed is unknown, defaulting to 1000 [ 339.253117][ T8520] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 339.262025][ T8520] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 339.270050][ T8520] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 339.303473][ T8519] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 339.310963][ T8519] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 339.318440][ T8519] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 339.329258][ T8519] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 339.337259][ T8519] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 339.472902][ C1] vcan0: j1939_tp_rxtimer: 0xffff888042340c00: rx timeout, send abort [ 339.481577][ C1] vcan0: j1939_tp_rxtimer: 0xffff888042343000: abort rx timeout. Force session deactivation [ 339.767398][T16780] virt_wifi0 speed is unknown, defaulting to 1000 [ 339.792924][T16780] lo speed is unknown, defaulting to 1000 [ 339.981230][ C1] vcan0: j1939_tp_rxtimer: 0xffff888042340c00: abort rx timeout. Force session deactivation [ 340.012837][T16792] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 340.315663][T16780] chnl_net:caif_netlink_parms(): no params data found [ 340.420479][T16809] bridge9: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 340.467404][T16809] bridge10: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 340.584903][T16817] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2874'. [ 340.670754][T16780] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.678059][T16780] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.685660][T16780] bridge_slave_0: entered allmulticast mode [ 340.693858][T16780] bridge_slave_0: entered promiscuous mode [ 340.702731][T16780] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.709933][T16780] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.721060][T16780] bridge_slave_1: entered allmulticast mode [ 340.749062][T16780] bridge_slave_1: entered promiscuous mode [ 340.942261][T16823] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2875'. [ 340.955413][T16780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 340.977946][T16780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.083077][T16780] team0: Port device team_slave_0 added [ 341.121835][T16780] team0: Port device team_slave_1 added [ 341.203269][T16780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.218284][T16780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 341.271440][T16780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.299843][T16780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.319022][T16780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 341.374394][ T8519] Bluetooth: hci5: command tx timeout [ 341.391626][T16835] netlink: 'syz.4.2878': attribute type 3 has an invalid length. [ 341.400670][T16835] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2878'. [ 341.402916][T16780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 341.477017][T16780] hsr_slave_0: entered promiscuous mode [ 341.484046][T16780] hsr_slave_1: entered promiscuous mode [ 341.491111][T16780] debugfs: 'hsr0' already exists in 'hsr' [ 341.497520][T16780] Cannot create hsr debugfs directory [ 341.666574][T16843] netlink: 'syz.3.2880': attribute type 13 has an invalid length. [ 341.700712][T16843] netlink: 'syz.3.2880': attribute type 17 has an invalid length. [ 341.804325][T16842] hsr0: left allmulticast mode [ 341.813808][T16842] hsr_slave_0: left allmulticast mode [ 341.821865][T16842] hsr_slave_1: left allmulticast mode [ 341.938140][T16843] 8021q: adding VLAN 0 to HW filter on device .` [ 341.949685][T16843] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 341.965606][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.976265][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 44933 - 0 [ 341.986948][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.997709][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 44933 - 0 [ 342.019040][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.041117][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 44933 - 0 [ 342.060433][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.069429][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 44933 - 0 [ 342.174781][T16780] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.229783][T16858] tipc: Enabled bearer , priority 10 [ 342.282396][T16780] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.297414][T16864] netlink: 'syz.2.2885': attribute type 1 has an invalid length. [ 342.461417][T16780] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.515424][T16875] syzkaller1: entered promiscuous mode [ 342.522028][T16875] syzkaller1: entered allmulticast mode [ 342.780029][T16893] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2894'. [ 342.789541][T16893] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 342.939487][T16902] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2898'. [ 342.949207][T16780] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 342.969328][T16780] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 342.977744][T16780] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 342.991469][T16780] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 342.999864][T16780] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 343.012236][T16780] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 343.032803][T16780] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 343.046396][T16780] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 343.321723][T16780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.375360][T16780] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.411147][ T1336] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.418336][ T1336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.450823][ T8519] Bluetooth: hci5: command tx timeout [ 343.477281][ T1041] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.484449][ T1041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 343.928376][T16780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 343.993404][T16780] veth0_vlan: entered promiscuous mode [ 344.024503][T16780] veth1_vlan: entered promiscuous mode [ 344.128223][T16780] veth0_macvtap: entered promiscuous mode [ 344.142604][T16780] veth1_macvtap: entered promiscuous mode [ 344.166529][T16780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 344.178773][T16780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 344.195338][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.205812][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.245145][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.255088][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.400842][T16971] netlink: 'syz.1.2915': attribute type 1 has an invalid length. [ 344.429520][T16971] bond9: entered promiscuous mode [ 344.435186][T16971] 8021q: adding VLAN 0 to HW filter on device bond9 [ 344.456803][T16971] bond9: (slave bridge8): making interface the new active one [ 344.464670][T16971] bridge8: entered promiscuous mode [ 344.471359][T16971] bond9: (slave bridge8): Enslaving as an active interface with an up link [ 344.526492][T16978] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2916'. [ 344.623300][T16985] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2914'. [ 345.050459][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 345.530572][ T8519] Bluetooth: hci5: command tx timeout [ 346.662447][T16943] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 346.750471][ T1336] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.758347][ T1336] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.857055][ T8234] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.870434][ T8234] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.176280][T17015] netlink: 'syz.2.2923': attribute type 1 has an invalid length. [ 347.276614][T17015] bond8: entered promiscuous mode [ 347.292685][T17015] 8021q: adding VLAN 0 to HW filter on device bond8 [ 347.396117][T17024] 8021q: adding VLAN 0 to HW filter on device bond8 [ 347.420882][T17024] bond8: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 347.456980][T17024] bond8: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 347.490867][T17024] bond8: (slave ip6gre2): making interface the new active one [ 347.510391][T17024] ip6gre2: entered promiscuous mode [ 347.532608][T17024] bond8: (slave ip6gre2): Enslaving as an active interface with an up link [ 347.616168][ T8520] Bluetooth: hci5: command tx timeout [ 347.713234][T17028] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2926'. [ 347.735487][ T8519] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 347.746253][ T8519] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 347.757062][ T8519] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 347.764160][T17029] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2926'. [ 347.791678][ T8519] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 347.799420][ T8519] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 347.809635][T17033] bond9: entered promiscuous mode [ 347.815015][T17033] bond9: entered allmulticast mode [ 347.821834][T17033] 8021q: adding VLAN 0 to HW filter on device bond9 [ 347.870903][T17028] netlink: 'syz.0.2926': attribute type 14 has an invalid length. [ 347.909832][T17030] virt_wifi0 speed is unknown, defaulting to 1000 [ 347.917975][T17028] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2926'. [ 347.974601][T17028] netlink: 'syz.0.2926': attribute type 3 has an invalid length. [ 347.982965][T17029] netlink: 'syz.0.2926': attribute type 3 has an invalid length. [ 347.990960][T17029] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2926'. [ 348.000732][T17028] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2926'. [ 348.111779][T17030] lo speed is unknown, defaulting to 1000 [ 348.626051][T17065] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 348.708762][T17030] chnl_net:caif_netlink_parms(): no params data found [ 348.866286][T17030] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.876398][T17030] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.885198][T17030] bridge_slave_0: entered allmulticast mode [ 348.897130][T17030] bridge_slave_0: entered promiscuous mode [ 348.907931][T17030] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.964618][T17030] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.984586][T17030] bridge_slave_1: entered allmulticast mode [ 348.996309][T17030] bridge_slave_1: entered promiscuous mode [ 349.065982][T17030] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 349.069014][T17077] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2936'. [ 349.085769][T17078] netlink: 'syz.0.2935': attribute type 1 has an invalid length. [ 349.089657][T17030] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 349.143061][T17030] team0: Port device team_slave_0 added [ 349.152851][T17030] team0: Port device team_slave_1 added [ 349.194137][T17030] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 349.201693][T17030] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.229036][T17030] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 349.242799][T17030] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 349.249869][T17030] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.277019][T17030] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 349.473981][T17030] hsr_slave_0: entered promiscuous mode [ 349.500729][T17030] hsr_slave_1: entered promiscuous mode [ 349.514412][T17030] debugfs: 'hsr0' already exists in 'hsr' [ 349.527400][T17030] Cannot create hsr debugfs directory [ 349.570990][T17090] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2940'. [ 349.579995][T17090] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2940'. [ 349.589726][T17090] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2940'. [ 349.599155][T17090] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2940'. [ 349.851297][ T8519] Bluetooth: hci0: command tx timeout [ 350.101502][T17109] openvswitch: netlink: Flow actions attr not present in new flow. [ 350.121078][T17109] openvswitch: netlink: Flow actions attr not present in new flow. [ 350.146487][T17109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2947'. [ 350.249374][T17119] netlink: 4988 bytes leftover after parsing attributes in process `syz.3.2949'. [ 350.269410][T17119] xt_CONNSECMARK: invalid mode: 0 [ 350.704701][T17030] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 350.719695][T17030] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 350.733909][T17030] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 350.754129][T17030] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 350.771103][T17030] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 350.864030][T17030] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 350.907224][T17030] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 350.934859][T17030] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 351.084631][T17153] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 351.268503][T17030] 8021q: adding VLAN 0 to HW filter on device bond0 [ 351.298456][T17030] 8021q: adding VLAN 0 to HW filter on device team0 [ 351.320809][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 351.328092][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 351.372763][ T1041] bridge0: port 2(bridge_slave_1) entered blocking state [ 351.379961][ T1041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 351.478427][T17166] virt_wifi0 speed is unknown, defaulting to 1000 [ 351.487433][T17166] lo speed is unknown, defaulting to 1000 [ 351.552878][T17173] virt_wifi0 speed is unknown, defaulting to 1000 [ 351.584257][T17173] lo speed is unknown, defaulting to 1000 [ 351.776789][T17030] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 351.930706][ T8519] Bluetooth: hci0: command tx timeout [ 352.145144][T17030] veth0_vlan: entered promiscuous mode [ 352.169418][T17030] veth1_vlan: entered promiscuous mode [ 352.179748][T17191] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 352.207169][T17030] veth0_macvtap: entered promiscuous mode [ 352.251983][T17030] veth1_macvtap: entered promiscuous mode [ 352.350856][T17030] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 352.418418][T17030] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 352.440696][ T30] audit: type=1800 audit(1776251517.400:10): pid=17209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2966" name="memory.stat" dev="tmpfs" ino=3061 res=0 errno=0 [ 352.502023][ T1041] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.629111][ T1041] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.649134][ T1041] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.704718][ T66] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.828843][T17221] virt_wifi0 speed is unknown, defaulting to 1000 [ 352.843343][T17223] netlink: 'syz.1.2971': attribute type 1 has an invalid length. [ 352.852750][T17225] netlink: 'syz.2.2972': attribute type 1 has an invalid length. [ 352.861909][T17223] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 352.881159][T17221] lo speed is unknown, defaulting to 1000 [ 352.946376][T17225] 8021q: adding VLAN 0 to HW filter on device bond10 [ 353.004483][T17231] __nla_validate_parse: 3 callbacks suppressed [ 353.004502][T17231] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2974'. [ 