last executing test programs: 10m39.499984141s ago: executing program 0 (id=3770): r0 = socket(0x18, 0x803, 0x2) getsockname$packet(r0, 0x0, &(0x7f00000003c0)=0x3e) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x88, 0x0, @remote, @local}, {0xfffe, 0x4e24, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "497a1d08fd3d0ee007022798bb6374ed840b4f36f41fc4d035e9ebe414aa958d", "4bbef5e4007898221aa606d083cd59745493938f1e2de8fdadd3823fedd2c01b2aff03050a4ca5d10fd1b6b06f47ea42", "ef7c9d6a98854743fe4dc8d2e7c0ce70a4ac7d00", {"a851525b16af17fe87acbae2ab0b233d", "01422d01cd53c3abe94331d0b7918724"}}}}}}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'pimreg\x00', 0x5005}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(0x0, r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, 0x0, 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x18, 0x1, 0x1, [r8, r7]}}], 0x18, 0x40008c1}, 0x84) r9 = socket(0x80000000000000a, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_group_source_req(r9, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}}}, 0x108) setsockopt$inet6_group_source_req(r9, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) close(r7) close(0x3) unshare(0x400) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) r10 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000040)=0x1c) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) 10m39.270340616s ago: executing program 0 (id=3773): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6erspan0\x00', 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001800310800000000000000001d01000005000d00"], 0x1c}}, 0x800) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) r3 = accept(r0, &(0x7f00000002c0)=@rc={0x1f, @fixed}, &(0x7f0000000080)=0x80) ioctl$IMGETVERSION(r3, 0x80044942, &(0x7f0000000100)) (async) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500010320000000000000000c0000000800040001"], 0x1c}}, 0x4000000) 10m38.990374918s ago: executing program 0 (id=3778): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x20008004) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @empty}, 0x3ff, 0x0, 0x2}}, 0x2e) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000640)={'wlan1\x00'}) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, 0x0, 0x40c0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELOBJ={0x40, 0x14, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_OBJ_USERDATA={0x4}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x516f0d0d3eb68eb5}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELRULE={0x14, 0x8, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x2}}, @NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0xa}}, @NFT_MSG_DELFLOWTABLE={0x34, 0x18, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xc4}, 0x1, 0x0, 0x0, 0x800}, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x1c, 0x4, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x40) 10m38.762146799s ago: executing program 0 (id=3781): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$SIOCGIFMTU(0xffffffffffffffff, 0x8921, &(0x7f00000002c0)={'syz_tun\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002500)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000500000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8f23e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae0000c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910a3193e90be231a05fd82e6003969c31082ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a3d19c158a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b884057aeb68f3d675a79907a72ace70902459f6950a06a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbd488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc816df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d044fa492aa38717481455e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000000000000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634e89aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3319f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f9863800f127d6b4518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c104fe52837a19dd6952fe2724c0105ab158a54a6a73000000000000000000"], &(0x7f0000000140)='GPL\x00'}, 0x48) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000180)=0x200000, 0x4) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f00000003c0), &(0x7f0000000400)=0x18) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000200)=r1) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r4}) setsockopt$netrom_NETROM_T1(r7, 0x103, 0x1, &(0x7f0000000180), 0x4) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r8, 0x19}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000440)="83dbdb0000", 0x5}], 0x1}, 0x5) 10m33.895990308s ago: executing program 0 (id=3792): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2, 0x80805, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={@private2, 0x74, r2}) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x84, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x80d, 0x0, 0x10000000, 0x5, 0x4}, 0x1, r4}}]}, {0x0, 0xa}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_mpls={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x1}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4008001}, 0x0) 10m33.451620137s ago: executing program 0 (id=3795): ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22fff6) (async) r0 = socket$inet_udplite(0x2, 0x2, 0x88) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xa, 0x8c, 0x40, 0x3, 0x8, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x50) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x45c], 0x0, 0x0, 0x100000, 0x1, r4}}, 0x40) (async) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) r5 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)=@o_path={&(0x7f0000000240)='./file0\x00', 0x0, 0x4000}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="180000001a000000000000000200000005045bf90100000085100000030000008520000005000000b0ad249a180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000000600000018000000060000000000000002000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7000085000000060000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x10, 0x1000, &(0x7f0000001080)=""/4096, 0x41100, 0xe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x0, 0x5, 0x7fff, 0x4}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000340)=[r1, r2, r5], &(0x7f0000000380)=[{0x0, 0x2, 0x10, 0x1}, {0x2, 0x5, 0x2, 0x1}, {0x5, 0x1, 0x5, 0x3}, {0x1, 0x4, 0xf, 0x6}, {0x4, 0x2, 0x0, 0xc}, {0x4, 0x3, 0x1, 0x4}], 0x10, 0x7fff}, 0x94) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x8, 0x3, 0x490, 0x338, 0xa, 0x148, 0x338, 0x60, 0x3f8, 0x2a8, 0x2a8, 0x3f8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00', {}, {}, 0xff}, 0x0, 0x2c8, 0x338, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@socket2={{0x28}, 0x1}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x1d, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00', {}, {}, 0x0, 0x0, 0x20}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r7) sendmsg$NLBL_MGMT_C_ADDDEF(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="ff090000", @ANYRES16=r8, @ANYBLOB="01002cbd7000fedbdf250400000008000800ac1414aa080002000300000008000700ac1414bb0800040003000000"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, &(0x7f00000004c0)=0x7) (async) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000540)={0x4, &(0x7f0000000500)=[{0x7, 0xb8, 0x9, 0x9}, {0xb, 0x4, 0x8, 0x101}, {0x8, 0xd, 0x9, 0x9}, {0x2, 0x3, 0x9, 0xfffff801}]}, 0x10) 10m17.823475164s ago: executing program 32 (id=3795): ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22fff6) (async) r0 = socket$inet_udplite(0x2, 0x2, 0x88) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xa, 0x8c, 0x40, 0x3, 0x8, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x50) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x45c], 0x0, 0x0, 0x100000, 0x1, r4}}, 0x40) (async) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) r5 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)=@o_path={&(0x7f0000000240)='./file0\x00', 0x0, 0x4000}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="180000001a000000000000000200000005045bf90100000085100000030000008520000005000000b0ad249a180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000000600000018000000060000000000000002000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7000085000000060000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x10, 0x1000, &(0x7f0000001080)=""/4096, 0x41100, 0xe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x0, 0x5, 0x7fff, 0x4}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000340)=[r1, r2, r5], &(0x7f0000000380)=[{0x0, 0x2, 0x10, 0x1}, {0x2, 0x5, 0x2, 0x1}, {0x5, 0x1, 0x5, 0x3}, {0x1, 0x4, 0xf, 0x6}, {0x4, 0x2, 0x0, 0xc}, {0x4, 0x3, 0x1, 0x4}], 0x10, 0x7fff}, 0x94) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x8, 0x3, 0x490, 0x338, 0xa, 0x148, 0x338, 0x60, 0x3f8, 0x2a8, 0x2a8, 0x3f8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00', {}, {}, 0xff}, 0x0, 0x2c8, 0x338, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@socket2={{0x28}, 0x1}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x1d, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00', {}, {}, 0x0, 0x0, 0x20}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r7) sendmsg$NLBL_MGMT_C_ADDDEF(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="ff090000", @ANYRES16=r8, @ANYBLOB="01002cbd7000fedbdf250400000008000800ac1414aa080002000300000008000700ac1414bb0800040003000000"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, &(0x7f00000004c0)=0x7) (async) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000540)={0x4, &(0x7f0000000500)=[{0x7, 0xb8, 0x9, 0x9}, {0xb, 0x4, 0x8, 0x101}, {0x8, 0xd, 0x9, 0x9}, {0x2, 0x3, 0x9, 0xfffff801}]}, 0x10) 8.089669264s ago: executing program 3 (id=7261): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r1, &(0x7f0000009580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)=[{0x10, 0x6, 0x8}, {0x10, 0x0, 0x492}], 0x20}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000008140)=[{0x10, 0x3a, 0x4}, {0x10, 0x1, 0x3}], 0x20}}], 0x2, 0x40840) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x1a, 0x0, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r5) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x24, r6, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_PS_STATE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040004}, 0x4000080) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)={0x40, r2, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_DEVKEY={0x24, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}]}]}, 0x40}}, 0x4000040) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r5) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3b, &(0x7f0000000300)=[{}], 0x8, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0xd2, 0x8, 0x8, &(0x7f0000000440)}}, 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0xf, &(0x7f00000004c0)={@loopback, 0x0}, &(0x7f0000000500)=0x14) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r7, &(0x7f0000000740)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x38, r9, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xd2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r11}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000010}, 0x40) 7.490866189s ago: executing program 3 (id=7266): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000300)={r1, 0x1, 0x0, @broadcast}, 0x49) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000000)='wg0\x00', 0x4) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000200)={r1, 0x11, 0x6, @random="bdf19b71a0f9"}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000020c0)={r1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000240)={r1, 0x1, 0x6, @broadcast}, 0x10) r2 = socket$inet(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000600)="4c0000001200ff09ff3a150099a283ff04b8008000f0ffff0000000600401500240036001fc411a0b598bc593ab6821148a730cc33a49868c62b2ca654a6613b6aab14e39ba9bf6c4387ea1b", 0x4c}], 0x1}, 0x0) recvmmsg(r2, &(0x7f0000001300)=[{{0x0, 0x0, 0x0}}], 0x300, 0x48, 0x0) 7.147532868s ago: executing program 3 (id=7273): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000000)={0x24, @long={0x3, 0x0, {0x300}}}, 0x14) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, r2, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x80}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xca1}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5a}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x8080}, 0x4000800) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0xa0620102}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x88, r3, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x400}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8001}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000080}, 0x80) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), r1) sendmsg$DEVLINK_CMD_PORT_SET(r1, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x44, r4, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x3}}]}, 0x44}}, 0x4000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000005c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r5, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x28, r6, 0x4, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x200048c1) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r1) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r5, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x901}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x5c, r8, 0x101, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x45986a42}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x48044) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x40, 0x3, 0x6, 0x301, 0x0, 0x0, {0xa, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4001}, 0x4) sendmsg$IPSET_CMD_LIST(r9, &(0x7f0000000a00)={&(0x7f0000000940), 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x34, 0x7, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0x95) sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000c00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000a80)={0x104, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vxcan1\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x81}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x452d}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fff}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xb}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, '\x00', 0x44}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}]}, 0x104}, 0x1, 0x0, 0x0, 0x44}, 0x800) r10 = socket$netlink(0x10, 0x3, 0x12) r11 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000c40)='memory.swap.current\x00', 0x0, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000c80)=r11, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000cc0), 0x8000, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000d00)) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_DEST(r12, &(0x7f00000010c0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001080)={&(0x7f0000000f40)={0x120, r2, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x60, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x84}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010102}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1c}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x991a}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3d}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7ff}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x20008015}, 0x4000001) sendmsg$IPSET_CMD_ADD(r10, &(0x7f0000001280)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001240)={&(0x7f0000001140)={0xe8, 0x9, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7fffffff}, @IPSET_ATTR_DATA={0x60, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP2_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x3}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x7}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x7}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x1}, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x3}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x5}]}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x9}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x37}}}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}]}, @IPSET_ATTR_ADT={0x48, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x8}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xee5a}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x2f}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x3}}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x400c814}, 0x4000010) sendmsg$RDMA_NLDEV_CMD_RES_GET(r11, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x40, 0x1409, 0x200, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x1) r13 = openat$cgroup_ro(r11, &(0x7f00000013c0)='cpuset.memory_pressure\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r13, &(0x7f0000001580)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001540)={&(0x7f0000001440)={0x100, 0x0, 0x1, 0x801, 0x0, 0x0, {0xe, 0x0, 0x6}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_TUPLE_MASTER={0xc0, 0xe, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @local}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x38}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_ZONE={0x6}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1402}]}, 0x100}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 6.948471895s ago: executing program 3 (id=7275): socket$kcm(0x29, 0x2, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) sendfile(r3, r4, 0x0, 0xffffffff000) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r6) sendmsg$NLBL_MGMT_C_ADD(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="00010000", @ANYRES16=r7, @ANYBLOB="cd3e00000000000000000100000008000200ecffffffce0001"], 0x100}}, 0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0x1c}}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) sendmsg$NFC_CMD_DEP_LINK_UP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8180840}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x3c, r2, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_COMM_MODE={0x5}, @NFC_ATTR_COMM_MODE={0x5}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000040000000000000000000007110b7000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.482256668s ago: executing program 5 (id=7286): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) close(r1) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a1", 0x4}], 0x1}, 0x9fc) syz_genetlink_get_family_id$nfc(&(0x7f0000000400), r6) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000140)=ANY=[], 0x14) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000240)=0xfffffffffffffffe, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xb, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000041ffffff000000000b004f62b3ae73f6e057010400000000000000009a3f0f44982724ff61b332b21dc1e989613b760f6c91a1ce2b9a6138e2be7b93ed1b22e91449d1ce05f186d1ffa80a466f2ad00d3242f5fd657a75a8b51a"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x410fd, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x94) splice(r3, 0x0, r0, 0x0, 0xf3a, 0x0) tee(r0, r1, 0x8f5, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) write(r2, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) writev(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x141402, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$xdp(0x2c, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001004040000000000000000000000000a20000000000a0102000000000000000001000000090001007352f64ee7b1797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}, 0x1, 0x0, 0x0, 0x8001}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xf, 0x2) 3.684479838s ago: executing program 4 (id=7289): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f0000000000)={'batadv_slave_1\x00', {0x2, 0x0, @empty=0xfe000000}}) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f00000000c0)=""/213, &(0x7f0000000040)=0xd5) openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0) close(0x3) 3.684219049s ago: executing program 3 (id=7290): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd7000fbdbdf2514000000080001000200000008001d00", @ANYRES32, @ANYBLOB="08000300", @ANYRES32, @ANYBLOB='\b\x00#'], 0x54}, 0x1, 0x0, 0x0, 0x20040000}, 0x10) r2 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) r3 = socket(0x10, 0x3, 0x0) (rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (rerun: 32) getsockopt$X25_QBITINCL(r4, 0x106, 0x1, 0x0, &(0x7f0000000440)) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@gettfilter={0x6c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x8, 0xf}, {0xc}, {0xfff2, 0xd}}, [{0x8, 0xb, 0x702}, {0x8, 0xb, 0xf}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x5}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0xb47d}, {0x8, 0xb, 0xfffffffc}, {0x8, 0xb, 0xffffffff}, {0x8, 0xb, 0x400}]}, 0x6c}, 0x1, 0x0, 0x0, 0x2}, 0x2000c05c) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001e00010a00000000000000a42d"], 0x14}, 0x1, 0x0, 0x0, 0x5daea4d3e560a25d}, 0x50) 3.616555539s ago: executing program 5 (id=7291): r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x74, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x9}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x48, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xf, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa, [{0x200, 0x500, 0x3, 0xe}, {0x6783, 0x2, 0x8001, 0x10}, {0x40000, 0x53, 0xa9, 0x80000001}]}}]}}]}, 0x74}}, 0x20000000) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0x4, 0x70bd26, 0x21dfdbfc, {0x0, 0x0, 0x0, r6, {0x3, 0xf}, {}, {0x9, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000014}, 0x200c4004) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000480)="b19ccccf84f531d9ec214627c11430c1", 0x20) r8 = accept$alg(r7, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f00000009c0)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="3f5e978e345482212cf7cd37be", 0xd}, {&(0x7f0000000000)="ece600", 0xfffffe5a}], 0x2, &(0x7f0000000640)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x20000000}], 0x1, 0x24000040) recvmmsg(r8, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001480)=""/194, 0x34000}], 0x1}, 0x4}], 0x1, 