last executing test programs: 3.940247275s ago: executing program 4 (id=1368): socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB], 0x6c}}, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x5}, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@ipv4_newroute={0x1c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x5}}, 0x1c}, 0x1, 0x0, 0x0, 0x4d0}, 0x4000050) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) syz_genetlink_get_family_id$nl802154(&(0x7f0000001100), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r7}, 0x10) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x11e, 0x488, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r9}, 0x10) ppoll(&(0x7f0000000500)=[{r8, 0x2000}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xb7, 0x7, 0x8000300, 0x1000000, 0x801, 0x8, 0xfffffffffffffc01}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x80003, 0x6, 0x3f9a, 0x0, 0x8000000010001, 0x9af}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r10 = syz_init_net_socket$ax25(0x3, 0x5, 0x33) ioctl$sock_FIOGETOWN(r10, 0x8903, &(0x7f0000000180)) close(r2) 2.844700683s ago: executing program 4 (id=1382): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x8800, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r0, 0x107, 0x15, 0x0, &(0x7f0000000100)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f00000001c0)={'ipvlan1\x00', 0x400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x2, 0x9}, 0x20) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b031200e0ff64000200475400f6a13b88a8", 0x36, 0x0, &(0x7f0000000140)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @local}, 0x14) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000200)={'caif0\x00', 0x400}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=@base={0x2, 0x4, 0x1004, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x1, r7}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r8}, &(0x7f0000000840), &(0x7f0000000880)=r7}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r8, &(0x7f0000000900)}, 0x20) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x350, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x320, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "936cfa6e7f486b45f70640d21d75cf02d28204d23a9e030990ab5ba0b6c22a310b2bb141bfe458d36eefa59a8ae1f1a7d9448760a3a8cfa749d699f976f0a02dd96accc2e1eca5dd122eb26473a6c1e18d05b0915bc7a6b4fd004c8322c929599488d2cba2936aae8c90e5292caf2e440db579ec5fbb17b64942b95f6da2024f6205390e4702ac2e6c7b60806cfe3903ba6428a6c8782bfbf8d374b1f363bd0bafdc50fd9d2ae2b5593b5aea1f0459527975f73ab8712f0e5c8994c933637ac71a3e9b3e89b770aec0aa90a9f6353838d3a4610ba8bfcbb28b05eadfb78961a1c8efc203739a6784eef953356bf3d357e7e4aa9ba5a68ec6a5a64b511024cdbf"}, @TCA_GRED_LIMIT={0x8, 0x5, 0x3}, @TCA_GRED_STAB={0x104, 0x2, "a7487241196ee8037a503169b80e84ecd0f80d3fcd1b8160ba840072dab7552ff8adcfe74792a15b4a7e95038885c31b45eea82cd0e07711972c23c1525ce9a3db6fb4d31cb43c51559c6cca4adabc76161105525064c05fe7d1f07b4a479bcbece7513a099115b8ccd6935833e79ff6e083b2840ac23ef7e6314e1c209904d56f2786252cb765b849b21a8ceccdc3c0e217816bc3868802b59320fcc4cc2a6bd6eb499b4fa71f5a2efb94e8264b027708015e8b40404ae8c0ec4df9a04bc1eb019686860092ce8575aa69b760a96e939e3b3db9ab0e28b2a77ba39b9bbe0723daeaab2ed34c31aaa9a4bb81a5de29deb37edf62b85b5bb12ab93a6e25acc5f7"}, @TCA_GRED_STAB={0xfffffffffffffd7f, 0x2, "36f903f4ccc9b4aded869b490f3e1c606c755f254a7cd53e145981af8ef98f7567521bed5f7073af97cf403cdeb7712a34806e2b4749608cb0ef2b0fc33904f43982b2efa152636d3a3748692353642082495cdd3fe8bfaabe499916d78def67caf0932d91320c71ccd7189892f9eee9e827bc7c2de214d846cf250a1328b292e641bccb4893113a32aed9f44907185c43ca77647fff928fa44ee7c712c78a2d3dffb6e0a31f8df683005fbe153de312cee6bfe0be14d67a4785bd7b4beafb57013203a6ac67424d114e07d094ce023ffcf2f10ae9235fe2724d0264e381233923ab7af0548efe7c12d2b63ba9cbfe2ee603e4ffa6a1aa377c5728751a1b2a8b"}, @TCA_GRED_MAX_P={0x8, 0x4, 0x7}, @TCA_GRED_PARMS={0x0, 0x1, {0x87, 0x7b2a, 0x6, 0x9, 0x5, 0x2, 0x6e5, 0x7, 0x6, 0x5, 0x9, 0x1c, 0xd, 0x6, 0x7, 0x200}}, @TCA_GRED_STAB={0x0, 0x2, "9a493467bcc004b3a62f1e357852daf4a0c32a12657e1da47db416a163ad10fd446ab2e03741af59bc09a5b5533a187787ea150ef0322aeaba59e26b5199c8a6529bdfa57a1713a5b4cc5aca3842850e28f33e338120c7466b17bd38d52cfc4b33bb88ae0d7df6b7e61fc48ace6e276a0a26efb7cc77b421b86953fe1c518a50eb585de298cd25f2a321407db6b4b65a65124c575baeee4f6375282398a240e42b833803605cf44631918b20fee4a863e0b08f8e9c16e5c3082911cb887718ff323ea09e11cd1501f442fa855e16a433e00f2aab1495de281d650bf0ec8876a5e45b36cba61aa0e0352717b0cdb9c89ff1a8ddfaf8c5426a8c8106fc67e5d273"}]}}]}, 0x350}}, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)=ANY=[@ANYBLOB="1800000010f5200057bd7000ffdbdf250800010001000000"], 0x18}, 0x1, 0x0, 0x0, 0x54881}, 0x8000) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000000206010100000000000000000000000005000100070000000900020073797a30000000001400078008001240fffffffe080013400000080015000300686173683a69702c706f72742c6e6574000000000500050002000000050004"], 0x64}, 0x1, 0x0, 0x0, 0x4001}, 0x0) close(r12) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) 2.601192685s ago: executing program 4 (id=1385): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e24, 0x4, @loopback}], 0x1c) sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x44004, &(0x7f0000000100)={0xa, 0x4e24, 0xb, @loopback, 0xc5f}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000003c0)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@chandef_params, @NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x24040890) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="310300000000000000000800000008000300", @ANYRES32=r3, @ANYBLOB="080006"], 0x24}}, 0x0) 2.101071157s ago: executing program 2 (id=1391): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x18, 0x4, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000000040)=0x20, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'ipvlan1\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x18, &(0x7f0000000000)=0x2, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r5}, 0x10) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000340)=0x20000002) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) write(r2, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000003c0000000000000008000f0001000000", 0x24) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[], 0x118}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8, 0x11, r3, 0xc5978000) sendmsg$inet(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000280)="db", 0x1}], 0x1}, 0x41) recvmsg(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x40010041) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c0000000206050000000000000000000700000014000780080008400000009808000640200000000500010006000000050005000a00000005000400000000000900020073797a310000000010000300686173683a69702c6d6163"], 0x5c}}, 0x20000010) 1.975351335s ago: executing program 2 (id=1394): r0 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) r1 = accept(r0, &(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, &(0x7f0000000100)=0x80) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000140)="fcd91c26d49c7a97dccf9546010468d8bb1a715c502225b5e414cf93277980a0", 0x20}], 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a0102000000000000000002001a000900010073797a30000000000900030073797a32000000006b00030091abc12404cf378042f28edd81ab64db88bebd7f"], 0xfc}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}, @NL80211_ATTR_4ADDR={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000801}, 0xc0c4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r7, &(0x7f0000000040)={@val, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x2}, {0x86dd, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @generic={{0x9, 0x4, 0x1, 0x6, 0x24, 0xe4, 0x0, 0x1, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x29}, @rand_addr=0x64010100, {[@lsrr={0x83, 0x7, 0x2a, [@multicast1]}, @generic={0x44, 0x8, "f93b624e058a"}]}}}}}}}, 0x3e) sendmsg$NL80211_CMD_TESTMODE(r1, &(0x7f00000007c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000800)={0x4a8, r6, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0x6b}}}}, [@NL80211_ATTR_TESTDATA={0x75, 0x45, "5918b3fdf06c0b00d55a7e93e6a5766aec74196d265b7d3052b603ec1aadb3f043cf357d21e21f5a8d8aa5ed1f6138b9dea23ebdae7119dd7e5200d281fc10acfaa56b904ecd60ec57fd6ff4c4b8379c3c1d98f61d985d8861bde0cf752907c78d327dd4558288528432a42d0570af3dc9"}, @NL80211_ATTR_TESTDATA={0xf7, 0x45, "17240655c32a606596c7c6e44750ed7cdcbbe5bd59039eea8ef7c63da41e5ec754762fbbc32da82072d1ab95bd872350c3e3ee511b1cbae981c867690a4b6dd7b6baabbaf2f1ae8735d8a8d69ffedc343712e2372bfb1e321a7669a40575c2c59179fcc8ec59115511ab97c59e5878a7cbb18b7604101ddb968b7101297a8aa2657deda4efb8db6baca2b174facaaf8f12e53b6dfd774b5e0238f9ae8693bf7c8021a97a10b7f11d4744f123a5b12dc52d9592fe982a4e27d06ed305fd43ddfa063684f185fa980b1f4a1935cad17d9ffc4bb04bfd5ccf4b734d4c9978d0bb74e77ca4c8c023ddc5adaca032f06e436a9d8775"}, @NL80211_ATTR_TESTDATA={0x10, 0x45, "0fecb9150645ca47ad931495"}, @NL80211_ATTR_TESTDATA={0xf9, 0x45, "a57188eed409d0db2caf84983e985c762cfd8535aab4b110fbff59f0346e94d3121e29083be66da35ae961c5444a650eb3c47c3a6f448d7d448e4e9b194fc6f8dcd3a71163baf7031019f2cddb69e31b53ef5f2e790e126dbd14085b5ce032c5ae0029f8e2fcd310d3d20037302a4036f298a21b7df242b7dc8128f8b7d4bb6949c5183567105a1e0fb2efc3ea1c4b0d80a247636b9e219961f30d3d25e616aecee9789802902ca34e9e36d884d36e9a91b8d85327f6e99544cd9c041d46737965327a531b66231a3890cdd54f5eec97a7da58694c1cab7b7d4ae6bd41a58b00498ae5dcbc4a42fa37ae669a47b222c50e594ceb74"}, @NL80211_ATTR_TESTDATA={0x8d, 0x45, "1b1d5fdc456adaf726a057d2538034f7898f482910b253e2a1cc525cd1aeadac9545383dc7067acae52202b22105bfb7918d718b2cca30b787909ca44e73cf12698dd27de2e20946048cf37731ab4afefdd9e24fd4e0a3fb9a2987c14cc63b7a5864a230c763a4dddc0a35f3d0c7c0b2f3ea53a6706acc5ef04d592c8fd3017a20a901d6d6f479bbf2"}, @NL80211_ATTR_TESTDATA={0xfd, 0x45, "3c117a7f3c25749433f0ec22bc1411016076f9c3c521ac7f7e7c9b7d8158c45d123f579b50bbb344ac3d2a7b8df58fa8b08ce92f6a3438ea30801fd8815f9a55eb779ba8b875a3e0bd1cb99953c809f16c3882f2106091718ae77c31581878f59545c0799e3987dd49625cdef3bc0aefa084e18ca4456ac0861219094f51238cfdb1ec8b33e242aeb8f12cd6dcc3d87bcc02a8d9615eda84d0819d1702a7ce0b7df7089384d740d7363fcd9ea67ae2289c7d3f3912be1d397322241711382adbfc2e769dbe37f8e94f114c3a868bc6fc206784aad7f4456992cfa4fa63edfc4bd4b8f0c0185cc4e8da8791bc46eecf21b1e7617e26b98f93d5"}, @NL80211_ATTR_TESTDATA={0x7c, 0x45, "35c7bf6b0f10899a70b42a376cde252221955560407718f91ba696abe325cc2d04ce3be0dcdf18110cadf88aaeeb3e6dccb86e1f8a60febbdd3d8e39fe8c60c790dfe0b62a665dccda06ad7362905ee0c24da24b5711013abb16252d13b8627af9b45755cd009102d9d5f6869dcbb90c8533bb2cd6276d22"}]}, 0x4a8}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x10, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000040000000000000000700000018010000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000b70900000000000055090100000000009500000000000000bf91010000000000b702000000000000850000008c000000b70000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x3}, 0x94) 1.891646136s ago: executing program 2 (id=1397): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x6, 0x1ff, 0x6}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={r1, 0x3, 0x2e5}, &(0x7f0000000100)=0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x73, &(0x7f0000000280)='/proc/net\x00\x00t4/c+\x0fG\xf9\xe1K\fX\a0\x04\x00\x00\x82D\x80\xa2EZ\xad}\\-\xd1\x96R\x91\xd7x\xb5\xfb\xc4N\xc7\xb3+\xb3qW\xa9\x83\x9b\x84\xbc\xe9\xc6$\x9b/\xda\x9d=P\xd1Xzk\xb5\x95\x18\xd7\xa8\xcc\x99v\x84hQ\xf1fZ\n\xb6\x02\xd5\xf1\xb4b\xa6\aM+\xc1\xe8\"\x0f\x89\xba\xb3\x06:a\xd335^x\xaf\x14\x82'}, 0x30) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r7, {}, {}, {0xfff3}}}, 0x24}}, 0x0) setsockopt$inet6_int(r4, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r8, 0x84, 0x1b, 0x0, &(0x7f0000000000)=0xff98) sendmmsg$inet6(r4, &(0x7f00000009c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xffffffff, @loopback}, 0x1c, 0x0}}], 0x1, 0x40) recvmmsg(r4, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/51, 0x33}, 0x3}], 0x1, 0x12023, 0x0) r9 = socket(0x2, 0x3, 0xff) connect$inet(r9, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r9, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f00000008c0)="7ca96e1548a71479959840a77cbef04000000037", 0x14}], 0x1}}], 0x1, 0x24004810) write$cgroup_int(r3, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) 1.704791209s ago: executing program 4 (id=1399): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r0, 0x0) mmap(&(0x7f0000c61000/0x4000)=nil, 0x4000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async, rerun: 32) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x100010, 0xffffffffffffffff, 0x0) (async, rerun: 32) socket$nl_audit(0x10, 0x3, 0x9) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in=@rand_addr=0x64010100, @in=@loopback, 0x4e25, 0x0, 0x3, 0x0, 0x2}, {0x2, 0x53, 0xfff, 0x0, 0xfffffffffffffffc, 0x1e6, 0xfffffffffffffffe, 0x8001}, {0x7ffffffffffffffe, 0x0, 0xfffffffffffffffe, 0x5}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x2}, {{@in=@remote, 0x0, 0x32}, 0xa, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x4, 0x2, 0x0, 0x0, 0x3439, 0x400009}}, 0xe8) (async, rerun: 32) r1 = socket$inet6(0xa, 0x2, 0x0) (rerun: 32) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) (async) recvmmsg(r1, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) (async, rerun: 32) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) (async, rerun: 32) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r3, 0x0) (async) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0xfffff000) (async) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x90b2, 0x0, 0xffffffff, 0x2}, &(0x7f0000000180)=0x18) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000240)={0x5, 0x8008, 0x8, 0x5, r5}, 0x10) (async) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) 1.603877684s ago: executing program 2 (id=1401): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x40, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x100004, @local, 0x3}, 0x1c) syz_emit_ethernet(0x4e, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb86dd678af00400000001fc000000000000000000000000000001fc8000000000000000006ea68bf200122b0200000000c204ff"], 0x0) listen(r3, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r3, 0xc038943b, &(0x7f0000000580)={0x5, 0x28, '\x00', 0x0, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0]}) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="b400000000000000dd0a0000006400006301040000006f0e0dbb000095000000000000006d59f50d0e9f25fc73a7cdbdb27faed67eeea855e2e2b9b19d89c94c28765487c3d9e2e973fbfe0adfbc9df5590c0c920cafe2e7c0df500434a5dc1d278bbc181ed48126100bcbfd91f3d85cd9fe5c77a8988760a31ce82cee0b27b95d8d00000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xffffffff}, 0x8}, 0x94) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-512\x00'}, 0x58) socket$unix(0x1, 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r5, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) connect$llc(r5, &(0x7f0000000240)={0x1a, 0x20, 0x0, 0x9, 0x2, 0x2, @remote}, 0x10) r6 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r6, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) write$cgroup_int(r4, &(0x7f0000000200), 0x12) read(0xffffffffffffffff, &(0x7f0000000240)=""/88, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) r7 = accept4(r0, 0x0, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT=r5, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES8=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000fbffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000000100)={'erspan0\x00', &(0x7f0000000300)={'tunl0\x00', 0x0, 0x7, 0x7, 0x5, 0x6bf, {{0x2f, 0x4, 0x2, 0x2, 0xbc, 0x65, 0x0, 0xa, 0x4, 0x0, @multicast2, @broadcast, {[@generic={0x94, 0x10, "4a1ca845750405ef45491bff9b9f"}, @generic={0x44, 0xe, "6875a3ed81eac9362361b612"}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0xf, 0x83, [@remote, @private=0xa010102, @broadcast]}, @end, @noop, @ssrr={0x89, 0x1b, 0x86, [@dev={0xac, 0x14, 0x14, 0x44}, @loopback, @broadcast, @private=0xa010101, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x10}]}, @cipso={0x86, 0x1e, 0x0, [{0x5, 0x6, "a112396f"}, {0x2, 0x4, "6ca2"}, {0x5, 0xe, "de35c6379cb4dcc3a3441406"}]}, @rr={0x7, 0xf, 0x62, [@multicast2, @private=0xa010102, @broadcast]}, @timestamp_prespec={0x44, 0x2c, 0x45, 0x3, 0x0, [{@multicast2, 0xfff}, {@broadcast, 0x4}, {@remote, 0x400}, {@empty, 0x5}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}]}]}}}}}) 1.547079271s ago: executing program 4 (id=1403): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x7c}}, 0x0) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='nr0\x00', 0x10) (async) sendmmsg$inet(r0, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)='\f', 0x1}], 0x1, 0x0, 0x0, 0x2000000}}], 0xfdef, 0x0) (async) unshare(0x68040200) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x149a40, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f2800800180004ac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6) (async) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000013b80)=ANY=[@ANYBLOB="280000001b1401"], 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x10) (async) write(r3, &(0x7f00000000c0)="510003000000", 0x6) r4 = socket$kcm(0x2, 0x8, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, 0x0) (async) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r5, 0x8) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r6, 0x0) (async) r7 = accept4(r5, 0x0, 0x0, 0x80000) setsockopt(r7, 0x84, 0x81, &(0x7f00000001c0)="020000000980ffff", 0x8) (async) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYRES64=r7, @ANYRES64=r0], 0x48) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) (async) syz_emit_ethernet(0xfc1, &(0x7f0000003780)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0xf8b, 0x3a, 0x0, @private2, @mcast2, {[@hopopts={0x33, 0xd, '\x00', [@jumbo={0xc2, 0x4, 0x4}, @enc_lim={0x4, 0x1, 0x4}, @calipso={0x7, 0x38, {0x1, 0xc, 0xfe, 0x200, [0x8000000000000001, 0x8, 0x7fff, 0xe, 0x5, 0x81]}}, @jumbo={0xc2, 0x4, 0x4}, @calipso={0x7, 0x20, {0x1, 0x6, 0x7, 0x91c, [0x1, 0x2, 0x5]}}]}, @srh={0x2f, 0x0, 0x4, 0x0, 0x0, 0x40, 0x80}, @dstopts={0xff, 0x26, '\x00', [@ra={0x5, 0x2, 0x7f}, @calipso={0x7, 0x8, {0x2, 0x0, 0x6, 0x4}}, @jumbo={0xc2, 0x4, 0xb}, @hao={0xc9, 0x10, @remote}, @generic={0xf4, 0xff, "e98a63f795341df5ac22af212800c8f4c6d60ec1dd44cfd93f865d294ca87e487c9b9d12c9ba0a541d1e0e980c78006542eac23fa8284232d8f34fbf133861ce75ddc0f7f053258a2e83df01191c3a80e678dc88e72ed4dbb429470281b6da314737e2b6b5541dabfffb8d9f106fd87f84ae5691b824ae19446a84df4ac343983270b90e085c2c1a9cc2a0b7517fb9615182817257861c1f8edcdae7ce41b3793740f5bde8903a726b7a8529b4817cd43cc3811ac0bcd300512ebae2d80d476a1f34af258b238d3f72635886d6c59b254a769fba51ab0ed1f0f976215a4e7ac754ddfc7d53e1d19a6c21e1e837f91561fa97a0ec9bf18c10323a02b4e1c357"}, @pad1, @enc_lim={0x4, 0x1, 0x9}, @padn={0x1, 0x2, [0x0, 0x0]}]}, @fragment={0x8, 0x0, 0xff, 0x0, 0x0, 0x7, 0x68}, @dstopts={0x33, 0x1af, '\x00', [@hao={0xc9, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}}, @generic={0xb, 0xd67, "6f78b53b510d2090d783b8eb7064fa8aac7efaa8bbd7992ba5970f2b7d49ad83274640d01ee66f7ab4d0150165fc503521570c1dec721a070ba5e78e6ba1fc8a1a8d25e068c1a91fbfdf11e6d490c7da94831cf76eabc37c4098114bf7af75bf2a55299ee952d1529e8c5dd88b626ad43c43e241c033ea1b25c7c579683273362ca98aedd6c8a9b12cc9bf4ad047d3769257f6722e6bc6bd49e7c8ff841ce1816b99f34aeccb1aa06b256260166e868da3ce134d95d06d39edf99c65bc2283f231ce8d126f780f70de338675588d273b002ab4ebfc1085f2e6ba46ba55cfc07ffb19011925ecd269fc54f8e4166ba0028df0db0514b6721d2cf8179e86409b3fd87c152844f517f01c0bc1bfe5cb5843a536db19b43781c04961aa85afa03224965b7de4331ecf2e60c28cbc4d2d6bd584ef3a06a72da84dbe83a95588c3259cde9fa089b98984e3c115f905ad7a3a08031bf368ca2b0152470212ead9244fdb13f55291d52ea3b4cf652240cfd6b08edc65d61016c5dab88172671202d364eb8a17752a78a2e99f704272c575f5d283a505280f9b2c5a61d5dae204b554261d39d5ef29e2e779ce19760265c125d3320024fb44cd6d3d72278744f03cf05655cf57474a8e8a8d55ca286c07e0414c3773ada2cad5f093cf2db134d8a4127000484895d420ac35111573fab81eae559644963f4b90c4a624150b25e9de8c8dfb5107b82fe21034c5fefe9384c06828d339eddd0fc0e4e2b2e2a91bf3f9e77f3907fc127f8f16e12019b44556e00a652e3edc2619c5a7dde796cc8dc318c8f34ef7cdf0b47e7c935d6bdcc504fb0033654a898528294e49b393eef5c9414479a980b8564475ebbcd8d500ed824ed4affc590e9d0e696f5a484bdf91a08a7c5ad7d51c36f5f7863f8f889674cd0f530886439734619c93a9f54557d1de677180ec11cbe591d1454b1941e6c0b7947c2fbaa156cd5dd4a663b9672bc2f91436e5fe882ac2e4969ec0dbff8460d053a6c49398b198077e78a6b31c90a1d43a537779e1fd9a79937fa2bf98ecfb041f778902573ebac33fe6697ef9dd737fd5ff2fc12f38e02b16aa651149776b3b58651a31c965554dff4f4a21be9b634fa6435a59a1c7ff4d88cf55c0e6681e738121228064bce80e8f1408c7db606f9a25a08961473ff64c059711da3b8fb0a42fb9cb803fd3d2056bf199c056827b4c45973f0be15fb1ca1e403f66be54aeda9499881ee05cd10a7bf6ab053980869d2281f94657d7f2d02c399dba0bd89cdecef552dec70f22dd229fd3fd1332ebfc9135f0e626e320edeb21766b0a3e5d7f58a17a83070433b0bcd297931c53d19adce45843b0f4e8a38c785a331f8a6c91d0c5c5c1645f3ad9aa7157424e679763a3b7924faa0edc11aa681816f58f5617ca0cd71d7e090d36a6ede1779a7bf0b0594695c2d747679daab8b483f5fb4334a4a93230e62b7cae99531d8c998d68a72baebae98810afe3d88da415492ba24490f27bce064391d53e1c9e83721a41c286f1216bc8f99008bac4251e3ad6188d487b36cef7878a8610acbc26e561788f31bcb41d87f802b5169fb698bee9073bb46d6a79f9bf6e71ae01f3210fda48a8c214d38f1bf2dc60215c17c5ba7fd666a788b037237ef1b7780a203486989bb4a7c1444aacb8c4a15ab5fc3edad837e7fcc49a3a6fab0c493c35d5095900089ec3d14bfb3c5e48a89b79aa6c9409d61f6f8be1b2524d025112e6c1a512b02bf60e2a9c9add9b55325fe901e0d8c234a7b7ac3ed5e6df7078a4545d5d6ec76dbd884af8e8e8649bde7bf207225e5a32852d89013719a5a43c430e721caeb7f5576b89a8bb5ba80f134c5a2f1c11fa5ebb4ef041539a20182e5c7f40c1a5ebffdc97086b5ccca1bd2454e0db376f6e1f613a0ff379a982bdcfee24431efcad55ed8c783c6607d8b2a13176bd059e509cd0f44bee7e82dd46020461c075332239ad7f0ec60b40f90df74104c2da8a2e4ecac9e594374c03016c752a24f325291afc0631e9f87719caf64f89e45cc3373dca6e7341841d7fbd2f92f47553c156247c7e3cd07c9921752a8a7c9b945e07da9c384cf02b580d69c49f477fe4ec1aa6f8a168d13989441e2f8bafa0cc7daf8ff9ec600964aa007877d132e71412c4bec5dca79264b807cd5c9a1abf689ccb46c65f03ce00ed1c1558b0128523762ff50f6a85cdb12b014831b59e4192a61a49c51c304b0c1b9682b985a49c7d83a95e0273e040ec617631c29675963650fb02c9e86f26ea66d9d86311365875b2601f79a7cfd2cbc011206888a3a7391a3fe2fa96bfa9229184864cf54e03579306f8c87faf34768e32c01e90a9760aa0d666caa0faddcd4fd1ce4b13df8734f5cbf0d4bbeb505c31dc0bbc319a485fc93eb762773d00e07f02a0dba30bb0c9bd3cc76e872390c97c2034d4cf488d343dc891d9e9e9b5c93c0893242b7e9dab6ea7af9cb00bdb0b1e346e8a21b60d3963c3814e81519ff4b77afc9739abe32765196436bb30aab51c6fa1d32dce70c2ed4aacbb8a77e10210c5510a9170231968a46a0a98aafe0b5e35c5b1d15b7f1a2c4c4f649a4b371fff2e535a1776445442d11157f0b9cb29a770c8e1a386847540b85015aeb2b527cbd2efd516f4d305fdbdb88b14e1570f4e01b753551958b6d0e5e64c03a806eb70654d6476fabf55f10f964d843e7a04cba097d2a6246a1452f1c246b9c002cf96a7601d9ed06a1bf5a0b2fed20c57a96f0df6232cef17f7a2142c2be3af64fadfefabfae075b8440d1f2b43dbb4a307b831a3d15260114e1a590dbbb975a112a6c22338358fbec156767611e8b0f4f6c24900d429ee5827d9bd7179814443270f1fa0e3b445aa32637ec0887f6a49170e82714c211d07a75ea2e4d2aafdb4c834da9f33c8a321311811c62af75af37b2486efdb862d0482214341a25688d65619c7fa64f8503f6c35d344f0cc6c85c1631e5dde0ab843c203d2cbfdb7f91d752920e799138a9a973afe7d2cbc41166e2e982e8aefd65c70d14484188ee3e2452b645a6866db3ccee5c6f451d2d05a32edb9960202b88c66703ad5b37ecf4b959a4d5a1d7743a2eebdb0f33527f9ac6446c769f6923407ba17f86a9b6df8f6be82477008598465ca58c28ed4fab67b240bff57349e87aed283ef19c20384d7348b3e7e982055b8a45512228c6aeeec304467e1b3e1ac9a5e97bd40160cc57e44c7919413b4b0224ef3ca912d65d1a175041bdbd17efda473711ae037c57f4bc819ae5d1458d1e7c4e426106bf53ac731e868ae6e7c56d75ffaa9ebb013ad242f84b7ab1b5a23d97229d1dff1ae3294f48b87521b1b058aa330b621c5416c613c3c60b5978aeddfa8db6709862d62ae39e5caf41468844c87e1e6b908a49e4327337fa3c0fa13efc5153b4e1cc28cee407af0152bc3e6f5691a352a8f9d0aef59614013ad79460dcf378192c56d49f9f305622ffda3fbb8e2a60ec5a1e7dc207836359d80ea663a0578d0837e7cc50845bf3a9bc521b13a36af3e0e917d01a1ec895863ce2e5ddca0e21a3d9e017d88a3d5231124bd8b690a951759db4d6dbd82d7a4857f834cc790fe4abb1323636eed51beb4c102cca7c5621ff575ddc9cb8064b015bb473742b1929c5ebcec688603fabd80af756920011ef1e2cae1964c6ef30ba1e4fe3a182ed570bbd36008a3e779848cd409b34bb22f9b4a6136f25aa3142b6b0760c538ed21f03ea1308b846fbfadacd6b591953e4bbf3ab384e22ae31484febcb78ab66499a811b162981968ae235b29eefe96100856dea5a599e3080875550e7c03522a3d5f25f7fc22cb5277be1e1d65bc0910a1027e49bf8abf2213edfc42873e93f2e1243b81e2fe4b4f1165c08d5647d60b49fce811625f0a33aa1aa202a05e8020fca490e161d7348ea51f5b6587bbc34ddab7cebb6d4c1323f02f4088685f7927bb894d80d5fad1034a419b18b48b06df8868e6290c1a21f134c2c60e456896ff87f1f4f02b59eed77fbce4b343f50ac6a1ac5f6140c39d12427855a1042e0e7513417e4cb8cdc791d6d5be82909899b0eb1687c798df4d6b780d9741842c013e7cc1c9b032d8675fbff0fde9040539a908022803207b549d1e1dc205a79c5679645c2b2fed4c14124bc3f27b138fe9b00e8558245e86c89e20593fb54cc771c0e1e7488cd8398e6e8f5a90711406a782e15f2567635d5f07b32d56a90b4465e478aa89acab6dc4a4ed070264c7d4c674d99b2cdf2026267fceb425baa0450ceb469819ab9e519f8524bf4565e896c89b5526342deb503195cfb9cdd4ac948afbce6c7c3b05663f1986202ce38420422035802b355df6720738e7c1867eee907faf0be763ee1460e12bd087e8c0809e463e968271f2cd45772fe28a12112095ece0de4a60dfc9667235549d132c6e39a38d6d1dcbba75509e365b5542cf582897faa729aa2b07cc9f292dcf9a0e2cf1645e7237a679fe58cc0fd4ac442046b7cb4667be146ca77f4e5b9ecc386ec89e756b46260cc63aba081eeda7f1b62bbdbe21ca58b92d016d4122ad2d49689779a15b2c497e7e33dda399fb61f1374df4c9721f0055f3e7cd1eb55f030c3aa183b0a4b25d0e8fd651d829ecc4b9ee7d39601cea4c8f773a8ed4a22add14b837561541243ebe448159a7fa79cec1693bc105fa7b1e3050b6a3a954eed63291b5a42bfe4db63bc6c48953068363b4221713234570020e34a845846df97517ce54f9d97c971c4ac2f8480afbced2284640a19aeacf77e448265beb978b4811cdd56d70a3af9ab7acf2ed57a175dd0572a696f42ddaedf3c68b799ae0d1730acdd537"}]}], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0xff, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f0791710007008400"}}}}}}}, 0x0) 1.425544384s ago: executing program 0 (id=1405): r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$rds(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x9) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x0, 