353.023312][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.054495][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.070414][T17231] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2974'. [ 353.127282][ T175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.149994][T17231] syz.1.2974: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 353.170786][ T175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.179742][T17231] CPU: 1 UID: 0 PID: 17231 Comm: syz.1.2974 Not tainted syzkaller #0 PREEMPT(full) [ 353.179767][T17231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 353.179779][T17231] Call Trace: [ 353.179786][T17231] [ 353.179795][T17231] dump_stack_lvl+0xe8/0x150 [ 353.179828][T17231] warn_alloc+0x249/0x340 [ 353.179853][T17231] ? stack_trace_save+0xa9/0x100 [ 353.179885][T17231] ? __pfx_warn_alloc+0x10/0x10 [ 353.179915][T17231] ? kasan_save_track+0x4f/0x80 [ 353.179936][T17231] ? kasan_save_track+0x3e/0x80 [ 353.179955][T17231] ? __kasan_kmalloc+0x93/0xb0 [ 353.179975][T17231] ? __kmalloc_cache_noprof+0x31c/0x660 [ 353.179996][T17231] ? xskq_create+0x56/0x170 [ 353.180015][T17231] ? xsk_setsockopt+0x54c/0x990 [ 353.180032][T17231] ? do_sock_setsockopt+0x17c/0x1b0 [ 353.180060][T17231] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 353.180086][T17231] ? do_syscall_64+0x14d/0xf80 [ 353.180112][T17231] __vmalloc_node_range_noprof+0x132/0x1730 [ 353.180165][T17231] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 353.180193][T17231] ? __kasan_kmalloc+0x93/0xb0 [ 353.180219][T17231] vmalloc_user_noprof+0xad/0xe0 [ 353.180240][T17231] ? xskq_create+0xbf/0x170 [ 353.180267][T17231] xskq_create+0xbf/0x170 [ 353.180290][T17231] xsk_init_queue+0x8a/0xe0 [ 353.180311][T17231] xsk_setsockopt+0x54c/0x990 [ 353.180332][T17231] ? __pfx_xsk_setsockopt+0x10/0x10 [ 353.180350][T17231] ? __pfx_aa_sk_perm+0x10/0x10 [ 353.180382][T17231] ? aa_sock_opt_perm+0xff/0x1a0 [ 353.180404][T17231] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 353.180426][T17231] ? __pfx_xsk_setsockopt+0x10/0x10 [ 353.180445][T17231] do_sock_setsockopt+0x17c/0x1b0 [ 353.180478][T17231] __x64_sys_setsockopt+0x13d/0x1b0 [ 353.180511][T17231] do_syscall_64+0x14d/0xf80 [ 353.180533][T17231] ? trace_irq_disable+0x3b/0x150 [ 353.180550][T17231] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.180570][T17231] ? clear_bhb_loop+0x40/0x90 [ 353.180595][T17231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.180614][T17231] RIP: 0033:0x7fedc8b9c819 [ 353.180632][T17231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.180648][T17231] RSP: 002b:00007fedc9acd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 353.180668][T17231] RAX: ffffffffffffffda RBX: 00007fedc8e15fa0 RCX: 00007fedc8b9c819 [ 353.180683][T17231] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000c [ 353.180695][T17231] RBP: 00007fedc8c32c91 R08: 0000000000000004 R09: 0000000000000000 [ 353.180707][T17231] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 353.180719][T17231] R13: 00007fedc8e16038 R14: 00007fedc8e15fa0 R15: 00007fffafa78138 [ 353.180749][T17231] [ 353.534723][T17231] Mem-Info: [ 353.537984][T17231] active_anon:8705 inactive_anon:0 isolated_anon:0 [ 353.537984][T17231] active_file:3343 inactive_file:40053 isolated_file:0 [ 353.537984][T17231] unevictable:768 dirty:237 writeback:0 [ 353.537984][T17231] slab_reclaimable:13207 slab_unreclaimable:156635 [ 353.537984][T17231] mapped:29617 shmem:1497 pagetables:1376 [ 353.537984][T17231] sec_pagetables:0 bounce:0 [ 353.537984][T17231] kernel_misc_reclaimable:0 [ 353.537984][T17231] free:1255713 free_pcp:12815 free_cma:0 [ 353.585111][T17231] Node 0 active_anon:34920kB inactive_anon:0kB active_file:13372kB inactive_file:160008kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:118468kB dirty:944kB writeback:0kB shmem:4452kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15252kB pagetables:5468kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 353.625205][T17231] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 353.656090][T17231] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 353.689278][T17231] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 353.696497][T17231] Node 0 DMA32 free:1071016kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:34904kB inactive_anon:0kB active_file:13372kB inactive_file:160016kB unevictable:1536kB writepending:968kB zspages:0kB present:3129332kB managed:2552060kB mlocked:0kB bounce:0kB free_pcp:48276kB local_pcp:25652kB free_cma:0kB [ 353.731275][T17231] lowmem_reserve[]: 0 0 0 0 0 [ 353.736192][T17231] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:868kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:4kB free_cma:0kB [ 353.849548][T17231] lowmem_reserve[]: 0 0 0 0 0 [ 353.908134][T17231] Node 1 Normal free:3938440kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:496kB local_pcp:0kB free_cma:0kB [ 354.001458][T17231] lowmem_reserve[]: 0 0 0 0 0 [ 354.007528][T17231] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 354.028766][T17231] Node 0 DMA32: 5187*4kB (UM) 3946*8kB (UME) 1880*16kB (UME) 163*32kB (UME) 104*64kB (UM) 294*128kB (UM) 294*256kB (UME) 213*512kB (UME) 136*1024kB (UME) 59*2048kB (UME) 117*4096kB (UM) = 1055548kB [ 354.030696][ T8519] Bluetooth: hci0: command tx timeout [ 354.080609][T17231] Node 0 Normal: 2*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 354.092918][T17231] Node 1 Normal: 1*4kB (U) 1*8kB (M) 1*16kB (M) 1*32kB (M) 10*64kB (UM) 4*128kB (UM) 4*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 0*2048kB 960*4096kB (UM) = 3938492kB [ 354.109739][T17231] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 354.124297][T17231] Node 0 hugepages_total=3 hugepages_free=0 hugepages_surp=1 hugepages_size=2048kB [ 354.133675][T17231] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 354.145395][T17231] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 354.155246][T17231] 44891 total pagecache pages [ 354.159954][T17231] 0 pages in swap cache [ 354.164209][T17231] Free swap = 124996kB [ 354.168395][T17231] Total swap = 124996kB [ 354.207697][T17231] 2097051 pages RAM [ 354.220363][T17231] 0 pages HighMem/MovableOnly [ 354.230347][T17231] 427204 pages reserved [ 354.234784][T17231] 0 pages cma reserved [ 354.613623][ T8520] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 354.623458][ T8520] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 354.634544][ T8520] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 354.646458][ T8520] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 354.667059][ T8520] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 354.823493][T17266] virt_wifi0 speed is unknown, defaulting to 1000 [ 354.846192][T17265] netlink: 'syz.0.2981': attribute type 39 has an invalid length. [ 354.854808][T17266] lo speed is unknown, defaulting to 1000 [ 355.058639][ T5834] syz_tun (unregistering): left allmulticast mode [ 355.269075][T17266] chnl_net:caif_netlink_parms(): no params data found [ 355.385599][T17305] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2990'. [ 355.397836][T17305] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2990'. [ 355.432183][T17266] bridge0: port 1(bridge_slave_0) entered blocking state [ 355.439824][T17266] bridge0: port 1(bridge_slave_0) entered disabled state [ 355.447137][T17266] bridge_slave_0: entered allmulticast mode [ 355.454931][T17266] bridge_slave_0: entered promiscuous mode [ 355.465867][T17266] bridge0: port 2(bridge_slave_1) entered blocking state [ 355.473204][T17266] bridge0: port 2(bridge_slave_1) entered disabled state [ 355.480770][T17266] bridge_slave_1: entered allmulticast mode [ 355.488359][T17266] bridge_slave_1: entered promiscuous mode [ 355.547044][T17266] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 355.556967][T17309] netlink: 'syz.0.2991': attribute type 4 has an invalid length. [ 355.567916][T17266] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 355.609578][T17266] team0: Port device team_slave_0 added [ 355.619751][T17266] team0: Port device team_slave_1 added [ 355.662625][T17266] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 355.669651][T17266] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 355.696183][T17266] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 355.708938][T17266] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 355.716167][T17266] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 355.744296][T17266] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 355.794465][T17314] netlink: 'syz.0.2992': attribute type 1 has an invalid length. [ 355.835168][T17266] hsr_slave_0: entered promiscuous mode [ 355.842201][T17266] hsr_slave_1: entered promiscuous mode [ 355.849769][T17266] debugfs: 'hsr0' already exists in 'hsr' [ 355.862235][T17266] Cannot create hsr debugfs directory [ 356.033304][T17318] virt_wifi0 speed is unknown, defaulting to 1000 [ 356.053435][T17266] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.080983][T17266] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 356.100996][ T8519] Bluetooth: hci0: command tx timeout [ 356.123680][T17318] lo speed is unknown, defaulting to 1000 [ 356.157683][T17266] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.168455][T17266] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 356.254699][T17266] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.266646][T17266] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 356.341114][T17266] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.351688][T17266] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 356.595145][T17325] virt_wifi0 speed is unknown, defaulting to 1000 [ 356.602826][T17325] lo speed is unknown, defaulting to 1000 [ 356.730898][ T8519] Bluetooth: hci1: command tx timeout [ 356.927747][T17334] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2996'. [ 356.940979][T17334] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2996'. [ 357.436268][T17260] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 357.542472][T17266] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 357.577561][T17266] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 357.597389][T17266] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 357.625113][T17266] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 357.655463][T17266] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 357.682965][T17266] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 357.693050][T17358] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3001'. [ 357.696432][T17360] netlink: 'syz.3.3002': attribute type 1 has an invalid length. [ 357.706944][T17266] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 357.721430][T17266] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 357.757703][T17360] netlink: 'syz.3.3002': attribute type 1 has an invalid length. [ 357.803058][T17371] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3001'. [ 357.819098][T17371] openvswitch: netlink: Flow key attr not present in new flow. [ 357.985260][T17266] 8021q: adding VLAN 0 to HW filter on device bond0 [ 358.024393][T17266] 8021q: adding VLAN 0 to HW filter on device team0 [ 358.046285][ T1336] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.053492][ T1336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 358.097394][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.104577][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 358.294619][T17393] gretap1: entered promiscuous mode [ 358.446862][T17266] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 358.505295][T17403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3009'. [ 358.519424][T17403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3009'. [ 358.529923][T17403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3009'. [ 358.542846][T17403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3009'. [ 358.560082][T17266] veth0_vlan: entered promiscuous mode [ 358.573887][T17266] veth1_vlan: entered promiscuous mode [ 358.600815][T17266] veth0_macvtap: entered promiscuous mode [ 358.611829][T17266] veth1_macvtap: entered promiscuous mode [ 358.632263][T17266] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 358.646895][T17266] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 358.665636][ T1336] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.681882][T17405] sit1: entered allmulticast mode [ 358.715407][ T1336] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.736037][ T1336] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.763285][ T1336] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.812859][ T8519] Bluetooth: hci1: command tx timeout [ 358.843702][ T1336] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 358.854359][ T1336] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 358.916814][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 358.937316][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 359.073180][T17416] tipc: Started in network mode [ 359.099137][T17416] tipc: Node identity 0ef7ce9829b9, cluster identity 4711 [ 359.119589][T17416] tipc: Enabled bearer , priority 0 [ 359.157439][T17428] netlink: 'syz.1.3014': attribute type 2 has an invalid length. [ 359.176682][T17431] syzkaller0: entered promiscuous mode [ 359.200468][T17431] syzkaller0: entered allmulticast mode [ 359.245300][T17416] tipc: Resetting bearer [ 359.282053][T17414] tipc: Resetting bearer [ 359.303591][T17404] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 359.400890][T17437] netlink: 'syz.1.3017': attribute type 10 has an invalid length. [ 359.410570][T17414] tipc: Disabling bearer [ 359.447008][T17437] team0: Device veth0_vlan failed to register rx_handler [ 359.535545][T17437] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3017'. [ 359.914212][ T8520] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 359.926538][ T8520] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 359.937302][ T8520] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 359.946777][ T8520] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 359.954809][ T8520] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 360.043708][T17457] bond10: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 360.105592][T17457] bond10 (unregistering): Released all slaves [ 360.149502][T17444] virt_wifi0 speed is unknown, defaulting to 1000 [ 360.159917][T17444] lo speed is unknown, defaulting to 1000 [ 360.318625][T17460] virt_wifi0 speed is unknown, defaulting to 1000 [ 360.356578][T17460] lo speed is unknown, defaulting to 1000 [ 360.402703][T17473] vlan2: entered allmulticast mode [ 360.408529][T17473] bond0: entered allmulticast mode [ 360.500245][T17477] sctp: [Deprecated]: syz.1.3024 (pid 17477) Use of int in max_burst socket option deprecated. [ 360.500245][T17477] Use struct sctp_assoc_value instead [ 360.651625][ T8520] Bluetooth: hci0: command 0x0401 tx timeout [ 360.671261][T17480] virt_wifi0 speed is unknown, defaulting to 1000 [ 360.679683][T17480] lo speed is unknown, defaulting to 1000 [ 360.891340][ T8520] Bluetooth: hci1: command tx timeout [ 361.206241][T17509] bridge1: entered promiscuous mode [ 361.262008][T17460] chnl_net:caif_netlink_parms(): no params data found [ 361.592362][T17460] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.599575][T17460] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.606903][T17460] bridge_slave_0: entered allmulticast mode [ 361.615091][T17460] bridge_slave_0: entered promiscuous mode [ 361.623905][T17460] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.632188][T17460] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.639369][T17460] bridge_slave_1: entered allmulticast mode [ 361.647545][T17460] bridge_slave_1: entered promiscuous mode [ 361.686142][T17460] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 361.698949][T17460] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 361.780802][T17460] team0: Port device team_slave_0 added [ 361.816136][T17460] team0: Port device team_slave_1 added [ 361.913227][T17460] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 361.921183][T17460] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.951705][T17460] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 361.976092][T17460] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 361.983289][T17460] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 362.013821][ T8520] Bluetooth: hci2: command tx timeout [ 362.020979][T17460] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 362.042654][T17547] syz_tun: entered allmulticast mode [ 362.108842][T17547] syz_tun: left allmulticast mode [ 362.134005][T17460] hsr_slave_0: entered promiscuous mode [ 362.162309][T17460] hsr_slave_1: entered promiscuous mode [ 362.178298][T17460] debugfs: 'hsr0' already exists in 'hsr' [ 362.192465][T17460] Cannot create hsr debugfs directory [ 362.492798][T17550] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3041'. [ 362.743599][T17566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3045'. [ 362.921099][T17566] team0: Port device team_slave_0 removed [ 362.973764][ T8520] Bluetooth: hci1: command tx timeout [ 363.003980][T17571] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 363.280104][T17592] netlink: 'syz.4.3052': attribute type 66 has an invalid length. [ 363.295462][T17593] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3050'. [ 363.424968][T17460] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 363.461712][T17460] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 363.469635][T17460] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 363.519359][T17460] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 363.538250][T17460] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 363.563477][T17460] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 363.573208][T17460] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 363.595320][T17460] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 363.676549][T17584] netlink: 'syz.2.3049': attribute type 1 has an invalid length. [ 363.689432][T17584] netlink: 'syz.2.3049': attribute type 8 has an invalid length. [ 363.799058][T17460] 8021q: adding VLAN 0 to HW filter on device bond0 [ 363.856904][T17460] 8021q: adding VLAN 0 to HW filter on device team0 [ 363.891918][ T1041] bridge0: port 1(bridge_slave_0) entered blocking state [ 363.899133][ T1041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 363.945088][ T1041] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.952645][ T1041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 364.091447][ T8519] Bluetooth: hci2: command tx timeout [ 364.517863][T17460] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 364.536560][T17637] ipvlan2: entered promiscuous mode [ 364.556680][T17637] bridge0: port 3(ipvlan2) entered blocking state [ 364.564077][T17637] bridge0: port 3(ipvlan2) entered disabled state [ 364.572604][T17637] ipvlan2: entered allmulticast mode [ 364.583496][T17637] bridge0: entered allmulticast mode [ 364.606325][T17637] ipvlan2: left allmulticast mode [ 364.611580][T17637] bridge0: left allmulticast mode [ 364.772277][T17642] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3061'. [ 364.841049][T17643] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3061'. [ 364.971963][T17460] veth0_vlan: entered promiscuous mode [ 364.984648][T17460] veth1_vlan: entered promiscuous mode [ 365.011601][T17460] veth0_macvtap: entered promiscuous mode [ 365.022220][T17460] veth1_macvtap: entered promiscuous mode [ 365.336479][T17460] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 365.376513][T17460] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 365.398727][ T1041] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.488886][ T1041] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.503687][ T1041] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.560883][ T1041] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.560923][T17656] ieee802154 phy1 wpan1: encryption failed: -22 [ 365.643408][T17654] netlink: 296 bytes leftover after parsing attributes in process `syz.0.3065'. [ 365.690615][ T175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 365.698608][ T175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 365.780214][ T1336] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 365.812255][ T1336] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.025456][T17669] sctp: [Deprecated]: syz.3.3016 (pid 17669) Use of int in maxseg socket option. [ 366.025456][T17669] Use struct sctp_assoc_value instead [ 366.046242][T17669] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3016'. [ 366.170911][ T8519] Bluetooth: hci2: command tx timeout [ 368.250446][ T8519] Bluetooth: hci2: command tx timeout [ 378.334677][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.250872][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 416.836215][T17684] bond2: option ad_user_port_key: invalid value (65535) [ 416.850341][T17684] bond2: option ad_user_port_key: allowed values 0 - 1023 [ 416.871880][T17684] bond2 (unregistering): Released all slaves [ 416.896096][T17696] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3071'. [ 417.125518][T17698] virt_wifi0 speed is unknown, defaulting to 1000 [ 417.143153][T17698] lo speed is unknown, defaulting to 1000 [ 417.169333][T17708] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3077'. [ 417.208976][T17708] ip6gre1: entered promiscuous mode [ 417.218657][T17708] ip6gre1: entered allmulticast mode [ 417.307836][ T7860] IPVS: starting estimator thread 0... [ 417.320780][T17721] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3075'. [ 417.352534][ T1336] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 417.375557][ T1336] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 417.383386][ T7860] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 417.452687][T17723] IPVS: using max 30 ests per chain, 72000 per kthread [ 417.548361][T17733] netlink: 'syz.0.3082': attribute type 11 has an invalid length. [ 417.557876][T17734] openvswitch: netlink: Unexpected mask (mask=20840, allowed=10048) [ 417.819015][T17751] netlink: 'syz.2.3084': attribute type 13 has an invalid length. [ 417.831853][T17751] netlink: 'syz.2.3084': attribute type 17 has an invalid length. [ 417.860814][ T7847] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 417.872262][T17743] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3084'. [ 417.918189][T17743] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3084'. [ 417.927440][T17743] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3084'. [ 417.983401][T17762] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3084'. [ 418.043951][T17751] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 418.081723][T17743] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3084'. [ 418.135650][T17759] xt_hashlimit: size too large, truncated to 1048576 [ 418.410596][ T7860] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 418.502317][T17771] –: renamed from vxcan1 (while UP) [ 418.855270][T17787] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 419.023676][T17796] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3096'. [ 419.042493][T17789] smc: adding net device wlan0 with user defined pnetid SYZ0 [ 419.405803][T17816] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 419.443215][T17816] team0 (unregistering): Port device team_slave_0 removed [ 419.495533][T17816] team0 (unregistering): Failed to send options change via netlink (err -105) [ 419.520907][T17816] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 419.534513][T17816] team0 (unregistering): Port device team_slave_1 removed [ 419.742748][T17830] syz_tun: entered promiscuous mode [ 419.749304][T17830] macvtap1: entered promiscuous mode [ 419.767222][T17830] macvtap1: entered allmulticast mode [ 419.784960][T17830] syz_tun: entered allmulticast mode [ 419.807201][T17830] syz_tun: left allmulticast mode [ 419.823357][T17830] syz_tun: left promiscuous mode [ 420.099360][T17846] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3104'. [ 421.462969][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 421.652899][ T66] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.671697][ T66] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 421.713511][ T66] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.735974][ T66] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 421.777254][ T66] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.816981][ T66] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 421.867891][ T66] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.878069][T17941] netlink: 'syz.4.3127': attribute type 1 has an invalid length. [ 421.897686][ T66] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 421.944209][T17941] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 421.944986][T17938] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 422.044037][T17956] __nla_validate_parse: 8 callbacks suppressed [ 422.044057][T17956] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3128'. [ 422.389513][T17970] virt_wifi0 speed is unknown, defaulting to 1000 [ 422.415099][T17970] lo speed is unknown, defaulting to 1000 [ 422.462556][T17975] FAULT_INJECTION: forcing a failure. [ 422.462556][T17975] name failslab, interval 1, probability 0, space 0, times 1 [ 422.489494][T17975] CPU: 1 UID: 0 PID: 17975 Comm: syz.2.3136 Not tainted syzkaller #0 PREEMPT(full) [ 422.489521][T17975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 422.489537][T17975] Call Trace: [ 422.489545][T17975] [ 422.489554][T17975] dump_stack_lvl+0xe8/0x150 [ 422.489588][T17975] should_fail_ex+0x412/0x560 [ 422.489625][T17975] should_failslab+0xa8/0x100 [ 422.489654][T17975] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 422.489676][T17975] ? __alloc_skb+0x1d0/0x7d0 [ 422.489701][T17975] ? __local_bh_enable_ip+0xd0/0x130 [ 422.489732][T17975] __alloc_skb+0x1d0/0x7d0 [ 422.489745][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3133'. [ 422.489763][T17975] sctp_packet_transmit+0x290/0x2ac0 [ 422.489890][T17975] ? sctp_outq_flush+0xc0c/0x31b0 [ 422.490006][T17975] ? sctp_outq_flush+0xc0c/0x31b0 [ 422.490057][T17975] ? sctp_outq_flush+0xc0c/0x31b0 [ 422.490138][T17975] sctp_outq_flush+0xee8/0x31b0 [ 422.490210][T17975] ? sctp_outq_flush+0xc0c/0x31b0 [ 422.490292][T17975] ? sctp_make_heartbeat+0x3c9/0x4c0 [ 422.490370][T17975] ? __pfx_sctp_make_heartbeat+0x10/0x10 [ 422.490439][T17975] ? __pfx_sctp_outq_flush+0x10/0x10 [ 422.490538][T17975] ? sctp_outq_tail+0x612/0x920 [ 422.490618][T17975] ? sctp_do_8_2_transport_strike+0x43c/0x8d0 [ 422.490678][T17975] ? sctp_outq_uncork+0x4d/0xa0 [ 422.490762][T17975] sctp_do_sm+0x54c7/0x5cf0 [ 422.490821][T17975] ? arch_stack_walk+0xfb/0x150 [ 422.490929][T17975] ? __pfx_sctp_do_sm+0x10/0x10 [ 422.491068][T17975] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 422.491138][T17975] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 422.491208][T17975] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 422.491285][T17975] ? sctp_v6_addr_to_user+0x217/0x420 [ 422.491378][T17975] sctp_primitive_REQUESTHEARTBEAT+0x98/0xc0 [ 422.491475][T17975] sctp_apply_peer_addr_params+0xdf/0x1880 [ 422.491531][T17975] ? __pfx_sctp_addr_id2transport+0x10/0x10 [ 422.491610][T17975] sctp_setsockopt_peer_addr_params+0x5e5/0x940 [ 422.491723][T17975] sctp_setsockopt+0x752/0x12c0 [ 422.491782][T17975] ? sock_common_setsockopt+0x36/0xc0 [ 422.491848][T17975] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 422.491921][T17975] do_sock_setsockopt+0x17c/0x1b0 [ 422.492000][T17975] __x64_sys_setsockopt+0x13d/0x1b0 [ 422.492077][T17975] do_syscall_64+0x14d/0xf80 [ 422.492138][T17975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.492185][T17975] ? clear_bhb_loop+0x40/0x90 [ 422.492247][T17975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.492303][T17975] RIP: 0033:0x7fd60bb9c819 [ 422.492369][T17975] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 422.492404][T17975] RSP: 002b:00007fd60ca33028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 422.492468][T17975] RAX: ffffffffffffffda RBX: 00007fd60be15fa0 RCX: 00007fd60bb9c819 [ 422.492501][T17975] RDX: 0000000000000009 RSI: 0000000000000084 RDI: 0000000000000003 [ 422.492530][T17975] RBP: 00007fd60ca33090 R08: 000000000000009c R09: 0000000000000000 [ 422.492567][T17975] R10: 0000200000000a00 R11: 0000000000000246 R12: 0000000000000001 [ 422.492597][T17975] R13: 00007fd60be16038 R14: 00007fd60be15fa0 R15: 00007ffdf5f94288 [ 422.492689][T17975] [ 423.097598][T17996] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3141'. [ 423.132213][T17996] netlink: 'syz.0.3141': attribute type 5 has an invalid length. [ 423.173976][T17996] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3141'. [ 423.445602][T17995] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 423.660940][T18027] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 423.689751][T17996] geneve2: entered promiscuous mode [ 423.692803][T18027] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3146'. [ 423.700127][T17996] geneve2: entered allmulticast mode [ 423.740447][ T175] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 34688 - 0 [ 423.756956][ T175] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 34688 - 0 [ 423.780159][ T175] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 34688 - 0 [ 423.807819][T18012] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 423.852288][T18012] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 423.944320][T17995] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 423.975766][T17995] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 34688 - 0 [ 424.071773][T18040] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 424.172472][T17995] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.197823][T17995] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 34688 - 0 [ 424.344468][T17995] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.360643][T17995] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 34688 - 0 [ 424.589220][ T36] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 34688 - 0 [ 424.608269][T18054] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3152'. [ 424.621259][ T36] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 424.683242][ T1041] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 34688 - 0 [ 424.692168][ T1041] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 424.707032][T18059] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3153'. [ 424.752852][ T1041] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 34688 - 0 [ 424.764301][ T1041] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 424.807053][ T175] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 34688 - 0 [ 424.830567][ T175] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 424.929263][T18064] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 425.104573][T18077] dvmrp0: entered allmulticast mode [ 425.188006][T18081] virt_wifi0 speed is unknown, defaulting to 1000 [ 425.198558][T18081] lo speed is unknown, defaulting to 1000 [ 425.205943][T18082] netlink: 'syz.1.3159': attribute type 1 has an invalid length. [ 425.276647][T18082] netlink: 'syz.1.3159': attribute type 2 has an invalid length. [ 425.407029][T18095] syz_tun: entered allmulticast mode [ 425.414399][T18095] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3162'. [ 425.428451][T18094] syz_tun: left allmulticast mode [ 425.803554][T18104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3166'. [ 426.419825][ T8520] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 426.438016][ T8520] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 426.450660][ T8520] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 426.466671][ T8520] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 426.474988][ T8520] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 426.514808][T18122] dummy0: entered promiscuous mode [ 426.535292][T18122] gretap0: entered promiscuous mode [ 426.552323][T18122] hsr1: entered allmulticast mode [ 426.557403][T18122] dummy0: entered allmulticast mode [ 426.577415][T18122] gretap0: entered allmulticast mode [ 426.642122][T18126] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3174'. [ 426.718794][T18126] team0: Port device team_slave_0 removed [ 426.778279][ T5835] .