0x2120, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000003c0)="00002e000d1982762d822c175dd6fae7458dbf5dfb694c9ac68ff9a9e45ba551bd4713c640a847ae902de4125311eee542b39438b159d34a6764bdd4706f6827a5", 0x77db}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_tcp_buf(r2, 0x6, 0x21, &(0x7f0000000340)=""/60, &(0x7f0000000380)=0x3c) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r10 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r10, &(0x7f0000000080)={0x2, 0x4e24, @remote}, 0x10) r11 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r11, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xfffd, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdb6, 0x3, [@default, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@newtaction={0x68, 0x30, 0x871a15abc695fb3d, 0x8000000, 0xfffffffd, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x54, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x12, 0x3, 0xffffffffffffffff, 0x1, 0x7c2}, 0x40000002}}]}, {0x4, 0x6, "156c58e6140000000000000047d3289b"}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x240400c0) ioctl$sock_netrom_SIOCADDRT(r11, 0x890b, &(0x7f00000000c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x0, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x101, 0x7, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}) connect$inet(r10, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r10, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) 3.070447761s ago: executing program 4 (id=7294): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000fedbdf251000000008003b000300000008000600", @ANYRES32=r3, @ANYBLOB="08000300", @ANYRES32=r3], 0x34}, 0x1, 0x0, 0x0, 0x44004}, 0x4040000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0xffffffff}]}}]}, 0x40}}, 0x8000) sendmsg$ETHTOOL_MSG_EEE_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0xfc, r4, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x40}, 0x404c0cc) 2.778888065s ago: executing program 5 (id=7297): sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x2, 0x80805, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000400)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00\x00@\x00'}, 0x28) writev(r1, &(0x7f00000009c0)=[{&(0x7f00000008c0)="581a", 0x2}], 0x1) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) readv(r1, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xff1}], 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r4, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r5, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 2.778348312s ago: executing program 4 (id=7298): socket$nl_route(0x10, 0x3, 0x0) 2.609396116s ago: executing program 4 (id=7299): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720a06fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed00000f030000000000001d44000000000000730a04fe0000000072030000000a0000b500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef77997e344e61482808c02b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8081}, 0x40000) unshare(0x66000080) 2.544337068s ago: executing program 5 (id=7300): r0 = socket$inet6(0xa, 0x3, 0x2) r1 = socket(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000100)=@assoc_value, &(0x7f00000001c0)=0x8) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x1c, 0x52, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @uid}]}, 0x1c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x38, 0x1, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0xfffd}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x5}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x24, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x4c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$inet(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000000)=0x5, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x44, &(0x7f0000000040)={0x0, 0x0}, 0x10) 2.486929102s ago: executing program 2 (id=7301): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x2400805d}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtfilter={0x70, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xe, 0xe}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_flow={{0x9}, {0x40, 0x2, [@TCA_FLOW_EMATCHES={0x3c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x80, 0x7, 0x8000}, {{0x0, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x7f, 0x1, 0x93}, {0xfffffffc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}}}]}]}]}}]}, 0x70}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8f655a10a0015000900142603600e1208000f0000000401a80016002000014003000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) 2.461920197s ago: executing program 1 (id=7302): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x0, 0x40000160, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000108000)={{0x0, 0x8, 0x100000000, 0xfffffffffffffffc, 0x0, 0x8, 0x9, 0x400, 0x3, 0x4, 0x36a58e4a, 0xd, 0x2, 0x75, 0x1}}) 2.413043553s ago: executing program 5 (id=7303): r0 = socket(0x15, 0x5, 0x0) connect$netrom(r0, &(0x7f00000000c0)={{0xa, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default]}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000000c0)=0x41) pwritev(r1, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd02000040", 0x42}], 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000001800"/198, @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001840)=@bpf_ext={0x1c, 0x1, &(0x7f0000000300)=@raw=[@alu={0x4, 0x1, 0xf3767c68fa0481d3, 0x4, 0x7, 0x20, 0x8}], &(0x7f0000000340)='GPL\x00', 0xfffffc00, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2469, r5, 0x0, 0x0, 0x0, 0x10, 0x878}, 0x94) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x2d6}, 0x10) write(r6, &(0x7f0000000000)="240000001a005f0400f9f407000904018000200000000000000000000800010000000000", 0x24) unshare(0x6a040000) socket$kcm(0x29, 0x7, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001ac0)=ANY=[@ANYBLOB="b702000006000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2a24a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112b0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01ac69398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9877399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ef6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a8449f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b6214912a517810200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d2943e6f5f828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000056c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734837ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a6d072034cecc457776c5fa1f33b0203c072083c9cda0b7480e0b17854ffcc76176ce266bc698f7921b8afe798a7a5ed33ab0374455ee368fda99a0e681bf9426831b193395cb01a7332a50aac841cb7d48a1768a7640a9820631ba775a00000000000000000000d550c9f15fbb2324a3f37dc4ba"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x18000000000002a0, 0xe2c, 0x60000000, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff00124000632c77fbac141416ac14141683029f034d2f87e5890c6aab845013f2325f1a39018303178da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) getsockname$tipc(r0, 0x0, &(0x7f0000000080)) 2.266204324s ago: executing program 1 (id=7304): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) r2 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r2, &(0x7f0000001bc0)={0x2c, 0xf81e225b3e466090, 0x0, 0x3e, r2}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r1}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000240)={@empty, @local, 0x0}, &(0x7f0000000280)=0xc) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x200000006c832, r5, 0x80000) splice(r6, &(0x7f0000000040), r5, 0x0, 0x800000000ff, 0x0) r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000380)=@generic={&(0x7f0000000340)='./file0\x00', 0x0, 0x8}, 0x18) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0600000008000000000001000100000000400000", @ANYRES32, @ANYBLOB="0100010000000000000079395308246c2da12fd5ed0754409916c0ce57277fbd", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000010000000100"/28], 0x50) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000440), &(0x7f0000000480)='%pi6 \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)=r1}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0xdad, 0x0, 0x0, 0x0, 0xd567}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x2}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x1000, &(0x7f0000002440)=""/4096, 0x41100, 0x10, '\x00', r4, 0x25, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x1, 0x10, 0xd, 0xf19}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000005c0)=[r7, r8, r9, r10], &(0x7f0000000640)=[{0x0, 0x4, 0xe, 0x1}], 0x10, 0xbd7}, 0x94) 2.126969315s ago: executing program 2 (id=7305): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x3f5}, [@NFT_MSG_DELSET={0x14, 0xb, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}}], {0x14, 0x3ed}}, 0x3c}, 0x1, 0x0, 0x0, 0x24004010}, 0xc144) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f00000002c0)={'vxcan1\x00', 0x0}) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000300)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x200, '\x00', r5, r6, 0x5, 0x5}, 0x50) r7 = socket$inet_udplite(0x2, 0x2, 0x88) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newsa={0xf0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@dev={0xac, 0x14, 0x14, 0x3e}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in=@empty, {}, {0x0, 0x0, 0x8000000, 0x200}, {0xf1, 0x0, 0x2}, 0x0, 0x0, 0x8, 0x0, 0x0, 0xcd}}, 0xf0}}, 0x800) ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e20, @loopback}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xdfd182dcd395e7a6}}, 0x0, {0x2, 0x4e20, @rand_addr=0x60010100}, 'xfrm0\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r1) r9 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r9) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a03000000000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r10], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350064756d6d79300000000000000000000008000a00", @ANYRES32=r3], 0x3c}}, 0x8000) 1.801513394s ago: executing program 1 (id=7306): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c01000011002300"/20, @ANYRES32=0x0, @ANYRES32, @ANYRES32, @ANYBLOB='\b\x00.'], 0x14c}, 0x1, 0x0, 0x0, 0x40080c5}, 0x4000000) r1 = socket(0x28, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_BOS={0x5}, @TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8848}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r3) connect$rose(r3, &(0x7f0000002a00)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000240)=0xc) syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, 0x0, 0x10) connect$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0xffffec77, @hyper}, 0x10) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x40, 0x1407, 0x10, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x5}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x40}}, 0x4000000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x6e8, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x618, 0xffffffff, 0xffffffff, 0x618, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x330, 0x358, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', {0x6}}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x2c0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0xc4, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0xffffffffffffffff, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x8000, 0x16a, 0x1, 'syz1\x00', 'syz0\x00', {0x80000001}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x748) 1.530148443s ago: executing program 3 (id=7307): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') write$bt_hci(r0, &(0x7f0000000080)={0x1, @write_def_err_data_reporting={{0xc5b, 0x1}, {0x1a}}}, 0x5) unshare(0x6a040000) r1 = socket(0x8, 0x0, 0x8000) ioctl$sock_netrom_SIOCADDRT(r1, 0x61d1, 0x0) (async) ioctl$sock_netrom_SIOCADDRT(r1, 0x61d1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006b04000000d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$EXT4_IOC_SETFSUUID(r0, 0x4008662c, &(0x7f00000000c0)={0x0, 0x0, "59d6e082a9eca838728aeb014483b0e8"}) (async) ioctl$EXT4_IOC_SETFSUUID(r0, 0x4008662c, &(0x7f00000000c0)={0x0, 0x0, "59d6e082a9eca838728aeb014483b0e8"}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5400000010000304000300"/20, @ANYRES32=0x0, @ANYBLOB="00000000010000002400128009000100766c616e000000001400028006000100fc0f00000600050088a8000008000500", @ANYRES32=r5, @ANYBLOB="0000000c2321983d0f90060000000000000000000000000000000000000000000000718a739636514ab20e321ba14c9b0fef71b066901ccf25238d43b1848b609041df36c587547be6a598882d3e3442a6eb7a2eae1d8e0da0bae47fbab7978f5088063865de7fbe47cce388718b0b923a601039c8824795bae78814376b2773e9fac69158ec4770b49e00d43e20d590f3e6288a437600b61add2b8c86c395bdb9645df2ad8202d8b52aef9cfc5ea07d7ddf77b1322334ce777038596025", @ANYRES32=r5, @ANYBLOB], 0x54}}, 0x8000) 1.528791639s ago: executing program 1 (id=7308): socket$kcm(0x2, 0x3, 0x2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha384\x00'}, 0x58) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0x14, 0x0, &(0x7f0000000100)="259a53f271a76d2608fff74588a80a3888ca2f15", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305\x00'}, 0x58) socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1c8}, 0x1, 0x0, 0x0, 0x42804}, 0x0) listen(r4, 0x3) r6 = socket(0xa, 0x3, 0x3a) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x24008040) setsockopt$MRT6_INIT(r6, 0x29, 0xc8, &(0x7f0000000340), 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) close(r6) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5d001d00", @ANYRES16=r2, @ANYBLOB="010029bd7000fedbdf25170000004800068008000600000000003c0004"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x4040800) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) accept4(r3, 0x0, 0x0, 0x80800) 1.332691772s ago: executing program 2 (id=7309): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$sock_buf(r1, 0x1, 0x1c, &(0x7f00000001c0)=""/250, &(0x7f0000000040)=0xfa) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000002c0)=@newlink={0x74, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x600a4, 0x40}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x30, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR={0xa, 0x4, @local}, @IFLA_MACVLAN_MACADDR_DATA={0x10, 0x5, 0x0, 0x1, [{0xa, 0x4, @local}]}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x74}, 0x1, 0x0, 0x0, 0x8840}, 0x8000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x1c, 0x46, 0x107, 0x70bd28, 0x0, {0x1, 0x7c}, [@nested={0x7, 0x4, 0x0, 0x1, [@generic='6dy']}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) syz_emit_ethernet(0x5e, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x28, 0x6, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0x2, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x2, 0x0, 0x0, 0x0, {[@generic={0xfe, 0x11, "e6673fcf0b051e0000000000000000"}, @window={0x3, 0x3, 0xfe}]}}}}}}}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000010000100000000000000cb000000000a20000000000a01030000000000000000010000797a31000000002c000000050a01020000000000000020000900030073797a31000000000900010073797a3100000000140000001100010002000000000000000500000a"], 0x74}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc0200, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000100)=0x82) close(r6) 674.965567ms ago: executing program 2 (id=7310): sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x2, 0x80805, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000400)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00\x00@\x00'}, 0x28) writev(r1, &(0x7f00000009c0)=[{&(0x7f00000008c0)="581a", 0x2}], 0x1) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) readv(r1, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xff1}], 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r4, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r5, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 460.112268ms ago: executing program 4 (id=7311): getsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) getsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) syz_init_net_socket$ax25(0x3, 0x5, 0xc4) (async) r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xc4) epoll_create1(0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newlink={0x5c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5003}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @mcast1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x5c}}, 0x2000000) listen(r0, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) (async) bind$alg(r2, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000a1c0)=ANY=[], 0x3bfc}, 0x1, 0x0, 0x0, 0x4000}, 0x40040) recvmsg$can_raw(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000700)=[{0x0}, {&(0x7f0000000180)=""/39, 0x27}, {&(0x7f00000006c0)=""/38, 0x26}], 0x3}, 0x1021) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000001940)=@rose={'rose', 0x0}, 0x10) (async) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000001940)=@rose={'rose', 0x0}, 0x10) 217.21948ms ago: executing program 1 (id=7312): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2400, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(khazad)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(0x0, r2) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r2) sendmsg$tipc(r2, &(0x7f00000003c0)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x41, 0x1, 0x3}}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000140)="6632cbcaec207714e921312394628f9e9da074ec4cba53539d9709528081b975927138922ac009c67bf9b2a741537cbb6ab28a1c47f54d3d10db28849660c560b7099ef9b2", 0x45}, {&(0x7f00000001c0)="9dd0367746ff5da37835a635502eb25aa3d34a41b8e6586eb19387125e2a2e839426207bb1b53597b5d1741970d4a2b33a90118970abd9301df9400d62d4347c94ee79769fbfb0af58d5f599e6fb971d456a839cef9e6187bb900761a0d96cec2dbacdfdb5c2bbc6ce1f3de8eab86666e9e456a1929b214cbc2d26808c914f796762d1efbb19e6024f0bdf0e3709db5e91dd329285d4d2a7262877be93c40e6a5561ebed952fc254283d1df5229f3c685d002927b2e6c9ad7a5b1283b688bbc25a714cc5719d925b8ca1105a89a7a809057d9c763619fe", 0xd7}, {&(0x7f0000000040)="2aa5a5ebf0594984073d27d7cc73f7a1", 0x10}, {&(0x7f0000001300)="013a5af9b81dd550f0d05979ef26d4e550ae3e6e324b6175fd488de44ea71815853f76b92bae4ada4d06fee68301dd31deaac95fe9ac1d8646b070b2e61081b356b4f3a2bcd5212d9e30a784e84ba337f00c0fbaeeb31acb90f67187df17da2455b07aed2c106d679cb85c3f6f0b7f89be910e50aaa8934af8d5629785748a15bff6bc829ead32bec47cf04456f3fcce818d5a30cbf5756906645de50cba75aef8354b5498204efa83cd616e0b3a376c46303f67d460e8ba894f0a7cefd33d833c8849cbe0afacf795eaa14041c54aa01321749e6306f8a880613e017f819bae5947edf3cab81163e9a6a71503ab93aa5d25f58f7c303c64efc3d2d96c34a72a5811e07a66f03323285d9afadb458aae8682b4a1691b4919d0a1154735495f3cdb7f3ea536af86c2e642afc0b01994388c9a2998eb4e42ac69eba39f5b704d9785324761683b2c9e3fbb43e1eb793a42bc1c30ec55631675aa599a5a0f059298842d1ceae272497b91f1ae7b25d8ca342a2d4e4a24a3576cc43f3091e5a45cae3c1834e19aec6079a26787f61f97d2b443438be3a31a5fe7f35b32c1b86f63d17134c8ea415466214237825625191d4ae375ca3acd0fc00eaa33263764a52033036376a9eb704f871b100b9a83507417f029b60499dd646fb25cb8c17d2ab00307790a59f4049894c9cd1d6c28ff0d2dfdd2af50c4ba732a49ebf6b3f512e29d85bbb7d2c10fb5113697e9fa502bc86b38c3674166538562e57d85d818d16729ebefe0b4ca91ce2fe37e1b7159b8ffe8f79ddab0f2fc21235541cf50d00ba23ce0969fa63462855babb2afb4c900153988de7bcb68a663046bb3b3e43f38fb3b7c1616e80a2bb4064503d28981e4eae247c39c4f3543e846c31ed6fd223dee4f73a0e77af96e7ea473c226b493c3d53a5805771e8eb773a62a13196d06a14a286936e647b8c548fd179bdf1a0d5ba654dd80efb69d5c20f718b4be616d003d73fb5d63f74b3b765dc606729543e32fdec412b420527eba485d7ea8900e0d65340eadac55b1cb9b28eca3a00eb47af8319061aad64f696e9ff926b22a269eae06634926487113b4f6f7ab5902ed2c7e28cdc5238b32aac93e614013d8ce8eae04f4828f47f1134b1b4d86bec79e62717b4b5f8d43bbc33a4e9022809bf2f5675930e590a569035f0acafc57d2fb63b50061d6251bd771c6741f7d8c1ce9702b6e4b6959e2bc9cc98b6105ae8e29c9e782be30b88004534485a75a4b07d3e120c5628569d2febc06ce8973df8716b6767ae99d39d3c93b1be88f17618124e15b5a6ca066e05abb56b2626df404e640e3074599233babcf3af256b2f5ef1f9ff42b82f96ad129e7d7b1e8c62fe43a373567a049a8879ba2a73a9df79858399f926cf7f9f34f0cb2f85dafe474c828e0c2a97799914f6f11b38f841e64587d174b6966594cec2bb58bb1d67c7dd84343e9917b2e83f35831215f2a1de3bda80e5f818c436f0efc8231e54f6cdb972942a69f2eab8628255682fe7805473cf14e6579f456b881485458031bae8ea99bff23642bdf36555fdc2ea8f5c1af4ce4dd003bbc19a8e72a8c82fc0b0877dc47b1dc6332b2abbf3542ffae09e7dec65f91f3d2729ee58211d2822804c3cca4c0d3c918633d365cce1fe05b1058c3af92b9f2571088446d354e97c69b3fcc2b823a1ae439e86ccf86bdbfc1661551343de27c5f1d5c822d6660d67ff6293c76d309813bef1e48a015122e9bd0bfc351212886a90888c3a1f519471bfdc3ab2c1c0fdaeb726e1782077f592270c8517a6972092be05de04914b70ecb2a633972b4246c29ea5510e9494baca36595ddead981b6e4efdf26ce2ece8fe8669db226a1d8ed24944064c18cb7ca8e63f7fceaa58f77b44cda0038f4c17f6fa11813fbb7e97ff6da9f2c08ebb7f3522aced8b548490686ad5128a76914d325544fc39d796306ce00dfa5da91f4cbe33d1fe1456bf5b6d1e6c1f99cd2815e4c34c7ae7c28d10c3f31ffe2a1464b21134a855fbe9a272cf9fdf4e2a05f2e29aa58682bbe1347b9542d36a31bdefbc3b643275bb69cada8664d93ca286b4f4921c714a37bfe24653a90d5dc8780abe57eda41301057f4cfe4c159f1475d1be1b70eaf46da0898a36f46415b8cdd1002d6335f45d00d776a468cd84e713d5d32bb8f65cd38bb4c7a4ec503998c194faa657e1f535811a850ee22542639d120fd9569957918220ee9572d9766c171d6092cdffef6ecc53444e41d8790717384157973d8bf24cb6738ef4ddd2a6f49a750038d067191130253e64f268b57be7668cacea8a71cf931db82b5304580d98a73fe43370c6cacd8e593126feea15dc3d91a5019b70b881195e57c6de91ff2557fd6527b039fcb8d4a0195ea812bf59e4f3dc2d92efabebd8c57d9344a417c8dd71f6c07b4109c1482766ed61dcea861f8cfbfbb04a3687911db18f953006b6bfe5209a6db020cf2f7d7d97558ee5a03d4ea42a6e6f1e3210c3321f8b5c0663d77f110d15fd893fbefb4f78aaf90db75d79d16008bc80a285ca32ef8a8d42ffd1f99d0e19a0b1b37ab98ab4730ffecefcfa08ebb96266293e43f0d6bf53c4bffbcce552de79b41a9b7f2e0f1395bdbb8f207f08b2b12fb9f1fb652340997f1cda78642c5532997d492194c2e273f2758737a67c67825b67f2c3e3b5f10d4a36a19ce60ac93819eb015ca61dbff734f6873d99bf65dae4499fd79d476307b5827523d124c035c9a00c5e1bf7ca5dde071c421ee6577ba894b8425a0c1f36de2e9f07a0c9b8e7743c44439a802dbb35650b32b6e30a52d73a3e3835513b0afc2734536eea1016f991f4bf79c12952681c9b7321ab72303d4193129d6bc169e3a7b171e6fa16581180f1b0a27039814ee90e8cf5a3c9073204d501dea9ba68e8b9e2b1bc572b62876b38eaa36f9211424781