last executing test programs: 11.920448381s ago: executing program 2 (id=3669): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xda01}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) pipe(0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000041}, 0x200088d0) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0x8b0, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x87c, 0x2, [@TCA_MATCHALL_ACT={0x878, 0x2, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0xffffffff, 0x10000, 0x81, 0x7f, 0xfffffffb, 0x4, 0x2, 0xffffffc0, 0x7, 0x2234, 0x7f, 0x81b, 0x800, 0x5, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x5, 0x58b, 0x85a, 0x1003ff, 0x9, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x5, 0xab2, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xfffffffb, 0x1, 0x5, 0x1, 0x5b1f, 0x7b0, 0x7, 0x103, 0x100006, 0xd, 0xff, 0x4, 0x10000, 0x6, 0x6b7, 0x1ff, 0x4, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0x100, 0x3, 0x3, 0x6, 0x7, 0x8, 0x100, 0xc0000000, 0x6, 0x4, 0x6, 0x12a, 0x80000001, 0x8, 0x1d24, 0x2, 0x5, 0x1, 0x7f, 0x7, 0x863d, 0xff, 0x24, 0x5, 0x7, 0x6, 0x7a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x2000000, 0x1, 0x0, 0x4, 0x9, 0x61, 0x200, 0x6, 0x2, 0x2, 0x6, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x7ffffffe, 0x9, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x86ae, 0x2, 0x3e, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0xfffffffb, 0x7, 0x8, 0x4, 0xffffffff, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0x0, 0xac, 0x9, 0x6, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x70, 0x2, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x9, 0x10001, 0x7, 0x7f, 0x5, 0x3, 0x200000a, 0x1, 0x0, 0x9, 0x300, 0x5, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x89d1, 0xfca, 0x399d, 0x9, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xb, 0x0, 0xef, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0xa, 0x400, 0x80001, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x2007, 0x1, 0x177, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7e, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0x4, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1080, 0x4, 0xec2, 0x1, 0x80000008, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0x3, 0x5, 0x37f, 0x30, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x4, 0x2004, 0x5, 0x7, 0x46, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x1, 0xa6, 0x3, 0x10000, 0x5, 0x4, 0x0, 0x3, 0x0, 0xd, 0x40006, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xfdc4, 0x94d, 0x9, 0x8, 0x6, 0x100, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb828, 0x0, 0x2, 0x325, 0x8, 0x8, 0x4000000f, 0x8, 0xfffffffe, 0xfffffff6, 0x93, 0x7ff, 0x1000092, 0x0, 0x7, 0x1, 0x7ff, 0x9, 0x2, 0x0, 0x2, 0x8, 0x4, 0x3, 0x9, 0xc, 0x0, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x200101, 0xadd9, 0x1, 0x4, 0x7, 0x7fffffff, 0x2, 0x4, 0x0, 0x9, 0x4, 0x3, 0x40008, 0x7, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x401, 0x1685, 0xa252, 0x8d7, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x101000, 0x7ff, 0x1, 0x1f6, 0x9, 0x7, 0x40000000, 0x5, 0xffffdbb7, 0x50, 0xf, 0xf, 0xe, 0x5, 0x0, 0x81, 0xfff80000, 0x7a7, 0x1, 0x6, 0x3, 0x5, 0x7, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x3, 0x8, 0x5, 0x5, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0xfff, 0x8, 0x7, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x8, 0x0, 0x1ff, 0x4000003, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xffffffec, 0x5, 0x0, 0xb9a6, 0x522, 0x101, 0x2, 0x900, 0x6, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0x7, 0x59, 0x9, 0x2, 0x101, 0x5f502dca, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0xffe, 0x1, 0x89d, 0x8, 0x3, 0x710, 0xe, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0x9, 0x2, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x1, 0x5, 0x1, 0xdbe8, {0x8, 0x1, 0x8001, 0x5, 0x7, 0x9}, {0x6, 0x2, 0xd, 0x5, 0x1, 0x5d17}, 0x8, 0xffffffff, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$SIOCAX25GETINFO(r8, 0x89ed, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000149c37e70f044cea00000000000500000a3c000000090a010400000000000000000a0000080900010073797a310000000008000540000000020900020075797a320000000008000a40fffffffc300000000c0a010100000000000000000a0000050900020073797a31000000000900010073797a310000000004000380140000001100010000000000000000000100000a"], 0x94}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r11 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r4, &(0x7f0000000b80)=[{{&(0x7f0000000440)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r12, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x1, 0x0) 11.55255828s ago: executing program 2 (id=3671): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={0x0, 0x140}, 0x1, 0x0, 0x0, 0x20044081}, 0x8000) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f00000000c0), 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10) unshare(0x62040200) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002021702500000000002020207b1af8ff00000000bfa10000951234d35864aa628023ce005f3d367c00000701fefff7ffffffb702000008000000b703003e6d000083850054308de8c7749781c53da224ccde11e158"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) syz_init_net_socket$llc(0x1a, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000061000000b70000004000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socket$l2tp6(0xa, 0x2, 0x73) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=0xf) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00'}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x2, @private1={0xfc, 0x1, '\x00', 0x2a}, 0x9}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000eb330969c3937265000000009ef3087b64ebec34bfa7b86b968d6be492e86dd4313b26aa10d0cfacb227ad58b5034d3ab438360a22473c953d3299aeab7c8e0fe892e154ca8c2b48e98de23e87859b"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000000c0)={0x0, 0xfffffffffffffd05, &(0x7f0000000080)={&(0x7f0000000200)={0xe4, 0x43, 0x107, 0xfffffffe, 0x25dfdbfc, {0x1, 0x7c}, [@nested={0x4, 0x145}, @nested={0xca, 0x1, 0x0, 0x1, [@typed={0x0, 0x5a, 0x0, 0x0, @str='%+\'\')\x00'}]}, @typed={0xfd73, 0x88, 0x0, 0x0, @pid}]}, 0xe4}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="140000001300015b993dde440113e90006"], 0x14}], 0x1}, 0x0) r8 = openat$cgroup_type(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r8, &(0x7f0000000280), 0x9) openat$cgroup_procs(r4, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="92", 0x1}], 0x1}, 0x3) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) connect$bt_sco(r0, &(0x7f0000000100)={0x1f, @none}, 0x8) 8.505051954s ago: executing program 1 (id=3690): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002000)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) unshare(0x20000400) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, 0x0, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r2 = socket$inet(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x0, 0x90, [0x4, 0x80, 0xffffffffffffffc0, 0xfff, 0xfffffffffffffff7, 0xd], 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x108) 8.497694744s ago: executing program 2 (id=3691): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001240)=ANY=[@ANYBLOB="12000000040000000800000001"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x15, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000020000001800000000000000000800000000000095"], &(0x7f0000000100)='GPL\x00', 0x8}, 0x94) 8.327587537s ago: executing program 2 (id=3692): socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'wg2\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=@bridge_newneigh={0x2c, 0x1c, 0x114236db3b607435, 0x70bd28, 0x25dfd3fe, {0x2, 0x0, 0x0, r2, 0x80, 0x80, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @remote}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x80c0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) unshare(0x62040200) socket$nl_route(0x10, 0x3, 0x0) setsockopt$MRT_TABLE(r3, 0x0, 0xcf, &(0x7f0000000040)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000050001000001000008000500", @ANYRES32=r6], 0x50}}, 0x2) 5.680237012s ago: executing program 1 (id=3700): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000140)='afs_make_fs_call\x00'}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) unshare(0x6a040000) mmap(&(0x7f00008e3000/0x1000)=nil, 0x1000, 0x2000000, 0x12, r0, 0xe5e8e000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\n\x00\x00\x00V\x00\x00\x00B\x00\x00\x00'], 0x50) r2 = socket$vsock_stream(0x28, 0x1, 0x0) writev(r2, &(0x7f00000002c0), 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x40048a4) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8855}, 0x2800) 5.400416585s ago: executing program 2 (id=3702): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[], 0x140}, 0x1, 0x0, 0x0, 0x20044081}, 0x8000) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f00000000c0), 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10) unshare(0x62040200) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002021702500000000002020207b1af8ff00000000bfa10000951234d35864aa628023ce005f3d367c00000701fefff7ffffffb702000008000000b703003e6d000083850054308de8c7749781c53da224ccde11e158"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) syz_init_net_socket$llc(0x1a, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000061000000b70000004000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socket$l2tp6(0xa, 0x2, 0x73) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=0xf) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00'}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x2, @private1={0xfc, 0x1, '\x00', 0x2a}, 0x9}], 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000eb330969c3937265000000009ef3087b64ebec34bfa7b86b968d6be492e86dd4313b26aa10d0cfacb227ad58b5034d3ab438360a22473c953d3299aeab7c8e0fe892e154ca8c2b48e98de23e87859b"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000000c0)={0x0, 0xfffffffffffffd05, &(0x7f0000000080)={&(0x7f0000000200)={0xe4, 0x43, 0x107, 0xfffffffe, 0x25dfdbfc, {0x1, 0x7c}, [@nested={0x4, 0x145}, @nested={0xca, 0x1, 0x0, 0x1, [@typed={0x0, 0x5a, 0x0, 0x0, @str='%+\'\')\x00'}]}, @typed={0xfd73, 0x88, 0x0, 0x0, @pid}]}, 0xe4}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="140000001300015b993dde440113e90006"], 0x14}], 0x1}, 0x0) r8 = openat$cgroup_type(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r8, &(0x7f0000000280), 0x9) openat$cgroup_procs(r4, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="92", 0x1}], 0x1}, 0x3) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) connect$bt_sco(r0, &(0x7f0000000100)={0x1f, @none}, 0x8) 4.939875817s ago: executing program 0 (id=3706): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x28, 0x2, 0xfd, 0x5ae9}, {0x20, 0x7f, 0x4, 0xfffff038}]}, 0x10) getsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f0000002280)=""/159, &(0x7f0000002340)=0x9f) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) getsockopt$inet6_tcp_int(r3, 0x6, 0x24, &(0x7f0000002380), &(0x7f00000023c0)=0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000500)=@ccm_128={{0x303}, '\x00', "9a3790020d4100", "00000001", "3b8eda4d6920ba22"}, 0x28) r5 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_ifreq(r5, 0x89fd, &(0x7f0000000100)={'veth1_to_bond\x00', @ifru_names='ipvlan0\x00'}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_LACP_ACTIVE={0x5}]}}}]}, 0x3c}}, 0x54) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) sendfile(r3, r6, 0x0, 0x20000000002) recvmmsg$unix(r6, &(0x7f0000002100)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000340)=""/201, 0xc9}], 0x1}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)=""/98, 0x62}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f0000000280)=""/73, 0x49}], 0x3, &(0x7f0000000440)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x98}}, {{&(0x7f0000000500)=@abs, 0x6e, &(0x7f0000001980)=[{&(0x7f0000000580)=""/55, 0x37}, {&(0x7f00000025c0)=""/257, 0x101}, {&(0x7f00000006c0)=""/70, 0x46}, {&(0x7f0000002540)=""/124, 0x7c}, {&(0x7f0000001840)=""/111, 0x6f}, {&(0x7f00000018c0)=""/170, 0xaa}], 0x6, &(0x7f0000000740)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001a00)=@abs, 0x6e, &(0x7f0000001bc0)=[{&(0x7f0000001a80)=""/25, 0x19}, {&(0x7f0000001ac0)=""/224, 0xe0}], 0x2, &(0x7f0000001c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x138}}, {{0x0, 0x0, &(0x7f0000001e00)=[{&(0x7f0000001d40)=""/77, 0x4d}, {&(0x7f0000001dc0)=""/28, 0x1c}], 0x2}}, {{&(0x7f0000001e40), 0x6e, &(0x7f0000002500)=[{&(0x7f0000001ec0)=""/216, 0xd8}, {&(0x7f0000002400)=""/28, 0x1c}, {&(0x7f0000002440)=""/181, 0xb5}], 0x3, &(0x7f0000002000)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xf0}}], 0x6, 0x40000020, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x60, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}]}, 0x90}}, 0x0) 4.722201657s ago: executing program 1 (id=3709): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) syz_emit_ethernet(0x2f0, &(0x7f0000000940)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x2ba, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x1, "000000050000000026000400"}, {}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "b8a3e100908f61640000000200000000000000000002000000008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r1, &(0x7f0000001740)=[{{0x0, 0x500, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1}}], 0x4000210, 0x2, 0x0) 4.008085743s ago: executing program 0 (id=3711): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r4, 0x400454cc, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000003c0)={0x1c, 0x2e, 0x1, 0xf0bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @u32=0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20004000) r7 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r7, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)={0x2004}) close(0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0xfc, 0x30, 0xffff, 0xfffffffe, 0x0, {}, [{0xe8, 0x1, [@m_gact={0xe4, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x75, 0x7}}]}, {0xa9, 0x6, "4e00e255eff0bdf33157840935de4a955bf6de970c67696a825ab8c9595a4b9d16cecdf0f6969657aae36eadbd08e7e83cae76d48b6aae691a27823ae62e7898c8d83bdb2c0d95739b7d5ab0440087e7e81a0523d42997039d74f272359f8bb74277450e25cdb4a70b1cf2844709561c75208a7284b7ef7ce39d059460e9f84c32629e154f45f349245bdb078a0e8a97b23b250db6906bd8720e1fdea6be633e83183421a1"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 3.924682848s ago: executing program 3 (id=3713): socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304efff00"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 3.750861576s ago: executing program 4 (id=3714): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="c185e871859750b7c4120a3466e7b5433a1e73acb079bc28cf0565686cd73b0b61706b13581a9758a680cdb661472b8a280932388639b253fd18125d3630d645b02190b8829ad8a409c62605d4183486544d6f6bcccdbc3856673bb5e27a7e2970de3079e5fdf5a06f045646d480af9f208697615f33c768f99e11a2ebb451a60aa8d285b893904b3e8cfeb211432e99656d8d11f5a8e05acf6b6abf061cf6f512f712f6ef", @ANYRES16=r3, @ANYBLOB="010000000000000000000100000014000180060001000200000008000300ac1414aa"], 0x28}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r5}, 0x10) r6 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000002300)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000a, 0x13, r6, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000002180)={r6}, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2800}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={0x50, r3, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x9}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xb}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x81) close(0x3) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x18) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x3, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x80000006}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r9, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) 3.607554936s ago: executing program 3 (id=3715): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r1, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001480)={0x9c, r2, 0xdaf8ab459986a1e9, 0x70bd28, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}]}, 0x9c}}, 0x4000) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@gcm_128={{0x303}, "54fcc1daadb00b00", "f4d095d17ba57f000000002c455700", '\x00', "eb034ea618e777ea"}, 0x28) sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x6e, 0x0, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xb, 0x10012, r3, 0xcac51000) sendto$inet6(r0, &(0x7f0000000240)="c6", 0x3fff, 0x8040, 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x15, 0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="1808000000400000d2e1687dfd479e2018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7060000000000008500000005000000bf0920000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000ae8900000000000007080000f8ffffffbf8420000000000007040000f0ffffffc70200000800000018260000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.54665089s ago: executing program 4 (id=3716): socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'wg2\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=@bridge_newneigh={0x2c, 0x1c, 0x114236db3b607435, 0x70bd28, 0x25dfd3fe, {0x2, 0x0, 0x0, r2, 0x80, 0x80, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @remote}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x80c0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) unshare(0x62040200) socket$nl_route(0x10, 0x3, 0x0) setsockopt$MRT_TABLE(r3, 0x0, 0xcf, &(0x7f0000000040)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a0000ef060001000001000008000500", @ANYRES32=r6], 0x50}}, 0x2) 3.490535252s ago: executing program 3 (id=3717): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0xf5ff}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x0) 3.231682163s ago: executing program 3 (id=3718): r0 = socket$kcm(0x10, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@cgroup, 0x5, 0x0, 0x1, &(0x7f00000000c0), 0x31, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000044000900000092000000000305000000080002"], 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x4000040) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffffffffda4, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 3.120414197s ago: executing program 3 (id=3719): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001240)=ANY=[@ANYBLOB="12000000040000000800000001"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x15, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000020000001800000000000000000e00000000000095"], &(0x7f0000000100)='GPL\x00', 