`: (slave syz_tun): Releasing backup interface [ 426.855911][T18119] virt_wifi0 speed is unknown, defaulting to 1000 [ 426.864754][T18119] lo speed is unknown, defaulting to 1000 [ 427.339101][T18119] chnl_net:caif_netlink_parms(): no params data found [ 427.966285][T18119] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.984114][T18119] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.999576][T18119] bridge_slave_0: entered allmulticast mode [ 428.017530][T18119] bridge_slave_0: entered promiscuous mode [ 428.036571][T18119] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.056952][T18119] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.073899][T18119] bridge_slave_1: entered allmulticast mode [ 428.099142][T18119] bridge_slave_1: entered promiscuous mode [ 428.276567][T18119] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 428.299631][T18119] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 428.375345][T18119] team0: Port device team_slave_0 added [ 428.384299][T18119] team0: Port device team_slave_1 added [ 428.499929][T18119] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 428.519581][T18119] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 428.553857][T18179] netlink: 'syz.0.3187': attribute type 4 has an invalid length. [ 428.561951][T18180] netlink: 'syz.0.3187': attribute type 4 has an invalid length. [ 428.570891][ T8519] Bluetooth: hci4: command tx timeout [ 428.600187][T18119] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 428.615773][T18119] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 428.630573][T18119] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 428.658163][T18119] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 428.784643][T18188] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3190'. [ 428.808770][T18119] hsr_slave_0: entered promiscuous mode [ 428.821429][T18119] hsr_slave_1: entered promiscuous mode [ 428.827742][T18119] debugfs: 'hsr0' already exists in 'hsr' [ 428.848216][T18119] Cannot create hsr debugfs directory [ 428.874360][T18192] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3191'. [ 428.988022][T18192] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 429.055109][T18201] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3191'. [ 429.675457][ T7860] IPVS: starting estimator thread 0... [ 429.713437][T18231] netlink: 'syz.0.3200': attribute type 13 has an invalid length. [ 429.721409][T18231] netlink: 'syz.0.3200': attribute type 17 has an invalid length. [ 429.792496][T18234] IPVS: using max 27 ests per chain, 64800 per kthread [ 429.959572][T18231] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 430.170985][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 430.302993][T18254] netlink: 'syz.2.3205': attribute type 2 has an invalid length. [ 430.330836][T18254] tipc: Started in network mode [ 430.335752][T18254] tipc: Node identity 340008, cluster identity 4711 [ 430.370343][T18254] tipc: Node number set to 3407880 [ 430.382908][T18254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3205'. [ 430.428849][T18119] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 430.439320][T18119] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 430.451728][T18119] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 430.489249][T18119] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 430.521104][T18119] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 430.556037][T18119] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 430.565500][T18119] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 430.596536][T18119] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 430.603925][T18274] Unsupported ieee802154 address type: 0 [ 430.619992][T18268] virt_wifi0 speed is unknown, defaulting to 1000 [ 430.642530][T18273] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3209'. [ 430.651452][ T8519] Bluetooth: hci4: command tx timeout [ 430.673904][T18268] lo speed is unknown, defaulting to 1000 [ 430.745480][T18288] dummy0: entered allmulticast mode [ 431.140492][T18296] virt_wifi0 speed is unknown, defaulting to 1000 [ 431.176643][T18296] lo speed is unknown, defaulting to 1000 [ 431.253482][T18119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 431.369059][T18119] 8021q: adding VLAN 0 to HW filter on device team0 [ 431.468615][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 431.475829][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 431.514204][T18333] openvswitch: netlink: IPv6 tunnel dst address is zero [ 431.528639][ T1336] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.535882][ T1336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 431.557425][T18333] syzkaller1: entered promiscuous mode [ 431.584635][T18333] syzkaller1: entered allmulticast mode [ 431.942276][T18352] netlink: 'syz.3.3227': attribute type 10 has an invalid length. [ 431.984468][T18352] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 432.006573][T18357] netlink: 'syz.3.3227': attribute type 10 has an invalid length. [ 432.038479][T18352] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 432.058354][T18357] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3227'. [ 432.113188][T18357] batadv0: entered promiscuous mode [ 432.142524][T18357] batadv0: entered allmulticast mode [ 432.178736][T18357] bond0: (slave batadv0): Releasing backup interface [ 432.214401][T18357] bridge0: port 3(batadv0) entered blocking state [ 432.224489][T18357] bridge0: port 3(batadv0) entered disabled state [ 432.309428][T18119] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 432.483341][T18366] syzkaller0: entered promiscuous mode [ 432.522383][ T175] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 432.531891][ T175] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 432.654375][T18385] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3237'. [ 432.731274][ T8519] Bluetooth: hci4: command tx timeout [ 433.918893][T18384] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3237'. [ 434.042610][T18119] veth0_vlan: entered promiscuous mode [ 434.077998][T18119] veth1_vlan: entered promiscuous mode [ 434.185566][T18400] netlink: 'syz.2.3240': attribute type 13 has an invalid length. [ 434.203467][T18396] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.211237][T18396] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.219811][T18400] netlink: 'syz.2.3240': attribute type 17 has an invalid length. [ 434.234605][T18403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3238'. [ 434.245815][T18403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3238'. [ 434.257892][T18403] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3238'. [ 434.319096][T18396] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 434.332372][T18396] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 434.422344][T18119] veth0_macvtap: entered promiscuous mode [ 434.472764][T18400] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.482751][T18400] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.493936][T18400] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 434.540015][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.558884][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.572878][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.589020][T18401] virt_wifi0 speed is unknown, defaulting to 1000 [ 434.599316][T18119] veth1_macvtap: entered promiscuous mode [ 434.624253][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.681230][T18402] virt_wifi0 speed is unknown, defaulting to 1000 [ 434.690381][T18401] lo speed is unknown, defaulting to 1000 [ 434.714021][T18119] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 434.791771][T18402] lo speed is unknown, defaulting to 1000 [ 434.810880][ T8519] Bluetooth: hci4: command tx timeout [ 434.819270][T18119] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 434.847957][T18408] virt_wifi0 speed is unknown, defaulting to 1000 [ 434.923073][T18408] lo speed is unknown, defaulting to 1000 [ 435.013276][T18406] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3242'. [ 435.127318][T18406] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3242'. [ 435.155895][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.175557][T18425] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 435.189882][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.221013][T18426] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3246'. [ 435.284376][T18423] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 435.326556][T18406] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Remote Mapping info ret = -22) [ 435.413739][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.427372][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.525264][T18436] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 435.539892][T18436] bond2 (unregistering): Released all slaves [ 435.611433][T18437] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 436.071308][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.108232][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.224615][T18462] syzkaller0: entered promiscuous mode [ 436.231521][T18462] syzkaller0: entered allmulticast mode [ 436.259895][T18459] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3252'. [ 436.271903][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.285776][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.381510][T18459] team0: Port device team_slave_0 removed [ 436.601098][T18484] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3258'. [ 436.761523][T18494] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3260'. [ 437.031281][T18492] netlink: 'syz.1.3259': attribute type 29 has an invalid length. [ 437.046934][T18507] netlink: 'syz.1.3259': attribute type 29 has an invalid length. [ 438.724630][T18505] ip6gretap0: mtu less than device minimum [ 439.184501][T18540] virt_wifi0 speed is unknown, defaulting to 1000 [ 439.229209][T18546] ref_ctr_offset mismatch. inode: 0x28 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x8 [ 439.254388][T18540] lo speed is unknown, defaulting to 1000 [ 439.409776][T18558] __nla_validate_parse: 4 callbacks suppressed [ 439.409794][T18558] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3279'. [ 439.511664][T18559] syzkaller0: entered promiscuous mode [ 439.518505][T18559] syzkaller0: entered allmulticast mode [ 439.773318][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.238427][T18587] virt_wifi0 speed is unknown, defaulting to 1000 [ 441.257963][T18587] lo speed is unknown, defaulting to 1000 [ 441.272739][T18591] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3287'. [ 441.431397][T18591] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3287'. [ 441.717221][T18613] SET target dimension over the limit! [ 441.735151][T18602] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.742793][T18602] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.751194][T18615] IPVS: set_ctl: invalid protocol: 4 100.1.1.2:20000 [ 441.775440][T18613] IPVS: set_ctl: invalid protocol: 4 100.1.1.2:20000 [ 441.802349][T18616] SET target dimension over the limit! [ 441.901547][T18602] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 441.937955][T18602] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 442.219191][ T66] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.249373][ T66] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.280513][ T66] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.352556][ T66] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 442.411181][T18625] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3296'. [ 442.732313][T18640] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3301'. [ 442.917979][T18651] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3304'. [ 443.058477][T18665] tipc: Started in network mode [ 443.073899][T18665] tipc: Node identity 1ef4e20a3e68, cluster identity 4711 [ 443.092443][T18665] tipc: Enabled bearer , priority 0 [ 443.110399][T18665] syzkaller0: entered promiscuous mode [ 443.115894][T18665] syzkaller0: entered allmulticast mode [ 443.167492][T18672] tipc: Resetting bearer [ 443.182152][T18673] hsr0: entered promiscuous mode [ 443.227825][T18663] tipc: Resetting bearer [ 443.271135][T18663] tipc: Disabling bearer [ 443.296902][T18679] Unsupported ieee802154 address type: 0 [ 443.316348][T18673] hsr0: left promiscuous mode [ 443.335167][T18679] dummy0: entered promiscuous mode [ 443.352839][T18679] vlan2: entered promiscuous mode [ 443.486043][T18693] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3317'. [ 443.497927][T18693] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3317'. [ 443.641216][T18702] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3320'. [ 443.715610][T18702] 8021q: adding VLAN 0 to HW filter on device bond1 [ 443.783886][T18702] netlink: 'syz.2.3320': attribute type 1 has an invalid length. [ 445.147433][T18702] vxlan0: entered promiscuous mode [ 445.199319][T18752] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3328'. [ 445.265033][T18743] virt_wifi0 speed is unknown, defaulting to 1000 [ 445.296985][T18743] lo speed is unknown, defaulting to 1000 [ 445.347059][T18755] xt_cgroup: xt_cgroup: no path or classid specified [ 445.361498][T18757] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3330'. [ 445.518902][T18768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3333'. [ 445.528744][T18758] TC_ACT_REPEAT abuse ? [ 445.546577][T18769] batman_adv: batadv0: Adding interface: macvtap1 [ 445.562379][T18768] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3333'. [ 445.571377][T18769] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 445.614950][T18769] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 445.783453][T18779] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3335'. [ 445.897603][T18783] FAULT_INJECTION: forcing a failure. [ 445.897603][T18783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 445.922850][T18783] CPU: 0 UID: 0 PID: 18783 Comm: syz.2.3337 Not tainted syzkaller #0 PREEMPT(full) [ 445.922877][T18783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 445.922890][T18783] Call Trace: [ 445.922898][T18783] [ 