ee7ae745c982f80723b6e87cfb0abd16eaae2becbed1b3277a598feb252582cb7ca7e9b08ef34e419fe343b7e166cdd8e2667365c388a65e6ab8fa1a647f5248936eb10fd0e751123571ce6bb408ed1bdf29aba1f8ace066d4f936298e1f5a1008363d9c4b58f87074362c79c704a599552d891e323e2887d1a0064e7a4ff6ea1c516d271cec4d3ef13bfeaecef85307552275ff78abddd31d34c2c19b1e34bb4bf22b3b787a81f47fa6aee83b53ec94ef7637a9c51065936f5f244b40d739c8d954fa6ad8a802e04c7648531887b019f09ae1e57ee911e1bc61458e70c3d8ab9d9f79e9b233fa467f43f724515a2c5af54d60e4d2d87a3c4bef3086a4ef0836debd6c9151fa2878ea7a389f98c7f22cb278e8976698a26574cb1c67629b47fbcb050c8b0ae0f2765999e4dbe1990cf1ec79cdd749ceb23991188e3cb598c447ba526f3fe6660e60915a43776d54414bd5a18851b184621aace9f4ce6a7305e724bad31e0821db3457bba889ee4e0b17055b14b75065e4779e8349b2378293c6185de03a3dec2013fd04f0afbd871a7f4e38a69fb08a357ec3c42e6291448f9abdc19a085ad09e91b6d325c01bd1cfd1a146bb5345537bee9a8d56961d21eb1a2e9edc029e0ea03d20b6b22bf0d35c5da9fe25303478a4610c3440a6311fa40238e6f25d8e13a1543bb8807c5caf62e05c5748615dfe883de10f71a259b6555f11d847c3cc1d06b2619d1a4b82dc135b95c8cd838ae3eed7e2ab938af7b553755e5dfb18d4b82bb4f2e08c865b1a4cb9e2b51b64ac9be2a328d9d3662ada9789e78042c5194ea3b4183ac2e7257f7b75f4017dd1b7419ef90400ec54b9b4e63fc6bce741e4b98b85d18566efd91799f08540a781ffbb49559de796ddbf611987beef1ba3aa9eb7845ae23b2b29055b862c8bb3a3b2e44a8adce72f552f1fdfbdee0f48877701ac6ae0922fd27b8e505eb4696382a54b37738aecfcb3ef65e1c817dee306bc4dd3f014c7072daac2cb3047a7bd0e30b69681ed36f53c7bf7bd68bf0715322c71b7a5acfae31fae9426f924aee67b096bf6be98fe8a1b8a915aaed27792c0dbefe2f7e48fe7ad06365b34c549821cd431a0760185e85b22bc94fcb09023962b9dc42b4e3b0ebc12b7df540040337a01f699e826386f0d4a33c5ea496c9ecd9896d251e71ffe24b047358cd75875159d937aef9348c177d62db65a3350a2cfcbdfca79633ca0851cabd198a8af545dda971f0040edfcd97b111354f591dba272e231a2ef72b38866bc6305f17cc655625cd8489ce91ef0b3ed4d15d89bcbaa19c154dbe5105e8cb9605ba55f6660fa1bd92c4954e5608a558165751987777bb4807f9f2f3376eb01ea7ce7233c86436ca0c572735e794eb03e98d39e37e1fafa60da8386dde6b2c396670ba15596d5bc61e08b69db6d74542e2ed4babeb7315ba80dbd91bece95ed4a62fbf59ddae81447de8d854b2604dee15079d3a15c101b847ec12cb3b1d93e7f1a3efad5d0681ed00ec06f9ed14fdbc6ba084b029dc19da35ad590a6b4bbacad14123191cdfccc20d4c35168c257eb15a647552f1c4122a445dc8cad844443e9895c12f0d42da3baa7bd2506c7a84a70213fe6a3c82906065c11e0dd7457e3c7daf61a00f6783e55856a8cb2d8ee52fe464a964441df940610f0836fd044703f633127466d72fba8ca58ecc17518319f90226236a845a3976f0dcebbd539a1ef71fac5c1196726fdd60d76c601265c2b623bd63ed030d224252054be89a2441bb4c56f51dba4df44fba76ab63305c29344450ae9ed0de758ccd11d99bde902b48cd34e2e416c8c932b989a8e72adfbdf128adad8a48735f847e3449c78c0c79a21982180bf9cc6b2065c0821e02dc0fbe7d9361007fce9d675abcb42ae8fd3f2bfeeb7218da73d8461e3d41ac23f5d075bf699d45299ecaf28b9433905d89e365a7b90d73bf072d31a47626508b700e8e639ec46970fcb77d5f5e823c2ea5019d431702a2dca2f9fee725a4fdabe8bb9a21462b8de9f0f10b77c8a8ae79925887b1d931b59ef631ee5a43954d7a67226999691ca063952b6222d958d5691b4132848c1b68482ecc297bfebbb95405ab544778c91638c4968a0c5803a4e77e2bf2163b89c94329dba6cb21973af4d9f91218d512afbe5662420d0c7c932ec662e3893ab6be3f8e7039221c67e14037a6829966ab599f5ed0c225adc1169749878c635b7611c1137fb6abb41cdeb290f507dbfc0038baa0da1359d39eee4a3b427f7893edce5b45eca51ef7738c702adf2d77aad6e62d94f3b31f3a292a0bf79bff3419474bc76e1bb3cbdf4693dd4b9eeb03e1cfcf75774f1a446fb143e47262b17d10fbcbeb5dfca484594c9639ea11a221f341debbb7d7a758f290f0b876bafdbe3a620a59abfd3d418d55cd2d2bedbcfd03cbf5c8c83a8fb6251cd991b9ffb72bc9775f7b9e40a6347246d259101e5431eec99ef9a9938e4889d6003791825bb5e788319a1e1ced32d886918916628f9c7b80a6c3848aeaaf011e9b81f7cf2d248d3ceade79e208d0da23cd1748bf650aada53b18790560160ed9bb7c5f2fc52ff57741cc0f3c309a910dd37b5900aa49c7497a1fe355d2bbf69cb603f34b415dd01aba85aeef948a0436ce4a746f87cf2631beacd1d2bab6f792521c9b72ad61598eedaef6c6ad3dc821540ac9e8c4ade1a490be26f39ae815a6d3a057eeb76d1becc89be097b5dac68eb31ff330df45de107b9988c557613984349479150f8d930b1b5194fef5e49a9eb4e588eb7a665b808ca9249e89d2751db256119094760b778afdf6fade06dc75", 0x1000}], 0x4, &(0x7f0000000340)="6255ef33e75b331ca004b7af74775bae616c3391a540f3a87ab3ec8681e9f32ca4a1e07571228c2a93b5db87ff23e19e1369cd301e9cf472e52e444f9902a4616997412ea0800a", 0x47, 0x20004040}, 0x4000801) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@delqdisc={0x0, 0x25, 0x200, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0x3}, {0xa, 0xfff3}, {0xb, 0x8}}, [@TCA_RATE={0x0, 0x5, {0x0, 0xa}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r4, {0x1c, 0xfff3}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0x9c}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x240488d0) 216.644729ms ago: executing program 4 (id=7313): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0101000000000000010000000900010073797a30000000002c000000030a010200000000000000000100000a0900010073797a30000000000900030073797a30000000005c000000060a010400000000000000000100000008000b4000000000340004803000018008000100636d70002400028010000380093e4e42494ae94a26f36c9f1f6ad2000100e0cf1b6251000000080002400000000008000140000000000900010073797a3000000000140000001100010000000000000000000700000a"], 0xd0}}, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x9, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x8}, @in={0x2, 0x4e20, @local}, @in={0x2, 0x4e21, @private=0xa010102}, @in6={0xa, 0x4e21, 0x5df, @loopback, 0x6}, @in={0x2, 0x4e21, @broadcast}], 0x68) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000240)={0xfffffff4}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="24000000700001002abd7000fbdbdf2507000000", @ANYRES32=r3, @ANYBLOB='\x00'], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = socket(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r4, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r4, &(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x100000}, 0xc) setsockopt$sock_int(r4, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) connect$pppl2tp(r4, &(0x7f0000000300)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x4, 0x1, 0x1, {0xa, 0x4e22, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffff8}}}, 0x32) write(r4, &(0x7f0000000000)='\"', 0x1) recvmmsg(r4, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) sendmmsg(r4, &(0x7f00000002c0)=[{{&(0x7f0000000040)=@llc={0x1a, 0x337, 0x3, 0xb, 0x40, 0xc, @local}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000180)="44f532af6f196f56b5520b043fd149f10a7663b1d91f03c666ab540080a6afc7c6537ad55dff9486d720b12c4bfdc3c2722a4dbd3d75369477dd630fc528c246297768f1a13044096b687951187b36970eab7a3bf4229e614e15546691bc44081bea1954fdf37289176e9f74c3073d2632d1dd59a1ae41facb9f6a5d6381ddb83245eb337add113f5388b51f44adf3df106a537e2932492fac2c4ef0bdd07120cd00e526787386aef7ffa4e1e64f32dd5a046baeba4f347dcdefcdfe6fae6c57f5fc36101ed233b10cda339752fc173222f7d1215e0452d8b1a27e799cd7b7a7cb99f46887f301077d921f53b407cdf61cd7765e9cb2", 0xf6}, {&(0x7f0000000600)="b17d63b2b8c783ff6830cd3836652b1aed4026c131c29661c4069c228f80a3bccc7a2ca8d5e114214549ae358ed1aea4957e2701e440dd6b67e56da400525aeca93d33aedf1f65201d45e5c55e9e36a3e24e749bee798285aa4363a5997d02f8bf12f60f82d6d838fb92e68cfdbd71eb2e136c7ddda0ac6e14354655f8c5da2127d4956a2f24a70f75bb0e67c5d46f77141798d219ba115eed92d3c3398dbcddb0116bbecc8056ef760d5c7956c6e59c9fba38f809c3271b68d15aa8d3917a91ee462e92bf65d974e159651bd95fc196a2f85d4a910a73401324ce66", 0xdc}], 0x2}}], 0x1, 0x20040001) write$bt_hci(r4, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x1d) sendmsg$NL80211_CMD_LEAVE_MESH(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x24, 0x24, 0x100, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {0xffff, 0xffff}}}, 0x24}}, 0x24040084) socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x2c, 0x2c, 0x200, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xf}, {0xd, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8848}, 0x80) socket(0x400000000010, 0x3, 0x0) 215.541375ms ago: executing program 2 (id=7314): r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$isdn(0xffffffffffffffff, 0x0, 0x0, 0x4000000, &(0x7f0000000100)={0x22, 0xc6, 0x9, 0x8, 0x9e}, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000002180), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000002280)={0x0, 0x0, &(0x7f0000002240)={&(0x7f00000021c0)={0x14, r4, 0xc896f2e2c472c557, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r5 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_FLAGS={0x6}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}]}}}]}, 0x48}}, 0x0) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, r4, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r5}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xa}}, @GTPA_LINK={0x8, 0x1, r6}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x94}, 0x24048005) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r9, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x8}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @bcast]}, 0x48) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000002100), &(0x7f00000000c0)=0x30) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x6b, 0x11, 0x77}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x8a}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, 0x1411, 0x0, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}, @RDMA_NLDEV_ATTR_RES_MRN={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x13}]}, 0x50}, 0x1, 0x0, 0x0, 0x440c0}, 0x4) 2.174251ms ago: executing program 5 (id=7315): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x80000a, 0x11, r5, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @remote, @val, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x0, @empty, @empty, @local, @broadcast}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r7 = socket(0x8, 0x3, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNGETOBJECT(r8, 0x89e0, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x11) ioctl$sock_netrom_SIOCADDRT(r7, 0x61f0, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x880) close(0x4) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x88, 0x2c, 0xe27, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {}, {0x5, 0xf}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x7}}, @filter_kind_options=@f_cgroup={{0xb}, {0x50, 0x2, [@TCA_CGROUP_ACT={0x4c, 0x1, [@m_sample={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x7, 0x81, 0x8, 0xff5, 0x40000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x88}}, 0x20040054) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f00000000c0)={'wpan0\x00'}) 1.865564ms ago: executing program 2 (id=7316): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x30, r1, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x30}}, 0x20000000) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'macsec0\x00', 0x200}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) 0s ago: executing program 1 (id=7317): r0 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x4c}}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x39, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000740)={r2, 0xffffffffffffffff, 0x39, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x7fff, 0x0, 0x100000}}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), 0xffffffffffffffff) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000600)={0x0, 0xfffffffffffffffa, 0x24f, 0x1}) ioctl$BTRFS_IOC_SCRUB(r3, 0xc400941b, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(r3, 0xc4009420, &(0x7f0000000e00)={0x18, 0x4, {0x6, @struct={0x8, 0x535d9a05}, 0x0, 0x8, 0x4, 0x8, 0xc03, 0x1, 0xb2, @usage=0xe, 0x7f8, 0x2, [0x1, 0xf3b4, 0x8, 0x3ff, 0x636d8f85, 0x5]}, {0x0, @struct={0x4, 0x1ff}, r5, 0xffffffffffffffff, 0xd4, 0x0, 0x6, 0x2, 0x1b, @usage=0xc, 0x9, 0xfff, [0x3, 0x10, 0x100000000, 0x5, 0x9, 0x8000000000000000]}, {0x1ff, @struct={0x1000, 0x4}, 0x0, 0x904, 0x4, 0x800, 0x0, 0x6, 0x80, @struct={0x2, 0x1}, 0x6, 0xc7f, [0x3, 0x6, 0x2, 0xffff, 0x9, 0xe933]}, {0xfffffffffffffffb, 0x8000000000000000, 0x1000}}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x50, r6, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0xffffffffffffffdc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0xfffffffffffffd13, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x23}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x43}, @IPVS_SVC_ATTR_FLAGS={0x0, 0x7, {0x1c, 0xb}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x50}}, 0x0) sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r4, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfc}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}]}]}, 0x48}, 0x1, 0x0, 0x0, 0xc006}, 0x0) r8 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r8, &(0x7f0000000400)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) accept4$inet6(r0, 0x0, 0x0, 0x0) sendmsg$tipc(r8, &(0x7f0000000640)={&(0x7f0000000300)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f00000004c0)="2e94", 0x2}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x74}, [@ldst={0x6}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) kernel console output (not intermixed with test programs): comm="syz.2.6121" name="memory.events" dev="tmpfs" ino=3045 res=0 errno=0 [ 1125.419503][T29950] __nla_validate_parse: 2 callbacks suppressed [ 1125.419531][T29950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6121'. [ 1125.436863][T29987] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1125.681682][T29982] chnl_net:caif_netlink_parms(): no params data found [ 1125.832106][T29992] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6131'. [ 1126.175856][T29996] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6132'. [ 1126.239224][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1126.247463][ C1] lec:lec_tx_timeout: lec0 [ 1126.387701][T30008] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6135'. [ 1126.412030][T30009] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6136'. [ 1126.528558][T29982] bridge0: port 1(bridge_slave_0) entered blocking state [ 1126.579110][T29982] bridge0: port 1(bridge_slave_0) entered disabled state [ 1126.599769][T29982] bridge_slave_0: entered allmulticast mode [ 1126.629350][T29982] bridge_slave_0: entered promiscuous mode [ 1126.674318][T30018] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6138'. [ 1126.739231][T29982] bridge0: port 2(bridge_slave_1) entered blocking state [ 1126.764548][T29982] bridge0: port 2(bridge_slave_1) entered disabled state [ 1126.786999][T29982] bridge_slave_1: entered allmulticast mode [ 1126.816358][T29982] bridge_slave_1: entered promiscuous mode [ 1126.980093][T29982] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1127.010532][ T5831] Bluetooth: hci2: command tx timeout [ 1127.026899][T29982] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1127.168099][T29982] team0: Port device team_slave_0 added [ 1127.195152][T29982] team0: Port device team_slave_1 added [ 1127.285205][T29982] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1127.307309][T29982] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1127.392858][T29982] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1127.440393][T29982] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1127.447419][T29982] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1127.515732][T29982] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1127.555076][T30032] xt_hashlimit: size too large, truncated to 1048576 [ 1127.613640][T30034] netlink: 'syz.2.6141': attribute type 1 has an invalid length. [ 1127.627459][T29982] hsr_slave_0: entered promiscuous mode [ 1127.637717][T29982] hsr_slave_1: entered promiscuous mode [ 1127.645486][T29982] debugfs: 'hsr0' already exists in 'hsr' [ 1127.652569][T29982] Cannot create hsr debugfs directory [ 1128.023745][T30040] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6145'. [ 1128.337825][T30052] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1128.585883][T29982] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1128.735537][T29982] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1128.846850][T29982] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1128.972337][T29982] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1129.080109][ T5831] Bluetooth: hci2: command 0x041b tx timeout [ 1129.466861][T29982] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1129.495115][T29982] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1129.524686][T29982] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1129.554897][T30083] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6156'. [ 1129.607313][T29982] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1129.737513][T30098] IPVS: Scheduler module ip_vs_sip not found [ 1129.781224][T30096] netlink: 'syz.2.6157': attribute type 1 has an invalid length. [ 1129.870823][T30096] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6157'. [ 1129.934497][T30110] netlink: 27 bytes leftover after parsing attributes in process `syz.2.6157'. [ 1130.096569][T29982] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1130.212709][T29982] 8021q: adding VLAN 0 to HW filter on device team0 [ 1130.281380][T23052] bridge0: port 1(bridge_slave_0) entered blocking state [ 1130.288728][T23052] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1130.332174][T30123] tipc: Trying to set illegal importance in message [ 1130.399915][ T1154] bridge0: port 2(bridge_slave_1) entered blocking state [ 1130.407749][ T1154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1130.593935][T30131] wg1 speed is unknown, defaulting to 1000 [ 1130.618731][T30130] bridge_slave_1: left allmulticast mode [ 1130.631407][T30130] bridge_slave_1: left promiscuous mode [ 1130.640184][T30130] bridge0: port 2(bridge_slave_1) entered disabled state [ 1130.662312][T30130] __nla_validate_parse: 4 callbacks suppressed [ 1130.662347][T30130] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6166'. [ 1130.684150][T30131] lo speed is unknown, defaulting to 1000 [ 1130.700796][T30131] virt_wifi0 speed is unknown, defaulting to 1000 [ 1130.813841][T30138] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6168'. [ 1130.969484][T30145] netlink: 'syz.1.6170': attribute type 1 has an invalid length. [ 1130.977305][T30145] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6170'. [ 1131.042644][T30145] netlink: 27 bytes leftover after parsing attributes in process `syz.1.6170'. [ 1131.153030][ T5831] Bluetooth: hci2: command 0x041b tx timeout [ 1131.347304][T29982] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1131.385521][T30158] netlink: 'syz.2.6175': attribute type 13 has an invalid length. [ 1131.928455][ T24] lo speed is unknown, defaulting to 1000 [ 1131.935989][ T24] syz2: Port: 1 Link DOWN [ 1132.000603][T30177] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6180'. [ 1132.267586][T30183] TCP: tcp_parse_options: Illegal window scaling value 47 > 14 received [ 1132.303041][T30185] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1132.701556][T29982] veth0_vlan: entered promiscuous mode [ 1132.802966][T29982] veth1_vlan: entered promiscuous mode [ 1132.987241][T29982] veth0_macvtap: entered promiscuous mode [ 1133.028472][T30219] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6190'. [ 1133.049245][T29982] veth1_macvtap: entered promiscuous mode [ 1133.131323][T29982] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1133.192017][T29982] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1133.230899][ T5831] Bluetooth: hci2: command 0x041b tx timeout [ 1133.245589][ T6891] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1133.257042][ T6891] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1133.268982][ T6891] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1133.286403][ T6891] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1133.311117][T30234] openvswitch: netlink: Unexpected mask (mask=20440, allowed=10048) [ 1133.729957][T30243] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1135.313032][ T5831] Bluetooth: hci2: command 0x041b tx timeout [ 1135.837362][T30210] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1135.942314][ T6891] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1135.968975][ T6891] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1136.105134][T23052] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1136.115336][T23052] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1136.263285][T30267] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6202'. [ 1136.308873][T30263] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6202'. [ 1136.486344][T30275] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6129'. [ 1136.528182][T30275] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6129'. [ 1136.756989][T30284] veth1: entered allmulticast mode [ 1136.944807][T30286] wg1 speed is unknown, defaulting to 1000 [ 1136.976139][T30286] lo speed is unknown, defaulting to 1000 [ 1137.020877][T30286] virt_wifi0 speed is unknown, defaulting to 1000 [ 1137.037969][T30294] netlink: 'syz.4.6212': attribute type 1 has an invalid length. [ 1137.046385][T30294] netlink: 14436 bytes leftover after parsing attributes in process `syz.4.6212'. [ 1137.418220][T25925] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1137.438536][T25925] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1137.451424][T25925] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1137.462161][T25925] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1137.471478][T25925] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1137.755284][T30312] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1137.817702][T30313] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1137.961991][T30299] wg1 speed is unknown, defaulting to 1000 [ 1137.980221][T30299] lo speed is unknown, defaulting to 1000 [ 1137.987788][T30299] virt_wifi0 speed is unknown, defaulting to 1000 [ 1138.417007][T30339] FAULT_INJECTION: forcing a failure. [ 1138.417007][T30339] name failslab, interval 1, probability 0, space 0, times 0 [ 1138.433168][T30339] CPU: 0 UID: 0 PID: 30339 Comm: syz.4.6225 Not tainted syzkaller #0 PREEMPT(full) [ 1138.433199][T30339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1138.433214][T30339] Call Trace: [ 1138.433223][T30339] [ 1138.433233][T30339] dump_stack_lvl+0xe8/0x150 [ 1138.433267][T30339] should_fail_ex+0x412/0x560 [ 1138.433300][T30339] should_failslab+0xa8/0x100 [ 1138.433327][T30339] __kmalloc_noprof+0xde/0x7e0 [ 