0x8, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0xffffff1e, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12001}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x0) 1.40173747s ago: executing program 2 (id=1407): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x78, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_COUNTERS={0x58, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x1ff}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x800000000000}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELTABLE={0x15c, 0x2, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5d, 0x6, "ee13cd963bde3df0f366835ec5e20d2d66bfda49429c6db4301727d22346ddbebdb94a49f0d3044146969b9049ae9c07f23c508e3bff695a8209efe5da6ddfde051ef0bca20a7800ddc032a9989de2be06e0658774435d71c6"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_USERDATA={0xc5, 0x6, "0028451e632568d02384229e6841f9908ad45b9543a19ab542198584b5f9f0ef5775b2b2d0f017cf31dfb392212ce38748d3bf16c925021fdb7213e731b3546f419180af819df809561cb56b0c77161393eb347fb1630459b6734be7c244babf1d6e27c03be29b7a761f8331ccd620337d286b915a158815d553c07151ddd480caca328ff1aa37c07b04eab5a12d0e213c2fe3651025ffbfb42beb24c95c94ce8600e31be428dffe3ea3b60fd3ba0288d168301c0aafed8c341a62e23af9b87ee2"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x21c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x78, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_COUNTERS={0x58, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x1ff}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x800000000000}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELTABLE={0x15c, 0x2, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5d, 0x6, "ee13cd963bde3df0f366835ec5e20d2d66bfda49429c6db4301727d22346ddbebdb94a49f0d3044146969b9049ae9c07f23c508e3bff695a8209efe5da6ddfde051ef0bca20a7800ddc032a9989de2be06e0658774435d71c6"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_USERDATA={0xc5, 0x6, "0028451e632568d02384229e6841f9908ad45b9543a19ab542198584b5f9f0ef5775b2b2d0f017cf31dfb392212ce38748d3bf16c925021fdb7213e731b3546f419180af819df809561cb56b0c77161393eb347fb1630459b6734be7c244babf1d6e27c03be29b7a761f8331ccd620337d286b915a158815d553c07151ddd480caca328ff1aa37c07b04eab5a12d0e213c2fe3651025ffbfb42beb24c95c94ce8600e31be428dffe3ea3b60fd3ba0288d168301c0aafed8c341a62e23af9b87ee2"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x21c}}, 0x0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) (async) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x50483}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.312528927s ago: executing program 0 (id=1409): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000040)={0x0, {0x2, 0x4e22, @broadcast}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e21, @broadcast}, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000)='team0\x00', 0x7f, 0x32, 0xfff}) (async) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0_to_bond\x00'}) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@remote, 0x800, 0x0, 0x2, 0x1, 0x773c}, 0x20) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'macsec0\x00', &(0x7f00000006c0)=@ethtool_ts_info}) (async) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) (async) r2 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000340)={'tunl0\x00', &(0x7f0000001540)={'tunl0\x00', 0x0, 0x40, 0x7, 0x7, 0x1, {{0x5, 0x4, 0x2, 0x16, 0x14, 0x67, 0x0, 0x0, 0x2f, 0x0, @empty, @empty}}}}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005c40)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}}, 0x4c8d0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) bind$bt_l2cap(r1, &(0x7f0000000640)={0x1f, 0x1000, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xdb, 0x2}, 0xe) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0xfc, 0xfffff00c}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) (async) sendmmsg$inet(r3, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{0x0}], 0x1}}], 0x1, 0x0) (async) r5 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$sock_int(r5, 0x1, 0x12, 0x0, &(0x7f0000000600)) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="640000000206010100000000000000000000000005000400000000000900020073797a300000000005000100078ad4b67c6104641c00000014000780080011400000000008005ed441b1ad4e613b1868241312400000ffff16000300686173683a8165742c70ef72742c6e6574000000"], 0x64}}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'veth1_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x800, 0x0, 0x40000, {0x0, 0x0, 0x0, r8, {0xf}}}, 0x24}}, 0x0) 1.264246374s ago: executing program 0 (id=1410): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10b8}, 0xff00) (async) r0 = socket$kcm(0xa, 0x5, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@bloom_filter={0x1e, 0x0, 0x400007, 0x8, 0x0, 0x1, 0x20000000, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0xfffffffffffffffd}, 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890b, &(0x7f0000000000)) r1 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) (rerun: 64) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000340)={0xfff8, 0xfffd, 0xa0, 0xffff}, 0x8) (async, rerun: 64) sendmmsg$inet(r2, &(0x7f0000000d00)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000700)}}], 0x1, 0x4004000) (rerun: 64) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000340)=0x4, 0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async, rerun: 32) sendto$inet6(r3, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10003, @loopback, 0x7}, 0x1c) (async, rerun: 32) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x200002, 0x30}, 0xc) sendto$inet6(r3, &(0x7f0000000040)='\v', 0x1, 0x20008081, 0x0, 0x0) (async, rerun: 64) socket$netlink(0x10, 0x3, 0xc) (async, rerun: 64) writev(r3, &(0x7f0000000240)=[{&(0x7f0000000400)="b0a56aeb", 0x4}], 0x1) (async) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@delneigh={0x24, 0x1a, 0x1, 0x0, 0xfffffffd, {0xa, 0x0, 0x0, 0x0, 0x10, 0x0, 0x3}, [@NDA_FLAGS_EXT={0x8}]}, 0x24}}, 0x0) 1.239953783s ago: executing program 1 (id=1411): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x60, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x3b9aca00}, @TCA_CAKE_DIFFSERV_MODE={0xfffffffffffffe62, 0x3, 0x3}]}}]}, 0x48}}, 0x4c040) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) unshare(0x22020600) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5000000010000504000000000000000000000f80", @ANYRES32=r6, @ANYBLOB="0000000000000000300012800b00010065727370616e00002000028004001200080014"], 0x50}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), r8) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r9, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @DEVLINK_ATTR_RATE_NODE_NAME={0x1a, 0xa8, @random="540ac69eefb3166f98acb589859e3fc3042d4a554a2c"}]}, 0x38}, 0x1, 0x0, 0x0, 0x44000}, 0x4004801) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) getpeername$netlink(r7, 0x0, &(0x7f00000000c0)) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1b, 0x7, 0x7, 0xa, 0x30001, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @value=r8}, 0x50) accept4$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, &(0x7f00000002c0)=0x1c, 0x80800) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r11, 0x8946, &(0x7f0000000000)={'gretap0\x00', &(0x7f0000000100)=@ethtool_wolinfo={0x6, 0x9, 0x3, "746478bdfd09"}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="d401000020000000180000000032662cd83543aa19588358000000000000000000000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) sendmsg$NFT_BATCH(r12, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a80)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a80000000060a010400000000000000000a0000050900010073797a3100000000540004802c000180090001007866726d000000001c00028005000300010000000800024000000001080001400000001210000180090001006d61737100000000140001800e000100627974656f726465720000000900020073797a32"], 0xe0}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = socket$inet(0x2, 0x3, 0xa) sendmmsg$inet(r14, &(0x7f0000000900)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000000000000000800000070000008608000000030102440427be000000004e9375b053622c227d496c69abc30a56967a185e23df8c16f7cdccc33d97d5ad93853a4a8793382c4c12d37dfcb2b1ee70a5ea7048bc88047a960f"], 0x20}}], 0x1, 0x24000004) sendmsg$nl_generic(r13, &(0x7f0000000100)={0x0, 0x300, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x20, 0x9, 0x2, 0x25dfdbff, {0x2}, [@typed={0x8, 0x8, 0x0, 0x0, @fd=r10}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 1.173036845s ago: executing program 2 (id=1412): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) (async) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000380)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x455f}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x4, 0x8, 0xb}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000880)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)='*', 0x1}], 0x1}, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x80, &(0x7f0000000000), 0x0) (async) setsockopt(0xffffffffffffffff, 0x84, 0x80, &(0x7f0000000000), 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$kcm(0x2, 0x1000000000000002, 0x0) (async) socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000)=0x7a28, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x13, &(0x7f0000000400)=0x101, 0x4) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x13, &(0x7f0000000400)=0x101, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x20}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x4, 0x0, 0x1, 0x5e, 0x6, @remote}, 0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) (async) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 1.070280479s ago: executing program 0 (id=1414): syz_emit_ethernet(0x5e, &(0x7f0000000080)={@multicast, @remote, @val={@val={0x88a8, 0x5, 0x0, 0x2}, {0x8100, 0x6, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x20, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @private0, [{}, {}, {0xe, 0x1, "24fcaa8fc05a"}]}}}}}}, 0x0) sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001340)={0x1c, 0x0, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x40090) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x21}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x4f}, @jmp={0x5, 0x0, 0x9, 0x0, 0x6, 0xfffffffffffffe88}], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11}}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r2}, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000180)="fd", 0x1}], 0x1, 0x5) vmsplice(r4, 0x0, 0x0, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r5, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}}], 0xf00, 0x4c42bb4f92, 0x0) shutdown(r5, 0x0) ioctl(r0, 0x8b1a, &(0x7f0000000040)) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, 0x0, &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x0, 0x100008, 0x0, 0x0, 0x0, 0x3, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfffffeff}}) 837.09114ms ago: executing program 1 (id=1416): r0 = socket(0xa, 0x3, 0x3a) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f00000000c0)={0x18, 0x0, {0x2, @local, 'ip6_vti0\x00'}}, 0x1e) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x4, @random="5677dee5a538", 'ip_vti0\x00'}}, 0x1e) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x2, 0x9, 0x0, 0x9, 0x6, 0x0, 0xffffffff, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x7, 0x6, 0x2, 0x3, 0x10000003}]}, 0x30}}, 0x4044010) getsockopt$IP_SET_OP_GET_BYNAME(r0, 0x1, 0x53, &(0x7f0000000200)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000000240)=0x28) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="04002cbd7000fbdbdf25170000000a001a0008022f00000100000a0006000802110000010000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) close(0x3) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r6, 0x0, 0xfffffffffffffffd}, 0x18) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x1400, &(0x7f0000000180)=[{&(0x7f00000001c0)="d80000001c0081064e81f782db44b9040a1d08040e00000000000aa1180002000600142603600e1208000f0000810401a8001605200001400200000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162756aa5e8d7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local}, {0xa, 0x0, 0x0, @empty}, 0x1}, 0x5c) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000280)) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) 778.814001ms ago: executing program 1 (id=1417): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x60040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$packet(0x11, 0x3, 0x300) (async) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f00000000c0)=0x20800, 0x4) (async) getsockopt$packet_int(r1, 0x107, 0xf, 0x0, &(0x7f0000000300)) (async) r3 = socket(0x400000000010, 0x3, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4001) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x31, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0x0, 0xd}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_CT_MARK_MASK={0x8}, @TCA_FLOWER_KEY_CT_MARK={0x8, 0x5f, 0x80000001}]}}, @TCA_RATE={0x0, 0x5, {0xb4, 0xb}}, @TCA_RATE={0x0, 0x5, {0x1, 0x5}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 762.342486ms ago: executing program 3 (id=1418): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) close(0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x50, 0x1f}, {0x6, 0x8, 0x0, 0x3}]}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x10008, 0x1, 0x1000}, 0x48) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) (async) close(0x3) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x50, 0x1f}, {0x6, 0x8, 0x0, 0x3}]}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x2, 0x4, 0x10008, 0x1, 0x1000}, 0x48) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) (async) 636.868286ms ago: executing program 3 (id=1419): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f00000004c0), r3) sendmsg$NFC_CMD_ENABLE_SE(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x1c, r4, 0x1, 0x70bd28, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x71eff8d2059dfe60}, 0xc004) (async) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000080)={0x0, @adiantum, 0x0, @desc1}) (async) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='kfree\x00', r6}, 0x18) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000006c0)={0x0, @in6={{0xa, 0x4e20, 0x62, @mcast2, 0x2}}}, &(0x7f00000001c0)=0x84) (rerun: 32) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000240)={r8, 0x8}, 0xc) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a30000000005c000000030a030000000000000000000300000009000b0073797a30000000000900010073797a300000000014000480080002400000000008000140000000001c0008800c00024000000000000000000c0001"], 0xcc}}, 0x0) (async) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000500)="d8000000180081064e81f782db4cb904021e0800fd007c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016001500090002000000035c3b61c1d67f6f94007134cf6efbca4158858e796834b25ae5a3048000a007a290457f01a7cee4090000001fb7913fd25a21ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703a90723f9000000008af26c", 0xd8}], 0x1}, 0x22040000) (async) sendto$x25(r2, &(0x7f0000000300)="8b54386eae922110078cb755a5035094d9a2f5d4326f13d945149b8abde698e7bd8482cf65d75773d0ed2ade53d2d99eb3eb8c8212110d1c52b6f5bf240e6713e894935b0f587d6a205790591a2507c9d911963ca627e22aacb28fc3c2006ac1fe4cd99a81c87f0d9f29e0d5febfa0a40d6638f5432805292c6b8e947524f3dce96e8eb3f7c237a2cb485cde34607db50619dc3b26f231d142841e40", 0x9c, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) sendmsg$kcm(r10, &(0x7f0000000600)={&(0x7f0000000800)=@nfc={0x27, 0x0, 0x1, 0x2}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000880)="6e755faddeb466ca62e6c14171e0ec29a3123683fb0405be6f329cd9df9ab24e6cd169ab8c42a22e19a177027e7cc5d05fb8952077a6df2f96c6d870dedaedaceeb19f5b3ff1555fad64e64a5b1511c06351d1dd4b78c9ccdabfff0dc73d210ff328a22ce0d61dd54e2e804ed9733b04e73bfb61193bffc3025ff2e594527199c68cddb819245f2f02c4d1832d6a2c05c1c68d52a511b22c8c9e0df7aac4f2fa9c67936ebfcc23010e59f8dec3d045d3a3c1746ed0c340694e3a322b51a6167149515bad70b062c58c1845ea03f16dfe17bab644a0778be32a0aa84ab555d3675190b6f9", 0xe4}, {&(0x7f0000000980)="993a112a7334ee9cacb2b9b3b07fb7cd3e01b2e25947434f9092e18750942baa819f8e1cb2207583e4a11d2764be7a3fbb03d194536382e779e1f9b83ad490dea8b343650cecb8e0c7e9f78f4f4374ff27b0e8074f5af24db3fb3d0b68fa1559cbbb18d8ea7efa2da4a2aed6adc252d9e9f309743ec8c5356950bc6cf7e41552db63166626f0f1ead49fb6eaa396a2d569aee9b049cde71265e4bc3abb01bd4866fbf7a21beabd7fdd285b0101acf60dcebdb5bc93bad03574619ffbedcf5b17cb09c7c5ff297b067619dcc1fe5011873d9176ebc13b2e74785a23812ed0de2482dc87a22b5b82a95355486236", 0xed}, {&(0x7f0000000280)="69da8ab3cb5b216a51c2e67701bd4b38f01457b294847775c413424485c6cd6bcfe622051d82f9a0ec76cd1271cc63095a34e858283b18fa", 0x38}, {&(0x7f0000000a80)="8560504be4c61cc9bd3be5760b1e97e80c9a3674fa5d0aa4a67fe4626cebad1bc9bf75046414a32924b2b09095ff2f31eb4ea4e8c669da5678b368a748bd0834dc4b4360b75e7c07420f347ade9b19025bb462291d3ccf", 0x57}, {&(0x7f0000000b00)="1eb4efd97b873f68fcead3c10efff045c0a34056a6086177e539d0ee0b26ec2ec693b7721d7adcb161e1ecdf2cd46780f5d76a6e8fc7b641f30256ba33a40017a9cc9099c6337c47669927f18a08d58d3d4b8bf99fbb09a2d46de6d66b12c5c43477335cb455859a69d0a226e1cf6c367ecd1c70df32007c5bce0b3b2dac0ee03587262b184f381c126f78c58f224f5c587672122ca6b10351eacf7929de01c9eec8cd43aeeb3ce2340ccd58946614a9ce528a44f9f604f511b31070de62b3c02d537523d94d2cac11c2582567b2ee5bd4b8c9be7b6414bc78629e9f26cd9c59a14c3c47b9e2", 0xe6}, {&(0x7f00000003c0)="7227c71cbcaf", 0x6}, {&(0x7f0000000c00)="37da9f8f857077eee257ed98ba6384b85f80b840661a2fa2e4200e6408af68062ed0d234c114f8da928705730cddfea06b294d3557a5ebe56181d6127546211346b2af29e2d6c7baaca8f805bee67b227b0d1c65757993cdeb49c4a8e3c8dddf35e055332b615cb8758a08f12ec57f271f2ab08a5f9f45a9d795c01b5b93ab47dc1718ee108757b2369e1e83ea56f4feaa44cbe134ad73689dc9f1e940c8b06bfc88cb133d08772a3a818c552179d85fed8befeda50114", 0xb7}], 0x7, &(0x7f0000001580)=[{0x1010, 0x11, 0x2, "190cc1588faadf36926f2c78a5df8c5c2d73d14a1cebfb912d0ee297a53709504eeaf84ab36d7c1a4772d24a7ddc00bfe9da89e43284c12ceb1e534138b315cc54aece0fcc5bb074e4ebd8f15ed23224f0d6bb5bb4fe20aad49fda90d7f669c4da9d8f2affeec4b5e3ed11d5f1dceb9cf436185def35b02a26bc6d94a09a5b3984fc8eb14e3cd74ec5ddee69d04fe68b7526377f1929af3b14f3615abd950f781ad7a2b109bbfe0f8f017dccb8b167959b274b307a848af937ee69bf7ec532120144d91698e2bbad4a212663b9fa92f5a07268449263728504e02e5e6c390b822228afc923d06df201e9954004c2bb485aa3a29e1cc58961e25fc463598c46f8907a6ffbaf9372b5d9d4b42bbff47decc983dd647f70794b6d113d48e885118dd98841dd864a970972639609c3bd87416d6159700f428fcc77a0e9455ca983b1c33bc5585e5c62c3f5d9e62085e69e51af88bb9c6861c2c41eb33d623658c8371a0189cccc9361d46b01f24fb4b0449570ec60e74f67a0b310b7a6da936d40ff586c99b6fc15034c83c709aadb5a7d3da48a6eb5796af8870dbc9526436fde6cfcec1419d606c26a9e99abc1db75d57693497987d1181f07bef708ab9d8be629a99401deb780f897d6368fd4e9ccfb8ab8ec2a3a976ef531f36b356c15692374cc682d15ec8a68316c7f02aa6c889f81fbb6f59a12e77950bbdec8cb205af5e6a9b65b172925b7b7276287e38d0a17a598d52447906fafce48841c9143d8e38e73213613029df464a2610fe78cb466463a4cf1dea67734d7d222cf92918ed0c54ae48b94f19c98b1454fffd7d04b9728b3d813ecb94e700200ee3c2748ec16b85e71e14a46479755344a2be341c3b4f5aaeb4ba6b7c8248fe34e999887bd01938069361354cc81e825e30123b7942c2adae251cc3abe41ee6bd609425df127d1eb739a3a1129dfdd72e6aef4f87594cf42b748c918f7b1960a792a83b8443ab0132273787596cd03f4cfcdf9888828da60c2f2f11367aa1e5344ca306e44067f86469d79766ebcba0ee2d506bcfcf5989a04e7473e9cc67d25cddac03f7b01b9589d67ff5610f7085238aa817d88ef910ef5e6d69cb41eeea6902105a9c01c18ea71ecbc2a4c1cf9ef6ee7d68bd5cd8400dc65c8767423f944d1c07c219836896ee91615af136a35c16763d4544dd62a68ec83a75a7bfe7a1009b25864174327a223d3c37f2b034ad7b419fc1cc5d9df3b3bd561bbc09304677192136853508e7eecc8d1f14fd197f279575d550eff6ef4d9d94656e498f9880f285dcc3b45f0659f3baf289d8237c852f78e29fc43d65aa70f029bd4eefd90b048e54cc1acaed0cb83145c79cc1c98fdc8de33fcdaab9c7409c3e01649debb9baa6166c8888147f979ee0616b42de65ceea68bec81aa0af4fb17e46ff5ca77a40819769a68f185af1ebe4e00066516d08eb53615f19403d22539177618b5005ae4470d63b199260fd39e56944bf52436640ad2a44ad40414ac832a1f7d106525dbfd3faf499aec2df25153dfa68f79477b2c05c0193140648428fd286425138933842e4a3480e1c404adcc113225dd97ec40637bbcdbfdc66a64322ffa4bcef3455dd4ff534d00714fd7feaf25356577581ec7cf9a8adb6fca6f492527a3b9c10be9eb25d349537f6ecbe2ee95dd4887e6f9a96363f9c8798cf5fd999f822605793f7b3fb4a2473cf1564a33292247bc9389a801b7579a1c723bdc8008af6a32954f9b358f5a14d3875e8f61fe6fc2bcbe62f593f2626398c6b4ad48051f04f09f4c97b2bd6d1da42f0c41c34d68b02698018e0a6aaaa8cd7836b6ff9710de415446f970c605b6774b9ad0e5790d85cd546cd0353e125c1801e70600b39e39ee66d34fd824d01aa28d23f2e6da8cf23b2b97f93448e49ed37431ed195ccb5d5307bba8067a72cfa763db39f431b75ebe0bb00c1ddc4276c89aa061ebffd9b6fe9d96007f93a74de98294b04f28e9b9b6c9d132a2845429653ac64c22a96a0625f37ab7fe590874f1847a82b45ae80b1c956037c2503c36d627c846e068a5e7fbe04a10ec8b061c9c3c0c2100e3773640019504541ef0dd1c9dad16dd379194dacffcddf88f354362ee638bae18fb29c28fea5e9ba48434ee19dd42275b867eeb1a8b9d3a8357029f47ee512f80ce71fb7ec848da8818142da7cbe12fc1dd18f90be4c23bb83b762ce2d4b0821c300da61f8743d31b6379c03b2bb11ac434a82f2eba3558b6850bd50707feba2e99fb2894f2bfd0832ec516ba7193e7b15230fb54a1326125cd94bc92c231f47e739cec083dd19a9a7e44f4e17b5151aa311143061814beb702524a66f034ace0230f1b096f3a4b5398bcfa6dadb32e5f8e0f95b309807c3c70811cb78da5f2b222b18252f83ad02f996df91981a3e7d96e723fa1c4ab6b4331003b83f4d97906463cd33c43c6cdc889cd86006f3b1b4bb26a7c9dd69558a11f612df49c5d3b129d08edf897cb77836aa50ed23888b352d1bd34ab7b1031e4f704a2b9fbcbd705a40e65e4c3ef01344cd08f944487f1b2a6d3eb3bf907fc7ccf540683f1fe0b520999ac82b3e67a925357e868bf55b9318662a3f5bbbdd32d3036011eca8daf8986f16692234d27bb1a1dd28ab55003da33899a742ba47d3ea1d3f523fb35e04f6278c8fce2ac9c0cce9b0cf348c2c9045db5f03302ae97a050f68f8fb161cb5e2ffe65b0d64e52d0131b53316cf1e74b1a1276ee58485f1c6e3a4a1d5f948eba52c93a2cad3dc861db44f64da5a702bd0f75b93efafeb542ff41d1d45376d49e382c7df0ade287aebafa9bdbe4dfd953bd44d9693cc359741673501ab1be64050569344dcf7819accb849cf340be06a619c3fb67b0952480f85b2a8855ece39c5eee5395e33e606e1bce2b6b00dc347dec9feeb0f4b07b0750e80c9bb5446b68e8e6d581404e25ed5aecf1b49ace369ce6e369a860ac76b0d5b6464bf36e6db55a49f28d54566157611e4fdf61f2e83608720cf22f5ed17fbeba65c0dce5d0d24c2e0863bc062c9653ce7ac0042af6bd685b83adbf1e65d782fa7ee1a4cadef91203d47876d5c9fa1a1031bb40cb2500075e2c20e52f04d8dce9235b2f271f814642a668ae29cb8de184f5bcb04745e0eb4e1ddc5e0f6396f598d6b97f99257659fc7ef70f95993487f3224c25a52005b07b3396046c998a0004608c1091c0fc62d84e49a48717f13110e0fdcedf1ef2149a1c3ecd4bb58a2ee83c2999327028579c16f4a280c5bdedf175ac2c3cc6510e9d8f17404e81926f565120447ae27ab9c0db3276c27904d5d6e97cd7d0901ed36583ab1798ef444f87e08d11d6e1d4a4d3dc0173d730e155e4887ed4a7c03f728ff56d9d853b585b04d84bab39f78c446e57d0e130921d504d4ea948ce9776a53869026ab983fcea5a526cbf0f7cff5714de37943ab0b82f6a633d375dfc655bb6f990354903fa311b2ffb48f055acf26df0506e0deb1ff5ae74d8ab3302530be1b6d20c2c676c61d7a7f0f19097a759b44b0088fb1b3131028c1e7b489e832b492f80a5a635e92a1783d4aef1034f03162b09e4573cada65435cd7df8dcda0fd8c7a69103a3852c7b2e40915d9a71bc4ec6ca7c96ad91ce2535e1d09cf0809e11da11f357c3c4febec5c92200dbfe7e8c8d3df9c8fd3b8c0a3236ff1ecd9fbf932a18f5cf368f7725f19a3a3bd6958708b253233145bbc9eb7b204c177cfb98a03a8c979758283d7f6ddd6bb7431e2ec525d8abfef45727876fd827dfb6e32c331e4b815c38e3055de904eeb4367f5d7ab9a95090a6dee9dc0eec3af6ab62e3c1bc3ee40aea866e76b657aca41257ae4d434de796a1641881fa90ed31265e1efe6020af3f8ca9d95b6f50bd7b054e81134573d939c2bb3bdb97ab1ae84eff03dd610b1eedd39e2cafe430e95941b18700c2a6566fa14ffa5bd2c3a0d3f20aae30371139e92f1996c9af65f59d79231cb54175cf5c91850a2237df87d63d85bfd92b25d9df2da229a5deb47af6124a7c1d08e9a68c8c4ab8210beb6e42058b7ab12292a99253fe40ec9642c7bf1a30780ddccea00cc167a05822c07a582eea30a346809ed9bb74a306141453bc40d397ae94dc0c5c554519b22b9919310952bcbddc66262d9063ad79a7b4530a5a70a40866940dfa610db9eed9c0d57ed20ae4e026d14240d5f666c96a1fc21cca4f35bfc3301614eb3f6af6f58bfe6ce485e7a3bbe1d323effd69f0cca5cae5be6bcc75ce4251415cddf72804b71e54f2ab87eb16af2c5d36ad158d4857bb97e8a614e114f545cfa603098fed1b8ee5be9d678091f7ef5969d36b2a571bb3f57fe4789f81a51e240825c70ba15b99f7f08505d3884da137c9f25cb112296f1e7e96390ad9b321f4115fa5b5c459fd19793e94ab9dad90db76b6613cf6b9dd729209a2a6bb07e9e63ff95276ba143aa4992a083fb46dd24392eee3ce98b31d14c9ea39f76dc2174b6a8a99d9e7e5b0433cdfe572bf8734d0215404df7c4d99f53088de4afbd52f24691c6ddfafa7d220aa1a03ce205b64448ad832ab8913fbab1459139733490288fc9fe1e1eab6373e1763f0704b5ac86e3c28bed8d36043418b124a0c7b66dfc77a1685d9c9f48580c9ea9eebc14f9f8a25613ae02cf36c55d44f2640956640d33b1f892479824d66facb68d120f8002f551479bfe799c0a03c6debabce798e91be815466ba444cda549ee2d9c030e4abcee180365b5ed69f4672994a46628764f304cef45d2d11be1e82739b15f8a1f5923e0f89e6adb33fca003e5651f41c322a701233ff968dcf7d413ad9b7f5f018ffd6c302dcb0b2b4c7b6df4ab584ca64c99c101bad208a5b9a89c3641c47a244ee942f778e62dbc38db9fced5b6513c01ada7610caea909f81aa3a01dca4688222a90904217766ed502227e09dc06826ac2a31546c036c299644fd5917d222befca0a5f6f53e737712af11844c58b71eb456dbea71ed924d9448d02772a2936f2b278f2d8d1cfee0f16df20580cf4a0097de5013a002713e60b8304c12d8a715c9a2e9f4443c9f18b6308a2b01360deb6fc00b6f4ae506a4262310a68ca29c7e8f2771200c852a0a452114b11b11724088c50985ee7ab3c94bcd5eaff973bfbd110991164b18c4f965336388915bc748f89bcefca4749372dd3181d04d414d8505969b694eb38c0cb3f6e1bb7ed61af83ec7e1655d75a7a33acc89689857bb9357254e23441d3f09f2d3939d183e3cb3a39349f3d18b7c550121659a9aec418a767c166cc9a75c23a82350f608c58ba87c741fc3195c1b00175962db4e7004fb1590f9ca0889183613cf3b6b1c2f1e8d4895798ddba682b057f721d10b8128d972b83558370ae2c2d57292cbfda1c6fd8c98073fd4603da9faf53c1361e414d4d9ca8ad9279bad8597735064961460a3b4ab83d4aa7b7ab67ba6a0d686c9a449142e98decf8e2792b671308b0d6c6a179514003b149106f3f5e40cd601ba9b97a2c3a536785ad08719710ef3163946fbdd9b2d0b99997fbec5cd048481918a1d5c725bb5966415cfdfc9dc5049dcd30b0759fc55ae9b8ee0ab96cfa1ec6382e8d9befe3dc43415ee15d316cfca1fbbaf97261aac5056dc5e8b666fa996ba33cff1b21d2fa085ca46563f78b78eb71e6cfb89b016035676d964e3fd08ebf8de8a7f3f77fb73cc11e3b7f7a3175f19d4ce9726aba7eb92e5b2bfd73458b2be730d21770d07f0b769106954e47d361f4243b3e9c80042c8a9636c10746e706524e8a6959d"}, {0xe8, 0x112, 