445.922907][T18783] dump_stack_lvl+0xe8/0x150 [ 445.922940][T18783] should_fail_ex+0x412/0x560 [ 445.922977][T18783] _copy_from_user+0x2d/0xb0 [ 445.923002][T18783] do_sock_getsockopt+0x200/0x7e0 [ 445.923038][T18783] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 445.923100][T18783] ? __fget_files+0x3a0/0x420 [ 445.923119][T18783] ? __fget_files+0x2a/0x420 [ 445.923151][T18783] __x64_sys_getsockopt+0x1a4/0x240 [ 445.923190][T18783] do_syscall_64+0x14d/0xf80 [ 445.923214][T18783] ? trace_irq_disable+0x3b/0x150 [ 445.923232][T18783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.923252][T18783] ? clear_bhb_loop+0x40/0x90 [ 445.923277][T18783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.923308][T18783] RIP: 0033:0x7fd60bb9c819 [ 445.923326][T18783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.923343][T18783] RSP: 002b:00007fd60ca33028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 445.923363][T18783] RAX: ffffffffffffffda RBX: 00007fd60be15fa0 RCX: 00007fd60bb9c819 [ 445.923376][T18783] RDX: 000000000000006c RSI: 0000000000000084 RDI: 0000000000000003 [ 445.923388][T18783] RBP: 00007fd60ca33090 R08: 0000200000000480 R09: 0000000000000000 [ 445.923400][T18783] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000001 [ 445.923412][T18783] R13: 00007fd60be16038 R14: 00007fd60be15fa0 R15: 00007ffdf5f94288 [ 445.923458][T18783] [ 446.419571][T18799] x_tables: ip6_tables: AUDIT.0 target: invalid size 8 (kernel) != (user) 40 [ 446.786130][T18807] bridge_slave_0 (unregistering): left allmulticast mode [ 446.800683][T18807] bridge_slave_0 (unregistering): left promiscuous mode [ 446.810743][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 446.842553][T18807] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.128913][T18823] FAULT_INJECTION: forcing a failure. [ 447.128913][T18823] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 447.153176][T18823] CPU: 0 UID: 0 PID: 18823 Comm: syz.3.3348 Not tainted syzkaller #0 PREEMPT(full) [ 447.153203][T18823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 447.153216][T18823] Call Trace: [ 447.153224][T18823] [ 447.153232][T18823] dump_stack_lvl+0xe8/0x150 [ 447.153266][T18823] should_fail_ex+0x412/0x560 [ 447.153303][T18823] _copy_from_user+0x2d/0xb0 [ 447.153327][T18823] sctp_getsockopt_peer_addrs+0xef/0x6a0 [ 447.153352][T18823] ? do_raw_spin_lock+0x12b/0x2f0 [ 447.153376][T18823] ? __pfx_sctp_getsockopt_peer_addrs+0x10/0x10 [ 447.153409][T18823] ? __local_bh_enable_ip+0xd0/0x130 [ 447.153440][T18823] sctp_getsockopt+0x9be/0xb90 [ 447.153468][T18823] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 447.153494][T18823] do_sock_getsockopt+0x51d/0x7e0 [ 447.153530][T18823] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 447.153575][T18823] ? __fget_files+0x3a0/0x420 [ 447.153594][T18823] ? __fget_files+0x2a/0x420 [ 447.153620][T18823] __x64_sys_getsockopt+0x1a4/0x240 [ 447.153669][T18823] do_syscall_64+0x14d/0xf80 [ 447.153691][T18823] ? trace_irq_disable+0x3b/0x150 [ 447.153708][T18823] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.153727][T18823] ? clear_bhb_loop+0x40/0x90 [ 447.153750][T18823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.153769][T18823] RIP: 0033:0x7f135899c819 [ 447.153786][T18823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.153802][T18823] RSP: 002b:00007f1359774028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 447.153822][T18823] RAX: ffffffffffffffda RBX: 00007f1358c15fa0 RCX: 00007f135899c819 [ 447.153836][T18823] RDX: 000000000000006c RSI: 0000000000000084 RDI: 0000000000000003 [ 447.153847][T18823] RBP: 00007f1359774090 R08: 0000200000000480 R09: 0000000000000000 [ 447.153859][T18823] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000001 [ 447.153870][T18823] R13: 00007f1358c16038 R14: 00007f1358c15fa0 R15: 00007ffdb286a218 [ 447.153900][T18823] [ 447.429564][T18829] syzkaller0: entered promiscuous mode [ 447.435417][T18829] syzkaller0: entered allmulticast mode [ 447.545400][T18836] netlink: 'syz.3.3352': attribute type 1 has an invalid length. [ 447.636366][T18839] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3353'. [ 447.723544][T18843] netlink: 'syz.2.3354': attribute type 13 has an invalid length. [ 447.751702][T18843] netlink: 'syz.2.3354': attribute type 17 has an invalid length. [ 447.836682][T18843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 447.845215][T18843] 8021q: adding VLAN 0 to HW filter on device team0 [ 447.906936][T18843] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 447.947536][T18857] dvmrp6: entered allmulticast mode [ 448.106857][T18867] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 448.798688][T18892] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3373'. [ 449.154078][T18903] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.274614][T18903] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.359430][T18903] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.457756][T18903] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.523526][T18922] netlink: 'syz.0.3382': attribute type 1 has an invalid length. [ 449.557151][T18922] 8021q: adding VLAN 0 to HW filter on device bond2 [ 449.953308][T18922] bond2: (slave veth3): Enslaving as an active interface with a down link [ 450.020816][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 450.126806][T18923] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 450.136366][T18923] bond2: (slave batadv1): making interface the new active one [ 450.145300][T18923] batadv1: entered promiscuous mode [ 450.151439][T18923] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 450.439720][ T1336] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.506587][T18936] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.536434][T18936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.550440][T18936] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.559494][T18936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.599190][T18936] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.654437][T18936] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.690105][T18936] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3386'. [ 450.750330][ T1041] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.807892][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.857119][ T1041] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.936601][T18963] sctp: [Deprecated]: syz.2.3391 (pid 18963) Use of int in maxseg socket option. [ 450.936601][T18963] Use struct sctp_assoc_value instead [ 451.082249][T18971] netlink: 'syz.1.3392': attribute type 1 has an invalid length. [ 451.269563][T18981] bridge_slave_0: left allmulticast mode [ 451.286221][T18979] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.3396'. [ 451.309840][T18981] bridge_slave_0: left promiscuous mode [ 451.317254][T18979] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.3396'. [ 451.327655][T18981] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.328831][T18974] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3395'. [ 451.358727][T18981] bridge_slave_1: left allmulticast mode [ 451.364683][T18981] bridge_slave_1: left promiscuous mode [ 451.375683][T18981] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.397725][T18981] bond0: (slave bond_slave_0): Releasing backup interface [ 451.431085][T18981] bond0: (slave bond_slave_1): Releasing backup interface [ 451.489150][T18981] team0: Port device team_slave_1 removed [ 451.502891][T18981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 451.511347][T18981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 451.522163][T18981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 451.529707][T18981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 451.546794][T18981] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 451.972336][T19009] hsr_slave_0: left promiscuous mode [ 451.988795][T19009] hsr_slave_1: left promiscuous mode [ 452.473364][T19024] virt_wifi0 speed is unknown, defaulting to 1000 [ 452.501952][T19024] lo speed is unknown, defaulting to 1000 [ 452.616243][T19035] netlink: 'syz.1.3412': attribute type 1 has an invalid length. [ 452.624080][T19035] netlink: 'syz.1.3412': attribute type 2 has an invalid length. [ 452.685847][T19039] netlink: 'syz.4.3413': attribute type 10 has an invalid length. [ 452.881584][T19046] netlink: 'syz.4.3413': attribute type 10 has an invalid length. [ 452.943688][T19039] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 452.960007][T19039] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 452.976011][T19046] batadv0: entered promiscuous mode [ 453.000356][T19046] batadv0: entered allmulticast mode [ 453.051659][T19046] bond0: (slave batadv0): Releasing backup interface [ 453.113298][T19046] bridge0: port 3(batadv0) entered blocking state [ 453.129590][T19046] bridge0: port 3(batadv0) entered disabled state [ 453.189796][T19065] netlink: 'syz.1.3420': attribute type 2 has an invalid length. [ 453.198642][T19065] tipc: Cannot configure node identity twice [ 453.242115][ T1336] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 453.251729][ T1336] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 454.301873][T19132] x_tables: unsorted entry at hook 3 [ 455.081523][T19136] vlan2: entered promiscuous mode [ 455.086707][T19136] vlan1: entered promiscuous mode [ 455.321675][T19147] netlink: 'syz.1.3443': attribute type 21 has an invalid length. [ 455.547670][T19150] __nla_validate_parse: 17 callbacks suppressed [ 455.547685][T19150] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3444'. [ 457.062711][T19117] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 457.242539][T19158] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3446'. [ 457.258958][T19161] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 457.812760][T19173] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3449'. [ 458.873057][T19157] virt_wifi0 speed is unknown, defaulting to 1000 [ 458.895187][T19175] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 458.904370][T19175] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 458.955329][ T8234] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 34688 - 0 [ 458.967661][ T8234] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 458.994088][ T8234] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 34688 - 0 [ 459.010699][ T8234] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 459.050006][ T8234] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 34688 - 0 [ 459.065908][T19208] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3453'. [ 459.075255][ T8234] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 459.084564][T19157] lo speed is unknown, defaulting to 1000 [ 459.098346][T19208] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3453'. [ 459.116952][ T8234] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 34688 - 0 [ 459.131770][ T8234] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 459.594996][T19230] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3460'. [ 459.620033][T19232] Bluetooth: MGMT ver 1.23 [ 459.722986][T19240] netlink: 'syz.0.3463': attribute type 5 has an invalid length. [ 459.886794][T19250] Bluetooth: MGMT ver 1.23 [ 459.922128][T19247] virt_wifi0 speed is unknown, defaulting to 1000 [ 459.958219][T19247] lo speed is unknown, defaulting to 1000 [ 460.244907][T19258] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 460.710806][T19275] veth7: entered promiscuous mode [ 460.920519][T19287] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 460.967314][T19290] "syz.4.3475" (19290) uses obsolete ecb(arc4) skcipher [ 461.036153][T19290] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 461.185580][T19294] netlink: 120 bytes leftover after parsing attributes in process `syz.1.3478'. [ 461.195302][T19294] netlink: 'syz.1.3478': attribute type 1 has an invalid length. [ 461.203244][T19294] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3478'. [ 461.252407][T19302] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3476'. [ 461.279959][T19304] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3480'. [ 461.299482][T19302] netlink: 47 bytes leftover after parsing attributes in process `syz.2.3476'. [ 461.311380][T19302] netlink: 'syz.2.3476': attribute type 6 has an invalid length. [ 461.319259][T19307] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3476'. [ 461.328946][T19302] netlink: 'syz.2.3476': attribute type 6 has an invalid length. [ 461.344891][T19301] netlink: 208 bytes leftover after parsing attributes in process `syz.4.3479'. [ 461.788889][T19331] 8021q: adding VLAN 0 to HW filter on device bond3 [ 461.876788][T19339] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3487'. [ 462.050863][T19345] veth0_macvtap: entered allmulticast mode [ 462.101038][T19333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3486'. [ 462.163712][T19353] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3489'. [ 462.281101][T19354] netlink: 'syz.1.3490': attribute type 2 has an invalid length. [ 462.331291][ T8520] Bluetooth: hci5: command 0x0406 tx timeout [ 462.439870][T19361] openvswitch: netlink: Message has 1512 unknown bytes. [ 464.305202][T19457] netlink: 'syz.0.3514': attribute type 39 has an invalid length. [ 464.479120][T19462] syzkaller1: entered promiscuous mode [ 464.520576][T19462] syzkaller1: entered allmulticast mode [ 464.575811][T19464] netlink: 'syz.3.3519': attribute type 3 has an invalid length. [ 464.638971][T19471] netlink: 'syz.4.3521': attribute type 1 has an invalid length. [ 464.671906][T19474] netlink: 'syz.3.3523': attribute type 13 has an invalid length. [ 464.679789][T19474] netlink: 'syz.3.3523': attribute type 17 has an invalid length. [ 464.694387][T19188] IPVS: starting estimator thread 0... [ 464.756934][T19474] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 464.790507][T19476] IPVS: using max 35 ests per chain, 84000 per kthread [ 464.801923][T19484] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 465.137718][T19498] netlink: 'syz.0.3530': attribute type 1 has an invalid length. [ 465.599486][ T36] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.622663][ T36] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.632803][ T36] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.642289][ T36] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.981774][T19528] tipc: Resetting bearer [ 466.333955][T19548] virt_wifi0 speed is unknown, defaulting to 1000 [ 466.404252][T19564] __nla_validate_parse: 12 callbacks suppressed [ 466.404269][T19564] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3550'. [ 466.421108][T19548] lo speed is unknown, defaulting to 1000 [ 466.547133][T19564] macvlan2: entered allmulticast mode [ 466.563419][T19564] hsr0: entered allmulticast mode [ 466.576171][T19564] hsr_slave_0: entered allmulticast mode [ 466.595913][T19564] hsr_slave_1: entered allmulticast mode [ 467.145672][T19589] netlink: 'syz.0.3555': attribute type 1 has an invalid length. [ 467.289464][T19601] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3555'. [ 467.341893][T19595] bond4: (slave bridge4): Enslaving as a backup interface with an up link [ 467.514329][T19608] netlink: 'syz.3.3556': attribute type 4 has an invalid length. [ 467.595101][T19585] syzkaller0: entered promiscuous mode [ 467.604803][T19585] syzkaller0: entered allmulticast mode [ 468.128049][T19628] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3558'. [ 468.221626][T19635] Cannot