1138.433348][T30339] ? kernfs_fop_write_iter+0x158/0x540 [ 1138.433379][T30339] kernfs_fop_write_iter+0x158/0x540 [ 1138.433409][T30339] vfs_write+0x61d/0xb90 [ 1138.433448][T30339] ? __pfx_vfs_write+0x10/0x10 [ 1138.433488][T30339] ? __fget_files+0x2a/0x420 [ 1138.433520][T30339] ksys_write+0x150/0x270 [ 1138.433550][T30339] ? __pfx_ksys_write+0x10/0x10 [ 1138.433594][T30339] do_syscall_64+0xe2/0xf80 [ 1138.433622][T30339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.433642][T30339] ? trace_irq_disable+0x37/0x100 [ 1138.433663][T30339] ? clear_bhb_loop+0x60/0xb0 [ 1138.433687][T30339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.433708][T30339] RIP: 0033:0x7f9c8a99aeb9 [ 1138.433727][T30339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1138.433746][T30339] RSP: 002b:00007f9c8b893028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1138.433770][T30339] RAX: ffffffffffffffda RBX: 00007f9c8ac15fa0 RCX: 00007f9c8a99aeb9 [ 1138.433786][T30339] RDX: 000000000000000a RSI: 0000200000000280 RDI: 0000000000000004 [ 1138.433809][T30339] RBP: 00007f9c8b893090 R08: 0000000000000000 R09: 0000000000000000 [ 1138.433823][T30339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1138.433835][T30339] R13: 00007f9c8ac16038 R14: 00007f9c8ac15fa0 R15: 00007ffe93df1db8 [ 1138.433872][T30339] [ 1138.855138][T30344] netlink: 'syz.4.6227': attribute type 1 has an invalid length. [ 1139.049934][T30353] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6229'. [ 1139.110024][T30344] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6227'. [ 1139.259985][T30359] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6228'. [ 1139.270817][T30359] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6228'. [ 1139.436235][T30299] chnl_net:caif_netlink_parms(): no params data found [ 1139.490870][T30365] syzkaller0: entered promiscuous mode [ 1139.511232][T30365] syzkaller0: entered allmulticast mode [ 1139.559012][ T5831] Bluetooth: hci3: command tx timeout [ 1139.660676][T30371] dvmrp0: entered allmulticast mode [ 1139.703465][T30375] netlink: 9 bytes leftover after parsing attributes in process `syz.3.6234'. [ 1139.784100][T30371] gretap0: entered promiscuous mode [ 1139.841629][T30299] bridge0: port 1(bridge_slave_0) entered blocking state [ 1139.874624][T30299] bridge0: port 1(bridge_slave_0) entered disabled state [ 1139.900362][T30299] bridge_slave_0: entered allmulticast mode [ 1139.922236][T30299] bridge_slave_0: entered promiscuous mode [ 1139.960770][T30299] bridge0: port 2(bridge_slave_1) entered blocking state [ 1139.988615][T30299] bridge0: port 2(bridge_slave_1) entered disabled state [ 1140.019839][T30299] bridge_slave_1: entered allmulticast mode [ 1140.028124][T30299] bridge_slave_1: entered promiscuous mode [ 1140.184971][T30299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1140.222868][T30299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1140.326953][T30395] bridge1: entered promiscuous mode [ 1140.332420][T30395] bridge1: entered allmulticast mode [ 1140.353316][T30395] team0: Port device bridge1 added [ 1140.394561][T30400] bridge0: port 2(team0) entered blocking state [ 1140.419754][T30400] bridge0: port 2(team0) entered disabled state [ 1140.449330][T30400] team0: entered allmulticast mode [ 1140.454733][T30400] team_slave_0: entered allmulticast mode [ 1140.491690][T30400] team_slave_1: entered allmulticast mode [ 1140.505682][T30400] team0: entered promiscuous mode [ 1140.519001][T30400] team_slave_0: entered promiscuous mode [ 1140.542242][T30400] team_slave_1: entered promiscuous mode [ 1140.570155][T30400] bridge0: port 2(team0) entered blocking state [ 1140.576665][T30400] bridge0: port 2(team0) entered forwarding state [ 1140.631936][T30299] team0: Port device team_slave_0 added [ 1140.674889][T30299] team0: Port device team_slave_1 added [ 1140.822691][T30299] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1140.839614][T30299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1140.913679][T30299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1140.955206][T30299] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1140.970788][T30299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1141.039211][T30299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1141.115670][T30425] netlink: 'syz.4.6249': attribute type 5 has an invalid length. [ 1141.225009][T30427] openvswitch: netlink: Flow key attr not present in new flow. [ 1141.271736][T30299] hsr_slave_0: entered promiscuous mode [ 1141.291112][T30299] hsr_slave_1: entered promiscuous mode [ 1141.308585][T30299] debugfs: 'hsr0' already exists in 'hsr' [ 1141.320231][T30299] Cannot create hsr debugfs directory [ 1141.344093][T30430] netlink: 'syz.4.6251': attribute type 1 has an invalid length. [ 1141.390573][T30430] __nla_validate_parse: 3 callbacks suppressed [ 1141.390593][T30430] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6251'. [ 1141.422018][T30431] netlink: 27 bytes leftover after parsing attributes in process `syz.4.6251'. [ 1141.629352][ T5831] Bluetooth: hci3: command tx timeout [ 1141.709358][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1141.720405][T30439] netlink: 'syz.3.6255': attribute type 1 has an invalid length. [ 1141.730341][ T95] block nbd2: Possible stuck request ffff888025498000: control (read@0,1024B). Runtime 840 seconds [ 1141.747153][ T95] block nbd2: Possible stuck request ffff888025498200: control (read@1024,1024B). Runtime 840 seconds [ 1141.760348][ T95] block nbd2: Possible stuck request ffff888025498400: control (read@2048,1024B). Runtime 840 seconds [ 1141.772845][ T95] block nbd2: Possible stuck request ffff888025498600: control (read@3072,1024B). Runtime 840 seconds [ 1141.864231][T30439] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1141.877970][T30445] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.6256'. [ 1141.975551][T30441] bond1: (slave ip6gretap1): making interface the new active one [ 1141.995769][T30441] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1142.059180][T30449] sock: sock_set_timeout: `syz.4.6258' (pid 30449) tries to set negative timeout [ 1142.155882][T30446] veth3: entered promiscuous mode [ 1142.176753][T30446] bond1: (slave veth3): Enslaving as an active interface with a down link [ 1142.222730][T30439] erspan0: entered allmulticast mode [ 1142.285669][T30439] bond1: (slave erspan0): Enslaving as an active interface with an up link [ 1142.478720][T30463] netlink: 40 bytes leftover after parsing attributes in process `syz.5.6261'. [ 1142.553276][T30441] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1142.872044][T30477] netlink: 'syz.1.6264': attribute type 1 has an invalid length. [ 1142.906610][T30477] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6264'. [ 1142.925287][T30477] netlink: 27 bytes leftover after parsing attributes in process `syz.1.6264'. [ 1143.166235][T30466] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1143.177064][T30466] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1143.202552][T30480] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 1143.242951][T30466] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1143.269534][T30466] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1143.273661][T30482] netlink: 10 bytes leftover after parsing attributes in process `syz.3.6266'. [ 1143.361711][T30299] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1143.452878][T30466] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1143.480192][T30299] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1143.481493][T30466] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1143.545988][T30299] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1143.593883][T30299] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1143.677057][T30466] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1143.697638][T30466] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1143.709114][ T5831] Bluetooth: hci3: command tx timeout [ 1143.887916][T30466] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1143.920924][T30466] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1144.040452][T30499] wg1 speed is unknown, defaulting to 1000 [ 1144.048289][T30499] lo speed is unknown, defaulting to 1000 [ 1144.102810][T30499] virt_wifi0 speed is unknown, defaulting to 1000 [ 1144.154422][T30502] netlink: 200 bytes leftover after parsing attributes in process `syz.1.6269'. [ 1144.180244][T30502] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6269'. [ 1144.252133][T30299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1144.354423][T30299] 8021q: adding VLAN 0 to HW filter on device team0 [ 1144.488213][ T6893] bridge0: port 1(bridge_slave_0) entered blocking state [ 1144.495571][ T6893] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1144.540665][ T6893] bridge0: port 2(bridge_slave_1) entered blocking state [ 1144.547966][ T6893] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1144.907176][T30514] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1145.175359][T30526] netlink: 'syz.1.6274': attribute type 1 has an invalid length. [ 1145.194174][T30526] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6274'. [ 1145.493248][T30534] syzkaller0: entered promiscuous mode [ 1145.499253][T30534] syzkaller0: entered allmulticast mode [ 1145.803602][T30299] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1145.938054][T30299] veth0_vlan: entered promiscuous mode [ 1145.987241][T30299] veth1_vlan: entered promiscuous mode [ 1146.093795][T30550] tipc: Failed to remove unknown binding: 66,1,1/4138126202:2898095780/2898095782 [ 1146.107905][T30550] tipc: Failed to remove unknown binding: 66,1,1/4138126202:2898095780/2898095782 [ 1146.133771][T30299] veth0_macvtap: entered promiscuous mode [ 1146.162250][T30550] tipc: Failed to remove unknown binding: 66,1,1/4138126202:2898095780/2898095782 [ 1146.175343][T30299] veth1_macvtap: entered promiscuous mode [ 1146.253642][T30299] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1146.291194][T30299] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1146.345765][T23052] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1146.373131][T23052] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1146.411833][T23052] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1146.462119][T23052] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1146.729195][ T6893] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1146.760501][ T6893] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1146.845605][T30573] __nla_validate_parse: 4 callbacks suppressed [ 1146.845627][T30573] netlink: 6048 bytes leftover after parsing attributes in process `syz.3.6287'. [ 1146.934464][T30571] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1146.977540][ T1154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1147.021215][ T1154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1147.060606][T30574] bond2: (slave ip6gretap1): making interface the new active one [ 1147.083068][T30574] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1147.427569][T30586] netlink: 'syz.2.6209': attribute type 32 has an invalid length. [ 1147.437096][T30586] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6209'. [ 1147.458187][T30581] netlink: 'syz.1.6292': attribute type 23 has an invalid length. [ 1147.485108][T30590] netlink: 'syz.5.6294': attribute type 21 has an invalid length. [ 1147.613636][T30586] bond1: option coupled_control: invalid value (16) [ 1147.636647][T30586] bond1 (unregistering): Released all slaves [ 1147.718118][T30590] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6294'. [ 1148.033495][T30607] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6296'. [ 1148.070292][T30599] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1148.137128][T30599] bond6: entered promiscuous mode [ 1148.162251][T30599] team0: Port device bond6 added [ 1148.187753][T30603] netlink: 'syz.2.6298': attribute type 1 has an invalid length. [ 1148.302417][T30611] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_vlan, syncid = 3, id = 0 [ 1148.601003][T30623] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6302'. [ 1148.632259][T30619] netlink: 6048 bytes leftover after parsing attributes in process `syz.2.6303'. [ 1148.848107][T30627] x_tables: duplicate underflow at hook 2 [ 1149.482628][T30640] netlink: 364 bytes leftover after parsing attributes in process `syz.1.6310'. [ 1149.521090][T30640] netlink: 277 bytes leftover after parsing attributes in process `syz.1.6310'. [ 1149.546467][T30644] netlink: 'syz.2.6312': attribute type 1 has an invalid length. [ 1149.556315][T30644] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6312'. [ 1149.625023][T30644] netlink: 27 bytes leftover after parsing attributes in process `syz.2.6312'. [ 1150.745037][T30701] netlink: 'syz.3.6327': attribute type 3 has an invalid length. [ 1150.762645][T30701] netlink: 'syz.3.6327': attribute type 1 has an invalid length. [ 1150.874388][T30699] wg1 speed is unknown, defaulting to 1000 [ 1150.917686][T30699] lo speed is unknown, defaulting to 1000 [ 1150.955512][T30699] virt_wifi0 speed is unknown, defaulting to 1000 [ 1151.997157][T30754] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1152.148892][T30755] __nla_validate_parse: 8 callbacks suppressed [ 1152.148915][T30755] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6341'. [ 1152.478353][T30767] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.490143][T30772] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6345'. [ 1152.590179][ T11] block nbd3: Possible stuck request ffff8880254b8000: control (read@0,1024B). Runtime 660 seconds [ 1152.601668][ T11] block nbd3: Possible stuck request ffff8880254b8200: control (read@1024,1024B). Runtime 660 seconds [ 1152.613213][ T11] block nbd3: Possible stuck request ffff8880254b8400: control (read@2048,1024B). Runtime 660 seconds [ 1152.624424][ T11] block nbd3: Possible stuck request ffff8880254b8600: control (read@3072,1024B). Runtime 660 seconds [ 1152.711329][T30767] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.925245][T30767] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1153.043451][T30767] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1153.254823][T30797] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6349'. [ 1153.315243][T30800] netlink: 'syz.2.6350': attribute type 1 has an invalid length. [ 1153.334666][ T6916] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.374187][T30801] vlan2: entered promiscuous mode [ 1153.386223][T30801] veth1_to_batadv: entered promiscuous mode [ 1153.393952][T30801] vlan2: entered allmulticast mode [ 1153.400081][T30801] veth1_to_batadv: entered allmulticast mode [ 1153.430102][ T6906] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.493823][ T6893] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.534908][ T6893] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1155.236761][T30771] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1155.547729][T30816] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6355'. [ 1155.589416][T30816] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6355'. [ 1155.631686][T30816] netlink: 58 bytes leftover after parsing attributes in process `syz.3.6355'. [ 1155.758681][T30822] dvmrp0: entered allmulticast mode [ 1155.832757][T30828] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6359'. [ 1155.854282][T30828] bond0: ARP target 170.170.170.170 is already present [ 1155.879148][T30828] bond0: option arp_ip_target: invalid value (2863311530) [ 1156.077882][T30843] netlink: 'syz.2.6360': attribute type 13 has an invalid length. [ 1156.278186][T30849] netlink: 'syz.4.6362': attribute type 3 has an invalid length. [ 1156.789187][T30863] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6363'. [ 1156.831891][T30847] syzkaller0: entered promiscuous mode [ 1156.847380][ T7013] lec:lec_start_xmit: lec0:No lecd attached [ 1156.855085][T30847] syzkaller0: entered allmulticast mode [ 1156.879260][T30838] wg1 speed is unknown, defaulting to 1000 [ 1157.037622][T30867] veth0: entered promiscuous mode [ 1157.045846][T30867] veth0: entered allmulticast mode [ 1157.116147][T30838] lo speed is unknown, defaulting to 1000 [ 1157.170635][T30838] virt_wifi0 speed is unknown, defaulting to 1000 [ 1157.202016][T30841] wg1 speed is unknown, defaulting to 1000 [ 1157.322324][T30841] lo speed is unknown, defaulting to 1000 [ 1157.413981][T30841] virt_wifi0 speed is unknown, defaulting to 1000 [ 1157.635424][T30891] x_tables: duplicate underflow at hook 3 [ 1157.776070][T30894] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6371'. [ 1157.887040][T30894] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6371'. [ 1158.741343][T30927] netlink: 'syz.2.6383': attribute type 3 has an invalid length. [ 1158.765029][T30927] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1158.954480][T30927] syzkaller0: entered promiscuous mode [ 1158.981621][T30927] syzkaller0: entered allmulticast mode [ 1159.045035][T30941] netlink: 256 bytes leftover after parsing attributes in process `syz.5.6387'. [ 1159.325689][T30942] syzkaller1: entered promiscuous mode [ 1159.333758][T30942] syzkaller1: entered allmulticast mode [ 1159.804047][T30963] netlink: 'syz.4.6391': attribute type 1 has an invalid length. [ 1162.118872][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5260 ms [ 1162.127176][ C1] lec:lec_tx_timeout: lec0 [ 1162.562081][T30963] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1162.877648][T30983] netlink: 'syz.2.6397': attribute type 1 has an invalid length. [ 1162.940607][T30987] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6397'. [ 1163.075424][T30983] bond1: entered promiscuous mode [ 1163.086160][T30983] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1163.161647][T30987] bond1: entered allmulticast mode [ 1163.295793][T31003] bond1: (slave bridge1): making interface the new active one [ 1163.306220][T31003] bridge1: entered promiscuous mode [ 1163.316759][T31003] bridge1: entered allmulticast mode [ 1163.384814][T31003] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 1163.415969][T30989] wg1 speed is unknown, defaulting to 1000 [ 1163.462400][T31010] batman_adv: batadv0: Adding interface: dummy0 [ 1163.487184][T31010] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1163.535706][T31010] batman_adv: batadv0: Interface activated: dummy0 [ 1163.543875][T30989] lo speed is unknown, defaulting to 1000 [ 1163.557834][T30989] virt_wifi0 speed is unknown, defaulting to 1000 [ 1163.593874][T31011] SET target dimension over the limit! [ 1163.613535][T31015] batadv0: mtu less than device minimum [ 1163.653484][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.665662][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.677577][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.689641][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.701816][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.702471][T31020] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6405'. [ 1163.715685][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.733352][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.745370][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.770065][T31015] net_ratelimit: 9 callbacks suppressed [ 1163.770088][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1163.787639][T31015] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1164.012596][T31016] syzkaller1: entered promiscuous mode [ 1164.021444][T31016] syzkaller1: entered allmulticast mode [ 1164.660328][T31036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6413'. [ 1164.670081][T31036] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6413'. [ 1164.865387][T31047] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6415'. [ 1165.063555][T31050] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6418'. [ 1165.287941][T31064] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6421'. [ 1165.610754][T31067] syzkaller1: entered promiscuous mode [ 1165.616329][T31067] syzkaller1: entered allmulticast mode [ 1165.712377][T31074] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1165.740889][T31074] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6425'. [ 1165.886328][T31084] tipc: Failed to remove unknown binding: 66,1,1/0:2951779683/2951779685 [ 1165.916554][T31085] sctp: [Deprecated]: syz.1.6427 (pid 31085) Use of int in max_burst socket option. [ 1165.916554][T31085] Use struct sctp_assoc_value instead [ 1165.928170][T31084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6426'. [ 1166.174351][T31088] gretap1: entered allmulticast mode [ 1166.286732][T31094] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6428'. [ 1166.553729][T31107] FAULT_INJECTION: forcing a failure. [ 1166.553729][T31107] name failslab, interval 1, probability 0, space 0, times 0 [ 1166.626560][T31107] CPU: 1 UID: 0 PID: 31107 Comm: syz.1.6433 Not tainted syzkaller #0 PREEMPT(full) [ 1166.626592][T31107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1166.626606][T31107] Call Trace: [ 1166.626615][T31107] [ 1166.626625][T31107] dump_stack_lvl+0xe8/0x150 [ 1166.626660][T31107] should_fail_ex+0x412/0x560 [ 1166.626692][T31107] should_failslab+0xa8/0x100 [ 1166.626719][T31107] __kmalloc_node_track_caller_noprof+0xe1/0x7f0 [ 1166.626744][T31107] ? dev_exception_add+0x94/0x4a0 [ 1166.626783][T31107] kmemdup_noprof+0x2b/0x70 [ 1166.626811][T31107] dev_exception_add+0x94/0x4a0 [ 1166.626840][T31107] ? kstrtoull+0x12f/0x1d0 [ 1166.626875][T31107] devcgroup_access_write+0xeb7/0x1790 [ 1166.626909][T31107] ? __pfx_devcgroup_access_write+0x10/0x10 [ 1166.626993][T31107] ? kernfs_root+0x1c/0x230 [ 1166.627024][T31107] ? kernfs_root+0x1c/0x230 [ 1166.627051][T31107] ? kernfs_root+0x1c/0x230 [ 1166.627082][T31107] ? kernfs_root+0x1ea/0x230 [ 1166.627110][T31107] ? __pfx_devcgroup_access_write+0x10/0x10 [ 1166.627142][T31107] cgroup_file_write+0x36f/0x790 [ 1166.627173][T31107] ? __pfx_cgroup_file_write+0x10/0x10 [ 1166.627192][T31107] ? rcu_is_watching+0x15/0xb0 [ 1166.627227][T31107] ? __pfx_cgroup_file_write+0x10/0x10 [ 1166.627244][T31107] kernfs_fop_write_iter+0x3af/0x540 [ 1166.627277][T31107] vfs_write+0x61d/0xb90 [ 1166.627364][T31107] ? __pfx_vfs_write+0x10/0x10 [ 1166.627409][T31107] ? __fget_files+0x2a/0x420 [ 1166.627443][T31107] ksys_write+0x150/0x270 [ 