0x8}, 0x94) 2.981319735s ago: executing program 3 (id=3720): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000140)='afs_make_fs_call\x00'}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) unshare(0x6a040000) mmap(&(0x7f00008e3000/0x1000)=nil, 0x1000, 0x2000000, 0x12, r0, 0xe5e8e000) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\n\x00\x00\x00V\x00\x00\x00B\x00\x00\x00'], 0x50) r2 = socket$vsock_stream(0x28, 0x1, 0x0) writev(r2, &(0x7f00000002c0), 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x40048a4) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8855}, 0x2800) 2.475276417s ago: executing program 1 (id=3721): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0a000000020000000200000004"], 0x2d) r1 = socket$nl_generic(0x10, 0x3, 0x10) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(twofish-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000880)="a95c5509000000000000585228a7a1033ad3484758ff33bb", 0x18) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x60, r3, 0x4, 0x70bd27, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private0}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008080}, 0x2400c001) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r4}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f0000000300)}, 0x20) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x84, &(0x7f0000000180)={r8, @in={{0x2, 0x4e20, @empty}}, 0x7, 0x4002}, 0x90) close(0x3) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb4b1}, [@printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5bb}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r10}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="0b00000008000000020000000900000001"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x19, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000a17000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r11}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x2, &(0x7f0000000380)=ANY=[@ANYBLOB="85000000ae00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) 2.352352466s ago: executing program 1 (id=3722): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x28, 0x2, 0xfd, 0x5ae9}, {0x6, 0x0, 0x7, 0x7}]}, 0x10) getsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f0000002280)=""/159, &(0x7f0000002340)=0x9f) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) getsockopt$inet6_tcp_int(r3, 0x6, 0x24, &(0x7f0000002380), &(0x7f00000023c0)=0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000500)=@ccm_128={{0x303}, '\x00', "9a3790020d4100", "00000001", "3b8eda4d6920ba22"}, 0x28) r5 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_ifreq(r5, 0x89fd, &(0x7f0000000100)={'veth1_to_bond\x00', @ifru_names='ipvlan0\x00'}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_LACP_ACTIVE={0x5}]}}}]}, 0x3c}}, 0x54) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) sendfile(r3, r6, 0x0, 0x20000000002) recvmmsg$unix(r6, &(0x7f0000002100)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000340)=""/201, 0xc9}], 0x1}}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)=""/98, 0x62}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f0000000280)=""/73, 0x49}], 0x3, &(0x7f0000000440)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x98}}, {{&(0x7f0000000500)=@abs, 0x6e, &(0x7f0000001980)=[{&(0x7f0000000580)=""/55, 0x37}, {&(0x7f00000025c0)=""/257, 0x101}, {&(0x7f00000006c0)=""/70, 0x46}, {&(0x7f0000002540)=""/124, 0x7c}, {&(0x7f0000001840)=""/111, 0x6f}, {&(0x7f00000018c0)=""/170, 0xaa}], 0x6, &(0x7f0000000740)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001a00)=@abs, 0x6e, &(0x7f0000001bc0)=[{&(0x7f0000001a80)=""/25, 0x19}, {&(0x7f0000001ac0)=""/224, 0xe0}], 0x2, &(0x7f0000001c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x138}}, {{0x0, 0x0, &(0x7f0000001e00)=[{&(0x7f0000001d40)=""/77, 0x4d}, {&(0x7f0000001dc0)=""/28, 0x1c}], 0x2}}, {{&(0x7f0000001e40), 0x6e, &(0x7f0000002500)=[{&(0x7f0000001ec0)=""/216, 0xd8}, {&(0x7f0000002400)=""/28, 0x1c}, {&(0x7f0000002440)=""/181, 0xb5}], 0x3, &(0x7f0000002000)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xf0}}], 0x6, 0x40000020, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x60, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}]}, 0x90}}, 0x0) 1.353523466s ago: executing program 1 (id=3723): r0 = socket$inet(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r1, 0x0, 0x0) connect$netlink(r1, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) write(r1, &(0x7f0000000000)='\"', 0x1) recvmmsg(r1, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) write$bt_hci(r1, &(0x7f0000000000)={0x1, @le_set_ext_adv_params={{0x2036, 0x19}, {0x1, 0x1, "528035", "b5ea47", 0x1, 0xd, 0x6, @any, 0x0, 0xff, 0x0, 0xf5, 0x8, 0xf9, 0x3}}}, 0x1d) sendmsg$NL80211_CMD_LEAVE_MESH(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc", 0xae}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0", 0x89}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) bind$unix(r2, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e21}, 0x6e) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="06000020040000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000008000000000000000000000095"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00', r5}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000012c0)=ANY=[@ANYBLOB="bc1000002b000b000000000000000000070000000800030004000100a01001"], 0x10bc}}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d1501000000000095000000000000006916b0ff00000000bf67000000000000350607000fff07206706000003000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d826f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) socket$inet_icmp(0x2, 0x2, 0x1) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6131, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) 1.232372212s ago: executing program 0 (id=3724): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v\x00\x00\x00B\x00\x00\x00>'], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x1005, &(0x7f00000014c0)=""/4101, 0x41000, 0xc}, 0x94) 1.112454575s ago: executing program 0 (id=3725): socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3d, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda98800fe0f002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 972.007406ms ago: executing program 4 (id=3726): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="c185e871859750b7c4120a3466e7b5433a1e73acb079bc28cf0565686cd73b0b61706b13581a9758a680cdb661472b8a280932388639b253fd18125d3630d645b02190b8829ad8a409c62605d4183486544d6f6bcccdbc3856673bb5e27a7e2970de3079e5fdf5a06f045646d480af9f208697615f33c768f99e11a2ebb451a60aa8d285b893904b3e8cfeb211432e99656d8d11f5a8e05acf6b6abf061cf6f512f712f6ef", @ANYRES16=r3, @ANYBLOB="010000000000000000000100000014000180060001000200000008000300ac1414aa"], 0x28}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r5}, 0x10) r6 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000002300)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000a, 0x13, r6, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000002180)={r6}, 0x4) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2800}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={0x50, r3, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x9}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xb}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x81) close(0x3) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x18) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x3, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x80000006}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r9, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) 680.922082ms ago: executing program 4 (id=3727): r0 = socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e00000007000000080000000100040003000000", @ANYRES32=0x1, @ANYBLOB="020000fdff000000000000000000040000000000", @ANYRES32=r0, @ANYRES32, @ANYBLOB="0300000001000000050000000d000000000000000000000000000000197d1fbacfcd20fbbfce74c2bde3bac5499dfdb70ef780c217faafe00eb3a8958ad057725e6705d8d210d3aeac9dccb0dc3fa55fcc0bf5406c18e4ed75f52a7dd99d2f801c36607e18b6ebcc67339bfba564b351f46dc0fcd7bb02b0db55e09a5ccfd999b70261e78ff3d05df947cd1b18a7a97836c42042d540e804a19b47cfb677601682877ee9c63e827c7d14c08a28d650ca71caa52d6f3e0288e78e3a4379c6aa6bc421a31b2596a86913de461f2f8d9cc5d600d5c8617eae549fcd64caa3137345c3bacf0c6a71bd3cd2677a0db10538930a2f"], 0x50) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000027c00000400c2800c00018006000600894f"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) setsockopt$sock_timeval(r1, 0x1, 0x15, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) connect$unix(r4, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) socket$netlink(0x10, 0x3, 0x4) socket$igmp(0x2, 0x3, 0x2) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00'}) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000006c0)='kfree\x00', r6}, 0x18) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x14, r8, 0x301, 0x70bd29, 0x25dfdbfc, {0x24}}, 0x14}}, 0x0) 508.171655ms ago: executing program 0 (id=3728): writev(0xffffffffffffffff, &(0x7f0000000180)=[{0x0}], 0x1) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (rerun: 32) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async, rerun: 32) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000003f80)=ANY=[@ANYBLOB="18020000feffffff00000000000000008500000041000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000010400000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) (async) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000000414010028bd7000fedbdf2508000100020000004d0001000000000108000100000000b914534e88000800010000001b0000000fff0100000008"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c014) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 32) sendto$inet(r2, &(0x7f0000000340)='I', 0x1, 0x4c001, 0x0, 0x0) (rerun: 32) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0x8, 0x1161, 0x0, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) r4 = openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="2b546964b2e0"], 0x6) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r5) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) (async) ioctl$SIOCSIFHWADDR(r5, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r7 = openat$cgroup_type(r6, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r7, &(0x7f0000000280), 0x9) (async, rerun: 32) r8 = openat$cgroup_procs(r6, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) (rerun: 32) write$cgroup_pid(r8, &(0x7f0000000c40), 0x12) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$nl_route(0x10, 0x3, 0x0) 230.053856ms ago: executing program 0 (id=3729): socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1, 0x4, 0x7fe2, 0x1}, 0x48) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304000004000000000000000000", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 194.268565ms ago: executing program 4 (id=3730): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0xfff5}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x0) 180.597126ms ago: executing program 2 (id=3731): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) syz_emit_ethernet(0x352, &(0x7f0000000940)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x31c, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x1, "000000050000000026000400"}, {0x0, 0xc, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "b8a3e100908f61640000000200000000000000000002000000008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r1, &(0x7f0000001740)=[{{0x0, 0x500, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1}}], 0x4000210, 0x2, 0x0) 0s ago: executing program 4 (id=3732): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0a000000020000000200000004"], 0x2d) r1 = socket$nl_generic(0x10, 0x3, 0x10) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(twofish-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000880)="a95c5509000000000000585228a7a1033ad3484758ff33bb", 0x18) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x60, r3, 0x4, 0x70bd27, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @private0}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0xff}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008080}, 0x2400c001) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r4}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f0000000300)}, 0x20) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x84, &(0x7f0000000180)={r8, @in={{0x2, 0x4e20, @empty}}, 0x7, 0x4002}, 0x90) close(0x3) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb4b1}, [@printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5bb}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r10}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="0b00000008000000020000000900000001"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x19, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000a17000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r11}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x2, &(0x7f0000000380)=ANY=[@ANYBLOB="85000000ae00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) kernel console output (not intermixed with test programs): pe 1 family 0 port 8472 - 0 [ 519.368482][ T752] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 519.416630][ T752] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 519.442910][ T752] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 519.481834][T16604] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3005'. [ 519.496252][T16604] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 519.514341][T16602] tipc: Started in network mode [ 519.521552][T16602] tipc: Node identity 1ae657ac283c, cluster identity 4711 [ 519.529200][T16602] tipc: Enabled bearer , priority 0 [ 519.549135][T16476] 8021q: adding VLAN 0 to HW filter on device bond0 [ 519.580913][T16602] tipc: Resetting bearer [ 519.596149][T16601] tipc: Disabling bearer [ 519.759955][T16476] 8021q: adding VLAN 0 to HW filter on device team0 [ 519.791910][ T5982] bridge0: port 1(bridge_slave_0) entered blocking state [ 519.799178][ T5982] bridge0: port 1(bridge_slave_0) entered forwarding state [ 519.845606][ T1094] bridge0: port 2(bridge_slave_1) entered blocking state [ 519.852870][ T1094] bridge0: port 2(bridge_slave_1) entered forwarding state [ 519.977049][ T5842] Bluetooth: hci1: command 0x040f tx timeout [ 520.035349][T16614] netlink: 212356 bytes leftover after parsing attributes in process `syz.2.3010'. [ 520.483366][T16476] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 520.629144][T16476] veth0_vlan: entered promiscuous mode [ 520.634891][T16641] netlink: 'syz.3.3017': attribute type 1 has an invalid length. [ 520.644033][T16476] veth1_vlan: entered promiscuous mode [ 520.742510][T16641] 8021q: adding VLAN 0 to HW filter on device bond10 [ 520.769377][T16641] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3017'. [ 520.814235][T16644] 8021q: adding VLAN 0 to HW filter on device bond10 [ 520.822132][T16644] bond10: (slave vxcan3): The slave device specified does not support setting the MAC address [ 520.834522][T16644] bond10: (slave vxcan3): Error -95 calling set_mac_address [ 520.839428][T16652] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3018'. [ 520.899777][T16476] veth0_macvtap: entered promiscuous mode [ 520.942000][T11062] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 520.963521][T11062] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 520.966118][T16476] veth1_macvtap: entered promiscuous mode [ 521.011525][T16476] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 521.065404][T16476] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 521.099305][T11062] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.129400][T11062] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.153024][T11062] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.174145][T11062] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.351678][T16664] ip6_vti0 speed is unknown, defaulting to 1000 [ 521.376308][ T1114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.392591][ T1114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.492709][ T5982] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.533664][ T5982] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.637718][T16446] syzkaller1: tun_net_xmit 76 [ 521.801049][T16682] syzkaller0: entered promiscuous mode [ 521.817902][T16682] syzkaller0: entered allmulticast mode [ 521.938805][T16685] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3028'. [ 521.948156][T16685] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 521.969724][T16685] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3028'. [ 521.992066][T16669] ip6_vti0 speed is unknown, defaulting to 1000 [ 522.057184][ T5150] Bluetooth: hci1: command 0x040f tx timeout [ 522.277967][ T5842] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 522.288430][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 522.296325][ T5842] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 522.309906][ T5842] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 522.317883][ T5842] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 522.494840][T16694] netlink: zone id is out of range [ 522.500408][T16694] netlink: zone id is out of range [ 522.505749][T16694] netlink: zone id is out of range [ 522.511548][T16694] netlink: set zone limit has 8 unknown bytes [ 522.805463][T16697] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3030'. [ 522.858367][T16696] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3030'. [ 522.869212][T16689] ip6_vti0 speed is unknown, defaulting to 1000 [ 523.034886][T16699] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3031'. [ 523.132581][T16699] vlan2: entered promiscuous mode [ 523.142317][T16699] syz_tun: entered promiscuous mode [ 523.455439][T16692] ip6_vti0 speed is unknown, defaulting to 1000 [ 524.136842][ T5842] Bluetooth: hci1: command 0x040f tx timeout [ 524.377424][ T5842] Bluetooth: hci0: command 0x0409 tx timeout [ 524.802017][T16689] chnl_net:caif_netlink_parms(): no params data found [ 525.074744][T16689] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.082880][T16689] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.090704][T16689] bridge_slave_0: entered allmulticast mode [ 525.098829][T16689] bridge_slave_0: entered promiscuous mode [ 525.109554][T16689] bridge0: port 2(bridge_slave_1) entered blocking state [ 