find del_set index 0 as target [ 469.625268][T19617] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 469.650580][T19617] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 469.661382][T19650] veth1_macvtap: left promiscuous mode [ 469.674478][T19617] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 469.828528][T19664] netlink: 'syz.2.3563': attribute type 1 has an invalid length. [ 469.840406][T19664] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3563'. [ 470.028194][T19681] netlink: 'syz.1.3571': attribute type 1 has an invalid length. [ 470.036257][T19681] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3571'. [ 470.048024][T19681] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3571'. [ 470.059665][T19682] netlink: 'syz.2.3570': attribute type 10 has an invalid length. [ 470.069491][T19682] netlink: 2 bytes leftover after parsing attributes in process `syz.2.3570'. [ 470.090513][T19682] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 470.101312][T19682] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 470.118311][T19682] hsr0: entered promiscuous mode [ 470.128604][T19682] bridge0: port 3(hsr0) entered blocking state [ 470.135209][T19682] bridge0: port 3(hsr0) entered disabled state [ 470.142134][T19682] hsr0: entered allmulticast mode [ 470.147300][T19682] hsr_slave_0: entered allmulticast mode [ 470.153455][T19682] hsr_slave_1: entered allmulticast mode [ 470.223710][T19688] netlink: 'syz.4.3574': attribute type 10 has an invalid length. [ 470.299777][T19693] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 470.370446][T19700] netlink: 'syz.4.3577': attribute type 21 has an invalid length. [ 470.400634][T19700] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3577'. [ 470.411145][T19700] netlink: 'syz.4.3577': attribute type 4 has an invalid length. [ 470.419468][T19700] netlink: 'syz.4.3577': attribute type 3 has an invalid length. [ 470.427755][T19700] netlink: 3 bytes leftover after parsing attributes in process `syz.4.3577'. [ 470.519884][T19708] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3580'. [ 470.531303][T19708] netlink: 'syz.1.3580': attribute type 12 has an invalid length. [ 470.675244][ T30] audit: type=1804 audit(1776251635.640:11): pid=19717 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3581" name="/newroot/131/memory.events" dev="tmpfs" ino=690 res=1 errno=0 [ 470.714669][ T923] block nbd6: Receive control failed (result -32) [ 470.735343][ T30] audit: type=1800 audit(1776251635.670:12): pid=19717 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3581" name="memory.events" dev="tmpfs" ino=690 res=0 errno=0 [ 470.760968][ T30] audit: type=1804 audit(1776251635.670:13): pid=19717 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.3581" name="/newroot/131/memory.events" dev="tmpfs" ino=690 res=1 errno=0 [ 470.820721][ T8520] block nbd6: Receive control failed (result -32) [ 470.828180][ T8521] block nbd6: Receive control failed (result -32) [ 470.834894][T19719] block nbd6: Receive control failed (result -32) [ 471.158968][T19741] veth1_macvtap: left promiscuous mode [ 471.547764][T19763] __nla_validate_parse: 5 callbacks suppressed [ 471.547782][T19763] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3592'. [ 471.616854][T19773] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3594'. [ 471.777509][T19779] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3596'. [ 471.793859][T19779] ip6gretap1: entered allmulticast mode [ 472.129177][T19799] 8021q: VLANs not supported on gre0 [ 472.310695][T19806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3604'. [ 472.474170][T19810] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3605'. [ 472.573075][T19719] Bluetooth: hci0: command 0x0401 tx timeout [ 472.586879][T19823] validate_nla: 2 callbacks suppressed [ 472.586897][T19823] netlink: 'syz.1.3610': attribute type 3 has an invalid length. [ 473.367239][T19841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3617'. [ 473.388110][T19841] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3617'. [ 473.397451][T19841] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3617'. [ 473.407611][T19841] netlink: 'syz.0.3617': attribute type 1 has an invalid length. [ 473.415829][T19841] netlink: 'syz.0.3617': attribute type 3 has an invalid length. [ 473.540715][T19846] virt_wifi0 speed is unknown, defaulting to 1000 [ 473.551040][T19846] lo speed is unknown, defaulting to 1000 [ 473.658035][T19850] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3620'. [ 473.668221][T19850] ¾x9ÿ: renamed from bridge_slave_0 [ 473.919461][T19862] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3625'. [ 473.986741][T19864] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 474.178638][T19875] netlink: del zone limit has 8 unknown bytes [ 474.963289][T19907] bridge0: port 1(macsec1) entered blocking state [ 474.970062][T19907] bridge0: port 1(macsec1) entered disabled state [ 474.978339][T19907] macsec1: entered allmulticast mode [ 474.984217][T19907] bridge0: entered allmulticast mode [ 474.993695][T19907] macsec1: left allmulticast mode [ 475.009006][T19907] bridge0: left allmulticast mode [ 475.050020][T19909] gtp0: entered promiscuous mode [ 475.061859][T19909] gtp0: entered allmulticast mode [ 475.100547][T19912] bond1: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 475.112384][T19912] bond1 (unregistering): Released all slaves [ 475.178284][T19918] Cannot find set identified by id 0 to match [ 475.294920][T19922] virt_wifi0 speed is unknown, defaulting to 1000 [ 475.312439][T19922] lo speed is unknown, defaulting to 1000 [ 475.501832][T19931] xt_connbytes: Forcing CT accounting to be enabled [ 476.155185][T19961] netlink: 'syz.4.3657': attribute type 1 has an invalid length. [ 476.975490][T20009] vti0: entered promiscuous mode [ 476.988357][T20013] xt_hashlimit: size too large, truncated to 1048576 [ 476.997157][T20013] xt_hashlimit: max too large, truncated to 1048576 [ 477.021345][T20009] vti0: entered allmulticast mode [ 477.107547][T20020] __nla_validate_parse: 11 callbacks suppressed [ 477.107567][T20020] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3670'. [ 477.147930][T20022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3671'. [ 477.172345][T20022] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3671'. [ 477.193471][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.205984][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.280909][T20032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3675'. [ 477.435187][T20046] FAULT_INJECTION: forcing a failure. [ 477.435187][T20046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 477.460941][T20046] CPU: 0 UID: 0 PID: 20046 Comm: syz.2.3678 Not tainted syzkaller #0 PREEMPT(full) [ 477.460968][T20046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 477.460980][T20046] Call Trace: [ 477.460988][T20046] [ 477.460996][T20046] dump_stack_lvl+0xe8/0x150 [ 477.461030][T20046] should_fail_ex+0x412/0x560 [ 477.461066][T20046] _copy_from_iter+0x1d3/0x1670 [ 477.461091][T20046] ? rcu_is_watching+0x15/0xb0 [ 477.461124][T20046] ? __pfx__copy_from_iter+0x10/0x10 [ 477.461152][T20046] ? netlink_sendmsg+0x650/0xb40 [ 477.461180][T20046] ? skb_put+0x11b/0x210 [ 477.461211][T20046] netlink_sendmsg+0x6c0/0xb40 [ 477.461248][T20046] ? __pfx_netlink_sendmsg+0x10/0x10 [ 477.461280][T20046] ? aa_sock_msg_perm+0xf1/0x1b0 [ 477.461300][T20046] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 477.461327][T20046] ____sys_sendmsg+0x972/0x9f0 [ 477.461356][T20046] ? __lock_acquire+0x6b5/0x2cf0 [ 477.461389][T20046] ? __pfx_____sys_sendmsg+0x10/0x10 [ 477.461427][T20046] ? import_iovec+0x73/0xa0 [ 477.461453][T20046] ___sys_sendmsg+0x2a5/0x360 [ 477.461489][T20046] ? __pfx____sys_sendmsg+0x10/0x10 [ 477.461526][T20046] ? kstrtouint+0x6e/0xe0 [ 477.461579][T20046] ? __fget_files+0x2a/0x420 [ 477.461607][T20046] ? __fget_files+0x3a0/0x420 [ 477.461632][T20046] __sys_sendmmsg+0x27c/0x4e0 [ 477.461655][T20046] ? __pfx___sys_sendmmsg+0x10/0x10 [ 477.461678][T20046] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 477.461724][T20046] ? ksys_write+0x242/0x270 [ 477.461748][T20046] ? __pfx_ksys_write+0x10/0x10 [ 477.461774][T20046] __x64_sys_sendmmsg+0xa0/0xc0 [ 477.461811][T20046] do_syscall_64+0x14d/0xf80 [ 477.461833][T20046] ? trace_irq_disable+0x3b/0x150 [ 477.461851][T20046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.461871][T20046] ? clear_bhb_loop+0x40/0x90 [ 477.461895][T20046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.461915][T20046] RIP: 0033:0x7fd60bb9c819 [ 477.461932][T20046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 477.461952][T20046] RSP: 002b:00007fd60ca33028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 477.461974][T20046] RAX: ffffffffffffffda RBX: 00007fd60be15fa0 RCX: 00007fd60bb9c819 [ 477.461988][T20046] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 477.462001][T20046] RBP: 00007fd60ca33090 R08: 0000000000000000 R09: 0000000000000000 [ 477.462013][T20046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 477.462025][T20046] R13: 00007fd60be16038 R14: 00007fd60be15fa0 R15: 00007ffdf5f94288 [ 477.462055][T20046] [ 477.747145][ T8519] Bluetooth: hci1: command 0x0406 tx timeout [ 478.137900][T20068] bond1: Removing last arp target with arp_interval on [ 478.246752][T20073] syzkaller1: entered promiscuous mode [ 478.280302][T20073] syzkaller1: entered allmulticast mode [ 478.299778][T20081] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3685'. [ 478.597930][T20095] netlink: 'syz.2.3691': attribute type 21 has an invalid length. [ 478.608397][T20095] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3691'. [ 478.620971][T20095] netlink: 'syz.2.3691': attribute type 4 has an invalid length. [ 478.629761][T20095] netlink: 'syz.2.3691': attribute type 3 has an invalid length. [ 478.639964][T20095] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3691'. [ 478.952506][T20122] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3697'. [ 479.007521][T20123] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 479.119592][T20126] bond2: option mode: invalid value (254) [ 479.154871][T20126] bond2 (unregistering): Released all slaves [ 479.403242][T20152] x_tables: duplicate underflow at hook 2 [ 479.409187][T20151] x_tables: duplicate underflow at hook 2 [ 479.548386][T20164] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3710'. [ 479.776582][T20175] virt_wifi0 speed is unknown, defaulting to 1000 [ 479.802563][T20175] lo speed is unknown, defaulting to 1000 [ 480.368667][T20209] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3721'. [ 480.698431][T20236] virt_wifi0 speed is unknown, defaulting to 1000 [ 480.709324][T20236] lo speed is unknown, defaulting to 1000 [ 481.160817][T20259] virt_wifi0 speed is unknown, defaulting to 1000 [ 481.169555][T20259] lo speed is unknown, defaulting to 1000 [ 482.812163][ T8519] Bluetooth: hci2: command 0x0406 tx timeout [ 483.593674][T20230] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 483.623393][T20275] __nla_validate_parse: 3 callbacks suppressed [ 483.623411][T20275] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3738'. [ 483.763543][T20283] FAULT_INJECTION: forcing a failure. [ 483.763543][T20283] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.777232][T20283] CPU: 0 UID: 0 PID: 20283 Comm: syz.0.3743 Not tainted syzkaller #0 PREEMPT(full) [ 483.777256][T20283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 483.777268][T20283] Call Trace: [ 483.777276][T20283] [ 483.777283][T20283] dump_stack_lvl+0xe8/0x150 [ 483.777314][T20283] should_fail_ex+0x412/0x560 [ 483.777348][T20283] _copy_to_user+0x31/0xb0 [ 483.777373][T20283] simple_read_from_buffer+0xe1/0x170 [ 483.777405][T20283] proc_fail_nth_read+0x1bb/0x230 [ 483.777436][T20283] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 483.777467][T20283] ? rw_verify_area+0x2a6/0x4d0 [ 483.777488][T20283] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 483.777516][T20283] vfs_read+0x20c/0xa70 [ 483.777535][T20283] ? fdget_pos+0x246/0x320 [ 483.777556][T20283] ? __pfx___mutex_lock+0x10/0x10 [ 483.777580][T20283] ? __pfx_vfs_read+0x10/0x10 [ 483.777602][T20283] ? __fget_files+0x2a/0x420 [ 483.777622][T20283] ? __fget_files+0x3a0/0x420 [ 483.777639][T20283] ? __fget_files+0x2a/0x420 [ 483.777664][T20283] ksys_read+0x150/0x270 [ 483.777686][T20283] ? __pfx_ksys_read+0x10/0x10 [ 483.777717][T20283] do_syscall_64+0x14d/0xf80 [ 483.777738][T20283] ? trace_irq_disable+0x3b/0x150 [ 483.777754][T20283] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.777773][T20283] ? clear_bhb_loop+0x40/0x90 [ 483.777796][T20283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.777814][T20283] RIP: 0033:0x7f4fa935d04e [ 483.777830][T20283] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 483.777846][T20283] RSP: 002b:00007f4fa75f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 483.777865][T20283] RAX: ffffffffffffffda RBX: 00007f4fa75f66c0 RCX: 00007f4fa935d04e [ 483.777879][T20283] RDX: 000000000000000f RSI: 00007f4fa75f60a0 RDI: 0000000000000004 [ 483.777890][T20283] RBP: 00007f4fa75f6090 R08: 0000000000000000 R09: 0000000000000000 [ 483.777902][T20283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.777912][T20283] R13: 00007f4fa9616038 R14: 00007f4fa9615fa0 R15: 00007fff5b1da238 [ 483.777942][T20283] [ 484.016954][T20287] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3740'. [ 484.033503][T20286] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 484.118765][T20287] netlink: 644 bytes leftover after parsing attributes in process `syz.2.3740'. [ 484.659966][T20315] xt_CONNSECMARK: invalid mode: 254 [ 484.870938][T20319] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3750'. [ 484.879932][T20319] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3750'. [ 485.377910][T20327] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3752'. [ 485.924048][T20309] virt_wifi0 speed is unknown, defaulting to 1000 [ 485.952119][T20309] lo speed is unknown, defaulting to 1000 [ 486.058493][T20334] siw: device registration error -23 [ 486.144896][T20331] virt_wifi0 speed is unknown, defaulting to 1000 [ 486.157663][T20331] lo speed is unknown, defaulting to 1000 [ 486.725596][T20377] netlink: 'syz.4.3764': attribute type 1 has an invalid length. [ 486.742166][T20377] netlink: 'syz.4.3764': attribute type 4 has an invalid length. [ 486.749970][T20377] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.3764'. [ 486.762399][T20380] syzkaller1: entered promiscuous mode [ 486.768179][T20380] syzkaller1: entered allmulticast mode [ 486.822994][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.831380][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.839448][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.847976][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.858082][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.880818][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.888766][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 486.896907][T20383] netlink: 'syz.4.3766': attribute type 5 has an invalid length. [ 487.118888][T20396] netlink: 41 bytes leftover after parsing attributes in process `syz.2.3771'. [ 487.145067][T20396] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3771'. [ 487.168965][T20396] netlink: 41 bytes leftover after parsing attributes in process `syz.2.3771'. [ 488.127351][T20446] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 