1166.627476][T31107] ? __pfx_ksys_write+0x10/0x10 [ 1166.627522][T31107] do_syscall_64+0xe2/0xf80 [ 1166.627549][T31107] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.627570][T31107] ? trace_irq_disable+0x37/0x100 [ 1166.627595][T31107] ? clear_bhb_loop+0x60/0xb0 [ 1166.627622][T31107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.627643][T31107] RIP: 0033:0x7f9b7099aeb9 [ 1166.627663][T31107] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1166.627682][T31107] RSP: 002b:00007f9b717e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1166.627704][T31107] RAX: ffffffffffffffda RBX: 00007f9b70c15fa0 RCX: 00007f9b7099aeb9 [ 1166.627720][T31107] RDX: 000000000000000a RSI: 0000200000000000 RDI: 0000000000000004 [ 1166.627733][T31107] RBP: 00007f9b717e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1166.627747][T31107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1166.627760][T31107] R13: 00007f9b70c16038 R14: 00007f9b70c15fa0 R15: 00007ffcff250498 [ 1166.627798][T31107] [ 1167.357259][T31129] syzkaller1: entered promiscuous mode [ 1167.399819][T31129] syzkaller1: entered allmulticast mode [ 1167.819430][T31149] netlink: 'syz.2.6443': attribute type 3 has an invalid length. [ 1167.847759][T31149] netlink: 'syz.2.6443': attribute type 3 has an invalid length. [ 1168.031565][T31159] netlink: 'syz.3.6446': attribute type 1 has an invalid length. [ 1168.039908][T31159] __nla_validate_parse: 2 callbacks suppressed [ 1168.039927][T31159] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6446'. [ 1168.058659][T31159] netlink: 27 bytes leftover after parsing attributes in process `syz.3.6446'. [ 1168.322683][T31170] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.333688][T31175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1168.347657][T31174] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 1168.434782][T31170] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.561995][T31170] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.692022][T31170] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.805715][T31190] geneve2: entered promiscuous mode [ 1168.819677][T31190] geneve2: entered allmulticast mode [ 1168.827804][ T6891] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1168.840781][ T6891] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1168.850986][ T6891] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1168.860721][ T6891] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1168.983345][ T6891] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.036434][ T6891] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.058200][T31196] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6457'. [ 1169.126134][T31201] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6458'. [ 1169.131276][T31194] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6456'. [ 1169.188974][T31194] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6456'. [ 1169.198153][T31194] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6456'. [ 1169.218441][T31194] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6456'. [ 1169.290531][ T6891] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.312681][T31205] Bluetooth: MGMT ver 1.23 [ 1169.454200][ T6906] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.536837][T31212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6461'. [ 1169.891756][T31236] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6467'. [ 1170.503015][T31256] netlink: 'syz.2.6474': attribute type 7 has an invalid length. [ 1170.512496][T31256] netlink: 'syz.2.6474': attribute type 8 has an invalid length. [ 1170.530997][T31256] veth0: entered promiscuous mode [ 1170.566981][T31256] veth0: left promiscuous mode [ 1170.736971][T31265] geneve3: entered promiscuous mode [ 1171.095833][T31290] tipc: Enabled bearer , priority 10 [ 1171.104011][T31290] syzkaller0: entered promiscuous mode [ 1171.119118][T31290] syzkaller0: entered allmulticast mode [ 1171.226907][T31290] tipc: Resetting bearer [ 1171.262894][T31289] tipc: Resetting bearer [ 1171.315497][T31289] tipc: Disabling bearer [ 1171.630513][T31313] sctp: [Deprecated]: syz.2.6487 (pid 31313) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1171.630513][T31313] Use struct sctp_sack_info instead [ 1171.682184][T31315] netlink: 'syz.4.6490': attribute type 14 has an invalid length. [ 1171.801810][ T95] block nbd2: Possible stuck request ffff888025498000: control (read@0,1024B). Runtime 870 seconds [ 1171.813375][ T95] block nbd2: Possible stuck request ffff888025498200: control (read@1024,1024B). Runtime 870 seconds [ 1171.824891][ T95] block nbd2: Possible stuck request ffff888025498400: control (read@2048,1024B). Runtime 870 seconds [ 1171.836243][ T95] block nbd2: Possible stuck request ffff888025498600: control (read@3072,1024B). Runtime 870 seconds [ 1172.078139][T31325] sock: sock_timestamping_bind_phc: sock not bind to device [ 1172.574521][T31334] xt_hashlimit: size too large, truncated to 1048576 [ 1172.599725][T31334] xt_hashlimit: overflow, try lower: 0/0 [ 1172.701268][T31339] netlink: 'syz.2.6498': attribute type 1 has an invalid length. [ 1173.254030][T31362] __nla_validate_parse: 11 callbacks suppressed [ 1173.254060][T31362] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6503'. [ 1173.357137][T31357] netlink: 'syz.5.6503': attribute type 10 has an invalid length. [ 1174.092367][T31401] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6514'. [ 1174.103483][T31401] openvswitch: netlink: Flow actions attr not present in new flow. [ 1174.112539][ T6906] wlan0: Trigger new scan to find an IBSS to join [ 1174.242818][T31403] netlink: 6048 bytes leftover after parsing attributes in process `syz.3.6515'. [ 1174.434913][T31415] netlink: 'syz.5.6518': attribute type 1 has an invalid length. [ 1174.563093][T31416] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 1175.010302][ T6896] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1175.018202][ T6896] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1175.042942][T31440] veth1_to_team: Caught tx_queue_len zero misconfig [ 1175.073850][T31440] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6525'. [ 1175.181544][T31441] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6526'. [ 1175.356616][T31452] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6529'. [ 1175.369317][T31451] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6528'. [ 1175.501323][T31461] netlink: 6048 bytes leftover after parsing attributes in process `syz.4.6530'. [ 1175.627360][T31465] netlink: 'syz.1.6532': attribute type 29 has an invalid length. [ 1175.647696][T31465] netlink: 'syz.1.6532': attribute type 1 has an invalid length. [ 1175.659557][T31465] netlink: 'syz.1.6532': attribute type 2 has an invalid length. [ 1175.667657][T31465] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6532'. [ 1175.687702][T31465] nbd: must specify a device to reconfigure [ 1175.826177][T31467] vxlan0: entered promiscuous mode [ 1175.837267][T31467] vxlan0: entered allmulticast mode [ 1175.875543][T31469] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 1177.044562][T31506] netlink: 6048 bytes leftover after parsing attributes in process `syz.4.6543'. [ 1177.151003][T23052] wlan0: Trigger new scan to find an IBSS to join [ 1178.167323][T31524] veth3: entered promiscuous mode [ 1179.513863][T31492] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1179.714801][T31529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6552'. [ 1180.111550][T23052] wlan0: Trigger new scan to find an IBSS to join [ 1180.573601][T31548] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6557'. [ 1180.874444][T31555] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6560'. [ 1181.054343][ T6891] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1181.393282][T31575] bond2: option miimon: invalid value (18446744073709551607) [ 1181.420146][T31575] bond2: option miimon: allowed values 0 - 2147483647 [ 1181.431678][T31575] bond2 (unregistering): Released all slaves [ 1181.500909][T31579] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6565'. [ 1181.536298][T31579] netlink: 7 bytes leftover after parsing attributes in process `syz.3.6565'. [ 1182.102716][T31613] netlink: 6048 bytes leftover after parsing attributes in process `syz.1.6570'. [ 1182.242451][T31607] batman_adv: batadv0: Adding interface: ipvlan2 [ 1182.270040][T31607] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1182.329403][T31607] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1182.360901][T31607] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1182.392557][T31607] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 1182.687145][ T1301] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1182.696165][ T11] block nbd3: Possible stuck request ffff8880254b8000: control (read@0,1024B). Runtime 690 seconds [ 1182.707604][ T11] block nbd3: Possible stuck request ffff8880254b8200: control (read@1024,1024B). Runtime 690 seconds [ 1182.719462][ T11] block nbd3: Possible stuck request ffff8880254b8400: control (read@2048,1024B). Runtime 690 seconds [ 1182.731052][ T11] block nbd3: Possible stuck request ffff8880254b8600: control (read@3072,1024B). Runtime 690 seconds [ 1182.745410][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1183.118331][T31646] pimreg: entered allmulticast mode [ 1183.181921][T31645] netlink: 'syz.5.6578': attribute type 3 has an invalid length. [ 1183.204678][T31645] netlink: 'syz.5.6578': attribute type 3 has an invalid length. [ 1183.250739][T31643] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6579'. [ 1183.279156][T31643] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6579'. [ 1183.298529][T31650] netlink: 236 bytes leftover after parsing attributes in process `syz.4.6580'. [ 1183.454504][T31657] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6580'. [ 1183.589227][T31660] syzkaller0: entered promiscuous mode [ 1183.594969][T31660] syzkaller0: entered allmulticast mode [ 1184.034974][T31674] wg1 speed is unknown, defaulting to 1000 [ 1184.054473][T31674] lo speed is unknown, defaulting to 1000 [ 1184.093888][T31674] virt_wifi0 speed is unknown, defaulting to 1000 [ 1184.422627][T31688] netlink: 'syz.5.6588': attribute type 21 has an invalid length. [ 1184.643193][T31701] netlink: 'syz.4.6593': attribute type 1 has an invalid length. [ 1184.754604][T31706] __nla_validate_parse: 1 callbacks suppressed [ 1184.754628][T31706] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6594'. [ 1184.904664][T31708] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6592'. [ 1186.492892][T31701] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1187.726029][T31752] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6602'. [ 1187.907658][T31757] netlink: 'syz.3.6603': attribute type 21 has an invalid length. [ 1187.935967][T31759] netlink: 'syz.5.6604': attribute type 12 has an invalid length. [ 1187.962782][T31760] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6604'. [ 1187.971603][T31757] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6603'. [ 1188.002913][T31759] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6604'. [ 1188.031556][T31757] netlink: 'syz.3.6603': attribute type 4 has an invalid length. [ 1188.054133][T31757] netlink: 3 bytes leftover after parsing attributes in process `syz.3.6603'. [ 1188.108778][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5360 ms [ 1188.116952][ C1] lec:lec_tx_timeout: lec0 [ 1188.248387][T31773] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6607'. [ 1188.352387][T31782] netlink: 'syz.1.6610': attribute type 1 has an invalid length. [ 1188.374229][T31784] netlink: 'syz.4.6608': attribute type 1 has an invalid length. [ 1188.393093][T31782] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6610'. [ 1188.430222][T31784] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1188.549758][T31793] netlink: 228 bytes leftover after parsing attributes in process `syz.3.6611'. [ 1188.813415][T31806] netlink: 'syz.4.6616': attribute type 6 has an invalid length. [ 1188.875936][T31814] netlink: 'syz.1.6618': attribute type 4 has an invalid length. [ 1188.920614][T31806] wg1 speed is unknown, defaulting to 1000 [ 1188.928416][T31806] lo speed is unknown, defaulting to 1000 [ 1188.944166][T31806] virt_wifi0 speed is unknown, defaulting to 1000 [ 1188.989853][T31812] veth0: entered promiscuous mode [ 1188.995068][T31812] veth0: entered allmulticast mode [ 1189.494693][T31844] tipc: Started in network mode [ 1189.514866][T31844] tipc: Node identity 12d1f2a81371, cluster identity 4711 [ 1189.579134][T31844] tipc: Enabled bearer , priority 0 [ 1189.588327][T31845] syzkaller0: entered promiscuous mode [ 1189.658441][T31845] syzkaller0: entered allmulticast mode [ 1189.735994][T31852] netlink: 'syz.5.6626': attribute type 39 has an invalid length. [ 1189.826934][T31845] tipc: Resetting bearer [ 1189.876012][T31845] tipc: Disabling bearer [ 1190.299770][T31871] __nla_validate_parse: 8 callbacks suppressed [ 1190.299793][T31871] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6632'. [ 1190.644296][T31888] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6639'. [ 1191.061919][T31907] netlink: 'syz.5.6643': attribute type 3 has an invalid length. [ 1191.089137][T31907] netlink: 666 bytes leftover after parsing attributes in process `syz.5.6643'. [ 1191.382660][T31918] netlink: 'syz.5.6646': attribute type 1 has an invalid length. [ 1191.464580][T31918] bond8 (unregistering): Released all slaves [ 1191.533610][T31924] netem: change failed [ 1191.624270][T31926] ip6gre1: entered allmulticast mode [ 1191.925223][T31942] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6652'. [ 1192.301997][T31957] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6656'. [ 1192.447524][T31962] netlink: 'syz.2.6658': attribute type 3 has an invalid length. [ 1192.474405][T31962] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6658'. [ 1192.526832][T31963] wg1 speed is unknown, defaulting to 1000 [ 1192.559763][T31962] netlink: 'syz.2.6658': attribute type 13 has an invalid length. [ 1192.606648][T20327] IPVS: starting estimator thread 0... [ 1192.640094][T31959] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1192.699138][T31963] lo speed is unknown, defaulting to 1000 [ 1192.801221][T31966] IPVS: using max 25 ests per chain, 60000 per kthread [ 1192.835779][T31963] virt_wifi0 speed is unknown, defaulting to 1000 [ 1193.226655][T31979] netlink: 88 bytes leftover after parsing attributes in process `syz.5.6663'. [ 1193.449863][T31981] wg1 speed is unknown, defaulting to 1000 [ 1193.482024][T31981] lo speed is unknown, defaulting to 1000 [ 1193.500991][T31981] virt_wifi0 speed is unknown, defaulting to 1000 [ 1193.536900][T31988] Bluetooth: MGMT ver 1.23 [ 1193.568695][T31991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6666'. [ 1193.589851][T31990] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6664'. [ 1193.716927][T31998] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6667'. [ 1193.941935][T32004] netlink: 'syz.5.6668': attribute type 1 has an invalid length. [ 1194.083526][T32006] pimreg: entered allmulticast mode [ 1194.765003][T32034] netlink: 'syz.3.6677': attribute type 1 has an invalid length. [ 1194.807838][T32034] veth5: entered promiscuous mode [ 1194.836500][T32034] bond1: (slave erspan0): Releasing active interface [ 1194.848054][T32034] ip6gretap1: entered promiscuous mode [ 1194.856604][T32031] netlink: 'syz.2.6676': attribute type 39 has an invalid length. [ 1195.143659][T32040] batadv_slave_0: entered promiscuous mode [ 1195.184236][T32039] batadv_slave_0: left promiscuous mode [ 1195.353166][T32047] macsec1: entered promiscuous mode [ 1195.372984][T32047] macsec1: entered allmulticast mode [ 1195.408690][T32050] __nla_validate_parse: 1 callbacks suppressed [ 1195.408713][T32050] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6682'. [ 1195.479565][T32050] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6682'. [ 1195.611316][T32060] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6682'. [ 1195.712008][T32063] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6685'. [ 1195.872021][ T30] audit: type=1800 audit(1769942627.795:11): pid=32071 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.6686" name=FF05 dev="tmpfs" ino=723 res=0 errno=0 [ 1195.925057][T32060] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1195.949874][ T30] audit: type=1804 audit(1769942627.795:12): pid=32069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.6686" name=FF05 dev="tmpfs" ino=723 res=1 errno=0 [ 1196.002593][T32060] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.314844][T32060] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1196.328067][T32060] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.421625][T32083] netlink: 596 bytes leftover after parsing attributes in process `syz.2.6690'. [ 1196.440366][T32079] netlink: 'syz.2.6690': attribute type 29 has an invalid length. [ 1196.472744][T32086] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6693'. [ 1196.487759][T32080] netlink: 'syz.2.6690': attribute type 29 has an invalid length. [ 1196.543237][T32087] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6693'. [ 1196.677474][T32060] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1196.697745][T32060] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.932257][T32060] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1196.974274][T32060] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1197.157242][T32109] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6700'. [ 1197.218504][T32108] netlink: 'syz.5.6699': attribute type 4 has an invalid length. [ 1197.370592][ T6891] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1197.380795][T32117] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1197.409552][ T6891] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.435053][ T6891] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1197.451673][ T6891] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.573713][ T6891] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1197.598813][ T6891] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.612227][T32120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6703'. [ 1197.667254][ T6891] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1197.706717][ T6891] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.838274][T32132] wg1 speed is unknown, defaulting to 1000 [ 1197.865894][T32132] lo speed is unknown, defaulting to 1000 [ 1197.891459][T32132] virt_wifi0 speed is unknown, defaulting to 1000 [ 1198.139739][T32148] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6710'. [ 1198.207072][T32151] x_tables: ip6_tables: SYNPROXY target: used from hooks PREROUTING, but only usable from INPUT/FORWARD [ 1198.974969][T32175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1199.020660][T32172] team1: entered promiscuous mode [ 1199.059231][T32172] team1: entered allmulticast mode [ 1199.073095][T32172] 8021q: adding VLAN 0 to HW filter on device team1 [ 1199.237045][T32183] team2: entered promiscuous mode [ 1199.262309][T32183] team2: entered allmulticast mode [ 1199.276201][T32183] 8021q: adding VLAN 0 to HW filter on device team2 [ 1199.315677][T32179] bridge0: port 2(bridge_slave_1) entered disabled state [ 1199.323798][T32179] bridge0: port 1(bridge_slave_0) entered disabled state [ 1199.531970][T32192] netlink: 'syz.5.6722': attribute type 2 has an invalid length. [ 1199.797945][T32197] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1199.860920][T32197] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1199.943102][T32197] bond0 (unregistering): Released all slaves [ 1200.098487][ T6891] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1200.134982][ T6891] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1200.172287][ T6891] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1200.574690][T32225] wg1 speed is unknown, defaulting to 1000 [ 1200.581347][ T6891] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1200.601778][T32225] lo speed is unknown, defaulting to 1000 [ 1200.618420][T32225] virt_wifi0 speed is unknown, defaulting to 1000 [ 1200.923519][T32240] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1200.999063][T32237] __nla_validate_parse: 13 callbacks suppressed [ 1200.999085][T32237] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6731'. [ 1201.022711][T32244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6735'. [ 1201.131763][T32226] wg1 speed is unknown, defaulting to 1000 [ 1201.243897][T32226] lo speed is unknown, defaulting to 1000 [ 1201.359426][T32226] virt_wifi0 speed is unknown, defaulting to 1000 [ 1201.582351][T32252] wg1 speed is unknown, defaulting to 1000 [ 1201.719384][T32252] lo speed is unknown, defaulting to 1000 [ 1201.727275][T32252] virt_wifi0 speed is unknown, defaulting to 1000 [ 1201.738990][T32261] netlink: 'syz.5.6741': attribute type 1 has an invalid length. [ 1201.784730][T32261] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1201.817951][T32264] netlink: 6048 bytes leftover after parsing attributes in process `syz.3.6742'. [ 1201.874635][T32267] veth7: entered promiscuous mode [ 1201.884527][T32267] bond8: (slave veth7): Enslaving as an active interface with an up link [ 1201.898114][ T95] block nbd2: Possible stuck request ffff888025498000: control (read@0,1024B). Runtime 900 seconds [ 1201.910284][ T95] block nbd2: Possible stuck request ffff888025498200: control (read@1024,1024B). Runtime 900 seconds [ 1201.922532][ T95] block nbd2: Possible stuck request ffff888025498400: control (read@2048,1024B). Runtime 900 seconds [ 1201.934343][ T95] block nbd2: Possible stuck request ffff888025498600: control (read@3072,1024B). Runtime 900 seconds [ 1201.970947][T32270] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6743'. [ 1202.231876][T32276] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6745'. [ 1202.264326][T32276] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6745'. [ 1202.342517][T32275] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6744'. [ 1202.519965][T32276] hsr_slave_1 (unregistering): left promiscuous mode [ 1202.694489][T32284] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6746'. [ 1202.717788][T32284] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6746'. [ 