525.117022][T16689] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.124263][T16689] bridge_slave_1: entered allmulticast mode [ 525.140769][T16689] bridge_slave_1: entered promiscuous mode [ 525.166221][T16752] xt_hashlimit: max too large, truncated to 1048576 [ 525.205506][T16752] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 525.284120][T16751] netlink: zone id is out of range [ 525.298949][T16751] netlink: zone id is out of range [ 525.374660][T16751] netlink: zone id is out of range [ 525.392753][T16751] netlink: set zone limit has 8 unknown bytes [ 525.420276][T16743] ip6_vti0 speed is unknown, defaulting to 1000 [ 525.439350][T16689] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 525.454383][T16689] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 525.555499][T16689] team0: Port device team_slave_0 added [ 525.568958][T16689] team0: Port device team_slave_1 added [ 525.646237][T16689] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 525.654336][T16689] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 525.686103][T16689] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 525.718654][T16689] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 525.729531][T16689] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 525.796068][T16689] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 525.986712][T16763] sctp: [Deprecated]: syz.2.3045 (pid 16763) Use of int in maxseg socket option. [ 525.986712][T16763] Use struct sctp_assoc_value instead [ 526.063967][T16689] hsr_slave_0: entered promiscuous mode [ 526.089928][T16689] hsr_slave_1: entered promiscuous mode [ 526.108130][T16689] debugfs: 'hsr0' already exists in 'hsr' [ 526.113925][T16689] Cannot create hsr debugfs directory [ 526.190038][T16766] openvswitch: netlink: Key type 30 is not supported [ 526.202699][T16766] Bluetooth: MGMT ver 1.23 [ 526.308938][T16756] ip6_vti0 speed is unknown, defaulting to 1000 [ 526.348889][T16768] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3047'. [ 526.457901][ T5842] Bluetooth: hci0: command 0x0409 tx timeout [ 526.816695][T16775] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3050'. [ 526.826117][T16775] netlink: 35 bytes leftover after parsing attributes in process `syz.2.3050'. [ 526.836646][T16775] netlink: 'syz.2.3050': attribute type 6 has an invalid length. [ 526.846410][T16775] netlink: 'syz.2.3050': attribute type 5 has an invalid length. [ 526.856197][T16775] netlink: 35 bytes leftover after parsing attributes in process `syz.2.3050'. [ 526.921232][T16778] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3049'. [ 526.936594][T16779] netlink: 'syz.2.3050': attribute type 4 has an invalid length. [ 526.953481][T16776] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 526.972905][T16778] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3049'. [ 527.009696][T16781] netlink: 'syz.2.3050': attribute type 4 has an invalid length. [ 527.022618][T16776] bond1 (unregistering): Released all slaves [ 527.836566][T16798] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3055'. [ 527.838569][T16799] netlink: zone id is out of range [ 527.861840][T16689] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 527.890175][T16799] netlink: zone id is out of range [ 527.910452][T16798] vlan2: entered promiscuous mode [ 527.938431][T16799] netlink: zone id is out of range [ 527.946443][T16689] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 527.958693][T16799] netlink: set zone limit has 8 unknown bytes [ 527.974927][T16689] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 528.008031][T16689] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 528.166011][T16689] 8021q: adding VLAN 0 to HW filter on device bond0 [ 528.216273][T16689] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.353617][T16803] ip6_vti0 speed is unknown, defaulting to 1000 [ 528.412776][T11059] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.420109][T11059] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.469296][T11059] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.476552][T11059] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.538524][ T5842] Bluetooth: hci0: command 0x0409 tx timeout [ 528.790129][T16820] netlink: 'syz.4.3060': attribute type 33 has an invalid length. [ 528.799342][T16820] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3060'. [ 529.360711][T16689] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 529.524635][T16689] veth0_vlan: entered promiscuous mode [ 529.550273][T16820] ip6_vti0 speed is unknown, defaulting to 1000 [ 529.717990][T16689] veth1_vlan: entered promiscuous mode [ 529.880766][T16689] veth0_macvtap: entered promiscuous mode [ 529.901534][T16689] veth1_macvtap: entered promiscuous mode [ 529.940954][T16689] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 529.981012][T16689] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 530.014928][ T1094] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.041709][ T1094] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.072084][ T1094] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.088779][ T1094] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.433454][ T5982] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.442229][ T5982] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.617696][ T5150] Bluetooth: hci0: command 0x0409 tx timeout [ 530.710645][T16837] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 530.770388][ T3799] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.815172][ T3799] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.969044][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.012017][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.060791][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.080656][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.094550][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.147443][T16845] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3066'. [ 531.151227][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.242824][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.273298][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.352987][T16840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.384479][T16851] ip6_vti0 speed is unknown, defaulting to 1000 [ 531.386413][T16841] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 531.416569][T16849] netlink: 'syz.1.3027': attribute type 7 has an invalid length. [ 531.535939][T16849] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.543819][T16849] bridge0: port 1(bridge_slave_0) entered disabled state [ 531.690758][T16849] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 531.707964][T16849] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 531.861011][ T1114] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.895274][ T1114] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.949108][ T1114] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.975927][ T1114] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.159069][T16871] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3071'. [ 532.341822][T16877] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3073'. [ 532.369714][T16877] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 532.594696][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 532.635166][ T5842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 532.648540][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 532.648836][T16871] ip6_vti0 speed is unknown, defaulting to 1000 [ 532.697930][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 532.705064][ T5842] Bluetooth: hci0: command 0x0409 tx timeout [ 532.713651][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 533.187311][T16890] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3077'. [ 533.205508][T16890] vlan2: entered promiscuous mode [ 533.222217][T16890] syz_tun: entered promiscuous mode [ 533.295370][T16883] ip6_vti0 speed is unknown, defaulting to 1000 [ 533.407606][T16894] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3079'. [ 533.764763][T16905] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3081'. [ 533.849615][T16903] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 533.890266][T16905] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3081'. [ 533.926088][T16903] bond1 (unregistering): Released all slaves [ 534.427553][T16917] ip6_vti0 speed is unknown, defaulting to 1000 [ 534.781396][ T5842] Bluetooth: hci3: command tx timeout [ 534.781429][T16576] Bluetooth: hci0: command 0x0409 tx timeout [ 534.873676][T16883] chnl_net:caif_netlink_parms(): no params data found [ 534.914305][T16927] netlink: zone id is out of range [ 534.920266][T16927] netlink: zone id is out of range [ 534.928379][T16927] netlink: zone id is out of range [ 534.933839][T16927] netlink: set zone limit has 8 unknown bytes [ 534.988790][T16921] ip6_vti0 speed is unknown, defaulting to 1000 [ 535.287932][T16934] netlink: zone id is out of range [ 535.293117][T16934] netlink: zone id is out of range [ 535.366427][T16934] netlink: zone id is out of range [ 535.372356][T16934] netlink: set zone limit has 8 unknown bytes [ 535.658562][T16883] bridge0: port 1(bridge_slave_0) entered blocking state [ 535.677466][T16883] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.695219][T16883] bridge_slave_0: entered allmulticast mode [ 535.709309][T16883] bridge_slave_0: entered promiscuous mode [ 535.805786][T16883] bridge0: port 2(bridge_slave_1) entered blocking state [ 535.836082][T16883] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.855917][T16883] bridge_slave_1: entered allmulticast mode [ 535.870494][T16883] bridge_slave_1: entered promiscuous mode [ 536.072420][T16883] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 536.132550][T16883] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 536.273009][T16945] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3091'. [ 536.275734][T16883] team0: Port device team_slave_0 added [ 536.305752][T16948] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3092'. [ 536.340364][T16883] team0: Port device team_slave_1 added [ 536.529605][T16953] netlink: 'syz.4.3093': attribute type 33 has an invalid length. [ 536.538811][T16953] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3093'. [ 536.539971][T16883] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 536.559656][T16883] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 536.587314][T16883] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 536.601511][T16955] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3093'. [ 536.612963][T16883] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 536.622041][T16883] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 536.648582][T16883] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 536.824047][T16883] hsr_slave_0: entered promiscuous mode [ 536.848097][T16883] hsr_slave_1: entered promiscuous mode [ 536.866867][T16576] Bluetooth: hci0: command 0x0409 tx timeout [ 536.866907][ T5842] Bluetooth: hci3: command 0x041b tx timeout [ 536.883398][T16883] debugfs: 'hsr0' already exists in 'hsr' [ 536.892929][T16883] Cannot create hsr debugfs directory [ 537.053770][T16972] can: request_module (can-proto-0) failed. [ 537.106189][T16975] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 537.115312][T16975] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 537.313405][T16883] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.394393][T16883] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.479493][T16883] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.564452][T16883] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 537.734431][T16883] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 537.749348][T16883] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 537.763689][T16883] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 537.777018][T16883] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 537.983562][T16883] 8021q: adding VLAN 0 to HW filter on device bond0 [ 538.054810][T17001] ip6_vti0 speed is unknown, defaulting to 1000 [ 538.071633][T16883] 8021q: adding VLAN 0 to HW filter on device team0 [ 538.111892][ T5982] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.119121][ T5982] bridge0: port 1(bridge_slave_0) entered forwarding state [ 538.169055][ T5982] bridge0: port 2(bridge_slave_1) entered blocking state [ 538.176255][ T5982] bridge0: port 2(bridge_slave_1) entered forwarding state [ 538.184884][T17007] __nla_validate_parse: 1 callbacks suppressed [ 538.184902][T17007] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3108'. [ 538.433258][T17014] netlink: zone id is out of range [ 538.466945][T17014] netlink: zone id is out of range [ 538.513891][T17014] netlink: zone id is out of range [ 538.567497][T17014] netlink: set zone limit has 8 unknown bytes [ 538.727468][T17024] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3111'. [ 538.736574][T17024] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3111'. [ 538.786238][T17022] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 538.844893][T17022] bond1 (unregistering): Released all slaves [ 538.937018][ T5842] Bluetooth: hci3: command 0x041b tx timeout [ 538.958602][T17009] ip6_vti0 speed is unknown, defaulting to 1000 [ 539.163301][T16883] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 539.263051][T16883] veth0_vlan: entered promiscuous mode [ 539.282379][T16883] veth1_vlan: entered promiscuous mode [ 539.349575][T16883] veth0_macvtap: entered promiscuous mode [ 539.395842][T16883] veth1_macvtap: entered promiscuous mode [ 539.436194][T16883] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 539.454939][T16883] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 539.474567][ T3799] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.494063][ T3799] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.541078][ T3799] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.571261][ T3799] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.643154][ T3799] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.651858][ T3799] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.711767][T11062] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.750487][T11062] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.018071][ T5842] Bluetooth: hci3: command 0x041b tx timeout [ 541.203205][ T5150] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 541.213538][ T5150] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 541.222713][ T5150] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 541.232217][ T5150] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 541.240211][ T5150] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 541.319495][T17053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3119'. [ 541.361490][T17047] ip6_vti0 speed is unknown, defaulting to 1000 [ 541.368807][T17053] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3119'. [ 541.381070][T17053] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3119'. [ 541.397758][T17053] netlink: 540 bytes leftover after parsing attributes in process `syz.4.3119'. [ 541.520396][T17058] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3120'. [ 541.599594][T17056] bridge0: port 2(bridge_slave_1) entered disabled state [ 541.607433][T17056] bridge0: port 1(bridge_slave_0) entered disabled state [ 541.825917][T17056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 541.856487][T17065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3122'. [ 541.864768][T17056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 541.875715][T17065] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3122'. [ 542.205221][T17064] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 542.261784][T17064] bond1 (unregistering): Released all slaves [ 542.326496][ T3799] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 542.342763][ T3799] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 542.362894][ T3799] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 542.418059][ T3799] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 542.643671][T17078] ip6_vti0 speed is unknown, defaulting to 1000 [ 543.014180][T17047] chnl_net:caif_netlink_parms(): no params data found [ 543.102930][ T5842] Bluetooth: hci3: command 0x041b tx timeout [ 543.204466][T17088] __nla_validate_parse: 3 callbacks suppressed [ 543.204486][T17088] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3128'. [ 543.257470][ T5842] Bluetooth: hci2: command tx timeout [ 543.642786][T17101] netlink: zone id is out of range [ 543.658988][T17101] netlink: zone id is out of range [ 543.666663][T17101] netlink: zone id is out of range [ 543.679492][T17101] netlink: set zone limit has 8 unknown bytes [ 544.079858][T17047] bridge0: port 1(bridge_slave_0) entered blocking state [ 544.097073][T17047] bridge0: port 1(bridge_slave_0) entered disabled state [ 544.117153][T17047] bridge_slave_0: entered allmulticast mode [ 544.125234][T17047] bridge_slave_0: entered promiscuous mode [ 544.151123][T17047] bridge0: port 2(bridge_slave_1) entered blocking state [ 544.266968][T17047] bridge0: port 2(bridge_slave_1) entered disabled state [ 544.274312][T17047] bridge_slave_1: entered allmulticast mode [ 544.290923][T17047] bridge_slave_1: entered promiscuous mode [ 544.324875][T17097] ip6_vti0 speed is unknown, defaulting to 1000 [ 544.411918][T17047] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 544.444849][T17047] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 544.627753][T17047] team0: Port device team_slave_0 added [ 544.651267][T17047] team0: Port device team_slave_1 added [ 544.710050][T17108] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3133'. [ 544.756216][T17047] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 544.774707][T17047] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 544.814503][T17047] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 544.836409][T17047] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 544.844712][T17047] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 544.873292][T17047] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 545.069378][T17047] hsr_slave_0: entered promiscuous mode [ 545.079303][T17047] hsr_slave_1: entered promiscuous mode [ 545.086695][T17047] debugfs: 'hsr0' already exists in 'hsr' [ 545.092749][T17047] Cannot create hsr debugfs directory [ 545.178688][ T5842] Bluetooth: hci3: command 0x041b tx timeout [ 545.260280][T17120] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 545.270957][T17125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3136'. [ 