488.268755][T20458] syzkaller0: entered promiscuous mode [ 488.276828][T20458] syzkaller0: entered allmulticast mode [ 489.743656][T20480] __nla_validate_parse: 13 callbacks suppressed [ 489.743673][T20480] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3800'. [ 489.888217][T20495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 489.900602][T20495] 8021q: adding VLAN 0 to HW filter on device team0 [ 489.926554][T20495] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 489.961503][T20506] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3806'. [ 490.063658][T20510] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3808'. [ 490.073009][T20510] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3808'. [ 490.084513][T20510] IPVS: ip_vs_edit_dest(): server weight less than zero [ 490.218922][T20526] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3810'. [ 490.332833][T20526] netlink: 160 bytes leftover after parsing attributes in process `syz.2.3810'. [ 490.344801][T20526] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3810'. [ 490.416041][T20530] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3810'. [ 490.580794][T20543] geneve2: entered promiscuous mode [ 490.594620][T20543] geneve2: entered allmulticast mode [ 490.611515][ T1041] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 490.631926][ T1041] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 490.648893][ T1041] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 490.663902][ T1041] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 491.188355][T20571] netlink: 120 bytes leftover after parsing attributes in process `syz.2.3821'. [ 491.251273][T20571] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3821'. [ 491.422547][T20593] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.555730][T20598] syzkaller0: entered promiscuous mode [ 491.670587][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034de8400: rx timeout, send abort [ 492.170715][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034dea800: rx timeout, send abort [ 492.179113][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034de8400: abort rx timeout. Force session deactivation [ 492.679106][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034dea800: abort rx timeout. Force session deactivation [ 493.735259][T20655] bridge2: entered promiscuous mode [ 493.740686][T20655] bridge2: entered allmulticast mode [ 494.023895][T20667] Bluetooth: MGMT ver 1.23 [ 494.051256][T20671] syzkaller0: entered promiscuous mode [ 494.077124][T20671] syzkaller0: entered allmulticast mode [ 494.256932][T20680] x_tables: duplicate underflow at hook 1 [ 494.404899][T20691] validate_nla: 62 callbacks suppressed [ 494.404918][T20691] netlink: 'syz.2.3861': attribute type 1 has an invalid length. [ 494.701439][T20712] virt_wifi0 speed is unknown, defaulting to 1000 [ 494.711123][T20712] lo speed is unknown, defaulting to 1000 [ 494.870535][T20717] syzkaller0: entered promiscuous mode [ 494.877069][T20717] syzkaller0: entered allmulticast mode [ 495.129309][T20727] __nla_validate_parse: 6 callbacks suppressed [ 495.129329][T20727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3872'. [ 495.686558][T20755] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3880'. [ 495.942993][T20762] syzkaller0: entered promiscuous mode [ 495.950561][T20762] syzkaller0: entered allmulticast mode [ 495.983510][T20772] netlink: 'syz.4.3885': attribute type 10 has an invalid length. [ 496.053683][T20777] netlink: 'syz.2.3886': attribute type 13 has an invalid length. [ 496.062937][T20777] netlink: 'syz.2.3886': attribute type 17 has an invalid length. [ 496.101059][T20772] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3885'. [ 496.114353][T20777] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 496.178235][T20781] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3888'. [ 496.190474][T20781] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3888'. [ 496.212137][T20781] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 496.666988][T20793] tipc: Enabled bearer , priority 0 [ 496.688527][T20793] syzkaller0: entered promiscuous mode [ 496.704229][T20793] syzkaller0: entered allmulticast mode [ 496.738742][T20793] tipc: Resetting bearer [ 496.754187][T20792] tipc: Resetting bearer [ 496.801088][T20792] tipc: Disabling bearer [ 496.944017][T20801] virt_wifi0 speed is unknown, defaulting to 1000 [ 497.001995][T20801] lo speed is unknown, defaulting to 1000 [ 497.056414][T20810] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3896'. [ 497.083100][T20814] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 497.262412][T20816] bond2: entered allmulticast mode [ 497.268076][T20816] 8021q: adding VLAN 0 to HW filter on device bond2 [ 497.383091][T20823] syzkaller0: entered promiscuous mode [ 497.388806][T20823] syzkaller0: entered allmulticast mode [ 497.637651][T20845] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3902'. [ 497.694410][T20842] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3902'. [ 498.203676][T20875] netlink: 428 bytes leftover after parsing attributes in process `syz.0.3912'. [ 498.224533][T20871] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3910'. [ 498.297221][T20875] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 498.322828][T20875] bond5 (unregistering): Released all slaves [ 498.397995][T20876] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 498.425460][T20876] bond5 (unregistering): Released all slaves [ 498.468411][T20891] syzkaller0: entered promiscuous mode [ 498.474499][T20891] syzkaller0: entered allmulticast mode [ 498.736706][T20902] virt_wifi0 speed is unknown, defaulting to 1000 [ 498.761843][T20906] syzkaller1: entered promiscuous mode [ 498.769702][T20906] syzkaller1: entered allmulticast mode [ 498.786571][T20902] lo speed is unknown, defaulting to 1000 [ 498.788530][T20906] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 498.973655][T20912] syzkaller0: entered promiscuous mode [ 500.495176][T20933] __nla_validate_parse: 3 callbacks suppressed [ 500.495195][T20933] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3927'. [ 500.646577][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3929'. [ 500.689510][T20929] virt_wifi0 speed is unknown, defaulting to 1000 [ 500.700972][T20946] xt_TCPMSS: Only works on TCP SYN packets [ 500.753225][T20929] lo speed is unknown, defaulting to 1000 [ 500.782567][T20921] virt_wifi0 speed is unknown, defaulting to 1000 [ 500.821830][T20948] syzkaller0: entered promiscuous mode [ 500.827448][T20948] syzkaller0: entered allmulticast mode [ 500.834884][T20937] virt_wifi0 speed is unknown, defaulting to 1000 [ 500.859184][T20921] lo speed is unknown, defaulting to 1000 [ 500.904360][T20937] lo speed is unknown, defaulting to 1000 [ 501.049104][T20954] netlink: 'syz.3.3933': attribute type 1 has an invalid length. [ 501.068197][T20954] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3933'. [ 501.077745][T20955] netlink: 'syz.3.3933': attribute type 1 has an invalid length. [ 501.086801][T20955] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3933'. [ 501.198574][T20964] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3936'. [ 501.218814][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.243485][T20964] nbd: must specify a device to reconfigure [ 501.572370][T20986] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3942'. [ 501.584903][T20977] IPVS: Scheduler module ip_vs_ not found [ 501.619711][T20977] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3942'. [ 501.939812][T20997] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3947'. [ 502.007398][T21002] ipt_ECN: cannot use operation on non-tcp rule [ 502.031868][T21002] ipt_ECN: cannot use operation on non-tcp rule [ 502.052003][T21001] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3949'. [ 502.070671][T21001] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3949'. [ 502.666940][T21039] FAULT_INJECTION: forcing a failure. [ 502.666940][T21039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 502.682132][T21039] CPU: 0 UID: 0 PID: 21039 Comm: syz.4.3962 Not tainted syzkaller #0 PREEMPT(full) [ 502.682158][T21039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 502.682171][T21039] Call Trace: [ 502.682179][T21039] [ 502.682187][T21039] dump_stack_lvl+0xe8/0x150 [ 502.682231][T21039] should_fail_ex+0x412/0x560 [ 502.682265][T21039] _copy_from_user+0x2d/0xb0 [ 502.682289][T21039] ___sys_sendmsg+0x1c6/0x360 [ 502.682340][T21039] ? __pfx____sys_sendmsg+0x10/0x10 [ 502.682405][T21039] ? __fget_files+0x2a/0x420 [ 502.682433][T21039] ? __fget_files+0x3a0/0x420 [ 502.682459][T21039] __x64_sys_sendmsg+0x1bd/0x2a0 [ 502.682490][T21039] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 502.682527][T21039] ? __pfx_ksys_write+0x10/0x10 [ 502.682558][T21039] do_syscall_64+0x14d/0xf80 [ 502.682590][T21039] ? trace_irq_disable+0x3b/0x150 [ 502.682607][T21039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.682644][T21039] ? clear_bhb_loop+0x40/0x90 [ 502.682685][T21039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.682707][T21039] RIP: 0033:0x7f3cd599c819 [ 502.682726][T21039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.682745][T21039] RSP: 002b:00007f3cd68f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 502.682768][T21039] RAX: ffffffffffffffda RBX: 00007f3cd5c15fa0 RCX: 00007f3cd599c819 [ 502.682784][T21039] RDX: 0000000000040000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 502.682799][T21039] RBP: 00007f3cd68f4090 R08: 0000000000000000 R09: 0000000000000000 [ 502.682812][T21039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.682825][T21039] R13: 00007f3cd5c16038 R14: 00007f3cd5c15fa0 R15: 00007ffe601b17d8 [ 502.682860][T21039] [ 503.109830][T21043] syzkaller0: entered promiscuous mode [ 503.120333][T21043] syzkaller0: entered allmulticast mode [ 503.503767][T21073] FAULT_INJECTION: forcing a failure. [ 503.503767][T21073] name failslab, interval 1, probability 0, space 0, times 0 [ 503.532331][T21073] CPU: 0 UID: 0 PID: 21073 Comm: syz.1.3971 Not tainted syzkaller #0 PREEMPT(full) [ 503.532358][T21073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 503.532389][T21073] Call Trace: [ 503.532397][T21073] [ 503.532406][T21073] dump_stack_lvl+0xe8/0x150 [ 503.532442][T21073] should_fail_ex+0x412/0x560 [ 503.532481][T21073] should_failslab+0xa8/0x100 [ 503.532531][T21073] __kmalloc_cache_noprof+0x88/0x660 [ 503.532555][T21073] ? __pfx_stack_trace_save+0x10/0x10 [ 503.532601][T21073] ? rtnl_newlink+0x136/0x1bb0 [ 503.532634][T21073] rtnl_newlink+0x136/0x1bb0 [ 503.532664][T21073] ? kasan_save_track+0x3e/0x80 [ 503.532687][T21073] ? kasan_save_free_info+0x46/0x50 [ 503.532717][T21073] ? __kasan_slab_free+0x5c/0x80 [ 503.532743][T21073] ? dev_hard_start_xmit+0x2d8/0x870 [ 503.532762][T21073] ? __dev_queue_xmit+0x14d9/0x3980 [ 503.532782][T21073] ? __netlink_deliver_tap+0x5ad/0x850 [ 503.532812][T21073] ? netlink_deliver_tap+0x19c/0x1b0 [ 503.532840][T21073] ? netlink_unicast+0x730/0x8e0 [ 503.532865][T21073] ? netlink_sendmsg+0x813/0xb40 [ 503.532896][T21073] ? __pfx_rtnl_newlink+0x10/0x10 [ 503.532923][T21073] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.532984][T21073] ? kasan_quarantine_put+0xbb/0x1f0 [ 503.533007][T21073] ? lockdep_hardirqs_on+0x7a/0x110 [ 503.533035][T21073] ? kmem_cache_free+0x187/0x630 [ 503.533060][T21073] ? nlmon_xmit+0xb0/0x100 [ 503.533101][T21073] ? __lock_acquire+0x6b5/0x2cf0 [ 503.533136][T21073] ? __local_bh_enable_ip+0xd0/0x130 [ 503.533165][T21073] ? lockdep_hardirqs_on+0x7a/0x110 [ 503.533189][T21073] ? __dev_queue_xmit+0x2b6/0x3980 [ 503.533210][T21073] ? __local_bh_enable_ip+0xd0/0x130 [ 503.533236][T21073] ? __dev_queue_xmit+0x2b6/0x3980 [ 503.533284][T21073] ? __pfx_rtnl_newlink+0x10/0x10 [ 503.533316][T21073] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 503.533349][T21073] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 503.533377][T21073] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 503.533404][T21073] ? ref_tracker_free+0x693/0x840 [ 503.533429][T21073] ? __pfx_ref_tracker_free+0x10/0x10 [ 503.533462][T21073] netlink_rcv_skb+0x232/0x4b0 [ 503.533501][T21073] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 503.533531][T21073] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 503.533575][T21073] ? netlink_deliver_tap+0x2e/0x1b0 [ 503.533605][T21073] ? netlink_deliver_tap+0x2e/0x1b0 [ 503.533642][T21073] netlink_unicast+0x75c/0x8e0 [ 503.533682][T21073] netlink_sendmsg+0x813/0xb40 [ 503.533722][T21073] ? __pfx_netlink_sendmsg+0x10/0x10 [ 503.533758][T21073] ? aa_sock_msg_perm+0xf1/0x1b0 [ 503.533780][T21073] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 503.533809][T21073] ____sys_sendmsg+0x972/0x9f0 [ 503.533870][T21073] ? __pfx_____sys_sendmsg+0x10/0x10 [ 503.533911][T21073] ? import_iovec+0x73/0xa0 [ 503.533939][T21073] ___sys_sendmsg+0x2a5/0x360 [ 503.533976][T21073] ? __pfx____sys_sendmsg+0x10/0x10 [ 503.534045][T21073] ? __fget_files+0x2a/0x420 [ 503.534063][T21073] ? __fget_files+0x3a0/0x420 [ 503.534093][T21073] __x64_sys_sendmsg+0x1bd/0x2a0 [ 503.534128][T21073] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 503.534169][T21073] ? __pfx_ksys_write+0x10/0x10 [ 503.534204][T21073] do_syscall_64+0x14d/0xf80 [ 503.534228][T21073] ? trace_irq_disable+0x3b/0x150 [ 503.534245][T21073] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.534268][T21073] ? clear_bhb_loop+0x40/0x90 [ 503.534293][T21073] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.534314][T21073] RIP: 0033:0x7fc5c079c819 [ 503.534333][T21073] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.534352][T21073] RSP: 002b:00007fc5be9d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.534374][T21073] RAX: ffffffffffffffda RBX: 00007fc5c0a16180 RCX: 00007fc5c079c819 [ 503.534389][T21073] RDX: 0000000004000010 RSI: 0000200000000280 RDI: 0000000000000008 [ 503.534402][T21073] RBP: 00007fc5be9d5090 R08: 0000000000000000 R09: 0000000000000000 [ 503.534415][T21073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.534427][T21073] R13: 00007fc5c0a16218 R14: 00007fc5c0a16180 R15: 00007ffd85c836d8 [ 503.534460][T21073] [ 505.226608][T21065] bond0: Unable to set down delay as MII monitoring is disabled [ 505.449700][T21094] Unknown options in mask 6 [ 505.489464][T21089] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 505.531941][T21089] syzkaller0: entered promiscuous mode [ 505.540130][T21089] syzkaller0: entered allmulticast mode [ 505.773882][T21101] __nla_validate_parse: 3 callbacks suppressed [ 505.773902][T21101] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3980'. [ 505.787202][T21105] virt_wifi0 speed is unknown, defaulting to 1000 [ 505.866524][T21105] lo speed is unknown, defaulting to 1000 [ 505.872963][T21112] nbd7: detected capacity change from 0 to 127 [ 506.024846][T21129] netlink: 292 bytes leftover after parsing attributes in process `syz.1.3988'. [ 506.087652][T21122] syzkaller0: entered promiscuous mode [ 506.096190][T21122] syzkaller0: entered allmulticast mode [ 506.109780][T19719] block nbd7: Receive control failed (result -104) [ 506.299489][T21122] macsec1: entered promiscuous mode [ 506.337006][T21122] macsec1: entered allmulticast mode [ 507.093110][T21169] [ 507.095527][T21169] ====================================================== [ 507.102560][T21169] WARNING: possible circular locking dependency detected [ 507.109601][T21169] syzkaller #0 Not tainted [ 507.114030][T21169] ------------------------------------------------------ [ 507.121063][T21169] syz.1.3998/21169 is trying to acquire lock: [ 507.127151][T21169] ffffffff8e883760 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x4a/0x690 [ 507.137056][T21169] [ 507.137056][T21169] but task is already holding lock: [ 507.144438][T21169] ffff8880326460e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 507.154145][T21169] [ 507.154145][T21169] which lock already depends on the new lock. [ 507.154145][T21169] [ 507.164577][T21169] [ 507.164577][T21169] the existing dependency chain (in reverse order) is: [ 507.173606][T21169] [ 507.173606][T21169] -> #7 (k-sk_lock-AF_INET6){+.