0x1, "c90bc1ff0a1ff6dd93c544ca95cd6837b9d25c435aa179121ef38d668d2aed2e3de8599ff01809cc62dbbbda8698a32ea1db953f25418e571372f760e7e98ca54cbb3376f2d64538e99930404abe20ccbe4f109dc68f724738b235ef4ff905ba8e7dfade67e2a69b9d083bf3ef6f69f2e55a6233797a08dbd8a5d301c047ebb35fa30aade343ecb877fd60bc748310428addcdb8293c65c514504191efef00045d022c6bc0afc1a333f7a878d710c5f9dc3d240296f2ffca8f632acf469f7cde05f11c5161a4d4711b6f4baf405f3b6e1bac2bf4"}, {0x80, 0x307, 0x2d8, "32cfef7f6978aab8c0ca5592a79eec5287bd077c34fb0ea05dc659b785d33c65e72dfe244ad8c42051f8d52780f6c9d9130500e99755461bf2bde77c1f95ce4b85875e366e57165a12d5495014ae24b02e6d519544f49e672e466516ef94bc6ced9cfb4a70ba2194fd01cc"}, {0x48, 0x10a, 0x7, "2c6203bb209b3aedc2ef2edc8f257fcf5fd892287746b134c22fbfac247b7dd55cfdf07733b48f9ae1cb9bb80e9649a64ef745cd53"}, {0x1010, 0x118, 0x9, "85ba68e634d6ff44d3150f957370918f7b5f9fc6754526b803d771552859a2cce7447dfeeca09a58700fc09fe78cdf60eecbdb4f9e6808860a851fc6102a5b29cb44510e929946a088273ef5fc0b07cabe64c9be9a0c645db363abaa867e3687e4a54270e158e91e78503684c5f27513868de0d5c1cc8397b6f35d8b445d3d1ea65c46fd9fc0ba65a889b1485eb2a80a626793ffc4d73489a5379f6a049556b19bca43dbd58b18be1290c1a2dcc2fb68dd45fdcc6f1c513d22888fc376cf147c7b209f1df7a990a72a3ac671f8e50d0889a65d5d9aae58e14f55bb077d54bdb7b87883408013140f7e0a4544c7a91fb1f23c15b9c20ba30cd92b82a29a3b9661826d38a49852a5e1b93f6190eb3458999a2281f8587c0fb17ac264089b2dff0e8a59c7816d10e32ff4f7c6e1bf1a3efc2f1abef706c778402c72cf088a9aeb826b9bae1e3c56e006e7c6f9a2d653b438f6836e8e7457ae97e219172df501690af7292478803e405b062b3bbb707f5a74ace63b346fabe84c484896d500a4f86730d8ee85a933e8f2e36634bdc7b379ea4a9a4290ed64ea573d2fdc2695f5a11b2103d2fede574441f4d7068ee96e0d006a5b95996d7d2a0411994ec81f11bd09093b0b5683f5f08da309b68de7c0a8d99ccc197445779f5a803e3fc65a8f3b54237b6345daba43262cd4dc1a3debacd412ca4dcc9195c138c0ad7797da0c9ebe1920827acfb1a06079c6c87eed0bf5b7f5806e04a17a3815125dcf0fe42160ba9c56431c32463efedf56528a886a8dd7a0b2d00e33a2d312eea01c425e94773ceca74e7287a0a844dbe480655130e9e2c839efc8da84dfde1db992613c20dd3af35f6aa365739c82acf2ae8a9e8791e56996f09abea6f7433377816314124c42b829e427d40903585b09e77e61df05e7320b278deeb2b9f378022c44e722dc442f9ca9d5293405737e7b25d9329cbf5f7febc16d0a42b5f7a49f818d0c20f6f1a6accb76f1569ca355471d13bb95244397ea10cd23078ca7810094fbeb25df4f35e3c9b935ffdd48e431869d79039a9ebbb67b271d0e43e85ecb3ee1b0949c479e56a52257a953d3c8824f5359d6757b0316ecf19720efc2e808893e4d028771d7959d66ad3221624fd9cec8f5f229e960fab3ddca8b278e539b5dcfdf4522454f24f3512147b2511d34e5e3ec7e4669780260117e2aad82705e871ba1e7926b5000dd871a8065981d7e497e9594ba775c7457c31f7424164411fa49b89d951b3e31175daaa1d6ec3bf958407e530f7c5c7621eaef4d4a2fca2b1172184d627183e12a64e4ceb9a0b971a503979c5bd3c89d2b1d2dd8cbe88c96a91bda9ca7b689a46441ac4a9ebb23e05af10d6694a2d7e1e03a21daa3e5ebec1c1eb8b4fc541b856fba000cfa6f0db5bd5cae641029ea7873b71d20561a78c0581b921b1ebca28eb5597f615038bf655a284fbd9507a334ef13a082ae656d174a6f6417e07eb70e6c70e687ae92cc9f9571fff5db243ef10ae2de4d8da1a08f9f295830464c65c33f8d970eb2546330b59bbb8b1935109cf084e7e27f72fe95ccc0ef8a3c5f8afa7c2fc31e8a264838dc7426979f88ebbf057f01539678f5ed8e2d9ff64f57cea0918a0a5e72046c979c83b4457536cd0f3f4aff7eb4c58c573cb7d4f58ffb23abe9a88b989125144b9063a3022f2aaa72a905e9c3add6594cd3e12475d64e3333409091c95a78da3b2047a26b81114d793f22e8a48ed132a4436f0459a84dcbbc09b5442432feeed36b7efdbe9b2f5f43135e6db9ff72723afaa57e8ba93fc5934e9deb2393d5969d998ab8527b9ea764fcc09c3459f5d841f2664846af3bb36eaae1693c2504ac8a2a0605895b7769c8db9077732e3092619b8097de45110807aa3fe2bb9671d3272d192cf3cf0103e0eb5d9cdbf61020a112663058d2b88cb6bf482e3bb648f54ee8269664063f7577ec1350b2e1732fd2772a77ae08761d8825b3b122b5e651c4b5831fc8e0af51817e5b1632ecc69fca667bc8d78bc55ac1616091b2d0d2f9723a28351a5f07fe83bd67d3381a01849b66314b356d802b88f9c4864f5ccb55a3ca6976deec33c38bf66005b5df9f8ad485d8e53887c04264d6eac4be90cacb8be5c1c213d605c4eda7f9028e54fd29ff4684cc5f2f1e108aa8f72c265ab9e4173e9142da5f72ddf1b17b75b70b1f6b40b874275f0904430ba6a90a3bf07dd53233ffcddde8871d93a9ccbb0c2111f0c9a8e3ba01de77fdd882db9c71e23ce550bd49e5a7072f8a7bbfc85f39d60e312b42c0354baf7190b9396abfec13b6767aca6223c55f75ec7bc95fcadca0245f40be4d3d77e3bd4ee2e7d29bff44ad12c443762052d34667286a04003ec45676f1ed0eb465154573910f1669c8864ff755662106e10d9b614b4548431025cf67c6322ab3727ae9017ab280865d5f623a60108dc8eabd593f3007fb171cc751b8e3d0695fc535bad3541501be78ba4c362757391e5b6e54d082aed66879831d210843b9b7510ef9b1ad96329194b46848ba63e986fb8ad991ba8f91bbdafdb405b7f86207182892a51d814244d030e55b8c885ae0a970567d822e8e4d990d232118a13759762ab4442648eef0ee0b0fe45b48a6a156313dbb1137ef959be35477dff63bd58fe7cdc3d819abebf30e6dabcbb6fa13b1e957d58d79d69f18e1ebf869e013a8d30012e4975d339bf0e14cae8a46c3d799ef4c852a725e46ca2fd70ead45da556564db4e12674dc096b0977da30b1a01836719255fefacf160d9a6f10abb967ad99a995221937383fa581a1d50ecc98eb9b2ef60ee8e033267d08e34b28a873bd161dbe265e3b91ecd0319166e67f0323f75873c52af2b33aa3e59179da22011a920c91531e24088384c7d8f5c3179d417580c7c6e15696bac963803afecae1ff47cb6628a7e15e017a55257cf216f41f34ceb1d9c7e86f8246fbabae0656d926769b3bb546cf34dde63d9ae06da644a2f7ceea1eb204b7d44eb350f2bdf1406d07541c863086416f054c76cb57138163401c4be74538f62f6137aad6440dd5a1cb52d637b3684129095b71e2b69aef0905b1da58e631940bd01d115576d01c5b510ec2508060ed028061527ccf72b825d94ee560ddac78697a5e1c2c0644065b0f4f8d25fcaae9805174f20bb6cdf5bd94f86151c815e50231eb75adc9e2a40717600d248c02a027615e3537828aada0e17c8034c69e4f8e224790b037c1b564784e9194c6819f4b9f936af7dbea9021e4582155b7a2650ae07b344c287e4eb4f005a872fef9bc7ca0fd199133cb498dd4dbbe669869531a8695e362838803577ae1f40339d3cfeb271a5e1121a83c901bc3a356a2bd46cd1fc85e1f2c092b559292e9c381eb1e031ad34ef7215660f91aa06fb57f5c33e13a4597f641878513fc6a7e240b6985f93db6e0735bf2086cb7333af910a841d1fb3b7cfc062c3251b449f44ee7c54084ccde62d5dfe0f58f6f3cbfe5cf79baab37d7ef51e07ccba6a2a57c670b9c5ba950451ad79bb77f24e08ca854b3669c67af10fb801ce15b35ceb331d734f1c4e3170cd42a19f75c330befc2b45a607f4314d249199537e0f3ee965db6b992a7ba87aa21d161d7e9fbe61aa4808f85a7acd60eb406a1338839cb898a3a9cffe20a9c82503308c169d9e3f61481632210398594483239b7886f9b92f21ca22a56335c27fcd9d196ac0aaffeb72ef5fd0e63d0b884384322b2de9cbd26b18aab40db94f8ce2126b95a90e66a59db1a1895d776ab0e3dc21345a8c470c917a6cd6dbe465fc28a0d45a6c9d2be34360c7aebdce4e954e6ca35188f07f2f881c85576381f962beaa24adf2a10ae68b653af999f382dc110d7204dfcd38bb2e06c00d8bfe7be93367561e00bc2ee9cb1aff1cbbcd10b2b5ed561594a77b6b45bbd048f95c310f3a22b0bfa50e7a91c2818c90da4f038625afa3652bd31de3043153762ffb4775f088c4d6dba42c4073b53320c1208a3d628157822e94b7330912b6915f911c81a6ad496f12d222cdb424071f213f612301a25acd87149e11aa09403497197bacbcacce75869dc2bc7c8aae1a8787aecd824ab970b245931937db09538ae074ba06012e344a726be02de63efb62146c934f69f657e5aa69eed58c4c69546d4803c42090b912a7472d7618109e7e44429c24602109d11bbd6b17e19cc5602e7430a869f06c53442ab499b3f0f2285f07da547f3cda071bd0a61ea9161a2b4628724f267481958ad4331224cafe203057fb4e4cdfa75dc763112982b35eaf973c17e8740edde108da2bfc4f40ee68ad1401d09de5d5daeaaebe7f3ed594dda73631e423befb5b1e9e1b3ffccdfd2aad793c93f8557f4005fcf2b12c7aedb5c57137b61ef849d1365e3c7f3f7c7d0b51a0d58275c2fccbfd06404004415651920ca3c4a1171efd4610ca5651103466e53d0d45102adeb370039d2816b429c30229cbe4a0c8582e13efdc212f358420eaccb5251a3ab1d0020a0f89fce45fa52a3a70c3db8094f5240cb20407ad5001aeb1cb27609816b3cbd768f898bd73d340c3103a3ecbe1b3d1062f5b76b183036cb7b7b4da951d561f1696cd4367feab77ebeaedbf15e5e86dc16d57c033749196f70c4e705bce0edc9766ad7ffaa6e2862c809b22a64c4588aba671f030702dfd2d8b848cc696ce6037624782a7a36f610fd3acf44bd776e4d03924ba386e885f84473f56289ec993dacd22ff0a59fca697ada3ea16563b6fefc80db04836bbc57826250d348df14da2a4f84f8876da3d60dbf73234680b458fc8c2cd941ca654183253670643f11a2915fbaac84030ad5a2e950ae60583dfb177535b3675494d3f8c4c3b22f7ede547f9eed8c095153d6b72626e894c83f3d0bf34911c069f074d3b121ea808a89435b6bb443c45697d5a6d77f6d51fb4768853f3a6b345fb820e455af3ae7d2747ea3d0a64c93c647827bdb9e20fdf90c1ff437c0b3fca12170b3a54e416fa8f525b96f9a42988e1da9abc2cde2a6e76550a0d7ebd1e78ea252351e1bd2b786702f3c2870eb6909fa12dd5f474f81adaf915d0163874d002773c6352e8cf52f3478aefe23ad463b5b1d1d36eb3d8be289ec7ecf1edfe2b8954a1e6f98391741d9e80184ac00ef8cef8dc609b33eb1595cc789ff4383df023ef3e3179dc080e52b9040f06976271c3dc86fc561263626190356811c8a8f2eea9eaed27eb89260b7fd262a4ce49eb3bba85f6aa4585f42d4b22c6386b56cce6b612eee8246b554a8a3411c376e76d98acaa12dc2a3da64eb85e8c07cc79a32ba78aa07da2d48890b714b169a8cf7647244df2e5234cdc9116230c6d40e8ea27302d4cd7f494e0e29ad18940606be4f54d87ce16d4780b1e9b04609ea7f52a3692a6c11cc5f5dd3a4dbe02a53b31f2b9ad365d8fac9edf4a6e314e383991bafd5659e2b089914f39f090e2147e361f48ee612a2367ceb8bfb5b4e2af16af66faacbe1f44ca81e69bbf04756ceb93e1b2b6d43d089fd0d6fcc945f1097a303bf5fb8361ec61c9b976cd2fc0219cdbad5133c2eb26c4b47ff323f228c93e06ebd04724c5537eb02cf63b5e58681b21a59885568ed83d41c495fa47df12ec0505b0b3e1aa03ded37641d0f01a16c0e1310a47920a211c8c769bda52f6de57928ec2b1defe7ae36d2ec077cd5937cf0daa5185d620aa64a85768422f670ca01e19c387b19a2d081a39c2d80f12e52ed5fe2793a38fbb614017d4b359051b5c660aeb43889aedbfdc20a05452c0"}, {0x108, 0x10d, 0x5, "e5aa54c2a0b2a958802c74c7f390513d2ac52734ab3cb30176f532241412c5bf69221039340ced534849365329b50e3a615e0a1b4bae87d89e91409468eafe6e38f73ca5cc82328a647d06d507b5fa341837d9f08bcc00c00bcfdd23d077d5e57ba4b38b9e45f8956cde258e9714d3f517a8c67e12d4639ea2bb9da21b92782b3cd9cabd2850456746abf93a6b501169b15f631613919f21e5d3fd8d147cdeeef46842b96fe45354b1052049780be7292bdf2fa0e9598e40c9566a48ad3410dd45cfbff6e0df22e0c2fb533b73fd0b338ab3d73aa4d336568c5ad4487d5cdfb3fc4885e59e487d3bfabbb43a818bb326b6"}, {0x68, 0x3a, 0x7, "65c42a652ad9fee1598d1e7e180631317ec08c7a756268740a5b79cfc751c1b9d9b49e1abbdc4a40197c9cec9d265f71eb06599f4cbce2c2746d59383e96be22408a874680fa0f7bea557c03d424e75684b0f44c72"}, {0x50, 0x103, 0x5, "339762991462a50b3ec306927a0826360681016734b595436db2c42eb4b4cd86b8bb7ca1add75d7a60c1ea13049c675bc15f5cfa11d799cf32943cd8"}], 0x2390}, 0x4c841) (async) tee(r1, r7, 0x5, 0x9) (async) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001500)=@newqdisc={0x6c, 0x24, 0x2, 0x0, 0x4, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x1ff, 0x1000, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0xffffff76, 0x2, {0x2, 0x8b1e, 0x1, 0xffffffff}}]}]}}}]}, 0x71}}, 0x0) (async) sendto$packet(r0, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c288a8", 0x36, 0x830, &(0x7f0000000440)={0x11, 0x0, r5, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}}, 0x14) 636.434253ms ago: executing program 1 (id=1420): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000aa22b9000000000000040000000000000000000000000000000038fc8148ce7c99cb904fd4be556c723ed648f36e43553262d9c230aa22b6871bf78cd11f591bce26fc47f965d8f9a756a8e5cdd6d6f7accbc5e9fbc804560204ef408bf7750a49d55101581c5a308074bbd679ad6d0b2ef466d3f6a612e5a41aaa5c26362f14153abe65ed09e1d75a4f194a71191138b4a9d04e2f"], 0x50) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x1041, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000540)=[{0x6, 0x37, 0x0, 0x9}]}, 0x10) unshare(0x22020400) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x6}]}, 0x10) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCSIFBR(r4, 0x8941, &(0x7f0000000040)=@get={0x1, &(0x7f0000000180)=""/160, 0x7}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000730109000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f00000006c0)=ANY=[@ANYBLOB="000086dd000411001400006000006eec00be00442f0100000000000000000000ffff7f000001ff020000000000000000000000000001042022eb"], 0x7a) 616.025488ms ago: executing program 3 (id=1421): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r5, &(0x7f0000000200)={0xa, 0x4e22, 0x2, @empty, 0x8}, 0x1c) listen(r5, 0x204) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x34, r3, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x34}}, 0x20004834) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd70100400000005000000060001000800000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4008090}, 0x30) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000005e007f0a7eed1168379a3601ffc4910700004f78d4"], 0x1c}}, 0x0) recvmmsg$unix(r9, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002040)=ANY=[@ANYBLOB='@\r\x00\x00', @ANYRES16=r11, @ANYBLOB="05000000000000000000010000000600060000000000c40c0880e400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b24000100000000000000000000000000000000000000000000000000000000000000000024000200fcbefe9641719404cc5c9ab2766dd4793e367b0ea55e65e2e3416ac9d4e68841240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c0800030000000000240002005da952055e5857d673cddd36909746c80efa3ff95c317de1063db32bc80a0b3e0003008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0600050000000000d002098058000080060001000200000008000200ac1e00010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff05000300000000007c000080060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200000000000500030000000000dc000080060001000a0000001400020000000000000000000000ffffac1414aa05000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1e0001050003000000000094000080060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000200000008000200e00000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000200000008000200ffffffff050003000000000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff020000000000000000000000000001050003000000000064000080080003000000000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a5499400008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002000000000000000000000000000000d807008000030980f4000080060001000a00000014000200000000000000000000000000000000000500030000000000060001000a00000014000200fc00"/1342, @ANYRES32], 0xd40}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r8, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=ANY=[@ANYBLOB="ac0000000001050500000000000008000a0000003c0002802c00018014000300ff0100000000000000000000000000011400e3fffe0200000000000000"], 0xac}}, 0x0) 489.121267ms ago: executing program 1 (id=1422): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000002000000000000002200000091a040000000000095"], &(0x7f0000000000)='GPL\x00', 0x4, 0xd, &(0x7f00000000c0)=""/13, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x4c, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x60}, @val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r4 = accept$ax25(0xffffffffffffffff, &(0x7f0000000040)={{}, [@rose, @remote, @bcast, @netrom, @null, @default, @netrom, @null]}, &(0x7f0000000100)=0x48) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f0000000240)={0x0, 'veth1_to_bridge\x00', {}, 0x101}) 438.548027ms ago: executing program 3 (id=1423): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000001c80)=ANY=[@ANYBLOB="1802000001000000000085000000870000"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) socket$tipc(0x1e, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000099a48d073cc92206be934e8a5e74c1f600000000000000bc301000080000009500000000000000"], &(0x7f00000005c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) socket$netlink(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x9, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRES8], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x37e2f4aba9289b81, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r1}, 0x18) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x2, 0x0, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000100)=[{{0x3, 0x1}, {0x0, 0x1, 0x1}}], 0x8) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010001ffe00989837a182138b00268f1c", @ANYRES32=0x0, @ANYBLOB="ff7f000080000000140012800a00010076786c616e0000000400028008000a00", @ANYRES64=r3], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) 301.137978ms ago: executing program 1 (id=1424): socket$kcm(0x10, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r0, &(0x7f00000004c0)='W', 0x1, 0x8005, &(0x7f0000000380)={0xa, 0x4e21, 0x0, @private0, 0xc}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f0000000240)) sendto$inet6(r0, &(0x7f00000007c0)="b928f10befa11d21f908763b44b2965bce9e2cb1069a2b111e50502ff22f29ebc62c43b3965e3cf5cc4ceb2f59f62a3c4dd5afb21e1ee10e647b6ad1074fefb6c07a91ec1a4cb59274b0c8a7911fe0f2a10042f911be9a1956aadc54d2107b7431b5e201d54ea7aeffe9ff22d0941f", 0x6f, 0x0, &(0x7f00000003c0)={0xa, 0x4e21, 0x5, @loopback, 0xfffff720}, 0x1c) bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x2710}, 0x10) listen(r1, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) connect$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x3, {0x0, 0x1, 0x4}, 0xff}, 0x18) r4 = socket$vsock_stream(0x28, 0x1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x90, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x38, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6}]}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @mcast2}]}]}, 0x90}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000f502000000400001"], 0x54}}, 0x0) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r8 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg(r4, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000480)="f48f2d4f6622b8e565f572dbc604f194ecf28cf95ddf9a8de9000000002bfe1393e8966273f4d669dbb59ceeda1639f705a9e1c53d4ff012ed00000000a1acad4cd99e971dbad8c12c2a272d6be5f0a1bcddcc2ebf14b078e12fcac97f4faccbaf16c4b597d21df1cd728bb23898c113e8f00e968999f29a44574e66c3189b6b6f005d4addb28e1dc020558dbe60851e58a4477ff74e04", 0x97}], 0x1}}], 0x1, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r9, 0x0, 0x20000140) recvmsg$kcm(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB="18000000", @ANYRES16=r11, @ANYBLOB="05002cbd7000bc1cdcfbe9499ae100000000000000036342ffdbdf250c000000040300801fe0a4f0c6dc823c94cc381c8e3fa000dad4e4ecef10c707ee21533dba019966d57b969a7ffe366200"/89], 0x18}, 0x1, 0x0, 0x0, 0x818}, 0x20000004) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 288.843118ms ago: executing program 3 (id=1425): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) socket$inet(0xa, 0x801, 0x84) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cgroup.freeze\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xf, &(0x7f00000002c0)=ANY=[@ANYRES8=r0, @ANYRES8=r0, @ANYRES64=r4], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0x5, 0x0, 0x0) (async) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x9, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) (async) write(r0, &(0x7f0000000640)="2700efff130007e2030e2000120f12ffffff003605980c56cd20e400050030606721d34d91922f876d027244fbcfe8c2e4a20d3d833aa97f4b1dc842bb7961739a2049346f0c8e38296b81c705792e2689daabb2245b4b3e0767015e0d21e6f0a666a9e3e4bb8a8c43943e7b81b17d8894a76a88c80d6298f366bb2c1e08ddb8b92d950d4fe2ea38febd6eb3538b3d832ad517b7d2f57632083dcd3c8f673c24dab7d20e8064bb0faff62d21572ed349264db371681116cd291600e4e47a746be2d6f7290f8ec56cc0ab608c935aaf04241c5257d476151cf4c39df355a19999772ac3421cf4adca926c822a32cedd7818bc1d08d3c9b3f6", 0x68) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x5, 0x6, &(0x7f0000000cc0)=ANY=[@ANYRESOCT], &(0x7f0000000300)='syzkaller\x00', 0x8001, 0xc3, &(0x7f0000000a00)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0xd, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x404, 0x0, 0x32, 0x40}, 0x9c) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r8, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)}, &(0x7f0000000540)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r8, 0x84, 0x0, &(0x7f0000000100)={r9, 0x4, 0x0, 0x80000001}, 0x10) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) (async) accept(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x0) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0xfffffffd, @loopback}, 0x1c) (async, rerun: 32) shutdown(r1, 0x2) (rerun: 32) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYRES32=0x0, @ANYBLOB="c6c1a4df8abe10af06e1bda42342fd6a0d11c9e22f559ea841005ee0d5a529b26f5765a3742e169e319b4a007bf048b26a2f12b859f0c494513d32350441c7788775b1f1be65d2461a41779bb548ea01e6b6b390d3c899599b963dafde0d8cc9a47c591978d302ad334d628525fa19d7b7774bba450327d215d2e0b5ee586c766671b4821149418c924fbd5229f25a52db4f38dcd5e836684c579c1ac656eaf275f8e93b17fa1b13776452b9e501e64557a65888d8beadb592a47dbe8132b85abd37a0ebbaa86b26e71a9d613060424c5c9a4fde7e"], 0x98}}, 0x40002) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) 146.879796ms ago: executing program 0 (id=1426): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000080), 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000000400350076657468305f6d614176746170000000140035006d61637674617030020000000000000014003500677265300000000000000000000000001400350076657468305f746f"], 0xe8}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="380000006800010000000000feffffff0a000000000000000600070003000000100008800c000100000000000000000108000500", @ANYRES32=r4], 0x38}}, 0x90) sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000056000100000000000000000007020000", @ANYRES32, @ANYBLOB=' \x00'], 0x38}}, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[@ANYBLOB='+pids'], 0x6) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="2d70696473203c6774bef3f3c62abe61002f1affdaa547be93717a7ad487a00bce4d10db6c7a532aaa2205f3700205fcaeb8228e309a97"], 0x6) 57.156703ms ago: executing program 4 (id=1427): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) accept4(r0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000009c0)=@newqdisc={0x4c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_drr={0x8}, @qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_OVERHEAD={0x8, 0x6, 0xed}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}]}}]}, 0x73}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = epoll_create1(0x80000) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000180)={0x6}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="300000001a00010000000000000000001c", @ANYRESOCT], 0x30}}, 0x0) clock_gettime(0x2, &(0x7f0000001140)) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, 0xffffffffffffffff) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r9, 0x0, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="1400000010000100000000cf2f66fa1b00000000000000000a50000000060a0b0400000000000000000200fffe24000480200001800700010063740000140002800100024001cdb7a813179b530000000c0900010073797a30000000000900020073797a3200000000140000001100010000bea3d6a70000000500000a"], 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f0000000100)={'nr0\x00', 0x2}) syz_emit_ethernet(0x11e, &(0x7f0000000ac0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0d86dd6a005c3900e83a00fc000000000000000000000000000001200100000000000000000000000000018f0090788100000200020003fe8000000000000000000000000000aa00000000000000000000000000000000fe80000000000000000000000000001f20650093d5d03b4101000000000000000000000000000007000000c40000000e040007fe80000000000000000000000000002800000000000000000000000000000000ff020000000000000000000000000001fe8000000000000000000000000000bb00000000000000000000000000000001000000000000000000080e00000000000001fc000000000000000000000000000000fc01000000000000000000000000000006080000000000000400000061002eef5c0006cf3ea787749a3704a3f63aee16a9af275b77f4b385dcd01145819ec3003fb9573a945f84a542a35f2f1d6734b834cc593566065f2f2bb137ebb2e2350b59d63a4179e1c2573310ac3e8a50108a0e6a11cfea51bd6ad51e7898aa699b010314edad6a2dd532584f404d9b7dfe7dd69dd7224d460bb562367f131465c3884477b3357e582e3f48a9a18646d7973af6f884a85d7ebbe81d9cab7eb223a5d6f8206b9d5b580d3d2b2b6f85ff1d202d904f75911cb1553d3d7696e280b6a210715d928e568396fe65b762837a9a723b6736b5cab89c305f8d5ef60d7797fe"], 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), r5) 43.139224ms ago: executing program 3 (id=1428): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = getpid() socket$netlink(0x10, 0x3, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000200"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d000000181100", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="14000000100001000000c8a2387300000000000a40000000160a03020000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800014000000000080002400000000014000000110001"], 0x68}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c000000170a01080000000000000000020000080900020073797a30220000000900010073797a30"], 0x2c}, 0x1, 0x0, 0x0, 0x44000}, 0x8094) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000048000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000408000140000000000900010073797a300000000008000a400000000284000000060a010400000000000000000100000008000b40000000000900010073797a30"], 0x124}}, 0x0) write(r3, &(0x7f0000000000)="2e000400010002", 0x7) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_BROADCAST={0xa}, @IFLA_NET_NS_PID={0x8, 0x13, r2}, @IFLA_MTU={0x8, 0x4, 0xffe1}]}, 0x50}}, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r9, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030080e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000040}, 0x24004000) sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000100)={&(0x7f000000c300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14}}, 0x64}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r11 = socket(0x1e, 0x4, 0x0) bind$alg(r11, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'fpu(pcbc(aes))\x00'}, 0x58) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r10}, 0x10) 0s ago: executing program 0 (id=1429): sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x1c, 0x0, 0x801, 0x0, 0x3, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000019000100000000000000000002"], 0x2c}}, 0x0) (async) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) (async, rerun: 32) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) (rerun: 32) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x44008011, 0x0, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)={0x2, {{0x2, 0x2, @multicast2}}, 0x1, 0x1, [{{0x2, 0x4e22, @empty}}]}, 0x110) (async) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8912, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) (async, rerun: 64) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x40}, &(0x7f0000000400)=0x40) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'dummy0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000041000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r4, @ANYBLOB="080004"], 0x4c}}, 0x0) kernel console output (not intermixed with test programs): estination available [ 101.523907][ T59] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.553658][ T1150] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.561089][ T6875] netlink: 'syz.2.254': attribute type 1 has an invalid length. [ 101.569686][ T6875] netlink: 4 bytes leftover after parsing attributes in process `syz.2.254'. [ 101.579959][ T1150] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.613013][ T1150] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.871861][ T6884] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 101.940120][ T6907] netlink: 48 bytes leftover after parsing attributes in process `syz.4.258'. [ 102.051441][ T6907] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 102.052459][ T9] IPVS: starting estimator thread 0... [ 102.072443][ T6913] syzkaller0: entered promiscuous mode [ 102.078665][ T6913] syzkaller0: entered allmulticast mode [ 102.086666][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.095642][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.113217][ T2910] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.129745][ T6913] tipc: Started in network mode [ 102.140952][ T6913] tipc: Node identity , cluster identity 4711 [ 102.147795][ T6913] tipc: Failed to obtain node identity [ 102.156256][ T6913] tipc: Enabling of bearer rejected, failed to enable media [ 102.162320][ T6915] netlink: 'syz.4.258': attribute type 39 has an invalid length. [ 102.174035][ T6916] IPVS: using max 41 ests per chain, 98400 per kthread [ 102.203678][ T1026] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.231653][ T6917] netlink: 96 bytes leftover after parsing attributes in process `syz.1.260'. [ 102.317505][ T5929] IPVS: starting estimator thread 0... [ 102.412979][ T6925] IPVS: using max 39 ests per chain, 93600 per kthread [ 102.700322][ T6950] netlink: 16 bytes leftover after parsing attributes in process `syz.0.266'. [ 102.874920][ T6961] netlink: 'syz.4.269': attribute type 1 has an invalid length. [ 102.921724][ T6961] bond1: (slave gretap1): making interface the new active one [ 102.931868][ T6961] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 102.953341][ T6961] bond1: (slave gretap2): Enslaving as an active interface with an up link [ 103.056224][ T6974] netlink: 8 bytes leftover after parsing attributes in process `syz.4.272'. [ 103.268058][ T6980] netlink: 16 bytes leftover after parsing attributes in process `syz.3.273'. [ 103.343995][ T6967] netlink: 'syz.0.271': attribute type 1 has an invalid length. [ 103.351966][ T6967] netlink: 144 bytes leftover after parsing attributes in process `syz.0.271'. [ 103.361739][ T6967] netlink: 96 bytes leftover after parsing attributes in process `syz.0.271'. [ 103.451272][ T6988] netlink: 'syz.4.274': attribute type 2 has an invalid length. [ 103.473119][ T6988] netlink: 'syz.4.274': attribute type 8 has an invalid length. [ 103.480902][ T6988] netlink: 132 bytes leftover after parsing attributes in process `syz.4.274'. [ 103.632735][ T6997] netlink: 'syz.4.278': attribute type 21 has an invalid length. [ 103.706080][ T6995] lo speed is unknown, defaulting to 1000 [ 103.712203][ T7002] 8021q: VLANs not supported on ip6_vti0 [ 103.720285][ T6995] lo speed is unknown, defaulting to 1000 [ 103.743386][ T6995] lo speed is unknown, defaulting to 1000 [ 103.799858][ T6995] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 103.871715][ T6995] lo speed is unknown, defaulting to 1000 [ 103.887885][ T6995] lo speed is unknown, defaulting to 1000 [ 103.895459][ T6995] lo speed is unknown, defaulting to 1000 [ 103.902406][ T6995] lo speed is unknown, defaulting to 1000 [ 103.911541][ T6995] lo speed is unknown, defaulting to 1000 [ 103.951966][ T6995] lo speed is unknown, defaulting to 1000 [ 103.960763][ T6995] lo speed is unknown, defaulting to 1000 [ 104.191025][ T7026] lo speed is unknown, defaulting to 1000 [ 104.729825][ T7035] lo speed is unknown, defaulting to 1000 [ 104.854529][ T7026] netlink: 'syz.3.286': attribute type 6 has an invalid length. [ 105.025203][ T7058] FAULT_INJECTION: forcing a failure. [ 105.025203][ T7058] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 105.030782][ T7061] netlink: 'syz.4.292': attribute type 1 has an invalid length. [ 105.050038][ T7058] CPU: 1 UID: 0 PID: 7058 Comm: syz.1.290 Not tainted syzkaller #0 PREEMPT(full) [ 105.050073][ T7058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 105.050086][ T7058] Call Trace: [ 105.050094][ T7058] [ 105.050102][ T7058] dump_stack_lvl+0x189/0x250 [ 105.050140][ T7058] ? __pfx____ratelimit+0x10/0x10 [ 105.050235][ T7058] ? __pfx_dump_stack_lvl+0x10/0x10 [ 105.050260][ T7058] ? __pfx__printk+0x10/0x10 [ 105.050288][ T7058] ? __might_fault+0xb0/0x130 [ 105.050323][ T7058] ? rcu_is_watching+0x15/0xb0 [ 105.050345][ T7058] should_fail_ex+0x414/0x560 [ 105.050375][ T7058] _copy_from_user+0x2d/0xb0 [ 105.050399][ T7058] ___sys_sendmsg+0x158/0x2a0 [ 105.050424][ T7058] ? __pfx____sys_sendmsg+0x10/0x10 [ 105.050466][ T7058] ? __fget_files+0x2a/0x420 [ 105.050484][ T7058] ? __fget_files+0x3a0/0x420 [ 105.050506][ T7058] __x64_sys_sendmsg+0x19b/0x260 [ 105.050528][ T7058] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 105.050554][ T7058] ? __pfx_ksys_write+0x10/0x10 [ 105.050580][ T7058] ? rcu_is_watching+0x15/0xb0 [ 105.050601][ T7058] ? rcu_is_watching+0x15/0xb0 [ 105.050621][ T7058] do_syscall_64+0xfa/0x3b0 [ 105.050640][ T7058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.050659][ T7058] ? clear_bhb_loop+0x60/0xb0 [ 105.050681][ T7058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.050701][ T7058] RIP: 0033:0x7f604d78ebe9 [ 105.050725][ T7058] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 105.050743][ T7058] RSP: 002b:00007f604e5f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 105.050771][ T7058] RAX: ffffffffffffffda RBX: 00007f604d9b6180 RCX: 00007f604d78ebe9 [ 105.050787][ T7058] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 000000000000000a [ 105.050800][ T7058] RBP: 00007f604e5f0090 R08: 0000000000000000 R09: 0000000000000000 [ 105.050813][ T7058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 105.050825][ T7058] R13: 00007f604d9b6218 R14: 00007f604d9b6180 R15: 00007ffd90473f68 [ 105.050850][ T7058] [ 105.297869][ T7033] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 105.473048][ T7067] lo speed is unknown, defaulting to 1000 [ 105.621516][ T7079] Driver unsupported XDP return value 0 on prog (id 131) dev N/A, expect packet loss! [ 105.906221][ T7090] syzkaller0: entered promiscuous mode [ 105.916064][ T7090] syzkaller0: entered allmulticast mode [ 105.924363][ T7087] tipc: Enabled bearer , priority 0 [ 105.953839][ T7090] tipc: Resetting bearer [ 106.007364][ T7090] ip6tnl1: entered promiscuous mode [ 106.035112][ T7090] ip6tnl1: entered allmulticast mode [ 106.045948][ T7090] team0: Device ip6tnl1 is of different type [ 106.109166][ T7086] tipc: Resetting bearer [ 106.121676][ T7086] tipc: Disabling bearer [ 106.519101][ T7120] validate_nla: 1 callbacks suppressed [ 106.519126][ T7120] netlink: 'syz.3.309': attribute type 3 has an invalid length. [ 106.603581][ T7126] netlink: 'syz.3.312': attribute type 1 has an invalid length. [ 106.634715][ T7126] __nla_validate_parse: 7 callbacks suppressed [ 106.634737][ T7126] netlink: 5624 bytes leftover after parsing attributes in process `syz.3.312'. [ 106.663596][ T7126] syzkaller0: entered promiscuous mode [ 106.669369][ T7126] syzkaller0: entered allmulticast mode [ 106.712473][ T7123] FAULT_INJECTION: forcing a failure. [ 106.712473][ T7123] name failslab, interval 1, probability 0, space 0, times 1 [ 106.730390][ T7123] CPU: 0 UID: 0 PID: 7123 Comm: syz.0.310 Not tainted syzkaller #0 PREEMPT(full) [ 106.730421][ T7123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 106.730434][ T7123] Call Trace: [ 106.730441][ T7123] [ 106.730450][ T7123] dump_stack_lvl+0x189/0x250 [ 106.730482][ T7123] ? __pfx____ratelimit+0x10/0x10 [ 106.730512][ T7123] ? __pfx_dump_stack_lvl+0x10/0x10 [ 106.730534][ T7123] ? __pfx__printk+0x10/0x10 [ 106.730562][ T7123] ? fs_reclaim_acquire+0x7d/0x100 [ 106.730595][ T7123] ? rcu_is_watching+0x15/0xb0 [ 106.730616][ T7123] ? __pfx___might_resched+0x10/0x10 [ 106.730633][ T7123] ? lock_acquire+0x5f/0x360 [ 106.730664][ T7123] should_fail_ex+0x414/0x560 [ 106.730694][ T7123] should_failslab+0xa8/0x100 [ 106.730726][ T7123] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 106.730755][ T7123] ? __alloc_skb+0x112/0x2d0 [ 106.730775][ T7123] __alloc_skb+0x112/0x2d0 [ 106.730795][ T7123] netlink_sendmsg+0x5c6/0xb30 [ 106.730819][ T7123] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.730839][ T7123] ? aa_sock_msg_perm+0xf1/0x1d0 [ 106.730859][ T7123] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 106.730881][ T7123] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.730899][ T7123] __sock_sendmsg+0x219/0x270 [ 106.730928][ T7123] ____sys_sendmsg+0x505/0x830 [ 106.730952][ T7123] ? __pfx_____sys_sendmsg+0x10/0x10 [ 106.730978][ T7123] ? import_iovec+0x74/0xa0 [ 106.731003][ T7123] ___sys_sendmsg+0x21f/0x2a0 [ 106.731025][ T7123] ? __pfx____sys_sendmsg+0x10/0x10 [ 106.731064][ T7123] ? __fget_files+0x2a/0x420 [ 106.731082][ T7123] ? __fget_files+0x3a0/0x420 [ 106.731112][ T7123] __x64_sys_sendmsg+0x19b/0x260 [ 106.731135][ T7123] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 106.731162][ T7123] ? __pfx_ksys_write+0x10/0x10 [ 106.731188][ T7123] ? rcu_is_watching+0x15/0xb0 [ 106.731210][ T7123] ? rcu_is_watching+0x15/0xb0 [ 106.731231][ T7123] do_syscall_64+0xfa/0x3b0 [ 106.731249][ T7123] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.731269][ T7123] ? clear_bhb_loop+0x60/0xb0 [ 106.731292][ T7123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.731312][ T7123] RIP: 0033:0x7fb79c58ebe9 [ 106.731331][ T7123] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 106.731350][ T7123] RSP: 002b:00007fb79d4d9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 106.731374][ T7123] RAX: ffffffffffffffda RBX: 00007fb79c7b5fa0 RCX: 00007fb79c58ebe9 [ 106.731390][ T7123] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 000000000000000a [ 106.731403][ T7123] RBP: 00007fb79d4d9090 R08: 0000000000000000 R09: 0000000000000000 [ 106.731416][ T7123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.731428][ T7123] R13: 00007fb79c7b6038 R14: 00007fb79c7b5fa0 R15: 00007ffd61ebefc8 [ 106.731451][ T7123] [ 107.077744][ T7133] netlink: 'syz.1.313': attribute type 29 has an invalid length. [ 107.159156][ T7143] bond0: (slave ipvlan1): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 107.199114][ T7143] bond0: (slave ipvlan1): The slave device specified does not support setting the MAC address [ 107.214655][ T7143] bond0: (slave ipvlan1): Error -95 calling set_mac_address [ 107.365919][ T30] audit: type=1800 audit(1756220519.809:2): pid=7141 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.315" name="memory.events" dev="tmpfs" ino=335 res=0 errno=0 [ 107.496360][ T7162] netlink: 'syz.0.320': attribute type 1 has an invalid length. [ 107.521491][ T7162] netlink: 'syz.0.320': attribute type 2 has an invalid length. [ 107.564272][ T7162] netlink: 'syz.0.320': attribute type 1 has an invalid length. [ 107.573710][ T7162] netlink: 1156 bytes leftover after parsing attributes in process `syz.0.320'. [ 107.658610][ T7176] netlink: 'syz.1.323': attribute type 1 has an invalid length. [ 107.731714][ T7176] bond2: entered promiscuous mode [ 107.738147][ T7176] 8021q: adding VLAN 0 to HW filter on device bond2 [ 107.763811][ T7176] bond2: (slave bridge1): making interface the new active one [ 107.772427][ T7176] bridge1: entered promiscuous mode [ 107.778961][ T7176] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 107.880045][ T7186] tipc: Started in network mode [ 107.894905][ T7186] tipc: Node identity 56b370178dd8, cluster identity 4711 [ 107.911947][ T7186] tipc: Enabled bearer , priority 0 [ 107.932756][ T7186] syzkaller0: entered promiscuous mode [ 107.940890][ T7186] syzkaller0: entered allmulticast mode [ 107.950279][ T7190] netlink: 'syz.1.327': attribute type 1 has an invalid length. [ 107.960608][ T7190] netlink: 5624 bytes leftover after parsing attributes in process `syz.1.327'. [ 107.973339][ T7192] netlink: 'syz.0.328': attribute type 1 has an invalid length. [ 107.989339][ T7186] tipc: Resetting bearer [ 108.006316][ T7192] netlink: 'syz.0.328': attribute type 1 has an invalid length. [ 108.018626][ T7192] netlink: 12 bytes leftover after parsing attributes in process `syz.0.328'. [ 108.028513][ T7185] tipc: Resetting bearer [ 108.038231][ T7192] block nbd0: shutting down sockets [ 108.067795][ T7185] tipc: Disabling bearer [ 108.085114][ T7197] syzkaller0: entered promiscuous mode [ 108.103291][ T7197] syzkaller0: entered allmulticast mode [ 108.256611][ T7205] netlink: 12 bytes leftover after parsing attributes in process `syz.0.330'. [ 108.321537][ T7208] netlink: 12 bytes leftover after parsing attributes in process `syz.1.333'. [ 108.373571][ T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.377787][ T7208] netlink: 12 bytes leftover after parsing attributes in process `syz.1.333'. [ 108.391137][ T12] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.429568][ T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.446079][ T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.620896][ T7221] lo speed is unknown, defaulting to 1000 [ 108.867058][ T7236] netlink: 28 bytes leftover after parsing attributes in process `syz.3.341'. [ 109.173873][ T7253] netlink: 40 bytes leftover after parsing attributes in process `syz.3.345'. [ 109.178796][ T7258] gtp0: entered promiscuous mode [ 109.184599][ T7259] netlink: 40 bytes leftover after parsing attributes in process `syz.3.345'. [ 109.334492][ T7269] netlink: zone id is out of range [ 109.339878][ T7269] netlink: zone id is out of range [ 109.345771][ T7269] netlink: zone id is out of range [ 109.351052][ T7269] netlink: zone id is out of range [ 109.356444][ T7269] netlink: zone id is out of range [ 109.367690][ T7269] netlink: get zone limit has 8 unknown bytes [ 109.493121][ T7278] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 109.510802][ T7283] FAULT_INJECTION: forcing a failure. [ 109.510802][ T7283] name failslab, interval 1, probability 0, space 0, times 0 [ 109.515566][ T7279] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 109.541957][ T7283] CPU: 1 UID: 0 PID: 7283 Comm: syz.0.352 Not tainted syzkaller #0 PREEMPT(full) [ 109.541992][ T7283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 109.542006][ T7283] Call Trace: [ 109.542014][ T7283] [ 109.542025][ T7283] dump_stack_lvl+0x189/0x250 [ 109.542059][ T7283] ? __pfx____ratelimit+0x10/0x10 [ 109.542100][ T7283] ? __pfx_dump_stack_lvl+0x10/0x10 [ 109.542124][ T7283] ? __pfx__printk+0x10/0x10 [ 109.542152][ T7283] ? rcu_is_watching+0x15/0xb0 [ 109.542174][ T7283] ? __pfx___might_resched+0x10/0x10 [ 109.542194][ T7283] ? lock_acquire+0x5f/0x360 [ 109.542225][ T7283] should_fail_ex+0x414/0x560 [ 109.542256][ T7283] should_failslab+0xa8/0x100 [ 109.542289][ T7283] __kmalloc_noprof+0xcb/0x4f0 [ 109.542317][ T7283] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 109.542348][ T7283] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 109.542378][ T7283] genl_family_rcv_msg_doit+0xb8/0x300 [ 109.542407][ T7283] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 109.542436][ T7283] ? apparmor_capable+0x137/0x1b0 [ 109.542461][ T7283] ? bpf_lsm_capable+0x9/0x20 [ 109.542489][ T7283] ? security_capable+0x7e/0x2e0 [ 109.542523][ T7283] genl_rcv_msg+0x60e/0x790 [ 109.542550][ T7283] ? __pfx_genl_rcv_msg+0x10/0x10 [ 109.542573][ T7283] ? __pfx_mptcp_pm_nl_flush_addrs_doit+0x10/0x10 [ 109.542605][ T7283] ? __asan_memcpy+0x40/0x70 [ 109.542627][ T7283] ? __pfx_ref_tracker_free+0x10/0x10 [ 109.542655][ T7283] ? __skb_clone+0x63/0x7a0 [ 109.542698][ T7283] netlink_rcv_skb+0x208/0x470 [ 109.542731][ T7283] ? __pfx_genl_rcv_msg+0x10/0x10 [ 109.542756][ T7283] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 109.542795][ T7283] ? lock_release+0x4b/0x3e0 [ 109.542826][ T7283] ? down_read+0x1ad/0x2e0 [ 109.542845][ T7283] genl_rcv+0x28/0x40 [ 109.542865][ T7283] netlink_unicast+0x82f/0x9e0 [ 109.542896][ T7283] ? __pfx_netlink_unicast+0x10/0x10 [ 109.542922][ T7283] ? netlink_sendmsg+0x642/0xb30 [ 109.542939][ T7283] ? skb_put+0x11b/0x210 [ 109.542959][ T7283] netlink_sendmsg+0x805/0xb30 [ 109.542979][ T7283] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.542998][ T7283] ? aa_sock_msg_perm+0xf1/0x1d0 [ 109.543017][ T7283] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 109.543040][ T7283] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.543058][ T7283] __sock_sendmsg+0x219/0x270 [ 109.543096][ T7283] ____sys_sendmsg+0x505/0x830 [ 109.543121][ T7283] ? __pfx_____sys_sendmsg+0x10/0x10 [ 109.543148][ T7283] ? import_iovec+0x74/0xa0 [ 109.543172][ T7283] ___sys_sendmsg+0x21f/0x2a0 [ 109.543195][ T7283] ? __pfx____sys_sendmsg+0x10/0x10 [ 109.543235][ T7283] ? __fget_files+0x2a/0x420 [ 109.543252][ T7283] ? __fget_files+0x3a0/0x420 [ 109.543275][ T7283] __x64_sys_sendmsg+0x19b/0x260 [ 109.543298][ T7283] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 109.543324][ T7283] ? __pfx_ksys_write+0x10/0x10 [ 109.543350][ T7283] ? rcu_is_watching+0x15/0xb0 [ 109.543373][ T7283] ? rcu_is_watching+0x15/0xb0 [ 109.543394][ T7283] do_syscall_64+0xfa/0x3b0 [ 109.543414][ T7283] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.543434][ T7283] ? clear_bhb_loop+0x60/0xb0 [ 109.543457][ T7283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.543478][ T7283] RIP: 0033:0x7fb79c58ebe9 [ 109.543497][ T7283] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 109.543515][ T7283] RSP: 002b:00007fb79d4b8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 109.543538][ T7283] RAX: ffffffffffffffda RBX: 00007fb79c7b6090 RCX: 00007fb79c58ebe9 [ 109.543553][ T7283] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 0000000000000007 [ 109.543567][ T7283] RBP: 00007fb79d4b8090 R08: 0000000000000000 R09: 0000000000000000 [ 109.543579][ T7283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.543591][ T7283] R13: 00007fb79c7b6128 R14: 00007fb79c7b6090 R15: 00007ffd61ebefc8 [ 109.543615][ T7283] [ 109.931025][ T7278] openvswitch: netlink: IPv4 tunnel dst address is zero [ 109.936998][ T7279] openvswitch: netlink: IPv4 tunnel dst address is zero [ 109.938530][ T1210] lo speed is unknown, defaulting to 1000 [ 110.060705][ T7289] syz.2.355 (7289) used greatest stack depth: 17992 bytes left [ 110.080930][ T7296] IPVS: set_ctl: invalid protocol: 50 172.20.20.170:6 [ 110.394625][ T7311] 8021q: adding VLAN 0 to HW filter on device bond2 [ 110.455806][ T7318] 8021q: adding VLAN 0 to HW filter on device bond2 [ 110.470525][ T7318] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 110.484629][ T7318] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 110.515754][ T7311] veth3: entered promiscuous mode [ 110.523203][ T7311] bond2: (slave veth3): Enslaving as an active interface with a down link [ 110.760524][ T7336] bridge0: port 3(macvlan2) entered blocking state [ 110.775174][ T7336] bridge0: port 3(macvlan2) entered disabled state [ 110.791308][ T7336] macvlan2: entered allmulticast mode [ 110.807221][ T7336] bridge0: entered allmulticast mode [ 110.828996][ T7336] macvlan2: left allmulticast mode [ 110.849745][ T7336] bridge0: left allmulticast mode [ 110.901867][ T7341] bridge: RTM_NEWNEIGH with invalid ether address [ 111.140238][ T7350] lo speed is unknown, defaulting to 1000 [ 111.786287][ T7377] lo speed is unknown, defaulting to 1000 [ 112.181755][ T7402] FAULT_INJECTION: forcing a failure. [ 112.181755][ T7402] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 112.199427][ T7402] CPU: 1 UID: 0 PID: 7402 Comm: syz.1.386 Not tainted syzkaller #0 PREEMPT(full) [ 112.199461][ T7402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 112.199474][ T7402] Call Trace: [ 112.199482][ T7402] [ 112.199491][ T7402] dump_stack_lvl+0x189/0x250 [ 112.199524][ T7402] ? __pfx____ratelimit+0x10/0x10 [ 112.199556][ T7402] ? __pfx_dump_stack_lvl+0x10/0x10 [ 112.199581][ T7402] ? __pfx__printk+0x10/0x10 [ 112.199609][ T7402] ? __might_fault+0xb0/0x130 [ 112.199642][ T7402] ? bpf_trace_run2+0x322/0x4b0 [ 112.199673][ T7402] ? rcu_is_watching+0x15/0xb0 [ 112.199694][ T7402] should_fail_ex+0x414/0x560 [ 112.199734][ T7402] _copy_from_user+0x2d/0xb0 [ 112.199759][ T7402] kstrtouint_from_user+0xc4/0x170 [ 112.199791][ T7402] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 112.199827][ T7402] ? vfs_write+0x211/0xb30 [ 112.199854][ T7402] ? rcu_is_watching+0x15/0xb0 [ 112.199876][ T7402] proc_fail_nth_write+0x88/0x200 [ 112.199900][ T7402] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 112.199923][ T7402] ? security_file_permission+0x75/0x290 [ 112.199952][ T7402] ? preempt_count_add+0x91/0x1a0 [ 112.199985][ T7402] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 112.200010][ T7402] vfs_write+0x27e/0xb30 [ 112.200041][ T7402] ? __pfx_vfs_write+0x10/0x10 [ 112.200073][ T7402] ? __fget_files+0x3a0/0x420 [ 112.200091][ T7402] ? __fget_files+0x2a/0x420 [ 112.200114][ T7402] ksys_write+0x145/0x250 [ 112.200143][ T7402] ? __pfx_ksys_write+0x10/0x10 [ 112.200168][ T7402] ? rcu_is_watching+0x15/0xb0 [ 112.200191][ T7402] ? rcu_is_watching+0x15/0xb0 [ 112.200213][ T7402] do_syscall_64+0xfa/0x3b0 [ 112.200232][ T7402] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.200253][ T7402] ? clear_bhb_loop+0x60/0xb0 [ 112.200277][ T7402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.200297][ T7402] RIP: 0033:0x7f604d78d69f [ 112.200317][ T7402] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 112.200335][ T7402] RSP: 002b:00007f604e611030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 112.200359][ T7402] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f604d78d69f [ 112.200373][ T7402] RDX: 0000000000000001 RSI: 00007f604e6110a0 RDI: 0000000000000008 [ 112.200386][ T7402] RBP: 00007f604e611090 R08: 0000000000000000 R09: 0000000000000000 [ 112.200399][ T7402] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 112.200411][ T7402] R13: 00007f604d9b6128 R14: 00007f604d9b6090 R15: 00007ffd90473f68 [ 112.200436][ T7402] [ 112.710256][ T7407] syzkaller1: entered allmulticast mode [ 112.809281][ T7421] macvlan1: entered promiscuous mode [ 112.817517][ T7421] ipvlan0: entered promiscuous mode [ 112.825926][ T7421] ipvlan0: left promiscuous mode [ 112.831326][ T7421] macvlan1: left promiscuous mode [ 113.211980][ T7440] validate_nla: 6 callbacks suppressed [ 113.212007][ T7440] netlink: 'syz.4.399': attribute type 1 has an invalid length. [ 113.236292][ T7440] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 113.591643][ T7448] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 113.617882][ T7448] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.626245][ T7448] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.788321][ T7460] __nla_validate_parse: 4 callbacks suppressed [ 113.788345][ T7460] netlink: 24 bytes leftover after parsing attributes in process `syz.3.405'. [ 113.902535][ T7466] netlink: 'syz.3.406': attribute type 13 has an invalid length. [ 113.911208][ T7466] netlink: 'syz.3.406': attribute type 17 has an invalid length. [ 114.022575][ T7466] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.030720][ T7466] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.038594][ T7466] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.046205][ T7466] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.121540][ T7467] lo speed is unknown, defaulting to 1000 [ 114.219737][ T7466] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.545758][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 152.169969][ T7479] tap0: tun_chr_ioctl cmd 1074025673 [ 152.187211][ T7479] tap0: tun_chr_ioctl cmd 1074025673 [ 152.196139][ T7484] IPv6: NLM_F_CREATE should be specified when creating new route [ 152.197871][ T7479] tap0: tun_chr_ioctl cmd 1074025673 [ 152.217982][ T7479] tap0: tun_chr_ioctl cmd 1074025673 [ 152.223767][ T7475] tap0: tun_chr_ioctl cmd 1074025677 [ 152.229908][ T7475] tap0: linktype set to 776 [ 152.237172][ T7487] netlink: 12 bytes leftover after parsing attributes in process `syz.4.413'. [ 152.251661][ T7481] lo speed is unknown, defaulting to 1000 [ 152.258476][ T7479] tap0: tun_chr_ioctl cmd 1074025673 [ 152.354117][ T7496] netlink: 4 bytes leftover after parsing attributes in process `syz.3.414'. [ 152.379643][ T7496] netlink: 4 bytes leftover after parsing attributes in process `syz.3.414'. [ 152.497359][ T7503] netlink: 'syz.3.416': attribute type 1 has an invalid length. [ 152.615301][ T7507] netlink: 'syz.4.419': attribute type 13 has an invalid length. [ 152.636434][ T7511] netlink: 8 bytes leftover after parsing attributes in process `syz.3.416'. [ 152.656462][ T7507] netlink: 'syz.4.419': attribute type 17 has an invalid length. [ 152.667625][ T7510] syz_tun: entered allmulticast mode [ 152.828230][ T7517] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 152.840973][ T7507] net_ratelimit: 1 callbacks suppressed [ 152.840986][ T7507] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 152.907079][ T7520] lo speed is unknown, defaulting to 1000 [ 152.915396][ T7513] lo speed is unknown, defaulting to 1000 [ 153.035291][ T7507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 153.046554][ T7481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.410'. [ 153.061940][ T7481] netlink: 20 bytes leftover after parsing attributes in process `syz.1.410'. [ 153.122263][ T7481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.410'. [ 153.172306][ T7523] netlink: 'syz.2.422': attribute type 1 has an invalid length. [ 153.189840][ T7509] syz_tun: left allmulticast mode [ 153.205911][ T7523] netlink: 3 bytes leftover after parsing attributes in process `syz.2.422'. [ 153.225761][ T7523] batadv1: entered promiscuous mode [ 153.231480][ T7523] batadv1: entered allmulticast mode [ 153.432277][ T7523] netlink: 48 bytes leftover after parsing attributes in process `syz.2.422'. [ 153.526254][ T7537] netlink: 8 bytes leftover after parsing attributes in process `syz.1.425'. [ 153.619282][ T7537] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 153.628496][ T7537] macvtap1: entered promiscuous mode [ 153.697688][ T7543] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 153.720178][ T7543] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.770962][ T7544] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 153.793716][ T7544] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 153.821989][ T7544] team0: Failed to send options change via netlink (err -105) [ 153.847909][ T7544] team0: Port device batadv1 added [ 153.869269][ T7543] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 153.914460][ T7543] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.926788][ T7548] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 154.013058][ T7543] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 154.030391][ T7543] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.177969][ T7543] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 154.198464][ T7543] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.328408][ T59] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.337229][ T59] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.359327][ T34] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.368873][ T34] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.410644][ T7562] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 154.437058][ T12] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.450876][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.459885][ T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.470442][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.528886][ T7565] lo speed is unknown, defaulting to 1000 [ 154.840297][ T7571] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 154.913904][ T7574] netlink: 'syz.2.436': attribute type 1 has an invalid length. [ 154.961093][ T7583] lo speed is unknown, defaulting to 1000 [ 155.049650][ T7585] netlink: 'syz.4.441': attribute type 1 has an invalid length. [ 155.085954][ T7585] tipc: Enabled bearer , priority 0 [ 155.128129][ T7585] tipc: Resetting bearer [ 155.172420][ T7584] tipc: Disabling bearer [ 155.350862][ T7592] netlink: 'syz.3.442': attribute type 1 has an invalid length. [ 155.361232][ T7592] netlink: 'syz.3.442': attribute type 1 has an invalid length. [ 155.586258][ T7599] netlink: 'syz.4.445': attribute type 3 has an invalid length. [ 155.811763][ T7609] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 156.009518][ T7623] lo speed is unknown, defaulting to 1000 [ 156.059239][ T7625] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 156.726582][ T7659] tipc: Enabled bearer , priority 0 [ 156.735098][ T7659] syzkaller0: entered promiscuous mode [ 156.740905][ T7659] syzkaller0: entered allmulticast mode [ 156.756617][ T7659] tipc: Resetting bearer [ 156.776541][ T7659] tipc: Resetting bearer [ 156.785837][ T7659] tipc: Disabling bearer [ 157.010035][ T7680] netlink: 'syz.4.471': attribute type 1 has an invalid length. [ 157.046904][ T7680] 8021q: adding VLAN 0 to HW filter on device bond2 [ 157.226932][ T7689] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 157.246223][ T9] lo speed is unknown, defaulting to 1000 [ 157.252181][ T7698] __nla_validate_parse: 14 callbacks suppressed [ 157.252205][ T7698] netlink: 152 bytes leftover after parsing attributes in process `syz.3.476'. [ 157.268425][ T9] syz2: Port: 1 Link DOWN [ 157.289113][ T7698] block nbd0: not configured, cannot reconfigure [ 157.345993][ T7697] netlink: 24 bytes leftover after parsing attributes in process `syz.3.476'. [ 157.788961][ T7718] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 157.984175][ T7732] netlink: 16 bytes leftover after parsing attributes in process `syz.0.488'. [ 158.004120][ T7732] netlink: 64 bytes leftover after parsing attributes in process `syz.0.488'. [ 158.145840][ T7741] netlink: 16 bytes leftover after parsing attributes in process `syz.3.490'. [ 158.317843][ T7750] validate_nla: 2 callbacks suppressed [ 158.317871][ T7750] netlink: 'syz.4.495': attribute type 2 has an invalid length. [ 158.358050][ T7750] k*]: entered promiscuous mode [ 158.392119][ T7750] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 158.410286][ T7752] netlink: 12 bytes leftover after parsing attributes in process `syz.0.496'. [ 158.436079][ T7752] netlink: 12 bytes leftover after parsing attributes in process `syz.0.496'. [ 158.445825][ T12] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.455392][ T12] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.468882][ T7750] veth0_to_team: entered promiscuous mode [ 158.475520][ T7750] veth0_to_team: entered allmulticast mode [ 158.491814][ T7750] IPVS: set_ctl: invalid protocol: 41 100.1.1.1:20003 [ 158.499141][ T12] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.511267][ T12] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.654436][ T7760] lo speed is unknown, defaulting to 1000 [ 158.658476][ T7763] sctp: [Deprecated]: syz.1.499 (pid 7763) Use of int in max_burst socket option. [ 158.658476][ T7763] Use struct sctp_assoc_value instead [ 158.954865][ T7775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.501'. [ 159.105935][ T7777] syzkaller0: entered promiscuous mode [ 159.122820][ T7777] syzkaller0: entered allmulticast mode [ 159.325172][ T7782] netlink: 80 bytes leftover after parsing attributes in process `syz.2.504'. [ 159.668634][ T7797] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 160.230607][ T7808] netlink: 24 bytes leftover after parsing attributes in process `syz.2.512'. [ 160.392330][ T7812] lo speed is unknown, defaulting to 1000 [ 160.472093][ T7824] syzkaller0: entered promiscuous mode [ 160.478013][ T7824] syzkaller0: entered allmulticast mode [ 160.569790][ T7826] lo speed is unknown, defaulting to 1000 [ 160.689233][ T7830] lo speed is unknown, defaulting to 1000 [ 160.749058][ T7831] netlink: 'syz.2.518': attribute type 1 has an invalid length. [ 161.347341][ T7867] tipc: Enabling of bearer rejected, failed to enable media [ 161.386991][ T7869] syzkaller0: entered promiscuous mode [ 161.413351][ T7869] syzkaller0: entered allmulticast mode [ 161.788233][ T7879] tipc: Enabling of bearer rejected, failed to enable media [ 162.202174][ T7909] netlink: 'syz.0.541': attribute type 10 has an invalid length. [ 162.215904][ T7909] team0: Device veth0_macvtap failed to register rx_handler [ 162.272728][ T7913] syzkaller0: entered promiscuous mode [ 162.294493][ T7913] syzkaller0: entered allmulticast mode [ 162.361643][ T7920] __nla_validate_parse: 3 callbacks suppressed [ 162.361661][ T7920] netlink: 8 bytes leftover after parsing attributes in process `syz.0.544'. [ 162.447775][ T7925] bond0: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 162.505473][ T7925] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 162.523215][ T7925] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 162.591819][ T7933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.546'. [ 162.982579][ T7946] netlink: 4 bytes leftover after parsing attributes in process `syz.2.550'. [ 163.215291][ T7960] syzkaller0: entered promiscuous mode [ 163.222392][ T7960] syzkaller0: entered allmulticast mode [ 163.393947][ T7969] netlink: 36 bytes leftover after parsing attributes in process `syz.1.559'. [ 163.408540][ T7969] 8021q: VLANs not supported on ipvlan1 [ 163.598397][ T7979] FAULT_INJECTION: forcing a failure. [ 163.598397][ T7979] name failslab, interval 1, probability 0, space 0, times 0 [ 163.615629][ T7974] netlink: 8 bytes leftover after parsing attributes in process `syz.0.562'. [ 163.624941][ T7974] netlink: 8 bytes leftover after parsing attributes in process `syz.0.562'. [ 163.629337][ T7979] CPU: 1 UID: 0 PID: 7979 Comm: syz.1.564 Not tainted syzkaller #0 PREEMPT(full) [ 163.629378][ T7979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 163.629395][ T7979] Call Trace: [ 163.629405][ T7979] [ 163.629415][ T7979] dump_stack_lvl+0x189/0x250 [ 163.629458][ T7979] ? __pfx____ratelimit+0x10/0x10 [ 163.629496][ T7979] ? __pfx_dump_stack_lvl+0x10/0x10 [ 163.629525][ T7979] ? __pfx__printk+0x10/0x10 [ 163.629563][ T7979] ? __pfx___might_resched+0x10/0x10 [ 163.629587][ T7979] ? lock_acquire+0x5f/0x360 [ 163.629625][ T7979] should_fail_ex+0x414/0x560 [ 163.629660][ T7979] should_failslab+0xa8/0x100 [ 163.629700][ T7979] __kmalloc_noprof+0xcb/0x4f0 [ 163.629731][ T7979] ? kfree+0x4d/0x440 [ 163.629758][ T7979] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 163.629786][ T7979] tomoyo_realpath_from_path+0xe3/0x5d0 [ 163.629812][ T7979] ? tomoyo_domain+0xd9/0x130 [ 163.629839][ T7979] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 163.629871][ T7979] tomoyo_path_number_perm+0x1e8/0x5a0 [ 163.629903][ T7979] ? lock_release+0x4b/0x3e0 [ 163.629936][ T7979] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 163.629971][ T7979] ? rcu_is_watching+0x15/0xb0 [ 163.629997][ T7979] ? lock_release+0x4b/0x3e0 [ 163.630028][ T7979] ? vfs_write+0x956/0xb30 [ 163.630061][ T7979] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 163.630110][ T7979] ? lock_release+0x4b/0x3e0 [ 163.630147][ T7979] ? __fget_files+0x2a/0x420 [ 163.630166][ T7979] ? __fget_files+0x3a0/0x420 [ 163.630185][ T7979] ? __fget_files+0x2a/0x420 [ 163.630208][ T7979] security_file_ioctl+0xcb/0x2d0 [ 163.630245][ T7979] __se_sys_ioctl+0x47/0x170 [ 163.630276][ T7979] do_syscall_64+0xfa/0x3b0 [ 163.630304][ T7979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.630329][ T7979] ? clear_bhb_loop+0x60/0xb0 [ 163.630356][ T7979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.630378][ T7979] RIP: 0033:0x7f604d78ebe9 [ 163.630401][ T7979] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 163.630421][ T7979] RSP: 002b:00007f604e632038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 163.630448][ T7979] RAX: ffffffffffffffda RBX: 00007f604d9b5fa0 RCX: 00007f604d78ebe9 [ 163.630467][ T7979] RDX: 00002000000000c0 RSI: 000000000000890c RDI: 0000000000000004 [ 163.630482][ T7979] RBP: 00007f604e632090 R08: 0000000000000000 R09: 0000000000000000 [ 163.630497][ T7979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 163.630510][ T7979] R13: 00007f604d9b6038 R14: 00007f604d9b5fa0 R15: 00007ffd90473f68 [ 163.630538][ T7979] [ 163.631444][ T7979] ERROR: Out of memory at tomoyo_realpath_from_path. [ 163.638979][ T7974] Bluetooth: MGMT ver 1.23 [ 163.931004][ T7987] lo speed is unknown, defaulting to 1000 [ 164.077399][ T7994] syzkaller0: entered promiscuous mode [ 164.083694][ T7994] syzkaller0: entered allmulticast mode [ 164.369648][ T8008] netlink: 'syz.0.575': attribute type 9 has an invalid length. [ 164.397954][ T8011] syz.0.575: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 164.430479][ T8008] netlink: 'syz.0.575': attribute type 7 has an invalid length. [ 164.446898][ T8015] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 164.457468][ T8011] CPU: 0 UID: 0 PID: 8011 Comm: syz.0.575 Not tainted syzkaller #0 PREEMPT(full) [ 164.457499][ T8011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 164.457512][ T8011] Call Trace: [ 164.457521][ T8011] [ 164.457529][ T8011] dump_stack_lvl+0x189/0x250 [ 164.457565][ T8011] ? __pfx_dump_stack_lvl+0x10/0x10 [ 164.457590][ T8011] ? __pfx__printk+0x10/0x10 [ 164.457618][ T8011] ? lock_release+0x4b/0x3e0 [ 164.457651][ T8011] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 164.457678][ T8011] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 164.457703][ T8011] warn_alloc+0x214/0x310 [ 164.457740][ T8011] ? __pfx_warn_alloc+0x10/0x10 [ 164.457776][ T8011] ? __get_vm_area_node+0x28f/0x300 [ 164.457805][ T8011] ? xskq_create+0xbf/0x170 [ 164.457837][ T8011] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 164.457884][ T8011] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 164.457915][ T8011] ? xsk_setsockopt+0x502/0x8d0 [ 164.457944][ T8011] ? __kasan_kmalloc+0x93/0xb0 [ 164.457975][ T8011] vmalloc_user_noprof+0xad/0xf0 [ 164.458006][ T8011] ? xskq_create+0xbf/0x170 [ 164.458035][ T8011] xskq_create+0xbf/0x170 [ 164.458065][ T8011] xsk_init_queue+0xb0/0x110 [ 164.458103][ T8011] xsk_setsockopt+0x57b/0x8d0 [ 164.458132][ T8011] ? __pfx_xsk_setsockopt+0x10/0x10 [ 164.458158][ T8011] ? __pfx_aa_sk_perm+0x10/0x10 [ 164.458189][ T8011] ? lock_release+0x4b/0x3e0 [ 164.458225][ T8011] ? __se_sys_futex+0x36f/0x400 [ 164.458251][ T8011] ? aa_sock_opt_perm+0xff/0x1b0 [ 164.458272][ T8011] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 164.458296][ T8011] ? __pfx_xsk_setsockopt+0x10/0x10 [ 164.458324][ T8011] do_sock_setsockopt+0x179/0x1b0 [ 164.458350][ T8011] __x64_sys_setsockopt+0x13f/0x1b0 [ 164.458375][ T8011] do_syscall_64+0xfa/0x3b0 [ 164.458394][ T8011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.458415][ T8011] ? clear_bhb_loop+0x60/0xb0 [ 164.458439][ T8011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.458459][ T8011] RIP: 0033:0x7fb79c58ebe9 [ 164.458478][ T8011] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 164.458496][ T8011] RSP: 002b:00007fb79d4b8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 164.458519][ T8011] RAX: ffffffffffffffda RBX: 00007fb79c7b6090 RCX: 00007fb79c58ebe9 [ 164.458534][ T8011] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000009 [ 164.458546][ T8011] RBP: 00007fb79c611e19 R08: 0000000000000004 R09: 0000000000000000 [ 164.458559][ T8011] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 164.458571][ T8011] R13: 00007fb79c7b6128 R14: 00007fb79c7b6090 R15: 00007ffd61ebefc8 [ 164.458596][ T8011] [ 164.458619][ T8011] Mem-Info: [ 164.731333][ T8011] active_anon:7196 inactive_anon:0 isolated_anon:0 [ 164.731333][ T8011] active_file:3218 inactive_file:39857 isolated_file:0 [ 164.731333][ T8011] unevictable:768 dirty:314 writeback:0 [ 164.731333][ T8011] slab_reclaimable:11331 slab_unreclaimable:125325 [ 164.731333][ T8011] mapped:32284 shmem:4245 pagetables:1056 [ 164.731333][ T8011] sec_pagetables:0 bounce:0 [ 164.731333][ T8011] kernel_misc_reclaimable:0 [ 164.731333][ T8011] free:1293558 free_pcp:22764 free_cma:0 [ 164.739932][ T8008] netlink: 'syz.0.575': attribute type 8 has an invalid length. [ 164.784092][ T8011] Node 0 active_anon:28784kB inactive_anon:0kB active_file:12872kB inactive_file:159224kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:129136kB dirty:1256kB writeback:0kB shmem:15444kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11700kB pagetables:4084kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 164.826187][ T8011] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 164.858548][ T8011] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 164.925368][ T8011] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 164.931988][ T8011] Node 0 DMA32 free:1278960kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:17036kB inactive_anon:0kB active_file:12872kB inactive_file:157648kB unevictable:1536kB writepending:1256kB present:3129332kB managed:2557448kB mlocked:0kB bounce:0kB free_pcp:75752kB local_pcp:23012kB free_cma:0kB [ 164.968026][ T8011] lowmem_reserve[]: 0 0 1 1 1 [ 164.973266][ T8011] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 165.020812][ T8011] lowmem_reserve[]: 0 0 0 0 0 [ 165.030121][ T8011] Node 1 Normal free:3887900kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:20032kB local_pcp:8672kB free_cma:0kB [ 165.062456][ T8011] lowmem_reserve[]: 0 0 0 0 0 [ 165.067962][ T8011] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 165.070154][ T8020] FAULT_INJECTION: forcing a failure. [ 165.070154][ T8020] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 165.095396][ T8011] Node 0 DMA32: 1419*4kB (UM) 726*8kB (UME) 150*16kB (UME) 673*32kB (UME) 206*64kB (UME) 82*128kB (UME) 55*256kB (UE) 45*512kB (UM) 31*1024kB (UM) 4*2048kB (UE) 279*4096kB (M) = 1278940kB [ 165.100100][ T8020] CPU: 1 UID: 0 PID: 8020 Comm: syz.3.577 Not tainted syzkaller #0 PREEMPT(full) [ 165.100131][ T8020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 165.100146][ T8020] Call Trace: [ 165.100155][ T8020] [ 165.100165][ T8020] dump_stack_lvl+0x189/0x250 [ 165.100202][ T8020] ? __pfx____ratelimit+0x10/0x10 [ 165.100239][ T8020] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.100267][ T8020] ? __pfx__printk+0x10/0x10 [ 165.100299][ T8020] ? __might_fault+0xb0/0x130 [ 165.100336][ T8020] ? rcu_is_watching+0x15/0xb0 [ 165.100362][ T8020] should_fail_ex+0x414/0x560 [ 165.100398][ T8020] _copy_from_user+0x2d/0xb0 [ 165.100426][ T8020] ___sys_sendmsg+0x158/0x2a0 [ 165.100455][ T8020] ? __pfx____sys_sendmsg+0x10/0x10 [ 165.100501][ T8020] ? __fget_files+0x2a/0x420 [ 165.100521][ T8020] ? __fget_files+0x3a0/0x420 [ 165.100546][ T8020] __x64_sys_sendmsg+0x19b/0x260 [ 165.100572][ T8020] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 165.100603][ T8020] ? __pfx_ksys_write+0x10/0x10 [ 165.100638][ T8020] ? rcu_is_watching+0x15/0xb0 [ 165.100664][ T8020] ? rcu_is_watching+0x15/0xb0 [ 165.100687][ T8020] do_syscall_64+0xfa/0x3b0 [ 165.100710][ T8020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.100732][ T8020] ? clear_bhb_loop+0x60/0xb0 [ 165.100759][ T8020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.100781][ T8020] RIP: 0033:0x7f3109d8ebe9 [ 165.100803][ T8020] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.100823][ T8020] RSP: 002b:00007f310ab28038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.100849][ T8020] RAX: ffffffffffffffda RBX: 00007f3109fb5fa0 RCX: 00007f3109d8ebe9 [ 165.100867][ T8020] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 0000000000000007 [ 165.100888][ T8020] RBP: 00007f310ab28090 R08: 0000000000000000 R09: 0000000000000000 [ 165.100904][ T8020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.100917][ T8020] R13: 00007f3109fb6038 R14: 00007f3109fb5fa0 R15: 00007ffdc7771a38 [ 165.100944][ T8020] [ 165.380912][ T8011] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 165.427947][ T8028] netlink: 8 bytes leftover after parsing attributes in process `syz.2.580'. [ 165.467867][ T8030] syzkaller0: entered promiscuous mode [ 165.474207][ T8030] syzkaller0: entered allmulticast mode [ 165.482190][ T8011] Node 1 Normal: 167*4kB (UME) 48*8kB (UME) 50*16kB (UME) 91*32kB (UME) 24*64kB (UME) 9*128kB (UME) 4*256kB (UME) 3*512kB (ME) 1*1024kB (M) 1*2048kB (E) 946*4096kB (M) = 3887900kB [ 165.508013][ T8011] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 165.519732][ T8011] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 165.532561][ T8032] FAULT_INJECTION: forcing a failure. [ 165.532561][ T8032] name failslab, interval 1, probability 0, space 0, times 0 [ 165.549960][ T8011] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 165.562192][ T8032] CPU: 0 UID: 0 PID: 8032 Comm: syz.3.583 Not tainted syzkaller #0 PREEMPT(full) [ 165.562222][ T8032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 165.562234][ T8032] Call Trace: [ 165.562242][ T8032] [ 165.562251][ T8032] dump_stack_lvl+0x189/0x250 [ 165.562284][ T8032] ? __pfx____ratelimit+0x10/0x10 [ 165.562315][ T8032] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.562337][ T8032] ? __pfx__printk+0x10/0x10 [ 165.562365][ T8032] ? __pfx___might_resched+0x10/0x10 [ 165.562384][ T8032] ? lock_acquire+0x5f/0x360 [ 165.562413][ T8032] should_fail_ex+0x414/0x560 [ 165.562442][ T8032] should_failslab+0xa8/0x100 [ 165.562473][ T8032] __kmalloc_noprof+0xcb/0x4f0 [ 165.562502][ T8032] ? tomoyo_encode+0x28b/0x550 [ 165.562524][ T8032] tomoyo_encode+0x28b/0x550 [ 165.562546][ T8032] tomoyo_realpath_from_path+0x58d/0x5d0 [ 165.562567][ T8032] ? tomoyo_domain+0xd9/0x130 [ 165.562590][ T8032] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 165.562625][ T8032] tomoyo_path_number_perm+0x1e8/0x5a0 [ 165.562653][ T8032] ? lock_release+0x4b/0x3e0 [ 165.562684][ T8032] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 165.562715][ T8032] ? rcu_is_watching+0x15/0xb0 [ 165.562736][ T8032] ? lock_release+0x4b/0x3e0 [ 165.562769][ T8032] ? vfs_write+0x956/0xb30 [ 165.562799][ T8032] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 165.562841][ T8032] ? lock_release+0x4b/0x3e0 [ 165.562872][ T8032] ? __fget_files+0x2a/0x420 [ 165.562889][ T8032] ? __fget_files+0x3a0/0x420 [ 165.562905][ T8032] ? __fget_files+0x2a/0x420 [ 165.562923][ T8032] security_file_ioctl+0xcb/0x2d0 [ 165.562949][ T8032] __se_sys_ioctl+0x47/0x170 [ 165.562975][ T8032] do_syscall_64+0xfa/0x3b0 [ 165.562994][ T8032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.563014][ T8032] ? clear_bhb_loop+0x60/0xb0 [ 165.563037][ T8032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.563057][ T8032] RIP: 0033:0x7f3109d8ebe9 [ 165.563077][ T8032] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.563094][ T8032] RSP: 002b:00007f310ab28038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 165.563117][ T8032] RAX: ffffffffffffffda RBX: 00007f3109fb5fa0 RCX: 00007f3109d8ebe9 [ 165.563140][ T8032] RDX: 00002000000000c0 RSI: 000000000000890c RDI: 0000000000000004 [ 165.563153][ T8032] RBP: 00007f310ab28090 R08: 0000000000000000 R09: 0000000000000000 [ 165.563165][ T8032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.563177][ T8032] R13: 00007f3109fb6038 R14: 00007f3109fb5fa0 R15: 00007ffdc7771a38 [ 165.563201][ T8032] [ 165.672574][ T8011] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 165.696225][ T8032] ERROR: Out of memory at tomoyo_realpath_from_path. [ 165.846222][ T8011] 44498 total pagecache pages [ 165.851308][ T8011] 0 pages in swap cache [ 165.855875][ T8011] Free swap = 124996kB [ 165.860252][ T8011] Total swap = 124996kB [ 165.865194][ T8011] 2097051 pages RAM [ 165.869252][ T8011] 0 pages HighMem/MovableOnly [ 165.890015][ T8044] tipc: Enabling of bearer rejected, failed to enable media [ 165.906419][ T8040] vcan0: entered promiscuous mode [ 165.911806][ T8011] 425663 pages reserved [ 165.916360][ T8011] 0 pages cma reserved [ 165.931841][ T8040] vcan0: entered allmulticast mode [ 166.139203][ T8058] FAULT_INJECTION: forcing a failure. [ 166.139203][ T8058] name failslab, interval 1, probability 0, space 0, times 0 [ 166.175774][ T8058] CPU: 0 UID: 0 PID: 8058 Comm: syz.4.589 Not tainted syzkaller #0 PREEMPT(full) [ 166.175808][ T8058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 166.175821][ T8058] Call Trace: [ 166.175830][ T8058] [ 166.175838][ T8058] dump_stack_lvl+0x189/0x250 [ 166.175872][ T8058] ? __pfx____ratelimit+0x10/0x10 [ 166.175904][ T8058] ? __pfx_dump_stack_lvl+0x10/0x10 [ 166.175929][ T8058] ? __pfx__printk+0x10/0x10 [ 166.175959][ T8058] ? fs_reclaim_acquire+0x7d/0x100 [ 166.175992][ T8058] ? rcu_is_watching+0x15/0xb0 [ 166.176013][ T8058] ? __pfx___might_resched+0x10/0x10 [ 166.176032][ T8058] ? lock_acquire+0x5f/0x360 [ 166.176063][ T8058] should_fail_ex+0x414/0x560 [ 166.176095][ T8058] should_failslab+0xa8/0x100 [ 166.176126][ T8058] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 166.176155][ T8058] ? __alloc_skb+0x112/0x2d0 [ 166.176182][ T8058] __alloc_skb+0x112/0x2d0 [ 166.176202][ T8058] netlink_sendmsg+0x5c6/0xb30 [ 166.176228][ T8058] ? __pfx_netlink_sendmsg+0x10/0x10 [ 166.176248][ T8058] ? aa_sock_msg_perm+0xf1/0x1d0 [ 166.176268][ T8058] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 166.176291][ T8058] ? __pfx_netlink_sendmsg+0x10/0x10 [ 166.176309][ T8058] __sock_sendmsg+0x219/0x270 [ 166.176338][ T8058] ____sys_sendmsg+0x505/0x830 [ 166.176363][ T8058] ? __pfx_____sys_sendmsg+0x10/0x10 [ 166.176389][ T8058] ? import_iovec+0x74/0xa0 [ 166.176415][ T8058] ___sys_sendmsg+0x21f/0x2a0 [ 166.176437][ T8058] ? __pfx____sys_sendmsg+0x10/0x10 [ 166.176477][ T8058] ? __fget_files+0x2a/0x420 [ 166.176494][ T8058] ? __fget_files+0x3a0/0x420 [ 166.176515][ T8058] __x64_sys_sendmsg+0x19b/0x260 [ 166.176538][ T8058] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 166.176565][ T8058] ? __pfx_ksys_write+0x10/0x10 [ 166.176591][ T8058] ? rcu_is_watching+0x15/0xb0 [ 166.176613][ T8058] ? rcu_is_watching+0x15/0xb0 [ 166.176634][ T8058] do_syscall_64+0xfa/0x3b0 [ 166.176653][ T8058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.176674][ T8058] ? clear_bhb_loop+0x60/0xb0 [ 166.176697][ T8058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.176717][ T8058] RIP: 0033:0x7fc95a58ebe9 [ 166.176736][ T8058] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 166.176753][ T8058] RSP: 002b:00007fc95b446038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 166.176776][ T8058] RAX: ffffffffffffffda RBX: 00007fc95a7b6090 RCX: 00007fc95a58ebe9 [ 166.176797][ T8058] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 0000000000000007 [ 166.176811][ T8058] RBP: 00007fc95b446090 R08: 0000000000000000 R09: 0000000000000000 [ 166.176823][ T8058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 166.176835][ T8058] R13: 00007fc95a7b6128 R14: 00007fc95a7b6090 R15: 00007ffd8aad2488 [ 166.176859][ T8058] [ 166.549540][ T8040] lo speed is unknown, defaulting to 1000 [ 166.859750][ T8086] FAULT_INJECTION: forcing a failure. [ 166.859750][ T8086] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 166.875681][ T8086] CPU: 1 UID: 0 PID: 8086 Comm: syz.3.598 Not tainted syzkaller #0 PREEMPT(full) [ 166.875711][ T8086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 166.875723][ T8086] Call Trace: [ 166.875731][ T8086] [ 166.875739][ T8086] dump_stack_lvl+0x189/0x250 [ 166.875772][ T8086] ? __pfx____ratelimit+0x10/0x10 [ 166.875802][ T8086] ? __pfx_dump_stack_lvl+0x10/0x10 [ 166.875826][ T8086] ? __pfx__printk+0x10/0x10 [ 166.875853][ T8086] ? __might_fault+0xb0/0x130 [ 166.875889][ T8086] ? rcu_is_watching+0x15/0xb0 [ 166.875911][ T8086] should_fail_ex+0x414/0x560 [ 166.875940][ T8086] _copy_from_user+0x2d/0xb0 [ 166.875963][ T8086] rose_rt_ioctl+0x229/0xfb0 [ 166.875989][ T8086] ? __pfx_rose_rt_ioctl+0x10/0x10 [ 166.876017][ T8086] ? bpf_lsm_capable+0x9/0x20 [ 166.876047][ T8086] ? security_capable+0x7e/0x2e0 [ 166.876080][ T8086] rose_ioctl+0x3ce/0x8b0 [ 166.876100][ T8086] ? __pfx_rose_ioctl+0x10/0x10 [ 166.876126][ T8086] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 166.876154][ T8086] sock_do_ioctl+0xdc/0x300 [ 166.876183][ T8086] ? __pfx_sock_do_ioctl+0x10/0x10 [ 166.876207][ T8086] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 166.876248][ T8086] sock_ioctl+0x576/0x790 [ 166.876272][ T8086] ? lock_release+0x4b/0x3e0 [ 166.876302][ T8086] ? __pfx_sock_ioctl+0x10/0x10 [ 166.876327][ T8086] ? __fget_files+0x2a/0x420 [ 166.876345][ T8086] ? __fget_files+0x3a0/0x420 [ 166.876361][ T8086] ? __fget_files+0x2a/0x420 [ 166.876380][ T8086] ? bpf_lsm_file_ioctl+0x9/0x20 [ 166.876404][ T8086] ? __pfx_sock_ioctl+0x10/0x10 [ 166.876426][ T8086] __se_sys_ioctl+0xf9/0x170 [ 166.876449][ T8086] do_syscall_64+0xfa/0x3b0 [ 166.876466][ T8086] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.876484][ T8086] ? clear_bhb_loop+0x60/0xb0 [ 166.876505][ T8086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.876526][ T8086] RIP: 0033:0x7f3109d8ebe9 [ 166.876545][ T8086] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 166.876562][ T8086] RSP: 002b:00007f310ab28038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 166.876585][ T8086] RAX: ffffffffffffffda RBX: 00007f3109fb5fa0 RCX: 00007f3109d8ebe9 [ 166.876599][ T8086] RDX: 00002000000000c0 RSI: 000000000000890c RDI: 0000000000000004 [ 166.876612][ T8086] RBP: 00007f310ab28090 R08: 0000000000000000 R09: 0000000000000000 [ 166.876623][ T8086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 166.876635][ T8086] R13: 00007f3109fb6038 R14: 00007f3109fb5fa0 R15: 00007ffdc7771a38 [ 166.876657][ T8086] [ 166.937466][ T8090] syzkaller0: entered promiscuous mode [ 167.150327][ T8090] syzkaller0: entered allmulticast mode [ 167.156124][ T8095] netlink: 8 bytes leftover after parsing attributes in process `syz.3.601'. [ 167.225859][ T8100] netlink: 12 bytes leftover after parsing attributes in process `syz.1.603'. [ 167.382622][ T8107] lo speed is unknown, defaulting to 1000 [ 167.689088][ T8129] lo speed is unknown, defaulting to 1000 [ 167.830765][ T8141] FAULT_INJECTION: forcing a failure. [ 167.830765][ T8141] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 167.846505][ T8141] CPU: 1 UID: 0 PID: 8141 Comm: syz.0.611 Not tainted syzkaller #0 PREEMPT(full) [ 167.846537][ T8141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 167.846549][ T8141] Call Trace: [ 167.846557][ T8141] [ 167.846566][ T8141] dump_stack_lvl+0x189/0x250 [ 167.846598][ T8141] ? __pfx____ratelimit+0x10/0x10 [ 167.846629][ T8141] ? __pfx_dump_stack_lvl+0x10/0x10 [ 167.846652][ T8141] ? __pfx__printk+0x10/0x10 [ 167.846684][ T8141] ? rcu_is_watching+0x15/0xb0 [ 167.846706][ T8141] should_fail_ex+0x414/0x560 [ 167.846737][ T8141] _copy_to_user+0x31/0xb0 [ 167.846762][ T8141] simple_read_from_buffer+0xe1/0x170 [ 167.846805][ T8141] proc_fail_nth_read+0x1b3/0x220 [ 167.846830][ T8141] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 167.846859][ T8141] ? rw_verify_area+0x2a6/0x4d0 [ 167.846885][ T8141] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 167.846908][ T8141] vfs_read+0x1fd/0xa30 [ 167.846933][ T8141] ? fdget_pos+0x247/0x320 [ 167.846953][ T8141] ? __pfx___mutex_lock+0x10/0x10 [ 167.846986][ T8141] ? __pfx_vfs_read+0x10/0x10 [ 167.847015][ T8141] ? __fget_files+0x3a0/0x420 [ 167.847032][ T8141] ? __fget_files+0x2a/0x420 [ 167.847053][ T8141] ksys_read+0x145/0x250 [ 167.847078][ T8141] ? __fget_files+0x3a0/0x420 [ 167.847095][ T8141] ? __pfx_ksys_read+0x10/0x10 [ 167.847120][ T8141] ? __pfx_sock_ioctl+0x10/0x10 [ 167.847147][ T8141] ? rcu_is_watching+0x15/0xb0 [ 167.847167][ T8141] do_syscall_64+0xfa/0x3b0 [ 167.847184][ T8141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.847205][ T8141] ? clear_bhb_loop+0x60/0xb0 [ 167.847228][ T8141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.847248][ T8141] RIP: 0033:0x7fb79c58d5fc [ 167.847268][ T8141] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 167.847285][ T8141] RSP: 002b:00007fb79d4d9030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 167.847308][ T8141] RAX: ffffffffffffffda RBX: 00007fb79c7b5fa0 RCX: 00007fb79c58d5fc [ 167.847323][ T8141] RDX: 000000000000000f RSI: 00007fb79d4d90a0 RDI: 0000000000000003 [ 167.847335][ T8141] RBP: 00007fb79d4d9090 R08: 0000000000000000 R09: 0000000000000000 [ 167.847346][ T8141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 167.847359][ T8141] R13: 00007fb79c7b6038 R14: 00007fb79c7b5fa0 R15: 00007ffd61ebefc8 [ 167.847382][ T8141] [ 168.138023][ T8143] netlink: 4 bytes leftover after parsing attributes in process `syz.4.612'. [ 168.198068][ T8143] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 168.212471][ T8143] team0: Device ipvlan2 is already an upper device of the team interface [ 168.262028][ T8153] syzkaller0: entered promiscuous mode [ 168.267949][ T8153] syzkaller0: entered allmulticast mode [ 168.476146][ T8165] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 168.579509][ T8173] netlink: 8 bytes leftover after parsing attributes in process `syz.1.619'. [ 168.618702][ T8175] lo speed is unknown, defaulting to 1000 [ 168.840322][ T8190] netlink: 'syz.4.624': attribute type 1 has an invalid length. [ 168.864522][ T8190] 8021q: adding VLAN 0 to HW filter on device bond3 [ 168.882266][ T8190] 8021q: adding VLAN 0 to HW filter on device bond3 [ 168.889454][ T8190] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 168.901761][ T8190] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 168.938169][ T8193] erspan0: entered allmulticast mode [ 168.950524][ T8193] bond3: (slave erspan0): making interface the new active one [ 168.959036][ T8193] bond3: (slave erspan0): Enslaving as an active interface with an up link [ 169.155584][ T8202] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 169.206639][ T8207] syzkaller0: entered promiscuous mode [ 169.212180][ T8207] syzkaller0: entered allmulticast mode [ 169.390154][ T8220] tipc: Enabled bearer , priority 0 [ 169.399899][ T8220] lo: entered promiscuous mode [ 169.406824][ T8220] lo: entered allmulticast mode [ 169.437980][ T44] lo speed is unknown, defaulting to 1000 [ 169.450409][ T44] syz2: Port: 1 Link ACTIVE [ 169.461971][ T8219] tipc: Disabling bearer [ 169.561557][ T8233] FAULT_INJECTION: forcing a failure. [ 169.561557][ T8233] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 169.575729][ T8233] CPU: 0 UID: 0 PID: 8233 Comm: syz.2.638 Not tainted syzkaller #0 PREEMPT(full) [ 169.575760][ T8233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 169.575774][ T8233] Call Trace: [ 169.575782][ T8233] [ 169.575790][ T8233] dump_stack_lvl+0x189/0x250 [ 169.575836][ T8233] ? __pfx____ratelimit+0x10/0x10 [ 169.575870][ T8233] ? __pfx_dump_stack_lvl+0x10/0x10 [ 169.575894][ T8233] ? __pfx__printk+0x10/0x10 [ 169.575922][ T8233] ? __might_fault+0xb0/0x130 [ 169.575955][ T8233] ? rcu_is_watching+0x15/0xb0 [ 169.575977][ T8233] should_fail_ex+0x414/0x560 [ 169.576008][ T8233] _copy_from_iter+0x1db/0x16f0 [ 169.576031][ T8233] ? rcu_is_watching+0x15/0xb0 [ 169.576051][ T8233] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 169.576081][ T8233] ? __pfx__copy_from_iter+0x10/0x10 [ 169.576101][ T8233] ? __build_skb_around+0x257/0x3e0 [ 169.576135][ T8233] ? netlink_sendmsg+0x642/0xb30 [ 169.576154][ T8233] ? skb_put+0x11b/0x210 [ 169.576174][ T8233] netlink_sendmsg+0x6b2/0xb30 [ 169.576197][ T8233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 169.576217][ T8233] ? aa_sock_msg_perm+0xf1/0x1d0 [ 169.576237][ T8233] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 169.576260][ T8233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 169.576278][ T8233] __sock_sendmsg+0x219/0x270 [ 169.576306][ T8233] ____sys_sendmsg+0x505/0x830 [ 169.576330][ T8233] ? __pfx_____sys_sendmsg+0x10/0x10 [ 169.576357][ T8233] ? import_iovec+0x74/0xa0 [ 169.576381][ T8233] ___sys_sendmsg+0x21f/0x2a0 [ 169.576403][ T8233] ? __pfx____sys_sendmsg+0x10/0x10 [ 169.576441][ T8233] ? __fget_files+0x2a/0x420 [ 169.576458][ T8233] ? __fget_files+0x3a0/0x420 [ 169.576474][ T8233] __x64_sys_sendmsg+0x19b/0x260 [ 169.576490][ T8233] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 169.576509][ T8233] ? __pfx_ksys_write+0x10/0x10 [ 169.576532][ T8233] ? rcu_is_watching+0x15/0xb0 [ 169.576548][ T8233] do_syscall_64+0xfa/0x3b0 [ 169.576561][ T8233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.576577][ T8233] ? clear_bhb_loop+0x60/0xb0 [ 169.576593][ T8233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.576608][ T8233] RIP: 0033:0x7f0c17f8ebe9 [ 169.576622][ T8233] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 169.576635][ T8233] RSP: 002b:00007f0c18e0d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 169.576651][ T8233] RAX: ffffffffffffffda RBX: 00007f0c181b5fa0 RCX: 00007f0c17f8ebe9 [ 169.576662][ T8233] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 0000000000000007 [ 169.576672][ T8233] RBP: 00007f0c18e0d090 R08: 0000000000000000 R09: 0000000000000000 [ 169.576681][ T8233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 169.576692][ T8233] R13: 00007f0c181b6038 R14: 00007f0c181b5fa0 R15: 00007fff68055cf8 [ 169.576717][ T8233] [ 169.979382][ T8239] lo speed is unknown, defaulting to 1000 [ 170.105792][ T8248] syzkaller0: entered promiscuous mode [ 170.111385][ T8248] syzkaller0: entered allmulticast mode [ 170.125659][ T8243] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 170.224479][ T8254] netlink: 'syz.1.643': attribute type 13 has an invalid length. [ 170.245014][ T8254] netlink: 'syz.1.643': attribute type 17 has an invalid length. [ 170.414746][ T8254] 8021q: adding VLAN 0 to HW filter on device team0 [ 170.555770][ T8254] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 170.830658][ T8256] lo speed is unknown, defaulting to 1000 [ 170.944029][ T8298] FAULT_INJECTION: forcing a failure. [ 170.944029][ T8298] name failslab, interval 1, probability 0, space 0, times 0 [ 170.961794][ T8298] CPU: 0 UID: 0 PID: 8298 Comm: syz.3.649 Not tainted syzkaller #0 PREEMPT(full) [ 170.961829][ T8298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 170.961842][ T8298] Call Trace: [ 170.961851][ T8298] [ 170.961860][ T8298] dump_stack_lvl+0x189/0x250 [ 170.961895][ T8298] ? __pfx____ratelimit+0x10/0x10 [ 170.961926][ T8298] ? __pfx_dump_stack_lvl+0x10/0x10 [ 170.961951][ T8298] ? __pfx__printk+0x10/0x10 [ 170.961986][ T8298] should_fail_ex+0x414/0x560 [ 170.962018][ T8298] should_failslab+0xa8/0x100 [ 170.962050][ T8298] kmem_cache_alloc_noprof+0x73/0x3c0 [ 170.962078][ T8298] ? skb_clone+0x212/0x3a0 [ 170.962104][ T8298] skb_clone+0x212/0x3a0 [ 170.962129][ T8298] __netlink_deliver_tap+0x404/0x850 [ 170.962168][ T8298] ? netlink_deliver_tap+0x2e/0x1b0 [ 170.962200][ T8298] netlink_deliver_tap+0x19c/0x1b0 [ 170.962231][ T8298] netlink_unicast+0x7fa/0x9e0 [ 170.962263][ T8298] ? __pfx_netlink_unicast+0x10/0x10 [ 170.962291][ T8298] ? netlink_sendmsg+0x642/0xb30 [ 170.962309][ T8298] ? skb_put+0x11b/0x210 [ 170.962329][ T8298] netlink_sendmsg+0x805/0xb30 [ 170.962352][ T8298] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.962372][ T8298] ? aa_sock_msg_perm+0xf1/0x1d0 [ 170.962392][ T8298] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 170.962415][ T8298] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.962434][ T8298] __sock_sendmsg+0x219/0x270 [ 170.962463][ T8298] ____sys_sendmsg+0x505/0x830 [ 170.962487][ T8298] ? __pfx_____sys_sendmsg+0x10/0x10 [ 170.962514][ T8298] ? import_iovec+0x74/0xa0 [ 170.962539][ T8298] ___sys_sendmsg+0x21f/0x2a0 [ 170.962561][ T8298] ? __pfx____sys_sendmsg+0x10/0x10 [ 170.962601][ T8298] ? __fget_files+0x2a/0x420 [ 170.962618][ T8298] ? __fget_files+0x3a0/0x420 [ 170.962640][ T8298] __x64_sys_sendmsg+0x19b/0x260 [ 170.962664][ T8298] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 170.962691][ T8298] ? __pfx_ksys_write+0x10/0x10 [ 170.962718][ T8298] ? rcu_is_watching+0x15/0xb0 [ 170.962748][ T8298] ? rcu_is_watching+0x15/0xb0 [ 170.962772][ T8298] do_syscall_64+0xfa/0x3b0 [ 170.962789][ T8298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.962809][ T8298] ? clear_bhb_loop+0x60/0xb0 [ 170.962832][ T8298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.962851][ T8298] RIP: 0033:0x7f3109d8ebe9 [ 170.962868][ T8298] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 170.962885][ T8298] RSP: 002b:00007f310ab28038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 170.962908][ T8298] RAX: ffffffffffffffda RBX: 00007f3109fb5fa0 RCX: 00007f3109d8ebe9 [ 170.962923][ T8298] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 0000000000000007 [ 170.962937][ T8298] RBP: 00007f310ab28090 R08: 0000000000000000 R09: 0000000000000000 [ 170.962950][ T8298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 170.962962][ T8298] R13: 00007f3109fb6038 R14: 00007f3109fb5fa0 R15: 00007ffdc7771a38 [ 170.962984][ T8298] [ 171.468380][ T8309] netlink: 44 bytes leftover after parsing attributes in process `syz.3.653'. [ 171.498210][ T8313] syzkaller0: entered promiscuous mode [ 171.503907][ T8313] syzkaller0: entered allmulticast mode [ 171.617468][ T8321] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551612) [ 171.629911][ T8321] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 171.726800][ T8325] veth3: entered allmulticast mode [ 171.781559][ T8330] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 171.895101][ T8340] FAULT_INJECTION: forcing a failure. [ 171.895101][ T8340] name failslab, interval 1, probability 0, space 0, times 0 [ 171.909141][ T8340] CPU: 1 UID: 0 PID: 8340 Comm: syz.2.663 Not tainted syzkaller #0 PREEMPT(full) [ 171.909172][ T8340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 171.909186][ T8340] Call Trace: [ 171.909194][ T8340] [ 171.909202][ T8340] dump_stack_lvl+0x189/0x250 [ 171.909235][ T8340] ? __pfx____ratelimit+0x10/0x10 [ 171.909269][ T8340] ? __pfx_dump_stack_lvl+0x10/0x10 [ 171.909294][ T8340] ? __pfx__printk+0x10/0x10 [ 171.909321][ T8340] ? rcu_is_watching+0x15/0xb0 [ 171.909344][ T8340] ? __pfx___might_resched+0x10/0x10 [ 171.909364][ T8340] ? lock_acquire+0x5f/0x360 [ 171.909398][ T8340] should_fail_ex+0x414/0x560 [ 171.909440][ T8340] should_failslab+0xa8/0x100 [ 171.909472][ T8340] __kmalloc_noprof+0xcb/0x4f0 [ 171.909498][ T8340] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 171.909528][ T8340] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 171.909557][ T8340] genl_family_rcv_msg_doit+0xb8/0x300 [ 171.909585][ T8340] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 171.909613][ T8340] ? apparmor_capable+0x137/0x1b0 [ 171.909637][ T8340] ? bpf_lsm_capable+0x9/0x20 [ 171.909665][ T8340] ? security_capable+0x7e/0x2e0 [ 171.909700][ T8340] genl_rcv_msg+0x60e/0x790 [ 171.909727][ T8340] ? __pfx_genl_rcv_msg+0x10/0x10 [ 171.909749][ T8340] ? __pfx_mptcp_pm_nl_flush_addrs_doit+0x10/0x10 [ 171.909781][ T8340] ? __asan_memcpy+0x40/0x70 [ 171.909804][ T8340] ? __pfx_ref_tracker_free+0x10/0x10 [ 171.909834][ T8340] ? __skb_clone+0x63/0x7a0 [ 171.909862][ T8340] netlink_rcv_skb+0x208/0x470 [ 171.909895][ T8340] ? __pfx_genl_rcv_msg+0x10/0x10 [ 171.909920][ T8340] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 171.909954][ T8340] ? lock_release+0x4b/0x3e0 [ 171.909985][ T8340] ? down_read+0x1ad/0x2e0 [ 171.910007][ T8340] genl_rcv+0x28/0x40 [ 171.910028][ T8340] netlink_unicast+0x82f/0x9e0 [ 171.910059][ T8340] ? __pfx_netlink_unicast+0x10/0x10 [ 171.910087][ T8340] ? netlink_sendmsg+0x642/0xb30 [ 171.910101][ T8340] ? skb_put+0x11b/0x210 [ 171.910121][ T8340] netlink_sendmsg+0x805/0xb30 [ 171.910143][ T8340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 171.910160][ T8340] ? aa_sock_msg_perm+0xf1/0x1d0 [ 171.910180][ T8340] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 171.910203][ T8340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 171.910221][ T8340] __sock_sendmsg+0x219/0x270 [ 171.910250][ T8340] ____sys_sendmsg+0x505/0x830 [ 171.910276][ T8340] ? __pfx_____sys_sendmsg+0x10/0x10 [ 171.910313][ T8340] ? import_iovec+0x74/0xa0 [ 171.910339][ T8340] ___sys_sendmsg+0x21f/0x2a0 [ 171.910362][ T8340] ? __pfx____sys_sendmsg+0x10/0x10 [ 171.910404][ T8340] ? __fget_files+0x2a/0x420 [ 171.910429][ T8340] ? __fget_files+0x3a0/0x420 [ 171.910453][ T8340] __x64_sys_sendmsg+0x19b/0x260 [ 171.910476][ T8340] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 171.910504][ T8340] ? __pfx_ksys_write+0x10/0x10 [ 171.910530][ T8340] ? rcu_is_watching+0x15/0xb0 [ 171.910555][ T8340] ? rcu_is_watching+0x15/0xb0 [ 171.910576][ T8340] do_syscall_64+0xfa/0x3b0 [ 171.910596][ T8340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.910618][ T8340] ? clear_bhb_loop+0x60/0xb0 [ 171.910642][ T8340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.910663][ T8340] RIP: 0033:0x7f0c17f8ebe9 [ 171.910684][ T8340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 171.910704][ T8340] RSP: 002b:00007f0c18e0d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 171.910727][ T8340] RAX: ffffffffffffffda RBX: 00007f0c181b5fa0 RCX: 00007f0c17f8ebe9 [ 171.910744][ T8340] RDX: 000000002400c000 RSI: 0000200000000040 RDI: 0000000000000007 [ 171.910757][ T8340] RBP: 00007f0c18e0d090 R08: 0000000000000000 R09: 0000000000000000 [ 171.910771][ T8340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 171.910784][ T8340] R13: 00007f0c181b6038 R14: 00007f0c181b5fa0 R15: 00007fff68055cf8 [ 171.910809][ T8340] [ 172.466994][ T8349] lo speed is unknown, defaulting to 1000 [ 172.649490][ T8353] syzkaller0: entered promiscuous mode [ 172.655367][ T8353] syzkaller0: entered allmulticast mode [ 172.852472][ T8376] netlink: 60 bytes leftover after parsing attributes in process `syz.3.672'. [ 173.284688][ T8390] lo speed is unknown, defaulting to 1000 [ 173.384467][ T8404] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 173.611107][ T8421] syzkaller0: entered promiscuous mode [ 173.619426][ T8421] syzkaller0: entered allmulticast mode [ 173.871767][ T8431] FAULT_INJECTION: forcing a failure. [ 173.871767][ T8431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.888560][ T8431] CPU: 0 UID: 0 PID: 8431 Comm: syz.0.689 Not tainted syzkaller #0 PREEMPT(full) [ 173.888595][ T8431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 173.888616][ T8431] Call Trace: [ 173.888624][ T8431] [ 173.888634][ T8431] dump_stack_lvl+0x189/0x250 [ 173.888668][ T8431] ? __pfx____ratelimit+0x10/0x10 [ 173.888707][ T8431] ? __pfx_dump_stack_lvl+0x10/0x10 [ 173.888732][ T8431] ? __pfx__printk+0x10/0x10 [ 173.888759][ T8431] ? __might_fault+0xb0/0x130 [ 173.888792][ T8431] ? rcu_is_watching+0x15/0xb0 [ 173.888815][ T8431] should_fail_ex+0x414/0x560 [ 173.888848][ T8431] _copy_from_user+0x2d/0xb0 [ 173.888873][ T8431] kstrtouint_from_user+0xc4/0x170 [ 173.888905][ T8431] ? __might_fault+0xb0/0x130 [ 173.888933][ T8431] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 173.888971][ T8431] ? vfs_write+0x211/0xb30 [ 173.889000][ T8431] ? rcu_is_watching+0x15/0xb0 [ 173.889022][ T8431] proc_fail_nth_write+0x88/0x200 [ 173.889047][ T8431] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 173.889071][ T8431] ? security_file_permission+0x75/0x290 [ 173.889101][ T8431] ? preempt_count_add+0x91/0x1a0 [ 173.889134][ T8431] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 173.889158][ T8431] vfs_write+0x27e/0xb30 [ 173.889190][ T8431] ? __pfx_vfs_write+0x10/0x10 [ 173.889222][ T8431] ? __fget_files+0x3a0/0x420 [ 173.889240][ T8431] ? __fget_files+0x2a/0x420 [ 173.889262][ T8431] ksys_write+0x145/0x250 [ 173.889291][ T8431] ? __pfx_ksys_write+0x10/0x10 [ 173.889317][ T8431] ? rcu_is_watching+0x15/0xb0 [ 173.889340][ T8431] ? rcu_is_watching+0x15/0xb0 [ 173.889371][ T8431] do_syscall_64+0xfa/0x3b0 [ 173.889390][ T8431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.889411][ T8431] ? clear_bhb_loop+0x60/0xb0 [ 173.889434][ T8431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.889454][ T8431] RIP: 0033:0x7fb79c58d69f [ 173.889473][ T8431] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 173.889493][ T8431] RSP: 002b:00007fb79d4b8030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 173.889518][ T8431] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb79c58d69f [ 173.889533][ T8431] RDX: 0000000000000001 RSI: 00007fb79d4b80a0 RDI: 0000000000000008 [ 173.889546][ T8431] RBP: 00007fb79d4b8090 R08: 0000000000000000 R09: 0000000000000000 [ 173.889560][ T8431] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 173.889573][ T8431] R13: 00007fb79c7b6128 R14: 00007fb79c7b6090 R15: 00007ffd61ebefc8 [ 173.889597][ T8431] [ 174.254287][ T8435] netlink: 'syz.4.690': attribute type 3 has an invalid length. [ 174.264681][ T8435] netlink: 20 bytes leftover after parsing attributes in process `syz.4.690'. [ 174.286302][ T8433] lo speed is unknown, defaulting to 1000 [ 174.301724][ T8443] lo speed is unknown, defaulting to 1000 [ 174.411181][ T8446] netlink: 76 bytes leftover after parsing attributes in process `syz.3.694'. [ 174.498525][ T8451] netlink: 24 bytes leftover after parsing attributes in process `syz.3.695'. [ 174.508321][ T8451] netlink: 24 bytes leftover after parsing attributes in process `syz.3.695'. [ 174.519350][ T8452] netlink: 16 bytes leftover after parsing attributes in process `syz.3.695'. [ 174.529046][ T8452] netlink: 16 bytes leftover after parsing attributes in process `syz.3.695'. [ 174.681441][ T8460] syzkaller0: entered promiscuous mode [ 174.687310][ T8460] syzkaller0: entered allmulticast mode [ 174.868152][ T8467] netlink: 96 bytes leftover after parsing attributes in process `syz.1.701'. [ 175.108115][ T8475] netlink: 12 bytes leftover after parsing attributes in process `syz.0.703'. [ 175.699553][ T8482] netlink: 'syz.4.706': attribute type 10 has an invalid length. [ 175.717695][ T8482] team0: Port device dummy0 added [ 175.725524][ T8482] netlink: 'syz.4.706': attribute type 10 has an invalid length. [ 175.739144][ T8482] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 175.750528][ T8482] team0: Failed to send options change via netlink (err -105) [ 175.759655][ T8482] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 175.769533][ T8482] team0: Port device dummy0 removed [ 175.781131][ T8482] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 175.844848][ T8486] netlink: 12 bytes leftover after parsing attributes in process `syz.1.707'. [ 175.854093][ T8486] nbd: must specify a size in bytes for the device [ 176.074518][ T8499] syzkaller0: entered promiscuous mode [ 176.087576][ T8499] syzkaller0: entered allmulticast mode [ 176.180241][ T8508] netlink: 20 bytes leftover after parsing attributes in process `syz.4.714'. [ 176.217223][ T8504] netlink: 'syz.4.714': attribute type 7 has an invalid length. [ 176.226591][ T8504] netlink: 'syz.4.714': attribute type 8 has an invalid length. [ 176.240701][ T8504] dummy0: entered promiscuous mode [ 176.249080][ T8504] dummy0: left promiscuous mode [ 176.303266][ T8512] netlink: 'syz.1.716': attribute type 2 has an invalid length. [ 176.565440][ T8530] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 176.755583][ T8537] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 177.186035][ T8552] syzkaller0: entered promiscuous mode [ 177.191593][ T8552] syzkaller0: entered allmulticast mode [ 177.311772][ T8558] netlink: 'syz.0.731': attribute type 18 has an invalid length. [ 177.341964][ T8558] NPFT: renamed from bond_slave_0 [ 177.453970][ T8566] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.484205][ T8566] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.551411][ T8574] netlink: 'syz.0.736': attribute type 1 has an invalid length. [ 177.598109][ T8566] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.598373][ T8574] netlink: 'syz.0.736': attribute type 1 has an invalid length. [ 177.611994][ T8566] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.739621][ T8566] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.772070][ T8566] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.818157][ T8566] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.838030][ T8566] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.967178][ T8266] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 177.976444][ T8266] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.996941][ T2910] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 178.007419][ T2910] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.046498][ T2910] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 178.056336][ T2910] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.068070][ T2910] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 178.076581][ T2910] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.155448][ T8604] syzkaller0: entered promiscuous mode [ 178.165602][ T8604] syzkaller0: entered allmulticast mode [ 178.176666][ T8608] netlink: 'syz.2.747': attribute type 11 has an invalid length. [ 178.185102][ T8608] netlink: 'syz.2.747': attribute type 4 has an invalid length. [ 178.309749][ T8611] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 178.400206][ T8621] netlink: 'syz.1.752': attribute type 21 has an invalid length. [ 178.406240][ T8622] IPv6: sit2: Disabled Multicast RS [ 178.414314][ T8622] sit2: entered allmulticast mode [ 178.557935][ T8629] lo speed is unknown, defaulting to 1000 [ 178.863075][ T8642] IPVS: length: 154 != 8 [ 179.058364][ T8644] tipc: Enabled bearer , priority 0 [ 179.070781][ T8644] syzkaller0: entered promiscuous mode [ 179.076367][ T8644] syzkaller0: entered allmulticast mode [ 179.153561][ T8648] tipc: Resetting bearer [ 179.192641][ T8643] tipc: Resetting bearer [ 179.239045][ T8643] tipc: Disabling bearer [ 179.257603][ T8655] syzkaller0: entered promiscuous mode [ 179.273085][ T8655] syzkaller0: entered allmulticast mode [ 179.286346][ T8654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 179.323752][ T8654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 179.349802][ T8659] veth0_vlan: left promiscuous mode [ 179.437397][ T8659] veth0_vlan: entered promiscuous mode [ 179.456396][ T8659] team0: Device veth0_vlan failed to register rx_handler [ 179.613603][ T8673] __nla_validate_parse: 16 callbacks suppressed [ 179.613633][ T8673] netlink: 24 bytes leftover after parsing attributes in process `syz.0.767'. [ 179.635017][ T8673] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 180.711036][ T8714] netlink: 4 bytes leftover after parsing attributes in process `syz.3.779'. [ 180.812824][ T8718] syzkaller0: entered promiscuous mode [ 180.822311][ T8718] syzkaller0: entered allmulticast mode [ 180.838007][ T8720] netlink: 12 bytes leftover after parsing attributes in process `syz.0.781'. [ 181.120372][ T8746] netlink: 44 bytes leftover after parsing attributes in process `syz.2.788'. [ 181.169754][ T8749] lo speed is unknown, defaulting to 1000 [ 181.624553][ T8786] syzkaller0: entered promiscuous mode [ 181.630227][ T8786] syzkaller0: entered allmulticast mode [ 181.682552][ T8789] netlink: 24 bytes leftover after parsing attributes in process `syz.2.798'. [ 182.121784][ T8807] netlink: 108 bytes leftover after parsing attributes in process `syz.2.803'. [ 182.283939][ T8815] validate_nla: 4 callbacks suppressed [ 182.283962][ T8815] netlink: 'syz.1.806': attribute type 41 has an invalid length. [ 182.414299][ T8813] netlink: 'syz.0.805': attribute type 1 has an invalid length. [ 182.422053][ T8813] netlink: 224 bytes leftover after parsing attributes in process `syz.0.805'. [ 182.529367][ T8832] netlink: 4 bytes leftover after parsing attributes in process `syz.1.808'. [ 182.592211][ T8836] syzkaller0: entered promiscuous mode [ 182.597906][ T8836] syzkaller0: entered allmulticast mode [ 183.358991][ T8854] tipc: Enabling of bearer rejected, media not registered [ 183.726762][ T8880] tipc: Started in network mode [ 183.732009][ T8880] tipc: Node identity 66dddc0c6198, cluster identity 4711 [ 183.742415][ T8880] tipc: Enabled bearer , priority 0 [ 183.752264][ T8880] syzkaller0: entered promiscuous mode [ 183.759928][ T8880] syzkaller0: entered allmulticast mode [ 183.784396][ T8880] tipc: Resetting bearer [ 183.800027][ T8879] tipc: Resetting bearer [ 183.817038][ T8879] tipc: Disabling bearer [ 183.839677][ T8884] syzkaller0: entered promiscuous mode [ 183.848276][ T8884] syzkaller0: entered allmulticast mode [ 184.081456][ T8908] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 184.801785][ T8930] netlink: 8 bytes leftover after parsing attributes in process `syz.2.839'. [ 184.815175][ T8930] netlink: 24 bytes leftover after parsing attributes in process `syz.2.839'. [ 184.879775][ T8938] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 512, id = 0 [ 184.891467][ T8936] IPVS: stopping backup sync thread 8938 ... [ 184.900590][ T8934] syzkaller0: entered promiscuous mode [ 184.906532][ T8934] syzkaller0: entered allmulticast mode [ 185.110730][ T8961] trusted_key: syz.1.846 sent an empty control message without MSG_MORE. [ 185.123454][ T8961] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 185.329444][ T8973] team0: entered promiscuous mode [ 185.334984][ T8973] team_slave_0: entered promiscuous mode [ 185.341107][ T8973] team_slave_1: entered promiscuous mode [ 186.151952][ T8995] netlink: 4 bytes leftover after parsing attributes in process `syz.3.856'. [ 186.196266][ T8994] syzkaller0: entered promiscuous mode [ 186.238887][ T8994] syzkaller0: entered allmulticast mode [ 186.532116][ T9005] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 186.681409][ T9010] netlink: 'syz.3.863': attribute type 1 has an invalid length. [ 186.690671][ T9010] netlink: 'syz.3.863': attribute type 1 has an invalid length. [ 186.741171][ T9010] lo speed is unknown, defaulting to 1000 [ 186.775461][ T9019] IPv6: NLM_F_CREATE should be specified when creating new route [ 186.855568][ T9025] netlink: 8 bytes leftover after parsing attributes in process `syz.0.862'. [ 186.871103][ T9025] netlink: 'syz.0.862': attribute type 30 has an invalid length. [ 186.922498][ T9025] netlink: 12 bytes leftover after parsing attributes in process `syz.0.862'. [ 187.058428][ T9033] netlink: 'syz.3.866': attribute type 10 has an invalid length. [ 187.169058][ T9038] syzkaller1: entered promiscuous mode [ 187.175526][ T9038] syzkaller1: entered allmulticast mode [ 187.284128][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.871'. [ 187.295098][ T9043] netlink: 4 bytes leftover after parsing attributes in process `syz.1.871'. [ 187.297671][ T9045] syzkaller0: entered promiscuous mode [ 187.309637][ T9045] syzkaller0: entered allmulticast mode [ 187.322824][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.871'. [ 187.332113][ T9043] netlink: 4 bytes leftover after parsing attributes in process `syz.1.871'. [ 187.787432][ T9073] netlink: 'syz.1.881': attribute type 1 has an invalid length. [ 187.902488][ T9079] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 188.061784][ T9096] tipc: Enabling of bearer rejected, failed to enable media [ 188.071604][ T9096] syzkaller0: entered promiscuous mode [ 188.079319][ T9096] syzkaller0: entered allmulticast mode [ 188.178910][ T9100] netlink: 'syz.0.888': attribute type 10 has an invalid length. [ 188.196292][ T9100] dummy0: entered promiscuous mode [ 188.213108][ T9100] team0: Port device dummy0 added [ 188.230963][ T9100] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 188.357781][ T9114] netlink: 232 bytes leftover after parsing attributes in process `syz.3.891'. [ 188.932167][ T9133] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.942127][ T9133] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.985582][ T5864] Bluetooth: hci4: link tx timeout [ 188.990888][ T5864] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 188.998887][ T5864] Bluetooth: hci4: link tx timeout [ 189.004225][ T5864] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 189.153989][ T9138] lo speed is unknown, defaulting to 1000 [ 189.369114][ T9146] tipc: Enabled bearer , priority 0 [ 189.395365][ T9150] tipc: Enabling of bearer rejected, failed to enable media [ 189.421772][ T9150] syzkaller0: entered promiscuous mode [ 189.432929][ T9150] syzkaller0: entered allmulticast mode [ 189.466383][ T9148] tipc: Disabling bearer [ 189.602471][ T9160] IPVS: sync thread started: state = BACKUP, mcast_ifn = tunl0, syncid = 3, id = 0 [ 189.616637][ T9156] lo speed is unknown, defaulting to 1000 [ 189.851208][ T9174] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 189.911316][ T9182] __nla_validate_parse: 2 callbacks suppressed [ 189.911340][ T9182] netlink: 140 bytes leftover after parsing attributes in process `syz.0.908'. [ 190.349423][ T9153] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 190.509487][ T9189] netlink: 'syz.1.911': attribute type 1 has an invalid length. [ 190.530986][ T9189] 8021q: adding VLAN 0 to HW filter on device bond4 [ 190.681081][ T9193] lo speed is unknown, defaulting to 1000 [ 190.726577][ T9202] netlink: 256 bytes leftover after parsing attributes in process `syz.4.914'. [ 190.741011][ T9202] netlink: 72 bytes leftover after parsing attributes in process `syz.4.914'. [ 190.748180][ T9192] lo speed is unknown, defaulting to 1000 [ 190.851940][ T9207] tipc: Enabling of bearer rejected, failed to enable media [ 190.897699][ T9207] syzkaller0: entered promiscuous mode [ 190.904105][ T9207] syzkaller0: entered allmulticast mode [ 191.013039][ T5864] Bluetooth: hci4: command 0x0406 tx timeout [ 191.177867][ T9227] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 191.227379][ T9229] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 191.458776][ T9248] netlink: 'syz.1.928': attribute type 1 has an invalid length. [ 191.513004][ T9251] netlink: 140 bytes leftover after parsing attributes in process `syz.0.927'. [ 191.522967][ T9248] bond5: (slave vlan2): Opening slave failed [ 191.643895][ T9253] lo: entered allmulticast mode [ 191.650877][ T9252] lo: left allmulticast mode [ 191.695503][ T9255] syzkaller1: entered promiscuous mode [ 191.701056][ T9255] syzkaller1: entered allmulticast mode [ 191.869360][ T9259] tipc: Enabling of bearer rejected, failed to enable media [ 191.880236][ T9259] syzkaller0: entered promiscuous mode [ 191.885844][ T9259] syzkaller0: entered allmulticast mode [ 191.988746][ T9261] tipc: Enabled bearer , priority 0 [ 191.998917][ T9261] syzkaller0: entered promiscuous mode [ 192.004826][ T9261] syzkaller0: entered allmulticast mode [ 192.026254][ T9261] tipc: Resetting bearer [ 192.041960][ T9260] tipc: Resetting bearer [ 192.052739][ T9260] tipc: Disabling bearer [ 192.067396][ T9263] 8021q: VLANs not supported on vxcan1 [ 193.093248][ T5864] Bluetooth: hci4: command 0x0406 tx timeout [ 196.932983][ T5869] Bluetooth: hci1: command 0x0406 tx timeout [ 196.933009][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 196.939052][ T5869] Bluetooth: hci2: command 0x0406 tx timeout [ 229.013253][ T1210] page_pool_release_retry() stalled pool shutdown: id 32, 1 inflight 60 sec [ 235.702040][ T9282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.941'. [ 235.746690][ T9283] lo speed is unknown, defaulting to 1000 [ 235.968932][ T9291] lo speed is unknown, defaulting to 1000 [ 236.207430][ T9307] tipc: Enabling of bearer rejected, failed to enable media [ 236.503873][ T9323] netlink: 277 bytes leftover after parsing attributes in process `syz.1.950'. [ 236.592678][ T9319] lo speed is unknown, defaulting to 1000 [ 236.628462][ T9330] netlink: 8 bytes leftover after parsing attributes in process `syz.3.951'. [ 236.670513][ T9330] ip6tnl0: Master is either lo or non-ether device [ 236.714634][ T9335] netlink: 277 bytes leftover after parsing attributes in process `syz.0.952'. [ 236.853623][ T9345] netlink: 68 bytes leftover after parsing attributes in process `syz.3.953'. [ 236.869982][ T9344] netlink: 4 bytes leftover after parsing attributes in process `syz.0.955'. [ 237.548433][ T9370] netlink: 277 bytes leftover after parsing attributes in process `syz.4.964'. [ 237.578890][ T9367] lo speed is unknown, defaulting to 1000 [ 237.776941][ T9377] netlink: 12 bytes leftover after parsing attributes in process `syz.4.965'. [ 237.788504][ T9377] netlink: 84 bytes leftover after parsing attributes in process `syz.4.965'. [ 237.801324][ T9379] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.813905][ T9379] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.864330][ T9379] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.876600][ T9379] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.915890][ T9381] netlink: 68 bytes leftover after parsing attributes in process `syz.0.967'. [ 237.935986][ T9379] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.946752][ T9379] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.984886][ T9379] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.996621][ T9379] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.071998][ T59] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.080784][ T59] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.107275][ T13] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.116569][ T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.137791][ T13] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.149409][ T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.168846][ T2910] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.179833][ T2910] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.305663][ T9392] netlink: 'syz.3.972': attribute type 21 has an invalid length. [ 238.315788][ T9392] netlink: 'syz.3.972': attribute type 4 has an invalid length. [ 238.324611][ T9392] netlink: 'syz.3.972': attribute type 3 has an invalid length. [ 238.425231][ T9390] lo speed is unknown, defaulting to 1000 [ 238.504822][ T9398] lo speed is unknown, defaulting to 1000 [ 239.032707][ T9416] tipc: Enabling of bearer rejected, failed to enable media [ 239.043016][ T9416] syzkaller0: entered promiscuous mode [ 239.048540][ T9416] syzkaller0: entered allmulticast mode [ 239.316911][ T9423] lo speed is unknown, defaulting to 1000 [ 239.630902][ T9441] vlan2: entered allmulticast mode [ 239.637364][ T9441] dummy0: entered allmulticast mode [ 239.682492][ T9440] vlan2: entered allmulticast mode [ 239.824805][ T30] audit: type=1804 audit(1756220652.269:3): pid=9448 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.988" name="/newroot/222/memory.events" dev="tmpfs" ino=1161 res=1 errno=0 [ 239.851488][ T30] audit: type=1800 audit(1756220652.269:4): pid=9448 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.988" name="memory.events" dev="tmpfs" ino=1161 res=0 errno=0 [ 239.952963][ T9458] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 239.983288][ T9460] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 240.932576][ T9493] netlink: 'syz.2.1005': attribute type 1 has an invalid length. [ 240.955321][ T9493] netlink: 'syz.2.1005': attribute type 2 has an invalid length. [ 241.079648][ T9502] netlink: 'syz.2.1010': attribute type 1 has an invalid length. [ 241.114980][ T9502] __nla_validate_parse: 9 callbacks suppressed [ 241.115006][ T9502] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1010'. [ 241.236789][ T9511] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 241.287493][ T9522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1018'. [ 241.296649][ T9522] netlink: 312 bytes leftover after parsing attributes in process `syz.4.1018'. [ 241.306194][ T9522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1018'. [ 241.379804][ T9527] gretap0: entered promiscuous mode [ 241.388579][ T9531] netlink: 'syz.1.1021': attribute type 1 has an invalid length. [ 241.397699][ T9531] netlink: 'syz.1.1021': attribute type 3 has an invalid length. [ 241.407790][ T9531] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1021'. [ 241.420757][ T9531] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1021'. [ 241.633646][ T9556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1024'. [ 241.788540][ T30] audit: type=1804 audit(1756220654.249:5): pid=9565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.1030" name="/newroot/195/cgroup.controllers" dev="tmpfs" ino=1017 res=1 errno=0 [ 241.800034][ T9565] macvlan2: entered allmulticast mode [ 241.811537][ T30] audit: type=1800 audit(1756220654.249:6): pid=9565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1030" name="cgroup.controllers" dev="tmpfs" ino=1017 res=0 errno=0 [ 241.835574][ T9565] veth1_vlan: entered allmulticast mode [ 241.839309][ T30] audit: type=1800 audit(1756220654.249:7): pid=9565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1030" name="cgroup.controllers" dev="tmpfs" ino=1017 res=0 errno=0 [ 241.850136][ T9565] bond0: (slave macvlan2): Enslaving as an active interface with an up link [ 241.925913][ T9569] openvswitch: netlink: Message has 20 unknown bytes. [ 241.929260][ T9571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1033'. [ 241.937358][ T9569] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 242.076432][ T9577] tipc: Enabled bearer , priority 0 [ 242.088749][ T9577] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1037'. [ 242.122849][ T9577] tipc: Resetting bearer [ 242.158986][ T9576] tipc: Disabling bearer [ 242.235023][ T9587] netlink: 'syz.2.1039': attribute type 10 has an invalid length. [ 242.348017][ T9594] !: renamed from dummy0 (while UP) [ 242.362318][ T9594] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 242.375601][ T9596] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1041'. [ 242.407190][ T9596] netlink: 'syz.0.1041': attribute type 1 has an invalid length. [ 243.168352][ T9650] bond4: (slave geneve2): making interface the new active one [ 243.179628][ T9650] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 243.188600][ T34] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 243.197550][ T34] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 243.207053][ T34] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 243.215501][ T34] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 243.291743][ T9655] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 243.930710][ T9690] validate_nla: 1 callbacks suppressed [ 243.930736][ T9690] netlink: 'syz.3.1075': attribute type 21 has an invalid length. [ 243.946439][ T9690] netlink: 'syz.3.1075': attribute type 5 has an invalid length. [ 243.954400][ T9690] netlink: 'syz.3.1075': attribute type 6 has an invalid length. [ 244.285989][ T9721] IPVS: set_ctl: invalid protocol: 0 100.1.1.1:20000 [ 244.348172][ T9727] netlink: 'syz.2.1085': attribute type 2 has an invalid length. [ 244.478721][ T9740] Bluetooth: MGMT ver 1.23 [ 244.493896][ T9740] geneve2: entered promiscuous mode [ 244.752185][ T9759] lo speed is unknown, defaulting to 1000 [ 245.186689][ T9770] pimreg: entered allmulticast mode [ 245.205609][ T9770] dvmrp8: entered allmulticast mode [ 245.213915][ T9769] pimreg: left allmulticast mode [ 245.219700][ T9761] netlink: 'syz.2.1093': attribute type 13 has an invalid length. [ 245.230298][ T9769] dvmrp8: left allmulticast mode [ 245.235579][ T9761] netlink: 'syz.2.1093': attribute type 17 has an invalid length. [ 245.319808][ T9761] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 245.875332][ T9795] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 245.887551][ T5915] IPVS: starting estimator thread 0... [ 245.921755][ T9803] team0: Port device batadv1 removed [ 245.990054][ T9807] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 246.015036][ T9808] IPVS: using max 36 ests per chain, 86400 per kthread [ 246.030169][ T9805] lo speed is unknown, defaulting to 1000 [ 246.087276][ T9807] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 246.166217][ T9812] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 246.195228][ T9821] tipc: Enabled bearer , priority 0 [ 246.202931][ T9821] syzkaller0: entered promiscuous mode [ 246.208537][ T9821] syzkaller0: entered allmulticast mode [ 246.258238][ T9821] tipc: Resetting bearer [ 246.941759][ T9862] __nla_validate_parse: 29 callbacks suppressed [ 246.941783][ T9862] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1122'. [ 246.965177][ T9861] netlink: 'syz.0.1122': attribute type 8 has an invalid length. [ 246.974563][ T9861] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1122'. [ 246.997310][ T9821] tipc: Resetting bearer [ 247.031694][ T9872] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1127'. [ 247.041802][ T9821] tipc: Disabling bearer [ 247.131609][ T9875] tipc: Enabled bearer , priority 0 [ 247.149608][ T9875] syzkaller0: entered promiscuous mode [ 247.154486][ T9879] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 247.155722][ T9875] syzkaller0: entered allmulticast mode [ 247.176201][ T9881] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1139'. [ 247.191521][ T9875] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 247.201860][ T9875] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1128'. [ 247.220774][ T9875] tipc: Resetting bearer [ 247.245204][ T9874] tipc: Resetting bearer [ 247.265185][ T9874] tipc: Disabling bearer [ 247.757632][ T9923] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 247.806324][ T9926] netlink: 'syz.3.1142': attribute type 1 has an invalid length. [ 247.815691][ T9926] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1142'. [ 247.824978][ T9923] syzkaller0: entered promiscuous mode [ 247.825007][ T9923] syzkaller0: entered allmulticast mode [ 248.341696][ T9948] netlink: 'syz.0.1150': attribute type 4 has an invalid length. [ 248.353191][ T9948] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1150'. [ 248.394702][ T9946] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1149'. [ 248.404364][ T9946] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1149'. [ 248.430141][ T9953] pimreg: entered allmulticast mode [ 248.470442][ T9953] pimreg: left allmulticast mode [ 248.711528][ T9971] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 249.015427][ T9984] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 249.121291][ T9990] lo speed is unknown, defaulting to 1000 [ 249.227485][ T9994] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 249.470952][T10001] netlink: 'syz.3.1165': attribute type 1 has an invalid length. [ 249.483558][T10001] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1165'. [ 249.491903][ T9990] netlink: 'syz.4.1162': attribute type 2 has an invalid length. [ 249.508818][ T9990] tipc: New replicast peer: 208.253.78.183 [ 249.516222][ T9990] tipc: Enabled bearer , priority 10 [ 249.751393][T10014] macsec1: entered promiscuous mode [ 249.758149][T10014] macvlan1: entered promiscuous mode [ 249.768376][T10014] macvlan1: left promiscuous mode [ 249.848715][T10014] macsec1: entered promiscuous mode [ 249.854701][T10014] macvlan1: entered promiscuous mode [ 250.224451][T10014] macvlan1: left promiscuous mode [ 250.388339][T10014] macsec1: entered promiscuous mode [ 250.393912][T10014] macvlan1: entered promiscuous mode [ 250.401428][T10014] macvlan1: left promiscuous mode [ 250.457472][T10014] macsec1: entered promiscuous mode [ 250.463906][T10014] macvlan1: entered promiscuous mode [ 250.472710][T10014] macvlan1: left promiscuous mode [ 250.530652][T10014] macsec1: entered promiscuous mode [ 250.536582][T10014] macvlan1: entered promiscuous mode [ 250.547019][T10014] macvlan1: left promiscuous mode [ 250.650233][ T979] tipc: Node number set to 2360807167 [ 250.944552][T10078] team0: Device macvlan3 is already an upper device of the team interface [ 251.066470][T10085] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 251.129375][T10096] netlink: 'syz.4.1182': attribute type 1 has an invalid length. [ 251.395426][T10114] lo speed is unknown, defaulting to 1000 [ 251.771689][T10141] lo speed is unknown, defaulting to 1000 [ 252.029945][T10168] bridge2: entered allmulticast mode [ 252.105567][T10167] bridge2: left allmulticast mode [ 252.353610][T10184] lo speed is unknown, defaulting to 1000 [ 252.477148][T10200] netlink: 'syz.3.1208': attribute type 1 has an invalid length. [ 252.503117][T10200] __nla_validate_parse: 8 callbacks suppressed [ 252.503142][T10200] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1208'. [ 252.533234][T10199] netlink: del zone limit has 4 unknown bytes [ 252.537886][ T30] audit: type=1800 audit(1756220664.989:8): pid=10203 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1210" name="blkio.bfq.io_queued_recursive" dev="tmpfs" ino=1421 res=0 errno=0 [ 252.731887][T10213] bridge0: port 2(bridge_slave_1) entered disabled state [ 252.739503][T10213] bridge0: port 1(bridge_slave_0) entered disabled state [ 252.841346][T10213] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 252.936088][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 252.946070][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 252.965071][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 252.974472][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 252.985136][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 252.996068][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 253.005527][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 253.015394][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 253.028357][T10222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 253.039114][ T13] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 253.048254][ T13] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 253.060591][T10222] openvswitch: netlink: Tunnel attr 227 out of range max 16 [ 253.066144][ T13] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 253.079864][ T13] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 253.091928][ T13] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 253.107176][ T13] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 253.135418][ T13] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 253.151259][ T13] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 253.382338][T10247] sctp: [Deprecated]: syz.4.1220 (pid 10247) Use of int in max_burst socket option deprecated. [ 253.382338][T10247] Use struct sctp_assoc_value instead [ 253.459262][T10247] lo speed is unknown, defaulting to 1000 [ 253.680758][ T2910] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 253.705902][ T2910] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 253.850273][T10278] lo speed is unknown, defaulting to 1000 [ 254.071152][T10297] netlink: 'syz.2.1236': attribute type 15 has an invalid length. [ 254.292296][T10306] netlink: 'syz.4.1238': attribute type 30 has an invalid length. [ 254.531891][T10313] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.773798][ T12] bond1: (slave ip6gretap2): link status up again after 0 ms [ 254.807593][ T12] bond1: (slave ip6gretap2): link status up again after 0 ms [ 254.848110][T10334] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 254.854017][ T12] bond1: (slave ip6gretap2): link status up again after 0 ms [ 254.894095][ T12] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 255.090485][T10344] pimreg: entered allmulticast mode [ 255.131398][T10353] macvlan2: entered promiscuous mode [ 255.142933][T10353] macvlan2: entered allmulticast mode [ 255.149916][ T13] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 255.275775][ T34] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 255.289613][T10376] netlink: 'syz.3.1256': attribute type 3 has an invalid length. [ 255.352528][T10380] bridge0: port 1(batadv2) entered blocking state [ 255.363956][T10384] sock: sock_timestamping_bind_phc: sock not bind to device [ 255.373022][T10380] bridge0: port 1(batadv2) entered disabled state [ 255.379678][T10380] batadv2: entered allmulticast mode [ 255.405016][T10380] batadv2: entered promiscuous mode [ 255.532291][T10398] tipc: Enabled bearer , priority 0 [ 255.541780][T10395] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 255.552024][T10395] syzkaller1: linktype set to 778 [ 255.600088][T10385] tipc: Resetting bearer [ 255.748070][T10385] tipc: Disabling bearer [ 255.749775][T10407] netlink: 'syz.2.1264': attribute type 1 has an invalid length. [ 255.854107][ T12] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 255.863452][ T12] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 255.956620][T10427] lo speed is unknown, defaulting to 1000 [ 255.972041][T10427] lo speed is unknown, defaulting to 1000 [ 255.988570][T10427] lo speed is unknown, defaulting to 1000 [ 255.998213][T10431] IPVS: set_ctl: invalid protocol: 44 255.255.255.255:20004 [ 256.126126][T10443] netlink: 'syz.0.1273': attribute type 1 has an invalid length. [ 256.151515][T10427] infiniband syz0: set active [ 256.156782][ T979] lo speed is unknown, defaulting to 1000 [ 256.159879][T10427] infiniband syz0: added lo [ 256.167697][T10429] net_ratelimit: 4 callbacks suppressed [ 256.167717][T10429] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 256.206641][T10427] RDS/IB: syz0: added [ 256.210763][T10427] smc: adding ib device syz0 with port count 1 [ 256.219345][T10427] smc: ib device syz0 port 1 has pnetid [ 256.226254][ T1210] lo speed is unknown, defaulting to 1000 [ 256.236759][T10427] lo speed is unknown, defaulting to 1000 [ 256.283029][ T8270] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 