545.280019][T17125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3136'. [ 545.299245][T17120] bond1 (unregistering): Released all slaves [ 545.337115][ T5842] Bluetooth: hci2: command tx timeout [ 545.512612][T17126] ip6_vti0 speed is unknown, defaulting to 1000 [ 545.894523][T17047] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 545.923385][T17047] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.961909][T17134] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3140'. [ 546.019437][T17134] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3140'. [ 546.239667][T17047] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.273042][T17047] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.308885][T17148] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3142'. [ 546.393795][T17136] ip6_vti0 speed is unknown, defaulting to 1000 [ 546.425153][T17047] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.450006][T17047] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.459862][T17153] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3144'. [ 546.569275][T17047] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.588567][T17047] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.603455][T17155] FAULT_INJECTION: forcing a failure. [ 546.603455][T17155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 546.621038][T17155] CPU: 1 UID: 0 PID: 17155 Comm: syz.0.3145 Not tainted syzkaller #0 PREEMPT(full) [ 546.621071][T17155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 546.621085][T17155] Call Trace: [ 546.621093][T17155] [ 546.621103][T17155] dump_stack_lvl+0x189/0x250 [ 546.621134][T17155] ? __pfx____ratelimit+0x10/0x10 [ 546.621155][T17155] ? __pfx_dump_stack_lvl+0x10/0x10 [ 546.621180][T17155] ? __pfx__printk+0x10/0x10 [ 546.621211][T17155] ? __might_fault+0xb0/0x130 [ 546.621255][T17155] should_fail_ex+0x414/0x560 [ 546.621292][T17155] _copy_from_user+0x2d/0xb0 [ 546.621319][T17155] ___sys_sendmsg+0x158/0x2a0 [ 546.621349][T17155] ? __pfx____sys_sendmsg+0x10/0x10 [ 546.621383][T17155] ? rcu_read_lock_any_held+0xb3/0x120 [ 546.621440][T17155] ? __fget_files+0x2a/0x420 [ 546.621465][T17155] ? __fget_files+0x3a0/0x420 [ 546.621503][T17155] __x64_sys_sendmsg+0x19b/0x260 [ 546.621532][T17155] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 546.621569][T17155] ? __pfx_ksys_write+0x10/0x10 [ 546.621595][T17155] ? do_syscall_64+0xbe/0xf80 [ 546.621621][T17155] do_syscall_64+0xfa/0xf80 [ 546.621644][T17155] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.621665][T17155] ? clear_bhb_loop+0x60/0xb0 [ 546.621691][T17155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.621717][T17155] RIP: 0033:0x7fad4af8f749 [ 546.621737][T17155] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 546.621755][T17155] RSP: 002b:00007fad491f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 546.621778][T17155] RAX: ffffffffffffffda RBX: 00007fad4b1e5fa0 RCX: 00007fad4af8f749 [ 546.621794][T17155] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 546.621806][T17155] RBP: 00007fad491f6090 R08: 0000000000000000 R09: 0000000000000000 [ 546.621819][T17155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.621831][T17155] R13: 00007fad4b1e6038 R14: 00007fad4b1e5fa0 R15: 00007fff898fab68 [ 546.621867][T17155] [ 547.233052][T17047] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 547.291745][T17047] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 547.341081][T17047] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 547.393039][T17047] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 547.430280][ T5842] Bluetooth: hci2: command 0x040f tx timeout [ 547.520534][T17178] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3150'. [ 547.578197][T17178] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3150'. [ 547.663363][T17181] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 547.928788][T17177] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 548.190317][T17177] bond1 (unregistering): Released all slaves [ 548.452734][T17047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 548.521845][T17047] 8021q: adding VLAN 0 to HW filter on device team0 [ 548.556272][ T752] bridge0: port 1(bridge_slave_0) entered blocking state [ 548.563510][ T752] bridge0: port 1(bridge_slave_0) entered forwarding state [ 548.572328][T17200] FAULT_INJECTION: forcing a failure. [ 548.572328][T17200] name failslab, interval 1, probability 0, space 0, times 0 [ 548.606936][T17200] CPU: 0 UID: 0 PID: 17200 Comm: syz.0.3157 Not tainted syzkaller #0 PREEMPT(full) [ 548.606967][T17200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 548.606980][T17200] Call Trace: [ 548.606989][T17200] [ 548.606999][T17200] dump_stack_lvl+0x189/0x250 [ 548.607030][T17200] ? __pfx____ratelimit+0x10/0x10 [ 548.607051][T17200] ? __pfx_dump_stack_lvl+0x10/0x10 [ 548.607076][T17200] ? __pfx__printk+0x10/0x10 [ 548.607109][T17200] ? __pfx___might_resched+0x10/0x10 [ 548.607132][T17200] ? fs_reclaim_acquire+0x7d/0x100 [ 548.607161][T17200] should_fail_ex+0x414/0x560 [ 548.607199][T17200] should_failslab+0xa8/0x100 [ 548.607226][T17200] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 548.607260][T17200] ? __alloc_skb+0x255/0x430 [ 548.607280][T17200] ? napi_skb_cache_get+0x4a5/0x780 [ 548.607300][T17200] ? napi_skb_cache_get+0x151/0x780 [ 548.607327][T17200] __alloc_skb+0x255/0x430 [ 548.607352][T17200] ? __pfx___alloc_skb+0x10/0x10 [ 548.607377][T17200] ? netlink_autobind+0xdb/0x300 [ 548.607403][T17200] ? netlink_autobind+0x2c2/0x300 [ 548.607436][T17200] netlink_sendmsg+0x5c6/0xb30 [ 548.607474][T17200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.607506][T17200] ? aa_sock_msg_perm+0xf1/0x1b0 [ 548.607535][T17200] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 548.607563][T17200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 548.607591][T17200] __sock_sendmsg+0x21c/0x270 [ 548.607626][T17200] ____sys_sendmsg+0x505/0x820 [ 548.607658][T17200] ? __pfx_____sys_sendmsg+0x10/0x10 [ 548.607694][T17200] ? import_iovec+0x74/0xa0 [ 548.607723][T17200] ___sys_sendmsg+0x21f/0x2a0 [ 548.607751][T17200] ? __pfx____sys_sendmsg+0x10/0x10 [ 548.607784][T17200] ? rcu_read_lock_any_held+0xb3/0x120 [ 548.607842][T17200] ? __fget_files+0x2a/0x420 [ 548.607868][T17200] ? __fget_files+0x3a0/0x420 [ 548.607906][T17200] __x64_sys_sendmsg+0x19b/0x260 [ 548.607936][T17200] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 548.607972][T17200] ? __pfx_ksys_write+0x10/0x10 [ 548.607997][T17200] ? do_syscall_64+0xbe/0xf80 [ 548.608024][T17200] do_syscall_64+0xfa/0xf80 [ 548.608047][T17200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.608067][T17200] ? clear_bhb_loop+0x60/0xb0 [ 548.608093][T17200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.608113][T17200] RIP: 0033:0x7fad4af8f749 [ 548.608132][T17200] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 548.608150][T17200] RSP: 002b:00007fad491f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 548.608173][T17200] RAX: ffffffffffffffda RBX: 00007fad4b1e5fa0 RCX: 00007fad4af8f749 [ 548.608187][T17200] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 548.608201][T17200] RBP: 00007fad491f6090 R08: 0000000000000000 R09: 0000000000000000 [ 548.608213][T17200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.608226][T17200] R13: 00007fad4b1e6038 R14: 00007fad4b1e5fa0 R15: 00007fff898fab68 [ 548.608261][T17200] [ 548.969672][T17202] ip6_vti0 speed is unknown, defaulting to 1000 [ 549.032866][T11062] bridge0: port 2(bridge_slave_1) entered blocking state [ 549.040125][T11062] bridge0: port 2(bridge_slave_1) entered forwarding state [ 549.192235][T17204] netlink: zone id is out of range [ 549.322396][T17204] netlink: zone id is out of range [ 549.386925][T17204] netlink: zone id is out of range [ 549.429706][T17204] netlink: set zone limit has 8 unknown bytes [ 549.499294][ T5842] Bluetooth: hci2: command 0x040f tx timeout [ 549.564291][T17213] netlink: 'syz.0.3158': attribute type 1 has an invalid length. [ 549.680243][T17213] netlink: 'syz.0.3158': attribute type 2 has an invalid length. [ 549.695270][T17214] netlink: 'syz.0.3158': attribute type 5 has an invalid length. [ 549.979898][T17047] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 550.355747][T17047] veth0_vlan: entered promiscuous mode [ 550.430463][T17047] veth1_vlan: entered promiscuous mode [ 550.534189][T17047] veth0_macvtap: entered promiscuous mode [ 550.580216][T17220] __nla_validate_parse: 1 callbacks suppressed [ 550.580237][T17220] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3160'. [ 550.580333][T17047] veth1_macvtap: entered promiscuous mode [ 550.681226][T17223] netlink: 'syz.0.3161': attribute type 1 has an invalid length. [ 550.685301][T17047] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 550.691217][T17222] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3161'. [ 550.707029][T17222] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3161'. [ 550.778117][T17223] 8021q: adding VLAN 0 to HW filter on device bond1 [ 550.844034][T17047] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 550.918307][ T66] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.952803][ T66] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.964841][T17228] ip6_vti0 speed is unknown, defaulting to 1000 [ 550.993198][ T66] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 551.052284][ T66] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 551.117355][T17235] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3164'. [ 551.198610][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 551.371924][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 551.398265][T17245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3165'. [ 551.457978][T17245] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3165'. [ 551.499165][T17241] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 551.527759][T17241] bond2 (unregistering): Released all slaves [ 551.580452][ T5150] Bluetooth: hci2: command 0x040f tx timeout [ 551.771065][ T1094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 551.783030][ T1094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 552.044041][T17254] ip6_vti0 speed is unknown, defaulting to 1000 [ 552.188816][T17256] netlink: zone id is out of range [ 552.193999][T17256] netlink: zone id is out of range [ 552.250477][T17256] netlink: zone id is out of range [ 552.255954][T17256] netlink: set zone limit has 8 unknown bytes [ 552.272957][T17262] netlink: 'syz.2.3171': attribute type 8 has an invalid length. [ 552.826241][T17258] ip6_vti0 speed is unknown, defaulting to 1000 [ 553.319658][T17279] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3175'. [ 553.423563][T17262] ip6_vti0 speed is unknown, defaulting to 1000 [ 553.656924][ T5150] Bluetooth: hci2: command 0x040f tx timeout [ 553.839659][T17290] FAULT_INJECTION: forcing a failure. [ 553.839659][T17290] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 553.903534][T17290] CPU: 0 UID: 0 PID: 17290 Comm: syz.3.3179 Not tainted syzkaller #0 PREEMPT(full) [ 553.903567][T17290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 553.903581][T17290] Call Trace: [ 553.903589][T17290] [ 553.903616][T17290] dump_stack_lvl+0x189/0x250 [ 553.903647][T17290] ? __pfx____ratelimit+0x10/0x10 [ 553.903669][T17290] ? __pfx_dump_stack_lvl+0x10/0x10 [ 553.903694][T17290] ? __pfx__printk+0x10/0x10 [ 553.903736][T17290] ? __might_fault+0xb0/0x130 [ 553.903778][T17290] should_fail_ex+0x414/0x560 [ 553.903815][T17290] _copy_from_iter+0x1cd/0x1630 [ 553.903842][T17290] ? __build_skb_around+0x22d/0x3c0 [ 553.903877][T17290] ? __pfx__copy_from_iter+0x10/0x10 [ 553.903896][T17290] ? __alloc_skb+0x2f1/0x430 [ 553.903919][T17290] ? __pfx___alloc_skb+0x10/0x10 [ 553.903943][T17290] ? netlink_sendmsg+0x642/0xb30 [ 553.903966][T17290] ? skb_put+0x11b/0x210 [ 553.903992][T17290] netlink_sendmsg+0x6b2/0xb30 [ 553.904029][T17290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 553.904059][T17290] ? aa_sock_msg_perm+0xf1/0x1b0 [ 553.904087][T17290] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 553.904107][T17290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 553.904135][T17290] __sock_sendmsg+0x21c/0x270 [ 553.904169][T17290] ____sys_sendmsg+0x505/0x820 [ 553.904201][T17290] ? __pfx_____sys_sendmsg+0x10/0x10 [ 553.904237][T17290] ? import_iovec+0x74/0xa0 [ 553.904265][T17290] ___sys_sendmsg+0x21f/0x2a0 [ 553.904293][T17290] ? __pfx____sys_sendmsg+0x10/0x10 [ 553.904326][T17290] ? rcu_read_lock_any_held+0xb3/0x120 [ 553.904380][T17290] ? __fget_files+0x2a/0x420 [ 553.904406][T17290] ? __fget_files+0x3a0/0x420 [ 553.904443][T17290] __x64_sys_sendmsg+0x19b/0x260 [ 553.904471][T17290] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 553.904507][T17290] ? __pfx_ksys_write+0x10/0x10 [ 553.904532][T17290] ? do_syscall_64+0xbe/0xf80 [ 553.904558][T17290] do_syscall_64+0xfa/0xf80 [ 553.904582][T17290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.904603][T17290] ? clear_bhb_loop+0x60/0xb0 [ 553.904628][T17290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.904648][T17290] RIP: 0033:0x7f2f6c58f749 [ 553.904666][T17290] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 553.904685][T17290] RSP: 002b:00007f2f6d4d3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 553.904707][T17290] RAX: ffffffffffffffda RBX: 00007f2f6c7e5fa0 RCX: 00007f2f6c58f749 [ 553.904723][T17290] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 553.904736][T17290] RBP: 00007f2f6d4d3090 R08: 0000000000000000 R09: 0000000000000000 [ 553.904749][T17290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 553.904761][T17290] R13: 00007f2f6c7e6038 R14: 00007f2f6c7e5fa0 R15: 00007ffff09282a8 [ 553.904797][T17290] [ 554.293863][T17297] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3180'. [ 554.304294][T17297] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3180'. [ 554.336077][T17295] gretap0: entered promiscuous mode [ 554.341663][T17295] vlan2: entered promiscuous mode [ 554.500407][T17293] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 554.582645][T17293] bond2 (unregistering): Released all slaves [ 555.109775][T17306] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3184'. [ 555.626666][T17317] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3186'. [ 555.703073][T17310] ip6_vti0 speed is unknown, defaulting to 1000 [ 555.737384][ T5150] Bluetooth: hci2: command 0x040f tx timeout [ 556.210145][T17331] macsec1: entered promiscuous mode [ 556.215408][T17331] macsec1: entered allmulticast mode [ 556.535783][T17344] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3193'. [ 556.554267][T17338] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 556.555992][T17344] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3193'. [ 556.568726][T17341] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 556.601279][T17341] sctp: [Deprecated]: syz.4.3195 (pid 17341) Use of struct sctp_assoc_value in delayed_ack socket option. [ 556.601279][T17341] Use struct sctp_sack_info instead [ 556.639489][T17338] bond2 (unregistering): Released all slaves [ 557.342368][T17352] ip6_vti0 speed is unknown, defaulting to 1000 [ 557.369972][T17354] netlink: zone id is out of range [ 557.376386][T17354] netlink: zone id is out of range [ 557.382523][T17354] netlink: zone id is out of range [ 557.407480][T17354] netlink: set zone limit has 8 unknown bytes [ 557.789482][T17359] ip6_vti0 speed is unknown, defaulting to 1000 [ 557.820852][T17361] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3200'. [ 558.622834][T17369] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.3203'. [ 558.841223][T17371] netlink: 'syz.1.3204': attribute type 5 has an invalid length. [ 559.511689][T17385] netlink: 'syz.4.3209': attribute type 1 has an invalid length. [ 559.597645][T17390] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3211'. [ 559.684257][T17391] ip6_vti0 speed is unknown, defaulting to 1000 [ 559.811461][T17397] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3212'. [ 559.915584][T17397] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3212'. [ 559.923670][T17394] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 559.992446][T17394] bond1 (unregistering): Released all slaves [ 560.778490][T17431] FAULT_INJECTION: forcing a failure. [ 560.778490][T17431] name failslab, interval 1, probability 0, space 0, times 0 [ 560.866261][T17431] CPU: 1 UID: 0 PID: 17431 Comm: syz.4.3218 Not tainted syzkaller #0 PREEMPT(full) [ 560.866294][T17431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 560.866307][T17431] Call Trace: [ 560.866317][T17431] [ 560.866326][T17431] dump_stack_lvl+0x189/0x250 [ 560.866356][T17431] ? __pfx____ratelimit+0x10/0x10 [ 560.866378][T17431] ? __pfx_dump_stack_lvl+0x10/0x10 [ 560.866402][T17431] ? __pfx__printk+0x10/0x10 [ 560.866436][T17431] ? __pfx___might_resched+0x10/0x10 [ 560.866458][T17431] ? fs_reclaim_acquire+0x7d/0x100 [ 560.866485][T17431] should_fail_ex+0x414/0x560 [ 560.866523][T17431] should_failslab+0xa8/0x100 [ 560.866551][T17431] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 560.866585][T17431] ? __alloc_skb+0x255/0x430 [ 560.866613][T17431] ? napi_skb_cache_get+0x4a5/0x780 [ 560.866633][T17431] ? napi_skb_cache_get+0x151/0x780 [ 560.866660][T17431] __alloc_skb+0x255/0x430 [ 560.866684][T17431] ? __pfx___alloc_skb+0x10/0x10 [ 560.866715][T17431] ? netlink_ack_tlv_len+0x6c/0x210 [ 560.866744][T17431] netlink_ack+0x146/0xa50 [ 560.866789][T17431] netlink_rcv_skb+0x28c/0x470 [ 560.866816][T17431] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 560.866842][T17431] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 560.866882][T17431] ? bpf_lsm_capable+0x9/0x20 [ 560.866906][T17431] ? security_capable+0x7e/0x2e0 [ 560.866938][T17431] nfnetlink_rcv+0x282/0x2590 [ 560.866963][T17431] ? unwind_get_return_address+0x4d/0x90 [ 560.866987][T17431] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 560.867016][T17431] ? arch_stack_walk+0xfc/0x150 [ 560.867053][T17431] ? stack_trace_save+0x9c/0xe0 [ 560.867090][T17431] ? __lock_acquire+0x6b6/0x2cf0 [ 560.867116][T17431] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 560.867137][T17431] ? kasan_save_track+0x4f/0x80 [ 560.867157][T17431] ? kasan_save_track+0x3e/0x80 [ 560.867175][T17431] ? __kasan_slab_alloc+0x6c/0x80 [ 560.867196][T17431] ? kmem_cache_alloc_node_noprof+0x43c/0x720 [ 560.867226][T17431] ? kmalloc_reserve+0xbd/0x290 [ 560.867245][T17431] ? __alloc_skb+0x27e/0x430 [ 560.867270][T17431] ? __lock_acquire+0x6b6/0x2cf0 [ 560.867301][T17431] ? __lock_acquire+0x6b6/0x2cf0 [ 