+.}-{0:0}: [ 507.181557][T21169] lock_sock_nested+0x41/0x100 [ 507.186868][T21169] mptcp_connect+0x4c3/0x830 [ 507.192004][T21169] __inet_stream_connect+0x25a/0xdd0 [ 507.197847][T21169] inet_stream_connect+0x66/0xa0 [ 507.203350][T21169] __sys_connect+0x312/0x450 [ 507.208489][T21169] __x64_sys_connect+0x7a/0x90 [ 507.213795][T21169] do_syscall_64+0x14d/0xf80 [ 507.218935][T21169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.225376][T21169] [ 507.225376][T21169] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 507.233133][T21169] lock_sock_nested+0x41/0x100 [ 507.238442][T21169] inet_shutdown+0x6a/0x390 [ 507.243489][T21169] nbd_mark_nsock_dead+0x2e9/0x560 [ 507.249144][T21169] recv_work+0x1c7f/0x1d90 [ 507.254110][T21169] process_scheduled_works+0xb6e/0x18c0 [ 507.260203][T21169] worker_thread+0xa53/0xfc0 [ 507.265337][T21169] kthread+0x388/0x470 [ 507.269944][T21169] ret_from_fork+0x51e/0xb90 [ 507.275078][T21169] ret_from_fork_asm+0x1a/0x30 [ 507.280393][T21169] [ 507.280393][T21169] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 507.288063][T21169] __mutex_lock+0x19f/0x1300 [ 507.293209][T21169] nbd_queue_rq+0x37b/0x1100 [ 507.298353][T21169] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 507.304471][T21169] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 507.311348][T21169] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 507.317884][T21169] blk_mq_run_hw_queue+0x348/0x4f0 [ 507.323573][T21169] blk_mq_dispatch_list+0xd16/0xe10 [ 507.329328][T21169] blk_mq_flush_plug_list+0x48d/0x570 [ 507.335249][T21169] __blk_flush_plug+0x3ed/0x4d0 [ 507.340656][T21169] __submit_bio+0x28d/0x580 [ 507.345726][T21169] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 507.351920][T21169] block_read_full_folio+0x599/0x830 [ 507.357770][T21169] filemap_read_folio+0x137/0x3b0 [ 507.363349][T21169] do_read_cache_folio+0x358/0x590 [ 507.369020][T21169] read_part_sector+0xb6/0x2b0 [ 507.374339][T21169] adfspart_check_ICS+0xa5/0xa40 [ 507.380080][T21169] bdev_disk_changed+0x7ba/0x1550 [ 507.385660][T21169] blkdev_get_whole+0x380/0x510 [ 507.391064][T21169] bdev_open+0x31e/0xd30 [ 507.395874][T21169] blkdev_open+0x470/0x610 [ 507.400849][T21169] do_dentry_open+0x785/0x14e0 [ 507.406162][T21169] vfs_open+0x3b/0x340 [ 507.410785][T21169] path_openat+0x2e08/0x3860 [ 507.415915][T21169] do_file_open+0x23e/0x4a0 [ 507.420957][T21169] do_sys_openat2+0x113/0x200 [ 507.426197][T21169] __x64_sys_openat+0x138/0x170 [ 507.431611][T21169] do_syscall_64+0x14d/0xf80 [ 507.436741][T21169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.443173][T21169] [ 507.443173][T21169] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 507.450421][T21169] __mutex_lock+0x19f/0x1300 [ 507.455566][T21169] nbd_queue_rq+0xc6/0x1100 [ 507.460616][T21169] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 507.466708][T21169] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 507.473593][T21169] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 507.480126][T21169] blk_mq_run_hw_queue+0x348/0x4f0 [ 507.485791][T21169] blk_mq_dispatch_list+0xd16/0xe10 [ 507.491547][T21169] blk_mq_flush_plug_list+0x48d/0x570 [ 507.497484][T21169] __blk_flush_plug+0x3ed/0x4d0 [ 507.502889][T21169] __submit_bio+0x28d/0x580 [ 507.507946][T21169] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 507.514123][T21169] block_read_full_folio+0x599/0x830 [ 507.519957][T21169] filemap_read_folio+0x137/0x3b0 [ 507.525527][T21169] do_read_cache_folio+0x358/0x590 [ 507.531185][T21169] read_part_sector+0xb6/0x2b0 [ 507.536497][T21169] adfspart_check_ICS+0xa5/0xa40 [ 507.542011][T21169] bdev_disk_changed+0x7ba/0x1550 [ 507.547588][T21169] blkdev_get_whole+0x380/0x510 [ 507.552999][T21169] bdev_open+0x31e/0xd30 [ 507.557781][T21169] blkdev_open+0x470/0x610 [ 507.562746][T21169] do_dentry_open+0x785/0x14e0 [ 507.568073][T21169] vfs_open+0x3b/0x340 [ 507.572704][T21169] path_openat+0x2e08/0x3860 [ 507.577829][T21169] do_file_open+0x23e/0x4a0 [ 507.582883][T21169] do_sys_openat2+0x113/0x200 [ 507.588108][T21169] __x64_sys_openat+0x138/0x170 [ 507.593512][T21169] do_syscall_64+0x14d/0xf80 [ 507.598679][T21169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.605125][T21169] [ 507.605125][T21169] -> #3 (set->srcu){.+.+}-{0:0}: [ 507.612303][T21169] __synchronize_srcu+0xca/0x300 [ 507.617793][T21169] elevator_switch+0x1e8/0x7a0 [ 507.623111][T21169] elevator_change+0x2cc/0x450 [ 507.628429][T21169] elevator_set_default+0x36c/0x430 [ 507.634187][T21169] blk_register_queue+0x366/0x430 [ 507.639771][T21169] __add_disk+0x677/0xd50 [ 507.644678][T21169] add_disk_fwnode+0xfb/0x480 [ 507.649907][T21169] nbd_dev_add+0x72c/0xb50 [ 507.654888][T21169] nbd_init+0x168/0x1f0 [ 507.659595][T21169] do_one_initcall+0x250/0x8d0 [ 507.664910][T21169] do_initcall_level+0x104/0x190 [ 507.670395][T21169] do_initcalls+0x59/0xa0 [ 507.675370][T21169] kernel_init_freeable+0x2a6/0x3e0 [ 507.681125][T21169] kernel_init+0x1d/0x1d0 [ 507.686009][T21169] ret_from_fork+0x51e/0xb90 [ 507.691170][T21169] ret_from_fork_asm+0x1a/0x30 [ 507.696529][T21169] [ 507.696529][T21169] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 507.704386][T21169] __mutex_lock+0x19f/0x1300 [ 507.709543][T21169] elevator_change+0x1b3/0x450 [ 507.714871][T21169] elevator_set_none+0xb5/0x140 [ 507.720296][T21169] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 507.726655][T21169] nbd_start_device+0x17f/0xb10 [ 507.732063][T21169] nbd_genl_connect+0x165b/0x1cf0 [ 507.737632][T21169] genl_family_rcv_msg_doit+0x22a/0x330 [ 507.743721][T21169] genl_rcv_msg+0x61c/0x7a0 [ 507.748779][T21169] netlink_rcv_skb+0x232/0x4b0 [ 507.754182][T21169] genl_rcv+0x28/0x40 [ 507.758706][T21169] netlink_unicast+0x75c/0x8e0 [ 507.764021][T21169] netlink_sendmsg+0x813/0xb40 [ 507.769337][T21169] ____sys_sendmsg+0x972/0x9f0 [ 507.774663][T21169] ___sys_sendmsg+0x2a5/0x360 [ 507.779910][T21169] __x64_sys_sendmsg+0x1bd/0x2a0 [ 507.785393][T21169] do_syscall_64+0x14d/0xf80 [ 507.790535][T21169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.796964][T21169] [ 507.796964][T21169] -> #1 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 507.805618][T21169] blk_alloc_queue+0x546/0x680 [ 507.810929][T21169] __blk_mq_alloc_disk+0x197/0x390 [ 507.816583][T21169] nbd_dev_add+0x499/0xb50 [ 507.821536][T21169] nbd_init+0x168/0x1f0 [ 507.826237][T21169] do_one_initcall+0x250/0x8d0 [ 507.831555][T21169] do_initcall_level+0x104/0x190 [ 507.837043][T21169] do_initcalls+0x59/0xa0 [ 507.841923][T21169] kernel_init_freeable+0x2a6/0x3e0 [ 507.847677][T21169] kernel_init+0x1d/0x1d0 [ 507.852558][T21169] ret_from_fork+0x51e/0xb90 [ 507.857700][T21169] ret_from_fork_asm+0x1a/0x30 [ 507.863030][T21169] [ 507.863030][T21169] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 507.870265][T21169] __lock_acquire+0x15a5/0x2cf0 [ 507.875667][T21169] lock_acquire+0xf0/0x2e0 [ 507.880626][T21169] fs_reclaim_acquire+0x71/0x100 [ 507.886113][T21169] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 507.892469][T21169] __alloc_skb+0x1d0/0x7d0 [ 507.897434][T21169] tcp_stream_alloc_skb+0x3f/0x580 [ 507.903082][T21169] tcp_connect+0x1567/0x5440 [ 507.908217][T21169] tcp_v4_connect+0x10f7/0x19b0 [ 507.913610][T21169] tcp_v6_connect+0xbbb/0x1b10 [ 507.918910][T21169] __inet_stream_connect+0x25a/0xdd0 [ 507.924757][T21169] inet_stream_connect+0x66/0xa0 [ 507.930242][T21169] kernel_connect+0x141/0x1c0 [ 507.935549][T21169] smc_connect+0x7a5/0xd90 [ 507.940513][T21169] __sys_connect+0x312/0x450 [ 507.945649][T21169] __x64_sys_connect+0x7a/0x90 [ 507.950964][T21169] do_syscall_64+0x14d/0xf80 [ 507.956098][T21169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.962524][T21169] [ 507.962524][T21169] other info that might help us debug this: [ 507.962524][T21169] [ 507.972765][T21169] Chain exists of: [ 507.972765][T21169] fs_reclaim --> sk_lock-AF_INET6 --> k-sk_lock-AF_INET6 [ 507.972765][T21169] [ 507.985761][T21169] Possible unsafe locking scenario: [ 507.985761][T21169] [ 507.993241][T21169] CPU0 CPU1 [ 507.998622][T21169] ---- ---- [ 508.004001][T21169] lock(k-sk_lock-AF_INET6); [ 508.008706][T21169] lock(sk_lock-AF_INET6); [ 508.015743][T21169] lock(k-sk_lock-AF_INET6); [ 508.022972][T21169] lock(fs_reclaim); [ 508.026987][T21169] [ 508.026987][T21169] *** DEADLOCK *** [ 508.026987][T21169] [ 508.035141][T21169] 2 locks held by syz.1.3998/21169: [ 508.040347][T21169] #0: ffff888032b940e0 (sk_lock-AF_SMC){+.+.}-{0:0}, at: smc_connect+0xbd/0xd90 [ 508.049537][T21169] #1: ffff8880326460e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 508.059859][T21169] [ 508.059859][T21169] stack backtrace: [ 508.065782][T21169] CPU: 0 UID: 0 PID: 21169 Comm: syz.1.3998 Not tainted syzkaller #0 PREEMPT(full) [ 508.065807][T21169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 508.065820][T21169] Call Trace: [ 508.065828][T21169] [ 508.065836][T21169] dump_stack_lvl+0xe8/0x150 [ 508.065868][T21169] print_circular_bug+0x2e1/0x300 [ 508.065910][T21169] check_noncircular+0x12e/0x150 [ 508.065946][T21169] __lock_acquire+0x15a5/0x2cf0 [ 508.065977][T21169] ? inet_sk_rebuild_header+0x93/0x1da0 [ 508.066001][T21169] ? __lock_acquire+0x6b5/0x2cf0 [ 508.066030][T21169] lock_acquire+0xf0/0x2e0 [ 508.066056][T21169] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 508.066085][T21169] fs_reclaim_acquire+0x71/0x100 [ 508.066110][T21169] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 508.066132][T21169] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 508.066156][T21169] ? __alloc_skb+0x1d0/0x7d0 [ 508.066185][T21169] ? ipv4_default_advmss+0x20/0x340 [ 508.066208][T21169] __alloc_skb+0x1d0/0x7d0 [ 508.066239][T21169] tcp_stream_alloc_skb+0x3f/0x580 [ 508.066261][T21169] ? __asan_memset+0x22/0x50 [ 508.066282][T21169] tcp_connect+0x1567/0x5440 [ 508.066330][T21169] ? __pfx_tcp_connect+0x10/0x10 [ 508.066369][T21169] ? __asan_memset+0x22/0x50 [ 508.066392][T21169] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 508.066418][T21169] ? secure_tcp_seq_and_ts_off+0xf2/0x1d0 [ 508.066453][T21169] ? sk_setup_caps+0x9ef/0xc40 [ 508.066485][T21169] ? sk_setup_caps+0x29/0xc40 [ 508.066517][T21169] tcp_v4_connect+0x10f7/0x19b0 [ 508.066540][T21169] ? sched_clock+0x3f/0x60 [ 508.066573][T21169] ? __pfx_tcp_v4_connect+0x10/0x10 [ 508.066595][T21169] ? lockdep_hardirqs_on+0x7a/0x110 [ 508.066620][T21169] ? tcp_v6_connect+0x62d/0x1b10 [ 508.066644][T21169] tcp_v6_connect+0xbbb/0x1b10 [ 508.066671][T21169] ? __pfx_tcp_v6_connect+0x10/0x10 [ 508.066694][T21169] ? __pfx___resched_curr+0x10/0x10 [ 508.066726][T21169] __inet_stream_connect+0x25a/0xdd0 [ 508.066762][T21169] ? do_raw_spin_lock+0x12b/0x2f0 [ 508.066784][T21169] ? __pfx___inet_stream_connect+0x10/0x10 [ 508.066819][T21169] ? inet_stream_connect+0x51/0xa0 [ 508.066851][T21169] ? __local_bh_enable_ip+0xd0/0x130 [ 508.066881][T21169] inet_stream_connect+0x66/0xa0 [ 508.066921][T21169] kernel_connect+0x141/0x1c0 [ 508.066945][T21169] ? __pfx_kernel_connect+0x10/0x10 [ 508.066965][T21169] ? do_raw_spin_lock+0x12b/0x2f0 [ 508.066991][T21169] ? smc_connect+0xbd/0xd90 [ 508.067012][T21169] ? __local_bh_enable_ip+0xd0/0x130 [ 508.067042][T21169] smc_connect+0x7a5/0xd90 [ 508.067065][T21169] __sys_connect+0x312/0x450 [ 508.067095][T21169] ? __pfx___sys_connect+0x10/0x10 [ 508.067129][T21169] ? rcu_is_watching+0x15/0xb0 [ 508.067163][T21169] __x64_sys_connect+0x7a/0x90 [ 508.067192][T21169] do_syscall_64+0x14d/0xf80 [ 508.067216][T21169] ? trace_irq_disable+0x3b/0x150 [ 508.067234][T21169] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.067255][T21169] ? clear_bhb_loop+0x40/0x90 [ 508.067279][T21169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.067299][T21169] RIP: 0033:0x7fc5c079c819 [ 508.067317][T21169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.067336][T21169] RSP: 002b:00007fc5c1571028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 508.067357][T21169] RAX: ffffffffffffffda RBX: 00007fc5c0a15fa0 RCX: 00007fc5c079c819 [ 508.067373][T21169] RDX: 000000000000001c RSI: 00002000000001c0 RDI: 0000000000000082 [ 508.067386][T21169] RBP: 00007fc5c0832c91 R08: 0000000000000000 R09: 0000000000000000 [ 508.067399][T21169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 508.067411][T21169] R13: 00007fc5c0a16038 R14: 00007fc5c0a15fa0 R15: 00007ffd85c836d8 [ 508.067435][T21169] [ 509.212895][ T5159] block nbd7: Connection timed out, retrying (0/1 alive) [ 509.219994][ T5159] block nbd7: Connection timed out, retrying (0/1 alive) [ 509.227181][ T5159] block nbd7: Connection timed out, retrying (0/1 alive) [ 509.234365][ T5159] block nbd7: Connection timed out, retrying (0/1 alive) [ 509.241522][ T25] block nbd7: Dead connection, failed to find a fallback [ 509.248580][ T25] block nbd7: shutting down sockets [ 509.254148][ T25] I/O error, dev nbd7, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.263682][ T25] Buffer I/O error on dev nbd7, logical block 2, async page read [ 509.271533][ T25] I/O error, dev nbd7, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.281143][ T25] Buffer I/O error on dev nbd7, logical block 1, async page read [ 509.289038][ T25] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.298834][ T25] Buffer I/O error on dev nbd7, logical block 0, async page read [ 509.306665][ T25] I/O error, dev nbd7, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.316181][ T25] Buffer I/O error on dev nbd7, logical block 3, async page read [ 509.324554][T19550] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.334171][T19550] Buffer I/O error on dev nbd7, logical block 0, async page read [ 509.341992][T19550] I/O error, dev nbd7, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.351809][T19550] Buffer I/O error on dev nbd7, logical block 1, async page read [ 509.359603][T19550] I/O error, dev nbd7, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.369144][T19550] Buffer I/O error on dev nbd7, logical block 2, async page read [ 509.377097][T19550] I/O error, dev nbd7, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.386742][T19550] Buffer I/O error on dev nbd7, logical block 3, async page read [ 509.394866][T19550] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.404413][T19550] Buffer I/O error on dev nbd7, logical block 0, async page read [ 509.412224][T19550] I/O error, dev nbd7, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 509.422013][T19550] Buffer I/O error on dev nbd7, logical block 1, async page read [ 509.430288][T19550] ldm_validate_partition_table(): Disk read failed. [ 509.437269][T19550] Dev nbd7: unable to read RDB block 0 [ 509.443398][T19550] nbd7: unable to read partition table [ 509.453836][T19550] ldm_validate_partition_table(): Disk read failed. [ 509.461872][T19550] Dev nbd7: unable to read RDB block 0 [ 509.467792][T19550] nbd7: unable to read partition table