256.388341][T10427] lo speed is unknown, defaulting to 1000 [ 256.403711][ T8270] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 256.533690][ T8270] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 256.547752][T10460] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 256.585683][T10427] lo speed is unknown, defaulting to 1000 [ 256.609676][T10463] netlink: 'syz.2.1278': attribute type 1 has an invalid length. [ 256.653237][T10429] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 256.736938][T10427] lo speed is unknown, defaulting to 1000 [ 256.773291][T10429] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 256.787299][T10426] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 256.878814][T10427] lo speed is unknown, defaulting to 1000 [ 256.886570][T10429] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 257.003493][ T13] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 257.124452][T10483] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 257.283508][T10485] team0: left promiscuous mode [ 257.288544][T10485] team_slave_0: left promiscuous mode [ 257.294570][T10485] team_slave_1: left promiscuous mode [ 257.300441][T10485] dummy0: left promiscuous mode [ 257.312067][T10485] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 257.322021][T10485] macvlan2: left promiscuous mode [ 257.327332][T10485] macvlan2: left allmulticast mode [ 257.839520][T10522] __nla_validate_parse: 61 callbacks suppressed [ 257.839547][T10522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1300'. [ 257.891854][T10527] netlink: 'syz.0.1301': attribute type 3 has an invalid length. [ 258.090407][T10540] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1304'. [ 258.145838][T10548] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1307'. [ 258.247477][T10553] lo speed is unknown, defaulting to 1000 [ 258.281214][T10553] lo speed is unknown, defaulting to 1000 [ 258.300124][T10560] netlink: 'syz.2.1309': attribute type 1 has an invalid length. [ 258.308692][T10560] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1309'. [ 258.326255][T10545] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1306'. [ 258.968379][T10603] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1319'. [ 259.136646][T10608] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (1803188595) [ 259.159659][T10608] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 259.341646][T10618] netlink: 'syz.3.1323': attribute type 5 has an invalid length. [ 259.356469][T10618] netlink: 92 bytes leftover after parsing attributes in process `syz.3.1323'. [ 259.414864][T10621] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1324'. [ 259.425922][T10621] 8021q: VLANs not supported on ip6_vti0 [ 259.436469][T10624] tipc: Enabled bearer , priority 0 [ 259.444286][T10624] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 259.456697][T10624] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 259.475225][T10624] tipc: Resetting bearer [ 259.756255][T10642] _Z`Ԁ@: entered promiscuous mode [ 259.788845][T10635] batadv_slave_1: entered promiscuous mode [ 259.908164][T10667] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1339'. [ 260.028120][T10669] netlink: 'syz.2.1337': attribute type 1 has an invalid length. [ 260.043515][T10669] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1337'. [ 260.152562][T10688] bond3: (slave erspan0): Releasing active interface [ 260.171732][T10688] bond0: (slave dummy0): Releasing backup interface [ 260.188129][T10688] bridge_slave_0: left allmulticast mode [ 260.194510][T10688] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.204155][T10688] bridge_slave_1: left allmulticast mode [ 260.209900][T10688] bridge_slave_1: left promiscuous mode [ 260.215908][T10688] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.226652][T10688] bond0: (slave bond_slave_0): Releasing backup interface [ 260.243664][T10688] bond0: (slave bond_slave_1): Releasing backup interface [ 260.262107][T10688] team0: Port device team_slave_0 removed [ 260.283791][T10688] team0: Port device team_slave_1 removed [ 260.290708][T10688] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 260.300557][T10688] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 260.309814][T10688] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 260.319675][T10688] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 260.335458][T10688] bond1: (slave gretap1): Releasing active interface [ 260.342274][T10688] bond1: (slave gretap1): the permanent HWaddr of slave - 3a:e2:83:6b:1d:28 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 260.359983][T10688] bond1: (slave gretap2): making interface the new active one [ 260.377274][T10688] bond1: (slave gretap2): Releasing active interface [ 260.394968][T10688] bond0: (slave macvlan2): Releasing backup interface [ 260.403777][T10688] veth1_vlan: left allmulticast mode [ 260.414077][T10688] bond4: (slave geneve2): Releasing active interface [ 260.498182][T10429] tipc: Resetting bearer [ 260.515019][ T1026] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 260.535275][ T1026] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 260.561306][ T1026] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 260.570408][ T1026] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 260.588663][T10693] bridge5: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 260.757975][T10706] netlink: 'syz.4.1349': attribute type 1 has an invalid length. [ 260.767828][T10706] netlink: 'syz.4.1349': attribute type 1 has an invalid length. [ 260.818921][T10708] : renamed from vlan1 (while UP) [ 260.848207][T10713] tipc: Enabled bearer , priority 0 [ 260.866009][T10713] syzkaller0: entered promiscuous mode [ 260.875009][T10713] syzkaller0: entered allmulticast mode [ 260.902507][T10713] tipc: Resetting bearer [ 260.999504][T10728] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.071000][T10728] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.181507][T10728] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.233350][ T1150] net_ratelimit: 30 callbacks suppressed [ 261.233374][ T1150] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 261.299030][T10728] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.380206][ T1150] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.390903][T10753] netlink: 'syz.2.1364': attribute type 10 has an invalid length. [ 261.404754][ T1150] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.425533][T10753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 261.436438][T10753] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 261.458355][T10429] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.489564][ T34] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 261.513398][ T34] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 261.591091][T10770] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:20003 [ 261.635128][ T1150] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 261.753339][ T1150] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 261.863080][T10783] lo speed is unknown, defaulting to 1000 [ 261.873565][ T1150] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 261.890102][T10783] lo speed is unknown, defaulting to 1000 [ 261.915423][T10787] netlink: 'syz.3.1374': attribute type 1 has an invalid length. [ 262.054091][ T1026] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 262.234586][ T34] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 262.358580][T10429] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 262.502946][T10429] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 262.538779][T10791] netlink: 'syz.3.1375': attribute type 5 has an invalid length. [ 262.558190][T10791] netlink: 'syz.3.1375': attribute type 7 has an invalid length. [ 262.580854][T10791] : entered promiscuous mode [ 262.633719][ T34] bond1: (slave ip6gretap2): failed to get link speed/duplex [ 262.655413][T10810] netlink: 'syz.0.1380': attribute type 29 has an invalid length. [ 262.980693][T10827] netlink: 'syz.1.1386': attribute type 1 has an invalid length. [ 263.016930][T10827] __nla_validate_parse: 13 callbacks suppressed [ 263.016958][T10827] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1386'. [ 263.146490][T10830] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1388'. [ 263.204103][T10832] netlink: 'syz.2.1389': attribute type 10 has an invalid length. [ 263.204111][T10833] netlink: 'syz.2.1389': attribute type 10 has an invalid length. [ 263.257236][T10837] netlink: 510 bytes leftover after parsing attributes in process `syz.2.1390'. [ 263.266811][T10838] netlink: 510 bytes leftover after parsing attributes in process `syz.2.1390'. [ 263.456477][T10851] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1395'. [ 263.569991][T10856] bridge2: entered allmulticast mode [ 263.576654][T10856] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1397'. [ 263.981691][T10881] lo speed is unknown, defaulting to 1000 [ 264.006012][T10882] netlink: 248 bytes leftover after parsing attributes in process `syz.4.1403'. [ 264.031970][T10881] lo speed is unknown, defaulting to 1000 [ 264.251619][T10910] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1411'. [ 264.313341][T10921] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1411'. [ 264.327148][T10915] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 264.349375][T10915] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.428798][T10924] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1413'. [ 264.462454][T10915] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 264.487313][T10915] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.558131][T10915] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 264.572225][T10915] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.654777][T10915] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 264.664888][T10915] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.071001][T10965] team0: Port device vxlan0 added [ 265.081828][ T1026] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.096383][ T1026] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.108360][ T1026] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.118933][ T1026] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.221704][ T1150] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.241281][ T1150] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.269606][ T8270] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.277957][ T8270] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.299798][ T34] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.322145][ T34] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.354929][ T1150] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 265.372947][ T1150] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.415023][T10922] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 265.451930][T10922] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.480802][ T1150] ================================================================== [ 265.488939][ T1150] BUG: KASAN: slab-use-after-free in __mutex_lock+0x147/0x1350 [ 265.496537][ T1150] Read of size 8 at addr ffff88807b0484b0 by task kworker/u8:6/1150 [ 265.504541][ T1150] [ 265.506881][ T1150] CPU: 0 UID: 0 PID: 1150 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 265.506904][ T1150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 265.506918][ T1150] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 265.506954][ T1150] Call Trace: [ 265.506962][ T1150] [ 265.506970][ T1150] dump_stack_lvl+0x189/0x250 [ 265.506997][ T1150] ? __pfx_dump_stack_lvl+0x10/0x10 [ 265.507018][ T1150] ? lock_release+0x4b/0x3e0 [ 265.507047][ T1150] ? __virt_addr_valid+0x4a5/0x5c0 [ 265.507080][ T1150] print_report+0xca/0x240 [ 265.507098][ T1150] ? __mutex_lock+0x147/0x1350 [ 265.507125][ T1150] kasan_report+0x118/0x150 [ 265.507153][ T1150] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 265.507178][ T1150] ? __mutex_lock+0x147/0x1350 [ 265.507209][ T1150] __mutex_lock+0x147/0x1350 [ 265.507237][ T1150] ? __mutex_lock+0x5bb/0x1350 [ 265.507265][ T1150] ? udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 265.507293][ T1150] ? __pfx___mutex_lock+0x10/0x10 [ 265.507320][ T1150] ? do_raw_spin_unlock+0x122/0x240 [ 265.507343][ T1150] ? rcu_is_watching+0x15/0xb0 [ 265.507365][ T1150] udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 265.507395][ T1150] ? process_scheduled_works+0x9ef/0x17b0 [ 265.507411][ T1150] ? process_scheduled_works+0x9ef/0x17b0 [ 265.507428][ T1150] process_scheduled_works+0xae1/0x17b0 [ 265.507458][ T1150] ? __pfx_process_scheduled_works+0x10/0x10 [ 265.507482][ T1150] worker_thread+0x8a0/0xda0 [ 265.507512][ T1150] kthread+0x70e/0x8a0 [ 265.507535][ T1150] ? __pfx_worker_thread+0x10/0x10 [ 265.507552][ T1150] ? __pfx_kthread+0x10/0x10 [ 265.507573][ T1150] ? rcu_is_watching+0x15/0xb0 [ 265.507591][ T1150] ? __pfx_kthread+0x10/0x10 [ 265.507612][ T1150] ret_from_fork+0x3f9/0x770 [ 265.507631][ T1150] ? __pfx_ret_from_fork+0x10/0x10 [ 265.507651][ T1150] ? __switch_to_asm+0x39/0x70 [ 265.507673][ T1150] ? __switch_to_asm+0x33/0x70 [ 265.507695][ T1150] ? __pfx_kthread+0x10/0x10 [ 265.507716][ T1150] ret_from_fork_asm+0x1a/0x30 [ 265.507746][ T1150] [ 265.507753][ T1150] [ 265.705988][ T1150] Allocated by task 10915: [ 265.710410][ T1150] kasan_save_track+0x3e/0x80 [ 265.715109][ T1150] __kasan_kmalloc+0x93/0xb0 [ 265.719715][ T1150] __kmalloc_noprof+0x27a/0x4f0 [ 265.724604][ T1150] udp_tunnel_nic_netdevice_event+0x854/0x19f0 [ 265.730778][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 265.735908][ T1150] register_netdevice+0x1608/0x1ae0 [ 265.741173][ T1150] nsim_create+0xae8/0xf10 [ 265.745610][ T1150] __nsim_dev_port_add+0x6b6/0xb10 [ 265.750746][ T1150] nsim_dev_port_add_all+0x37/0xf0 [ 265.755878][ T1150] nsim_dev_reload_up+0x451/0x780 [ 265.760940][ T1150] devlink_reload+0x4ec/0x8d0 [ 265.765633][ T1150] devlink_nl_reload_doit+0xb35/0xd50 [ 265.771026][ T1150] genl_family_rcv_msg_doit+0x212/0x300 [ 265.776585][ T1150] genl_rcv_msg+0x60e/0x790 [ 265.781102][ T1150] netlink_rcv_skb+0x208/0x470 [ 265.785878][ T1150] genl_rcv+0x28/0x40 [ 265.789888][ T1150] netlink_unicast+0x82f/0x9e0 [ 265.794691][ T1150] netlink_sendmsg+0x805/0xb30 [ 265.799457][ T1150] __sock_sendmsg+0x219/0x270 [ 265.804146][ T1150] ____sys_sendmsg+0x505/0x830 [ 265.808916][ T1150] ___sys_sendmsg+0x21f/0x2a0 [ 265.813595][ T1150] __x64_sys_sendmsg+0x19b/0x260 [ 265.818538][ T1150] do_syscall_64+0xfa/0x3b0 [ 265.823045][ T1150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.828947][ T1150] [ 265.831273][ T1150] Freed by task 10922: [ 265.835409][ T1150] kasan_save_track+0x3e/0x80 [ 265.840097][ T1150] kasan_save_free_info+0x46/0x50 [ 265.845129][ T1150] __kasan_slab_free+0x5b/0x80 [ 265.849907][ T1150] kfree+0x18e/0x440 [ 265.853811][ T1150] udp_tunnel_nic_netdevice_event+0x1332/0x19f0 [ 265.860138][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 265.865258][ T1150] unregister_netdevice_many_notify+0x14d7/0x1ff0 [ 265.871686][ T1150] unregister_netdevice_queue+0x33c/0x380 [ 265.877486][ T1150] nsim_destroy+0x1dd/0x670 [ 265.882002][ T1150] __nsim_dev_port_del+0x14d/0x1b0 [ 265.887127][ T1150] nsim_dev_reload_destroy+0x288/0x490 [ 265.892620][ T1150] nsim_dev_reload_down+0x8a/0xc0 [ 265.897655][ T1150] devlink_reload+0x1b3/0x8d0 [ 265.902360][ T1150] devlink_nl_reload_doit+0xb35/0xd50 [ 265.907934][ T1150] genl_family_rcv_msg_doit+0x212/0x300 [ 265.913488][ T1150] genl_rcv_msg+0x60e/0x790 [ 265.918000][ T1150] netlink_rcv_skb+0x208/0x470 [ 265.922780][ T1150] genl_rcv+0x28/0x40 [ 265.926777][ T1150] netlink_unicast+0x82f/0x9e0 [ 265.931576][ T1150] netlink_sendmsg+0x805/0xb30 [ 265.936340][ T1150] __sock_sendmsg+0x219/0x270 [ 265.941036][ T1150] ____sys_sendmsg+0x505/0x830 [ 265.945822][ T1150] ___sys_sendmsg+0x21f/0x2a0 [ 265.950517][ T1150] __x64_sys_sendmsg+0x19b/0x260 [ 265.955486][ T1150] do_syscall_64+0xfa/0x3b0 [ 265.960017][ T1150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.965918][ T1150] [ 265.968247][ T1150] Last potentially related work creation: [ 265.974052][ T1150] kasan_save_stack+0x3e/0x60 [ 265.978752][ T1150] kasan_record_aux_stack+0xbd/0xd0 [ 265.983966][ T1150] insert_work+0x3d/0x330 [ 265.988451][ T1150] __queue_work+0xbaf/0xfb0 [ 265.992965][ T1150] queue_work_on+0x181/0x270 [ 265.997565][ T1150] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 266.003214][ T1150] udp_tunnel_push_rx_port+0x17d/0x200 [ 266.008689][ T1150] geneve_offload_rx_ports+0xd7/0x160 [ 266.014157][ T1150] geneve_netdevice_event+0x6a/0x80 [ 266.019385][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 266.024519][ T1150] call_netdevice_notifiers+0x88/0xc0 [ 266.029907][ T1150] udp_tunnel_nic_netdevice_event+0x134d/0x19f0 [ 266.036158][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 266.041273][ T1150] register_netdevice+0x1608/0x1ae0 [ 266.046477][ T1150] nsim_create+0xae8/0xf10 [ 266.050931][ T1150] __nsim_dev_port_add+0x6b6/0xb10 [ 266.056406][ T1150] nsim_dev_port_add_all+0x37/0xf0 [ 266.061536][ T1150] nsim_dev_reload_up+0x451/0x780 [ 266.066569][ T1150] devlink_reload+0x4ec/0x8d0 [ 266.071257][ T1150] devlink_nl_reload_doit+0xb35/0xd50 [ 266.076649][ T1150] genl_family_rcv_msg_doit+0x212/0x300 [ 266.082207][ T1150] genl_rcv_msg+0x60e/0x790 [ 266.086718][ T1150] netlink_rcv_skb+0x208/0x470 [ 266.091496][ T1150] genl_rcv+0x28/0x40 [ 266.095483][ T1150] netlink_unicast+0x82f/0x9e0 [ 266.100257][ T1150] netlink_sendmsg+0x805/0xb30 [ 266.105032][ T1150] __sock_sendmsg+0x219/0x270 [ 266.109719][ T1150] ____sys_sendmsg+0x505/0x830 [ 266.114540][ T1150] ___sys_sendmsg+0x21f/0x2a0 [ 266.119229][ T1150] __x64_sys_sendmsg+0x19b/0x260 [ 266.124170][ T1150] do_syscall_64+0xfa/0x3b0 [ 266.128719][ T1150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.134616][ T1150] [ 266.136941][ T1150] Second to last potentially related work creation: [ 266.143545][ T1150] kasan_save_stack+0x3e/0x60 [ 266.148236][ T1150] kasan_record_aux_stack+0xbd/0xd0 [ 266.153438][ T1150] insert_work+0x3d/0x330 [ 266.157782][ T1150] __queue_work+0xcd2/0xfb0 [ 266.162288][ T1150] queue_work_on+0x181/0x270 [ 266.166901][ T1150] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 266.172544][ T1150] udp_tunnel_push_rx_port+0x17d/0x200 [ 266.178013][ T1150] vxlan_offload_rx_ports+0x139/0x200 [ 266.183490][ T1150] vxlan_netdevice_event+0x111/0x470 [ 266.188792][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 266.193907][ T1150] call_netdevice_notifiers+0x88/0xc0 [ 266.199298][ T1150] udp_tunnel_nic_netdevice_event+0x134d/0x19f0 [ 266.205586][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 266.210703][ T1150] register_netdevice+0x1608/0x1ae0 [ 266.215915][ T1150] nsim_create+0xae8/0xf10 [ 266.220340][ T1150] __nsim_dev_port_add+0x6b6/0xb10 [ 266.225463][ T1150] nsim_dev_port_add_all+0x37/0xf0 [ 266.230600][ T1150] nsim_dev_reload_up+0x451/0x780 [ 266.235634][ T1150] devlink_reload+0x4ec/0x8d0 [ 266.240353][ T1150] devlink_nl_reload_doit+0xb35/0xd50 [ 266.245824][ T1150] genl_family_rcv_msg_doit+0x212/0x300 [ 266.251397][ T1150] genl_rcv_msg+0x60e/0x790 [ 266.255938][ T1150] netlink_rcv_skb+0x208/0x470 [ 266.260735][ T1150] genl_rcv+0x28/0x40 [ 266.264724][ T1150] netlink_unicast+0x82f/0x9e0 [ 266.269674][ T1150] netlink_sendmsg+0x805/0xb30 [ 266.274639][ T1150] __sock_sendmsg+0x219/0x270 [ 266.279535][ T1150] ____sys_sendmsg+0x505/0x830 [ 266.284417][ T1150] ___sys_sendmsg+0x21f/0x2a0 [ 266.289113][ T1150] __x64_sys_sendmsg+0x19b/0x260 [ 266.294080][ T1150] do_syscall_64+0xfa/0x3b0 [ 266.298948][ T1150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.304989][ T1150] [ 266.307444][ T1150] The buggy address belongs to the object at ffff88807b048400 [ 266.307444][ T1150] which belongs to the cache kmalloc-256 of size 256 [ 266.321528][ T1150] The buggy address is located 176 bytes inside of [ 266.321528][ T1150] freed 256-byte region [ffff88807b048400, ffff88807b048500) [ 266.335447][ T1150] [ 266.337809][ T1150] The buggy address belongs to the physical page: [ 266.344341][ T1150] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b048 [ 266.353167][ T1150] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 266.361746][ T1150] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 266.369411][ T1150] page_type: f5(slab) [ 266.373446][ T1150] raw: 00fff00000000040 ffff88801a441b40 ffffea0001e21c00 dead000000000002 [ 266.382392][ T1150] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 266.390991][ T1150] head: 00fff00000000040 ffff88801a441b40 ffffea0001e21c00 dead000000000002 [ 266.399695][ T1150] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 266.408551][ T1150] head: 00fff00000000001 ffffea0001ec1201 00000000ffffffff 00000000ffffffff [ 266.417258][ T1150] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 266.425935][ T1150] page dumped because: kasan: bad access detected [ 266.432366][ T1150] page_owner tracks the page as allocated [ 266.438167][ T1150] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5857, tgid 5857 (syz-executor), ts 78075533309, free_ts 78032326262 [ 266.459651][ T1150] post_alloc_hook+0x240/0x2a0 [ 266.464474][ T1150] get_page_from_freelist+0x21e4/0x22c0 [ 266.470053][ T1150] __alloc_frozen_pages_noprof+0x181/0x370 [ 266.475865][ T1150] alloc_pages_mpol+0x232/0x4a0 [ 266.480728][ T1150] allocate_slab+0x8a/0x370 [ 266.485326][ T1150] ___slab_alloc+0xbeb/0x1410 [ 266.490021][ T1150] __kmalloc_noprof+0x305/0x4f0 [ 266.494897][ T1150] fib_create_info+0x1728/0x3210 [ 266.500059][ T1150] fib_table_insert+0xc6/0x1b50 [ 266.504913][ T1150] fib_magic+0x2c4/0x390 [ 266.509513][ T1150] fib_add_ifaddr+0x144/0x5f0 [ 266.514197][ T1150] fib_inetaddr_event+0x12e/0x190 [ 266.519236][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 266.524359][ T1150] blocking_notifier_call_chain+0x6a/0x90 [ 266.530098][ T1150] __inet_insert_ifa+0xa13/0xbf0 [ 266.535129][ T1150] inet_rtm_newaddr+0xf3a/0x18b0 [ 266.540101][ T1150] page last free pid 5863 tgid 5863 stack trace: [ 266.546600][ T1150] __free_frozen_pages+0xbc4/0xd30 [ 266.551732][ T1150] __put_partials+0x156/0x1a0 [ 266.556600][ T1150] put_cpu_partial+0x17c/0x250 [ 266.561374][ T1150] __slab_free+0x2d5/0x3c0 [ 266.565792][ T1150] qlist_free_all+0x97/0x140 [ 266.570393][ T1150] kasan_quarantine_reduce+0x148/0x160 [ 266.575859][ T1150] __kasan_slab_alloc+0x22/0x80 [ 266.580725][ T1150] __kmalloc_cache_noprof+0x1be/0x3d0 [ 266.586194][ T1150] netdevice_event+0x3a1/0x8a0 [ 266.591055][ T1150] notifier_call_chain+0x1b3/0x3e0 [ 266.596183][ T1150] netif_set_mac_address+0x37c/0x4c0 [ 266.601489][ T1150] do_setlink+0x88c/0x41c0 [ 266.605909][ T1150] rtnl_newlink+0x160b/0x1c70 [ 266.610731][ T1150] rtnetlink_rcv_msg+0x7cc/0xb70 [ 266.615909][ T1150] netlink_rcv_skb+0x208/0x470 [ 266.620724][ T1150] netlink_unicast+0x82f/0x9e0 [ 266.625515][ T1150] [ 266.627854][ T1150] Memory state around the buggy address: [ 266.633492][ T1150] ffff88807b048380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 266.641566][ T1150] ffff88807b048400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 266.649652][ T1150] >ffff88807b048480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 266.657716][ T1150] ^ [ 266.663348][ T1150] ffff88807b048500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 266.671412][ T1150] ffff88807b048580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 266.679476][ T1150] ================================================================== [ 266.695208][ T1150] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 266.702459][ T1150] CPU: 0 UID: 0 PID: 1150 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 266.711947][ T1150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 266.722044][ T1150] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 266.729474][ T1150] Call Trace: [ 266.732773][ T1150] [ 266.735733][ T1150] dump_stack_lvl+0x99/0x250 [ 266.740348][ T1150] ? __asan_memcpy+0x40/0x70 [ 266.744960][ T1150] ? __pfx_dump_stack_lvl+0x10/0x10 [ 266.750173][ T1150] ? __pfx__printk+0x10/0x10 [ 266.754784][ T1150] vpanic+0x281/0x750 [ 266.758780][ T1150] ? preempt_schedule+0xae/0xc0 [ 266.763820][ T1150] ? __pfx_vpanic+0x10/0x10 [ 266.768334][ T1150] ? preempt_schedule_common+0x83/0xd0 [ 266.773810][ T1150] ? preempt_schedule+0xae/0xc0 [ 266.778676][ T1150] ? __pfx_preempt_schedule+0x10/0x10 [ 266.784065][ T1150] panic+0xb9/0xc0 [ 266.787795][ T1150] ? __pfx_panic+0x10/0x10 [ 266.792235][ T1150] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 266.798148][ T1150] ? __mutex_lock+0x147/0x1350 [ 266.803023][ T1150] check_panic_on_warn+0x89/0xb0 [ 266.807986][ T1150] ? __mutex_lock+0x147/0x1350 [ 266.812779][ T1150] end_report+0x78/0x160 [ 266.817052][ T1150] kasan_report+0x129/0x150 [ 266.821580][ T1150] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 266.827491][ T1150] ? __mutex_lock+0x147/0x1350 [ 266.832302][ T1150] __mutex_lock+0x147/0x1350 [ 266.836940][ T1150] ? __mutex_lock+0x5bb/0x1350 [ 266.841774][ T1150] ? udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 266.848142][ T1150] ? __pfx___mutex_lock+0x10/0x10 [ 266.853301][ T1150] ? do_raw_spin_unlock+0x122/0x240 [ 266.858549][ T1150] ? rcu_is_watching+0x15/0xb0 [ 266.863337][ T1150] udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 266.869440][ T1150] ? process_scheduled_works+0x9ef/0x17b0 [ 266.875191][ T1150] ? process_scheduled_works+0x9ef/0x17b0 [ 266.880924][ T1150] process_scheduled_works+0xae1/0x17b0 [ 266.886515][ T1150] ? __pfx_process_scheduled_works+0x10/0x10 [ 266.892514][ T1150] worker_thread+0x8a0/0xda0 [ 266.897226][ T1150] kthread+0x70e/0x8a0 [ 266.901400][ T1150] ? __pfx_worker_thread+0x10/0x10 [ 266.906698][ T1150] ? __pfx_kthread+0x10/0x10 [ 266.911315][ T1150] ? rcu_is_watching+0x15/0xb0 [ 266.916199][ T1150] ? __pfx_kthread+0x10/0x10 [ 266.920812][ T1150] ret_from_fork+0x3f9/0x770 [ 266.925432][ T1150] ? __pfx_ret_from_fork+0x10/0x10 [ 266.930553][ T1150] ? __switch_to_asm+0x39/0x70 [ 266.935330][ T1150] ? __switch_to_asm+0x33/0x70 [ 266.940112][ T1150] ? __pfx_kthread+0x10/0x10 [ 266.944718][ T1150] ret_from_fork_asm+0x1a/0x30 [ 266.949505][ T1150] [ 266.952897][ T1150] Kernel Offset: disabled [ 266.957225][ T1150] Rebooting in 86400 seconds..