560.867333][T17431] ? __netlink_lookup+0xbd/0x8a0 [ 560.867379][T17431] ? netlink_deliver_tap+0x2e/0x1b0 [ 560.867412][T17431] ? netlink_deliver_tap+0x2e/0x1b0 [ 560.867447][T17431] netlink_unicast+0x82f/0x9e0 [ 560.867481][T17431] ? __pfx_netlink_unicast+0x10/0x10 [ 560.867508][T17431] ? netlink_sendmsg+0x642/0xb30 [ 560.867532][T17431] ? skb_put+0x11b/0x210 [ 560.867560][T17431] netlink_sendmsg+0x805/0xb30 [ 560.867603][T17431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 560.867634][T17431] ? aa_sock_msg_perm+0xf1/0x1b0 [ 560.867663][T17431] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 560.867683][T17431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 560.867711][T17431] __sock_sendmsg+0x21c/0x270 [ 560.867745][T17431] ____sys_sendmsg+0x505/0x820 [ 560.867775][T17431] ? __pfx_____sys_sendmsg+0x10/0x10 [ 560.867809][T17431] ? import_iovec+0x74/0xa0 [ 560.867837][T17431] ___sys_sendmsg+0x21f/0x2a0 [ 560.867864][T17431] ? __pfx____sys_sendmsg+0x10/0x10 [ 560.867897][T17431] ? rcu_read_lock_any_held+0xb3/0x120 [ 560.867955][T17431] ? __fget_files+0x2a/0x420 [ 560.867980][T17431] ? __fget_files+0x3a0/0x420 [ 560.868018][T17431] __x64_sys_sendmsg+0x19b/0x260 [ 560.868046][T17431] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 560.868083][T17431] ? __pfx_ksys_write+0x10/0x10 [ 560.868108][T17431] ? do_syscall_64+0xbe/0xf80 [ 560.868135][T17431] do_syscall_64+0xfa/0xf80 [ 560.868158][T17431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.868180][T17431] ? clear_bhb_loop+0x60/0xb0 [ 560.868205][T17431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.868226][T17431] RIP: 0033:0x7fd474f8f749 [ 560.868245][T17431] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 560.868263][T17431] RSP: 002b:00007fd475e99038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 560.868286][T17431] RAX: ffffffffffffffda RBX: 00007fd4751e5fa0 RCX: 00007fd474f8f749 [ 560.868302][T17431] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 560.868341][T17431] RBP: 00007fd475e99090 R08: 0000000000000000 R09: 0000000000000000 [ 560.868371][T17431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 560.868385][T17431] R13: 00007fd4751e6038 R14: 00007fd4751e5fa0 R15: 00007fffe838b468 [ 560.868422][T17431] [ 561.342329][T17423] ip6_vti0 speed is unknown, defaulting to 1000 [ 561.462724][T17432] netlink: zone id is out of range [ 561.568248][T17432] netlink: zone id is out of range [ 561.639915][T17432] netlink: zone id is out of range [ 561.707431][T17432] netlink: set zone limit has 8 unknown bytes [ 561.715507][T17440] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3223'. [ 562.199998][T17461] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3229'. [ 562.231773][T17457] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 562.247752][T17463] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3230'. [ 562.285636][T17461] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3229'. [ 562.316273][T17457] bond1 (unregistering): Released all slaves [ 562.325838][T17467] FAULT_INJECTION: forcing a failure. [ 562.325838][T17467] name failslab, interval 1, probability 0, space 0, times 0 [ 562.354731][T17467] CPU: 0 UID: 0 PID: 17467 Comm: syz.3.3232 Not tainted syzkaller #0 PREEMPT(full) [ 562.354764][T17467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 562.354778][T17467] Call Trace: [ 562.354788][T17467] [ 562.354798][T17467] dump_stack_lvl+0x189/0x250 [ 562.354829][T17467] ? __pfx____ratelimit+0x10/0x10 [ 562.354851][T17467] ? __pfx_dump_stack_lvl+0x10/0x10 [ 562.354878][T17467] ? __pfx__printk+0x10/0x10 [ 562.354925][T17467] should_fail_ex+0x414/0x560 [ 562.354964][T17467] should_failslab+0xa8/0x100 [ 562.354993][T17467] kmem_cache_alloc_noprof+0x88/0x710 [ 562.355027][T17467] ? skb_clone+0x212/0x3a0 [ 562.355059][T17467] skb_clone+0x212/0x3a0 [ 562.355091][T17467] __netlink_deliver_tap+0x404/0x850 [ 562.355134][T17467] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.355163][T17467] netlink_deliver_tap+0x19c/0x1b0 [ 562.355192][T17467] netlink_sendskb+0x68/0x140 [ 562.355220][T17467] netlink_unicast+0x397/0x9e0 [ 562.355261][T17467] ? __asan_memcpy+0x40/0x70 [ 562.355291][T17467] ? __pfx_netlink_unicast+0x10/0x10 [ 562.355328][T17467] netlink_rcv_skb+0x28c/0x470 [ 562.355356][T17467] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 562.355384][T17467] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 562.355425][T17467] ? bpf_lsm_capable+0x9/0x20 [ 562.355450][T17467] ? security_capable+0x7e/0x2e0 [ 562.355484][T17467] nfnetlink_rcv+0x282/0x2590 [ 562.355510][T17467] ? __local_bh_enable_ip+0x12d/0x1c0 [ 562.355534][T17467] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 562.355564][T17467] ? __dev_queue_xmit+0x289/0x3140 [ 562.355590][T17467] ? __dev_queue_xmit+0x289/0x3140 [ 562.355621][T17467] ? __dev_queue_xmit+0x1955/0x3140 [ 562.355652][T17467] ? ___sys_sendmsg+0x21f/0x2a0 [ 562.355685][T17467] ? __dev_queue_xmit+0x289/0x3140 [ 562.355721][T17467] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 562.355753][T17467] ? __pfx___dev_queue_xmit+0x10/0x10 [ 562.355791][T17467] ? ref_tracker_free+0x63a/0x7d0 [ 562.355813][T17467] ? __asan_memcpy+0x40/0x70 [ 562.355832][T17467] ? __pfx_ref_tracker_free+0x10/0x10 [ 562.355852][T17467] ? __skb_clone+0x63/0x7a0 [ 562.355883][T17467] ? __skb_clone+0x483/0x7a0 [ 562.355918][T17467] ? skb_clone+0x246/0x3a0 [ 562.355949][T17467] ? __netlink_deliver_tap+0x807/0x850 [ 562.355976][T17467] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.356011][T17467] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.356048][T17467] netlink_unicast+0x82f/0x9e0 [ 562.356082][T17467] ? __pfx_netlink_unicast+0x10/0x10 [ 562.356109][T17467] ? netlink_sendmsg+0x642/0xb30 [ 562.356135][T17467] ? skb_put+0x11b/0x210 [ 562.356163][T17467] netlink_sendmsg+0x805/0xb30 [ 562.356201][T17467] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.356234][T17467] ? aa_sock_msg_perm+0xf1/0x1b0 [ 562.356270][T17467] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 562.356291][T17467] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.356320][T17467] __sock_sendmsg+0x21c/0x270 [ 562.356355][T17467] ____sys_sendmsg+0x505/0x820 [ 562.356388][T17467] ? __pfx_____sys_sendmsg+0x10/0x10 [ 562.356425][T17467] ? import_iovec+0x74/0xa0 [ 562.356455][T17467] ___sys_sendmsg+0x21f/0x2a0 [ 562.356484][T17467] ? __pfx____sys_sendmsg+0x10/0x10 [ 562.356518][T17467] ? rcu_read_lock_any_held+0xb3/0x120 [ 562.356575][T17467] ? __fget_files+0x2a/0x420 [ 562.356601][T17467] ? __fget_files+0x3a0/0x420 [ 562.356641][T17467] __x64_sys_sendmsg+0x19b/0x260 [ 562.356671][T17467] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 562.356709][T17467] ? __pfx_ksys_write+0x10/0x10 [ 562.356732][T17467] ? do_syscall_64+0xbe/0xf80 [ 562.356758][T17467] do_syscall_64+0xfa/0xf80 [ 562.356781][T17467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.356802][T17467] ? clear_bhb_loop+0x60/0xb0 [ 562.356827][T17467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.356847][T17467] RIP: 0033:0x7f2f6c58f749 [ 562.356866][T17467] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 562.356885][T17467] RSP: 002b:00007f2f6d4d3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.356907][T17467] RAX: ffffffffffffffda RBX: 00007f2f6c7e5fa0 RCX: 00007f2f6c58f749 [ 562.356922][T17467] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 562.356935][T17467] RBP: 00007f2f6d4d3090 R08: 0000000000000000 R09: 0000000000000000 [ 562.356947][T17467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 562.356958][T17467] R13: 00007f2f6c7e6038 R14: 00007f2f6c7e5fa0 R15: 00007ffff09282a8 [ 562.356993][T17467] [ 563.090077][T17471] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3234'. [ 563.165979][T17472] ip6_vti0 speed is unknown, defaulting to 1000 [ 564.314683][T17487] ip6_vti0 speed is unknown, defaulting to 1000 [ 564.452027][T17489] netlink: zone id is out of range [ 564.500535][T17489] netlink: zone id is out of range [ 564.540102][T17489] netlink: zone id is out of range [ 564.597423][T17489] netlink: set zone limit has 8 unknown bytes [ 565.356827][T17496] ip6_vti0 speed is unknown, defaulting to 1000 [ 565.990428][T17514] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3246'. [ 566.015923][T17511] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 566.046567][T17514] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3246'. [ 566.086215][T17511] bond1 (unregistering): Released all slaves [ 566.293321][T17523] netlink: 'syz.0.3248': attribute type 7 has an invalid length. [ 566.420210][T17517] ip6_vti0 speed is unknown, defaulting to 1000 [ 566.806638][T17544] veth0: entered promiscuous mode [ 566.812620][T17544] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3255'. [ 566.885220][T17544] veth0 (unregistering): left promiscuous mode [ 566.972460][T17543] ip6_vti0 speed is unknown, defaulting to 1000 [ 567.877090][T17551] ip6_vti0 speed is unknown, defaulting to 1000 [ 567.957517][T17553] netlink: zone id is out of range [ 567.963312][T17553] netlink: zone id is out of range [ 568.017526][T17553] netlink: zone id is out of range [ 568.023110][T17553] netlink: set zone limit has 8 unknown bytes [ 569.179066][T17564] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3260'. [ 569.219519][T17564] IPVS: set_ctl: invalid protocol: 51 10.1.1.1:20001 [ 569.226436][T14585] IPVS: starting estimator thread 0... [ 569.245425][T17564] IPVS: sed: FWM 3 0x00000003 - no destination available [ 569.269725][ C1] IPVS: sed: FWM 3 0x00000003 - no destination available [ 569.281678][T17564] netlink: 'syz.3.3260': attribute type 10 has an invalid length. [ 569.321472][T17564] 8021q: adding VLAN 0 to HW filter on device team0 [ 569.328396][T17565] IPVS: using max 27 ests per chain, 64800 per kthread [ 569.350938][T17564] bond0: (slave team0): Enslaving as an active interface with an up link [ 569.693117][T17570] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 569.715894][T17570] bond1 (unregistering): Released all slaves [ 569.746680][T17572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3262'. [ 569.762721][T17572] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3262'. [ 570.248404][T17593] ip6_vti0 speed is unknown, defaulting to 1000 [ 570.713981][T17597] ip6_vti0 speed is unknown, defaulting to 1000 [ 570.768054][T17604] netlink: zone id is out of range [ 570.813297][T17604] netlink: zone id is out of range [ 570.855940][T17604] netlink: zone id is out of range [ 570.899205][T17604] netlink: set zone limit has 8 unknown bytes [ 571.340413][T17629] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 571.367684][T17631] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3280'. [ 571.439479][T17631] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3280'. [ 571.501082][T17629] bond2 (unregistering): Released all slaves [ 572.297366][T17653] netlink: 'syz.3.3286': attribute type 6 has an invalid length. [ 572.306178][T17653] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3286'. [ 572.402318][T17653] wireguard0: entered promiscuous mode [ 572.435833][T17653] wireguard0: entered allmulticast mode [ 572.509351][T17653] team0: Device wireguard0 is of different type [ 572.551484][T17660] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3285'. [ 572.818958][ T5914] hid-generic 0005:15C2:0009.0002: unknown main item tag 0x0 [ 572.831646][T17664] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3287'. [ 572.847214][ T5914] hid-generic 0005:15C2:0009.0002: hidraw0: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 572.871223][T17664] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3287'. [ 572.907005][T17664] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3287'. [ 572.995178][T17667] ip6_vti0 speed is unknown, defaulting to 1000 [ 573.297838][T17675] ip6_vti0 speed is unknown, defaulting to 1000 [ 573.300955][T17677] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3289'. [ 573.363945][T17676] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 573.417628][T17677] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 574.000861][T17689] netlink: 'syz.2.3294': attribute type 33 has an invalid length. [ 574.008986][T17689] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3294'. [ 574.051035][T17689] `: renamed from team0 (while UP) [ 574.189440][T17693] dummy0: entered promiscuous mode [ 574.206889][T17693] macsec1: entered allmulticast mode [ 574.212294][T17693] dummy0: entered allmulticast mode [ 574.244847][T17695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3295'. [ 574.258789][T17693] dummy0: left allmulticast mode [ 574.263923][T17693] dummy0: left promiscuous mode [ 574.633938][T17707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3296'. [ 574.750766][T17709] netlink: zone id is out of range [ 574.755940][T17709] netlink: zone id is out of range [ 574.777590][T17707] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3296'. [ 574.837561][T17709] netlink: zone id is out of range [ 574.843290][T17709] netlink: set zone limit has 8 unknown bytes [ 574.853472][T17704] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 574.950945][T17704] bond3 (unregistering): Released all slaves [ 575.213905][T17717] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 575.226642][T17717] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 575.235883][T17703] ip6_vti0 speed is unknown, defaulting to 1000 [ 575.320856][T17715] netlink: 'syz.4.3299': attribute type 1 has an invalid length. [ 575.482604][T17715] veth1: entered promiscuous mode [ 575.542073][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 575.560801][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.764310][T17728] tipc: Enabling of bearer rejected, failed to enable media [ 575.972827][T17727] ip6_vti0 speed is unknown, defaulting to 1000 [ 576.836655][T17741] ip6_vti0 speed is unknown, defaulting to 1000 [ 577.052187][T17748] FAULT_INJECTION: forcing a failure. [ 577.052187][T17748] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.087072][T17748] CPU: 1 UID: 0 PID: 17748 Comm: syz.0.3310 Not tainted syzkaller #0 PREEMPT(full) [ 577.087110][T17748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 577.087124][T17748] Call Trace: [ 577.087133][T17748] [ 577.087143][T17748] dump_stack_lvl+0x189/0x250 [ 577.087173][T17748] ? __pfx____ratelimit+0x10/0x10 [ 577.087194][T17748] ? __pfx_dump_stack_lvl+0x10/0x10 [ 577.087220][T17748] ? __pfx__printk+0x10/0x10 [ 577.087250][T17748] ? __might_fault+0xb0/0x130 [ 577.087294][T17748] should_fail_ex+0x414/0x560 [ 577.087330][T17748] _copy_from_user+0x2d/0xb0 [ 577.087357][T17748] ___sys_sendmsg+0x158/0x2a0 [ 577.087405][T17748] ? __pfx____sys_sendmsg+0x10/0x10 [ 577.087439][T17748] ? rcu_read_lock_any_held+0xb3/0x120 [ 577.087501][T17748] ? __fget_files+0x2a/0x420 [ 577.087528][T17748] ? __fget_files+0x3a0/0x420 [ 577.087567][T17748] __x64_sys_sendmsg+0x19b/0x260 [ 577.087597][T17748] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 577.087634][T17748] ? __pfx_ksys_write+0x10/0x10 [ 577.087660][T17748] ? do_syscall_64+0xbe/0xf80 [ 577.087688][T17748] do_syscall_64+0xfa/0xf80 [ 577.087711][T17748] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.087732][T17748] ? clear_bhb_loop+0x60/0xb0 [ 577.087758][T17748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.087791][T17748] RIP: 0033:0x7fad4af8f749 [ 577.087810][T17748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 577.087828][T17748] RSP: 002b:00007fad491f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 577.087850][T17748] RAX: ffffffffffffffda RBX: 00007fad4b1e5fa0 RCX: 00007fad4af8f749 [ 577.087866][T17748] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 577.087879][T17748] RBP: 00007fad491f6090 R08: 0000000000000000 R09: 0000000000000000 [ 577.087893][T17748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.087905][T17748] R13: 00007fad4b1e6038 R14: 00007fad4b1e5fa0 R15: 00007fff898fab68 [ 577.087940][T17748] [ 577.389299][T17751] __nla_validate_parse: 6 callbacks suppressed [ 577.389320][T17751] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3311'. [ 577.619109][T17754] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3311'. [ 577.647190][T17755] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3312'. [ 577.686555][T17755] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3312'. [ 577.740324][T17753] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 577.768843][T17753] bond2 (unregistering): Released all slaves [ 578.157760][T17762] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3313'. [ 578.538951][T17770] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3315'. [ 579.079959][T17782] ip6_vti0 speed is unknown, defaulting to 1000 [ 579.227839][T17789] netlink: zone id is out of range [ 579.267607][T17789] netlink: zone id is out of range [ 579.272900][T17789] netlink: zone id is out of range [ 579.383373][T17789] netlink: set zone limit has 8 unknown bytes [ 579.757396][T17802] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3326'. [ 579.850648][T17802] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3326'. [ 579.930249][T17800] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 579.954792][T17800] bond3 (unregistering): Released all slaves [ 580.327838][T17794] ip6_vti0 speed is unknown, defaulting to 1000 [ 580.610922][T17806] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3328'. [ 581.112164][T17823] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 581.148223][T17825] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 581.161909][T17825] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3333'. [ 581.187100][T17825] netlink: 'syz.3.3333': attribute type 15 has an invalid length. [ 582.046026][T17842] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 582.159693][T17842] bond2 (unregistering): Released all slaves [ 582.671935][T17857] netlink: 'syz.1.3343': attribute type 83 has an invalid length. [ 582.962189][T17863] ip6_vti0 speed is unknown, defaulting to 1000 [ 583.058563][T17868] netlink: zone id is out of range [ 583.063780][T17868] netlink: zone id is out of range [ 583.094205][T17868] netlink: zone id is out of range [ 583.127439][T17868] netlink: set zone limit has 8 unknown bytes [ 583.357211][T17874] __nla_validate_parse: 4 callbacks suppressed [ 583.357234][T17874] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3349'. [ 583.728418][T17884] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3353'. [ 583.896857][T17882] ip6_vti0 speed is unknown, defaulting to 1000 [ 584.028116][T17892] FAULT_INJECTION: forcing a failure. [ 584.028116][T17892] name failslab, interval 1, probability 