1203.042967][T32297] macsec1: entered promiscuous mode [ 1203.048374][T32297] macsec1: entered allmulticast mode [ 1203.438950][T32317] netlink: 6048 bytes leftover after parsing attributes in process `syz.2.6756'. [ 1203.516241][ T5831] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1203.527679][ T5831] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1203.537342][ T5831] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1203.552616][ T5831] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1203.561239][ T5831] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1203.904323][T32320] wg1 speed is unknown, defaulting to 1000 [ 1204.079552][T32320] lo speed is unknown, defaulting to 1000 [ 1204.108651][T32320] virt_wifi0 speed is unknown, defaulting to 1000 [ 1204.537604][T32350] netlink: 'syz.2.6765': attribute type 29 has an invalid length. [ 1204.839551][T32367] netlink: 'syz.2.6765': attribute type 29 has an invalid length. [ 1204.901263][T32374] netlink: 'syz.3.6764': attribute type 13 has an invalid length. [ 1205.043449][T32358] wg1 speed is unknown, defaulting to 1000 [ 1205.112937][T32358] lo speed is unknown, defaulting to 1000 [ 1205.147527][T32358] virt_wifi0 speed is unknown, defaulting to 1000 [ 1205.312176][T23052] netdevsim netdevsim5 eth5: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.408360][T32320] chnl_net:caif_netlink_parms(): no params data found [ 1205.452096][ T6906] netdevsim netdevsim5 eth6: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.549114][ T6891] netdevsim netdevsim5 eth7: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.628862][ T5831] Bluetooth: hci0: command tx timeout [ 1205.686926][ T6891] netdevsim netdevsim5 eth8: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.801733][T32401] netlink: 'syz.1.6776': attribute type 39 has an invalid length. [ 1206.258344][ T6893] batman_adv: batadv0: Removing interface: gretap1 [ 1206.321282][ T6893] dvmrp0 (unregistering): left allmulticast mode [ 1206.416086][ T6893] bond4 (unregistering): (slave bridge1): Releasing active interface [ 1206.688107][ T6893] bond0 (unregistering): left promiscuous mode [ 1206.694664][ T6893] bond_slave_0: left promiscuous mode [ 1206.701302][ T6893] bond_slave_1: left promiscuous mode [ 1206.707255][ T6893] bridge_slave_1: left promiscuous mode [ 1206.717083][ T6893] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1206.730151][ T6893] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1206.743277][ T6893] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1206.757843][ T6893] bond0 (unregistering): Released all slaves [ 1206.773600][ T6893] bond1 (unregistering): Released all slaves [ 1207.005775][ T6893] bond2 (unregistering): Released all slaves [ 1207.025656][ T6893] bond3 (unregistering): Released all slaves [ 1207.046471][ T6893] bond4 (unregistering): Released all slaves [ 1207.067867][ T6893] bond5 (unregistering): Released all slaves [ 1207.290723][ T6893] bond6 (unregistering): left promiscuous mode [ 1207.298396][ T6893] team0: Port device bond6 removed [ 1207.310257][ T6893] bond6 (unregistering): Released all slaves [ 1207.330094][ T6893] bond7 (unregistering): Released all slaves [ 1207.540672][ T6893] bond8 (unregistering): (slave veth7): Releasing backup interface [ 1207.557035][ T6893] bond8 (unregistering): Released all slaves [ 1207.598107][T32399] netlink: 'syz.4.6775': attribute type 3 has an invalid length. [ 1207.720642][ T5831] Bluetooth: hci0: command tx timeout [ 1207.862071][ T6916] ip6gretap1: left promiscuous mode [ 1207.881667][ T6893] : left promiscuous mode [ 1208.064461][T32417] __nla_validate_parse: 4 callbacks suppressed [ 1208.064483][T32417] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6778'. [ 1208.112590][T32417] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6778'. [ 1208.136431][ T6893] : left promiscuous mode [ 1208.151384][T32417] netlink: 'syz.3.6778': attribute type 1 has an invalid length. [ 1208.179516][T32425] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6779'. [ 1208.245851][T32424] netlink: 6 bytes leftover after parsing attributes in process `syz.1.6779'. [ 1208.262759][T32417] bond0: entered promiscuous mode [ 1208.290705][T32417] bond0: entered allmulticast mode [ 1208.296808][T32417] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1208.417692][T32418] erspan1: entered allmulticast mode [ 1208.436281][T32418] bond0: (slave erspan1): making interface the new active one [ 1208.444850][T32418] erspan1: entered promiscuous mode [ 1208.452073][T32418] bond0: (slave erspan1): Enslaving as an active interface with an up link [ 1208.496226][ T6893] tipc: Disabling bearer [ 1208.508121][ T6893] tipc: Left network mode [ 1208.513140][T32419] wg1 speed is unknown, defaulting to 1000 [ 1208.525571][T32419] lo speed is unknown, defaulting to 1000 [ 1208.545311][T32320] bridge0: port 1(bridge_slave_0) entered blocking state [ 1208.566745][T32320] bridge0: port 1(bridge_slave_0) entered disabled state [ 1208.577045][T32320] bridge_slave_0: entered allmulticast mode [ 1208.586258][T32320] bridge_slave_0: entered promiscuous mode [ 1208.599275][T32419] virt_wifi0 speed is unknown, defaulting to 1000 [ 1208.729929][T32320] bridge0: port 2(bridge_slave_1) entered blocking state [ 1208.739644][T32320] bridge0: port 2(bridge_slave_1) entered disabled state [ 1208.769728][T32320] bridge_slave_1: entered allmulticast mode [ 1208.777751][T32320] bridge_slave_1: entered promiscuous mode [ 1208.890335][T32437] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6781'. [ 1209.113807][T32320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1209.301182][T32442] syzkaller0: entered promiscuous mode [ 1209.306941][T32442] syzkaller0: entered allmulticast mode [ 1209.321070][T32320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1209.537171][T32320] team0: Port device team_slave_0 added [ 1209.790479][ T5831] Bluetooth: hci0: command tx timeout [ 1210.297371][T32479] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6793'. [ 1210.362112][T32480] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6793'. [ 1210.382992][T32480] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6793'. [ 1211.874564][ T5831] Bluetooth: hci0: command tx timeout [ 1212.766209][ T11] block nbd3: Possible stuck request ffff8880254b8000: control (read@0,1024B). Runtime 720 seconds [ 1212.778618][ T11] block nbd3: Possible stuck request ffff8880254b8200: control (read@1024,1024B). Runtime 720 seconds [ 1212.789900][ T11] block nbd3: Possible stuck request ffff8880254b8400: control (read@2048,1024B). Runtime 720 seconds [ 1212.801162][ T11] block nbd3: Possible stuck request ffff8880254b8600: control (read@3072,1024B). Runtime 720 seconds [ 1213.401719][ T6896] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1214.405429][T32320] team0: Port device team_slave_1 added [ 1214.453385][T32479] bridge0: port 2(bridge_slave_1) entered disabled state [ 1214.460947][T32479] bridge0: port 1(bridge_slave_0) entered disabled state [ 1214.760749][T32320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1214.767800][T32320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1214.814006][T32320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1214.857866][T32320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1214.899101][T32320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1214.973108][T32320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1215.316860][T32320] hsr_slave_0: entered promiscuous mode [ 1215.365718][T32320] hsr_slave_1: entered promiscuous mode [ 1215.390616][T32320] debugfs: 'hsr0' already exists in 'hsr' [ 1215.406860][T32320] Cannot create hsr debugfs directory [ 1216.098263][ T6893] batadv0: left promiscuous mode [ 1216.143934][ T6893] hsr_slave_0: left promiscuous mode [ 1216.163558][ T6893] hsr_slave_1: left promiscuous mode [ 1216.172582][ T6893] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1216.190714][ T6893] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1216.975274][T32539] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6808'. [ 1216.992762][T32539] nbd: illegal input index -1113835520 [ 1217.135125][T32545] netlink: 'syz.1.6809': attribute type 13 has an invalid length. [ 1217.162660][T32547] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 1217.193357][T32548] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6809'. [ 1217.644656][ T6893] team_slave_1 (unregistering): left promiscuous mode [ 1217.653572][ T6893] team0 (unregistering): Port device team_slave_1 removed [ 1217.725143][ T6893] team_slave_0 (unregistering): left promiscuous mode [ 1217.738463][ T6893] team0 (unregistering): Port device team_slave_0 removed [ 1218.439839][T32528] wg1 speed is unknown, defaulting to 1000 [ 1218.443143][T32542] netlink: 'syz.1.6809': attribute type 2 has an invalid length. [ 1218.469318][T32542] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6809'. [ 1218.646298][T32528] lo speed is unknown, defaulting to 1000 [ 1218.682984][T32528] virt_wifi0 speed is unknown, defaulting to 1000 [ 1219.083362][T32566] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6817'. [ 1219.279828][T32320] netdevsim netdevsim5 eth8 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1219.521378][T32320] netdevsim netdevsim5 eth7 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1219.596399][T32578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6821'. [ 1219.680701][T32320] netdevsim netdevsim5 eth6 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1219.979426][T32320] netdevsim netdevsim5 eth5 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1220.036014][T32584] dvmrp1: entered allmulticast mode [ 1220.051497][T32587] dvmrp1: left allmulticast mode [ 1220.399814][T32320] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1220.423704][T32320] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1220.508651][T32320] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1220.581103][T32320] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1220.591200][T32596] openvswitch: netlink: Key type 273 is out of range max 32 [ 1220.691316][T32606] FAULT_INJECTION: forcing a failure. [ 1220.691316][T32606] name failslab, interval 1, probability 0, space 0, times 0 [ 1220.755965][T32606] CPU: 0 UID: 0 PID: 32606 Comm: syz.4.6827 Not tainted syzkaller #0 PREEMPT(full) [ 1220.756013][T32606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1220.756035][T32606] Call Trace: [ 1220.756045][T32606] [ 1220.756055][T32606] dump_stack_lvl+0xe8/0x150 [ 1220.756089][T32606] should_fail_ex+0x412/0x560 [ 1220.756123][T32606] should_failslab+0xa8/0x100 [ 1220.756150][T32606] __kmalloc_node_noprof+0xe6/0x7f0 [ 1220.756173][T32606] ? crypto_create_tfm_node+0x83/0x3f0 [ 1220.756203][T32606] crypto_create_tfm_node+0x83/0x3f0 [ 1220.756233][T32606] crypto_alloc_tfm_node+0x172/0x3f0 [ 1220.756266][T32606] esp_init_state+0x63c/0x1240 [ 1220.756310][T32606] ? __pfx_esp_init_state+0x10/0x10 [ 1220.756355][T32606] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1220.756384][T32606] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1220.756424][T32606] ? __xfrm_init_state+0x842/0x1460 [ 1220.756453][T32606] __xfrm_init_state+0xac9/0x1460 [ 1220.756475][T32606] ? __xfrm_init_state+0x842/0x1460 [ 1220.756504][T32606] xfrm_init_state+0x18/0xa0 [ 1220.756533][T32606] pfkey_add+0x1d34/0x2df0 [ 1220.756579][T32606] ? __pfx_pfkey_add+0x10/0x10 [ 1220.756600][T32606] ? pfkey_broadcast+0x3c2/0x3e0 [ 1220.756636][T32606] pfkey_sendmsg+0xc56/0x1120 [ 1220.756658][T32606] ? unwind_next_frame+0xa5/0x23c0 [ 1220.756698][T32606] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1220.756750][T32606] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1220.756779][T32606] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1220.756804][T32606] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1220.756826][T32606] ____sys_sendmsg+0xa68/0xad0 [ 1220.756854][T32606] ? __might_fault+0xaf/0x130 [ 1220.756892][T32606] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1220.756933][T32606] ? import_iovec+0x73/0xa0 [ 1220.756969][T32606] ___sys_sendmsg+0x2a5/0x360 [ 1220.756996][T32606] ? __lock_acquire+0x6b5/0x2cf0 [ 1220.757031][T32606] ? __pfx____sys_sendmsg+0x10/0x10 [ 1220.757101][T32606] ? __fget_files+0x2a/0x420 [ 1220.757124][T32606] ? __fget_files+0x3a0/0x420 [ 1220.757165][T32606] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1220.757198][T32606] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1220.757239][T32606] ? __pfx_ksys_write+0x10/0x10 [ 1220.757284][T32606] do_syscall_64+0xe2/0xf80 [ 1220.757311][T32606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1220.757331][T32606] ? trace_irq_disable+0x37/0x100 [ 1220.757351][T32606] ? clear_bhb_loop+0x60/0xb0 [ 1220.757378][T32606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1220.757398][T32606] RIP: 0033:0x7f9c8a99aeb9 [ 1220.757418][T32606] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1220.757437][T32606] RSP: 002b:00007f9c8b893028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1220.757461][T32606] RAX: ffffffffffffffda RBX: 00007f9c8ac15fa0 RCX: 00007f9c8a99aeb9 [ 1220.757477][T32606] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1220.757491][T32606] RBP: 00007f9c8b893090 R08: 0000000000000000 R09: 0000000000000000 [ 1220.757504][T32606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1220.757522][T32606] R13: 00007f9c8ac16038 R14: 00007f9c8ac15fa0 R15: 00007ffe93df1db8 [ 1220.757564][T32606] [ 1221.126048][T32320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1221.241569][T32320] 8021q: adding VLAN 0 to HW filter on device team0 [ 1221.286780][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1221.294141][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1221.312989][ T7013] lec:lec_start_xmit: lec0:No lecd attached [ 1221.406431][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1221.413768][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1221.439912][T32615] netlink: 76 bytes leftover after parsing attributes in process `syz.1.6831'. [ 1221.485452][T32611] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6832'. [ 1221.495024][T32611] veth1_vlan: Caught tx_queue_len zero misconfig [ 1221.753483][T32625] netlink: 'syz.4.6835': attribute type 21 has an invalid length. [ 1221.765243][T32625] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6835'. [ 1221.860607][T32625] netlink: 'syz.4.6835': attribute type 5 has an invalid length. [ 1221.881400][T32625] netlink: 'syz.4.6835': attribute type 6 has an invalid length. [ 1221.919658][T32625] netlink: 3 bytes leftover after parsing attributes in process `syz.4.6835'. [ 1222.054021][T32320] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1222.101782][T32633] netlink: 232 bytes leftover after parsing attributes in process `syz.2.6836'. [ 1222.125986][T32633] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6836'. [ 1222.329831][T32642] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6837'. [ 1222.550447][T32320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1222.799008][T32659] FAULT_INJECTION: forcing a failure. [ 1222.799008][T32659] name failslab, interval 1, probability 0, space 0, times 0 [ 1222.839889][T32659] CPU: 0 UID: 0 PID: 32659 Comm: syz.1.6842 Not tainted syzkaller #0 PREEMPT(full) [ 1222.839920][T32659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1222.839933][T32659] Call Trace: [ 1222.839942][T32659] [ 1222.839953][T32659] dump_stack_lvl+0xe8/0x150 [ 1222.839993][T32659] should_fail_ex+0x412/0x560 [ 1222.840025][T32659] should_failslab+0xa8/0x100 [ 1222.840052][T32659] __kmalloc_node_noprof+0xe6/0x7f0 [ 1222.840074][T32659] ? __pfx___up_read+0x10/0x10 [ 1222.840095][T32659] ? crypto_create_tfm_node+0x83/0x3f0 [ 1222.840122][T32659] crypto_create_tfm_node+0x83/0x3f0 [ 1222.840151][T32659] crypto_spawn_tfm2+0x5c/0x90 [ 1222.840205][T32659] aead_init_geniv+0x169/0x240 [ 1222.840231][T32659] crypto_create_tfm_node+0x18c/0x3f0 [ 1222.840261][T32659] crypto_alloc_tfm_node+0x172/0x3f0 [ 1222.840295][T32659] esp_init_state+0x63c/0x1240 [ 1222.840338][T32659] ? __pfx_esp_init_state+0x10/0x10 [ 1222.840382][T32659] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1222.840413][T32659] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1222.840452][T32659] ? __xfrm_init_state+0x842/0x1460 [ 1222.840480][T32659] __xfrm_init_state+0xac9/0x1460 [ 1222.840502][T32659] ? __xfrm_init_state+0x842/0x1460 [ 1222.840530][T32659] xfrm_init_state+0x18/0xa0 [ 1222.840550][T32659] pfkey_add+0x1d34/0x2df0 [ 1222.840602][T32659] ? __pfx_pfkey_add+0x10/0x10 [ 1222.840624][T32659] ? pfkey_broadcast+0x3c2/0x3e0 [ 1222.840660][T32659] pfkey_sendmsg+0xc56/0x1120 [ 1222.840681][T32659] ? unwind_next_frame+0xa5/0x23c0 [ 1222.840723][T32659] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1222.840775][T32659] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1222.840804][T32659] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1222.840829][T32659] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1222.840851][T32659] ____sys_sendmsg+0xa68/0xad0 [ 1222.840881][T32659] ? __might_fault+0xaf/0x130 [ 1222.840919][T32659] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1222.840960][T32659] ? import_iovec+0x73/0xa0 [ 1222.840995][T32659] ___sys_sendmsg+0x2a5/0x360 [ 1222.841024][T32659] ? __lock_acquire+0x6b5/0x2cf0 [ 1222.841059][T32659] ? __pfx____sys_sendmsg+0x10/0x10 [ 1222.841128][T32659] ? __fget_files+0x2a/0x420 [ 1222.841151][T32659] ? __fget_files+0x3a0/0x420 [ 1222.841185][T32659] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1222.841218][T32659] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1222.841258][T32659] ? __pfx_ksys_write+0x10/0x10 [ 1222.841302][T32659] do_syscall_64+0xe2/0xf80 [ 1222.841330][T32659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1222.841351][T32659] ? trace_irq_disable+0x37/0x100 [ 1222.841371][T32659] ? clear_bhb_loop+0x60/0xb0 [ 1222.841397][T32659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1222.841418][T32659] RIP: 0033:0x7f9b7099aeb9 [ 1222.841438][T32659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1222.841456][T32659] RSP: 002b:00007f9b717e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1222.841480][T32659] RAX: ffffffffffffffda RBX: 00007f9b70c15fa0 RCX: 00007f9b7099aeb9 [ 1222.841497][T32659] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1222.841510][T32659] RBP: 00007f9b717e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1222.841524][T32659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1222.841537][T32659] R13: 00007f9b70c16038 R14: 00007f9b70c15fa0 R15: 00007ffcff250498 [ 1222.841585][T32659] [ 1223.213259][T32669] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 1223.255115][T32669] batman_adv: batadv0: Adding interface: gretap1 [ 1223.339153][T32669] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1223.482444][T32669] batman_adv: batadv0: Interface activated: gretap1 [ 1223.673535][T32678] xt_l2tp: v2 sid > 0xffff: 4294901760 [ 1223.887844][T32685] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6847'. [ 1224.006758][T32688] netlink: 'syz.1.6849': attribute type 21 has an invalid length. [ 1224.017738][T32692] syzkaller0: entered promiscuous mode [ 1224.024836][T32692] syzkaller0: entered allmulticast mode [ 1224.282951][T32702] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1224.412779][T32688] tipc: Started in network mode [ 1224.418049][T32688] tipc: Node identity 2e0f7ac2c31, cluster identity 4711 [ 1224.451937][T32688] tipc: Enabled bearer , priority 0 [ 1224.523937][T32687] tipc: Resetting bearer [ 1224.640778][T32687] tipc: Disabling bearer [ 1224.682013][T32320] veth0_vlan: entered promiscuous mode [ 1224.717915][T32320] veth1_vlan: entered promiscuous mode [ 1224.879030][T32320] veth0_macvtap: entered promiscuous mode [ 1224.915318][T32320] veth1_macvtap: entered promiscuous mode [ 1224.949353][T32716] syzkaller0: entered promiscuous mode [ 1224.954979][T32716] syzkaller0: entered allmulticast mode [ 1224.995163][T32719] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6857'. [ 1225.171229][T32729] siw: device registration error -23 [ 1225.256543][T32320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1225.307282][T32320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1225.608427][ T6916] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1225.651359][ T6916] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1225.664897][ T6916] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1225.694662][ T6916] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1225.743141][T32747] mac80211_hwsim hwsim83 wlan0: Caught tx_queue_len zero misconfig [ 1225.920406][ T6916] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1225.928402][ T6916] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1226.040092][ T6896] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1226.081680][ T6896] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1226.093006][T32755] syzkaller0: entered promiscuous mode [ 1226.098581][T32755] syzkaller0: entered allmulticast mode [ 1226.153696][T32753] wg1 speed is unknown, defaulting to 1000 [ 1226.161447][T32755] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6867'. [ 1226.185793][T32753] lo speed is unknown, defaulting to 1000 [ 1226.262498][T32753] virt_wifi0 speed is unknown, defaulting to 1000 [ 1226.265050][T32755] tipc: Started in network mode [ 1226.293864][T32755] tipc: Node identity 2a9765a98562, cluster identity 4711 [ 1226.319913][T32755] tipc: Enabled bearer , priority 0 [ 1226.384210][T32766] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6755'. [ 1226.406402][T32754] tipc: Resetting bearer [ 1226.416478][T32767] FAULT_INJECTION: forcing a failure. [ 1226.416478][T32767] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.451870][T32767] CPU: 0 UID: 0 PID: 32767 Comm: syz.1.6869 Not tainted syzkaller #0 PREEMPT(full) [ 1226.451907][T32767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1226.451922][T32767] Call Trace: [ 1226.451931][T32767] [ 1226.451942][T32767] dump_stack_lvl+0xe8/0x150 [ 1226.451977][T32767] should_fail_ex+0x412/0x560 [ 1226.452011][T32767] should_failslab+0xa8/0x100 [ 1226.452039][T32767] __kmalloc_node_noprof+0xe6/0x7f0 [ 1226.452062][T32767] ? crypto_create_tfm_node+0x83/0x3f0 [ 1226.452092][T32767] crypto_create_tfm_node+0x83/0x3f0 [ 1226.452122][T32767] crypto_ahash_init_tfm+0x162/0x770 [ 1226.452154][T32767] crypto_create_tfm_node+0x18c/0x3f0 [ 1226.452183][T32767] crypto_spawn_tfm2+0x5c/0x90 [ 1226.452214][T32767] crypto_authenc_init_tfm+0x47/0x1c0 [ 1226.452254][T32767] crypto_create_tfm_node+0x18c/0x3f0 [ 1226.452284][T32767] crypto_spawn_tfm2+0x5c/0x90 [ 1226.452312][T32767] aead_init_geniv+0x169/0x240 [ 1226.452338][T32767] crypto_create_tfm_node+0x18c/0x3f0 [ 1226.452367][T32767] crypto_alloc_tfm_node+0x172/0x3f0 [ 1226.452401][T32767] esp_init_state+0x63c/0x1240 [ 1226.452444][T32767] ? __pfx_esp_init_state+0x10/0x10 [ 1226.452488][T32767] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1226.452520][T32767] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1226.452558][T32767] ? __xfrm_init_state+0x842/0x1460 [ 1226.452587][T32767] __xfrm_init_state+0xac9/0x1460 [ 1226.452609][T32767] ? __xfrm_init_state+0x842/0x1460 [ 1226.452638][T32767] xfrm_init_state+0x18/0xa0 [ 1226.452657][T32767] pfkey_add+0x1d34/0x2df0 [ 1226.452703][T32767] ? __pfx_pfkey_add+0x10/0x10 [ 1226.452724][T32767] ? pfkey_broadcast+0x3c2/0x3e0 [ 1226.452760][T32767] pfkey_sendmsg+0xc56/0x1120 [ 1226.452781][T32767] ? unwind_next_frame+0xa5/0x23c0 [ 1226.452822][T32767] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1226.452873][T32767] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1226.452901][T32767] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1226.452926][T32767] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1226.452948][T32767] ____sys_sendmsg+0xa68/0xad0 [ 1226.452979][T32767] ? __might_fault+0xaf/0x130 [ 1226.453018][T32767] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1226.453058][T32767] ? import_iovec+0x73/0xa0 [ 1226.453094][T32767] ___sys_sendmsg+0x2a5/0x360 [ 1226.453122][T32767] ? __lock_acquire+0x6b5/0x2cf0 [ 1226.453157][T32767] ? __pfx____sys_sendmsg+0x10/0x10 [ 1226.453232][T32767] ? __fget_files+0x2a/0x420 [ 1226.453255][T32767] ? __fget_files+0x3a0/0x420 [ 1226.453290][T32767] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1226.453324][T32767] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1226.453364][T32767] ? __pfx_ksys_write+0x10/0x10 [ 1226.453409][T32767] do_syscall_64+0xe2/0xf80 [ 1226.453436][T32767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.453457][T32767] ? trace_irq_disable+0x37/0x100 [ 1226.453477][T32767] ? clear_bhb_loop+0x60/0xb0 [ 1226.453503][T32767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.453523][T32767] RIP: 0033:0x7f9b7099aeb9 [ 1226.453544][T32767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.453565][T32767] RSP: 002b:00007f9b717e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1226.453589][T32767] RAX: ffffffffffffffda RBX: 00007f9b70c15fa0 RCX: 00007f9b7099aeb9 [ 1226.453605][T32767] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1226.453619][T32767] RBP: 00007f9b717e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1226.453633][T32767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1226.453646][T32767] R13: 00007f9b70c16038 R14: 00007f9b70c15fa0 R15: 00007ffcff250498 [ 1226.453683][T32767] [ 1226.895428][T32754] tipc: Disabling bearer [ 1227.070154][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 1227.078480][ C1] lec:lec_tx_timeout: lec0 [ 1227.497559][ T322] ip6tnl0: Caught tx_queue_len zero misconfig [ 1227.513963][ T323] netlink: 152 bytes leftover after parsing attributes in process `syz.5.6871'. [ 1228.021644][ T346] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6882'. [ 1228.073540][ T340] wg1 speed is unknown, defaulting to 1000 [ 1228.093410][ T340] lo speed is unknown, defaulting to 1000 [ 1228.120711][ T340] virt_wifi0 speed is unknown, defaulting to 1000 [ 1228.581074][ T368] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6891'. [ 1228.642481][ T368] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6891'. [ 1228.748524][ T377] gre0: entered promiscuous mode [ 1228.765199][ T377] gre0: entered allmulticast mode [ 1228.840875][ T368] vlan3: entered allmulticast mode [ 1229.064171][ T392] netlink: 'syz.4.6897': attribute type 3 has an invalid length. [ 1229.089396][ T392] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6897'. [ 1229.194683][ T401] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6900'. [ 1229.205884][ T406] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6900'. [ 1229.264094][ T391] netlink: 1 bytes leftover after parsing attributes in process `syz.3.6896'. [ 1229.305569][ T401] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1229.417402][ T404] wg1 speed is unknown, defaulting to 1000 [ 1229.454698][ T412] macsec2: entered promiscuous mode [ 1229.468278][ T412] macsec2: entered allmulticast mode [ 1229.505904][ T412] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6901'. [ 1229.539330][ T414] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6901'. [ 1229.606166][ T421] Cannot find add_set index 0 as target [ 1229.618527][ T404] lo speed is unknown, defaulting to 1000 [ 1229.628652][ T404] virt_wifi0 speed is unknown, defaulting to 1000 [ 1230.209899][ T438] wg1 speed is unknown, defaulting to 1000 [ 1230.286861][ T438] lo speed is unknown, defaulting to 1000 [ 1230.709393][ T444] wg0: entered promiscuous mode [ 1230.714783][ T444] wg0: entered allmulticast mode [ 1230.736412][ T438] virt_wifi0 speed is unknown, defaulting to 1000 [ 1231.188368][ T468] FAULT_INJECTION: forcing a failure. [ 1231.188368][ T468] name failslab, interval 1, probability 0, space 0, times 0 [ 1231.209201][ T468] CPU: 1 UID: 0 PID: 468 Comm: syz.4.6916 Not tainted syzkaller #0 PREEMPT(full) [ 1231.209234][ T468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1231.209248][ T468] Call Trace: [ 1231.209257][ T468] [ 1231.209267][ T468] dump_stack_lvl+0xe8/0x150 [ 1231.209301][ T468] should_fail_ex+0x412/0x560 [ 1231.209332][ T468] should_failslab+0xa8/0x100 [ 1231.209358][ T468] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 1231.209393][ T468] ? __alloc_skb+0x1d0/0x7d0 [ 1231.209417][ T468] ? __local_bh_enable_ip+0xd0/0x130 [ 1231.209443][ T468] __alloc_skb+0x1d0/0x7d0 [ 1231.209474][ T468] xfrm_send_state_notify+0x884/0x18d0 [ 1231.209501][ T468] ? km_state_notify+0x25/0x1f0 [ 1231.209524][ T468] ? __pfx_xfrm_send_state_notify+0x10/0x10 [ 1231.209543][ T468] ? km_state_notify+0x25/0x1f0 [ 1231.209566][ T468] ? xfrm_state_add+0x56e/0xc40 [ 1231.209583][ T468] ? __local_bh_enable_ip+0xd0/0x130 [ 1231.209606][ T468] ? km_state_notify+0x25/0x1f0 [ 1231.209626][ T468] ? km_state_notify+0x25/0x1f0 [ 1231.209647][ T468] ? __pfx_xfrm_send_state_notify+0x10/0x10 [ 1231.209668][ T468] km_state_notify+0x110/0x1f0 [ 1231.209695][ T468] pfkey_add+0x2008/0x2df0 [ 1231.209743][ T468] ? __pfx_pfkey_add+0x10/0x10 [ 1231.209764][ T468] ? pfkey_broadcast+0x3c2/0x3e0 [ 1231.209800][ T468] pfkey_sendmsg+0xc56/0x1120 [ 1231.209822][ T468] ? unwind_next_frame+0xa5/0x23c0 [ 1231.209870][ T468] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1231.209925][ T468] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1231.209953][ T468] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1231.209979][ T468] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1231.210001][ T468] ____sys_sendmsg+0xa68/0xad0 [ 1231.210031][ T468] ? __might_fault+0xaf/0x130 [ 1231.210069][ T468] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1231.210109][ T468] ? import_iovec+0x73/0xa0 [ 1231.210145][ T468] ___sys_sendmsg+0x2a5/0x360 [ 1231.210172][ T468] ? __lock_acquire+0x6b5/0x2cf0 [ 1231.210211][ T468] ? __pfx____sys_sendmsg+0x10/0x10 [ 1231.210282][ T468] ? __fget_files+0x2a/0x420 [ 1231.210305][ T468] ? __fget_files+0x3a0/0x420 [ 1231.210341][ T468] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1231.210373][ T468] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1231.210415][ T468] ? __pfx_ksys_write+0x10/0x10 [ 1231.210459][ T468] do_syscall_64+0xe2/0xf80 [ 1231.210493][ T468] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1231.210513][ T468] ? trace_irq_disable+0x37/0x100 [ 1231.210533][ T468] ? clear_bhb_loop+0x60/0xb0 [ 1231.210560][ T468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1231.210581][ T468] RIP: 0033:0x7f9c8a99aeb9 [ 1231.210601][ T468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1231.210620][ T468] RSP: 002b:00007f9c8b893028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1231.210643][ T468] RAX: ffffffffffffffda RBX: 00007f9c8ac15fa0 RCX: 00007f9c8a99aeb9 [ 1231.210657][ T468] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1231.210672][ T468] RBP: 00007f9c8b893090 R08: 0000000000000000 R09: 0000000000000000 [ 1231.210685][ T468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1231.210698][ T468] R13: 00007f9c8ac16038 R14: 00007f9c8ac15fa0 R15: 00007ffe93df1db8 [ 1231.210733][ T468] [ 1231.953499][ T95] block nbd2: Possible stuck request ffff888025498000: control (read@0,1024B). Runtime 930 seconds [ 1231.966577][ T95] block nbd2: Possible stuck request ffff888025498200: control (read@1024,1024B). Runtime 930 seconds [ 1231.978014][ T95] block nbd2: Possible stuck request ffff888025498400: control (read@2048,1024B). Runtime 930 seconds [ 1231.990518][ T95] block nbd2: Possible stuck request ffff888025498600: control (read@3072,1024B). Runtime 930 seconds [ 1232.060303][ T474] 8021q: VLANs not supported on tunl0 [ 1232.590255][ T496] tunl0: Caught tx_queue_len zero misconfig [ 1232.721082][ T502] macvlan2: entered promiscuous mode [ 1232.953876][ T516] wg1 speed is unknown, defaulting to 1000 [ 1232.988093][ T516] lo speed is unknown, defaulting to 1000 [ 1233.036832][ T516] virt_wifi0 speed is unknown, defaulting to 1000 [ 1233.192667][ T517] __nla_validate_parse: 4 callbacks suppressed [ 1233.192691][ T517] netlink: 76 bytes leftover after parsing attributes in process `syz.5.6931'. [ 1233.239191][ T528] netlink: 'syz.1.6934': attribute type 27 has an invalid length. [ 1233.360810][ T540] netlink: 6048 bytes leftover after parsing attributes in process `syz.2.6935'. [ 1233.455016][ T537] dummy0: entered promiscuous mode [ 1233.895555][ T554] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6936'. [ 1233.994237][ T523] dummy0: left promiscuous mode [ 1234.181292][ T559] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6937'. [ 1234.479247][ T579] netlink: 'syz.3.6944': attribute type 1 has an invalid length. [ 1234.615377][ T584] lo: Caught tx_queue_len zero misconfig [ 1234.639158][ T583] netlink: 6048 bytes leftover after parsing attributes in process `syz.2.6946'. [ 1234.677053][ T586] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6947'. [ 1234.702240][ T588] netlink: 312 bytes leftover after parsing attributes in process `syz.3.6948'. [ 1234.821192][ T586] netlink: 92 bytes leftover after parsing attributes in process `syz.4.6947'. [ 1234.830910][ T593] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6950'. [ 1234.830943][ T593] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6950'. [ 1234.907456][ T593] bond2: option min_links: invalid value (18446744073709551612) [ 1234.919048][ T593] bond2: option min_links: allowed values 0 - 2147483647 [ 1234.952025][ T593] bond2 (unregistering): Released all slaves [ 1235.078465][ T598] wg1 speed is unknown, defaulting to 1000 [ 1235.107388][ T598] lo speed is unknown, defaulting to 1000 [ 1235.121170][ T598] virt_wifi0 speed is unknown, defaulting to 1000 [ 1235.417474][ T615] xt_TCPMSS: Only works on TCP SYN packets [ 1236.563431][ T652] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1236.664765][ T652] bond1 (unregistering): Released all slaves [ 1236.794635][ T661] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1236.903566][ T670] syzkaller0: entered promiscuous mode [ 1236.912172][ T670] syzkaller0: entered allmulticast mode [ 1236.937218][ T661] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.035002][ T661] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.121662][ T661] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.295913][ T6891] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.346632][ T6891] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.403416][ T6891] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.442798][T23052] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.794582][ T684] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1238.001371][ T681] wg1 speed is unknown, defaulting to 1000 [ 1238.076109][ T690] gretap0: entered promiscuous mode [ 1238.144349][ T681] lo speed is unknown, defaulting to 1000 [ 1238.160669][ T681] virt_wifi0 speed is unknown, defaulting to 1000 [ 1238.426954][ T706] __nla_validate_parse: 6 callbacks suppressed [ 1238.426991][ T706] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6981'. [ 1238.585613][ T711] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6981'. [ 1238.651431][ T711] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6981'. [ 1239.083493][ T723] netlink: 'syz.5.6983': attribute type 1 has an invalid length. [ 1239.197845][ T710] wg1 speed is unknown, defaulting to 1000 [ 1239.316512][ T710] lo speed is unknown, defaulting to 1000 [ 1239.323885][ T732] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6985'. [ 1239.349010][ T710] virt_wifi0 speed is unknown, defaulting to 1000 [ 1239.905716][ T752] xt_hashlimit: overflow, rate too high: 0 [ 1240.355560][ T772] netlink: 'syz.3.6995': attribute type 16 has an invalid length. [ 1240.371288][ T772] netlink: 'syz.3.6995': attribute type 17 has an invalid length. [ 1240.589000][ T780] netlink: 292 bytes leftover after parsing attributes in process `syz.3.6997'. [ 1240.692714][ T782] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6999'. [ 1240.985999][ T797] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7000'. [ 1241.224924][ T809] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7004'. [ 1241.265887][ T810] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7004'. [ 1241.371270][ T789] wg1 speed is unknown, defaulting to 1000 [ 1241.392766][ T789] lo speed is unknown, defaulting to 1000 [ 1241.410967][ T789] virt_wifi0 speed is unknown, defaulting to 1000 [ 1241.534706][ T820] netlink: 'syz.2.7007': attribute type 2 has an invalid length. [ 1241.592186][ T820] !9: entered promiscuous mode [ 1241.668224][ T821] netlink: 36 bytes leftover after parsing attributes in process `syz.5.7009'. [ 1241.766919][ T820] netlink: 'syz.2.7007': attribute type 2 has an invalid length. [ 1241.876693][ T820] !9: left promiscuous mode [ 1241.940522][ T831] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1241.989392][ T831] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.321669][ T831] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1242.367295][ T831] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.523273][ T831] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1242.536554][ T831] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.569965][ T846] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1242.576321][ T846] syzkaller1: linktype set to 825 [ 1242.591815][ T847] tipc: Started in network mode [ 1242.600429][ T847] tipc: Node identity 264e4f66ef08, cluster identity 4711 [ 1242.610907][ T847] tipc: Enabled bearer , priority 10 [ 1242.640208][ T851] syzkaller0: entered promiscuous mode [ 1242.666693][ T851] syzkaller0: entered allmulticast mode [ 1242.748410][ T857] delete_channel: no stack [ 1242.759017][ T831] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1242.785244][ T831] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.834050][ T11] block nbd3: Possible stuck request ffff8880254b8000: control (read@0,1024B). Runtime 750 seconds [ 1242.844411][ T852] tipc: Resetting bearer [ 1242.851012][ T11] block nbd3: Possible stuck request ffff8880254b8200: control (read@1024,1024B). Runtime 750 seconds [ 1242.862720][ T11] block nbd3: Possible stuck request ffff8880254b8400: control (read@2048,1024B). Runtime 750 seconds [ 1242.874354][ T11] block nbd3: Possible stuck request ffff8880254b8600: control (read@3072,1024B). Runtime 750 seconds [ 1243.060646][ T6893] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1243.079526][ T862] SET target dimension over the limit! [ 1243.085350][ T6893] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.127484][ T6893] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1243.162781][ T6893] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.200561][ T866] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1243.360922][ T845] tipc: Resetting bearer [ 1243.452634][ T845] tipc: Disabling bearer [ 1243.535309][ T6891] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1243.544392][ T6891] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.591079][ T6891] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1243.607613][ T6891] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.885113][ T891] syzkaller1: entered promiscuous mode [ 1243.910428][ T891] syzkaller1: entered allmulticast mode [ 1244.056823][ T892] syzkaller0: entered promiscuous mode [ 1244.076153][ T892] syzkaller0: entered allmulticast mode [ 1244.114128][ T1301] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1244.129338][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1244.404585][ T906] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1244.543444][ T917] __nla_validate_parse: 3 callbacks suppressed [ 1244.543466][ T917] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7034'. [ 1244.576127][ T917] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7034'. [ 1244.888235][ T945] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7038'. [ 1245.000039][ T926] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7035'. [ 1245.038907][ T926] netlink: 32 bytes leftover after parsing attributes in process `syz.5.7035'. [ 1245.050773][ T926] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7035'. [ 1245.073109][ T926] netlink: 32 bytes leftover after parsing attributes in process `syz.5.7035'. [ 1245.391841][ T6893] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1249.145443][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1249.153763][ C1] lec:lec_tx_timeout: lec0 [ 1250.218079][ T932] wg1 speed is unknown, defaulting to 1000 [ 1250.260413][ T970] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7041'. [ 1250.275864][ T970] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7041'. [ 1250.288019][ T932] lo speed is unknown, defaulting to 1000 [ 1250.341307][ T932] virt_wifi0 speed is unknown, defaulting to 1000 [ 1250.639267][ T985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7045'. [ 1251.219434][ T997] syzkaller0: entered promiscuous mode [ 1251.298973][ T997] syzkaller0: entered allmulticast mode [ 1251.577761][ T1012] Bluetooth: MGMT ver 1.23 [ 1251.967647][ T1045] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1252.021980][ T1048] netlink: 'syz.5.7058': attribute type 1 has an invalid length. [ 1252.039290][ T1048] netlink: 'syz.5.7058': attribute type 2 has an invalid length. [ 1252.113954][ T1055] netlink: 292 bytes leftover after parsing attributes in process `syz.2.7060'. [ 1252.527600][ T1073] netlink: 'syz.3.7065': attribute type 4 has an invalid length. [ 1252.576232][ T1060] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1252.592221][ T1076] netlink: 'syz.3.7065': attribute type 4 has an invalid length. [ 1252.777676][ T1060] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1252.946094][ T1084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7068'. [ 1252.946748][ T1060] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1253.024506][ T1082] netlink: 3 bytes leftover after parsing attributes in process `syz.4.7067'. [ 1253.034078][ T1082] 0X: renamed from caif0 [ 1253.050109][ T1082] 0X: entered allmulticast mode [ 1253.057834][ T1082] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 1253.195115][ T1060] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1253.323048][ T1098] netlink: 292 bytes leftover after parsing attributes in process `syz.4.7072'. [ 1253.423366][ T6893] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.466663][ T1101] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7073'. [ 1253.497099][ T6893] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.673383][ T1111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7076'. [ 1253.695878][ T1111] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1253.732689][ T1094] siw: device registration error -23 [ 1253.780841][ T6906] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.851579][ T6893] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.980469][ T1118] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7078'. [ 1254.013940][ T1118] bridge0: port 2(team0) entered disabled state [ 1254.022038][ T1118] bridge0: port 1(bridge_slave_0) entered disabled state [ 1254.652707][ T1152] wg1 speed is unknown, defaulting to 1000 [ 1254.680684][ T1152] lo speed is unknown, defaulting to 1000 [ 1254.693934][ T1152] virt_wifi0 speed is unknown, defaulting to 1000 [ 1255.483769][ T1179] bond2: option mode: unable to set because the bond device has slaves [ 1255.521552][ T1180] __nla_validate_parse: 2 callbacks suppressed [ 1255.521575][ T1180] netlink: 292 bytes leftover after parsing attributes in process `syz.4.7097'. [ 1255.643806][ T1184] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7100'. [ 1255.736273][ T1187] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7101'. [ 1255.819832][ T1192] netlink: 'syz.5.7102': attribute type 13 has an invalid length. [ 1255.830867][ T1190] netlink: 'syz.3.7103': attribute type 1 has an invalid length. [ 1255.841041][ T1192] gretap0: refused to change device tx_queue_len [ 1255.847526][ T1192] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1255.923966][ T1190] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1256.026747][ T1190] veth7: entered promiscuous mode [ 1256.057460][ T1190] bond2: (slave veth7): Enslaving as an active interface with a down link [ 1256.080123][ T1194] bond2: (slave erspan0): making interface the new active one [ 1256.092937][ T1194] erspan0: entered promiscuous mode [ 1256.100196][ T1194] bond2: (slave erspan0): Enslaving as an active interface with an up link [ 1257.322850][ T1142] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1257.585959][ T1211] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1257.640050][ T1217] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7106'. [ 1257.680112][ T1213] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7107'. [ 1257.776547][ T1219] netlink: 'syz.1.7107': attribute type 1 has an invalid length. [ 1257.893668][ T1224] vlan2: entered promiscuous mode [ 1257.931520][ T1224] vlan2: entered allmulticast mode [ 1257.936781][ T1224] hsr_slave_1: entered allmulticast mode [ 1257.960715][ T1234] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7111'. [ 1258.016870][ T1240] netlink: 'syz.2.7114': attribute type 1 has an invalid length. [ 1258.264736][ T1273] netlink: 6048 bytes leftover after parsing attributes in process `syz.2.7117'. [ 1258.685397][ T1287] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7120'. [ 1258.798313][ T1297] netlink: 'syz.3.7123': attribute type 2 has an invalid length. [ 1258.807035][ T1297] netlink: 'syz.3.7123': attribute type 1 has an invalid length. [ 1259.028580][ T1308] netlink: 6048 bytes leftover after parsing attributes in process `syz.3.7127'. [ 1259.374074][ T1328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7129'. [ 1259.679654][ T1337] tipc: Enabled bearer , priority 17 [ 1259.727992][ T1344] --map-set only usable from mangle table [ 1260.085610][ T1354] bridge2: entered promiscuous mode [ 1260.156535][ T1354] bridge2: entered allmulticast mode [ 1260.540632][ T1365] __nla_validate_parse: 2 callbacks suppressed [ 1260.540652][ T1365] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7140'. [ 1260.798835][T20324] tipc: Node number set to 2952095145 [ 1260.826944][ T1370] x_tables: duplicate underflow at hook 1 [ 1260.867134][ T1376] netlink: 'syz.2.7137': attribute type 1 has an invalid length. [ 1261.002695][ T1376] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1261.127020][ T1387] netlink: 192 bytes leftover after parsing attributes in process `syz.5.7147'. [ 1261.835138][ T1418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7154'. [ 1261.869108][ T1418] bridge_slave_1: left allmulticast mode [ 1261.884972][ T1418] bridge_slave_1: left promiscuous mode [ 1261.898309][ T1418] bridge0: port 2(bridge_slave_1) entered disabled state [ 1261.912946][ T1418] bridge_slave_0: left allmulticast mode [ 1261.919457][ T1418] bridge_slave_0: left promiscuous mode [ 1261.922238][ T1428] netlink: 'syz.5.7157': attribute type 1 has an invalid length. [ 1261.926253][ T1418] bridge0: port 1(bridge_slave_0) entered disabled state [ 1262.033422][ T95] block nbd2: Possible stuck request ffff888025498000: control (read@0,1024B). Runtime 960 seconds [ 1262.043204][ T1432] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7157'. [ 1262.048467][ T95] block nbd2: Possible stuck request ffff888025498200: control (read@1024,1024B). Runtime 960 seconds [ 1262.067177][ T95] block nbd2: Possible stuck request ffff888025498400: control (read@2048,1024B). Runtime 960 seconds [ 1262.078639][ T95] block nbd2: Possible stuck request ffff888025498600: control (read@3072,1024B). Runtime 960 seconds [ 1262.102096][ T1434] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7157'. [ 1262.242702][ T1428] bond1: entered promiscuous mode [ 1262.258645][ T1428] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1262.435157][ T1430] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1262.487145][ T1430] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1262.532708][ T1430] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 1262.580564][ T1430] bond1: (slave wireguard0): making interface the new active one [ 1262.601470][ T1430] wireguard0: entered promiscuous mode [ 1262.621735][ T1430] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 1262.697853][ T1450] syzkaller0: entered promiscuous mode [ 1262.716883][ T1450] syzkaller0: entered allmulticast mode [ 1262.867960][ T1456] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7162'. [ 1262.880200][ T1458] netlink: 144 bytes leftover after parsing attributes in process `syz.5.7163'. [ 1262.974544][ T1462] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7164'. [ 1263.476047][ T1483] wg1 speed is unknown, defaulting to 1000 [ 1263.491323][ T1484] netlink: 'syz.2.7168': attribute type 10 has an invalid length. [ 1263.517034][ T1483] lo speed is unknown, defaulting to 1000 [ 1263.524759][ T1483] virt_wifi0 speed is unknown, defaulting to 1000 [ 1263.532356][ T1488] netlink: 'syz.3.7170': attribute type 4 has an invalid length. [ 1263.663672][ T1493] netlink: 'syz.3.7170': attribute type 4 has an invalid length. [ 1263.970574][ T1488] syzkaller0: entered promiscuous mode [ 1263.996672][ T1488] syzkaller0: entered allmulticast mode [ 1264.024270][ T1502] veth0: entered promiscuous mode [ 1264.029727][ T1502] veth0: entered allmulticast mode [ 1264.310877][ T1493] tipc: Enabled bearer , priority 0 [ 1264.438631][ T1486] tipc: Resetting bearer [ 1264.516425][ T1518] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7176'. [ 1264.548869][ T1518] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7176'. [ 1264.574930][ T1518] netlink: 'syz.4.7176': attribute type 13 has an invalid length. [ 1264.599912][ T1486] tipc: Disabling bearer [ 1264.616687][ T1518] netlink: 'syz.4.7176': attribute type 12 has an invalid length. [ 1264.620336][ T1524] netlink: 'syz.4.7176': attribute type 1 has an invalid length. [ 1264.895633][ T1527] gre0: left promiscuous mode [ 1264.904025][ T1527] gre0: left allmulticast mode [ 1264.913284][ T1527] gretap0: left promiscuous mode [ 1264.939513][ T1527] erspan0: left allmulticast mode [ 1264.973016][ T1527] sit0: left promiscuous mode [ 1265.038058][ T1527] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1265.113522][ T1540] netlink: 'syz.4.7184': attribute type 12 has an invalid length. [ 1265.274781][ T1547] netlink: 'syz.3.7187': attribute type 9 has an invalid length. [ 1265.295017][ T1545] veth0: entered promiscuous mode [ 1265.307474][ T1545] veth0: entered allmulticast mode [ 1265.548146][ T1559] ip6tnl0: Caught tx_queue_len zero misconfig [ 1265.592219][ T1559] __nla_validate_parse: 5 callbacks suppressed [ 1265.592240][ T1559] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7189'. [ 1265.731560][ T1562] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7192'. [ 1265.754883][ T1564] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7193'. [ 1265.781037][ T1568] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7194'. [ 1266.093204][ T1575] bond0: (slave rose0): Releasing backup interface [ 1266.418504][ T1588] veth0: entered promiscuous mode [ 1266.428535][ T1588] veth0: entered allmulticast mode [ 1266.900045][ T1599] wg1 speed is unknown, defaulting to 1000 [ 1266.911732][ T1599] lo speed is unknown, defaulting to 1000 [ 1266.924035][ T1599] virt_wifi0 speed is unknown, defaulting to 1000 [ 1266.988582][ T1608] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7205'. [ 1267.012881][ T1608] FAULT_INJECTION: forcing a failure. [ 1267.012881][ T1608] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1267.053132][ T1611] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7206'. [ 1267.061986][ T1608] CPU: 1 UID: 0 PID: 1608 Comm: syz.3.7205 Not tainted syzkaller #0 PREEMPT(full) [ 1267.062072][ T1608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1267.062097][ T1608] Call Trace: [ 1267.062105][ T1608] [ 1267.062115][ T1608] dump_stack_lvl+0xe8/0x150 [ 1267.062152][ T1608] should_fail_ex+0x412/0x560 [ 1267.062183][ T1608] _copy_to_user+0x31/0xb0 [ 1267.062217][ T1608] simple_read_from_buffer+0xe1/0x170 [ 1267.062250][ T1608] proc_fail_nth_read+0x1bb/0x230 [ 1267.062284][ T1608] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1267.062317][ T1608] ? rw_verify_area+0x2a6/0x4d0 [ 1267.062348][ T1608] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1267.062381][ T1608] vfs_read+0x20c/0xa70 [ 1267.062409][ T1608] ? fdget_pos+0x246/0x320 [ 1267.062438][ T1608] ? __pfx___mutex_lock+0x10/0x10 [ 1267.062475][ T1608] ? __pfx_vfs_read+0x10/0x10 [ 1267.062507][ T1608] ? __fget_files+0x2a/0x420 [ 1267.062535][ T1608] ? __fget_files+0x3a0/0x420 [ 1267.062556][ T1608] ? __fget_files+0x2a/0x420 [ 1267.062590][ T1608] ksys_read+0x150/0x270 [ 1267.062623][ T1608] ? __pfx_ksys_read+0x10/0x10 [ 1267.062667][ T1608] do_syscall_64+0xe2/0xf80 [ 1267.062694][ T1608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1267.062714][ T1608] ? trace_irq_disable+0x37/0x100 [ 1267.062733][ T1608] ? clear_bhb_loop+0x60/0xb0 [ 1267.062781][ T1608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1267.062859][ T1608] RIP: 0033:0x7f46dd15b78e [ 1267.062932][ T1608] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1267.062986][ T1608] RSP: 002b:00007f46de133fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1267.063043][ T1608] RAX: ffffffffffffffda RBX: 00007f46de1346c0 RCX: 00007f46dd15b78e [ 1267.063086][ T1608] RDX: 000000000000000f RSI: 00007f46de1340a0 RDI: 0000000000000010 [ 1267.063119][ T1608] RBP: 00007f46de134090 R08: 0000000000000000 R09: 0000000000000000 [ 1267.063151][ T1608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1267.063192][ T1608] R13: 00007f46dd416038 R14: 00007f46dd415fa0 R15: 00007ffc68cdad28 [ 1267.063282][ T1608] [ 1267.411243][ T1258] erspan0: left promiscuous mode [ 1268.070520][ T1643] netlink: 6048 bytes leftover after parsing attributes in process `syz.5.7214'. [ 1268.108004][ T1647] No such timeout policy "syz0" [ 1268.122206][ T1650] No such timeout policy "syz0" [ 1268.685285][ T1680] x9: renamed from bridge_slave_0 (while UP) [ 1268.811633][ T1680] smc: net device geneve0 applied user defined pnetid SYZ0 [ 1268.819296][ T1682] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7224'. [ 1269.437075][ T1702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7229'. [ 1269.863758][ T1720] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7234'. [ 1269.963961][ T1728] netlink: 'syz.1.7236': attribute type 1 has an invalid length. [ 1270.311441][ T1731] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1270.372735][ T1731] bond4: (slave vxcan1): Error -95 calling set_mac_address [ 1270.520663][ T1734] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1270.614857][ T1728] bond4: (slave bridge4): Enslaving as an active interface with a down link [ 1270.760385][ T1742] macvlan0: entered promiscuous mode [ 1270.768964][ T1742] macvlan0: entered allmulticast mode [ 1270.781160][ T1742] bond4: entered promiscuous mode [ 1270.807718][ T1742] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1270.835018][ T1742] bond4: left promiscuous mode [ 1270.912837][ T1767] netlink: 'syz.3.7241': attribute type 4 has an invalid length. [ 1271.177788][ T1755] wg1 speed is unknown, defaulting to 1000 [ 1271.255742][ T1755] lo speed is unknown, defaulting to 1000 [ 1271.315843][ T1755] virt_wifi0 speed is unknown, defaulting to 1000 [ 1271.661173][ T1791] batman_adv: batadv0: Adding interface: dummy0 [ 1271.674325][ T1791] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1271.729737][ T1799] __nla_validate_parse: 1 callbacks suppressed [ 1271.729760][ T1799] netlink: 332 bytes leftover after parsing attributes in process `syz.4.7249'. [ 1271.748271][ T1799] netlink: 'syz.4.7249': attribute type 9 has an invalid length. [ 1271.757299][ T1791] batman_adv: batadv0: Interface activated: dummy0 [ 1271.767474][ T1799] netlink: 100 bytes leftover after parsing attributes in process `syz.4.7249'. [ 1271.808325][ T1797] batadv0: mtu less than device minimum [ 1271.849539][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.861490][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.873541][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.886094][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.898129][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.910527][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.923237][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.935267][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1271.947385][ T1797] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1272.093876][ T1811] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7252'. [ 1272.150476][ T1811] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7252'. [ 1272.233967][ T1263] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1272.248636][ T1811] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7252'. [ 1272.259618][ T1263] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1272.267897][ T1263] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1272.297391][ T1811] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7252'. [ 1272.322813][ T1263] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1272.572929][ T1824] pim6reg1: entered promiscuous mode [ 1272.609269][ T1824] pim6reg1: entered allmulticast mode [ 1272.684013][ T1836] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7260'. [ 1272.910296][ T11] block nbd3: Possible stuck request ffff8880254b8000: control (read@0,1024B). Runtime 780 seconds [ 1272.921690][ T11] block nbd3: Possible stuck request ffff8880254b8200: control (read@1024,1024B). Runtime 780 seconds [ 1272.933323][ T11] block nbd3: Possible stuck request ffff8880254b8400: control (read@2048,1024B). Runtime 780 seconds [ 1272.944547][ T11] block nbd3: Possible stuck request ffff8880254b8600: control (read@3072,1024B). Runtime 780 seconds [ 1273.392901][ T1869] batadv_slave_0: entered promiscuous mode [ 1273.469901][ T1868] batadv_slave_0: left promiscuous mode [ 1273.664945][ T1878] netlink: 'syz.1.7269': attribute type 39 has an invalid length. [ 1274.005429][ T1904] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7277'. [ 1274.014802][ T1904] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7277'. [ 1274.031531][ T1904] ip6gretap0: entered promiscuous mode [ 1274.040292][ T1904] syz_tun: entered promiscuous mode [ 1274.047538][ T1904] debugfs: 'hsr1' already exists in 'hsr' [ 1274.057780][ T1904] Cannot create hsr debugfs directory [ 1274.076632][ T1904] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7277'. [ 1274.141252][ T1907] syzkaller0: entered promiscuous mode [ 1274.158958][ T1907] syzkaller0: entered allmulticast mode [ 1274.830449][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1275.345054][ T1932] netlink: 'syz.5.7284': attribute type 11 has an invalid length. [ 1276.888365][ T1894] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1277.071764][ T1950] __nla_validate_parse: 2 callbacks suppressed [ 1277.071797][ T1950] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7288'. [ 1277.299127][ T1952] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7288'. [ 1277.391652][ T1258] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1277.462989][ T1962] netlink: 7 bytes leftover after parsing attributes in process `syz.1.7292'. [ 1277.558680][ T1957] netlink: 60 bytes leftover after parsing attributes in process `syz.5.7291'. [ 1277.619243][ T1957] netlink: 60 bytes leftover after parsing attributes in process `syz.5.7291'. [ 1277.776358][ T1974] netlink: 292 bytes leftover after parsing attributes in process `syz.1.7293'. [ 1277.801558][ T1975] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7294'. [ 1278.033977][ T1982] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7295'. [ 1278.338458][ T1991] netlink: 'syz.2.7301': attribute type 21 has an invalid length. [ 1278.503758][ T1993] wg1 speed is unknown, defaulting to 1000 [ 1278.553088][ T1993] lo speed is unknown, defaulting to 1000 [ 1278.569933][ T1993] virt_wifi0 speed is unknown, defaulting to 1000 [ 1278.576829][ T2005] netlink: 'syz.1.7304': attribute type 10 has an invalid length. [ 1278.614190][ T2005] syz_tun: entered promiscuous mode [ 1278.679916][ T2005] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1278.775432][ T2009] netlink: 'syz.2.7305': attribute type 1 has an invalid length. [ 1278.852883][ T2007] net_ratelimit: 12 callbacks suppressed [ 1278.852908][ T2007] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1279.013535][ T2013] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7305'. [ 1279.037199][ T2009] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1279.097003][ T2015] netlink: 292 bytes leftover after parsing attributes in process `syz.1.7306'. [ 1279.144330][ T1999] wg1 speed is unknown, defaulting to 1000 [ 1279.153546][ T2009] bond4: entered allmulticast mode [ 1279.204943][ T1999] lo speed is unknown, defaulting to 1000 [ 1279.273014][ T2009] bond4: (slave dummy0): making interface the new active one [ 1279.305553][ T2009] dummy0: entered allmulticast mode [ 1279.316114][ T2009] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 1279.337154][ T1999] virt_wifi0 speed is unknown, defaulting to 1000 [ 1279.345655][ T2020] lec:lec_vcc_attach: copy from user failed for 28 bytes [ 1279.381114][ T2017] lec:lec_vcc_attach: copy from user failed for 28 bytes [ 1279.844904][ T2019] wg1 speed is unknown, defaulting to 1000 [ 1279.868580][ T2019] lo speed is unknown, defaulting to 1000 [ 1279.930967][ T2019] virt_wifi0 speed is unknown, defaulting to 1000 [ 1280.434415][ T2037] bond4: (slave dummy0): Releasing active interface [ 1280.449231][ T2037] dummy0: left allmulticast mode [ 1280.850990][ T2019] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 1280.863176][ T2019] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 1280.871835][ T2019] CPU: 1 UID: 0 PID: 2019 Comm: syz.3.7307 Not tainted syzkaller #0 PREEMPT(full) [ 1280.882471][ T2019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1280.892934][ T2019] RIP: 0010:lec_arp_clear_vccs+0xad/0x380 [ 1280.898718][ T2019] Code: e8 03 80 3c 28 00 74 08 4c 89 e7 e8 2d 1a 67 f7 4c 89 74 24 18 49 8b 2c 24 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 05 1a 67 f7 4d 8b 75 00 4d 8d a7 30 [ 1280.919762][ T2019] RSP: 0018:ffffc9000cc2f828 EFLAGS: 00010046 [ 1280.924557][ T2059] veth1_macvtap: left promiscuous mode [ 1280.925965][ T2019] RAX: 0000000000000000 RBX: ffff888028f42000 RCX: dffffc0000000000 [ 1280.925986][ T2019] RDX: 0000000000000000 RSI: ffffffff8c073960 RDI: ffff888028f42000 [ 1280.934678][ T2059] macsec0: entered allmulticast mode [ 1280.939545][ T2019] RBP: ffff88823be4a000 R08: ffffffff8ed019f3 R09: 1ffffffff1da033e [ 1280.939566][ T2019] R10: dffffc0000000000 R11: fffffbfff1da033f R12: ffff88804aa49650 [ 1280.939582][ T2019] R13: 0000000000000000 R14: ffff888028f42030 R15: ffff88804aa49000 [ 1280.939598][ T2019] FS: 0000000000000000(0000) GS:ffff8881257ed000(0000) knlGS:0000000000000000 [ 1280.987014][ T2019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1280.993910][ T2019] CR2: 000020000005f000 CR3: 0000000031830000 CR4: 00000000003526f0 [ 1281.002139][ T2019] Call Trace: [ 1281.005721][ T2019] [ 1281.008690][ T2019] lec_push+0x3cb/0x19d0 [ 1281.012989][ T2019] ? __local_bh_enable_ip+0xd0/0x130 [ 1281.018057][ T2061] veth1_macvtap: entered promiscuous mode [ 1281.018410][ T2019] ? __pfx_lec_push+0x10/0x10 [ 1281.030040][ T2019] vcc_release+0x15f/0x580 [ 1281.034907][ T2019] sock_close+0xc3/0x240 [ 1281.039195][ T2019] ? __pfx_sock_close+0x10/0x10 [ 1281.044093][ T2019] __fput+0x44f/0xa70 [ 1281.048140][ T2019] task_work_run+0x1d9/0x270 [ 1281.052785][ T2019] ? __pfx_task_work_run+0x10/0x10 [ 1281.057955][ T2019] ? do_raw_spin_unlock+0xf5/0x210 [ 1281.063133][ T2019] do_exit+0x69b/0x2310 [ 1281.067346][ T2019] ? __pfx_do_exit+0x10/0x10 [ 1281.069345][ T2061] veth1_macvtap: entered allmulticast mode [ 1281.072071][ T2019] ? do_raw_spin_lock+0x12b/0x2f0 [ 1281.072106][ T2019] do_group_exit+0x21b/0x2d0 [ 1281.082123][ T2061] macsec0: left allmulticast mode [ 1281.083708][ T2019] ? _raw_spin_unlock_irq+0x23/0x50 [ 1281.088654][ T2061] veth1_macvtap: left allmulticast mode [ 1281.093515][ T2019] get_signal+0x1284/0x1330 [ 1281.093592][ T2019] arch_do_signal_or_restart+0xbc/0x830 [ 1281.115128][ T2019] ? unshare_nsproxy_namespaces+0x143/0x160 [ 1281.121164][ T2019] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1281.127352][ T2019] ? ksys_unshare+0x7fc/0x900 [ 1281.132057][ T2019] ? __pfx_ksys_unshare+0x10/0x10 [ 1281.137110][ T2019] exit_to_user_mode_loop+0x86/0x480 [ 1281.142522][ T2019] ? rcu_is_watching+0x15/0xb0 [ 1281.147320][ T2019] do_syscall_64+0x2b7/0xf80 [ 1281.152078][ T2019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1281.158251][ T2019] ? trace_irq_disable+0x37/0x100 [ 1281.163298][ T2019] ? clear_bhb_loop+0x60/0xb0 [ 1281.168017][ T2019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1281.174078][ T2019] RIP: 0033:0x7f46dd19aeb9 [ 1281.178518][ T2019] Code: Unable to access opcode bytes at 0x7f46dd19ae8f. [ 1281.185836][ T2019] RSP: 002b:00007f46de113028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1281.194535][ T2019] RAX: fffffffffffffffc RBX: 00007f46dd416090 RCX: 00007f46dd19aeb9 [ 1281.202563][ T2019] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 1281.210695][ T2019] RBP: 00007f46dd208c1f R08: 0000000000000000 R09: 0000000000000000 [ 1281.218792][ T2019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1281.226816][ T2019] R13: 00007f46dd416128 R14: 00007f46dd416090 R15: 00007ffc68cdad28 [ 1281.234924][ T2019] [ 1281.238203][ T2019] Modules linked in: [ 1281.242131][ T2019] ---[ end trace 0000000000000000 ]--- [ 1281.247619][ T2019] RIP: 0010:lec_arp_clear_vccs+0xad/0x380 [ 1281.253550][ T2019] Code: e8 03 80 3c 28 00 74 08 4c 89 e7 e8 2d 1a 67 f7 4c 89 74 24 18 49 8b 2c 24 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 05 1a 67 f7 4d 8b 75 00 4d 8d a7 30 [ 1281.273545][ T2019] RSP: 0018:ffffc9000cc2f828 EFLAGS: 00010046 [ 1281.280138][ T2019] RAX: 0000000000000000 RBX: ffff888028f42000 RCX: dffffc0000000000 [ 1281.288250][ T2019] RDX: 0000000000000000 RSI: ffffffff8c073960 RDI: ffff888028f42000 [ 1281.296337][ T2019] RBP: ffff88823be4a000 R08: ffffffff8ed019f3 R09: 1ffffffff1da033e [ 1281.304455][ T2019] R10: dffffc0000000000 R11: fffffbfff1da033f R12: ffff88804aa49650 [ 1281.312737][ T2019] R13: 0000000000000000 R14: ffff888028f42030 R15: ffff88804aa49000 [ 1281.321001][ T2019] FS: 0000000000000000(0000) GS:ffff8881257ed000(0000) knlGS:0000000000000000 [ 1281.330085][ T2019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1281.336959][ T2019] CR2: 000020000005f000 CR3: 0000000031830000 CR4: 00000000003526f0 [ 1281.345310][ T2019] Kernel panic - not syncing: Fatal exception [ 1281.352024][ T2019] Kernel Offset: disabled [ 1281.356442][ T2019] Rebooting in 86400 seconds..