0, space 0, times 0 [ 584.057180][T17892] CPU: 0 UID: 0 PID: 17892 Comm: syz.1.3356 Not tainted syzkaller #0 PREEMPT(full) [ 584.057211][T17892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 584.057225][T17892] Call Trace: [ 584.057234][T17892] [ 584.057244][T17892] dump_stack_lvl+0x189/0x250 [ 584.057278][T17892] ? __pfx____ratelimit+0x10/0x10 [ 584.057299][T17892] ? __pfx_dump_stack_lvl+0x10/0x10 [ 584.057324][T17892] ? __pfx__printk+0x10/0x10 [ 584.057361][T17892] ? nf_conntrack_find_get+0x120/0x600 [ 584.057400][T17892] should_fail_ex+0x414/0x560 [ 584.057436][T17892] should_failslab+0xa8/0x100 [ 584.057463][T17892] kmem_cache_alloc_noprof+0x88/0x710 [ 584.057492][T17892] ? nf_ct_pernet+0x45/0x270 [ 584.057510][T17892] ? nf_ct_pernet+0x45/0x270 [ 584.057528][T17892] ? __nf_conntrack_alloc+0x81/0x3e0 [ 584.057550][T17892] __nf_conntrack_alloc+0x81/0x3e0 [ 584.057576][T17892] ctnetlink_new_conntrack+0x571/0x20a0 [ 584.057612][T17892] ? __pfx___mutex_trylock_common+0x10/0x10 [ 584.057648][T17892] ? __pfx_ctnetlink_new_conntrack+0x10/0x10 [ 584.057677][T17892] ? trace_contention_end+0x39/0x100 [ 584.057703][T17892] ? __mutex_lock+0x335/0x1350 [ 584.057739][T17892] ? nfnetlink_rcv_msg+0x9dc/0x1130 [ 584.057799][T17892] nfnetlink_rcv_msg+0xb4d/0x1130 [ 584.057825][T17892] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 584.057870][T17892] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 584.057922][T17892] ? __lock_acquire+0x6b6/0x2cf0 [ 584.057964][T17892] netlink_rcv_skb+0x208/0x470 [ 584.057993][T17892] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 584.058019][T17892] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 584.058056][T17892] ? bpf_lsm_capable+0x9/0x20 [ 584.058079][T17892] ? security_capable+0x7e/0x2e0 [ 584.058111][T17892] nfnetlink_rcv+0x282/0x2590 [ 584.058137][T17892] ? unwind_get_return_address+0x4d/0x90 [ 584.058163][T17892] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 584.058195][T17892] ? arch_stack_walk+0xfc/0x150 [ 584.058233][T17892] ? stack_trace_save+0x9c/0xe0 [ 584.058270][T17892] ? __lock_acquire+0x6b6/0x2cf0 [ 584.058295][T17892] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 584.058315][T17892] ? kasan_save_track+0x4f/0x80 [ 584.058334][T17892] ? kasan_save_track+0x3e/0x80 [ 584.058353][T17892] ? __kasan_slab_alloc+0x6c/0x80 [ 584.058374][T17892] ? kmem_cache_alloc_node_noprof+0x43c/0x720 [ 584.058403][T17892] ? kmalloc_reserve+0xbd/0x290 [ 584.058424][T17892] ? __alloc_skb+0x27e/0x430 [ 584.058449][T17892] ? __lock_acquire+0x6b6/0x2cf0 [ 584.058480][T17892] ? __lock_acquire+0x6b6/0x2cf0 [ 584.058513][T17892] ? __netlink_lookup+0xbd/0x8a0 [ 584.058558][T17892] ? netlink_deliver_tap+0x2e/0x1b0 [ 584.058592][T17892] ? netlink_deliver_tap+0x2e/0x1b0 [ 584.058628][T17892] netlink_unicast+0x82f/0x9e0 [ 584.058662][T17892] ? __pfx_netlink_unicast+0x10/0x10 [ 584.058688][T17892] ? netlink_sendmsg+0x642/0xb30 [ 584.058713][T17892] ? skb_put+0x11b/0x210 [ 584.058741][T17892] netlink_sendmsg+0x805/0xb30 [ 584.058785][T17892] ? __pfx_netlink_sendmsg+0x10/0x10 [ 584.058817][T17892] ? aa_sock_msg_perm+0xf1/0x1b0 [ 584.058846][T17892] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 584.058867][T17892] ? __pfx_netlink_sendmsg+0x10/0x10 [ 584.058895][T17892] __sock_sendmsg+0x21c/0x270 [ 584.058929][T17892] ____sys_sendmsg+0x505/0x820 [ 584.058961][T17892] ? __pfx_____sys_sendmsg+0x10/0x10 [ 584.058997][T17892] ? import_iovec+0x74/0xa0 [ 584.059026][T17892] ___sys_sendmsg+0x21f/0x2a0 [ 584.059054][T17892] ? __pfx____sys_sendmsg+0x10/0x10 [ 584.059088][T17892] ? rcu_read_lock_any_held+0xb3/0x120 [ 584.059165][T17892] ? __fget_files+0x2a/0x420 [ 584.059191][T17892] ? __fget_files+0x3a0/0x420 [ 584.059231][T17892] __x64_sys_sendmsg+0x19b/0x260 [ 584.059261][T17892] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 584.059299][T17892] ? __pfx_ksys_write+0x10/0x10 [ 584.059325][T17892] ? do_syscall_64+0xbe/0xf80 [ 584.059353][T17892] do_syscall_64+0xfa/0xf80 [ 584.059376][T17892] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.059398][T17892] ? clear_bhb_loop+0x60/0xb0 [ 584.059424][T17892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.059445][T17892] RIP: 0033:0x7fb97c38f749 [ 584.059465][T17892] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 584.059485][T17892] RSP: 002b:00007fb97d165038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 584.059508][T17892] RAX: ffffffffffffffda RBX: 00007fb97c5e5fa0 RCX: 00007fb97c38f749 [ 584.059525][T17892] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 584.059539][T17892] RBP: 00007fb97d165090 R08: 0000000000000000 R09: 0000000000000000 [ 584.059553][T17892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 584.059565][T17892] R13: 00007fb97c5e6038 R14: 00007fb97c5e5fa0 R15: 00007ffe58abe348 [ 584.059601][T17892] [ 584.802493][T17895] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 584.885780][T17898] ip6_vti0: entered promiscuous mode [ 584.894153][T17898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3357'. [ 584.977321][T17901] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3358'. [ 585.001107][T17901] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3358'. [ 585.022241][T17897] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 585.061398][T17897] bond1 (unregistering): Released all slaves [ 585.819289][T17925] FAULT_INJECTION: forcing a failure. [ 585.819289][T17925] name failslab, interval 1, probability 0, space 0, times 0 [ 585.858466][T17925] CPU: 1 UID: 0 PID: 17925 Comm: syz.4.3368 Not tainted syzkaller #0 PREEMPT(full) [ 585.858496][T17925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 585.858509][T17925] Call Trace: [ 585.858518][T17925] [ 585.858528][T17925] dump_stack_lvl+0x189/0x250 [ 585.858560][T17925] ? __pfx____ratelimit+0x10/0x10 [ 585.858582][T17925] ? __pfx_dump_stack_lvl+0x10/0x10 [ 585.858609][T17925] ? __pfx__printk+0x10/0x10 [ 585.858636][T17925] ? nfnetlink_parse_nat_setup+0x50b/0x680 [ 585.858675][T17925] ? __pfx_nfnetlink_parse_nat_setup+0x10/0x10 [ 585.858707][T17925] should_fail_ex+0x414/0x560 [ 585.858745][T17925] should_failslab+0xa8/0x100 [ 585.858773][T17925] __kmalloc_node_track_caller_noprof+0xe2/0x820 [ 585.858798][T17925] ? nf_ct_ext_add+0x1b6/0x460 [ 585.858821][T17925] ? nf_ct_ext_add+0x1b6/0x460 [ 585.858844][T17925] krealloc_node_align_noprof+0x1ae/0x3a0 [ 585.858873][T17925] nf_ct_ext_add+0x1b6/0x460 [ 585.858902][T17925] ctnetlink_new_conntrack+0x11e7/0x20a0 [ 585.858939][T17925] ? ctnetlink_new_conntrack+0x6d3/0x20a0 [ 585.858981][T17925] ? __pfx_ctnetlink_new_conntrack+0x10/0x10 [ 585.859011][T17925] ? trace_contention_end+0x39/0x100 [ 585.859039][T17925] ? __mutex_lock+0x335/0x1350 [ 585.859067][T17925] ? finish_task_switch+0x162/0x940 [ 585.859104][T17925] ? nfnetlink_rcv_msg+0x9dc/0x1130 [ 585.859157][T17925] nfnetlink_rcv_msg+0xb4d/0x1130 [ 585.859184][T17925] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 585.859228][T17925] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 585.859284][T17925] ? __lock_acquire+0x6b6/0x2cf0 [ 585.859314][T17925] ? rcu_is_watching+0x15/0xb0 [ 585.859350][T17925] netlink_rcv_skb+0x208/0x470 [ 585.859380][T17925] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 585.859407][T17925] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 585.859447][T17925] ? bpf_lsm_capable+0x9/0x20 [ 585.859472][T17925] ? security_capable+0x7e/0x2e0 [ 585.859505][T17925] nfnetlink_rcv+0x282/0x2590 [ 585.859530][T17925] ? unwind_get_return_address+0x4d/0x90 [ 585.859556][T17925] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 585.859588][T17925] ? arch_stack_walk+0xfc/0x150 [ 585.859626][T17925] ? stack_trace_save+0x9c/0xe0 [ 585.859672][T17925] ? __lock_acquire+0x6b6/0x2cf0 [ 585.859697][T17925] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 585.859719][T17925] ? kasan_save_track+0x4f/0x80 [ 585.859739][T17925] ? kasan_save_track+0x3e/0x80 [ 585.859758][T17925] ? __kasan_slab_alloc+0x6c/0x80 [ 585.859779][T17925] ? kmem_cache_alloc_node_noprof+0x43c/0x720 [ 585.859811][T17925] ? kmalloc_reserve+0xbd/0x290 [ 585.859832][T17925] ? __alloc_skb+0x27e/0x430 [ 585.859857][T17925] ? __lock_acquire+0x6b6/0x2cf0 [ 585.859888][T17925] ? __lock_acquire+0x6b6/0x2cf0 [ 585.859921][T17925] ? __netlink_lookup+0xbd/0x8a0 [ 585.859968][T17925] ? netlink_deliver_tap+0x2e/0x1b0 [ 585.860002][T17925] ? netlink_deliver_tap+0x2e/0x1b0 [ 585.860037][T17925] netlink_unicast+0x82f/0x9e0 [ 585.860072][T17925] ? __pfx_netlink_unicast+0x10/0x10 [ 585.860098][T17925] ? netlink_sendmsg+0x642/0xb30 [ 585.860123][T17925] ? skb_put+0x11b/0x210 [ 585.860151][T17925] netlink_sendmsg+0x805/0xb30 [ 585.860189][T17925] ? __pfx_netlink_sendmsg+0x10/0x10 [ 585.860220][T17925] ? aa_sock_msg_perm+0xf1/0x1b0 [ 585.860249][T17925] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 585.860269][T17925] ? __pfx_netlink_sendmsg+0x10/0x10 [ 585.860298][T17925] __sock_sendmsg+0x21c/0x270 [ 585.860331][T17925] ____sys_sendmsg+0x505/0x820 [ 585.860363][T17925] ? __pfx_____sys_sendmsg+0x10/0x10 [ 585.860399][T17925] ? import_iovec+0x74/0xa0 [ 585.860428][T17925] ___sys_sendmsg+0x21f/0x2a0 [ 585.860457][T17925] ? __pfx____sys_sendmsg+0x10/0x10 [ 585.860490][T17925] ? rcu_read_lock_any_held+0xb3/0x120 [ 585.860549][T17925] ? __fget_files+0x2a/0x420 [ 585.860574][T17925] ? __fget_files+0x3a0/0x420 [ 585.860613][T17925] __x64_sys_sendmsg+0x19b/0x260 [ 585.860650][T17925] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 585.860687][T17925] ? __pfx_ksys_write+0x10/0x10 [ 585.860713][T17925] ? do_syscall_64+0xbe/0xf80 [ 585.860739][T17925] do_syscall_64+0xfa/0xf80 [ 585.860762][T17925] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.860783][T17925] ? clear_bhb_loop+0x60/0xb0 [ 585.860809][T17925] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.860829][T17925] RIP: 0033:0x7fd474f8f749 [ 585.860847][T17925] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 585.860867][T17925] RSP: 002b:00007fd475e99038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 585.860890][T17925] RAX: ffffffffffffffda RBX: 00007fd4751e5fa0 RCX: 00007fd474f8f749 [ 585.860906][T17925] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 585.860919][T17925] RBP: 00007fd475e99090 R08: 0000000000000000 R09: 0000000000000000 [ 585.860933][T17925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 585.860945][T17925] R13: 00007fd4751e6038 R14: 00007fd4751e5fa0 R15: 00007fffe838b468 [ 585.860981][T17925] [ 586.351578][T17927] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3366'. [ 586.450328][T17929] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3367'. [ 586.630985][T17937] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3372'. [ 586.960150][T17943] ip6_vti0 speed is unknown, defaulting to 1000 [ 587.059123][T17947] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3374'. [ 587.293556][T17947] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3374'. [ 587.351804][T17950] netlink: zone id is out of range [ 587.382533][T17950] netlink: zone id is out of range [ 587.408508][T17950] netlink: zone id is out of range [ 587.451316][T17950] netlink: set zone limit has 8 unknown bytes [ 587.479308][T17944] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 587.539744][T17944] bond3 (unregistering): Released all slaves [ 587.682025][T17946] ip6_vti0 speed is unknown, defaulting to 1000 [ 588.198565][T17961] tap0: tun_chr_ioctl cmd 2148553947 [ 588.218300][T17961] tap0: tun_chr_ioctl cmd 2147767521 [ 588.236205][T17961] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 588.262392][T17961] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 588.278944][T17961] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 588.303518][T17961] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 588.846537][T17964] __nla_validate_parse: 1 callbacks suppressed [ 588.846560][T17964] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3379'. [ 589.129919][T17970] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3382'. [ 589.148312][T17970] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3382'. [ 589.172263][T17970] netlink: 'syz.0.3382': attribute type 3 has an invalid length. [ 589.243359][T17977] netlink: 260 bytes leftover after parsing attributes in process `syz.2.3383'. [ 589.284386][T17972] syzkaller0: entered promiscuous mode [ 589.306885][T17972] syzkaller0: entered allmulticast mode [ 589.381678][T17974] netlink: 'syz.3.3384': attribute type 1 has an invalid length. [ 589.511583][T17981] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3384'. [ 589.633864][T17974] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3384'. [ 589.715396][T17985] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3387'. [ 589.814310][T17991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3386'. [ 589.869759][T17987] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 589.909056][T17987] bond2 (unregistering): Released all slaves [ 589.941654][T17991] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3386'. [ 590.066301][T18004] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3392'. [ 590.353934][T18006] ip6_vti0 speed is unknown, defaulting to 1000 [ 590.669013][T18013] FAULT_INJECTION: forcing a failure. [ 590.669013][T18013] name failslab, interval 1, probability 0, space 0, times 0 [ 590.707586][T18013] CPU: 1 UID: 0 PID: 18013 Comm: syz.2.3395 Not tainted syzkaller #0 PREEMPT(full) [ 590.707616][T18013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 590.707629][T18013] Call Trace: [ 590.707638][T18013] [ 590.707647][T18013] dump_stack_lvl+0x189/0x250 [ 590.707678][T18013] ? __pfx____ratelimit+0x10/0x10 [ 590.707699][T18013] ? __pfx_dump_stack_lvl+0x10/0x10 [ 590.707724][T18013] ? __pfx__printk+0x10/0x10 [ 590.707751][T18013] ? nfnetlink_parse_nat_setup+0x50b/0x680 [ 590.707780][T18013] ? __pfx_nfnetlink_parse_nat_setup+0x10/0x10 [ 590.707811][T18013] should_fail_ex+0x414/0x560 [ 590.707848][T18013] should_failslab+0xa8/0x100 [ 590.707877][T18013] __kmalloc_node_track_caller_noprof+0xe2/0x820 [ 590.707901][T18013] ? nf_ct_ext_add+0x1b6/0x460 [ 590.707924][T18013] ? nf_ct_ext_add+0x1b6/0x460 [ 590.707946][T18013] krealloc_node_align_noprof+0x1ae/0x3a0 [ 590.707977][T18013] nf_ct_ext_add+0x1b6/0x460 [ 590.708006][T18013] ctnetlink_new_conntrack+0x10e3/0x20a0 [ 590.708042][T18013] ? ctnetlink_new_conntrack+0x6d3/0x20a0 [ 590.708083][T18013] ? __pfx_ctnetlink_new_conntrack+0x10/0x10 [ 590.708113][T18013] ? trace_contention_end+0x39/0x100 [ 590.708141][T18013] ? __mutex_lock+0x335/0x1350 [ 590.708169][T18013] ? unwind_next_frame+0xa5/0x23d0 [ 590.708204][T18013] ? is_bpf_text_address+0x26/0x2b0 [ 590.708236][T18013] ? nfnetlink_rcv_msg+0x9dc/0x1130 [ 590.708290][T18013] nfnetlink_rcv_msg+0xb4d/0x1130 [ 590.708314][T18013] ? unwind_get_return_address+0x4d/0x90 [ 590.708338][T18013] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 590.708369][T18013] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 590.708414][T18013] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 590.708494][T18013] netlink_rcv_skb+0x208/0x470 [ 590.708522][T18013] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 590.708548][T18013] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 590.708588][T18013] ? bpf_lsm_capable+0x9/0x20 [ 590.708612][T18013] ? security_capable+0x7e/0x2e0 [ 590.708646][T18013] nfnetlink_rcv+0x282/0x2590 [ 590.708672][T18013] ? __local_bh_enable_ip+0x12d/0x1c0 [ 590.708695][T18013] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 590.708724][T18013] ? __dev_queue_xmit+0x289/0x3140 [ 590.708751][T18013] ? __dev_queue_xmit+0x289/0x3140 [ 590.708780][T18013] ? __dev_queue_xmit+0x1955/0x3140 [ 590.708805][T18013] ? ___sys_sendmsg+0x21f/0x2a0 [ 590.708838][T18013] ? __dev_queue_xmit+0x289/0x3140 [ 590.708871][T18013] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 590.708902][T18013] ? __pfx___dev_queue_xmit+0x10/0x10 [ 590.708939][T18013] ? ref_tracker_free+0x63a/0x7d0 [ 590.708962][T18013] ? __asan_memcpy+0x40/0x70 [ 590.708980][T18013] ? __pfx_ref_tracker_free+0x10/0x10 [ 590.708998][T18013] ? __skb_clone+0x63/0x7a0 [ 590.709029][T18013] ? __skb_clone+0x483/0x7a0 [ 590.709062][T18013] ? skb_clone+0x246/0x3a0 [ 590.709093][T18013] ? __netlink_deliver_tap+0x807/0x850 [ 590.709119][T18013] ? netlink_deliver_tap+0x2e/0x1b0 [ 590.709154][T18013] ? netlink_deliver_tap+0x2e/0x1b0 [ 590.709187][T18013] netlink_unicast+0x82f/0x9e0 [ 590.709227][T18013] ? __pfx_netlink_unicast+0x10/0x10 [ 590.709253][T18013] ? netlink_sendmsg+0x642/0xb30 [ 590.709278][T18013] ? skb_put+0x11b/0x210 [ 590.709305][T18013] netlink_sendmsg+0x805/0xb30 [ 590.709343][T18013] ? __pfx_netlink_sendmsg+0x10/0x10 [ 590.709375][T18013] ? aa_sock_msg_perm+0xf1/0x1b0 [ 590.709405][T18013] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 590.709425][T18013] ? __pfx_netlink_sendmsg+0x10/0x10 [ 590.709453][T18013] __sock_sendmsg+0x21c/0x270 [ 590.709489][T18013] ____sys_sendmsg+0x505/0x820 [ 590.709520][T18013] ? __pfx_____sys_sendmsg+0x10/0x10 [ 590.709556][T18013] ? import_iovec+0x74/0xa0 [ 590.709586][T18013] ___sys_sendmsg+0x21f/0x2a0 [ 590.709613][T18013] ? __pfx____sys_sendmsg+0x10/0x10 [ 590.709647][T18013] ? rcu_read_lock_any_held+0xb3/0x120 [ 590.709705][T18013] ? __fget_files+0x2a/0x420 [ 590.709730][T18013] ? __fget_files+0x3a0/0x420 [ 590.709768][T18013] __x64_sys_sendmsg+0x19b/0x260 [ 590.709797][T18013] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 590.709834][T18013] ? __pfx_ksys_write+0x10/0x10 [ 590.709861][T18013] ? do_syscall_64+0xbe/0xf80 [ 590.709887][T18013] do_syscall_64+0xfa/0xf80 [ 590.709910][T18013] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.709931][T18013] ? clear_bhb_loop+0x60/0xb0 [ 590.709957][T18013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.709977][T18013] RIP: 0033:0x7fa90478f749 [ 590.709997][T18013] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 590.710016][T18013] RSP: 002b:00007fa9029f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 590.710039][T18013] RAX: ffffffffffffffda RBX: 00007fa9049e5fa0 RCX: 00007fa90478f749 [ 590.710055][T18013] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 590.710069][T18013] RBP: 00007fa9029f6090 R08: 0000000000000000 R09: 0000000000000000 [ 590.710083][T18013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 590.710096][T18013] R13: 00007fa9049e6038 R14: 00007fa9049e5fa0 R15: 00007fff841b90e8 [ 590.710151][T18013] [ 592.034999][T18035] netlink: zone id is out of range [ 592.048226][T18031] ip6_vti0 speed is unknown, defaulting to 1000 [ 592.088152][T18035] netlink: zone id is out of range [ 592.195661][T18035] netlink: zone id is out of range [ 592.201878][T18035] netlink: set zone limit has 8 unknown bytes [ 592.486532][T18040] netlink: 'syz.0.3405': attribute type 1 has an invalid length. [ 592.654790][T18040] bond2: entered promiscuous mode [ 592.660386][T18040] bond2: entered allmulticast mode [ 592.668461][T18040] 8021q: adding VLAN 0 to HW filter on device bond2 [ 592.717976][T18043] erspan1: entered allmulticast mode [ 592.748957][T18043] bond2: (slave erspan1): making interface the new active one [ 592.777575][T18043] erspan1: entered promiscuous mode [ 592.804463][T18043] bond2: (slave erspan1): Enslaving as an active interface with an up link [ 592.847396][T18047] netlink: 'syz.1.3406': attribute type 10 has an invalid length. [ 592.908687][T18047] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 592.947044][T18047] team0: Failed to send options change via netlink (err -105) [ 592.954664][T18047] team0: Port device geneve0 added [ 592.983847][T17419] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.007326][T17419] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.016318][T17419] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.025554][T17419] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.160512][T18055] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 593.208003][T18055] bond1 (unregistering): Released all slaves [ 593.399862][T18062] FAULT_INJECTION: forcing a failure. [ 593.399862][T18062] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 593.476909][T18062] CPU: 0 UID: 0 PID: 18062 Comm: syz.0.3410 Not tainted syzkaller #0 PREEMPT(full) [ 593.476941][T18062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 593.476954][T18062] Call Trace: [ 593.476963][T18062] [ 593.476973][T18062] dump_stack_lvl+0x189/0x250 [ 593.477004][T18062] ? __pfx____ratelimit+0x10/0x10 [ 593.477025][T18062] ? __pfx_dump_stack_lvl+0x10/0x10 [ 593.477052][T18062] ? __pfx__printk+0x10/0x10 [ 593.477097][T18062] should_fail_ex+0x414/0x560 [ 593.477136][T18062] _copy_to_user+0x31/0xb0 [ 593.477164][T18062] simple_read_from_buffer+0xe1/0x170 [ 593.477196][T18062] proc_fail_nth_read+0x1b3/0x220 [ 593.477223][T18062] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 593.477251][T18062] ? rw_verify_area+0x2a6/0x4d0 [ 593.477270][T18062] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 593.477295][T18062] vfs_read+0x200/0xa30 [ 593.477315][T18062] ? fdget_pos+0x247/0x320 [ 593.477347][T18062] ? __pfx___mutex_lock+0x10/0x10 [ 593.477372][T18062] ? __pfx_vfs_read+0x10/0x10 [ 593.477394][T18062] ? __fget_files+0x2a/0x420 [ 593.477425][T18062] ? __fget_files+0x3a0/0x420 [ 593.477451][T18062] ? __fget_files+0x2a/0x420 [ 593.477489][T18062] ksys_read+0x145/0x250 [ 593.477514][T18062] ? __pfx_ksys_read+0x10/0x10 [ 593.477540][T18062] ? do_syscall_64+0xbe/0xf80 [ 593.477568][T18062] do_syscall_64+0xfa/0xf80 [ 593.477592][T18062] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.477613][T18062] ? clear_bhb_loop+0x60/0xb0 [ 593.477639][T18062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.477660][T18062] RIP: 0033:0x7fad4af8e15c [ 593.477679][T18062] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 593.477698][T18062] RSP: 002b:00007fad491f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 593.477721][T18062] RAX: ffffffffffffffda RBX: 00007fad4b1e5fa0 RCX: 00007fad4af8e15c [ 593.477738][T18062] RDX: 000000000000000f RSI: 00007fad491f60a0 RDI: 0000000000000004 [ 593.477759][T18062] RBP: 00007fad491f6090 R08: 0000000000000000 R09: 0000000000000000 [ 593.477773][T18062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 593.477786][T18062] R13: 00007fad4b1e6038 R14: 00007fad4b1e5fa0 R15: 00007fff898fab68 [ 593.477824][T18062] [ 593.516964][T18064] ip6_vti0 speed is unknown, defaulting to 1000 [ 594.160622][T18072] __nla_validate_parse: 6 callbacks suppressed [ 594.160646][T18072] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3415'. [ 594.458521][T18080] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3416'. [ 594.547643][T18083] netlink: zone id is out of range [ 594.603086][T18083] netlink: zone id is out of range [ 594.637519][T18083] netlink: zone id is out of range [ 594.670398][T18083] netlink: set zone limit has 8 unknown bytes [ 594.677341][T18086] tipc: Enabled bearer , priority 0 [ 594.686308][T18086] syzkaller0: entered promiscuous mode [ 594.700928][T18086] syzkaller0: entered allmulticast mode [ 594.738128][T18086] tipc: Resetting bearer [ 594.846137][T18084] tipc: Resetting bearer [ 594.901273][T18084] tipc: Disabling bearer [ 595.168990][T18095] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3419'. [ 595.205010][T18076] ip6_vti0 speed is unknown, defaulting to 1000 [ 595.211572][T18095] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3419'. [ 595.257439][T18095] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3419'. [ 595.446471][T18100] syzkaller0: entered promiscuous mode [ 595.470752][T18100] syzkaller0: entered allmulticast mode [ 595.714924][T18082] ip6_vti0 speed is unknown, defaulting to 1000 [ 595.852115][T18121] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3427'. [ 595.872590][T18118] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 595.884353][T18122] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3424'. [ 595.895840][T18118] bond1 (unregistering): Released all slaves [ 595.928281][T18122] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3424'. [ 597.403973][T18137] ip6_vti0: left promiscuous mode [ 597.522282][T18137] 8021q: adding VLAN 0 to HW filter on device bond0 [ 597.532760][T18137] 8021q: adding VLAN 0 to HW filter on device team0 [ 597.554328][T18137] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 598.151857][T18154] ip6_vti0 speed is unknown, defaulting to 1000 [ 598.195174][T18150] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3436'. [ 598.241804][T18156] netlink: 'syz.1.3438': attribute type 1 has an invalid length. [ 598.350183][T18160] bond1: (slave bridge3): making interface the new active one [ 598.364700][T18160] bond1: (slave bridge3): Enslaving as an active interface with an up link [ 598.395706][T18162] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3440'. [ 598.905486][T18171] netlink: zone id is out of range [ 598.929309][T18167] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 598.947013][T18171] netlink: zone id is out of range [ 598.967250][T18171] netlink: zone id is out of range [ 598.987212][T18171] netlink: set zone limit has 8 unknown bytes [ 599.009688][T18167] bond3 (unregistering): Released all slaves [ 599.439405][T18166] ip6_vti0 speed is unknown, defaulting to 1000 [ 600.040774][T18183] __nla_validate_parse: 2 callbacks suppressed [ 600.040793][T18183] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3445'. [ 600.161643][T18181] ip6_vti0 speed is unknown, defaulting to 1000 [ 600.272814][T18186] tipc: Started in network mode [ 600.308246][T18186] tipc: Node identity 080211, cluster identity 4711 [ 600.322992][T18186] tipc: Enabled bearer , priority 0 [ 600.358677][T18187] mac80211_hwsim hwsim46 syzkaller0: entered promiscuous mode [ 600.413158][T18187] mac80211_hwsim hwsim46 syzkaller0: entered allmulticast mode [ 600.438386][T18186] tipc: Resetting bearer [ 600.808377][T18201] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3451'. [ 601.162793][T18220] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 601.176144][T18216] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3455'. [ 601.176410][T18220] bond1 (unregistering): Released all slaves [ 601.288514][T18216] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3455'. [ 601.468255][T16446] tipc: Node number set to 134353152 [ 601.471368][T18225] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3457'. [ 601.584979][T18227] netlink: zone id is out of range [ 601.634905][T18227] netlink: zone id is out of range [ 601.762365][T18227] netlink: zone id is out of range [ 601.852050][T18227] netlink: set zone limit has 8 unknown bytes [ 601.928909][T18223] ip6_vti0 speed is unknown, defaulting to 1000 [ 603.627413][T18250] vlan2: entered promiscuous mode [ 603.650153][T18250] syz_tun: entered promiscuous mode [ 604.017909][T18260] FAULT_INJECTION: forcing a failure. [ 604.017909][T18260] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 604.031280][T18260] CPU: 1 UID: 0 PID: 18260 Comm: syz.0.3467 Not tainted syzkaller #0 PREEMPT(full) [ 604.031311][T18260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 604.031325][T18260] Call Trace: [ 604.031334][T18260] [ 604.031343][T18260] dump_stack_lvl+0x189/0x250 [ 604.031375][T18260] ? __pfx____ratelimit+0x10/0x10 [ 604.031397][T18260] ? __pfx_dump_stack_lvl+0x10/0x10 [ 604.031423][T18260] ? __pfx__printk+0x10/0x10 [ 604.031454][T18260] ? __might_fault+0xb0/0x130 [ 604.031499][T18260] should_fail_ex+0x414/0x560 [ 604.031550][T18260] _copy_from_user+0x2d/0xb0 [ 604.031594][T18260] ___sys_sendmsg+0x158/0x2a0 [ 604.031624][T18260] ? __pfx____sys_sendmsg+0x10/0x10 [ 604.031658][T18260] ? rcu_read_lock_any_held+0xb3/0x120 [ 604.031717][T18260] ? __fget_files+0x2a/0x420 [ 604.031744][T18260] ? __fget_files+0x3a0/0x420 [ 604.031782][T18260] __x64_sys_sendmsg+0x19b/0x260 [ 604.031812][T18260] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 604.031850][T18260] ? __pfx_ksys_write+0x10/0x10 [ 604.031877][T18260] ? do_syscall_64+0xbe/0xf80 [ 604.031904][T18260] do_syscall_64+0xfa/0xf80 [ 604.031927][T18260] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.031949][T18260] ? clear_bhb_loop+0x60/0xb0 [ 604.031975][T18260] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.031995][T18260] RIP: 0033:0x7fad4af8f749 [ 604.032015][T18260] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 604.032033][T18260] RSP: 002b:00007fad491f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 604.032057][T18260] RAX: ffffffffffffffda RBX: 00007fad4b1e5fa0 RCX: 00007fad4af8f749 [ 604.032073][T18260] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 000000000000000c [ 604.032087][T18260] RBP: 00007fad491f6090 R08: 0000000000000000 R09: 0000000000000000 [ 604.032100][T18260] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 604.032113][T18260] R13: 00007fad4b1e6038 R14: 00007fad4b1e5fa0 R15: 00007fff898fab68 [ 604.032149][T18260] [ 604.515227][T18262] vlan2: entered promiscuous mode [ 604.520973][T18262] bridge0: entered promiscuous mode [ 604.759775][T18270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3469'. [ 604.811938][T18268] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 604.822404][T18270] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3469'. [ 604.834127][T18274] x_tables: duplicate underflow at hook 1 [ 604.844749][T18268] bond3 (unregistering): Released all slaves [ 604.893694][T18276] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3470'. [ 604.989044][T18276] ip6_vti0 speed is unknown, defaulting to 1000 [ 605.537161][T18284] ip6_vti0 speed is unknown, defaulting to 1000 [ 605.569585][T18287] netlink: zone id is out of range [ 605.574771][T18287] netlink: zone id is out of range [ 605.607259][T18287] netlink: zone id is out of range [ 605.612842][T18287] netlink: set zone limit has 8 unknown bytes [ 605.945683][T18299] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3478'. [ 605.986879][T18299] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3478'. [ 606.015049][T18299] netlink: 'syz.2.3478': attribute type 18 has an invalid length. [ 606.133574][T18305] vlan2: entered promiscuous mode [ 606.214477][T18310] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3483'. [ 606.463946][T18319] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3486'. [ 606.725796][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3487'. [ 606.819034][T18329] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3487'. [ 607.009507][T18327] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 607.036609][T18327] bond2 (unregistering): Released all slaves [ 607.143095][T18334] ip6_vti0 speed is unknown, defaulting to 1000 [ 607.691605][T18349] FAULT_INJECTION: forcing a failure. [ 607.691605][T18349] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 607.704992][T18349] CPU: 1 UID: 0 PID: 18349 Comm: syz.2.3494 Not tainted syzkaller #0 PREEMPT(full) [ 607.705022][T18349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 607.705037][T18349] Call Trace: [ 607.705047][T18349] [ 607.705056][T18349] dump_stack_lvl+0x189/0x250 [ 607.705089][T18349] ? __pfx____ratelimit+0x10/0x10 [ 607.705111][T18349] ? __pfx_dump_stack_lvl+0x10/0x10 [ 607.705138][T18349] ? __pfx__printk+0x10/0x10 [ 607.705170][T18349] ? __might_fault+0xb0/0x130 [ 607.705215][T18349] should_fail_ex+0x414/0x560 [ 607.705253][T18349] _copy_from_iter+0x1cd/0x1630 [ 607.705282][T18349] ? __build_skb_around+0x22d/0x3c0 [ 607.705312][T18349] ? __pfx__copy_from_iter+0x10/0x10 [ 607.705332][T18349] ? __alloc_skb+0x2f1/0x430 [ 607.705357][T18349] ? __pfx___alloc_skb+0x10/0x10 [ 607.705383][T18349] ? netlink_sendmsg+0x642/0xb30 [ 607.705409][T18349] ? skb_put+0x11b/0x210 [ 607.705437][T18349] netlink_sendmsg+0x6b2/0xb30 [ 607.705476][T18349] ? __pfx_netlink_sendmsg+0x10/0x10 [ 607.705508][T18349] ? aa_sock_msg_perm+0xf1/0x1b0 [ 607.705538][T18349] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 607.705559][T18349] ? __pfx_netlink_sendmsg+0x10/0x10 [ 607.705597][T18349] __sock_sendmsg+0x21c/0x270 [ 607.705633][T18349] ____sys_sendmsg+0x505/0x820 [ 607.705678][T18349] ? __pfx_____sys_sendmsg+0x10/0x10 [ 607.705714][T18349] ? import_iovec+0x74/0xa0 [ 607.705742][T18349] ___sys_sendmsg+0x21f/0x2a0 [ 607.705769][T18349] ? __pfx____sys_sendmsg+0x10/0x10 [ 607.705801][T18349] ? rcu_read_lock_any_held+0xb3/0x120 [ 607.705858][T18349] ? __fget_files+0x2a/0x420 [ 607.705883][T18349] ? __fget_files+0x3a0/0x420 [ 607.705920][T18349] __x64_sys_sendmsg+0x19b/0x260 [ 607.705948][T18349] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 607.705985][T18349] ? __pfx_ksys_write+0x10/0x10 [ 607.706009][T18349] ? do_syscall_64+0xbe/0xf80 [ 607.706036][T18349] do_syscall_64+0xfa/0xf80 [ 607.706059][T18349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.706079][T18349] ? clear_bhb_loop+0x60/0xb0 [ 607.706104][T18349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.706124][T18349] RIP: 0033:0x7fa90478f749 [ 607.706143][T18349] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 607.706161][T18349] RSP: 002b:00007fa9029f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 607.706183][T18349] RAX: ffffffffffffffda RBX: 00007fa9049e5fa0 RCX: 00007fa90478f749 [ 607.706199][T18349] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 000000000000000c [ 607.706212][T18349] RBP: 00007fa9029f6090 R08: 0000000000000000 R09: 0000000000000000 [ 607.706243][T18349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 607.706256][T18349] R13: 00007fa9049e6038 R14: 00007fa9049e5fa0 R15: 00007fff841b90e8 [ 607.706293][T18349] [ 608.223951][T18354] syz_tun: entered promiscuous mode [ 608.230837][T18354] vlan0: entered promiscuous mode [ 608.453522][T18358] ip6_vti0 speed is unknown, defaulting to 1000 [ 609.290498][T18374] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3502'. [ 609.351189][T18374] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3502'. [ 609.404149][T18372] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 609.478697][T18372] bond1 (unregistering): Released all slaves [ 609.616360][T18379] netlink: zone id is out of range [ 609.637129][T18379] netlink: zone id is out of range [ 609.642433][T18379] netlink: zone id is out of range [ 609.717453][T18379] netlink: set zone limit has 8 unknown bytes [ 609.831015][T18377] ip6_vti0 speed is unknown, defaulting to 1000 [ 610.500520][T18385] FAULT_INJECTION: forcing a failure. [ 610.500520][T18385] name failslab, interval 1, probability 0, space 0, times 0 [ 610.556941][T18385] CPU: 0 UID: 0 PID: 18385 Comm: syz.1.3506 Not tainted syzkaller #0 PREEMPT(full) [ 610.556972][T18385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 610.556987][T18385] Call Trace: [ 610.556996][T18385] [ 610.557006][T18385] dump_stack_lvl+0x189/0x250 [ 610.557054][T18385] ? __pfx____ratelimit+0x10/0x10 [ 610.557076][T18385] ? __pfx_dump_stack_lvl+0x10/0x10 [ 610.557102][T18385] ? __pfx__printk+0x10/0x10 [ 610.557135][T18385] ? __lock_acquire+0x6b6/0x2cf0 [ 610.557169][T18385] should_fail_ex+0x414/0x560 [ 610.557207][T18385] should_failslab+0xa8/0x100 [ 610.557236][T18385] kmem_cache_alloc_noprof+0x88/0x710 [ 610.557268][T18385] ? __netlink_lookup+0xbd/0x8a0 [ 610.557299][T18385] ? skb_clone+0x212/0x3a0 [ 610.557331][T18385] skb_clone+0x212/0x3a0 [ 610.557363][T18385] __netlink_deliver_tap+0x404/0x850 [ 610.557413][T18385] ? netlink_deliver_tap+0x2e/0x1b0 [ 610.557443][T18385] netlink_deliver_tap+0x19c/0x1b0 [ 610.557472][T18385] netlink_unicast+0x7fa/0x9e0 [ 610.557508][T18385] ? __pfx_netlink_unicast+0x10/0x10 [ 610.557535][T18385] ? netlink_sendmsg+0x642/0xb30 [ 610.557561][T18385] ? skb_put+0x11b/0x210 [ 610.557589][T18385] netlink_sendmsg+0x805/0xb30 [ 610.557628][T18385] ? __pfx_netlink_sendmsg+0x10/0x10 [ 610.557660][T18385] ? aa_sock_msg_perm+0xf1/0x1b0 [ 610.557691][T18385] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 610.557712][T18385] ? __pfx_netlink_sendmsg+0x10/0x10 [ 610.557741][T18385] __sock_sendmsg+0x21c/0x270 [ 610.557777][T18385] ____sys_sendmsg+0x505/0x820 [ 610.557810][T18385] ? __pfx_____sys_sendmsg+0x10/0x10 [ 610.557847][T18385] ? import_iovec+0x74/0xa0 [ 610.557878][T18385] ___sys_sendmsg+0x21f/0x2a0 [ 610.557904][T18385] ? __pfx____sys_sendmsg+0x10/0x10 [ 610.557939][T18385] ? rcu_read_lock_any_held+0xb3/0x120 [ 610.557999][T18385] ? __fget_files+0x2a/0x420 [ 610.558025][T18385] ? __fget_files+0x3a0/0x420 [ 610.558065][T18385] __x64_sys_sendmsg+0x19b/0x260 [ 610.558094][T18385] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 610.558133][T18385] ? __pfx_ksys_write+0x10/0x10 [ 610.558159][T18385] ? do_syscall_64+0xbe/0xf80 [ 610.558187][T18385] do_syscall_64+0xfa/0xf80 [ 610.558211][T18385] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.558232][T18385] ? clear_bhb_loop+0x60/0xb0 [ 610.558259][T18385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.558280][T18385] RIP: 0033:0x7fb97c38f749 [ 610.558300][T18385] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 610.558319][T18385] RSP: 002b:00007fb97d165038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 610.558342][T18385] RAX: ffffffffffffffda RBX: 00007fb97c5e5fa0 RCX: 00007fb97c38f749 [ 610.558359][T18385] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 000000000000000c [ 610.558373][T18385] RBP: 00007fb97d165090 R08: 0000000000000000 R09: 0000000000000000 [ 610.558392][T18385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.558405][T18385] R13: 00007fb97c5e6038 R14: 00007fb97c5e5fa0 R15: 00007ffe58abe348 [ 610.558442][T18385] [ 610.875008][T18385] vlan2: entered promiscuous mode [ 611.085926][T18395] netlink: 'syz.2.3508': attribute type 10 has an invalid length. [ 611.523587][T18407] ip6_vti0 speed is unknown, defaulting to 1000 [ 611.777402][T18419] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3515'. [ 611.807916][T18421] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3516'. [ 611.818433][T18419] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3515'. [ 611.908382][T18417] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 612.004273][T18417] bond2 (unregistering): Released all slaves [ 612.381700][T18437] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3519'. [ 612.689067][T18446] FAULT_INJECTION: forcing a failure. [ 612.689067][T18446] name failslab, interval 1, probability 0, space 0, times 0 [ 612.746836][T18446] CPU: 1 UID: 0 PID: 18446 Comm: syz.1.3521 Not tainted syzkaller #0 PREEMPT(full) [ 612.746867][T18446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 612.746881][T18446] Call Trace: [ 612.746890][T18446] [ 612.746901][T18446] dump_stack_lvl+0x189/0x250 [ 612.746931][T18446] ? __pfx____ratelimit+0x10/0x10 [ 612.746952][T18446] ? __pfx_dump_stack_lvl+0x10/0x10 [ 612.746978][T18446] ? __pfx__printk+0x10/0x10 [ 612.747010][T18446] ? __lock_acquire+0x6b6/0x2cf0 [ 612.747044][T18446] should_fail_ex+0x414/0x560 [ 612.747083][T18446] should_failslab+0xa8/0x100 [ 612.747116][T18446] kmem_cache_alloc_noprof+0x88/0x710 [ 612.747148][T18446] ? __netlink_lookup+0xbd/0x8a0 [ 612.747178][T18446] ? skb_clone+0x212/0x3a0 [ 612.747211][T18446] skb_clone+0x212/0x3a0 [ 612.747242][T18446] __netlink_deliver_tap+0x404/0x850 [ 612.747283][T18446] ? netlink_deliver_tap+0x2e/0x1b0 [ 612.747314][T18446] netlink_deliver_tap+0x19c/0x1b0 [ 612.747343][T18446] netlink_unicast+0x7fa/0x9e0 [ 612.747379][T18446] ? __pfx_netlink_unicast+0x10/0x10 [ 612.747406][T18446] ? netlink_sendmsg+0x642/0xb30 [ 612.747432][T18446] ? skb_put+0x11b/0x210 [ 612.747460][T18446] netlink_sendmsg+0x805/0xb30 [ 612.747509][T18446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 612.747542][T18446] ? aa_sock_msg_perm+0xf1/0x1b0 [ 612.747573][T18446] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 612.747594][T18446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 612.747624][T18446] __sock_sendmsg+0x21c/0x270 [ 612.747660][T18446] ____sys_sendmsg+0x505/0x820 [ 612.747693][T18446] ? __pfx_____sys_sendmsg+0x10/0x10 [ 612.747731][T18446] ? import_iovec+0x74/0xa0 [ 612.747761][T18446] ___sys_sendmsg+0x21f/0x2a0 [ 612.747791][T18446] ? __pfx____sys_sendmsg+0x10/0x10 [ 612.747825][T18446] ? rcu_read_lock_any_held+0xb3/0x120 [ 612.747887][T18446] ? __fget_files+0x2a/0x420 [ 612.747913][T18446] ? __fget_files+0x3a0/0x420 [ 612.747953][T18446] __x64_sys_sendmsg+0x19b/0x260 [ 612.747983][T18446] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 612.748020][T18446] ? __pfx_ksys_write+0x10/0x10 [ 612.748047][T18446] ? do_syscall_64+0xbe/0xf80 [ 612.748075][T18446] do_syscall_64+0xfa/0xf80 [ 612.748100][T18446] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.748122][T18446] ? clear_bhb_loop+0x60/0xb0 [ 612.748148][T18446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.748169][T18446] RIP: 0033:0x7fb97c38f749 [ 612.748190][T18446] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 612.748208][T18446] RSP: 002b:00007fb97d165038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 612.748232][T18446] RAX: ffffffffffffffda RBX: 00007fb97c5e5fa0 RCX: 00007fb97c38f749 [ 612.748249][T18446] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 000000000000000c [ 612.748263][T18446] RBP: 00007fb97d165090 R08: 0000000000000000 R09: 0000000000000000 [ 612.748276][T18446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 612.748288][T18446] R13: 00007fb97c5e6038 R14: 00007fb97c5e5fa0 R15: 00007ffe58abe348 [ 612.748325][T18446] [ 613.459004][T18446] vlan2: entered promiscuous mode [ 613.881359][T18453] ip6_vti0 speed is unknown, defaulting to 1000 [ 613.990305][T18458] netlink: zone id is out of range [ 614.038218][T18458] netlink: zone id is out of range [ 614.090379][T18458] netlink: zone id is out of range [ 614.151532][T18458] netlink: set zone limit has 8 unknown bytes [ 614.200993][T18468] netlink: 'syz.3.3527': attribute type 83 has an invalid length. [ 614.581213][T18475] ip6gretap0: entered promiscuous mode [ 614.607455][T18475] vlan2: entered promiscuous mode [ 615.041004][T18489] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3532'. [ 615.054473][T18489] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3532'. [ 615.090902][T18487] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 615.125995][T18486] netlink: 'syz.2.3531': attribute type 13 has an invalid length. [ 615.184029][T18487] bond3 (unregistering): Released all slaves [ 615.401464][T18485] bond1: option arp_validate: invalid value (18446744073491447809) [ 615.452981][T18485] bond1 (unregistering): Released all slaves [ 616.041762][T18486] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.049596][T18486] bridge0: port 1(bridge_slave_0) entered disabled state [ 616.669743][T18486] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 616.730022][T18486] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 617.350979][ T1114] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.366225][ T1114] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.408587][ T1114] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.441737][ T1114] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.502766][T18516] pim6reg1: entered promiscuous mode [ 617.517087][T18516] pim6reg1: entered allmulticast mode [ 617.743135][T18527] sctp: [Deprecated]: syz.3.3541 (pid 18527) Use of int in max_burst socket option. [ 617.743135][T18527] Use struct sctp_assoc_value instead [ 617.930162][T18530] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 618.101648][T18535] netlink: 600 bytes leftover after parsing attributes in process `syz.4.3547'. [ 618.347688][T18545] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 64993 [ 618.483194][T18545] can: request_module (can-proto-5) failed. [ 618.617056][T18552] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3552'. [ 618.625982][T18552] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3552'. [ 618.781717][T18550] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 618.931700][T18550] bond2 (unregistering): Released all slaves [ 619.084137][T18559] ip6_vti0 speed is unknown, defaulting to 1000 [ 619.528970][T18533] ip6_vti0 speed is unknown, defaulting to 1000 [ 619.942500][T18567] netlink: zone id is out of range [ 619.970772][T18567] netlink: zone id is out of range [ 619.976079][T18567] netlink: zone id is out of range [ 620.021259][T18567] netlink: set zone limit has 8 unknown bytes [ 620.133377][T18565] ip6_vti0 speed is unknown, defaulting to 1000 [ 621.209721][T18578] ip6_vti0 speed is unknown, defaulting to 1000 [ 621.306222][T18582] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3559'. [ 622.190002][T18607] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3566'. [ 622.317068][T18612] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3565'. [ 622.337608][T18610] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 622.382063][T18612] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3565'. [ 622.474121][T18610] bond3 (unregistering): Released all slaves [ 622.604327][T18619] netlink: zone id is out of range [ 622.695358][T18619] netlink: zone id is out of range [ 622.777098][T18619] netlink: zone id is out of range [ 622.782754][T18619] netlink: set zone limit has 8 unknown bytes [ 623.035591][T18614] ip6_vti0 speed is unknown, defaulting to 1000 [ 623.651867][T18645] 8021q: VLANs not supported on ip6gre0 [ 623.779481][T18640] ip6_vti0 speed is unknown, defaulting to 1000 [ 624.729498][T18662] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 624.779133][T18662] bond3 (unregistering): Released all slaves [ 624.928706][T18671] tipc: Enabling of bearer rejected, already enabled [ 625.341103][T18681] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3586'. [ 625.412650][T18682] gre0: entered promiscuous mode [ 625.436927][T18682] gre0: entered allmulticast mode [ 625.466567][T18684] vlan0: entered promiscuous mode [ 625.767406][T18692] ip6_vti0 speed is unknown, defaulting to 1000 [ 625.883820][T18699] netlink: zone id is out of range [ 625.918182][T18699] netlink: zone id is out of range [ 625.951461][T18699] netlink: zone id is out of range [ 625.976454][T18699] netlink: set zone limit has 8 unknown bytes [ 626.205674][T18706] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 626.469652][T18711] netlink: 'syz.1.3595': attribute type 10 has an invalid length. [ 626.489981][T18711] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3595'. [ 626.508282][T18711] batadv0: entered promiscuous mode [ 626.520802][T18711] batadv0: entered allmulticast mode [ 626.537969][T18711] bridge0: port 3(batadv0) entered blocking state [ 626.558629][T18711] bridge0: port 3(batadv0) entered disabled state [ 626.619731][ T5842] Bluetooth: hci5: command 0x0406 tx timeout [ 626.846419][T18720] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 626.869666][T18725] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3598'. [ 626.899934][T18720] bond2 (unregistering): Released all slaves [ 626.927552][T11057] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 626.937414][T11057] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 626.950651][T18698] ip6_vti0 speed is unknown, defaulting to 1000 [ 626.971176][T18725] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3598'. [ 627.523766][T18741] netlink: 220 bytes leftover after parsing attributes in process `syz.0.3604'. [ 627.579113][T18741] ip6gretap0: entered promiscuous mode [ 627.589268][T18741] vlan2: entered promiscuous mode [ 628.477955][T18765] ip6_vti0 speed is unknown, defaulting to 1000 [ 628.528465][T18768] netlink: zone id is out of range [ 628.544226][T18768] netlink: zone id is out of range [ 628.552504][T18768] netlink: zone id is out of range [ 628.575929][T18768] netlink: set zone limit has 8 unknown bytes [ 628.888824][T18775] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 628.902409][T18775] team0: Device ipvlan2 failed to register rx_handler [ 629.068369][T18780] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3616'. [ 629.094668][T18780] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3616'. [ 629.181883][T18781] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 629.259989][T18781] bond2 (unregistering): Released all slaves [ 629.858417][T18791] ip6_vti0 speed is unknown, defaulting to 1000 [ 629.894999][T18797] 8021q: VLANs not supported on ip6gre0 [ 630.907186][T18825] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3630'. [ 630.948226][T18825] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3630'. [ 631.057765][T18823] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 631.144481][T18823] bond2 (unregistering): Released all slaves [ 631.218222][T18832] 8021q: VLANs not supported on ip6gre0 [ 632.075887][T18822] ip6_vti0 speed is unknown, defaulting to 1000 [ 632.351460][T18843] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3638'. [ 632.617890][T18845] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.749228][T18845] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.867230][T18850] ip6_vti0 speed is unknown, defaulting to 1000 [ 632.930196][T18845] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.116120][T18845] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.403209][ T37] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.481646][ T34] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.645512][T17416] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.686433][T17416] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.818907][T18861] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3642'. [ 633.872152][T18859] ip6_vti0 speed is unknown, defaulting to 1000 [ 633.949159][T18865] netlink: zone id is out of range [ 633.982158][T18865] netlink: zone id is out of range [ 634.061889][T18865] netlink: zone id is out of range [ 634.152063][T18865] netlink: set zone limit has 8 unknown bytes [ 634.508602][T18872] vlan2: entered promiscuous mode [ 634.557993][T18875] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3646'. [ 634.606999][T18875] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3646'. [ 634.690483][T18873] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 634.722805][T18873] bond1 (unregistering): Released all slaves [ 635.333640][T18899] Bluetooth: MGMT ver 1.23 [ 635.368806][T18899] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3656'. [ 635.989514][T18908] ip6_vti0 speed is unknown, defaulting to 1000 [ 636.421615][T18917] 8021q: VLANs not supported on ip6gre0 [ 636.746064][T18922] vlan2: entered promiscuous mode [ 636.859620][ T5150] Bluetooth: hci1: command 0x040f tx timeout [ 637.049749][T18930] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3665'. [ 637.099577][T18930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3665'. [ 637.168440][T18928] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 637.198878][T18928] bond2 (unregistering): Released all slaves [ 637.297448][T18932] vlan2: entered promiscuous mode [ 637.737580][ T1168] 0: reclassify loop, rule prio 0, protocol 800 [ 637.921886][T18943] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3670'. [ 638.165052][T18948] ip6_vti0 speed is unknown, defaulting to 1000 [ 638.292145][T18955] netlink: zone id is out of range [ 638.297848][T18955] netlink: zone id is out of range [ 638.303106][T18955] netlink: zone id is out of range [ 638.317447][T18955] netlink: set zone limit has 8 unknown bytes [ 638.471330][T18957] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3674'. [ 638.517196][T18957] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3674'. [ 639.165095][T18971] vlan2: entered promiscuous mode [ 639.250356][T18961] ip6_vti0 speed is unknown, defaulting to 1000 [ 639.440487][T18979] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3682'. [ 639.459500][T18986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3680'. [ 639.510943][T18986] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3680'. [ 639.526203][T18976] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 639.544180][T18976] bond2 (unregistering): Released all slaves [ 639.766668][T18985] ip6_vti0 speed is unknown, defaulting to 1000 [ 639.767186][T18988] tipc: Started in network mode [ 639.778633][T18988] tipc: Node identity 66984af24e7e, cluster identity 4711 [ 639.820325][T18988] tipc: Enabled bearer , priority 0 [ 639.870453][T18988] syzkaller0: entered promiscuous mode [ 639.876044][T18988] syzkaller0: entered allmulticast mode [ 640.094548][T18988] tipc: Resetting bearer [ 640.112380][T18987] tipc: Resetting bearer [ 640.172322][T18987] tipc: Disabling bearer [ 640.693015][T18998] dummy0: entered allmulticast mode [ 641.265553][T19008] ip6_vti0 speed is unknown, defaulting to 1000 [ 641.282762][T19013] netlink: 'syz.2.3692': attribute type 1 has an invalid length. [ 641.771861][T19024] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3695'. [ 641.800147][T19024] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3695'. [ 641.921248][T19022] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 641.964512][T19022] bond3 (unregistering): Released all slaves [ 642.167144][T19012] ip6_vti0 speed is unknown, defaulting to 1000 [ 643.369198][T19036] netlink: 'syz.3.3698': attribute type 9 has an invalid length. [ 643.451219][T19035] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3698'. [ 643.815430][T19039] vlan2: entered promiscuous mode [ 643.953167][T19041] ip6_vti0 speed is unknown, defaulting to 1000 [ 644.308401][T19050] syzkaller1: entered promiscuous mode [ 644.324931][T19050] syzkaller1: entered allmulticast mode [ 644.418411][T19054] netlink: zone id is out of range [ 644.431792][T19054] netlink: zone id is out of range [ 644.448726][T19054] netlink: zone id is out of range [ 644.465332][T19054] netlink: set zone limit has 8 unknown bytes [ 644.516059][T19048] ip6_vti0 speed is unknown, defaulting to 1000 [ 644.848299][T19069] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3706'. [ 644.859853][T19065] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 644.873237][T19065] bond3 (unregistering): Released all slaves [ 644.987616][T19069] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3706'. [ 645.745484][T19076] syz_tun: entered promiscuous mode [ 645.762293][T19076] vlan2: entered promiscuous mode [ 646.054813][T19079] syzkaller0: entered promiscuous mode [ 646.060881][T19079] syzkaller0: entered allmulticast mode [ 646.165589][T19089] ip6_vti0 speed is unknown, defaulting to 1000 [ 647.097921][ T5150] Bluetooth: hci0: command 0x0409 tx timeout [ 647.374042][T19106] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3722'. [ 647.397516][T19106] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3722'. [ 648.115649][T19105] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 648.211647][T19097] ip6_vti0 speed is unknown, defaulting to 1000 [ 649.073027][T19122] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3728'. [ 649.099313][T19126] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.3727'. [ 649.132140][T19126] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 649.446593][T19130] vlan2: entered promiscuous mode [ 649.527303][T11060] unregister_netdevice: waiting for lo to become free. Usage count = 2 [ 649.547264][T11060] ref_tracker: netdev@ffff888031e34618 has 1/1 users at [ 649.547264][T11060] netdev_get_by_index+0x79/0xb0 [ 649.547264][T11060] fib6_nh_init+0x1cd/0x1ff0 [ 649.547264][T11060] rtm_new_nexthop+0x38d6/0x8130 [ 649.547264][T11060] rtnetlink_rcv_msg+0x7cf/0xb70 [ 649.547264][T11060] netlink_rcv_skb+0x208/0x470 [ 649.547264][T11060] netlink_unicast+0x82f/0x9e0 [ 649.547264][T11060] netlink_sendmsg+0x805/0xb30 [ 649.547264][T11060] __sock_sendmsg+0x21c/0x270 [ 649.547264][T11060] ____sys_sendmsg+0x505/0x820 [ 649.547264][T11060] ___sys_sendmsg+0x21f/0x2a0 [ 649.547264][T11060] __x64_sys_sendmsg+0x19b/0x260 [ 649.547264][T11060] do_syscall_64+0xfa/0xf80 [ 649.547264][T11060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.547264][T11060] [ 657.337041][ T5842] Bluetooth: hci3: command 0x041b tx timeout